Merge pull request #3171 from MathiasVP/init-dynamic-alloc-newexpr

C++: Emit InitializeDynamicAllocation instructions for NewExpr and NewArrayExpr

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll

@@ -206,7 +206,44 @@ abstract class TranslatedCall extends TranslatedExpr {
 
   predicate hasPreciseSideEffect() { exists(getSideEffects()) }
 
-  TranslatedSideEffects getSideEffects() { result.getCall() = expr }
+  final TranslatedSideEffects getSideEffects() { result.getExpr() = expr }
+}
+
+abstract class TranslatedSideEffects extends TranslatedElement {
+  abstract Expr getExpr();
+
+  final override Locatable getAST() { result = getExpr() }
+
+  final override Function getFunction() { result = getExpr().getEnclosingFunction() }
+
+  override TranslatedElement getChild(int i) {
+    result =
+      rank[i + 1](TranslatedSideEffect tse, int isWrite, int index |
+        (
+          tse.getCall() = getExpr() and
+          tse.getArgumentIndex() = index and
+          if tse.isWrite() then isWrite = 1 else isWrite = 0
+        )
+      |
+        tse order by isWrite, index
+      )
+  }
+
+  final override Instruction getChildSuccessor(TranslatedElement te) {
+    exists(int i |
+      getChild(i) = te and
+      if exists(getChild(i + 1))
+      then result = getChild(i + 1).getFirstInstruction()
+      else result = getParent().getChildSuccessor(this)
+    )
+  }
+
+  /**
+   * Gets the `TranslatedFunction` containing this expression.
+   */
+  final TranslatedFunction getEnclosingFunction() {
+    result = getTranslatedFunction(getExpr().getEnclosingFunction())
+  }
 }
 
 /**
@@ -308,66 +345,27 @@ class TranslatedStructorCall extends TranslatedFunctionCall {
   override predicate hasQualifier() { any() }
 }
 
-class TranslatedSideEffects extends TranslatedElement, TTranslatedSideEffects {
-  Call expr;
+class TranslatedAllocationSideEffects extends TranslatedSideEffects,
+  TTranslatedAllocationSideEffects {
+  AllocationExpr expr;
 
-  TranslatedSideEffects() { this = TTranslatedSideEffects(expr) }
+  TranslatedAllocationSideEffects() { this = TTranslatedAllocationSideEffects(expr) }
 
-  override string toString() { result = "(side effects  for " + expr.toString() + ")" }
+  final override AllocationExpr getExpr() { result = expr }
 
-  override Locatable getAST() { result = expr }
+  override string toString() { result = "(allocation side effects for " + expr.toString() + ")" }
 
-  Call getCall() { result = expr }
-
-  override TranslatedElement getChild(int i) {
-    result =
-      rank[i + 1](TranslatedSideEffect tse, int isWrite, int index |
-        (
-          tse.getCall() = getCall() and
-          tse.getArgumentIndex() = index and
-          if tse.isWrite() then isWrite = 1 else isWrite = 0
-        )
-      |
-        tse order by isWrite, index
-      )
-  }
-
-  override Instruction getChildSuccessor(TranslatedElement te) {
-    exists(int i |
-      getChild(i) = te and
-      if exists(getChild(i + 1))
-      then result = getChild(i + 1).getFirstInstruction()
-      else result = getParent().getChildSuccessor(this)
-    )
-  }
+  override Instruction getFirstInstruction() { result = getInstruction(OnlyInstructionTag()) }
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType type) {
-    expr.getTarget() instanceof AllocationFunction and
-    not exists(NewOrNewArrayExpr newExpr |
-      // we synthesize allocator calls for `new` and `new[]`, so don't add instructions to
-      // the existing allocator call when it exists.
-      newExpr.getAllocatorCall() = expr
-    ) and
     opcode instanceof Opcode::InitializeDynamicAllocation and
     tag = OnlyInstructionTag() and
     type = getUnknownType()
   }
 
-  override Instruction getFirstInstruction() {
-    if expr.getTarget() instanceof AllocationFunction
-    then result = getInstruction(OnlyInstructionTag())
-    else result = getChild(0).getFirstInstruction()
-  }
-
   override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
     tag = OnlyInstructionTag() and
     kind = gotoEdge() and
-    expr.getTarget() instanceof AllocationFunction and
-    not exists(NewOrNewArrayExpr newExpr |
-      // we synthesize allocator calls for `new` and `new[]`, so don't add instructions to
-      // the existing allocator call when it exists.
-      newExpr.getAllocatorCall() = expr
-    ) and
     if exists(getChild(0))
     then result = getChild(0).getFirstInstruction()
     else result = getParent().getChildSuccessor(this)
@@ -381,23 +379,34 @@ class TranslatedSideEffects extends TranslatedElement, TTranslatedSideEffects {
 
   override Instruction getPrimaryInstructionForSideEffect(InstructionTag tag) {
     tag = OnlyInstructionTag() and
-    result = getTranslatedExpr(expr).getInstruction(CallTag())
+    if expr instanceof NewOrNewArrayExpr
+    then result = getTranslatedAllocatorCall(expr).getInstruction(CallTag())
+    else result = getTranslatedExpr(expr).getInstruction(CallTag())
   }
-
-  /**
-   * Gets the `TranslatedFunction` containing this expression.
-   */
-  final TranslatedFunction getEnclosingFunction() {
-    result = getTranslatedFunction(expr.getEnclosingFunction())
-  }
-
-  /**
-   * Gets the `Function` containing this expression.
-   */
-  override Function getFunction() { result = expr.getEnclosingFunction() }
 }
 
-class TranslatedStructorCallSideEffects extends TranslatedSideEffects {
+class TranslatedCallSideEffects extends TranslatedSideEffects, TTranslatedCallSideEffects {
+  Call expr;
+
+  TranslatedCallSideEffects() { this = TTranslatedCallSideEffects(expr) }
+
+  override string toString() { result = "(side effects  for " + expr.toString() + ")" }
+
+  override Call getExpr() { result = expr }
+
+  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType type) { none() }
+
+  override Instruction getFirstInstruction() { result = getChild(0).getFirstInstruction() }
+
+  override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) { none() }
+
+  override Instruction getPrimaryInstructionForSideEffect(InstructionTag tag) {
+    tag = OnlyInstructionTag() and
+    result = getTranslatedExpr(expr).getInstruction(CallTag())
+  }
+}
+
+class TranslatedStructorCallSideEffects extends TranslatedCallSideEffects {
   TranslatedStructorCallSideEffects() { getParent().(TranslatedStructorCall).hasQualifier() }
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType t) {

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -442,11 +442,22 @@ newtype TTranslatedElement =
   // The declaration/initialization part of a `ConditionDeclExpr`
   TTranslatedConditionDecl(ConditionDeclExpr expr) { not ignoreExpr(expr) } or
   // The side effects of a `Call`
-  TTranslatedSideEffects(Call expr) {
-    exists(TTranslatedArgumentSideEffect(expr, _, _, _)) or
-    expr instanceof ConstructorCall or
-    expr.getTarget() instanceof AllocationFunction
-  } or // A precise side effect of an argument to a `Call`
+  TTranslatedCallSideEffects(Call expr) {
+    // Exclude allocations such as `malloc` (which happen to also be function calls).
+    // Both `TranslatedCallSideEffects` and `TranslatedAllocationSideEffects` generate
+    // the same side effects for its children as they both extend the `TranslatedSideEffects`
+    // class.
+    // Note: We can separate allocation side effects and call side effects into two
+    // translated elements as no call can be both a `ConstructorCall` and an `AllocationExpr`.
+    not expr instanceof AllocationExpr and
+    (
+      exists(TTranslatedArgumentSideEffect(expr, _, _, _)) or
+      expr instanceof ConstructorCall
+    )
+  } or
+  // The side effects of an allocation, i.e. `new`, `new[]` or `malloc`
+  TTranslatedAllocationSideEffects(AllocationExpr expr) or
+  // A precise side effect of an argument to a `Call`
   TTranslatedArgumentSideEffect(Call call, Expr expr, int n, boolean isWrite) {
     (
       expr = call.getArgument(n).getFullyConverted()

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll

@@ -1649,6 +1649,11 @@ class TranslatedAllocatorCall extends TTranslatedAllocatorCall, TranslatedDirect
 
   final override int getNumberOfArguments() {
     result = expr.getAllocatorCall().getNumberOfArguments()
+    or
+    // Make sure there's a result even when there is no allocator, as otherwise
+    // TranslatedCall::getChild() will not return the side effects for this call.
+    not exists(expr.getAllocatorCall()) and
+    result = 0
   }
 
   final override TranslatedExpr getArgument(int index) {

cpp/ql/test/library-tests/dataflow/security-taint/tainted.expected

@@ -73,3 +73,18 @@
 | test.cpp:100:17:100:22 | buffer | test.cpp:93:18:93:18 | s |  |
 | test.cpp:100:17:100:22 | buffer | test.cpp:97:7:97:12 | buffer |  |
 | test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | buffer |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:8:24:8:25 | s1 |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:11:20:11:21 | s1 |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:11:36:11:37 | s2 |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:17:106:24 | userName |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:28:106:33 | call to getenv |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:28:106:46 | (const char *)... |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:108:8:108:11 | copy |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:2:109:7 | call to strcpy |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:9:109:12 | copy |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:15:109:22 | userName |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:6:111:27 | ! ... |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:12 | call to strcmp |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:27 | (bool)... |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | (const char *)... |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | copy |  |

cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected

@@ -14,3 +14,6 @@
 | test.cpp:100:12:100:15 | call to gets | test.cpp:100:2:100:8 | pointer | AST only |
 | test.cpp:100:17:100:22 | buffer | test.cpp:97:7:97:12 | buffer | AST only |
 | test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | array to pointer conversion | IR only |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:108:8:108:11 | copy | AST only |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:9:109:12 | copy | AST only |

cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected

@@ -57,3 +57,15 @@
 | test.cpp:100:17:100:22 | buffer | test.cpp:93:18:93:18 | s |  |
 | test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | array to pointer conversion |  |
 | test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | buffer |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:8:24:8:25 | s1 |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:11:36:11:37 | s2 |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:17:106:24 | userName |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:28:106:33 | call to getenv |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:106:28:106:46 | (const char *)... |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:2:109:7 | call to strcpy |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:109:15:109:22 | userName |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:6:111:27 | ! ... |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:12 | call to strcmp |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:7:111:27 | (bool)... |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | (const char *)... |  |
+| test.cpp:106:28:106:33 | call to getenv | test.cpp:111:14:111:17 | copy |  |

cpp/ql/test/library-tests/dataflow/security-taint/test.cpp

@@ -99,3 +99,16 @@ void test_gets()
 
 	pointer = gets(buffer);
 }
+
+const char *alias_global_new;
+
+void newBuffer() {
+    const char *userName = getenv("USER_NAME");
+	char *alias = new char[4096];
+	char *copy = new char[4096];
+	strcpy(copy, userName);
+	alias_global_new = alias; // to force a Chi node on all aliased memory
+	if (!strcmp(copy, "admin")) { // copy should be tainted
+		isAdmin = true;
+	}
+}

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -4664,58 +4664,65 @@ ir.cpp:
 #  950|     r950_2(unsigned long)  = Constant[4]                     : 
 #  950|     r950_3(void *)         = Call                            : func:r950_1, 0:r950_2
 #  950|     mu950_4(unknown)       = ^CallSideEffect                 : ~mu949_4
-#  950|     r950_5(int *)          = Convert                         : r950_3
+#  950|     mu950_5(unknown)       = ^InitializeDynamicAllocation    : &:r950_3
+#  950|     r950_6(int *)          = Convert                         : r950_3
 #  951|     r951_1(glval<unknown>) = FunctionAddress[operator new]   : 
 #  951|     r951_2(unsigned long)  = Constant[4]                     : 
 #  951|     r951_3(float)          = Constant[1.0]                   : 
 #  951|     r951_4(void *)         = Call                            : func:r951_1, 0:r951_2, 1:r951_3
 #  951|     mu951_5(unknown)       = ^CallSideEffect                 : ~mu949_4
-#  951|     r951_6(int *)          = Convert                         : r951_4
+#  951|     mu951_6(unknown)       = ^InitializeDynamicAllocation    : &:r951_4
+#  951|     r951_7(int *)          = Convert                         : r951_4
 #  952|     r952_1(glval<unknown>) = FunctionAddress[operator new]   : 
 #  952|     r952_2(unsigned long)  = Constant[4]                     : 
 #  952|     r952_3(void *)         = Call                            : func:r952_1, 0:r952_2
 #  952|     mu952_4(unknown)       = ^CallSideEffect                 : ~mu949_4
-#  952|     r952_5(int *)          = Convert                         : r952_3
-#  952|     r952_6(int)            = Constant[0]                     : 
-#  952|     mu952_7(int)           = Store                           : &:r952_5, r952_6
+#  952|     mu952_5(unknown)       = ^InitializeDynamicAllocation    : &:r952_3
+#  952|     r952_6(int *)          = Convert                         : r952_3
+#  952|     r952_7(int)            = Constant[0]                     : 
+#  952|     mu952_8(int)           = Store                           : &:r952_6, r952_7
 #  953|     r953_1(glval<unknown>) = FunctionAddress[operator new]   : 
 #  953|     r953_2(unsigned long)  = Constant[8]                     : 
 #  953|     r953_3(void *)         = Call                            : func:r953_1, 0:r953_2
 #  953|     mu953_4(unknown)       = ^CallSideEffect                 : ~mu949_4
-#  953|     r953_5(String *)       = Convert                         : r953_3
-#  953|     r953_6(glval<unknown>) = FunctionAddress[String]         : 
-#  953|     v953_7(void)           = Call                            : func:r953_6, this:r953_5
-#  953|     mu953_8(unknown)       = ^CallSideEffect                 : ~mu949_4
-#  953|     mu953_9(String)        = ^IndirectMayWriteSideEffect[-1] : &:r953_5
+#  953|     mu953_5(unknown)       = ^InitializeDynamicAllocation    : &:r953_3
+#  953|     r953_6(String *)       = Convert                         : r953_3
+#  953|     r953_7(glval<unknown>) = FunctionAddress[String]         : 
+#  953|     v953_8(void)           = Call                            : func:r953_7, this:r953_6
+#  953|     mu953_9(unknown)       = ^CallSideEffect                 : ~mu949_4
+#  953|     mu953_10(String)       = ^IndirectMayWriteSideEffect[-1] : &:r953_6
 #  954|     r954_1(glval<unknown>) = FunctionAddress[operator new]   : 
 #  954|     r954_2(unsigned long)  = Constant[8]                     : 
 #  954|     r954_3(float)          = Constant[1.0]                   : 
 #  954|     r954_4(void *)         = Call                            : func:r954_1, 0:r954_2, 1:r954_3
 #  954|     mu954_5(unknown)       = ^CallSideEffect                 : ~mu949_4
-#  954|     r954_6(String *)       = Convert                         : r954_4
-#  954|     r954_7(glval<unknown>) = FunctionAddress[String]         : 
-#  954|     r954_8(glval<char[6]>) = StringConstant["hello"]         : 
-#  954|     r954_9(char *)         = Convert                         : r954_8
-#  954|     v954_10(void)          = Call                            : func:r954_7, this:r954_6, 0:r954_9
-#  954|     mu954_11(unknown)      = ^CallSideEffect                 : ~mu949_4
-#  954|     mu954_12(String)       = ^IndirectMayWriteSideEffect[-1] : &:r954_6
-#  954|     v954_13(void)          = ^BufferReadSideEffect[0]        : &:r954_9, ~mu949_4
-#  954|     mu954_14(unknown)      = ^BufferMayWriteSideEffect[0]    : &:r954_9
+#  954|     mu954_6(unknown)       = ^InitializeDynamicAllocation    : &:r954_4
+#  954|     r954_7(String *)       = Convert                         : r954_4
+#  954|     r954_8(glval<unknown>) = FunctionAddress[String]         : 
+#  954|     r954_9(glval<char[6]>) = StringConstant["hello"]         : 
+#  954|     r954_10(char *)        = Convert                         : r954_9
+#  954|     v954_11(void)          = Call                            : func:r954_8, this:r954_7, 0:r954_10
+#  954|     mu954_12(unknown)      = ^CallSideEffect                 : ~mu949_4
+#  954|     mu954_13(String)       = ^IndirectMayWriteSideEffect[-1] : &:r954_7
+#  954|     v954_14(void)          = ^BufferReadSideEffect[0]        : &:r954_10, ~mu949_4
+#  954|     mu954_15(unknown)      = ^BufferMayWriteSideEffect[0]    : &:r954_10
 #  955|     r955_1(glval<unknown>) = FunctionAddress[operator new]   : 
 #  955|     r955_2(unsigned long)  = Constant[256]                   : 
 #  955|     r955_3(align_val_t)    = Constant[128]                   : 
 #  955|     r955_4(void *)         = Call                            : func:r955_1, 0:r955_2, 1:r955_3
 #  955|     mu955_5(unknown)       = ^CallSideEffect                 : ~mu949_4
-#  955|     r955_6(Overaligned *)  = Convert                         : r955_4
+#  955|     mu955_6(unknown)       = ^InitializeDynamicAllocation    : &:r955_4
+#  955|     r955_7(Overaligned *)  = Convert                         : r955_4
 #  956|     r956_1(glval<unknown>) = FunctionAddress[operator new]   : 
 #  956|     r956_2(unsigned long)  = Constant[256]                   : 
 #  956|     r956_3(align_val_t)    = Constant[128]                   : 
 #  956|     r956_4(float)          = Constant[1.0]                   : 
 #  956|     r956_5(void *)         = Call                            : func:r956_1, 0:r956_2, 1:r956_3, 2:r956_4
 #  956|     mu956_6(unknown)       = ^CallSideEffect                 : ~mu949_4
-#  956|     r956_7(Overaligned *)  = Convert                         : r956_5
-#  956|     r956_8(Overaligned)    = Constant[0]                     : 
-#  956|     mu956_9(Overaligned)   = Store                           : &:r956_7, r956_8
+#  956|     mu956_7(unknown)       = ^InitializeDynamicAllocation    : &:r956_5
+#  956|     r956_8(Overaligned *)  = Convert                         : r956_5
+#  956|     r956_9(Overaligned)    = Constant[0]                     : 
+#  956|     mu956_10(Overaligned)  = Store                           : &:r956_8, r956_9
 #  957|     v957_1(void)           = NoOp                            : 
 #  949|     v949_5(void)           = ReturnVoid                      : 
 #  949|     v949_6(void)           = UnmodeledUse                    : mu*
@@ -4724,85 +4731,93 @@ ir.cpp:
 
 #  959| void OperatorNewArray(int)
 #  959|   Block 0
-#  959|     v959_1(void)                          = EnterFunction                   : 
-#  959|     mu959_2(unknown)                      = AliasedDefinition               : 
-#  959|     mu959_3(unknown)                      = InitializeNonLocal              : 
-#  959|     mu959_4(unknown)                      = UnmodeledDefinition             : 
-#  959|     r959_5(glval<int>)                    = VariableAddress[n]              : 
-#  959|     mu959_6(int)                          = InitializeParameter[n]          : &:r959_5
-#  960|     r960_1(glval<unknown>)                = FunctionAddress[operator new[]] : 
-#  960|     r960_2(unsigned long)                 = Constant[40]                    : 
-#  960|     r960_3(void *)                        = Call                            : func:r960_1, 0:r960_2
-#  960|     mu960_4(unknown)                      = ^CallSideEffect                 : ~mu959_4
-#  960|     r960_5(int *)                         = Convert                         : r960_3
-#  961|     r961_1(glval<unknown>)                = FunctionAddress[operator new[]] : 
-#  961|     r961_2(glval<int>)                    = VariableAddress[n]              : 
-#  961|     r961_3(int)                           = Load                            : &:r961_2, ~mu959_4
-#  961|     r961_4(unsigned long)                 = Convert                         : r961_3
-#  961|     r961_5(unsigned long)                 = Constant[4]                     : 
-#  961|     r961_6(unsigned long)                 = Mul                             : r961_4, r961_5
-#  961|     r961_7(void *)                        = Call                            : func:r961_1, 0:r961_6
-#  961|     mu961_8(unknown)                      = ^CallSideEffect                 : ~mu959_4
-#  961|     r961_9(int *)                         = Convert                         : r961_7
-#  962|     r962_1(glval<unknown>)                = FunctionAddress[operator new[]] : 
-#  962|     r962_2(glval<int>)                    = VariableAddress[n]              : 
-#  962|     r962_3(int)                           = Load                            : &:r962_2, ~mu959_4
-#  962|     r962_4(unsigned long)                 = Convert                         : r962_3
-#  962|     r962_5(unsigned long)                 = Constant[4]                     : 
-#  962|     r962_6(unsigned long)                 = Mul                             : r962_4, r962_5
-#  962|     r962_7(float)                         = Constant[1.0]                   : 
-#  962|     r962_8(void *)                        = Call                            : func:r962_1, 0:r962_6, 1:r962_7
-#  962|     mu962_9(unknown)                      = ^CallSideEffect                 : ~mu959_4
-#  962|     r962_10(int *)                        = Convert                         : r962_8
-#  963|     r963_1(glval<unknown>)                = FunctionAddress[operator new[]] : 
-#  963|     r963_2(glval<int>)                    = VariableAddress[n]              : 
-#  963|     r963_3(int)                           = Load                            : &:r963_2, ~mu959_4
-#  963|     r963_4(unsigned long)                 = Convert                         : r963_3
-#  963|     r963_5(unsigned long)                 = Constant[8]                     : 
-#  963|     r963_6(unsigned long)                 = Mul                             : r963_4, r963_5
-#  963|     r963_7(void *)                        = Call                            : func:r963_1, 0:r963_6
-#  963|     mu963_8(unknown)                      = ^CallSideEffect                 : ~mu959_4
-#  963|     r963_9(String *)                      = Convert                         : r963_7
-#  964|     r964_1(glval<unknown>)                = FunctionAddress[operator new[]] : 
-#  964|     r964_2(glval<int>)                    = VariableAddress[n]              : 
-#  964|     r964_3(int)                           = Load                            : &:r964_2, ~mu959_4
-#  964|     r964_4(unsigned long)                 = Convert                         : r964_3
-#  964|     r964_5(unsigned long)                 = Constant[256]                   : 
-#  964|     r964_6(unsigned long)                 = Mul                             : r964_4, r964_5
-#  964|     r964_7(align_val_t)                   = Constant[128]                   : 
-#  964|     r964_8(void *)                        = Call                            : func:r964_1, 0:r964_6, 1:r964_7
-#  964|     mu964_9(unknown)                      = ^CallSideEffect                 : ~mu959_4
-#  964|     r964_10(Overaligned *)                = Convert                         : r964_8
-#  965|     r965_1(glval<unknown>)                = FunctionAddress[operator new[]] : 
-#  965|     r965_2(unsigned long)                 = Constant[2560]                  : 
-#  965|     r965_3(align_val_t)                   = Constant[128]                   : 
-#  965|     r965_4(float)                         = Constant[1.0]                   : 
-#  965|     r965_5(void *)                        = Call                            : func:r965_1, 0:r965_2, 1:r965_3, 2:r965_4
-#  965|     mu965_6(unknown)                      = ^CallSideEffect                 : ~mu959_4
-#  965|     r965_7(Overaligned *)                 = Convert                         : r965_5
-#  966|     r966_1(glval<unknown>)                = FunctionAddress[operator new[]] : 
-#  966|     r966_2(glval<int>)                    = VariableAddress[n]              : 
-#  966|     r966_3(int)                           = Load                            : &:r966_2, ~mu959_4
-#  966|     r966_4(unsigned long)                 = Convert                         : r966_3
-#  966|     r966_5(unsigned long)                 = Constant[1]                     : 
-#  966|     r966_6(unsigned long)                 = Mul                             : r966_4, r966_5
-#  966|     r966_7(void *)                        = Call                            : func:r966_1, 0:r966_6
-#  966|     mu966_8(unknown)                      = ^CallSideEffect                 : ~mu959_4
-#  966|     r966_9(DefaultCtorWithDefaultParam *) = Convert                         : r966_7
-#  967|     r967_1(glval<unknown>)                = FunctionAddress[operator new[]] : 
-#  967|     r967_2(glval<int>)                    = VariableAddress[n]              : 
-#  967|     r967_3(int)                           = Load                            : &:r967_2, ~mu959_4
-#  967|     r967_4(unsigned long)                 = Convert                         : r967_3
-#  967|     r967_5(unsigned long)                 = Constant[4]                     : 
-#  967|     r967_6(unsigned long)                 = Mul                             : r967_4, r967_5
-#  967|     r967_7(void *)                        = Call                            : func:r967_1, 0:r967_6
-#  967|     mu967_8(unknown)                      = ^CallSideEffect                 : ~mu959_4
-#  967|     r967_9(int *)                         = Convert                         : r967_7
-#  968|     v968_1(void)                          = NoOp                            : 
-#  959|     v959_7(void)                          = ReturnVoid                      : 
-#  959|     v959_8(void)                          = UnmodeledUse                    : mu*
-#  959|     v959_9(void)                          = AliasedUse                      : ~mu959_4
-#  959|     v959_10(void)                         = ExitFunction                    : 
+#  959|     v959_1(void)                           = EnterFunction                   : 
+#  959|     mu959_2(unknown)                       = AliasedDefinition               : 
+#  959|     mu959_3(unknown)                       = InitializeNonLocal              : 
+#  959|     mu959_4(unknown)                       = UnmodeledDefinition             : 
+#  959|     r959_5(glval<int>)                     = VariableAddress[n]              : 
+#  959|     mu959_6(int)                           = InitializeParameter[n]          : &:r959_5
+#  960|     r960_1(glval<unknown>)                 = FunctionAddress[operator new[]] : 
+#  960|     r960_2(unsigned long)                  = Constant[40]                    : 
+#  960|     r960_3(void *)                         = Call                            : func:r960_1, 0:r960_2
+#  960|     mu960_4(unknown)                       = ^CallSideEffect                 : ~mu959_4
+#  960|     mu960_5(unknown)                       = ^InitializeDynamicAllocation    : &:r960_3
+#  960|     r960_6(int *)                          = Convert                         : r960_3
+#  961|     r961_1(glval<unknown>)                 = FunctionAddress[operator new[]] : 
+#  961|     r961_2(glval<int>)                     = VariableAddress[n]              : 
+#  961|     r961_3(int)                            = Load                            : &:r961_2, ~mu959_4
+#  961|     r961_4(unsigned long)                  = Convert                         : r961_3
+#  961|     r961_5(unsigned long)                  = Constant[4]                     : 
+#  961|     r961_6(unsigned long)                  = Mul                             : r961_4, r961_5
+#  961|     r961_7(void *)                         = Call                            : func:r961_1, 0:r961_6
+#  961|     mu961_8(unknown)                       = ^CallSideEffect                 : ~mu959_4
+#  961|     mu961_9(unknown)                       = ^InitializeDynamicAllocation    : &:r961_7
+#  961|     r961_10(int *)                         = Convert                         : r961_7
+#  962|     r962_1(glval<unknown>)                 = FunctionAddress[operator new[]] : 
+#  962|     r962_2(glval<int>)                     = VariableAddress[n]              : 
+#  962|     r962_3(int)                            = Load                            : &:r962_2, ~mu959_4
+#  962|     r962_4(unsigned long)                  = Convert                         : r962_3
+#  962|     r962_5(unsigned long)                  = Constant[4]                     : 
+#  962|     r962_6(unsigned long)                  = Mul                             : r962_4, r962_5
+#  962|     r962_7(float)                          = Constant[1.0]                   : 
+#  962|     r962_8(void *)                         = Call                            : func:r962_1, 0:r962_6, 1:r962_7
+#  962|     mu962_9(unknown)                       = ^CallSideEffect                 : ~mu959_4
+#  962|     mu962_10(unknown)                      = ^InitializeDynamicAllocation    : &:r962_8
+#  962|     r962_11(int *)                         = Convert                         : r962_8
+#  963|     r963_1(glval<unknown>)                 = FunctionAddress[operator new[]] : 
+#  963|     r963_2(glval<int>)                     = VariableAddress[n]              : 
+#  963|     r963_3(int)                            = Load                            : &:r963_2, ~mu959_4
+#  963|     r963_4(unsigned long)                  = Convert                         : r963_3
+#  963|     r963_5(unsigned long)                  = Constant[8]                     : 
+#  963|     r963_6(unsigned long)                  = Mul                             : r963_4, r963_5
+#  963|     r963_7(void *)                         = Call                            : func:r963_1, 0:r963_6
+#  963|     mu963_8(unknown)                       = ^CallSideEffect                 : ~mu959_4
+#  963|     mu963_9(unknown)                       = ^InitializeDynamicAllocation    : &:r963_7
+#  963|     r963_10(String *)                      = Convert                         : r963_7
+#  964|     r964_1(glval<unknown>)                 = FunctionAddress[operator new[]] : 
+#  964|     r964_2(glval<int>)                     = VariableAddress[n]              : 
+#  964|     r964_3(int)                            = Load                            : &:r964_2, ~mu959_4
+#  964|     r964_4(unsigned long)                  = Convert                         : r964_3
+#  964|     r964_5(unsigned long)                  = Constant[256]                   : 
+#  964|     r964_6(unsigned long)                  = Mul                             : r964_4, r964_5
+#  964|     r964_7(align_val_t)                    = Constant[128]                   : 
+#  964|     r964_8(void *)                         = Call                            : func:r964_1, 0:r964_6, 1:r964_7
+#  964|     mu964_9(unknown)                       = ^CallSideEffect                 : ~mu959_4
+#  964|     mu964_10(unknown)                      = ^InitializeDynamicAllocation    : &:r964_8
+#  964|     r964_11(Overaligned *)                 = Convert                         : r964_8
+#  965|     r965_1(glval<unknown>)                 = FunctionAddress[operator new[]] : 
+#  965|     r965_2(unsigned long)                  = Constant[2560]                  : 
+#  965|     r965_3(align_val_t)                    = Constant[128]                   : 
+#  965|     r965_4(float)                          = Constant[1.0]                   : 
+#  965|     r965_5(void *)                         = Call                            : func:r965_1, 0:r965_2, 1:r965_3, 2:r965_4
+#  965|     mu965_6(unknown)                       = ^CallSideEffect                 : ~mu959_4
+#  965|     mu965_7(unknown)                       = ^InitializeDynamicAllocation    : &:r965_5
+#  965|     r965_8(Overaligned *)                  = Convert                         : r965_5
+#  966|     r966_1(glval<unknown>)                 = FunctionAddress[operator new[]] : 
+#  966|     r966_2(glval<int>)                     = VariableAddress[n]              : 
+#  966|     r966_3(int)                            = Load                            : &:r966_2, ~mu959_4
+#  966|     r966_4(unsigned long)                  = Convert                         : r966_3
+#  966|     r966_5(unsigned long)                  = Constant[1]                     : 
+#  966|     r966_6(unsigned long)                  = Mul                             : r966_4, r966_5
+#  966|     r966_7(void *)                         = Call                            : func:r966_1, 0:r966_6
+#  966|     mu966_8(unknown)                       = ^CallSideEffect                 : ~mu959_4
+#  966|     mu966_9(unknown)                       = ^InitializeDynamicAllocation    : &:r966_7
+#  966|     r966_10(DefaultCtorWithDefaultParam *) = Convert                         : r966_7
+#  967|     r967_1(glval<unknown>)                 = FunctionAddress[operator new[]] : 
+#  967|     r967_2(glval<int>)                     = VariableAddress[n]              : 
+#  967|     r967_3(int)                            = Load                            : &:r967_2, ~mu959_4
+#  967|     r967_4(unsigned long)                  = Convert                         : r967_3
+#  967|     r967_5(unsigned long)                  = Constant[4]                     : 
+#  967|     r967_6(unsigned long)                  = Mul                             : r967_4, r967_5
+#  967|     r967_7(void *)                         = Call                            : func:r967_1, 0:r967_6
+#  967|     mu967_8(unknown)                       = ^CallSideEffect                 : ~mu959_4
+#  967|     mu967_9(unknown)                       = ^InitializeDynamicAllocation    : &:r967_7
+#  967|     r967_10(int *)                         = Convert                         : r967_7
+#  968|     v968_1(void)                           = NoOp                            : 
+#  959|     v959_7(void)                           = ReturnVoid                      : 
+#  959|     v959_8(void)                           = UnmodeledUse                    : mu*
+#  959|     v959_9(void)                           = AliasedUse                      : ~mu959_4
+#  959|     v959_10(void)                          = ExitFunction                    : 
 
 #  970| int designatedInit()
 #  970|   Block 0
@@ -6498,12 +6513,13 @@ perf-regression.cpp:
 #   10|     r10_3(unsigned long)  = Constant[1073741824]            : 
 #   10|     r10_4(void *)         = Call                            : func:r10_2, 0:r10_3
 #   10|     mu10_5(unknown)       = ^CallSideEffect                 : ~mu9_4
-#   10|     r10_6(Big *)          = Convert                         : r10_4
-#   10|     r10_7(glval<unknown>) = FunctionAddress[Big]            : 
-#   10|     v10_8(void)           = Call                            : func:r10_7, this:r10_6
-#   10|     mu10_9(unknown)       = ^CallSideEffect                 : ~mu9_4
-#   10|     mu10_10(Big)          = ^IndirectMayWriteSideEffect[-1] : &:r10_6
-#   10|     mu10_11(Big *)        = Store                           : &:r10_1, r10_6
+#   10|     mu10_6(unknown)       = ^InitializeDynamicAllocation    : &:r10_4
+#   10|     r10_7(Big *)          = Convert                         : r10_4
+#   10|     r10_8(glval<unknown>) = FunctionAddress[Big]            : 
+#   10|     v10_9(void)           = Call                            : func:r10_8, this:r10_7
+#   10|     mu10_10(unknown)      = ^CallSideEffect                 : ~mu9_4
+#   10|     mu10_11(Big)          = ^IndirectMayWriteSideEffect[-1] : &:r10_7
+#   10|     mu10_12(Big *)        = Store                           : &:r10_1, r10_7
 #   12|     r12_1(glval<int>)     = VariableAddress[#return]        : 
 #   12|     r12_2(int)            = Constant[0]                     : 
 #   12|     mu12_3(int)           = Store                           : &:r12_1, r12_2

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected

@@ -1162,17 +1162,19 @@ ssa.cpp:
 #  248|     r248_8(void *)         = Call                               : func:r248_2, 0:r248_7
 #  248|     m248_9(unknown)        = ^CallSideEffect                    : ~m247_10
 #  248|     m248_10(unknown)       = Chi                                : total:m247_10, partial:m248_9
-#  248|     r248_11(char *)        = Convert                            : r248_8
-#  248|     m248_12(char *)        = Store                              : &:r248_1, r248_11
+#  248|     m248_11(unknown)       = ^InitializeDynamicAllocation       : &:r248_8
+#  248|     m248_12(unknown)       = Chi                                : total:m248_10, partial:m248_11
+#  248|     r248_13(char *)        = Convert                            : r248_8
+#  248|     m248_14(char *)        = Store                              : &:r248_1, r248_13
 #  249|     r249_1(char)           = Constant[97]                       : 
 #  249|     r249_2(glval<char *>)  = VariableAddress[src]               : 
 #  249|     r249_3(char *)         = Load                               : &:r249_2, m247_7
 #  249|     r249_4(glval<char>)    = CopyValue                          : r249_3
 #  249|     m249_5(char)           = Store                              : &:r249_4, r249_1
-#  249|     m249_6(unknown)        = Chi                                : total:m248_10, partial:m249_5
+#  249|     m249_6(unknown)        = Chi                                : total:m248_12, partial:m249_5
 #  250|     r250_1(glval<unknown>) = FunctionAddress[memcpy]            : 
 #  250|     r250_2(glval<char *>)  = VariableAddress[dst]               : 
-#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_12
+#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_14
 #  250|     r250_4(void *)         = Convert                            : r250_3
 #  250|     r250_5(glval<char *>)  = VariableAddress[src]               : 
 #  250|     r250_6(char *)         = Load                               : &:r250_5, m247_7
@@ -1185,7 +1187,7 @@ ssa.cpp:
 #  250|     m250_13(unknown)       = Chi                                : total:m249_6, partial:m250_12
 #  251|     r251_1(glval<char *>)  = VariableAddress[#return]           : 
 #  251|     r251_2(glval<char *>)  = VariableAddress[dst]               : 
-#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_12
+#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_14
 #  251|     m251_4(char *)         = Store                              : &:r251_1, r251_3
 #  247|     v247_13(void)          = ReturnIndirection                  : &:r247_8, ~m250_13
 #  247|     r247_14(glval<char *>) = VariableAddress[#return]           : 
@@ -1345,3 +1347,139 @@ ssa.cpp:
 #  275|     v275_13(void)        = UnmodeledUse       : mu*
 #  275|     v275_14(void)        = AliasedUse         : ~m281_2
 #  275|     v275_15(void)        = ExitFunction       : 
+
+#  286| void A::A(int)
+#  286|   Block 0
+#  286|     v286_1(void)       = EnterFunction          : 
+#  286|     m286_2(unknown)    = AliasedDefinition      : 
+#  286|     m286_3(unknown)    = InitializeNonLocal     : 
+#  286|     m286_4(unknown)    = Chi                    : total:m286_2, partial:m286_3
+#  286|     mu286_5(unknown)   = UnmodeledDefinition    : 
+#  286|     r286_6(glval<A>)   = InitializeThis         : 
+#  286|     r286_7(glval<int>) = VariableAddress[x]     : 
+#  286|     m286_8(int)        = InitializeParameter[x] : &:r286_7
+#  286|     v286_9(void)       = NoOp                   : 
+#  286|     v286_10(void)      = ReturnVoid             : 
+#  286|     v286_11(void)      = UnmodeledUse           : mu*
+#  286|     v286_12(void)      = AliasedUse             : m286_3
+#  286|     v286_13(void)      = ExitFunction           : 
+
+#  287| void A::A(A*)
+#  287|   Block 0
+#  287|     v287_1(void)       = EnterFunction              : 
+#  287|     m287_2(unknown)    = AliasedDefinition          : 
+#  287|     m287_3(unknown)    = InitializeNonLocal         : 
+#  287|     m287_4(unknown)    = Chi                        : total:m287_2, partial:m287_3
+#  287|     mu287_5(unknown)   = UnmodeledDefinition        : 
+#  287|     r287_6(glval<A>)   = InitializeThis             : 
+#  287|     r287_7(glval<A *>) = VariableAddress[p#0]       : 
+#  287|     m287_8(A *)        = InitializeParameter[p#0]   : &:r287_7
+#  287|     r287_9(A *)        = Load                       : &:r287_7, m287_8
+#  287|     m287_10(unknown)   = InitializeIndirection[p#0] : &:r287_9
+#  287|     v287_11(void)      = NoOp                       : 
+#  287|     v287_12(void)      = ReturnIndirection          : &:r287_9, m287_10
+#  287|     v287_13(void)      = ReturnVoid                 : 
+#  287|     v287_14(void)      = UnmodeledUse               : mu*
+#  287|     v287_15(void)      = AliasedUse                 : m287_3
+#  287|     v287_16(void)      = ExitFunction               : 
+
+#  288| void A::A()
+#  288|   Block 0
+#  288|     v288_1(void)     = EnterFunction       : 
+#  288|     m288_2(unknown)  = AliasedDefinition   : 
+#  288|     m288_3(unknown)  = InitializeNonLocal  : 
+#  288|     m288_4(unknown)  = Chi                 : total:m288_2, partial:m288_3
+#  288|     mu288_5(unknown) = UnmodeledDefinition : 
+#  288|     r288_6(glval<A>) = InitializeThis      : 
+#  288|     v288_7(void)     = NoOp                : 
+#  288|     v288_8(void)     = ReturnVoid          : 
+#  288|     v288_9(void)     = UnmodeledUse        : mu*
+#  288|     v288_10(void)    = AliasedUse          : m288_3
+#  288|     v288_11(void)    = ExitFunction        : 
+
+#  291| Point* NewAliasing(int)
+#  291|   Block 0
+#  291|     v291_1(void)            = EnterFunction                   : 
+#  291|     m291_2(unknown)         = AliasedDefinition               : 
+#  291|     m291_3(unknown)         = InitializeNonLocal              : 
+#  291|     m291_4(unknown)         = Chi                             : total:m291_2, partial:m291_3
+#  291|     mu291_5(unknown)        = UnmodeledDefinition             : 
+#  291|     r291_6(glval<int>)      = VariableAddress[x]              : 
+#  291|     m291_7(int)             = InitializeParameter[x]          : &:r291_6
+#  292|     r292_1(glval<Point *>)  = VariableAddress[p]              : 
+#  292|     r292_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  292|     r292_3(unsigned long)   = Constant[8]                     : 
+#  292|     r292_4(void *)          = Call                            : func:r292_2, 0:r292_3
+#  292|     m292_5(unknown)         = ^CallSideEffect                 : ~m291_4
+#  292|     m292_6(unknown)         = Chi                             : total:m291_4, partial:m292_5
+#  292|     m292_7(unknown)         = ^InitializeDynamicAllocation    : &:r292_4
+#  292|     r292_8(Point *)         = Convert                         : r292_4
+#  292|     m292_9(Point *)         = Store                           : &:r292_1, r292_8
+#  293|     r293_1(glval<Point *>)  = VariableAddress[q]              : 
+#  293|     r293_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  293|     r293_3(unsigned long)   = Constant[8]                     : 
+#  293|     r293_4(void *)          = Call                            : func:r293_2, 0:r293_3
+#  293|     m293_5(unknown)         = ^CallSideEffect                 : ~m292_6
+#  293|     m293_6(unknown)         = Chi                             : total:m292_6, partial:m293_5
+#  293|     m293_7(unknown)         = ^InitializeDynamicAllocation    : &:r293_4
+#  293|     r293_8(Point *)         = Convert                         : r293_4
+#  293|     m293_9(Point *)         = Store                           : &:r293_1, r293_8
+#  294|     r294_1(glval<int>)      = VariableAddress[j]              : 
+#  294|     r294_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  294|     r294_3(unsigned long)   = Constant[4]                     : 
+#  294|     r294_4(void *)          = Call                            : func:r294_2, 0:r294_3
+#  294|     m294_5(unknown)         = ^CallSideEffect                 : ~m293_6
+#  294|     m294_6(unknown)         = Chi                             : total:m293_6, partial:m294_5
+#  294|     m294_7(unknown)         = ^InitializeDynamicAllocation    : &:r294_4
+#  294|     r294_8(A *)             = Convert                         : r294_4
+#  294|     r294_9(glval<unknown>)  = FunctionAddress[A]              : 
+#  294|     r294_10(glval<unknown>) = FunctionAddress[operator new]   : 
+#  294|     r294_11(unsigned long)  = Constant[4]                     : 
+#  294|     r294_12(void *)         = Call                            : func:r294_10, 0:r294_11
+#  294|     m294_13(unknown)        = ^CallSideEffect                 : ~m294_6
+#  294|     m294_14(unknown)        = Chi                             : total:m294_6, partial:m294_13
+#  294|     m294_15(unknown)        = ^InitializeDynamicAllocation    : &:r294_12
+#  294|     r294_16(A *)            = Convert                         : r294_12
+#  294|     r294_17(glval<unknown>) = FunctionAddress[A]              : 
+#  294|     r294_18(glval<int>)     = VariableAddress[x]              : 
+#  294|     r294_19(int)            = Load                            : &:r294_18, m291_7
+#  294|     v294_20(void)           = Call                            : func:r294_17, this:r294_16, 0:r294_19
+#  294|     m294_21(unknown)        = ^CallSideEffect                 : ~m294_14
+#  294|     m294_22(unknown)        = Chi                             : total:m294_14, partial:m294_21
+#  294|     m294_23(A)              = ^IndirectMayWriteSideEffect[-1] : &:r294_16
+#  294|     m294_24(unknown)        = Chi                             : total:m294_15, partial:m294_23
+#  294|     v294_25(void)           = Call                            : func:r294_9, this:r294_8, 0:r294_16
+#  294|     m294_26(unknown)        = ^CallSideEffect                 : ~m294_22
+#  294|     m294_27(unknown)        = Chi                             : total:m294_22, partial:m294_26
+#  294|     m294_28(A)              = ^IndirectMayWriteSideEffect[-1] : &:r294_8
+#  294|     m294_29(unknown)        = Chi                             : total:m294_7, partial:m294_28
+#  294|     v294_30(void)           = ^BufferReadSideEffect[0]        : &:r294_16, ~m294_24
+#  294|     m294_31(unknown)        = ^BufferMayWriteSideEffect[0]    : &:r294_16
+#  294|     m294_32(unknown)        = Chi                             : total:m294_24, partial:m294_31
+#  294|     r294_33(glval<int>)     = FieldAddress[i]                 : r294_8
+#  294|     r294_34(int)            = Load                            : &:r294_33, ~m294_29
+#  294|     m294_35(int)            = Store                           : &:r294_1, r294_34
+#  295|     r295_1(glval<A *>)      = VariableAddress[a]              : 
+#  295|     r295_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  295|     r295_3(unsigned long)   = Constant[4]                     : 
+#  295|     r295_4(void *)          = Call                            : func:r295_2, 0:r295_3
+#  295|     m295_5(unknown)         = ^CallSideEffect                 : ~m294_27
+#  295|     m295_6(unknown)         = Chi                             : total:m294_27, partial:m295_5
+#  295|     m295_7(unknown)         = ^InitializeDynamicAllocation    : &:r295_4
+#  295|     r295_8(A *)             = Convert                         : r295_4
+#  295|     r295_9(glval<unknown>)  = FunctionAddress[A]              : 
+#  295|     v295_10(void)           = Call                            : func:r295_9, this:r295_8
+#  295|     m295_11(unknown)        = ^CallSideEffect                 : ~m295_6
+#  295|     m295_12(unknown)        = Chi                             : total:m295_6, partial:m295_11
+#  295|     m295_13(A)              = ^IndirectMayWriteSideEffect[-1] : &:r295_8
+#  295|     m295_14(unknown)        = Chi                             : total:m295_7, partial:m295_13
+#  295|     m295_15(A *)            = Store                           : &:r295_1, r295_8
+#  296|     r296_1(glval<Point *>)  = VariableAddress[#return]        : 
+#  296|     r296_2(glval<Point *>)  = VariableAddress[p]              : 
+#  296|     r296_3(Point *)         = Load                            : &:r296_2, m292_9
+#  296|     m296_4(Point *)         = Store                           : &:r296_1, r296_3
+#  291|     r291_8(glval<Point *>)  = VariableAddress[#return]        : 
+#  291|     v291_9(void)            = ReturnValue                     : &:r291_8, m296_4
+#  291|     v291_10(void)           = UnmodeledUse                    : mu*
+#  291|     v291_11(void)           = AliasedUse                      : ~m295_12
+#  291|     v291_12(void)           = ExitFunction                    : 

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected

@@ -1154,8 +1154,9 @@ ssa.cpp:
 #  248|     r248_8(void *)         = Call                               : func:r248_2, 0:r248_7
 #  248|     m248_9(unknown)        = ^CallSideEffect                    : ~m247_4
 #  248|     m248_10(unknown)       = Chi                                : total:m247_4, partial:m248_9
-#  248|     r248_11(char *)        = Convert                            : r248_8
-#  248|     m248_12(char *)        = Store                              : &:r248_1, r248_11
+#  248|     m248_11(unknown)       = ^InitializeDynamicAllocation       : &:r248_8
+#  248|     r248_12(char *)        = Convert                            : r248_8
+#  248|     m248_13(char *)        = Store                              : &:r248_1, r248_12
 #  249|     r249_1(char)           = Constant[97]                       : 
 #  249|     r249_2(glval<char *>)  = VariableAddress[src]               : 
 #  249|     r249_3(char *)         = Load                               : &:r249_2, m247_7
@@ -1164,7 +1165,7 @@ ssa.cpp:
 #  249|     m249_6(unknown)        = Chi                                : total:m247_9, partial:m249_5
 #  250|     r250_1(glval<unknown>) = FunctionAddress[memcpy]            : 
 #  250|     r250_2(glval<char *>)  = VariableAddress[dst]               : 
-#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_12
+#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_13
 #  250|     r250_4(void *)         = Convert                            : r250_3
 #  250|     r250_5(glval<char *>)  = VariableAddress[src]               : 
 #  250|     r250_6(char *)         = Load                               : &:r250_5, m247_7
@@ -1174,16 +1175,16 @@ ssa.cpp:
 #  250|     r250_10(void *)        = Call                               : func:r250_1, 0:r250_4, 1:r250_7, 2:r250_9
 #  250|     v250_11(void)          = ^SizedBufferReadSideEffect[1]      : &:r250_7, r250_9, ~m249_6
 #  250|     m250_12(unknown)       = ^SizedBufferMustWriteSideEffect[0] : &:r250_4, r250_9
-#  250|     m250_13(unknown)       = Chi                                : total:m248_10, partial:m250_12
+#  250|     m250_13(unknown)       = Chi                                : total:m248_11, partial:m250_12
 #  251|     r251_1(glval<char *>)  = VariableAddress[#return]           : 
 #  251|     r251_2(glval<char *>)  = VariableAddress[dst]               : 
-#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_12
+#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_13
 #  251|     m251_4(char *)         = Store                              : &:r251_1, r251_3
 #  247|     v247_12(void)          = ReturnIndirection                  : &:r247_8, m249_6
 #  247|     r247_13(glval<char *>) = VariableAddress[#return]           : 
 #  247|     v247_14(void)          = ReturnValue                        : &:r247_13, m251_4
 #  247|     v247_15(void)          = UnmodeledUse                       : mu*
-#  247|     v247_16(void)          = AliasedUse                         : ~m250_13
+#  247|     v247_16(void)          = AliasedUse                         : ~m248_10
 #  247|     v247_17(void)          = ExitFunction                       : 
 
 #  254| char StringLiteralAliasing2(bool)
@@ -1334,3 +1335,139 @@ ssa.cpp:
 #  275|     v275_13(void)        = UnmodeledUse       : mu*
 #  275|     v275_14(void)        = AliasedUse         : ~m277_5
 #  275|     v275_15(void)        = ExitFunction       : 
+
+#  286| void A::A(int)
+#  286|   Block 0
+#  286|     v286_1(void)       = EnterFunction          : 
+#  286|     m286_2(unknown)    = AliasedDefinition      : 
+#  286|     m286_3(unknown)    = InitializeNonLocal     : 
+#  286|     m286_4(unknown)    = Chi                    : total:m286_2, partial:m286_3
+#  286|     mu286_5(unknown)   = UnmodeledDefinition    : 
+#  286|     r286_6(glval<A>)   = InitializeThis         : 
+#  286|     r286_7(glval<int>) = VariableAddress[x]     : 
+#  286|     m286_8(int)        = InitializeParameter[x] : &:r286_7
+#  286|     v286_9(void)       = NoOp                   : 
+#  286|     v286_10(void)      = ReturnVoid             : 
+#  286|     v286_11(void)      = UnmodeledUse           : mu*
+#  286|     v286_12(void)      = AliasedUse             : m286_3
+#  286|     v286_13(void)      = ExitFunction           : 
+
+#  287| void A::A(A*)
+#  287|   Block 0
+#  287|     v287_1(void)       = EnterFunction              : 
+#  287|     m287_2(unknown)    = AliasedDefinition          : 
+#  287|     m287_3(unknown)    = InitializeNonLocal         : 
+#  287|     m287_4(unknown)    = Chi                        : total:m287_2, partial:m287_3
+#  287|     mu287_5(unknown)   = UnmodeledDefinition        : 
+#  287|     r287_6(glval<A>)   = InitializeThis             : 
+#  287|     r287_7(glval<A *>) = VariableAddress[p#0]       : 
+#  287|     m287_8(A *)        = InitializeParameter[p#0]   : &:r287_7
+#  287|     r287_9(A *)        = Load                       : &:r287_7, m287_8
+#  287|     m287_10(unknown)   = InitializeIndirection[p#0] : &:r287_9
+#  287|     v287_11(void)      = NoOp                       : 
+#  287|     v287_12(void)      = ReturnIndirection          : &:r287_9, m287_10
+#  287|     v287_13(void)      = ReturnVoid                 : 
+#  287|     v287_14(void)      = UnmodeledUse               : mu*
+#  287|     v287_15(void)      = AliasedUse                 : m287_3
+#  287|     v287_16(void)      = ExitFunction               : 
+
+#  288| void A::A()
+#  288|   Block 0
+#  288|     v288_1(void)     = EnterFunction       : 
+#  288|     m288_2(unknown)  = AliasedDefinition   : 
+#  288|     m288_3(unknown)  = InitializeNonLocal  : 
+#  288|     m288_4(unknown)  = Chi                 : total:m288_2, partial:m288_3
+#  288|     mu288_5(unknown) = UnmodeledDefinition : 
+#  288|     r288_6(glval<A>) = InitializeThis      : 
+#  288|     v288_7(void)     = NoOp                : 
+#  288|     v288_8(void)     = ReturnVoid          : 
+#  288|     v288_9(void)     = UnmodeledUse        : mu*
+#  288|     v288_10(void)    = AliasedUse          : m288_3
+#  288|     v288_11(void)    = ExitFunction        : 
+
+#  291| Point* NewAliasing(int)
+#  291|   Block 0
+#  291|     v291_1(void)            = EnterFunction                   : 
+#  291|     m291_2(unknown)         = AliasedDefinition               : 
+#  291|     m291_3(unknown)         = InitializeNonLocal              : 
+#  291|     m291_4(unknown)         = Chi                             : total:m291_2, partial:m291_3
+#  291|     mu291_5(unknown)        = UnmodeledDefinition             : 
+#  291|     r291_6(glval<int>)      = VariableAddress[x]              : 
+#  291|     m291_7(int)             = InitializeParameter[x]          : &:r291_6
+#  292|     r292_1(glval<Point *>)  = VariableAddress[p]              : 
+#  292|     r292_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  292|     r292_3(unsigned long)   = Constant[8]                     : 
+#  292|     r292_4(void *)          = Call                            : func:r292_2, 0:r292_3
+#  292|     m292_5(unknown)         = ^CallSideEffect                 : ~m291_4
+#  292|     m292_6(unknown)         = Chi                             : total:m291_4, partial:m292_5
+#  292|     m292_7(unknown)         = ^InitializeDynamicAllocation    : &:r292_4
+#  292|     r292_8(Point *)         = Convert                         : r292_4
+#  292|     m292_9(Point *)         = Store                           : &:r292_1, r292_8
+#  293|     r293_1(glval<Point *>)  = VariableAddress[q]              : 
+#  293|     r293_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  293|     r293_3(unsigned long)   = Constant[8]                     : 
+#  293|     r293_4(void *)          = Call                            : func:r293_2, 0:r293_3
+#  293|     m293_5(unknown)         = ^CallSideEffect                 : ~m292_6
+#  293|     m293_6(unknown)         = Chi                             : total:m292_6, partial:m293_5
+#  293|     m293_7(unknown)         = ^InitializeDynamicAllocation    : &:r293_4
+#  293|     r293_8(Point *)         = Convert                         : r293_4
+#  293|     m293_9(Point *)         = Store                           : &:r293_1, r293_8
+#  294|     r294_1(glval<int>)      = VariableAddress[j]              : 
+#  294|     r294_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  294|     r294_3(unsigned long)   = Constant[4]                     : 
+#  294|     r294_4(void *)          = Call                            : func:r294_2, 0:r294_3
+#  294|     m294_5(unknown)         = ^CallSideEffect                 : ~m293_6
+#  294|     m294_6(unknown)         = Chi                             : total:m293_6, partial:m294_5
+#  294|     m294_7(unknown)         = ^InitializeDynamicAllocation    : &:r294_4
+#  294|     r294_8(A *)             = Convert                         : r294_4
+#  294|     r294_9(glval<unknown>)  = FunctionAddress[A]              : 
+#  294|     r294_10(glval<unknown>) = FunctionAddress[operator new]   : 
+#  294|     r294_11(unsigned long)  = Constant[4]                     : 
+#  294|     r294_12(void *)         = Call                            : func:r294_10, 0:r294_11
+#  294|     m294_13(unknown)        = ^CallSideEffect                 : ~m294_6
+#  294|     m294_14(unknown)        = Chi                             : total:m294_6, partial:m294_13
+#  294|     m294_15(unknown)        = ^InitializeDynamicAllocation    : &:r294_12
+#  294|     r294_16(A *)            = Convert                         : r294_12
+#  294|     r294_17(glval<unknown>) = FunctionAddress[A]              : 
+#  294|     r294_18(glval<int>)     = VariableAddress[x]              : 
+#  294|     r294_19(int)            = Load                            : &:r294_18, m291_7
+#  294|     v294_20(void)           = Call                            : func:r294_17, this:r294_16, 0:r294_19
+#  294|     m294_21(unknown)        = ^CallSideEffect                 : ~m294_14
+#  294|     m294_22(unknown)        = Chi                             : total:m294_14, partial:m294_21
+#  294|     m294_23(A)              = ^IndirectMayWriteSideEffect[-1] : &:r294_16
+#  294|     m294_24(unknown)        = Chi                             : total:m294_15, partial:m294_23
+#  294|     v294_25(void)           = Call                            : func:r294_9, this:r294_8, 0:r294_16
+#  294|     m294_26(unknown)        = ^CallSideEffect                 : ~m294_22
+#  294|     m294_27(unknown)        = Chi                             : total:m294_22, partial:m294_26
+#  294|     m294_28(A)              = ^IndirectMayWriteSideEffect[-1] : &:r294_8
+#  294|     m294_29(unknown)        = Chi                             : total:m294_7, partial:m294_28
+#  294|     v294_30(void)           = ^BufferReadSideEffect[0]        : &:r294_16, ~m294_24
+#  294|     m294_31(unknown)        = ^BufferMayWriteSideEffect[0]    : &:r294_16
+#  294|     m294_32(unknown)        = Chi                             : total:m294_24, partial:m294_31
+#  294|     r294_33(glval<int>)     = FieldAddress[i]                 : r294_8
+#  294|     r294_34(int)            = Load                            : &:r294_33, ~m294_29
+#  294|     m294_35(int)            = Store                           : &:r294_1, r294_34
+#  295|     r295_1(glval<A *>)      = VariableAddress[a]              : 
+#  295|     r295_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  295|     r295_3(unsigned long)   = Constant[4]                     : 
+#  295|     r295_4(void *)          = Call                            : func:r295_2, 0:r295_3
+#  295|     m295_5(unknown)         = ^CallSideEffect                 : ~m294_27
+#  295|     m295_6(unknown)         = Chi                             : total:m294_27, partial:m295_5
+#  295|     m295_7(unknown)         = ^InitializeDynamicAllocation    : &:r295_4
+#  295|     r295_8(A *)             = Convert                         : r295_4
+#  295|     r295_9(glval<unknown>)  = FunctionAddress[A]              : 
+#  295|     v295_10(void)           = Call                            : func:r295_9, this:r295_8
+#  295|     m295_11(unknown)        = ^CallSideEffect                 : ~m295_6
+#  295|     m295_12(unknown)        = Chi                             : total:m295_6, partial:m295_11
+#  295|     m295_13(A)              = ^IndirectMayWriteSideEffect[-1] : &:r295_8
+#  295|     m295_14(unknown)        = Chi                             : total:m295_7, partial:m295_13
+#  295|     m295_15(A *)            = Store                           : &:r295_1, r295_8
+#  296|     r296_1(glval<Point *>)  = VariableAddress[#return]        : 
+#  296|     r296_2(glval<Point *>)  = VariableAddress[p]              : 
+#  296|     r296_3(Point *)         = Load                            : &:r296_2, m292_9
+#  296|     m296_4(Point *)         = Store                           : &:r296_1, r296_3
+#  291|     r291_8(glval<Point *>)  = VariableAddress[#return]        : 
+#  291|     v291_9(void)            = ReturnValue                     : &:r291_8, m296_4
+#  291|     v291_10(void)           = UnmodeledUse                    : mu*
+#  291|     v291_11(void)           = AliasedUse                      : ~m295_12
+#  291|     v291_12(void)           = ExitFunction                    : 

cpp/ql/test/library-tests/ir/ssa/ssa.cpp

@@ -280,3 +280,18 @@ void EscapedButNotConflated(bool c, Point p, int x1) {
   }
   int x = a.x; // The phi node here is not conflated
 }
+
+struct A {
+  int i;
+  A(int x) {}
+  A(A*) {}
+  A() {}
+};
+
+Point *NewAliasing(int x) {
+  Point* p = new Point;
+  Point* q = new Point;
+  int j = new A(new A(x))->i;
+  A* a = new A;
+  return p;
+}

cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected

@@ -1074,8 +1074,9 @@ ssa.cpp:
 #  248|     r248_7(unsigned long)  = Mul                                : r248_5, r248_6
 #  248|     r248_8(void *)         = Call                               : func:r248_2, 0:r248_7
 #  248|     mu248_9(unknown)       = ^CallSideEffect                    : ~mu247_4
-#  248|     r248_10(char *)        = Convert                            : r248_8
-#  248|     m248_11(char *)        = Store                              : &:r248_1, r248_10
+#  248|     mu248_10(unknown)      = ^InitializeDynamicAllocation       : &:r248_8
+#  248|     r248_11(char *)        = Convert                            : r248_8
+#  248|     m248_12(char *)        = Store                              : &:r248_1, r248_11
 #  249|     r249_1(char)           = Constant[97]                       : 
 #  249|     r249_2(glval<char *>)  = VariableAddress[src]               : 
 #  249|     r249_3(char *)         = Load                               : &:r249_2, m247_6
@@ -1083,7 +1084,7 @@ ssa.cpp:
 #  249|     mu249_5(char)          = Store                              : &:r249_4, r249_1
 #  250|     r250_1(glval<unknown>) = FunctionAddress[memcpy]            : 
 #  250|     r250_2(glval<char *>)  = VariableAddress[dst]               : 
-#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_11
+#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_12
 #  250|     r250_4(void *)         = Convert                            : r250_3
 #  250|     r250_5(glval<char *>)  = VariableAddress[src]               : 
 #  250|     r250_6(char *)         = Load                               : &:r250_5, m247_6
@@ -1095,7 +1096,7 @@ ssa.cpp:
 #  250|     mu250_12(unknown)      = ^SizedBufferMustWriteSideEffect[0] : &:r250_4, r250_9
 #  251|     r251_1(glval<char *>)  = VariableAddress[#return]           : 
 #  251|     r251_2(glval<char *>)  = VariableAddress[dst]               : 
-#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_11
+#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_12
 #  251|     m251_4(char *)         = Store                              : &:r251_1, r251_3
 #  247|     v247_11(void)          = ReturnIndirection                  : &:r247_7, ~mu247_4
 #  247|     r247_12(glval<char *>) = VariableAddress[#return]           : 
@@ -1238,3 +1239,123 @@ ssa.cpp:
 #  275|     v275_12(void)        = UnmodeledUse       : mu*
 #  275|     v275_13(void)        = AliasedUse         : ~mu275_4
 #  275|     v275_14(void)        = ExitFunction       : 
+
+#  286| void A::A(int)
+#  286|   Block 0
+#  286|     v286_1(void)       = EnterFunction          : 
+#  286|     mu286_2(unknown)   = AliasedDefinition      : 
+#  286|     mu286_3(unknown)   = InitializeNonLocal     : 
+#  286|     mu286_4(unknown)   = UnmodeledDefinition    : 
+#  286|     r286_5(glval<A>)   = InitializeThis         : 
+#  286|     r286_6(glval<int>) = VariableAddress[x]     : 
+#  286|     m286_7(int)        = InitializeParameter[x] : &:r286_6
+#  286|     v286_8(void)       = NoOp                   : 
+#  286|     v286_9(void)       = ReturnVoid             : 
+#  286|     v286_10(void)      = UnmodeledUse           : mu*
+#  286|     v286_11(void)      = AliasedUse             : ~mu286_4
+#  286|     v286_12(void)      = ExitFunction           : 
+
+#  287| void A::A(A*)
+#  287|   Block 0
+#  287|     v287_1(void)       = EnterFunction              : 
+#  287|     mu287_2(unknown)   = AliasedDefinition          : 
+#  287|     mu287_3(unknown)   = InitializeNonLocal         : 
+#  287|     mu287_4(unknown)   = UnmodeledDefinition        : 
+#  287|     r287_5(glval<A>)   = InitializeThis             : 
+#  287|     r287_6(glval<A *>) = VariableAddress[p#0]       : 
+#  287|     m287_7(A *)        = InitializeParameter[p#0]   : &:r287_6
+#  287|     r287_8(A *)        = Load                       : &:r287_6, m287_7
+#  287|     mu287_9(unknown)   = InitializeIndirection[p#0] : &:r287_8
+#  287|     v287_10(void)      = NoOp                       : 
+#  287|     v287_11(void)      = ReturnIndirection          : &:r287_8, ~mu287_4
+#  287|     v287_12(void)      = ReturnVoid                 : 
+#  287|     v287_13(void)      = UnmodeledUse               : mu*
+#  287|     v287_14(void)      = AliasedUse                 : ~mu287_4
+#  287|     v287_15(void)      = ExitFunction               : 
+
+#  288| void A::A()
+#  288|   Block 0
+#  288|     v288_1(void)     = EnterFunction       : 
+#  288|     mu288_2(unknown) = AliasedDefinition   : 
+#  288|     mu288_3(unknown) = InitializeNonLocal  : 
+#  288|     mu288_4(unknown) = UnmodeledDefinition : 
+#  288|     r288_5(glval<A>) = InitializeThis      : 
+#  288|     v288_6(void)     = NoOp                : 
+#  288|     v288_7(void)     = ReturnVoid          : 
+#  288|     v288_8(void)     = UnmodeledUse        : mu*
+#  288|     v288_9(void)     = AliasedUse          : ~mu288_4
+#  288|     v288_10(void)    = ExitFunction        : 
+
+#  291| Point* NewAliasing(int)
+#  291|   Block 0
+#  291|     v291_1(void)            = EnterFunction                   : 
+#  291|     mu291_2(unknown)        = AliasedDefinition               : 
+#  291|     mu291_3(unknown)        = InitializeNonLocal              : 
+#  291|     mu291_4(unknown)        = UnmodeledDefinition             : 
+#  291|     r291_5(glval<int>)      = VariableAddress[x]              : 
+#  291|     m291_6(int)             = InitializeParameter[x]          : &:r291_5
+#  292|     r292_1(glval<Point *>)  = VariableAddress[p]              : 
+#  292|     r292_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  292|     r292_3(unsigned long)   = Constant[8]                     : 
+#  292|     r292_4(void *)          = Call                            : func:r292_2, 0:r292_3
+#  292|     mu292_5(unknown)        = ^CallSideEffect                 : ~mu291_4
+#  292|     mu292_6(unknown)        = ^InitializeDynamicAllocation    : &:r292_4
+#  292|     r292_7(Point *)         = Convert                         : r292_4
+#  292|     m292_8(Point *)         = Store                           : &:r292_1, r292_7
+#  293|     r293_1(glval<Point *>)  = VariableAddress[q]              : 
+#  293|     r293_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  293|     r293_3(unsigned long)   = Constant[8]                     : 
+#  293|     r293_4(void *)          = Call                            : func:r293_2, 0:r293_3
+#  293|     mu293_5(unknown)        = ^CallSideEffect                 : ~mu291_4
+#  293|     mu293_6(unknown)        = ^InitializeDynamicAllocation    : &:r293_4
+#  293|     r293_7(Point *)         = Convert                         : r293_4
+#  293|     m293_8(Point *)         = Store                           : &:r293_1, r293_7
+#  294|     r294_1(glval<int>)      = VariableAddress[j]              : 
+#  294|     r294_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  294|     r294_3(unsigned long)   = Constant[4]                     : 
+#  294|     r294_4(void *)          = Call                            : func:r294_2, 0:r294_3
+#  294|     mu294_5(unknown)        = ^CallSideEffect                 : ~mu291_4
+#  294|     mu294_6(unknown)        = ^InitializeDynamicAllocation    : &:r294_4
+#  294|     r294_7(A *)             = Convert                         : r294_4
+#  294|     r294_8(glval<unknown>)  = FunctionAddress[A]              : 
+#  294|     r294_9(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  294|     r294_10(unsigned long)  = Constant[4]                     : 
+#  294|     r294_11(void *)         = Call                            : func:r294_9, 0:r294_10
+#  294|     mu294_12(unknown)       = ^CallSideEffect                 : ~mu291_4
+#  294|     mu294_13(unknown)       = ^InitializeDynamicAllocation    : &:r294_11
+#  294|     r294_14(A *)            = Convert                         : r294_11
+#  294|     r294_15(glval<unknown>) = FunctionAddress[A]              : 
+#  294|     r294_16(glval<int>)     = VariableAddress[x]              : 
+#  294|     r294_17(int)            = Load                            : &:r294_16, m291_6
+#  294|     v294_18(void)           = Call                            : func:r294_15, this:r294_14, 0:r294_17
+#  294|     mu294_19(unknown)       = ^CallSideEffect                 : ~mu291_4
+#  294|     mu294_20(A)             = ^IndirectMayWriteSideEffect[-1] : &:r294_14
+#  294|     v294_21(void)           = Call                            : func:r294_8, this:r294_7, 0:r294_14
+#  294|     mu294_22(unknown)       = ^CallSideEffect                 : ~mu291_4
+#  294|     mu294_23(A)             = ^IndirectMayWriteSideEffect[-1] : &:r294_7
+#  294|     v294_24(void)           = ^BufferReadSideEffect[0]        : &:r294_14, ~mu291_4
+#  294|     mu294_25(unknown)       = ^BufferMayWriteSideEffect[0]    : &:r294_14
+#  294|     r294_26(glval<int>)     = FieldAddress[i]                 : r294_7
+#  294|     r294_27(int)            = Load                            : &:r294_26, ~mu291_4
+#  294|     m294_28(int)            = Store                           : &:r294_1, r294_27
+#  295|     r295_1(glval<A *>)      = VariableAddress[a]              : 
+#  295|     r295_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  295|     r295_3(unsigned long)   = Constant[4]                     : 
+#  295|     r295_4(void *)          = Call                            : func:r295_2, 0:r295_3
+#  295|     mu295_5(unknown)        = ^CallSideEffect                 : ~mu291_4
+#  295|     mu295_6(unknown)        = ^InitializeDynamicAllocation    : &:r295_4
+#  295|     r295_7(A *)             = Convert                         : r295_4
+#  295|     r295_8(glval<unknown>)  = FunctionAddress[A]              : 
+#  295|     v295_9(void)            = Call                            : func:r295_8, this:r295_7
+#  295|     mu295_10(unknown)       = ^CallSideEffect                 : ~mu291_4
+#  295|     mu295_11(A)             = ^IndirectMayWriteSideEffect[-1] : &:r295_7
+#  295|     m295_12(A *)            = Store                           : &:r295_1, r295_7
+#  296|     r296_1(glval<Point *>)  = VariableAddress[#return]        : 
+#  296|     r296_2(glval<Point *>)  = VariableAddress[p]              : 
+#  296|     r296_3(Point *)         = Load                            : &:r296_2, m292_8
+#  296|     m296_4(Point *)         = Store                           : &:r296_1, r296_3
+#  291|     r291_7(glval<Point *>)  = VariableAddress[#return]        : 
+#  291|     v291_8(void)            = ReturnValue                     : &:r291_7, m296_4
+#  291|     v291_9(void)            = UnmodeledUse                    : mu*
+#  291|     v291_10(void)           = AliasedUse                      : ~mu291_4
+#  291|     v291_11(void)           = ExitFunction                    : 

cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected

@@ -1074,8 +1074,9 @@ ssa.cpp:
 #  248|     r248_7(unsigned long)  = Mul                                : r248_5, r248_6
 #  248|     r248_8(void *)         = Call                               : func:r248_2, 0:r248_7
 #  248|     mu248_9(unknown)       = ^CallSideEffect                    : ~mu247_4
-#  248|     r248_10(char *)        = Convert                            : r248_8
-#  248|     m248_11(char *)        = Store                              : &:r248_1, r248_10
+#  248|     mu248_10(unknown)      = ^InitializeDynamicAllocation       : &:r248_8
+#  248|     r248_11(char *)        = Convert                            : r248_8
+#  248|     m248_12(char *)        = Store                              : &:r248_1, r248_11
 #  249|     r249_1(char)           = Constant[97]                       : 
 #  249|     r249_2(glval<char *>)  = VariableAddress[src]               : 
 #  249|     r249_3(char *)         = Load                               : &:r249_2, m247_6
@@ -1083,7 +1084,7 @@ ssa.cpp:
 #  249|     mu249_5(char)          = Store                              : &:r249_4, r249_1
 #  250|     r250_1(glval<unknown>) = FunctionAddress[memcpy]            : 
 #  250|     r250_2(glval<char *>)  = VariableAddress[dst]               : 
-#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_11
+#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_12
 #  250|     r250_4(void *)         = Convert                            : r250_3
 #  250|     r250_5(glval<char *>)  = VariableAddress[src]               : 
 #  250|     r250_6(char *)         = Load                               : &:r250_5, m247_6
@@ -1095,7 +1096,7 @@ ssa.cpp:
 #  250|     mu250_12(unknown)      = ^SizedBufferMustWriteSideEffect[0] : &:r250_4, r250_9
 #  251|     r251_1(glval<char *>)  = VariableAddress[#return]           : 
 #  251|     r251_2(glval<char *>)  = VariableAddress[dst]               : 
-#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_11
+#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_12
 #  251|     m251_4(char *)         = Store                              : &:r251_1, r251_3
 #  247|     v247_11(void)          = ReturnIndirection                  : &:r247_7, ~mu247_4
 #  247|     r247_12(glval<char *>) = VariableAddress[#return]           : 
@@ -1238,3 +1239,123 @@ ssa.cpp:
 #  275|     v275_12(void)        = UnmodeledUse       : mu*
 #  275|     v275_13(void)        = AliasedUse         : ~mu275_4
 #  275|     v275_14(void)        = ExitFunction       : 
+
+#  286| void A::A(int)
+#  286|   Block 0
+#  286|     v286_1(void)       = EnterFunction          : 
+#  286|     mu286_2(unknown)   = AliasedDefinition      : 
+#  286|     mu286_3(unknown)   = InitializeNonLocal     : 
+#  286|     mu286_4(unknown)   = UnmodeledDefinition    : 
+#  286|     r286_5(glval<A>)   = InitializeThis         : 
+#  286|     r286_6(glval<int>) = VariableAddress[x]     : 
+#  286|     m286_7(int)        = InitializeParameter[x] : &:r286_6
+#  286|     v286_8(void)       = NoOp                   : 
+#  286|     v286_9(void)       = ReturnVoid             : 
+#  286|     v286_10(void)      = UnmodeledUse           : mu*
+#  286|     v286_11(void)      = AliasedUse             : ~mu286_4
+#  286|     v286_12(void)      = ExitFunction           : 
+
+#  287| void A::A(A*)
+#  287|   Block 0
+#  287|     v287_1(void)       = EnterFunction              : 
+#  287|     mu287_2(unknown)   = AliasedDefinition          : 
+#  287|     mu287_3(unknown)   = InitializeNonLocal         : 
+#  287|     mu287_4(unknown)   = UnmodeledDefinition        : 
+#  287|     r287_5(glval<A>)   = InitializeThis             : 
+#  287|     r287_6(glval<A *>) = VariableAddress[p#0]       : 
+#  287|     m287_7(A *)        = InitializeParameter[p#0]   : &:r287_6
+#  287|     r287_8(A *)        = Load                       : &:r287_6, m287_7
+#  287|     mu287_9(unknown)   = InitializeIndirection[p#0] : &:r287_8
+#  287|     v287_10(void)      = NoOp                       : 
+#  287|     v287_11(void)      = ReturnIndirection          : &:r287_8, ~mu287_4
+#  287|     v287_12(void)      = ReturnVoid                 : 
+#  287|     v287_13(void)      = UnmodeledUse               : mu*
+#  287|     v287_14(void)      = AliasedUse                 : ~mu287_4
+#  287|     v287_15(void)      = ExitFunction               : 
+
+#  288| void A::A()
+#  288|   Block 0
+#  288|     v288_1(void)     = EnterFunction       : 
+#  288|     mu288_2(unknown) = AliasedDefinition   : 
+#  288|     mu288_3(unknown) = InitializeNonLocal  : 
+#  288|     mu288_4(unknown) = UnmodeledDefinition : 
+#  288|     r288_5(glval<A>) = InitializeThis      : 
+#  288|     v288_6(void)     = NoOp                : 
+#  288|     v288_7(void)     = ReturnVoid          : 
+#  288|     v288_8(void)     = UnmodeledUse        : mu*
+#  288|     v288_9(void)     = AliasedUse          : ~mu288_4
+#  288|     v288_10(void)    = ExitFunction        : 
+
+#  291| Point* NewAliasing(int)
+#  291|   Block 0
+#  291|     v291_1(void)            = EnterFunction                   : 
+#  291|     mu291_2(unknown)        = AliasedDefinition               : 
+#  291|     mu291_3(unknown)        = InitializeNonLocal              : 
+#  291|     mu291_4(unknown)        = UnmodeledDefinition             : 
+#  291|     r291_5(glval<int>)      = VariableAddress[x]              : 
+#  291|     m291_6(int)             = InitializeParameter[x]          : &:r291_5
+#  292|     r292_1(glval<Point *>)  = VariableAddress[p]              : 
+#  292|     r292_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  292|     r292_3(unsigned long)   = Constant[8]                     : 
+#  292|     r292_4(void *)          = Call                            : func:r292_2, 0:r292_3
+#  292|     mu292_5(unknown)        = ^CallSideEffect                 : ~mu291_4
+#  292|     mu292_6(unknown)        = ^InitializeDynamicAllocation    : &:r292_4
+#  292|     r292_7(Point *)         = Convert                         : r292_4
+#  292|     m292_8(Point *)         = Store                           : &:r292_1, r292_7
+#  293|     r293_1(glval<Point *>)  = VariableAddress[q]              : 
+#  293|     r293_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  293|     r293_3(unsigned long)   = Constant[8]                     : 
+#  293|     r293_4(void *)          = Call                            : func:r293_2, 0:r293_3
+#  293|     mu293_5(unknown)        = ^CallSideEffect                 : ~mu291_4
+#  293|     mu293_6(unknown)        = ^InitializeDynamicAllocation    : &:r293_4
+#  293|     r293_7(Point *)         = Convert                         : r293_4
+#  293|     m293_8(Point *)         = Store                           : &:r293_1, r293_7
+#  294|     r294_1(glval<int>)      = VariableAddress[j]              : 
+#  294|     r294_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  294|     r294_3(unsigned long)   = Constant[4]                     : 
+#  294|     r294_4(void *)          = Call                            : func:r294_2, 0:r294_3
+#  294|     mu294_5(unknown)        = ^CallSideEffect                 : ~mu291_4
+#  294|     mu294_6(unknown)        = ^InitializeDynamicAllocation    : &:r294_4
+#  294|     r294_7(A *)             = Convert                         : r294_4
+#  294|     r294_8(glval<unknown>)  = FunctionAddress[A]              : 
+#  294|     r294_9(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  294|     r294_10(unsigned long)  = Constant[4]                     : 
+#  294|     r294_11(void *)         = Call                            : func:r294_9, 0:r294_10
+#  294|     mu294_12(unknown)       = ^CallSideEffect                 : ~mu291_4
+#  294|     mu294_13(unknown)       = ^InitializeDynamicAllocation    : &:r294_11
+#  294|     r294_14(A *)            = Convert                         : r294_11
+#  294|     r294_15(glval<unknown>) = FunctionAddress[A]              : 
+#  294|     r294_16(glval<int>)     = VariableAddress[x]              : 
+#  294|     r294_17(int)            = Load                            : &:r294_16, m291_6
+#  294|     v294_18(void)           = Call                            : func:r294_15, this:r294_14, 0:r294_17
+#  294|     mu294_19(unknown)       = ^CallSideEffect                 : ~mu291_4
+#  294|     mu294_20(A)             = ^IndirectMayWriteSideEffect[-1] : &:r294_14
+#  294|     v294_21(void)           = Call                            : func:r294_8, this:r294_7, 0:r294_14
+#  294|     mu294_22(unknown)       = ^CallSideEffect                 : ~mu291_4
+#  294|     mu294_23(A)             = ^IndirectMayWriteSideEffect[-1] : &:r294_7
+#  294|     v294_24(void)           = ^BufferReadSideEffect[0]        : &:r294_14, ~mu291_4
+#  294|     mu294_25(unknown)       = ^BufferMayWriteSideEffect[0]    : &:r294_14
+#  294|     r294_26(glval<int>)     = FieldAddress[i]                 : r294_7
+#  294|     r294_27(int)            = Load                            : &:r294_26, ~mu291_4
+#  294|     m294_28(int)            = Store                           : &:r294_1, r294_27
+#  295|     r295_1(glval<A *>)      = VariableAddress[a]              : 
+#  295|     r295_2(glval<unknown>)  = FunctionAddress[operator new]   : 
+#  295|     r295_3(unsigned long)   = Constant[4]                     : 
+#  295|     r295_4(void *)          = Call                            : func:r295_2, 0:r295_3
+#  295|     mu295_5(unknown)        = ^CallSideEffect                 : ~mu291_4
+#  295|     mu295_6(unknown)        = ^InitializeDynamicAllocation    : &:r295_4
+#  295|     r295_7(A *)             = Convert                         : r295_4
+#  295|     r295_8(glval<unknown>)  = FunctionAddress[A]              : 
+#  295|     v295_9(void)            = Call                            : func:r295_8, this:r295_7
+#  295|     mu295_10(unknown)       = ^CallSideEffect                 : ~mu291_4
+#  295|     mu295_11(A)             = ^IndirectMayWriteSideEffect[-1] : &:r295_7
+#  295|     m295_12(A *)            = Store                           : &:r295_1, r295_7
+#  296|     r296_1(glval<Point *>)  = VariableAddress[#return]        : 
+#  296|     r296_2(glval<Point *>)  = VariableAddress[p]              : 
+#  296|     r296_3(Point *)         = Load                            : &:r296_2, m292_8
+#  296|     m296_4(Point *)         = Store                           : &:r296_1, r296_3
+#  291|     r291_7(glval<Point *>)  = VariableAddress[#return]        : 
+#  291|     v291_8(void)            = ReturnValue                     : &:r291_7, m296_4
+#  291|     v291_9(void)            = UnmodeledUse                    : mu*
+#  291|     v291_10(void)           = AliasedUse                      : ~mu291_4
+#  291|     v291_11(void)           = ExitFunction                    : 

cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected

@@ -49,6 +49,7 @@ missingOperandType
 duplicateChiOperand
 sideEffectWithoutPrimary
 instructionWithoutSuccessor
+| CPP-309.cpp:7:5:7:20 | InitializeDynamicAllocation: new[] |
 | VacuousDestructorCall.cpp:2:29:2:29 | InitializeIndirection: y |
 | VacuousDestructorCall.cpp:3:3:3:3 | VariableAddress: x |
 | VacuousDestructorCall.cpp:4:3:4:3 | Load: y |
@@ -57,6 +58,7 @@ instructionWithoutSuccessor
 | condition_decls.cpp:26:23:26:24 | IndirectMayWriteSideEffect: call to BoxedInt |
 | condition_decls.cpp:41:22:41:23 | IndirectMayWriteSideEffect: call to BoxedInt |
 | condition_decls.cpp:48:52:48:53 | IndirectMayWriteSideEffect: call to BoxedInt |
+| cpp17.cpp:15:5:15:45 | InitializeDynamicAllocation: new |
 | cpp17.cpp:15:11:15:21 | Convert: (void *)... |
 | file://:0:0:0:0 | CompareNE: (bool)... |
 | file://:0:0:0:0 | CompareNE: (bool)... |