Merge branch 'master' of git.semmle.com:Semmle/ql

git pull upstream master

CODEOWNERS

@@ -3,3 +3,8 @@
 /javascript/ @Semmle/js
 /cpp/ @Semmle/cpp-analysis
 /cpp/**/*.qhelp @semmledocs-ac
+/csharp/**/*.qhelp @jf205
+/java/**/*.qhelp @felicity-semmle
+/javascript/**/*.qhelp @mc-semmle
+/python/**/*.qhelp @felicity-semmle
+/docs/language/ @felicity-semmle @jf205

CONTRIBUTING.md

@@ -19,7 +19,7 @@ Follow the steps below to help other users understand what your query does, and
 
 3. **Make sure your query has the correct metadata**
 
-   Query metadata is used by Semmle's analysis to idenitfy your query and make sure the query results are displayed properly. 
+   Query metadata is used by Semmle's analysis to identify your query and make sure the query results are displayed properly. 
    The most important metadata to include are the `@name`, `@description`, and the `@kind`.
    Other metadata properties (`@precision`, `@severity`, and `@tags`) are usually added after the query has been reviewed by Semmle staff.
    For more information on writing query metadata, see the [Query metadata style guide](https://github.com/Semmle/ql/blob/master/docs/query-metadata-style-guide.md).
@@ -29,7 +29,7 @@ Follow the steps below to help other users understand what your query does, and
    The `select` statement of your query must be compatible with the query type (determined by the `@kind` metadata property) for alert or path results to be displayed correctly in LGTM and QL for Eclipse.
    For more information on `select` statement format, see [Introduction to query files](https://help.semmle.com/QL/learn-ql/writing-queries/introduction-to-queries.html#select-clause) on help.semmle.com.
 
-5. **Save your query in a `.ql` file in correct language directory in the this repository**
+5. **Save your query in a `.ql` file in correct language directory in this repository**
 
    There are five language-specific directories in this repository:
    

change-notes/1.22/analysis-java.md

@@ -5,6 +5,9 @@
 | **Query**                  | **Expected impact**    | **Change**                                                       |
 |----------------------------|------------------------|------------------------------------------------------------------|
 | Equals method does not inspect argument type (`java/unchecked-cast-in-equals`) | Fewer false positive and more true positive results | Precision has been improved by doing a bit of inter-procedural analysis and relying less on ad-hoc method names. |
+| Uncontrolled data in arithmetic expression (`java/uncontrolled-arithmetic`) | Fewer false positive results | Precision has been improved in several ways, in particular, by better detection of guards along the data-flow path. |
+| Uncontrolled data used in path expression (`java/path-injection`) | Fewer false positive results | The query no longer reports results guarded by `!var.contains("..")`. |
+| User-controlled data in arithmetic expression (`java/tainted-arithmetic`) | Fewer false positive results | Precision has been improved in several ways, in particular, by better detection of guards along the data-flow path. |
 
 ## Changes to QL libraries
 

cpp/ql/src/semmle/code/cpp/Enum.qll

@@ -2,7 +2,13 @@ import semmle.code.cpp.Type
 private import semmle.code.cpp.internal.ResolveClass
 
 /**
- * A C/C++ enum [N4140 7.2].
+ * A C/C++ enum [N4140 7.2]. For example, the type `MyEnum` in:
+ * ```
+ * enum MyEnum {
+ *   MyEnumConstant
+ * };
+ * ```
+ * This includes C++ scoped enums, see the `ScopedEnum` QL class.
  */
 class Enum extends UserType, IntegralOrEnumType {
   /** Gets an enumerator of this enumeration. */
@@ -46,7 +52,15 @@ class Enum extends UserType, IntegralOrEnumType {
 }
 
 /**
- * A C++ enum that is directly enclosed by a function.
+ * A C/C++ enum that is directly enclosed by a function. For example, the type
+ * `MyLocalEnum` in:
+ * ```
+ * void myFunction() {
+ *   enum MyLocalEnum {
+ *     MyLocalEnumConstant
+ *   };
+ * }
+ * ```
  */
 class LocalEnum extends Enum {
   LocalEnum() {
@@ -57,7 +71,16 @@ class LocalEnum extends Enum {
 }
 
 /**
- * A C++ enum that is declared within a class.
+ * A C/C++ enum that is declared within a class/struct. For example, the type
+ * `MyNestedEnum` in:
+ * ```
+ * class MyClass {
+ * public:
+ *   enum MyNestedEnum {
+ *     MyNestedEnumConstant
+ *   };
+ * };
+ * ```
  */
 class NestedEnum extends Enum {
 
@@ -79,9 +102,14 @@ class NestedEnum extends Enum {
 }
 
 /**
- * A C++ scoped enum.
- *
- * For example, `enum class Color { red, blue }`.
+ * A C++ scoped enum, that is, an enum whose constants must be qualified with
+ * the name of the enum. For example, the type `Color` in:
+ * ```
+ * enum class Color {
+ *   red,
+ *   blue
+ * }
+ * ```
  */
 class ScopedEnum extends Enum {
   ScopedEnum() {
@@ -92,11 +120,16 @@ class ScopedEnum extends Enum {
 }
 
 /**
- * A C/C++ enumerator [N4140 7.2].
+ * A C/C++ enumerator [N4140 7.2], also known as an enumeration constant.
  *
- * For example: `green` in `enum { red, green, blue }`.
- *
- * Enumerators are also knowns as enumeration constants.
+ * For example the enumeration constant `green` in:
+ * ```
+ * enum {
+ *   red,
+ *   green,
+ *   blue
+ * }
+ * ```
  */
 class EnumConstant extends Declaration, @enumconstant {
   /**

cpp/ql/src/semmle/code/cpp/Function.qll

@@ -9,7 +9,12 @@ private import semmle.code.cpp.internal.ResolveClass
 
 /**
  * A C/C++ function [N4140 8.3.5]. Both member functions and non-member
- * functions are included.
+ * functions are included. For example the function `MyFunction` in:
+ * ```
+ * void MyFunction() {
+ *   DoSomething();
+ * }
+ * ```
  *
  * Function has a one-to-many relationship with FunctionDeclarationEntry,
  * because the same function can be declared in multiple locations. This
@@ -497,7 +502,16 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
 }
 
 /**
- * A particular declaration or definition of a C/C++ function.
+ * A particular declaration or definition of a C/C++ function. For example the
+ * declaration and definition of `MyFunction` in the following code are each a
+ * `FunctionDeclarationEntry`:
+ * ```
+ * void MyFunction();
+ *
+ * void MyFunction() {
+ *   DoSomething();
+ * }
+ * ```
  */
 class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
   /** Gets the function which is being declared or defined. */
@@ -703,7 +717,20 @@ class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
 
 /**
  * A C/C++ non-member function (a function that is not a member of any
- * class).
+ * class). For example the in the following code, `MyFunction` is a
+ * `TopLevelFunction` but `MyMemberFunction` is not:
+ * ```
+ * void MyFunction() {
+ *   DoSomething();
+ * }
+ *
+ * class MyClass {
+ * public:
+ *   void MyMemberFunction() {
+ *     DoSomething();
+ *   }
+ * };
+ * ```
  */
 class TopLevelFunction extends Function {
   TopLevelFunction() {
@@ -715,7 +742,20 @@ class TopLevelFunction extends Function {
 
 /**
  * A C++ function declared as a member of a class [N4140 9.3]. This includes
- * static member functions.
+ * static member functions. For example the functions `MyStaticMemberFunction`
+ * and `MyMemberFunction` in:
+ * ```
+ * class MyClass {
+ * public:
+ *   void MyMemberFunction() {
+ *     DoSomething();
+ *   }
+ *
+ *   static void MyStaticMemberFunction() {
+ *     DoSomething();
+ *   }
+ * };
+ * ```
  */
 class MemberFunction extends Function {
   MemberFunction() {
@@ -770,7 +810,22 @@ class MemberFunction extends Function {
 }
 
 /**
- * A C++ virtual function.
+ * A C++ virtual function. For example the two functions called
+ * `myVirtualFunction` in the following code are each a
+ * `VirtualFunction`:
+ * ```
+ * class A {
+ * public:
+ *   virtual void myVirtualFunction() = 0;
+ * };
+ *
+ * class B: public A {
+ * public:
+ *   virtual void myVirtualFunction() {
+ *     doSomething();
+ *   }
+ * };
+ * ```
  */
 class VirtualFunction extends MemberFunction {
 
@@ -791,7 +846,21 @@ class VirtualFunction extends MemberFunction {
 }
 
 /**
- * A C++ pure virtual function [N4140 10.4].
+ * A C++ pure virtual function [N4140 10.4]. For example the first function
+ * called `myVirtualFunction` in the following code:
+ * ```
+ * class A {
+ * public:
+ *   virtual void myVirtualFunction() = 0;
+ * };
+ *
+ * class B: public A {
+ * public:
+ *   virtual void myVirtualFunction() {
+ *     doSomething();
+ *   }
+ * };
+ * ```
  */
 class PureVirtualFunction extends VirtualFunction {
 
@@ -801,9 +870,20 @@ class PureVirtualFunction extends VirtualFunction {
 }
 
 /**
- * A const C++ member function [N4140 9.3.1/4]. A const function does not
- * modify the state of its class.
- * For example: `int day() const { return d; }`
+ * A const C++ member function [N4140 9.3.1/4]. A const function has the
+ * `const` specifier and does not modify the state of its class. For example
+ * the member function `day` in the following code:
+ * ```
+ * class MyClass {
+ *   ...
+ * 
+ *   int day() const {
+ *     return d;
+ *   }
+ *
+ *   ...
+ * };
+ * ```
  */
 class ConstMemberFunction extends MemberFunction {
 
@@ -813,7 +893,16 @@ class ConstMemberFunction extends MemberFunction {
 }
 
 /**
- * A C++ constructor [N4140 12.1].
+ * A C++ constructor [N4140 12.1]. For example the function `MyClass` in the
+ * following code is a constructor:
+ * ```
+ * class MyClass {
+ * public:
+ *   MyClass() {
+ *     ...
+ *   }
+ * };
+ * ```
  */
 class Constructor extends MemberFunction {
 
@@ -852,13 +941,26 @@ class Constructor extends MemberFunction {
   }
 }
 
-/** A function that defines an implicit conversion. */
+/**
+ * A function that defines an implicit conversion.
+ */
 abstract class ImplicitConversionFunction extends MemberFunction {
   abstract Type getSourceType();
   abstract Type getDestType();
 }
 
-/** A C++ constructor that also defines an implicit conversion. */
+/**
+ * A C++ constructor that also defines an implicit conversion. For example the
+ * function `MyClass` in the following code is a `ConversionConstructor`:
+ * ```
+ * class MyClass {
+ * public:
+ *   MyClass(const MyOtherClass &from) {
+ *     ...
+ *   }
+ * };
+ * ```
+ */
 class ConversionConstructor extends Constructor, ImplicitConversionFunction {
   ConversionConstructor() {
     strictcount(Parameter p | p = getAParameter() and not p.hasInitializer()) = 1
@@ -893,9 +995,18 @@ private predicate hasMoveSignature(MemberFunction f) {
 }
 
 /**
- * A C++ copy constructor, such as `T::T(const T&)` [N4140 12.8].
+ * A C++ copy constructor [N4140 12.8]. For example the function `MyClass` in
+ * the following code is a `CopyConstructor`:
+ * ```
+ * class MyClass {
+ * public:
+ *   MyClass(const MyClass &from) {
+ *     ...
+ *   }
+ * };
+ * ```
  *
- * As per the standard, a copy constructor of class T is a non-template
+ * As per the standard, a copy constructor of class `T` is a non-template
  * constructor whose first parameter has type `T&`, `const T&`, `volatile
  * T&`, or `const volatile T&`, and either there are no other parameters,
  * or the rest of the parameters all have default values.
@@ -943,9 +1054,18 @@ class CopyConstructor extends Constructor {
 }
 
 /**
- * A C++ move constructor, such as `T::T(T&&)` [N4140 12.8].
+ * A C++ move constructor [N4140 12.8]. For example the function `MyClass` in
+ * the following code is a `MoveConstructor`:
+ * ```
+ * class MyClass {
+ * public:
+ *   MyClass(MyClass &&from) {
+ *     ...
+ *   }
+ * };
+ * ```
  *
- * As per the standard, a move constructor of class T is a non-template
+ * As per the standard, a move constructor of class `T` is a non-template
  * constructor whose first parameter is `T&&`, `const T&&`, `volatile T&&`,
  * or `const volatile T&&`, and either there are no other parameters, or
  * the rest of the parameters all have default values.
@@ -994,7 +1114,17 @@ class MoveConstructor extends Constructor {
 
 /**
  * A C++ constructor that takes no arguments ('default' constructor). This
- * is the constructor that is invoked when no initializer is given.
+ * is the constructor that is invoked when no initializer is given. For
+ * example the function `MyClass` in the following code is a
+ * `NoArgConstructor`:
+ * ```
+ * class MyClass {
+ * public:
+ *   MyClass() {
+ *     ...
+ *   }
+ * };
+ * ```
  */
 class NoArgConstructor extends Constructor {
   NoArgConstructor() {
@@ -1003,7 +1133,16 @@ class NoArgConstructor extends Constructor {
 }
 
 /**
- * A C++ destructor [N4140 12.4].
+ * A C++ destructor [N4140 12.4]. For example the function `~MyClass` in the
+ * following code is a destructor:
+ * ```
+ * class MyClass {
+ * public:
+ *   ~MyClass() {
+ *     ...
+ *   }
+ * };
+ * ```
  */
 class Destructor extends MemberFunction {
   Destructor() { functions(underlyingElement(this),_,3) }
@@ -1029,7 +1168,14 @@ class Destructor extends MemberFunction {
 }
 
 /**
- * A C++ conversion operator [N4140 12.3.2].
+ * A C++ conversion operator [N4140 12.3.2]. For example the function
+ * `operator int` in the following code is a `ConversionOperator`:
+ * ```
+ * class MyClass {
+ * public:
+ *   operator int();
+ * };
+ * ```
  */
 class ConversionOperator extends MemberFunction, ImplicitConversionFunction {
 
@@ -1054,8 +1200,14 @@ class Operator extends Function {
 }
 
 /**
- * A C++ copy assignment operator, such as `T& T::operator=(const T&)`
- * [N4140 12.8].
+ * A C++ copy assignment operator [N4140 12.8]. For example the function
+ * `operator=` in the following code is a `CopyAssignmentOperator`:
+ * ```
+ * class MyClass {
+ * public:
+ *   MyClass &operator=(const MyClass &other);
+ * };
+ * ```
  *
  * As per the standard, a copy assignment operator of class `T` is a
  * non-template non-static member function with the name `operator=` that
@@ -1079,8 +1231,14 @@ class CopyAssignmentOperator extends Operator {
 
 
 /**
- * A C++ move assignment operator, such as `T& T::operator=(T&&)` [N4140
- * 12.8].
+ * A C++ move assignment operator [N4140 12.8]. For example the function
+ * `operator=` in the following code is a `MoveAssignmentOperator`:
+ * ```
+ * class MyClass {
+ * public:
+ *   MyClass &operator=(MyClass &&other);
+ * };
+ * ```
  *
  * As per the standard, a move assignment operator of class `T` is a
  * non-template non-static member function with the name `operator=` that
@@ -1100,11 +1258,18 @@ class MoveAssignmentOperator extends Operator {
 
 
 /**
- * A C++ function which has a non-empty template argument list.
+ * A C++ function which has a non-empty template argument list. For example
+ * the function `myTemplateFunction` in the following code:
+ * ```
+ * template<class T>
+ * void myTemplateFunction(T t) {
+ *   ...
+ * }
+ * ```
  *
- * This includes function declarations which are immediately preceded by
- * `template <...>`, where the "..." part is not empty, and therefore it
- * does not include:
+ * This comprises function declarations which are immediately preceded by
+ * `template <...>`, where the "..." part is not empty, and therefore it does
+ * not include:
  *
  *   1. Full specializations of template functions, as they have an empty
  *      template argument list.
@@ -1139,7 +1304,18 @@ class TemplateFunction extends Function {
 }
 
 /**
- * A function that is an instantiation of a template.
+ * A function that is an instantiation of a template. For example
+ * the instantiation `myTemplateFunction<int>` in the following code:
+ * ```
+ * template<class T>
+ * void myTemplateFunction(T t) {
+ *   ...
+ * }
+ *
+ * void caller(int i) {
+ *   myTemplateFunction<int>(i);
+ * }
+ * ```
  */
 class FunctionTemplateInstantiation extends Function {
   TemplateFunction tf;
@@ -1161,19 +1337,30 @@ class FunctionTemplateInstantiation extends Function {
 }
 
 /**
- * An explicit specialization of a C++ function template.
- * For example: `template <> void f<int*>(int *)`.
+ * An explicit specialization of a C++ function template. For example the
+ * function `myTemplateFunction<int>` in the following code:
+ * ```
+ * template<class T>
+ * void myTemplateFunction(T t) {
+ *   ...
+ * }
+ *
+ * template<>
+ * void myTemplateFunction<int>(int i) {
+ *   ...
+ * }
+ * ```
  *
  * Note that unlike classes, functions overload rather than specialize
  * partially. Therefore this only includes the last two of the following
  * four definitions, and in particular does not include the second one:
  *
- *   ```
- *   template <typename T> void f(T) {...}
- *   template <typename T> void f(T*) {...}
- *   template <> void f<int>(int *) {...}
- *   template <> void f<int*>(int *) {...}
- *   ```
+ * ```
+ * template <typename T> void f(T) {...}
+ * template <typename T> void f(T*) {...}
+ * template <> void f<int>(int *) {...}
+ * template <> void f<int*>(int *) {...}
+ * ```
  *
  * Furthermore, this does not include compiler-generated instantiations of
  * function templates.

cpp/ql/src/semmle/code/cpp/Initializer.qll

@@ -1,7 +1,19 @@
 import semmle.code.cpp.controlflow.ControlFlowGraph
 
 /**
- * A C/C++ declaration initializer.
+ * A C/C++ declaration initializer. For example the initializers `1`, `2` and
+ * `3` in the following code:
+ * ```
+ * int myVariable = 1;
+ *
+ * enum myEnum {
+ *   MYENUMCONST = 2
+ * };
+ *
+ * void myFunction(int param = 3) {
+ *   ...
+ * }
+ * ```
  */
 class Initializer extends ControlFlowNode, @initialiser {
   override Location getLocation() { initialisers(underlyingElement(this),_,_,result) }

cpp/ql/src/semmle/code/cpp/Parameter.qll

@@ -3,7 +3,18 @@ import semmle.code.cpp.Declaration
 private import semmle.code.cpp.internal.ResolveClass
 
 /**
- * A C/C++ function parameter or catch block parameter.
+ * A C/C++ function parameter or catch block parameter. For example the
+ * function parameter `p` and the catch block parameter `e` in the following
+ * code: 
+ * ```
+ * void myFunction(int p) {
+ *   try {
+ *     ...
+ *   } catch (const std::exception &e) {
+ *     ...
+ *   }
+ * }
+ * ```
  *
  * For catch block parameters, there is a one-to-one correspondence between
  * the `Parameter` and its `ParameterDeclarationEntry`.

cpp/ql/src/semmle/code/cpp/Struct.qll

@@ -2,7 +2,18 @@ import semmle.code.cpp.Type
 import semmle.code.cpp.Class
 
 /**
- * A C/C++ structure or union.
+ * A C/C++ structure or union. For example, the types `MyStruct` and `MyUnion`
+ * in:
+ * ``` 
+ * struct MyStruct {
+ *   int x, y, z;
+ * };
+ *
+ * union MyUnion {
+ *   int i;
+ *   float f;
+ * };
+ * ```
  */
 class Struct extends Class {
 
@@ -16,7 +27,15 @@ class Struct extends Class {
 }
 
 /**
- * A C++ struct that is directly enclosed by a function.
+ * A C/C++ struct that is directly enclosed by a function. For example, the type
+ * `MyLocalStruct` in:
+ * ```
+ * void myFunction() { 
+ *   struct MyLocalStruct {
+ *     int x, y, z;
+ *   };
+ * }
+ * ```
  */
 class LocalStruct extends Struct {
   LocalStruct() {
@@ -28,7 +47,15 @@ class LocalStruct extends Struct {
 }
 
 /**
- * A C++ nested struct. See 11.12.
+ * A C/C++ nested struct. See 11.12. For example, the type `MyNestedStruct` in:
+ * ```
+ * class MyClass {
+ * public:
+ *   struct MyNestedStruct {
+ *     int x, y, z;
+ *   };
+ * };
+ * ```
  */
 class NestedStruct extends Struct {
   NestedStruct() {

cpp/ql/src/semmle/code/cpp/Union.qll

@@ -2,7 +2,13 @@ import semmle.code.cpp.Type
 import semmle.code.cpp.Struct
 
 /**
- * A C/C++ union. See C.8.2.
+ * A C/C++ union. See C.8.2. For example, the type `MyUnion` in:
+ * ```
+ * union MyUnion {
+ *   int i;
+ *   float f;
+ * };
+ * ```
  */
 class Union extends Struct  {
 
@@ -17,7 +23,16 @@ class Union extends Struct  {
 }
 
 /**
- * A C++ union that is directly enclosed by a function.
+ * A C/C++ union that is directly enclosed by a function. For example, the type
+ * `MyLocalUnion` in:
+ * ```
+ * void myFunction() {
+ *   union MyLocalUnion {
+ *     int i;
+ *     float f;
+ *   };
+ * }
+ * ```
  */
 class LocalUnion extends Union {
   LocalUnion() {
@@ -28,7 +43,16 @@ class LocalUnion extends Union {
 }
 
 /**
- * A C++ nested union.
+ * A C/C++ nested union. For example, the type `MyNestedUnion` in:
+ * ```
+ * class MyClass {
+ * public:
+ *   union MyNestedUnion {
+ *     int i;
+ *     float f;
+ *   };
+ * };
+ * ```
  */
 class NestedUnion extends Union {
   NestedUnion() {

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

@@ -75,6 +75,9 @@ abstract class Configuration extends string {
   /** Holds if data flow out of `node` is prohibited. */
   predicate isBarrierOut(Node node) { none() }
 
+  /** Holds if data flow through nodes guarded by `guard` is prohibited. */
+  predicate isBarrierGuard(BarrierGuard guard) { none() }
+
   /**
    * Holds if the additional flow step from `node1` to `node2` must be taken
    * into account in the analysis.
@@ -136,6 +139,11 @@ private predicate fullBarrier(Node node, Configuration config) {
   or
   config.isBarrierOut(node) and
   not config.isSink(node)
+  or
+  exists(BarrierGuard g |
+    config.isBarrierGuard(g) and
+    node = g.getAGuardedNode()
+  )
 }
 
 private class AdditionalFlowStepSource extends Node {
@@ -826,6 +834,7 @@ private predicate localFlowExit(Node node, Configuration config) {
  * This is the transitive closure of `[additional]localFlowStep` beginning
  * at `localFlowEntry`.
  */
+pragma[nomagic]
 private predicate localFlowStepPlus(
   Node node1, Node node2, boolean preservesValue, Configuration config
 ) {
@@ -1086,28 +1095,44 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
     flowCandFwd(node, _, apf, config)
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    store(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandStore(node, f, toReturn, apf0, config) and
     apf0.headUsesContent(f) and
     consCand(f, apf, unbind(config))
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    read(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandRead(node, f, toReturn, apf0, config) and
     consCandFwd(f, apf0, unbind(config)) and
     apf.headUsesContent(f)
   )
 }
 
+pragma[nomagic]
+private predicate flowCandRead(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    read(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
+private predicate flowCandStore(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    store(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
 private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
   consCandFwd(f, apf, config) and
-  exists(Node mid, Node n, AccessPathFront apf0 |
+  exists(Node n, AccessPathFront apf0 |
     flowCandFwd(n, _, apf0, config) and
     apf0.headUsesContent(f) and
-    read(n, f, mid) and
-    flowCand(mid, _, apf, config)
+    flowCandRead(n, f, _, apf, config)
   )
 }
 
@@ -1447,8 +1472,18 @@ abstract class PathNode extends TPathNode {
    */
   string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
 
-  /** Gets the source location for this element. */
-  DataFlowLocation getLocation() { result = getNode().getLocation() }
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
 
   /** Gets the underlying `Node`. */
   abstract Node getNode();

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

@@ -75,6 +75,9 @@ abstract class Configuration extends string {
   /** Holds if data flow out of `node` is prohibited. */
   predicate isBarrierOut(Node node) { none() }
 
+  /** Holds if data flow through nodes guarded by `guard` is prohibited. */
+  predicate isBarrierGuard(BarrierGuard guard) { none() }
+
   /**
    * Holds if the additional flow step from `node1` to `node2` must be taken
    * into account in the analysis.
@@ -136,6 +139,11 @@ private predicate fullBarrier(Node node, Configuration config) {
   or
   config.isBarrierOut(node) and
   not config.isSink(node)
+  or
+  exists(BarrierGuard g |
+    config.isBarrierGuard(g) and
+    node = g.getAGuardedNode()
+  )
 }
 
 private class AdditionalFlowStepSource extends Node {
@@ -826,6 +834,7 @@ private predicate localFlowExit(Node node, Configuration config) {
  * This is the transitive closure of `[additional]localFlowStep` beginning
  * at `localFlowEntry`.
  */
+pragma[nomagic]
 private predicate localFlowStepPlus(
   Node node1, Node node2, boolean preservesValue, Configuration config
 ) {
@@ -1086,28 +1095,44 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
     flowCandFwd(node, _, apf, config)
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    store(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandStore(node, f, toReturn, apf0, config) and
     apf0.headUsesContent(f) and
     consCand(f, apf, unbind(config))
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    read(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandRead(node, f, toReturn, apf0, config) and
     consCandFwd(f, apf0, unbind(config)) and
     apf.headUsesContent(f)
   )
 }
 
+pragma[nomagic]
+private predicate flowCandRead(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    read(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
+private predicate flowCandStore(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    store(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
 private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
   consCandFwd(f, apf, config) and
-  exists(Node mid, Node n, AccessPathFront apf0 |
+  exists(Node n, AccessPathFront apf0 |
     flowCandFwd(n, _, apf0, config) and
     apf0.headUsesContent(f) and
-    read(n, f, mid) and
-    flowCand(mid, _, apf, config)
+    flowCandRead(n, f, _, apf, config)
   )
 }
 
@@ -1447,8 +1472,18 @@ abstract class PathNode extends TPathNode {
    */
   string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
 
-  /** Gets the source location for this element. */
-  DataFlowLocation getLocation() { result = getNode().getLocation() }
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
 
   /** Gets the underlying `Node`. */
   abstract Node getNode();

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll

@@ -75,6 +75,9 @@ abstract class Configuration extends string {
   /** Holds if data flow out of `node` is prohibited. */
   predicate isBarrierOut(Node node) { none() }
 
+  /** Holds if data flow through nodes guarded by `guard` is prohibited. */
+  predicate isBarrierGuard(BarrierGuard guard) { none() }
+
   /**
    * Holds if the additional flow step from `node1` to `node2` must be taken
    * into account in the analysis.
@@ -136,6 +139,11 @@ private predicate fullBarrier(Node node, Configuration config) {
   or
   config.isBarrierOut(node) and
   not config.isSink(node)
+  or
+  exists(BarrierGuard g |
+    config.isBarrierGuard(g) and
+    node = g.getAGuardedNode()
+  )
 }
 
 private class AdditionalFlowStepSource extends Node {
@@ -826,6 +834,7 @@ private predicate localFlowExit(Node node, Configuration config) {
  * This is the transitive closure of `[additional]localFlowStep` beginning
  * at `localFlowEntry`.
  */
+pragma[nomagic]
 private predicate localFlowStepPlus(
   Node node1, Node node2, boolean preservesValue, Configuration config
 ) {
@@ -1086,28 +1095,44 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
     flowCandFwd(node, _, apf, config)
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    store(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandStore(node, f, toReturn, apf0, config) and
     apf0.headUsesContent(f) and
     consCand(f, apf, unbind(config))
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    read(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandRead(node, f, toReturn, apf0, config) and
     consCandFwd(f, apf0, unbind(config)) and
     apf.headUsesContent(f)
   )
 }
 
+pragma[nomagic]
+private predicate flowCandRead(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    read(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
+private predicate flowCandStore(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    store(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
 private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
   consCandFwd(f, apf, config) and
-  exists(Node mid, Node n, AccessPathFront apf0 |
+  exists(Node n, AccessPathFront apf0 |
     flowCandFwd(n, _, apf0, config) and
     apf0.headUsesContent(f) and
-    read(n, f, mid) and
-    flowCand(mid, _, apf, config)
+    flowCandRead(n, f, _, apf, config)
   )
 }
 
@@ -1447,8 +1472,18 @@ abstract class PathNode extends TPathNode {
    */
   string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
 
-  /** Gets the source location for this element. */
-  DataFlowLocation getLocation() { result = getNode().getLocation() }
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
 
   /** Gets the underlying `Node`. */
   abstract Node getNode();

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll

@@ -75,6 +75,9 @@ abstract class Configuration extends string {
   /** Holds if data flow out of `node` is prohibited. */
   predicate isBarrierOut(Node node) { none() }
 
+  /** Holds if data flow through nodes guarded by `guard` is prohibited. */
+  predicate isBarrierGuard(BarrierGuard guard) { none() }
+
   /**
    * Holds if the additional flow step from `node1` to `node2` must be taken
    * into account in the analysis.
@@ -136,6 +139,11 @@ private predicate fullBarrier(Node node, Configuration config) {
   or
   config.isBarrierOut(node) and
   not config.isSink(node)
+  or
+  exists(BarrierGuard g |
+    config.isBarrierGuard(g) and
+    node = g.getAGuardedNode()
+  )
 }
 
 private class AdditionalFlowStepSource extends Node {
@@ -826,6 +834,7 @@ private predicate localFlowExit(Node node, Configuration config) {
  * This is the transitive closure of `[additional]localFlowStep` beginning
  * at `localFlowEntry`.
  */
+pragma[nomagic]
 private predicate localFlowStepPlus(
   Node node1, Node node2, boolean preservesValue, Configuration config
 ) {
@@ -1086,28 +1095,44 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
     flowCandFwd(node, _, apf, config)
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    store(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandStore(node, f, toReturn, apf0, config) and
     apf0.headUsesContent(f) and
     consCand(f, apf, unbind(config))
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    read(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandRead(node, f, toReturn, apf0, config) and
     consCandFwd(f, apf0, unbind(config)) and
     apf.headUsesContent(f)
   )
 }
 
+pragma[nomagic]
+private predicate flowCandRead(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    read(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
+private predicate flowCandStore(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    store(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
 private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
   consCandFwd(f, apf, config) and
-  exists(Node mid, Node n, AccessPathFront apf0 |
+  exists(Node n, AccessPathFront apf0 |
     flowCandFwd(n, _, apf0, config) and
     apf0.headUsesContent(f) and
-    read(n, f, mid) and
-    flowCand(mid, _, apf, config)
+    flowCandRead(n, f, _, apf, config)
   )
 }
 
@@ -1447,8 +1472,18 @@ abstract class PathNode extends TPathNode {
    */
   string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
 
-  /** Gets the source location for this element. */
-  DataFlowLocation getLocation() { result = getNode().getLocation() }
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
 
   /** Gets the underlying `Node`. */
   abstract Node getNode();

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

@@ -55,6 +55,19 @@ class Node extends TNode {
   /** Gets the location of this element. */
   Location getLocation() { none() } // overridden by subclasses
 
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+
   /**
    * Gets an upper bound on the type of this node.
    */
@@ -318,3 +331,22 @@ VariableAccess getAnAccessToAssignedVariable(Expr assign) {
     result = var.getAnAccess()
   )
 }
+
+/**
+ * A guard that validates some expression.
+ *
+ * To use this in a configuration, extend the class and provide a
+ * characteristic predicate precisely specifying the guard, and override
+ * `checks` to specify what is being validated and in which branch.
+ *
+ * It is important that all extending classes in scope are disjoint.
+ */
+class BarrierGuard extends Expr {
+  /** NOT YET SUPPORTED. Holds if this guard validates `e` upon evaluating to `branch`. */
+  abstract deprecated predicate checks(Expr e, boolean branch);
+
+  /** Gets a node guarded by this guard. */
+  final Node getAGuardedNode() {
+    none() // stub
+  }
+}

cpp/ql/src/semmle/code/cpp/exprs/Literal.qll

@@ -255,9 +255,10 @@ class ArrayAggregateLiteral extends AggregateLiteral {
    * list, either explicitly with an expression, or implicitly value
    * initialized.
    */
-  pragma[inline]
+  bindingset[elementIndex]
   predicate isInitialized(int elementIndex) {
-    elementIndex in [0..arrayType.getArraySize() - 1]
+    elementIndex >= 0 and
+    elementIndex < arrayType.getArraySize()
   }
 
   /**
@@ -268,7 +269,7 @@ class ArrayAggregateLiteral extends AggregateLiteral {
    * of an object to `false`, `0`, `nullptr`, or by calling the default
    * constructor, as appropriate to the type.
    */
-  pragma[inline]
+  bindingset[elementIndex]
   predicate isValueInitialized(int elementIndex) {
     isInitialized(elementIndex) and
     not exists(getElementExpr(elementIndex))

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll

@@ -75,6 +75,9 @@ abstract class Configuration extends string {
   /** Holds if data flow out of `node` is prohibited. */
   predicate isBarrierOut(Node node) { none() }
 
+  /** Holds if data flow through nodes guarded by `guard` is prohibited. */
+  predicate isBarrierGuard(BarrierGuard guard) { none() }
+
   /**
    * Holds if the additional flow step from `node1` to `node2` must be taken
    * into account in the analysis.
@@ -136,6 +139,11 @@ private predicate fullBarrier(Node node, Configuration config) {
   or
   config.isBarrierOut(node) and
   not config.isSink(node)
+  or
+  exists(BarrierGuard g |
+    config.isBarrierGuard(g) and
+    node = g.getAGuardedNode()
+  )
 }
 
 private class AdditionalFlowStepSource extends Node {
@@ -826,6 +834,7 @@ private predicate localFlowExit(Node node, Configuration config) {
  * This is the transitive closure of `[additional]localFlowStep` beginning
  * at `localFlowEntry`.
  */
+pragma[nomagic]
 private predicate localFlowStepPlus(
   Node node1, Node node2, boolean preservesValue, Configuration config
 ) {
@@ -1086,28 +1095,44 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
     flowCandFwd(node, _, apf, config)
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    store(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandStore(node, f, toReturn, apf0, config) and
     apf0.headUsesContent(f) and
     consCand(f, apf, unbind(config))
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    read(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandRead(node, f, toReturn, apf0, config) and
     consCandFwd(f, apf0, unbind(config)) and
     apf.headUsesContent(f)
   )
 }
 
+pragma[nomagic]
+private predicate flowCandRead(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    read(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
+private predicate flowCandStore(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    store(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
 private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
   consCandFwd(f, apf, config) and
-  exists(Node mid, Node n, AccessPathFront apf0 |
+  exists(Node n, AccessPathFront apf0 |
     flowCandFwd(n, _, apf0, config) and
     apf0.headUsesContent(f) and
-    read(n, f, mid) and
-    flowCand(mid, _, apf, config)
+    flowCandRead(n, f, _, apf, config)
   )
 }
 
@@ -1447,8 +1472,18 @@ abstract class PathNode extends TPathNode {
    */
   string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
 
-  /** Gets the source location for this element. */
-  DataFlowLocation getLocation() { result = getNode().getLocation() }
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
 
   /** Gets the underlying `Node`. */
   abstract Node getNode();

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll

@@ -75,6 +75,9 @@ abstract class Configuration extends string {
   /** Holds if data flow out of `node` is prohibited. */
   predicate isBarrierOut(Node node) { none() }
 
+  /** Holds if data flow through nodes guarded by `guard` is prohibited. */
+  predicate isBarrierGuard(BarrierGuard guard) { none() }
+
   /**
    * Holds if the additional flow step from `node1` to `node2` must be taken
    * into account in the analysis.
@@ -136,6 +139,11 @@ private predicate fullBarrier(Node node, Configuration config) {
   or
   config.isBarrierOut(node) and
   not config.isSink(node)
+  or
+  exists(BarrierGuard g |
+    config.isBarrierGuard(g) and
+    node = g.getAGuardedNode()
+  )
 }
 
 private class AdditionalFlowStepSource extends Node {
@@ -826,6 +834,7 @@ private predicate localFlowExit(Node node, Configuration config) {
  * This is the transitive closure of `[additional]localFlowStep` beginning
  * at `localFlowEntry`.
  */
+pragma[nomagic]
 private predicate localFlowStepPlus(
   Node node1, Node node2, boolean preservesValue, Configuration config
 ) {
@@ -1086,28 +1095,44 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
     flowCandFwd(node, _, apf, config)
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    store(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandStore(node, f, toReturn, apf0, config) and
     apf0.headUsesContent(f) and
     consCand(f, apf, unbind(config))
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    read(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandRead(node, f, toReturn, apf0, config) and
     consCandFwd(f, apf0, unbind(config)) and
     apf.headUsesContent(f)
   )
 }
 
+pragma[nomagic]
+private predicate flowCandRead(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    read(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
+private predicate flowCandStore(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    store(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
 private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
   consCandFwd(f, apf, config) and
-  exists(Node mid, Node n, AccessPathFront apf0 |
+  exists(Node n, AccessPathFront apf0 |
     flowCandFwd(n, _, apf0, config) and
     apf0.headUsesContent(f) and
-    read(n, f, mid) and
-    flowCand(mid, _, apf, config)
+    flowCandRead(n, f, _, apf, config)
   )
 }
 
@@ -1447,8 +1472,18 @@ abstract class PathNode extends TPathNode {
    */
   string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
 
-  /** Gets the source location for this element. */
-  DataFlowLocation getLocation() { result = getNode().getLocation() }
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
 
   /** Gets the underlying `Node`. */
   abstract Node getNode();

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll

@@ -75,6 +75,9 @@ abstract class Configuration extends string {
   /** Holds if data flow out of `node` is prohibited. */
   predicate isBarrierOut(Node node) { none() }
 
+  /** Holds if data flow through nodes guarded by `guard` is prohibited. */
+  predicate isBarrierGuard(BarrierGuard guard) { none() }
+
   /**
    * Holds if the additional flow step from `node1` to `node2` must be taken
    * into account in the analysis.
@@ -136,6 +139,11 @@ private predicate fullBarrier(Node node, Configuration config) {
   or
   config.isBarrierOut(node) and
   not config.isSink(node)
+  or
+  exists(BarrierGuard g |
+    config.isBarrierGuard(g) and
+    node = g.getAGuardedNode()
+  )
 }
 
 private class AdditionalFlowStepSource extends Node {
@@ -826,6 +834,7 @@ private predicate localFlowExit(Node node, Configuration config) {
  * This is the transitive closure of `[additional]localFlowStep` beginning
  * at `localFlowEntry`.
  */
+pragma[nomagic]
 private predicate localFlowStepPlus(
   Node node1, Node node2, boolean preservesValue, Configuration config
 ) {
@@ -1086,28 +1095,44 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
     flowCandFwd(node, _, apf, config)
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    store(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandStore(node, f, toReturn, apf0, config) and
     apf0.headUsesContent(f) and
     consCand(f, apf, unbind(config))
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    read(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandRead(node, f, toReturn, apf0, config) and
     consCandFwd(f, apf0, unbind(config)) and
     apf.headUsesContent(f)
   )
 }
 
+pragma[nomagic]
+private predicate flowCandRead(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    read(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
+private predicate flowCandStore(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    store(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
 private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
   consCandFwd(f, apf, config) and
-  exists(Node mid, Node n, AccessPathFront apf0 |
+  exists(Node n, AccessPathFront apf0 |
     flowCandFwd(n, _, apf0, config) and
     apf0.headUsesContent(f) and
-    read(n, f, mid) and
-    flowCand(mid, _, apf, config)
+    flowCandRead(n, f, _, apf, config)
   )
 }
 
@@ -1447,8 +1472,18 @@ abstract class PathNode extends TPathNode {
    */
   string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
 
-  /** Gets the source location for this element. */
-  DataFlowLocation getLocation() { result = getNode().getLocation() }
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
 
   /** Gets the underlying `Node`. */
   abstract Node getNode();

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll

@@ -75,6 +75,9 @@ abstract class Configuration extends string {
   /** Holds if data flow out of `node` is prohibited. */
   predicate isBarrierOut(Node node) { none() }
 
+  /** Holds if data flow through nodes guarded by `guard` is prohibited. */
+  predicate isBarrierGuard(BarrierGuard guard) { none() }
+
   /**
    * Holds if the additional flow step from `node1` to `node2` must be taken
    * into account in the analysis.
@@ -136,6 +139,11 @@ private predicate fullBarrier(Node node, Configuration config) {
   or
   config.isBarrierOut(node) and
   not config.isSink(node)
+  or
+  exists(BarrierGuard g |
+    config.isBarrierGuard(g) and
+    node = g.getAGuardedNode()
+  )
 }
 
 private class AdditionalFlowStepSource extends Node {
@@ -826,6 +834,7 @@ private predicate localFlowExit(Node node, Configuration config) {
  * This is the transitive closure of `[additional]localFlowStep` beginning
  * at `localFlowEntry`.
  */
+pragma[nomagic]
 private predicate localFlowStepPlus(
   Node node1, Node node2, boolean preservesValue, Configuration config
 ) {
@@ -1086,28 +1095,44 @@ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Co
     flowCandFwd(node, _, apf, config)
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    store(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandStore(node, f, toReturn, apf0, config) and
     apf0.headUsesContent(f) and
     consCand(f, apf, unbind(config))
   )
   or
-  exists(Node mid, Content f, AccessPathFront apf0 |
-    read(node, f, mid) and
-    flowCand(mid, toReturn, apf0, config) and
+  exists(Content f, AccessPathFront apf0 |
+    flowCandRead(node, f, toReturn, apf0, config) and
     consCandFwd(f, apf0, unbind(config)) and
     apf.headUsesContent(f)
   )
 }
 
+pragma[nomagic]
+private predicate flowCandRead(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    read(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
+private predicate flowCandStore(
+  Node node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
+) {
+  exists(Node mid |
+    store(node, f, mid) and
+    flowCand(mid, toReturn, apf0, config)
+  )
+}
+
 private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
   consCandFwd(f, apf, config) and
-  exists(Node mid, Node n, AccessPathFront apf0 |
+  exists(Node n, AccessPathFront apf0 |
     flowCandFwd(n, _, apf0, config) and
     apf0.headUsesContent(f) and
-    read(n, f, mid) and
-    flowCand(mid, _, apf, config)
+    flowCandRead(n, f, _, apf, config)
   )
 }
 
@@ -1447,8 +1472,18 @@ abstract class PathNode extends TPathNode {
    */
   string toStringWithContext() { result = getNode().toString() + ppAp() + ppCtx() }
 
-  /** Gets the source location for this element. */
-  DataFlowLocation getLocation() { result = getNode().getLocation() }
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
 
   /** Gets the underlying `Node`. */
   abstract Node getNode();

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -4,6 +4,7 @@
 
 private import cpp
 private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.controlflow.IRGuards
 
 /**
  * A node in a data flow graph.
@@ -51,6 +52,19 @@ class Node extends Instruction {
    * Gets an upper bound on the type of this node.
    */
   Type getTypeBound() { result = getType() }
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://help.semmle.com/QL/learn-ql/ql/locations.html).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
 }
 
 /**
@@ -153,3 +167,22 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) {
  * (intra-procedural) steps.
  */
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
+
+/**
+ * A guard that validates some expression.
+ *
+ * To use this in a configuration, extend the class and provide a
+ * characteristic predicate precisely specifying the guard, and override
+ * `checks` to specify what is being validated and in which branch.
+ *
+ * It is important that all extending classes in scope are disjoint.
+ */
+class BarrierGuard extends IRGuardCondition {
+  /** NOT YET SUPPORTED. Holds if this guard validates `e` upon evaluating to `b`. */
+  abstract deprecated predicate checks(Instruction e, boolean b);
+
+  /** Gets a node guarded by this guard. */
+  final Node getAGuardedNode() {
+    none() // stub
+  }
+}

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll

@@ -1,20 +1,5 @@
 private import cpp
 
-private predicate fieldIsInitialized(Field field) {
-  exists(ClassAggregateLiteral initList |
-    initList.isInitialized(field)
-  ) or
-  exists(ConstructorFieldInit init |
-    field = init.getTarget()
-  )
-}
-
-private predicate elementIsInitialized(int elementIndex) {
-  exists(ArrayAggregateLiteral initList |
-    initList.isInitialized(elementIndex)
-  )
-}
-
 newtype TInstructionTag =
   OnlyInstructionTag() or  // Single instruction (not including implicit Load)
   InitializeThisTag() or
@@ -64,27 +49,13 @@ newtype TInstructionTag =
   ThrowTag() or
   UnwindTag() or
   InitializerUninitializedTag() or
-  InitializerFieldAddressTag(Field field) {
-    fieldIsInitialized(field)
-  } or
-  InitializerFieldDefaultValueTag(Field field) {
-    fieldIsInitialized(field)
-  } or
-  InitializerFieldDefaultValueStoreTag(Field field) {
-    fieldIsInitialized(field)
-  } or
-  InitializerElementIndexTag(int elementIndex) {
-    elementIsInitialized(elementIndex)
-  } or
-  InitializerElementAddressTag(int elementIndex) {
-    elementIsInitialized(elementIndex)
-  } or
-  InitializerElementDefaultValueTag(int elementIndex) {
-    elementIsInitialized(elementIndex)
-  } or
-  InitializerElementDefaultValueStoreTag(int elementIndex) {
-    elementIsInitialized(elementIndex)
-  } or
+  InitializerFieldAddressTag() or
+  InitializerFieldDefaultValueTag() or
+  InitializerFieldDefaultValueStoreTag() or
+  InitializerElementIndexTag() or
+  InitializerElementAddressTag() or
+  InitializerElementDefaultValueTag() or
+  InitializerElementDefaultValueStoreTag() or
   AsmTag() or
   AsmInputTag(int elementIndex) {
     exists(AsmStmt asm |
@@ -150,24 +121,13 @@ string getInstructionTagId(TInstructionTag tag) {
   tag = CatchTag() and result = "Catch" or
   tag = ThrowTag() and result = "Throw" or
   tag = UnwindTag() and result = "Unwind" or
-  exists(Field field, Class cls, int index, string tagName |
-    field = cls.getCanonicalMember(index) and
-    (
-      tag = InitializerFieldAddressTag(field) and tagName = "InitFieldAddr" or
-      tag = InitializerFieldDefaultValueTag(field) and tagName = "InitFieldDefVal" or
-      tag = InitializerFieldDefaultValueStoreTag(field) and tagName = "InitFieldDefValStore"
-    ) and
-    result = tagName + "(" + index + ")"
-  ) or
-  exists(int index, string tagName |
-    (
-      tag = InitializerElementIndexTag(index) and tagName = "InitElemIndex" or
-      tag = InitializerElementAddressTag(index) and tagName = "InitElemAddr" or
-      tag = InitializerElementDefaultValueTag(index) and tagName = "InitElemDefVal" or
-      tag = InitializerElementDefaultValueStoreTag(index) and tagName = "InitElemDefValStore"
-    ) and
-    result = tagName + "(" + index + ")"
-  ) or
+  tag = InitializerFieldAddressTag() and result = "InitFieldAddr" or
+  tag = InitializerFieldDefaultValueTag() and result = "InitFieldDefVal" or
+  tag = InitializerFieldDefaultValueStoreTag() and result = "InitFieldDefValStore" or
+  tag = InitializerElementIndexTag() and result = "InitElemIndex" or
+  tag = InitializerElementAddressTag() and result = "InitElemAddr" or
+  tag = InitializerElementDefaultValueTag() and result = "InitElemDefVal" or
+  tag = InitializerElementDefaultValueStoreTag() and result = "InitElemDefValStore" or
   tag = AsmTag() and result = "Asm" or
   exists(int index |
     tag = AsmInputTag(index) and result = "AsmInputTag(" + index + ")"

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -441,7 +441,7 @@ private predicate isFirstValueInitializedElementInRange(
   initList.isValueInitialized(elementIndex) and
   (
     elementIndex = 0 or
-    not initList.isValueInitialized(elementIndex - 1)
+    exists(initList.getElementExpr(elementIndex - 1))
   )
 }
 

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll

@@ -497,7 +497,7 @@ abstract class TranslatedFieldInitialization extends TranslatedElement {
   }
 
   final InstructionTag getFieldAddressTag() {
-    result = InitializerFieldAddressTag(field)
+    result = InitializerFieldAddressTag()
   }
 
   final Field getField() {
@@ -625,11 +625,11 @@ class TranslatedFieldValueInitialization extends TranslatedFieldInitialization,
   }
 
   private InstructionTag getFieldDefaultValueTag() {
-    result = InitializerFieldDefaultValueTag(field)
+    result = InitializerFieldDefaultValueTag()
   }
 
   private InstructionTag getFieldDefaultValueStoreTag() {
-    result = InitializerFieldDefaultValueStoreTag(field)
+    result = InitializerFieldDefaultValueStoreTag()
   }
 }
 
@@ -699,11 +699,11 @@ abstract class TranslatedElementInitialization extends TranslatedElement {
   abstract int getElementIndex();
 
   final InstructionTag getElementAddressTag() {
-    result = InitializerElementAddressTag(getElementIndex())
+    result = InitializerElementAddressTag()
   }
 
   final InstructionTag getElementIndexTag() {
-    result = InitializerElementIndexTag(getElementIndex())
+    result = InitializerElementIndexTag()
   }
 
   final ArrayAggregateLiteral getInitList() {
@@ -861,11 +861,11 @@ class TranslatedElementValueInitialization extends TranslatedElementInitializati
   }
   
   private InstructionTag getElementDefaultValueTag() {
-    result = InitializerElementDefaultValueTag(elementIndex)
+    result = InitializerElementDefaultValueTag()
   }
 
   private InstructionTag getElementDefaultValueStoreTag() {
-    result = InitializerElementDefaultValueStoreTag(elementIndex)
+    result = InitializerElementDefaultValueStoreTag()
   }
 
   private Type getDefaultValueType() {

cpp/ql/test/library-tests/enums/enums/Enums1.expected

@@ -11,6 +11,8 @@
 | enums.cpp:5:13:5:13 | b | b | 1 | Flag | 1 | 1 | 1 |
 | enums.cpp:5:22:5:22 | c | c | 1 | Flag | 1 | 1 | 1 |
 | enums.cpp:5:31:5:31 | d | d | 1 | Flag | 1 | 1 | 1 |
+| enums.cpp:21:3:21:21 | myLocalEnumConstant | myLocalEnumConstant | 1 | myLocalEnum | 1 | 1 | 1 |
+| enums.cpp:29:5:29:24 | MyNestedEnumConstant | MyNestedEnumConstant | 1 | MyNestedEnum | 1 | 1 | 1 |
 | enums.ms.c:2:3:2:6 | zero | zero | 1 | numbers | 1 | 1 | 1 |
 | enums.ms.c:2:9:2:11 | one | one | 1 | numbers | 1 | 1 | 1 |
 | scoped.cpp:3:5:3:5 | X | X | 1 | E1 | 1 | 1 | 1 |

cpp/ql/test/library-tests/enums/enums/Enums3.expected

@@ -1,8 +1,10 @@
-| enums.cpp:3:6:3:8 | Day | false |
-| enums.cpp:4:6:4:9 | Day2 | false |
-| enums.cpp:5:6:5:9 | Flag | false |
-| enums.ms.c:1:6:1:12 | numbers | false |
-| scoped.cpp:2:12:2:13 | E1 | true |
-| scoped.cpp:6:12:6:13 | E2 | true |
-| scoped.cpp:10:13:10:14 | E3 | true |
-| scoped.cpp:16:14:16:18 | State | true |
+| enums.cpp:3:6:3:8 | Day |  |
+| enums.cpp:4:6:4:9 | Day2 |  |
+| enums.cpp:5:6:5:9 | Flag |  |
+| enums.cpp:19:7:19:17 | myLocalEnum | LocalEnum |
+| enums.cpp:27:8:27:19 | MyNestedEnum | NestedEnum |
+| enums.ms.c:1:6:1:12 | numbers |  |
+| scoped.cpp:2:12:2:13 | E1 | ScopedEnum |
+| scoped.cpp:6:12:6:13 | E2 | ScopedEnum |
+| scoped.cpp:10:13:10:14 | E3 | ScopedEnum |
+| scoped.cpp:16:14:16:18 | State | NestedEnum, ScopedEnum |

cpp/ql/test/library-tests/enums/enums/Enums3.ql

@@ -1,6 +1,18 @@
 import cpp
 
-from Enum e, boolean isScoped
-where if e instanceof ScopedEnum then isScoped = true else isScoped = false
-select e, isScoped
+string describe(Enum e)
+{
+  (
+    e instanceof LocalEnum and
+    result = "LocalEnum"
+  ) or (
+    e instanceof NestedEnum and
+    result = "NestedEnum"
+  ) or (
+    e instanceof ScopedEnum and
+    result = "ScopedEnum"
+  )
+}
 
+from Enum e
+select e, concat(describe(e), ", ")

cpp/ql/test/library-tests/enums/enums/enums.cpp

@@ -13,3 +13,19 @@ Day& operator++(Day& d)
 	Day2 d2 = (Day2)d;
 	return d = (sat==d) ? sun: Day(d+1);
 }
+
+void myFunction()
+{
+	enum myLocalEnum
+	{
+		myLocalEnumConstant
+	};
+};
+
+class MyClass
+{
+  enum MyNestedEnum
+  {
+    MyNestedEnumConstant
+  };
+};

cpp/ql/test/library-tests/functions/functions/Functions1.expected

@@ -32,3 +32,10 @@
 | functions.cpp:28:3:28:8 | ~Table | ~Table |  |  | functions.cpp:28:3:28:8 | definition |
 | functions.cpp:29:9:29:14 | lookup | lookup |  |  | functions.cpp:29:9:29:14 | declaration |
 | functions.cpp:30:8:30:13 | insert | insert |  |  | functions.cpp:30:8:30:13 | declaration |
+| functions.cpp:33:7:33:7 | operator= | operator= |  |  | functions.cpp:33:7:33:7 | declaration |
+| functions.cpp:33:7:33:7 | operator= | operator= |  |  | functions.cpp:33:7:33:7 | definition |
+| functions.cpp:36:2:36:8 | MyClass | MyClass |  |  | functions.cpp:36:2:36:8 | declaration |
+| functions.cpp:37:2:37:8 | MyClass | MyClass |  |  | functions.cpp:37:2:37:8 | declaration |
+| functions.cpp:38:2:38:8 | MyClass | MyClass |  |  | functions.cpp:38:2:38:8 | declaration |
+| functions.cpp:39:2:39:8 | MyClass | MyClass |  |  | functions.cpp:39:2:39:8 | declaration |
+| functions.cpp:40:2:40:13 | operator int | operator int |  |  | functions.cpp:40:2:40:13 | declaration |

cpp/ql/test/library-tests/functions/functions/Functions2.expected

@@ -1,23 +1,26 @@
-| ODASA-5186.cpp:4:8:4:14 | MyClass<T> | Class | ODASA-5186.cpp:5:8:5:17 | operator== | member function |
-| ODASA-5186.cpp:4:8:4:14 | MyClass<int> | Struct | ODASA-5186.cpp:4:8:4:8 | operator= | member function |
-| ODASA-5186.cpp:4:8:4:14 | MyClass<int> | Struct | ODASA-5186.cpp:4:8:4:8 | operator= | member function |
-| ODASA-5186.cpp:4:8:4:14 | MyClass<int> | Struct | ODASA-5186.cpp:5:8:5:8 | operator== | member function |
-| ODASA-5186.hpp:2:8:2:17 | NEQ_helper<MyClass<int>> | Struct | ODASA-5186.hpp:2:8:2:8 | operator= | member function |
-| ODASA-5186.hpp:2:8:2:17 | NEQ_helper<MyClass<int>> | Struct | ODASA-5186.hpp:2:8:2:8 | operator= | member function |
-| file://:0:0:0:0 | __va_list_tag | Struct | file://:0:0:0:0 | operator= | member function |
-| file://:0:0:0:0 | __va_list_tag | Struct | file://:0:0:0:0 | operator= | member function |
-| functions.cpp:7:8:7:8 | A | Struct | functions.cpp:7:8:7:8 | operator= | member function |
-| functions.cpp:7:8:7:8 | A | Struct | functions.cpp:7:8:7:8 | operator= | member function |
-| functions.cpp:7:8:7:8 | A | Struct | functions.cpp:8:7:8:8 | af | member function |
-| functions.cpp:7:8:7:8 | A | Struct | functions.cpp:11:7:11:8 | ag | member function |
-| functions.cpp:19:7:19:10 | Name | Class | functions.cpp:19:7:19:7 | operator= | member function |
-| functions.cpp:19:7:19:10 | Name | Class | functions.cpp:19:7:19:7 | operator= | member function |
-| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:23:7:23:7 | Table | constructor |
-| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:23:7:23:7 | Table | member function |
-| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:23:7:23:7 | operator= | member function |
-| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:27:3:27:7 | Table | constructor |
-| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:27:3:27:7 | Table | member function |
-| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:28:3:28:8 | ~Table | destructor |
-| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:28:3:28:8 | ~Table | member function |
-| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:29:9:29:14 | lookup | member function |
-| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:30:8:30:13 | insert | member function |
+| ODASA-5186.cpp:4:8:4:14 | MyClass<T> | Class | ODASA-5186.cpp:5:8:5:17 | operator== |  |
+| ODASA-5186.cpp:4:8:4:14 | MyClass<int> | Struct | ODASA-5186.cpp:4:8:4:8 | operator= |  |
+| ODASA-5186.cpp:4:8:4:14 | MyClass<int> | Struct | ODASA-5186.cpp:4:8:4:8 | operator= |  |
+| ODASA-5186.cpp:4:8:4:14 | MyClass<int> | Struct | ODASA-5186.cpp:5:8:5:8 | operator== |  |
+| ODASA-5186.hpp:2:8:2:17 | NEQ_helper<MyClass<int>> | Struct | ODASA-5186.hpp:2:8:2:8 | operator= |  |
+| ODASA-5186.hpp:2:8:2:17 | NEQ_helper<MyClass<int>> | Struct | ODASA-5186.hpp:2:8:2:8 | operator= |  |
+| file://:0:0:0:0 | __va_list_tag | Struct | file://:0:0:0:0 | operator= |  |
+| file://:0:0:0:0 | __va_list_tag | Struct | file://:0:0:0:0 | operator= |  |
+| functions.cpp:7:8:7:8 | A | Struct | functions.cpp:7:8:7:8 | operator= |  |
+| functions.cpp:7:8:7:8 | A | Struct | functions.cpp:7:8:7:8 | operator= |  |
+| functions.cpp:7:8:7:8 | A | Struct | functions.cpp:8:7:8:8 | af |  |
+| functions.cpp:7:8:7:8 | A | Struct | functions.cpp:11:7:11:8 | ag |  |
+| functions.cpp:19:7:19:10 | Name | Class | functions.cpp:19:7:19:7 | operator= |  |
+| functions.cpp:19:7:19:10 | Name | Class | functions.cpp:19:7:19:7 | operator= |  |
+| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:23:7:23:7 | Table | Constructor, CopyConstructor, getAConstructor() |
+| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:23:7:23:7 | operator= |  |
+| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:27:3:27:7 | Table | Constructor, getAConstructor() |
+| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:28:3:28:8 | ~Table | Destructor, getDestructor() |
+| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:29:9:29:14 | lookup |  |
+| functions.cpp:23:7:23:11 | Table | Class | functions.cpp:30:8:30:13 | insert |  |
+| functions.cpp:33:7:33:13 | MyClass | Class | functions.cpp:33:7:33:7 | operator= |  |
+| functions.cpp:33:7:33:13 | MyClass | Class | functions.cpp:36:2:36:8 | MyClass | Constructor, NoArgConstructor, getAConstructor() |
+| functions.cpp:33:7:33:13 | MyClass | Class | functions.cpp:37:2:37:8 | MyClass | Constructor, ConversionConstructor, getAConstructor() |
+| functions.cpp:33:7:33:13 | MyClass | Class | functions.cpp:38:2:38:8 | MyClass | Constructor, CopyConstructor, getAConstructor() |
+| functions.cpp:33:7:33:13 | MyClass | Class | functions.cpp:39:2:39:8 | MyClass | Constructor, ConversionConstructor, MoveConstructor, getAConstructor() |
+| functions.cpp:33:7:33:13 | MyClass | Class | functions.cpp:40:2:40:13 | operator int | ConversionOperator |

cpp/ql/test/library-tests/functions/functions/Functions2.ql

@@ -4,12 +4,41 @@
  */
 import cpp
 
-from Class c, string ctype, MemberFunction f, string ftype
-where
-	if c instanceof Struct then ctype = "Struct" else ctype = "Class" and
+bindingset[c, f] string describe(Class c, MemberFunction f)
+{
 	(
-		(f = c.getAConstructor() and ftype = "constructor") or
-		(f = c.getDestructor() and ftype = "destructor") or
-		(f.getDeclaringType() = c and ftype = "member function")
+		f = c.getAConstructor() and
+		result = "getAConstructor()"
+	) or (
+		f = c.getDestructor() and
+		result = "getDestructor()"
+	) or (
+		f instanceof Constructor and
+		result = "Constructor"
+	) or (
+		f instanceof Destructor and
+		result = "Destructor"
+	) or (
+		f instanceof ConversionConstructor and
+		result = "ConversionConstructor"
+	) or (
+		f instanceof CopyConstructor and
+		result = "CopyConstructor"
+	) or (
+		f instanceof MoveConstructor and
+		result = "MoveConstructor"
+	) or (
+		f instanceof NoArgConstructor and
+		result = "NoArgConstructor"
+	) or (
+		f instanceof ConversionOperator and
+		result = "ConversionOperator"
 	)
-select c, ctype, f, ftype
+}
+
+from Class c, string ctype, MemberFunction f
+where
+	f.getDeclaringType() = c and
+	if c instanceof Struct then ctype = "Struct" else ctype = "Class"
+select
+	c, ctype, f, concat(describe(c, f), ", ")

cpp/ql/test/library-tests/functions/functions/functions.cpp

@@ -30,4 +30,12 @@ public:
   bool insert(Name*);
 };
 
-
+class MyClass
+{
+public:
+	MyClass();
+	MyClass(int from);
+	MyClass(const MyClass &from);
+	MyClass(MyClass &&from);
+	operator int();
+};

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -6,6 +6,10 @@
 #-----|   params: 
 #-----|     0: [Parameter] p#0
 #-----|         Type = [RValueReferenceType] __va_list_tag &&
+#-----| [Operator,TopLevelFunction] void operator delete(void*)
+#-----|   params: 
+#-----|     0: [Parameter] p#0
+#-----|         Type = [VoidPointerType] void *
 #-----| [Operator,TopLevelFunction] void operator delete(void*, unsigned long)
 #-----|   params: 
 #-----|     0: [Parameter] p#0
@@ -8001,3 +8005,49 @@ ir.cpp:
 # 1147|       2: [Handler] <handler>
 # 1147|         0: [CatchBlock] { ... }
 # 1149|     1: [ReturnStmt] return ...
+perf-regression.cpp:
+#    4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
+#    4|   params: 
+#-----|     0: [Parameter] p#0
+#-----|         Type = [LValueReferenceType] const Big &
+#    4| [MoveAssignmentOperator] Big& Big::operator=(Big&&)
+#    4|   params: 
+#-----|     0: [Parameter] p#0
+#-----|         Type = [RValueReferenceType] Big &&
+#    4| [CopyConstructor] void Big::Big(Big const&)
+#    4|   params: 
+#-----|     0: [Parameter] p#0
+#-----|         Type = [LValueReferenceType] const Big &
+#    4| [MoveConstructor] void Big::Big(Big&&)
+#    4|   params: 
+#-----|     0: [Parameter] p#0
+#-----|         Type = [RValueReferenceType] Big &&
+#    6| [Constructor] void Big::Big()
+#    6|   params: 
+#    6|   initializations: 
+#    6|     0: [ConstructorFieldInit] constructor init of field buffer
+#    6|         Type = [ArrayType] char[1073741824]
+#    6|         ValueCategory = prvalue
+#    6|       0: [ArrayAggregateLiteral] {...}
+#    6|           Type = [ArrayType] char[1073741824]
+#    6|           ValueCategory = prvalue
+#    6|   body: [Block] { ... }
+#    6|     0: [ReturnStmt] return ...
+#    9| [TopLevelFunction] int main()
+#    9|   params: 
+#    9|   body: [Block] { ... }
+#   10|     0: [DeclStmt] declaration
+#   10|       0: [VariableDeclarationEntry] definition of big
+#   10|           Type = [PointerType] Big *
+#   10|         init: [Initializer] initializer for big
+#   10|           expr: [NewExpr] new
+#   10|               Type = [PointerType] Big *
+#   10|               ValueCategory = prvalue
+#   10|             1: [ConstructorCall] call to Big
+#   10|                 Type = [VoidType] void
+#   10|                 ValueCategory = prvalue
+#   12|     1: [ReturnStmt] return ...
+#   12|       0: [Literal,Zero] 0
+#   12|           Type = [IntType] int
+#   12|           Value = [Literal,Zero] 0
+#   12|           ValueCategory = prvalue

cpp/ql/test/library-tests/ir/ir/perf-regression.cpp

@@ -0,0 +1,13 @@
+// This test ensures that we can efficiently generate IR for a large
+// value-initialized array.
+
+struct Big {
+  char buffer[1 << 30]; // 1 GiB
+  Big() : buffer() {} // This explicit init of `buffer` makes it value-initialized
+};
+
+int main() {
+  Big *big = new Big;
+
+  return 0;
+}

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -5269,3 +5269,43 @@ ir.cpp:
 # 1149|     v13_0(void) = NoOp       : 
 # 1133|     v13_1(void) = ReturnVoid : 
 #-----|   Goto -> Block 1
+
+perf-regression.cpp:
+#    6| void Big::Big()
+#    6|   Block 0
+#    6|     v0_0(void)                    = EnterFunction        : 
+#    6|     mu0_1(unknown)                = AliasedDefinition    : 
+#    6|     mu0_2(unknown)                = UnmodeledDefinition  : 
+#    6|     r0_3(glval<Big>)              = InitializeThis       : 
+#    6|     r0_4(glval<char[1073741824]>) = FieldAddress[buffer] : r0_3
+#    6|     r0_5(int)                     = Constant[0]          : 
+#    6|     r0_6(glval<char>)             = PointerAdd           : r0_4, r0_5
+#    6|     r0_7(unknown[1073741824])     = Constant[0]          : 
+#    6|     mu0_8(unknown[1073741824])    = Store                : &:r0_6, r0_7
+#    6|     v0_9(void)                    = NoOp                 : 
+#    6|     v0_10(void)                   = ReturnVoid           : 
+#    6|     v0_11(void)                   = UnmodeledUse         : mu*
+#    6|     v0_12(void)                   = ExitFunction         : 
+
+#    9| int main()
+#    9|   Block 0
+#    9|     v0_0(void)           = EnterFunction                 : 
+#    9|     mu0_1(unknown)       = AliasedDefinition             : 
+#    9|     mu0_2(unknown)       = UnmodeledDefinition           : 
+#   10|     r0_3(glval<Big *>)   = VariableAddress[big]          : 
+#   10|     r0_4(glval<unknown>) = FunctionAddress[operator new] : 
+#   10|     r0_5(unsigned long)  = Constant[1073741824]          : 
+#   10|     r0_6(void *)         = Call                          : func:r0_4, 0:r0_5
+#   10|     mu0_7(unknown)       = ^CallSideEffect               : ~mu0_2
+#   10|     r0_8(Big *)          = Convert                       : r0_6
+#   10|     r0_9(glval<unknown>) = FunctionAddress[Big]          : 
+#   10|     v0_10(void)          = Call                          : func:r0_9, this:r0_8
+#   10|     mu0_11(unknown)      = ^CallSideEffect               : ~mu0_2
+#   10|     mu0_12(Big *)        = Store                         : &:r0_3, r0_8
+#   12|     r0_13(glval<int>)    = VariableAddress[#return]      : 
+#   12|     r0_14(int)           = Constant[0]                   : 
+#   12|     mu0_15(int)          = Store                         : &:r0_13, r0_14
+#    9|     r0_16(glval<int>)    = VariableAddress[#return]      : 
+#    9|     v0_17(void)          = ReturnValue                   : &:r0_16, ~mu0_2
+#    9|     v0_18(void)          = UnmodeledUse                  : mu*
+#    9|     v0_19(void)          = ExitFunction                  : 

cpp/ql/test/library-tests/literals/aggregate_literals/arrays_value_init.ql

@@ -2,5 +2,6 @@ import cpp
 
 from ArrayType a, ArrayAggregateLiteral al, int i
 where a = al.getType()
+  and i = [0 .. al.getUnspecifiedType().(ArrayType).getArraySize()]
   and al.isValueInitialized(i)
 select al, a, i

cpp/ql/test/library-tests/structs/structs/structs.c

@@ -10,3 +10,9 @@ void f(void) {
     l = s.i;
 } 
 
+void myFunction()
+{ 
+  struct MyLocalStruct {
+    int x, y, z;
+  };
+}

cpp/ql/test/library-tests/structs/structs/structs.cpp

@@ -0,0 +1,8 @@
+
+class MyClass
+{
+public:
+  struct MyNestedStruct {
+    int x, y, z;
+  };
+};

cpp/ql/test/library-tests/structs/structs/structs.expected

@@ -1 +1,6 @@
+structs
+| structs.c:2:8:2:10 | foo |  |
+| structs.c:15:10:15:22 | MyLocalStruct | LocalStruct |
+| structs.cpp:5:10:5:23 | MyNestedStruct | NestedStruct |
+assignments
 | structs.c:10:5:10:11 | ... = ... | structs.c:10:5:10:5 | l | int | structs.c:10:11:10:11 | i | int |

cpp/ql/test/library-tests/structs/structs/structs.ql

@@ -1,9 +1,24 @@
 import cpp
 
-from Assignment a
-select a,
-       a.getLValue() as l,
-       l.getType().explain(),
-       a.getRValue() as r,
-       r.getType().explain()
+string describe(Struct s)
+{
+  (
+    s instanceof LocalStruct and
+    result = "LocalStruct"
+  ) or (
+    s instanceof NestedStruct and
+    result = "NestedStruct"
+  )
+}
 
+query predicate structs(Struct s, string descStr) {
+  s.fromSource() and
+  descStr = concat(describe(s), ", ")
+}
+
+query predicate assignments(Assignment a, Expr l, string explainL, Expr r, string explainR) {
+  l = a.getLValue() and
+  explainL = l.getType().explain() and
+  r = a.getRValue() and
+  explainR = r.getType().explain()
+}

cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected

@@ -0,0 +1,543 @@
+missingOperand
+| misc.c:125:5:125:11 | CopyValue: (statement expression) | Instruction 'CopyValue' is missing an expected operand with tag 'Unary' in function '$@'. | misc.c:97:6:97:10 | IR: misc3 | void misc3() |
+| try_catch.cpp:13:5:13:16 | ThrowValue: throw ... | Instruction 'ThrowValue' is missing an expected operand with tag 'Load' in function '$@'. | try_catch.cpp:11:6:11:17 | IR: bypass_catch | void bypass_catch() |
+unexpectedOperand
+duplicateOperand
+missingPhiOperand
+| cpp11.cpp:141:7:141:7 | Phi: g | cpp11.cpp:161:16:161:16 | NoOp: label ...: |
+missingOperandType
+instructionWithoutSuccessor
+| VacuousDestructorCall.cpp:2:29:2:29 | InitializeParameter: y |
+| assume0.cpp:7:2:7:2 | Chi: call to f |
+| builtin.c:15:18:15:21 | VariableAddress: definition of vec2 |
+| condition_decls.cpp:16:19:16:20 | Chi: call to BoxedInt |
+| condition_decls.cpp:26:23:26:24 | Chi: call to BoxedInt |
+| condition_decls.cpp:41:22:41:23 | Chi: call to BoxedInt |
+| condition_decls.cpp:48:52:48:53 | Chi: call to BoxedInt |
+| cpp17.cpp:15:11:15:21 | Convert: (void *)... |
+| misc.c:171:10:171:13 | Uninitialized: definition of str2 |
+| misc.c:219:47:219:48 | InitializeParameter: sp |
+| ms_try_except.cpp:3:9:3:9 | Uninitialized: definition of x |
+| ms_try_mix.cpp:11:12:11:15 | Chi: call to C |
+| ms_try_mix.cpp:28:12:28:15 | Chi: call to C |
+| ms_try_mix.cpp:48:10:48:13 | Chi: call to C |
+| stmt_expr.cpp:27:5:27:15 | Store: ... = ... |
+| vla.c:5:9:5:14 | Uninitialized: definition of matrix |
+| vla.c:11:6:11:16 | UnmodeledDefinition: vla_typedef |
+ambiguousSuccessors
+| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
+| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
+| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
+| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| assignexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | break_labels.c:3:9:3:14 | VariableAddress: definition of result |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | duff.c:3:9:3:9 | VariableAddress: definition of n |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | dummyblock.c:2:9:2:9 | Constant: 1 |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | emptyblock.c:2:5:3:5 | NoOp: { ... } |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | enum.c:6:2:6:10 | VariableAddress: return ... |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | exprstmt.c:2:5:2:5 | Constant: 1 |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | initializer.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | landexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | lorexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | ltrbinopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: i |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: x |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | nonmembercallexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | nonmemberfp2callexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | nonmemberfpcallexpr.c:2:8:2:8 | VariableAddress: definition of g |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | questionexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | subscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: i |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: x |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | tinyforstmt.c:3:9:3:9 | NoOp: ; |
+| break_labels.c:2:11:2:11 | InitializeParameter: i | Goto | 20 | unaryopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | break_labels.c:3:9:3:14 | VariableAddress: definition of result |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | duff.c:3:9:3:9 | VariableAddress: definition of n |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | dummyblock.c:2:9:2:9 | Constant: 1 |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | emptyblock.c:2:5:3:5 | NoOp: { ... } |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | enum.c:6:2:6:10 | VariableAddress: return ... |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | exprstmt.c:2:5:2:5 | Constant: 1 |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | initializer.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | landexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | lorexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | ltrbinopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: i |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: x |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | nonmembercallexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | nonmemberfp2callexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | nonmemberfpcallexpr.c:2:8:2:8 | VariableAddress: definition of g |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | questionexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | subscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: i |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: x |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | tinyforstmt.c:3:9:3:9 | NoOp: ; |
+| break_labels.c:2:11:2:11 | InitializeParameter: x | Goto | 20 | unaryopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| conditional_destructors.cpp:29:6:29:7 | UnmodeledDefinition: f1 | Goto | 2 | conditional_destructors.cpp:30:9:30:13 | FunctionAddress: call to C1 |
+| conditional_destructors.cpp:29:6:29:7 | UnmodeledDefinition: f1 | Goto | 2 | forstmt.cpp:2:14:2:14 | VariableAddress: definition of i |
+| conditional_destructors.cpp:38:6:38:7 | UnmodeledDefinition: f2 | Goto | 2 | conditional_destructors.cpp:39:9:39:13 | FunctionAddress: call to C2 |
+| conditional_destructors.cpp:38:6:38:7 | UnmodeledDefinition: f2 | Goto | 2 | forstmt.cpp:9:14:9:14 | VariableAddress: definition of i |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| constmemberaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| constructorinitializer.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| cpp17.cpp:15:19:15:21 | Load: ptr | Goto | 2 | cpp17.cpp:15:5:15:45 | Call: new |
+| cpp17.cpp:15:19:15:21 | Load: ptr | Goto | 2 | cpp17.cpp:15:11:15:21 | Convert: (void *)... |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| defconstructornewexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| defdestructordeleteexpr.cpp:3:6:3:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| deleteexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| dostmt.c:8:6:8:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | dostmt.c:10:5:10:7 | NoOp: label ...: |
+| dostmt.c:8:6:8:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | ifelsestmt.c:20:6:20:6 | Constant: 1 |
+| dostmt.c:8:6:8:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | ifstmt.c:15:6:15:6 | Constant: 1 |
+| dostmt.c:8:6:8:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | whilestmt.c:16:9:16:9 | Constant: 1 |
+| dostmt.c:16:6:16:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | dostmt.c:18:5:18:7 | NoOp: label ...: |
+| dostmt.c:16:6:16:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | ifelsestmt.c:30:6:30:6 | Constant: 1 |
+| dostmt.c:16:6:16:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | ifstmt.c:22:6:22:6 | Constant: 1 |
+| dostmt.c:16:6:16:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | whilestmt.c:24:9:24:9 | Constant: 1 |
+| dostmt.c:25:6:25:18 | UnmodeledDefinition: always_true_3 | Goto | 2 | dostmt.c:27:5:27:7 | NoOp: label ...: |
+| dostmt.c:25:6:25:18 | UnmodeledDefinition: always_true_3 | Goto | 2 | whilestmt.c:33:9:33:9 | Constant: 1 |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | break_labels.c:3:9:3:14 | VariableAddress: definition of result |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | duff.c:3:9:3:9 | VariableAddress: definition of n |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | dummyblock.c:2:9:2:9 | Constant: 1 |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | emptyblock.c:2:5:3:5 | NoOp: { ... } |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | enum.c:6:2:6:10 | VariableAddress: return ... |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | exprstmt.c:2:5:2:5 | Constant: 1 |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | initializer.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | landexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | lorexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | ltrbinopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: i |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: x |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | nonmembercallexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | nonmemberfp2callexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | nonmemberfpcallexpr.c:2:8:2:8 | VariableAddress: definition of g |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | questionexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | subscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: i |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: x |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | tinyforstmt.c:3:9:3:9 | NoOp: ; |
+| duff.c:2:12:2:12 | InitializeParameter: i | Goto | 20 | unaryopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | break_labels.c:3:9:3:14 | VariableAddress: definition of result |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | duff.c:3:9:3:9 | VariableAddress: definition of n |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | dummyblock.c:2:9:2:9 | Constant: 1 |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | emptyblock.c:2:5:3:5 | NoOp: { ... } |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | enum.c:6:2:6:10 | VariableAddress: return ... |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | exprstmt.c:2:5:2:5 | Constant: 1 |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | initializer.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | landexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | lorexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | ltrbinopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: i |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: x |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | nonmembercallexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | nonmemberfp2callexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | nonmemberfpcallexpr.c:2:8:2:8 | VariableAddress: definition of g |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | questionexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | subscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: i |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: x |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | tinyforstmt.c:3:9:3:9 | NoOp: ; |
+| duff.c:2:12:2:12 | InitializeParameter: x | Goto | 20 | unaryopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| fieldaccess.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| forstmt.cpp:1:6:1:7 | UnmodeledDefinition: f1 | Goto | 2 | conditional_destructors.cpp:30:9:30:13 | FunctionAddress: call to C1 |
+| forstmt.cpp:1:6:1:7 | UnmodeledDefinition: f1 | Goto | 2 | forstmt.cpp:2:14:2:14 | VariableAddress: definition of i |
+| forstmt.cpp:8:6:8:7 | UnmodeledDefinition: f2 | Goto | 2 | conditional_destructors.cpp:39:9:39:13 | FunctionAddress: call to C2 |
+| forstmt.cpp:8:6:8:7 | UnmodeledDefinition: f2 | Goto | 2 | forstmt.cpp:9:14:9:14 | VariableAddress: definition of i |
+| ifelsestmt.c:1:6:1:19 | UnmodeledDefinition: always_false_1 | Goto | 3 | ifelsestmt.c:2:6:2:6 | Constant: 0 |
+| ifelsestmt.c:1:6:1:19 | UnmodeledDefinition: always_false_1 | Goto | 3 | ifstmt.c:2:6:2:6 | Constant: 0 |
+| ifelsestmt.c:1:6:1:19 | UnmodeledDefinition: always_false_1 | Goto | 3 | whilestmt.c:2:9:2:9 | Constant: 0 |
+| ifelsestmt.c:11:6:11:19 | UnmodeledDefinition: always_false_2 | Goto | 3 | ifelsestmt.c:12:6:12:6 | Constant: 0 |
+| ifelsestmt.c:11:6:11:19 | UnmodeledDefinition: always_false_2 | Goto | 3 | ifstmt.c:9:6:9:6 | Constant: 0 |
+| ifelsestmt.c:11:6:11:19 | UnmodeledDefinition: always_false_2 | Goto | 3 | whilestmt.c:9:7:9:10 | VariableAddress: definition of done |
+| ifelsestmt.c:19:6:19:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | dostmt.c:10:5:10:7 | NoOp: label ...: |
+| ifelsestmt.c:19:6:19:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | ifelsestmt.c:20:6:20:6 | Constant: 1 |
+| ifelsestmt.c:19:6:19:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | ifstmt.c:15:6:15:6 | Constant: 1 |
+| ifelsestmt.c:19:6:19:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | whilestmt.c:16:9:16:9 | Constant: 1 |
+| ifelsestmt.c:29:6:29:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | dostmt.c:18:5:18:7 | NoOp: label ...: |
+| ifelsestmt.c:29:6:29:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | ifelsestmt.c:30:6:30:6 | Constant: 1 |
+| ifelsestmt.c:29:6:29:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | ifstmt.c:22:6:22:6 | Constant: 1 |
+| ifelsestmt.c:29:6:29:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | whilestmt.c:24:9:24:9 | Constant: 1 |
+| ifelsestmt.c:37:24:37:24 | InitializeParameter: y | Goto | 4 | dostmt.c:33:7:33:7 | VariableAddress: definition of i |
+| ifelsestmt.c:37:24:37:24 | InitializeParameter: y | Goto | 4 | ifelsestmt.c:38:6:38:6 | VariableAddress: x |
+| ifelsestmt.c:37:24:37:24 | InitializeParameter: y | Goto | 4 | ifstmt.c:28:6:28:6 | VariableAddress: x |
+| ifelsestmt.c:37:24:37:24 | InitializeParameter: y | Goto | 4 | whilestmt.c:40:7:40:7 | VariableAddress: definition of i |
+| ifstmt.c:1:6:1:19 | UnmodeledDefinition: always_false_1 | Goto | 3 | ifelsestmt.c:2:6:2:6 | Constant: 0 |
+| ifstmt.c:1:6:1:19 | UnmodeledDefinition: always_false_1 | Goto | 3 | ifstmt.c:2:6:2:6 | Constant: 0 |
+| ifstmt.c:1:6:1:19 | UnmodeledDefinition: always_false_1 | Goto | 3 | whilestmt.c:2:9:2:9 | Constant: 0 |
+| ifstmt.c:8:6:8:19 | UnmodeledDefinition: always_false_2 | Goto | 3 | ifelsestmt.c:12:6:12:6 | Constant: 0 |
+| ifstmt.c:8:6:8:19 | UnmodeledDefinition: always_false_2 | Goto | 3 | ifstmt.c:9:6:9:6 | Constant: 0 |
+| ifstmt.c:8:6:8:19 | UnmodeledDefinition: always_false_2 | Goto | 3 | whilestmt.c:9:7:9:10 | VariableAddress: definition of done |
+| ifstmt.c:14:6:14:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | dostmt.c:10:5:10:7 | NoOp: label ...: |
+| ifstmt.c:14:6:14:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | ifelsestmt.c:20:6:20:6 | Constant: 1 |
+| ifstmt.c:14:6:14:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | ifstmt.c:15:6:15:6 | Constant: 1 |
+| ifstmt.c:14:6:14:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | whilestmt.c:16:9:16:9 | Constant: 1 |
+| ifstmt.c:21:6:21:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | dostmt.c:18:5:18:7 | NoOp: label ...: |
+| ifstmt.c:21:6:21:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | ifelsestmt.c:30:6:30:6 | Constant: 1 |
+| ifstmt.c:21:6:21:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | ifstmt.c:22:6:22:6 | Constant: 1 |
+| ifstmt.c:21:6:21:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | whilestmt.c:24:9:24:9 | Constant: 1 |
+| ifstmt.c:27:24:27:24 | InitializeParameter: y | Goto | 4 | dostmt.c:33:7:33:7 | VariableAddress: definition of i |
+| ifstmt.c:27:24:27:24 | InitializeParameter: y | Goto | 4 | ifelsestmt.c:38:6:38:6 | VariableAddress: x |
+| ifstmt.c:27:24:27:24 | InitializeParameter: y | Goto | 4 | ifstmt.c:28:6:28:6 | VariableAddress: x |
+| ifstmt.c:27:24:27:24 | InitializeParameter: y | Goto | 4 | whilestmt.c:40:7:40:7 | VariableAddress: definition of i |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| membercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| membercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| misc.c:93:9:93:9 | Load: j | Goto | 2 | misc.c:93:9:93:9 | ConditionalBranch: j |
+| misc.c:93:9:93:9 | Load: j | Goto | 2 | misc.c:93:9:93:15 | VariableAddress: ... ? ... : ... |
+| misc.c:94:13:94:13 | Load: i | Goto | 2 | misc.c:94:9:94:19 | VariableAddress: ... ? ... : ... |
+| misc.c:94:13:94:13 | Load: i | Goto | 2 | misc.c:94:13:94:13 | ConditionalBranch: i |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
+| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
+| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
+| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | break_labels.c:3:9:3:14 | VariableAddress: definition of result |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | duff.c:3:9:3:9 | VariableAddress: definition of n |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | dummyblock.c:2:9:2:9 | Constant: 1 |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | emptyblock.c:2:5:3:5 | NoOp: { ... } |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | enum.c:6:2:6:10 | VariableAddress: return ... |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | exprstmt.c:2:5:2:5 | Constant: 1 |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | initializer.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | landexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | lorexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | ltrbinopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: i |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: x |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nonmembercallexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nonmemberfp2callexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nonmemberfpcallexpr.c:2:8:2:8 | VariableAddress: definition of g |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | questionexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | subscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: i |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: x |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | tinyforstmt.c:3:9:3:9 | NoOp: ; |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | unaryopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | break_labels.c:3:9:3:14 | VariableAddress: definition of result |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | duff.c:3:9:3:9 | VariableAddress: definition of n |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | dummyblock.c:2:9:2:9 | Constant: 1 |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | emptyblock.c:2:5:3:5 | NoOp: { ... } |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | enum.c:6:2:6:10 | VariableAddress: return ... |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | exprstmt.c:2:5:2:5 | Constant: 1 |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | initializer.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | landexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | lorexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | ltrbinopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: i |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: x |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nonmembercallexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nonmemberfp2callexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nonmemberfpcallexpr.c:2:8:2:8 | VariableAddress: definition of g |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | questionexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | subscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: i |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: x |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | tinyforstmt.c:3:9:3:9 | NoOp: ; |
+| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | unaryopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| nonmembercallexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | nonmembercallexpr.c:1:12:1:12 | NoOp: return ... |
+| nonmembercallexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | revsubscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
+| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
+| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
+| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| range_analysis.c:366:10:366:10 | Load: x | Goto | 2 | range_analysis.c:366:10:366:10 | ConditionalBranch: x |
+| range_analysis.c:366:10:366:10 | Load: x | Goto | 2 | range_analysis.c:366:10:366:15 | VariableAddress: ... ? ... : ... |
+| range_analysis.c:367:10:367:10 | Load: x | Goto | 2 | range_analysis.c:367:10:367:10 | ConditionalBranch: x |
+| range_analysis.c:367:10:367:10 | Load: x | Goto | 2 | range_analysis.c:367:10:367:17 | VariableAddress: ... ? ... : ... |
+| revsubscriptexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | nonmembercallexpr.c:1:12:1:12 | NoOp: return ... |
+| revsubscriptexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | revsubscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| staticmembercallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | assignexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | constmemberaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | constructorinitializer.cpp:7:6:7:6 | VariableAddress: definition of i |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | defconstructornewexpr.cpp:4:2:4:6 | FunctionAddress: new |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | defdestructordeleteexpr.cpp:4:5:4:5 | VariableAddress: definition of c |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | deleteexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | fieldaccess.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | membercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | newexpr.cpp:7:6:7:6 | VariableAddress: definition of a |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | pmcallexpr.cpp:7:5:7:5 | VariableAddress: definition of c |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
+| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
+| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
+| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
+| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
+| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | break_labels.c:3:9:3:14 | VariableAddress: definition of result |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | duff.c:3:9:3:9 | VariableAddress: definition of n |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | dummyblock.c:2:9:2:9 | Constant: 1 |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | emptyblock.c:2:5:3:5 | NoOp: { ... } |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | enum.c:6:2:6:10 | VariableAddress: return ... |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | exprstmt.c:2:5:2:5 | Constant: 1 |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | initializer.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | landexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | lorexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | ltrbinopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: i |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: x |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nonmembercallexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nonmemberfp2callexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | nonmemberfpcallexpr.c:2:8:2:8 | VariableAddress: definition of g |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | questionexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | subscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: i |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: x |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | tinyforstmt.c:3:9:3:9 | NoOp: ; |
+| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | unaryopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | break_labels.c:3:9:3:14 | VariableAddress: definition of result |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | duff.c:3:9:3:9 | VariableAddress: definition of n |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | dummyblock.c:2:9:2:9 | Constant: 1 |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | emptyblock.c:2:5:3:5 | NoOp: { ... } |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | enum.c:6:2:6:10 | VariableAddress: return ... |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | exprstmt.c:2:5:2:5 | Constant: 1 |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | initializer.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | landexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | lorexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | ltrbinopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: i |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nodefaultswitchstmt.c:2:14:2:14 | VariableAddress: x |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nonmembercallexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nonmemberfp2callexpr.c:4:2:4:2 | FunctionAddress: call to g |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | nonmemberfpcallexpr.c:2:8:2:8 | VariableAddress: definition of g |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | questionexpr.c:2:6:2:6 | VariableAddress: definition of a |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | subscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: i |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | switchstmt.c:2:14:2:14 | VariableAddress: x |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | tinyforstmt.c:3:9:3:9 | NoOp: ; |
+| switchstmt.c:1:12:1:12 | InitializeParameter: x | Goto | 20 | unaryopexpr.c:2:9:2:9 | VariableAddress: definition of i |
+| whilestmt.c:1:6:1:19 | UnmodeledDefinition: always_false_1 | Goto | 3 | ifelsestmt.c:2:6:2:6 | Constant: 0 |
+| whilestmt.c:1:6:1:19 | UnmodeledDefinition: always_false_1 | Goto | 3 | ifstmt.c:2:6:2:6 | Constant: 0 |
+| whilestmt.c:1:6:1:19 | UnmodeledDefinition: always_false_1 | Goto | 3 | whilestmt.c:2:9:2:9 | Constant: 0 |
+| whilestmt.c:8:6:8:19 | UnmodeledDefinition: always_false_2 | Goto | 3 | ifelsestmt.c:12:6:12:6 | Constant: 0 |
+| whilestmt.c:8:6:8:19 | UnmodeledDefinition: always_false_2 | Goto | 3 | ifstmt.c:9:6:9:6 | Constant: 0 |
+| whilestmt.c:8:6:8:19 | UnmodeledDefinition: always_false_2 | Goto | 3 | whilestmt.c:9:7:9:10 | VariableAddress: definition of done |
+| whilestmt.c:15:6:15:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | dostmt.c:10:5:10:7 | NoOp: label ...: |
+| whilestmt.c:15:6:15:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | ifelsestmt.c:20:6:20:6 | Constant: 1 |
+| whilestmt.c:15:6:15:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | ifstmt.c:15:6:15:6 | Constant: 1 |
+| whilestmt.c:15:6:15:18 | UnmodeledDefinition: always_true_1 | Goto | 4 | whilestmt.c:16:9:16:9 | Constant: 1 |
+| whilestmt.c:23:6:23:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | dostmt.c:18:5:18:7 | NoOp: label ...: |
+| whilestmt.c:23:6:23:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | ifelsestmt.c:30:6:30:6 | Constant: 1 |
+| whilestmt.c:23:6:23:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | ifstmt.c:22:6:22:6 | Constant: 1 |
+| whilestmt.c:23:6:23:18 | UnmodeledDefinition: always_true_2 | Goto | 4 | whilestmt.c:24:9:24:9 | Constant: 1 |
+| whilestmt.c:32:6:32:18 | UnmodeledDefinition: always_true_3 | Goto | 2 | dostmt.c:27:5:27:7 | NoOp: label ...: |
+| whilestmt.c:32:6:32:18 | UnmodeledDefinition: always_true_3 | Goto | 2 | whilestmt.c:33:9:33:9 | Constant: 1 |
+unexplainedLoop
+| misc.c:91:6:91:33 | gnuConditionalOmittedOperand | misc.c:93:9:93:9 | ConditionalBranch: j |
+| misc.c:91:6:91:33 | gnuConditionalOmittedOperand | misc.c:93:9:93:9 | Load: j |
+| misc.c:91:6:91:33 | gnuConditionalOmittedOperand | misc.c:93:9:93:9 | VariableAddress: j |
+| misc.c:91:6:91:33 | gnuConditionalOmittedOperand | misc.c:94:9:94:10 | Load: sp |
+| misc.c:91:6:91:33 | gnuConditionalOmittedOperand | misc.c:94:9:94:10 | VariableAddress: sp |
+| misc.c:91:6:91:33 | gnuConditionalOmittedOperand | misc.c:94:13:94:13 | ConditionalBranch: i |
+| misc.c:91:6:91:33 | gnuConditionalOmittedOperand | misc.c:94:13:94:13 | FieldAddress: i |
+| misc.c:91:6:91:33 | gnuConditionalOmittedOperand | misc.c:94:13:94:13 | Load: i |
+| range_analysis.c:355:14:355:27 | test_ternary01 | range_analysis.c:366:10:366:10 | ConditionalBranch: x |
+| range_analysis.c:355:14:355:27 | test_ternary01 | range_analysis.c:366:10:366:10 | Load: x |
+| range_analysis.c:355:14:355:27 | test_ternary01 | range_analysis.c:366:10:366:10 | VariableAddress: x |
+| range_analysis.c:355:14:355:27 | test_ternary01 | range_analysis.c:367:10:367:10 | ConditionalBranch: x |
+| range_analysis.c:355:14:355:27 | test_ternary01 | range_analysis.c:367:10:367:10 | Load: x |
+| range_analysis.c:355:14:355:27 | test_ternary01 | range_analysis.c:367:10:367:10 | VariableAddress: x |
+unnecessaryPhiInstruction
+operandAcrossFunctions
+instructionWithoutUniqueBlock
+containsLoopOfForwardEdges
+lostReachability
+| misc.c:93:9:93:9 | ConditionalBranch: j |
+| misc.c:93:9:93:15 | VariableAddress: ... ? ... : ... |
+| misc.c:93:9:93:15 | VariableAddress: ... ? ... : ... |
+| misc.c:93:15:93:15 | Constant: 2 |
+| misc.c:94:9:94:10 | VariableAddress: sp |
+| misc.c:94:9:94:19 | VariableAddress: ... ? ... : ... |
+| misc.c:94:9:94:19 | VariableAddress: ... ? ... : ... |
+| misc.c:94:13:94:13 | ConditionalBranch: i |
+| misc.c:94:19:94:19 | VariableAddress: i |
+| range_analysis.c:366:10:366:10 | ConditionalBranch: x |
+| range_analysis.c:366:10:366:15 | VariableAddress: ... ? ... : ... |
+| range_analysis.c:366:10:366:15 | VariableAddress: ... ? ... : ... |
+| range_analysis.c:366:15:366:15 | Constant: (unsigned int)... |
+| range_analysis.c:367:10:367:10 | ConditionalBranch: x |
+| range_analysis.c:367:10:367:10 | VariableAddress: x |
+| range_analysis.c:367:10:367:17 | VariableAddress: ... ? ... : ... |
+| range_analysis.c:367:10:367:17 | VariableAddress: ... ? ... : ... |
+| range_analysis.c:367:15:367:17 | Constant: (unsigned int)... |
+| range_analysis.c:368:19:368:21 | Constant: (unsigned int)... |
+| range_analysis.c:369:36:369:36 | Constant: 5 |
+| range_analysis.c:370:36:370:38 | Constant: 500 |
+| range_analysis.c:371:37:371:39 | Constant: 500 |
+backEdgeCountMismatch
+useNotDominatedByDefinition

cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.qlref

@@ -0,0 +1 @@
+semmle/code/cpp/ir/IRSanity.ql