C++/C#: Remove UnmodeledUseOperand

2026-05-01 03:35:13 +02:00 · 2020-05-12 17:46:57 -04:00
parent 3c233c762c
commit 7f2c6dd9f9
30 changed files with 128 additions and 328 deletions
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll
@@ -590,9 +590,7 @@ module Opcode {
  class UnmodeledUse extends Opcode, TUnmodeledUse {
    final override string toString() { result = "UnmodeledUse" }

-    final override predicate hasOperandInternal(OperandTag tag) {
-      tag instanceof UnmodeledUseOperandTag
-    }
+    final override predicate hasOperandInternal(OperandTag tag) { none() }
  }

  class AliasedDefinition extends Opcode, TAliasedDefinition {
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll
@@ -55,7 +55,6 @@ module InstructionConsistency {
          operand.getOperandTag() = tag
        ) and
      operandCount > 1 and
-      not tag instanceof UnmodeledUseOperandTag and
      message =
        "Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
          " in function '$@'." and
@@ -158,7 +157,6 @@ module InstructionConsistency {
  ) {
    exists(MemoryOperand operand, Instruction def |
      operand = instr.getAnOperand() and
-      not operand instanceof UnmodeledUseOperand and
      def = operand.getAnyDef() and
      not def.isResultModeled() and
      not def instanceof UnmodeledDefinitionInstruction and
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll
@@ -19,11 +19,7 @@ private newtype TOperand =
  ) {
    defInstr = Construction::getMemoryOperandDefinition(useInstr, tag, overlap) and
    not Construction::isInCycle(useInstr) and
-    (
-      strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
-      or
-      tag instanceof UnmodeledUseOperandTag
-    )
+    strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
  } or
  TPhiOperand(
    PhiInstruction useInstr, Instruction defInstr, IRBlock predecessorBlock, Overlap overlap
@@ -327,16 +323,6 @@ class ConditionOperand extends RegisterOperand {
  override string toString() { result = "Condition" }
 }

-/**
- * An operand of the special `UnmodeledUse` instruction, representing a value
- * whose set of uses is unknown.
- */
-class UnmodeledUseOperand extends NonPhiMemoryOperand {
-  override UnmodeledUseOperandTag tag;
-
-  override string toString() { result = "UnmodeledUse" }
-}
-
 /**
 * The operand representing the target function of an `Call` instruction.
 */
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
@@ -247,6 +247,10 @@ private predicate resultMayReachReturn(Instruction instr) { operandMayReachRetur
 private predicate resultEscapesNonReturn(Instruction instr) {
  // The result escapes if it has at least one use that escapes.
  operandEscapesNonReturn(instr.getAUse())
+  or
+  // The result also escapes if it is not modeled in SSA, because we do not know where it might be
+  // used.
+  not instr.isResultModeled()
 }

 /**
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
@@ -128,23 +128,10 @@ private module Cached {
      oldOperand = oldInstruction.getAnOperand() and
      tag = oldOperand.getOperandTag() and
      (
-        (
-          if exists(Alias::getOperandMemoryLocation(oldOperand))
-          then hasMemoryOperandDefinition(oldInstruction, oldOperand, overlap, result)
-          else (
-            result = instruction.getEnclosingIRFunction().getUnmodeledDefinitionInstruction() and
-            overlap instanceof MustTotallyOverlap
-          )
-        )
-        or
-        // Connect any definitions that are not being modeled in SSA to the
-        // `UnmodeledUse` instruction.
-        exists(OldInstruction oldDefinition |
-          instruction instanceof UnmodeledUseInstruction and
-          tag instanceof UnmodeledUseOperandTag and
-          oldDefinition = oldOperand.getAnyDef() and
-          not exists(Alias::getResultMemoryLocation(oldDefinition)) and
-          result = getNewInstruction(oldDefinition) and
+        if exists(Alias::getOperandMemoryLocation(oldOperand))
+        then hasMemoryOperandDefinition(oldInstruction, oldOperand, overlap, result)
+        else (
+          result = instruction.getEnclosingIRFunction().getUnmodeledDefinitionInstruction() and
          overlap instanceof MustTotallyOverlap
        )
      )
@@ -154,13 +141,6 @@ private module Cached {
    tag instanceof ChiPartialOperandTag and
    overlap instanceof MustExactlyOverlap
    or
-    exists(IRFunction f |
-      tag instanceof UnmodeledUseOperandTag and
-      result = f.getUnmodeledDefinitionInstruction() and
-      instruction = f.getUnmodeledUseInstruction() and
-      overlap instanceof MustTotallyOverlap
-    )
-    or
    tag instanceof ChiTotalOperandTag and
    result = getChiInstructionTotalOperand(instruction) and
    overlap instanceof MustExactlyOverlap
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/internal/OperandTag.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/internal/OperandTag.qll
@@ -15,7 +15,6 @@ private newtype TOperandTag =
  TLeftOperand() or
  TRightOperand() or
  TConditionOperand() or
-  TUnmodeledUseOperand() or
  TCallTargetOperand() or
  TThisArgumentOperand() or
  TPositionalArgumentOperand(int argIndex) { Language::hasPositionalArgIndex(argIndex) } or
@@ -165,18 +164,6 @@ class ConditionOperandTag extends RegisterOperandTag, TConditionOperand {

 ConditionOperandTag conditionOperand() { result = TConditionOperand() }

-/**
- * An operand of the special `UnmodeledUse` instruction, representing a value
- * whose set of uses is unknown.
- */
-class UnmodeledUseOperandTag extends MemoryOperandTag, TUnmodeledUseOperand {
-  final override string toString() { result = "UnmodeledUse" }
-
-  final override int getSortOrder() { result = 9 }
-}
-
-UnmodeledUseOperandTag unmodeledUseOperand() { result = TUnmodeledUseOperand() }
-
 /**
 * The operand representing the target function of an `Call` instruction.
 */
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll
@@ -55,7 +55,6 @@ module InstructionConsistency {
          operand.getOperandTag() = tag
        ) and
      operandCount > 1 and
-      not tag instanceof UnmodeledUseOperandTag and
      message =
        "Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
          " in function '$@'." and
@@ -158,7 +157,6 @@ module InstructionConsistency {
  ) {
    exists(MemoryOperand operand, Instruction def |
      operand = instr.getAnOperand() and
-      not operand instanceof UnmodeledUseOperand and
      def = operand.getAnyDef() and
      not def.isResultModeled() and
      not def instanceof UnmodeledDefinitionInstruction and
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll
@@ -19,11 +19,7 @@ private newtype TOperand =
  ) {
    defInstr = Construction::getMemoryOperandDefinition(useInstr, tag, overlap) and
    not Construction::isInCycle(useInstr) and
-    (
-      strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
-      or
-      tag instanceof UnmodeledUseOperandTag
-    )
+    strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
  } or
  TPhiOperand(
    PhiInstruction useInstr, Instruction defInstr, IRBlock predecessorBlock, Overlap overlap
@@ -327,16 +323,6 @@ class ConditionOperand extends RegisterOperand {
  override string toString() { result = "Condition" }
 }

-/**
- * An operand of the special `UnmodeledUse` instruction, representing a value
- * whose set of uses is unknown.
- */
-class UnmodeledUseOperand extends NonPhiMemoryOperand {
-  override UnmodeledUseOperandTag tag;
-
-  override string toString() { result = "UnmodeledUse" }
-}
-
 /**
 * The operand representing the target function of an `Call` instruction.
 */
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
@@ -91,17 +91,25 @@ private module Cached {
  Instruction getRegisterOperandDefinition(Instruction instruction, RegisterOperandTag tag) {
    result =
      getInstructionTranslatedElement(instruction)
-          .getInstructionOperand(getInstructionTag(instruction), tag)
+          .getInstructionRegisterOperand(getInstructionTag(instruction), tag)
  }

  cached
  Instruction getMemoryOperandDefinition(
    Instruction instruction, MemoryOperandTag tag, Overlap overlap
  ) {
-    result =
-      getInstructionTranslatedElement(instruction)
-          .getInstructionOperand(getInstructionTag(instruction), tag) and
-    overlap instanceof MustTotallyOverlap
+    exists(TranslatedElement translatedElement, TranslatedFunction translatedFunc |
+      translatedElement = getInstructionTranslatedElement(instruction) and
+      exists(getInstructionOperandType(instruction, tag)) and
+      translatedFunc = getTranslatedFunction(instruction.getEnclosingFunction()) and
+      result = translatedFunc.getUnmodeledDefinitionInstruction() and
+      overlap instanceof MustTotallyOverlap
+    )
+    or
+    // Without the code below, the optimizer will realize that raw IR never contains Chi operands,
+    // and report an error that `ChiTotalOperand` and `ChiPartialOperand` are infeasible.
+    (tag instanceof ChiTotalOperandTag or tag instanceof ChiPartialOperandTag) and
+    none()
  }

  /** Gets a non-phi instruction that defines an operand of `instr`. */
@@ -144,12 +152,13 @@ private module Cached {
  CppType getInstructionOperandType(Instruction instruction, TypedOperandTag tag) {
    // For all `LoadInstruction`s, the operand type of the `LoadOperand` is the same as
    // the result type of the load.
+    tag instanceof LoadOperandTag and
    result = instruction.(LoadInstruction).getResultLanguageType()
    or
    not instruction instanceof LoadInstruction and
    result =
      getInstructionTranslatedElement(instruction)
-          .getInstructionOperandType(getInstructionTag(instruction), tag)
+          .getInstructionMemoryOperandType(getInstructionTag(instruction), tag)
  }

  cached
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
@@ -94,7 +94,7 @@ abstract class TranslatedCall extends TranslatedExpr {
    )
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = CallTag() and
    (
      operandTag instanceof CallTargetOperandTag and
@@ -115,7 +115,9 @@ abstract class TranslatedCall extends TranslatedExpr {
    result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
  }

-  final override CppType getInstructionOperandType(InstructionTag tag, TypedOperandTag operandTag) {
+  final override CppType getInstructionMemoryOperandType(
+    InstructionTag tag, TypedOperandTag operandTag
+  ) {
    tag = CallSideEffectTag() and
    hasSideEffect() and
    operandTag instanceof SideEffectOperandTag and
@@ -381,7 +383,7 @@ class TranslatedAllocationSideEffects extends TranslatedSideEffects,
    else result = getParent().getChildSuccessor(this)
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    operandTag = addressOperand() and
    result = getPrimaryInstructionForSideEffect(OnlyInstructionTag())
@@ -437,7 +439,7 @@ class TranslatedStructorCallSideEffects extends TranslatedCallSideEffects {

  override Instruction getFirstInstruction() { result = getInstruction(OnlyInstructionTag()) }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag instanceof OnlyInstructionTag and
    operandTag instanceof AddressOperandTag and
    result = getParent().(TranslatedStructorCall).getQualifierResult()
@@ -513,17 +515,12 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
    kind instanceof GotoEdge
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag instanceof OnlyInstructionTag and
    operandTag instanceof AddressOperandTag and
    result = getTranslatedExpr(arg).getResult()
    or
    tag instanceof OnlyInstructionTag and
-    operandTag instanceof SideEffectOperandTag and
-    not isWrite() and
-    result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
-    or
-    tag instanceof OnlyInstructionTag and
    operandTag instanceof BufferSizeOperandTag and
    result =
      getTranslatedExpr(call
@@ -531,7 +528,8 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
            .getFullyConverted()).getResult()
  }

-  override CppType getInstructionOperandType(InstructionTag tag, TypedOperandTag operandTag) {
+  override CppType getInstructionMemoryOperandType(InstructionTag tag, TypedOperandTag operandTag) {
+    not isWrite() and
    if hasSpecificReadSideEffect(any(BufferAccessOpcode op))
    then
      result = getUnknownType() and
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCondition.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCondition.qll
@@ -182,7 +182,7 @@ class TranslatedValueCondition extends TranslatedCondition, TTranslatedValueCond
    )
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = ValueConditionConditionalBranchTag() and
    operandTag instanceof ConditionOperandTag and
    result = getValueExpr().getResult()
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll
@@ -181,14 +181,11 @@ class TranslatedStaticLocalVariableDeclarationEntry extends TranslatedDeclaratio
    tag = DynamicInitializationFlagConstantTag() and result = "1"
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = DynamicInitializationFlagLoadTag() and
    (
      operandTag instanceof AddressOperandTag and
      result = getInstruction(DynamicInitializationFlagAddressTag())
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getTranslatedFunction(var.getFunction()).getUnmodeledDefinitionInstruction()
    )
    or
    tag = DynamicInitializationConditionalBranchTag() and
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
@@ -736,12 +736,12 @@ abstract class TranslatedElement extends TTranslatedElement {
   * Gets the instruction whose result is consumed as an operand of the
   * instruction specified by `tag`, with the operand specified by `operandTag`.
   */
-  Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) { none() }
+  Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) { none() }

  /**
   * Gets the type of the memory operand specified by `operandTag` on the the instruction specified by `tag`.
   */
-  CppType getInstructionOperandType(InstructionTag tag, TypedOperandTag operandTag) { none() }
+  CppType getInstructionMemoryOperandType(InstructionTag tag, TypedOperandTag operandTag) { none() }

  /**
   * Gets the size of the memory operand specified by `operandTag` on the the instruction specified by `tag`.
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -183,7 +183,7 @@ class TranslatedConditionValue extends TranslatedCoreExpr, ConditionContext,
    )
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = ConditionValueTrueStoreTag() and
    (
      operandTag instanceof AddressOperandTag and
@@ -206,9 +206,6 @@ class TranslatedConditionValue extends TranslatedCoreExpr, ConditionContext,
    (
      operandTag instanceof AddressOperandTag and
      result = getInstruction(ConditionValueResultTempAddressTag())
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
    )
  }

@@ -282,14 +279,11 @@ class TranslatedLoad extends TranslatedExpr, TTranslatedLoad {

  override Instruction getResult() { result = getInstruction(LoadTag()) }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = LoadTag() and
    (
      operandTag instanceof AddressOperandTag and
      result = getOperand().getResult()
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
    )
  }

@@ -332,7 +326,7 @@ class TranslatedResultCopy extends TranslatedExpr, TTranslatedResultCopy {

  override Instruction getResult() { result = getInstruction(ResultCopyTag()) }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = ResultCopyTag() and
    operandTag instanceof UnaryOperandTag and
    result = getOperand().getResult()
@@ -369,7 +363,9 @@ class TranslatedCommaExpr extends TranslatedNonConstantExpr {
    none()
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) { none() }
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
+    none()
+  }

  private TranslatedExpr getLeftOperand() {
    result = getTranslatedExpr(expr.getLeftOperand().getFullyConverted())
@@ -429,7 +425,7 @@ abstract class TranslatedCrementOperation extends TranslatedNonConstantExpr {
    resultType = getTypeForPRValue(expr.getType())
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = CrementOpTag() and
    (
      operandTag instanceof LeftOperandTag and
@@ -580,7 +576,7 @@ class TranslatedArrayExpr extends TranslatedNonConstantExpr {
    resultType = getTypeForGLValue(expr.getType())
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    (
      operandTag instanceof LeftOperandTag and
@@ -622,7 +618,7 @@ abstract class TranslatedTransparentExpr extends TranslatedNonConstantExpr {

  final override Instruction getResult() { result = getOperand().getResult() }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    none()
  }

@@ -685,7 +681,7 @@ class TranslatedThisExpr extends TranslatedNonConstantExpr {

  final override Instruction getChildSuccessor(TranslatedElement child) { none() }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    operandTag instanceof UnaryOperandTag and
    result = getInitializeThisInstruction()
@@ -729,7 +725,9 @@ class TranslatedNonFieldVariableAccess extends TranslatedVariableAccess {
    else result = getInstruction(OnlyInstructionTag())
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) { none() }
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
+    none()
+  }

  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
    tag = OnlyInstructionTag() and
@@ -748,7 +746,7 @@ class TranslatedFieldAccess extends TranslatedVariableAccess {

  override Instruction getFirstInstruction() { result = getQualifier().getFirstInstruction() }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    operandTag instanceof UnaryOperandTag and
    result = getQualifier().getResult()
@@ -822,7 +820,7 @@ abstract class TranslatedConstantExpr extends TranslatedCoreExpr, TTranslatedVal

  final override Instruction getResult() { result = getInstruction(OnlyInstructionTag()) }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    none()
  }

@@ -906,7 +904,7 @@ class TranslatedUnaryExpr extends TranslatedSingleInstructionExpr {
    child = getOperand() and result = getInstruction(OnlyInstructionTag())
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    result = getOperand().getResult() and
    operandTag instanceof UnaryOperandTag
@@ -960,7 +958,7 @@ abstract class TranslatedSingleInstructionConversion extends TranslatedConversio

  override Instruction getResult() { result = getInstruction(OnlyInstructionTag()) }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    operandTag instanceof UnaryOperandTag and
    result = getOperand().getResult()
@@ -1070,7 +1068,7 @@ class TranslatedBoolConversion extends TranslatedConversion {

  override Instruction getResult() { result = getInstruction(BoolConversionCompareTag()) }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = BoolConversionCompareTag() and
    (
      operandTag instanceof LeftOperandTag and
@@ -1172,7 +1170,7 @@ class TranslatedBinaryOperation extends TranslatedSingleInstructionExpr {
    id = 1 and result = getRightOperand()
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    if swapOperandsOnOp()
    then (
@@ -1306,7 +1304,7 @@ class TranslatedAssignExpr extends TranslatedNonConstantExpr {
    resultType = getTypeForPRValue(expr.getType()) // Always a prvalue
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = AssignmentStoreTag() and
    (
      operandTag instanceof AddressOperandTag and
@@ -1482,7 +1480,7 @@ class TranslatedAssignOperation extends TranslatedNonConstantExpr {
    result = getElementSize(expr.getType())
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    leftOperandNeedsConversion() and
    tag = AssignOperationConvertLeftTag() and
    operandTag instanceof UnaryOperandTag and
@@ -1626,7 +1624,7 @@ class TranslatedNonConstantAllocationSize extends TranslatedAllocationSize {
    result = expr.getAllocatedElementType().getSize().toString()
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = AllocationSizeTag() and
    (
      operandTag instanceof LeftOperandTag and result = getInstruction(AllocationExtentConvertTag())
@@ -1742,7 +1740,7 @@ class TranslatedDestructorFieldDestruction extends TranslatedNonConstantExpr, St

  final override Instruction getFirstInstruction() { result = getInstruction(OnlyInstructionTag()) }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    operandTag instanceof UnaryOperandTag and
    result = getTranslatedFunction(expr.getEnclosingFunction()).getInitializeThisInstruction()
@@ -1832,7 +1830,7 @@ abstract class TranslatedConditionalExpr extends TranslatedNonConstantExpr {
    )
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    not resultIsVoid() and
    (
      not thenIsVoid() and
@@ -1859,9 +1857,6 @@ abstract class TranslatedConditionalExpr extends TranslatedNonConstantExpr {
      (
        operandTag instanceof AddressOperandTag and
        result = getInstruction(ConditionValueResultTempAddressTag())
-        or
-        operandTag instanceof LoadOperandTag and
-        result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
      )
    )
  }
@@ -2014,8 +2009,8 @@ class TranslatedBinaryConditionalExpr extends TranslatedConditionalExpr {
    )
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
-    result = super.getInstructionOperand(tag, operandTag)
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
+    result = super.getInstructionRegisterOperand(tag, operandTag)
    or
    tag = ValueConditionConditionalBranchTag() and
    operandTag instanceof ConditionOperandTag and
@@ -2093,20 +2088,19 @@ class TranslatedThrowValueExpr extends TranslatedThrowExpr, TranslatedVariableIn
    type = getTypeForPRValue(getExceptionType())
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
-    result = TranslatedVariableInitialization.super.getInstructionOperand(tag, operandTag)
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
+    result = TranslatedVariableInitialization.super.getInstructionRegisterOperand(tag, operandTag)
    or
    tag = ThrowTag() and
    (
      operandTag instanceof AddressOperandTag and
      result = getInstruction(InitializerVariableAddressTag())
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
    )
  }

-  final override CppType getInstructionOperandType(InstructionTag tag, TypedOperandTag operandTag) {
+  final override CppType getInstructionMemoryOperandType(
+    InstructionTag tag, TypedOperandTag operandTag
+  ) {
    tag = ThrowTag() and
    operandTag instanceof LoadOperandTag and
    result = getTypeForPRValue(getExceptionType())
@@ -2191,7 +2185,7 @@ class TranslatedBuiltInOperation extends TranslatedNonConstantExpr {
    resultType = getResultType()
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    exists(int index |
      operandTag = positionalArgumentOperand(index) and
@@ -2311,7 +2305,7 @@ class TranslatedVarArgsStart extends TranslatedNonConstantExpr {
    result = getEnclosingFunction().getEllipsisVariable()
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = VarArgsStartTag() and
    operandTag instanceof UnaryOperandTag and
    result = getInstruction(VarArgsStartEllipsisAddressTag())
@@ -2382,14 +2376,11 @@ class TranslatedVarArg extends TranslatedNonConstantExpr {
    result = getInstruction(VarArgsVAListLoadTag())
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = VarArgsVAListLoadTag() and
    (
      operandTag instanceof AddressOperandTag and
      result = getVAList().getResult()
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
    )
    or
    tag = VarArgsArgAddressTag() and
@@ -2442,7 +2433,7 @@ class TranslatedVarArgsEnd extends TranslatedNonConstantExpr {
    result = getInstruction(OnlyInstructionTag())
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    operandTag instanceof UnaryOperandTag and
    result = getVAList().getResult()
@@ -2503,14 +2494,11 @@ class TranslatedVarArgCopy extends TranslatedNonConstantExpr {
    result = getInstruction(VarArgsVAListStoreTag())
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = VarArgsVAListLoadTag() and
    (
      operandTag instanceof AddressOperandTag and
      result = getSourceVAList().getResult()
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
    )
    or
    tag = VarArgsVAListStoreTag() and
@@ -2560,7 +2548,7 @@ abstract class TranslatedNewOrNewArrayExpr extends TranslatedNonConstantExpr, In
    child = getInitialization() and result = getParent().getChildSuccessor(this)
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    operandTag instanceof UnaryOperandTag and
    result = getAllocatorCall().getResult()
@@ -2623,7 +2611,7 @@ class TranslatedDeleteArrayExprPlaceHolder extends TranslatedSingleInstructionEx
    child = getOperand() and result = getInstruction(OnlyInstructionTag())
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    none()
  }

@@ -2657,7 +2645,7 @@ class TranslatedDeleteExprPlaceHolder extends TranslatedSingleInstructionExpr {
    child = getOperand() and result = getInstruction(OnlyInstructionTag())
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    none()
  }

@@ -2761,7 +2749,7 @@ class TranslatedLambdaExpr extends TranslatedNonConstantExpr, InitializationCont
    resultType = getTypeForPRValue(expr.getType())
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = InitializerStoreTag() and
    operandTag instanceof AddressOperandTag and
    result = getInstruction(InitializerVariableAddressTag())
@@ -2770,9 +2758,6 @@ class TranslatedLambdaExpr extends TranslatedNonConstantExpr, InitializationCont
    (
      operandTag instanceof AddressOperandTag and
      result = getInstruction(InitializerVariableAddressTag())
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
    )
  }

@@ -2832,7 +2817,7 @@ class TranslatedStmtExpr extends TranslatedNonConstantExpr {

  override Instruction getResult() { result = getInstruction(OnlyInstructionTag()) }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag instanceof OnlyInstructionTag and
    operandTag instanceof UnaryOperandTag and
    result = getTranslatedExpr(expr.getResultExpr().getFullyConverted()).getResult()
@@ -2856,7 +2841,7 @@ class TranslatedErrorExpr extends TranslatedSingleInstructionExpr {

  final override Instruction getChildSuccessor(TranslatedElement child) { none() }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    none()
  }

--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll
@@ -239,32 +239,18 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
    result = getInstruction(UnwindTag())
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
-    tag = UnmodeledUseTag() and
-    operandTag instanceof UnmodeledUseOperandTag and
-    result.getEnclosingFunction() = func and
-    result.hasMemoryResult()
-    or
-    tag = UnmodeledUseTag() and
-    operandTag instanceof UnmodeledUseOperandTag and
-    result = getUnmodeledDefinitionInstruction()
-    or
-    tag = AliasedUseTag() and
-    operandTag instanceof SideEffectOperandTag and
-    result = getUnmodeledDefinitionInstruction()
-    or
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = ReturnTag() and
    hasReturnValue() and
    (
      operandTag instanceof AddressOperandTag and
      result = getInstruction(ReturnValueAddressTag())
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getUnmodeledDefinitionInstruction()
    )
  }

-  final override CppType getInstructionOperandType(InstructionTag tag, TypedOperandTag operandTag) {
+  final override CppType getInstructionMemoryOperandType(
+    InstructionTag tag, TypedOperandTag operandTag
+  ) {
    tag = ReturnTag() and
    hasReturnValue() and
    operandTag instanceof LoadOperandTag and
@@ -445,7 +431,7 @@ abstract class TranslatedParameter extends TranslatedElement {
    result = getIRVariable()
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = InitializerStoreTag() and
    (
      operandTag instanceof AddressOperandTag and
@@ -457,9 +443,6 @@ abstract class TranslatedParameter extends TranslatedElement {
    (
      operandTag instanceof AddressOperandTag and
      result = getInstruction(InitializerVariableAddressTag())
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getTranslatedFunction(getFunction()).getUnmodeledDefinitionInstruction()
    )
    or
    tag = InitializerIndirectStoreTag() and
@@ -734,17 +717,15 @@ class TranslatedReadEffect extends TranslatedElement, TTranslatedReadEffect {
    resultType = getVoidType()
  }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
-    tag = OnlyInstructionTag() and
-    operandTag = sideEffectOperand() and
-    result = getTranslatedFunction(getFunction()).getUnmodeledDefinitionInstruction()
-    or
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    operandTag = addressOperand() and
    result = getTranslatedParameter(param).getInstruction(InitializerIndirectAddressTag())
  }

-  final override CppType getInstructionOperandType(InstructionTag tag, TypedOperandTag operandTag) {
+  final override CppType getInstructionMemoryOperandType(
+    InstructionTag tag, TypedOperandTag operandTag
+  ) {
    tag = OnlyInstructionTag() and
    operandTag = sideEffectOperand() and
    result = getUnknownType()
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
@@ -75,7 +75,7 @@ abstract class TranslatedVariableInitialization extends TranslatedElement, Initi
    child = getInitialization() and result = getInitializationSuccessor()
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    hasUninitializedInstruction() and
    tag = InitializerStoreTag() and
    operandTag instanceof AddressOperandTag and
@@ -262,7 +262,7 @@ class TranslatedSimpleDirectInitialization extends TranslatedDirectInitializatio
    child = getInitializer() and result = getInstruction(InitializerStoreTag())
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = InitializerStoreTag() and
    (
      operandTag instanceof AddressOperandTag and
@@ -355,14 +355,11 @@ class TranslatedStringLiteralInitialization extends TranslatedDirectInitializati
    child = getInitializer() and result = getInstruction(InitializerLoadStringTag())
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = InitializerLoadStringTag() and
    (
      operandTag instanceof AddressOperandTag and
      result = getInitializer().getResult()
-      or
-      operandTag instanceof LoadOperandTag and
-      result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
    )
    or
    tag = InitializerStoreTag() and
@@ -461,7 +458,9 @@ class TranslatedConstructorInitialization extends TranslatedDirectInitialization
    child = getInitializer() and result = getParent().getChildSuccessor(this)
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) { none() }
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
+    none()
+  }

  override Instruction getReceiver() { result = getContext().getTargetAddress() }
 }
@@ -508,7 +507,7 @@ abstract class TranslatedFieldInitialization extends TranslatedElement {
    resultType = getTypeForGLValue(field.getType())
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = getFieldAddressTag() and
    operandTag instanceof UnaryOperandTag and
    result = getParent().(InitializationContext).getTargetAddress()
@@ -599,8 +598,8 @@ class TranslatedFieldValueInitialization extends TranslatedFieldInitialization,
    result = getZeroValue(field.getUnspecifiedType())
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
-    result = TranslatedFieldInitialization.super.getInstructionOperand(tag, operandTag)
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
+    result = TranslatedFieldInitialization.super.getInstructionRegisterOperand(tag, operandTag)
    or
    tag = getFieldDefaultValueStoreTag() and
    (
@@ -656,7 +655,7 @@ abstract class TranslatedElementInitialization extends TranslatedElement {
    kind instanceof GotoEdge
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = getElementAddressTag() and
    (
      operandTag instanceof LeftOperandTag and
@@ -782,8 +781,8 @@ class TranslatedElementValueInitialization extends TranslatedElementInitializati
    result = elementCount * getElementType().getSize()
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
-    result = TranslatedElementInitialization.super.getInstructionOperand(tag, operandTag)
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
+    result = TranslatedElementInitialization.super.getInstructionRegisterOperand(tag, operandTag)
    or
    tag = getElementDefaultValueStoreTag() and
    (
@@ -861,7 +860,7 @@ abstract class TranslatedBaseStructorCall extends TranslatedStructorCallFromStru

  final override Instruction getReceiver() { result = getInstruction(OnlyInstructionTag()) }

-  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = OnlyInstructionTag() and
    operandTag instanceof UnaryOperandTag and
    result = getTranslatedFunction(getFunction()).getInitializeThisInstruction()
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
@@ -713,7 +713,7 @@ class TranslatedSwitchStmt extends TranslatedStmt {
    resultType = getVoidType()
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    tag = SwitchBranchTag() and
    operandTag instanceof ConditionOperandTag and
    result = getExpr().getResult()
@@ -759,11 +759,7 @@ class TranslatedAsmStmt extends TranslatedStmt {
    resultType = getUnknownType()
  }

-  override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
-    tag = AsmTag() and
-    operandTag instanceof SideEffectOperandTag and
-    result = getTranslatedFunction(stmt.getEnclosingFunction()).getUnmodeledDefinitionInstruction()
-    or
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
    exists(int index |
      tag = AsmTag() and
      operandTag = asmOperand(index) and
@@ -771,7 +767,9 @@ class TranslatedAsmStmt extends TranslatedStmt {
    )
  }

-  final override CppType getInstructionOperandType(InstructionTag tag, TypedOperandTag operandTag) {
+  final override CppType getInstructionMemoryOperandType(
+    InstructionTag tag, TypedOperandTag operandTag
+  ) {
    tag = AsmTag() and
    operandTag instanceof SideEffectOperandTag and
    result = getUnknownType()
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll
@@ -55,7 +55,6 @@ module InstructionConsistency {
          operand.getOperandTag() = tag
        ) and
      operandCount > 1 and
-      not tag instanceof UnmodeledUseOperandTag and
      message =
        "Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
          " in function '$@'." and
@@ -158,7 +157,6 @@ module InstructionConsistency {
  ) {
    exists(MemoryOperand operand, Instruction def |
      operand = instr.getAnOperand() and
-      not operand instanceof UnmodeledUseOperand and
      def = operand.getAnyDef() and
      not def.isResultModeled() and
      not def instanceof UnmodeledDefinitionInstruction and
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll
@@ -19,11 +19,7 @@ private newtype TOperand =
  ) {
    defInstr = Construction::getMemoryOperandDefinition(useInstr, tag, overlap) and
    not Construction::isInCycle(useInstr) and
-    (
-      strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
-      or
-      tag instanceof UnmodeledUseOperandTag
-    )
+    strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
  } or
  TPhiOperand(
    PhiInstruction useInstr, Instruction defInstr, IRBlock predecessorBlock, Overlap overlap
@@ -327,16 +323,6 @@ class ConditionOperand extends RegisterOperand {
  override string toString() { result = "Condition" }
 }

-/**
- * An operand of the special `UnmodeledUse` instruction, representing a value
- * whose set of uses is unknown.
- */
-class UnmodeledUseOperand extends NonPhiMemoryOperand {
-  override UnmodeledUseOperandTag tag;
-
-  override string toString() { result = "UnmodeledUse" }
-}
-
 /**
 * The operand representing the target function of an `Call` instruction.
 */
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -247,6 +247,10 @@ private predicate resultMayReachReturn(Instruction instr) { operandMayReachRetur
 private predicate resultEscapesNonReturn(Instruction instr) {
  // The result escapes if it has at least one use that escapes.
  operandEscapesNonReturn(instr.getAUse())
+  or
+  // The result also escapes if it is not modeled in SSA, because we do not know where it might be
+  // used.
+  not instr.isResultModeled()
 }

 /**
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
@@ -128,23 +128,10 @@ private module Cached {
      oldOperand = oldInstruction.getAnOperand() and
      tag = oldOperand.getOperandTag() and
      (
-        (
-          if exists(Alias::getOperandMemoryLocation(oldOperand))
-          then hasMemoryOperandDefinition(oldInstruction, oldOperand, overlap, result)
-          else (
-            result = instruction.getEnclosingIRFunction().getUnmodeledDefinitionInstruction() and
-            overlap instanceof MustTotallyOverlap
-          )
-        )
-        or
-        // Connect any definitions that are not being modeled in SSA to the
-        // `UnmodeledUse` instruction.
-        exists(OldInstruction oldDefinition |
-          instruction instanceof UnmodeledUseInstruction and
-          tag instanceof UnmodeledUseOperandTag and
-          oldDefinition = oldOperand.getAnyDef() and
-          not exists(Alias::getResultMemoryLocation(oldDefinition)) and
-          result = getNewInstruction(oldDefinition) and
+        if exists(Alias::getOperandMemoryLocation(oldOperand))
+        then hasMemoryOperandDefinition(oldInstruction, oldOperand, overlap, result)
+        else (
+          result = instruction.getEnclosingIRFunction().getUnmodeledDefinitionInstruction() and
          overlap instanceof MustTotallyOverlap
        )
      )
@@ -154,13 +141,6 @@ private module Cached {
    tag instanceof ChiPartialOperandTag and
    overlap instanceof MustExactlyOverlap
    or
-    exists(IRFunction f |
-      tag instanceof UnmodeledUseOperandTag and
-      result = f.getUnmodeledDefinitionInstruction() and
-      instruction = f.getUnmodeledUseInstruction() and
-      overlap instanceof MustTotallyOverlap
-    )
-    or
    tag instanceof ChiTotalOperandTag and
    result = getChiInstructionTotalOperand(instruction) and
    overlap instanceof MustExactlyOverlap
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll
@@ -590,9 +590,7 @@ module Opcode {
  class UnmodeledUse extends Opcode, TUnmodeledUse {
    final override string toString() { result = "UnmodeledUse" }

-    final override predicate hasOperandInternal(OperandTag tag) {
-      tag instanceof UnmodeledUseOperandTag
-    }
+    final override predicate hasOperandInternal(OperandTag tag) { none() }
  }

  class AliasedDefinition extends Opcode, TAliasedDefinition {
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/internal/OperandTag.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/internal/OperandTag.qll
@@ -15,7 +15,6 @@ private newtype TOperandTag =
  TLeftOperand() or
  TRightOperand() or
  TConditionOperand() or
-  TUnmodeledUseOperand() or
  TCallTargetOperand() or
  TThisArgumentOperand() or
  TPositionalArgumentOperand(int argIndex) { Language::hasPositionalArgIndex(argIndex) } or
@@ -165,18 +164,6 @@ class ConditionOperandTag extends RegisterOperandTag, TConditionOperand {

 ConditionOperandTag conditionOperand() { result = TConditionOperand() }

-/**
- * An operand of the special `UnmodeledUse` instruction, representing a value
- * whose set of uses is unknown.
- */
-class UnmodeledUseOperandTag extends MemoryOperandTag, TUnmodeledUseOperand {
-  final override string toString() { result = "UnmodeledUse" }
-
-  final override int getSortOrder() { result = 9 }
-}
-
-UnmodeledUseOperandTag unmodeledUseOperand() { result = TUnmodeledUseOperand() }
-
 /**
 * The operand representing the target function of an `Call` instruction.
 */
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRConsistency.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRConsistency.qll
@@ -55,7 +55,6 @@ module InstructionConsistency {
          operand.getOperandTag() = tag
        ) and
      operandCount > 1 and
-      not tag instanceof UnmodeledUseOperandTag and
      message =
        "Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
          " in function '$@'." and
@@ -158,7 +157,6 @@ module InstructionConsistency {
  ) {
    exists(MemoryOperand operand, Instruction def |
      operand = instr.getAnOperand() and
-      not operand instanceof UnmodeledUseOperand and
      def = operand.getAnyDef() and
      not def.isResultModeled() and
      not def instanceof UnmodeledDefinitionInstruction and
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Operand.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Operand.qll
@@ -19,11 +19,7 @@ private newtype TOperand =
  ) {
    defInstr = Construction::getMemoryOperandDefinition(useInstr, tag, overlap) and
    not Construction::isInCycle(useInstr) and
-    (
-      strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
-      or
-      tag instanceof UnmodeledUseOperandTag
-    )
+    strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
  } or
  TPhiOperand(
    PhiInstruction useInstr, Instruction defInstr, IRBlock predecessorBlock, Overlap overlap
@@ -327,16 +323,6 @@ class ConditionOperand extends RegisterOperand {
  override string toString() { result = "Condition" }
 }

-/**
- * An operand of the special `UnmodeledUse` instruction, representing a value
- * whose set of uses is unknown.
- */
-class UnmodeledUseOperand extends NonPhiMemoryOperand {
-  override UnmodeledUseOperandTag tag;
-
-  override string toString() { result = "UnmodeledUse" }
-}
-
 /**
 * The operand representing the target function of an `Call` instruction.
 */
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/TranslatedFunction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/TranslatedFunction.qll
@@ -190,15 +190,6 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
  }

  final override Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
-    tag = UnmodeledUseTag() and
-    operandTag instanceof UnmodeledUseOperandTag and
-    result.getEnclosingFunction() = callable and
-    result.hasMemoryResult()
-    or
-    tag = UnmodeledUseTag() and
-    operandTag instanceof UnmodeledUseOperandTag and
-    result = getUnmodeledDefinitionInstruction()
-    or
    tag = AliasedUseTag() and
    operandTag instanceof SideEffectOperandTag and
    result = getUnmodeledDefinitionInstruction()
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRConsistency.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRConsistency.qll
@@ -55,7 +55,6 @@ module InstructionConsistency {
          operand.getOperandTag() = tag
        ) and
      operandCount > 1 and
-      not tag instanceof UnmodeledUseOperandTag and
      message =
        "Instruction has " + operandCount + " operands with tag '" + tag.toString() + "'" +
          " in function '$@'." and
@@ -158,7 +157,6 @@ module InstructionConsistency {
  ) {
    exists(MemoryOperand operand, Instruction def |
      operand = instr.getAnOperand() and
-      not operand instanceof UnmodeledUseOperand and
      def = operand.getAnyDef() and
      not def.isResultModeled() and
      not def instanceof UnmodeledDefinitionInstruction and
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Operand.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Operand.qll
@@ -19,11 +19,7 @@ private newtype TOperand =
  ) {
    defInstr = Construction::getMemoryOperandDefinition(useInstr, tag, overlap) and
    not Construction::isInCycle(useInstr) and
-    (
-      strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
-      or
-      tag instanceof UnmodeledUseOperandTag
-    )
+    strictcount(Construction::getMemoryOperandDefinition(useInstr, tag, _)) = 1
  } or
  TPhiOperand(
    PhiInstruction useInstr, Instruction defInstr, IRBlock predecessorBlock, Overlap overlap
@@ -327,16 +323,6 @@ class ConditionOperand extends RegisterOperand {
  override string toString() { result = "Condition" }
 }

-/**
- * An operand of the special `UnmodeledUse` instruction, representing a value
- * whose set of uses is unknown.
- */
-class UnmodeledUseOperand extends NonPhiMemoryOperand {
-  override UnmodeledUseOperandTag tag;
-
-  override string toString() { result = "UnmodeledUse" }
-}
-
 /**
 * The operand representing the target function of an `Call` instruction.
 */
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
@@ -247,6 +247,10 @@ private predicate resultMayReachReturn(Instruction instr) { operandMayReachRetur
 private predicate resultEscapesNonReturn(Instruction instr) {
  // The result escapes if it has at least one use that escapes.
  operandEscapesNonReturn(instr.getAUse())
+  or
+  // The result also escapes if it is not modeled in SSA, because we do not know where it might be
+  // used.
+  not instr.isResultModeled()
 }

 /**
--- a/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
+++ b/csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
@@ -128,23 +128,10 @@ private module Cached {
      oldOperand = oldInstruction.getAnOperand() and
      tag = oldOperand.getOperandTag() and
      (
-        (
-          if exists(Alias::getOperandMemoryLocation(oldOperand))
-          then hasMemoryOperandDefinition(oldInstruction, oldOperand, overlap, result)
-          else (
-            result = instruction.getEnclosingIRFunction().getUnmodeledDefinitionInstruction() and
-            overlap instanceof MustTotallyOverlap
-          )
-        )
-        or
-        // Connect any definitions that are not being modeled in SSA to the
-        // `UnmodeledUse` instruction.
-        exists(OldInstruction oldDefinition |
-          instruction instanceof UnmodeledUseInstruction and
-          tag instanceof UnmodeledUseOperandTag and
-          oldDefinition = oldOperand.getAnyDef() and
-          not exists(Alias::getResultMemoryLocation(oldDefinition)) and
-          result = getNewInstruction(oldDefinition) and
+        if exists(Alias::getOperandMemoryLocation(oldOperand))
+        then hasMemoryOperandDefinition(oldInstruction, oldOperand, overlap, result)
+        else (
+          result = instruction.getEnclosingIRFunction().getUnmodeledDefinitionInstruction() and
          overlap instanceof MustTotallyOverlap
        )
      )
@@ -154,13 +141,6 @@ private module Cached {
    tag instanceof ChiPartialOperandTag and
    overlap instanceof MustExactlyOverlap
    or
-    exists(IRFunction f |
-      tag instanceof UnmodeledUseOperandTag and
-      result = f.getUnmodeledDefinitionInstruction() and
-      instruction = f.getUnmodeledUseInstruction() and
-      overlap instanceof MustTotallyOverlap
-    )
-    or
    tag instanceof ChiTotalOperandTag and
    result = getChiInstructionTotalOperand(instruction) and
    overlap instanceof MustExactlyOverlap