Merge remote-tracking branch 'upstream/main' into igfoo/unnamed

cpp/ql/src/Critical/OverflowDestination.ql

@@ -23,10 +23,7 @@ import semmle.code.cpp.security.TaintTracking
  * ```
  */
 predicate sourceSized(FunctionCall fc, Expr src) {
-  exists(string name |
-    (name = "strncpy" or name = "strncat" or name = "memcpy" or name = "memmove") and
-    fc.getTarget().hasGlobalOrStdName(name)
-  ) and
+  fc.getTarget().hasGlobalOrStdName(["strncpy", "strncat", "memcpy", "memmove"]) and
   exists(Expr dest, Expr size, Variable v |
     fc.getArgument(0) = dest and
     fc.getArgument(1) = src and

cpp/ql/src/Critical/SizeCheck2.ql

@@ -15,12 +15,7 @@
 import cpp
 
 class Allocation extends FunctionCall {
-  Allocation() {
-    exists(string name |
-      this.getTarget().hasGlobalOrStdName(name) and
-      (name = "malloc" or name = "calloc" or name = "realloc")
-    )
-  }
+  Allocation() { this.getTarget().hasGlobalOrStdName(["malloc", "calloc", "realloc"]) }
 
   private string getName() { this.getTarget().hasGlobalOrStdName(result) }
 

cpp/ql/src/JPL_C/LOC-2/Rule 11/SimpleControlFlowJmp.ql

@@ -13,14 +13,7 @@
 import cpp
 
 class ForbiddenFunction extends Function {
-  ForbiddenFunction() {
-    exists(string name | name = this.getName() |
-      name = "setjmp" or
-      name = "longjmp" or
-      name = "sigsetjmp" or
-      name = "siglongjmp"
-    )
-  }
+  ForbiddenFunction() { this.getName() = ["setjmp", "longjmp", "sigsetjmp", "siglongjmp"] }
 }
 
 from FunctionCall call

cpp/ql/src/Likely Bugs/Leap Year/UncheckedReturnValueForTimeFunctions.ql

@@ -40,9 +40,7 @@ class DateStructModifiedFieldAccess extends LeapYearFieldAccess {
  */
 class SafeTimeGatheringFunction extends Function {
   SafeTimeGatheringFunction() {
-    this.getQualifiedName() = "GetFileTime" or
-    this.getQualifiedName() = "GetSystemTime" or
-    this.getQualifiedName() = "NtQuerySystemTime"
+    this.getQualifiedName() = ["GetFileTime", "GetSystemTime", "NtQuerySystemTime"]
   }
 }
 
@@ -51,15 +49,11 @@ class SafeTimeGatheringFunction extends Function {
  */
 class TimeConversionFunction extends Function {
   TimeConversionFunction() {
-    this.getQualifiedName() = "FileTimeToSystemTime" or
-    this.getQualifiedName() = "SystemTimeToFileTime" or
-    this.getQualifiedName() = "SystemTimeToTzSpecificLocalTime" or
-    this.getQualifiedName() = "SystemTimeToTzSpecificLocalTimeEx" or
-    this.getQualifiedName() = "TzSpecificLocalTimeToSystemTime" or
-    this.getQualifiedName() = "TzSpecificLocalTimeToSystemTimeEx" or
-    this.getQualifiedName() = "RtlLocalTimeToSystemTime" or
-    this.getQualifiedName() = "RtlTimeToSecondsSince1970" or
-    this.getQualifiedName() = "_mkgmtime"
+    this.getQualifiedName() =
+      ["FileTimeToSystemTime", "SystemTimeToFileTime", "SystemTimeToTzSpecificLocalTime",
+          "SystemTimeToTzSpecificLocalTimeEx", "TzSpecificLocalTimeToSystemTime",
+          "TzSpecificLocalTimeToSystemTimeEx", "RtlLocalTimeToSystemTime",
+          "RtlTimeToSecondsSince1970", "_mkgmtime"]
   }
 }
 

cpp/ql/src/Microsoft/SAL.qll

@@ -10,13 +10,8 @@ import cpp
  */
 class SALMacro extends Macro {
   SALMacro() {
-    exists(string filename | filename = this.getFile().getBaseName() |
-      filename = "sal.h" or
-      filename = "specstrings_strict.h" or
-      filename = "specstrings.h" or
-      filename = "w32p.h" or
-      filename = "minwindef.h"
-    ) and
+    this.getFile().getBaseName() =
+      ["sal.h", "specstrings_strict.h", "specstrings.h", "w32p.h", "minwindef.h"] and
     (
       // Dialect for Windows 8 and above
       this.getName().matches("\\_%\\_")
@@ -58,10 +53,7 @@ class SALAnnotation extends MacroInvocation {
  */
 class SALCheckReturn extends SALAnnotation {
   SALCheckReturn() {
-    exists(SALMacro m | m = this.getMacro() |
-      m.getName() = "_Check_return_" or
-      m.getName() = "_Must_inspect_result_"
-    )
+    this.getMacro().(SALMacro).getName() = ["_Check_return_", "_Must_inspect_result_"]
   }
 }
 

cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.ql

@@ -56,7 +56,7 @@ class VarargsFunction extends Function {
   }
 
   string normalTerminator(int cnt) {
-    (result = "0" or result = "-1") and
+    result = ["0", "-1"] and
     cnt = trailingArgValueCount(result) and
     2 * cnt > totalCount() and
     not exists(FunctionCall fc, int index |

cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.ql

@@ -66,10 +66,7 @@ class IFStream extends Type {
  */
 class CinVariable extends NamespaceVariable {
   CinVariable() {
-    (
-      getName() = "cin" or
-      getName() = "wcin"
-    ) and
+    getName() = ["cin", "wcin"] and
     getNamespace().getName() = "std"
   }
 }

cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql

@@ -14,12 +14,7 @@ import cpp
 
 predicate potentiallyDangerousFunction(Function f, string message) {
   exists(string name | f.hasGlobalName(name) |
-    (
-      name = "gmtime" or
-      name = "localtime" or
-      name = "ctime" or
-      name = "asctime"
-    ) and
+    name = ["gmtime", "localtime", "ctime", "asctime"] and
     message = "Call to " + name + " is potentially dangerous"
   )
 }

cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.ql

@@ -19,12 +19,7 @@ predicate worldWritableCreation(FileCreationExpr fc, int mode) {
 }
 
 predicate setWorldWritable(FunctionCall fc, int mode) {
-  exists(string name | fc.getTarget().getName() = name |
-    name = "chmod" or
-    name = "fchmod" or
-    name = "_chmod" or
-    name = "_wchmod"
-  ) and
+  fc.getTarget().getName() = ["chmod", "fchmod", "_chmod", "_wchmod"] and
   mode = fc.getArgument(1).getValue().toInt() and
   sets(mode, s_iwoth())
 }

cpp/ql/src/Security/CWE/CWE-732/FilePermissions.qll

@@ -31,11 +31,7 @@ predicate sets(int mask, int fields) { mask.bitAnd(fields) != 0 }
  * one of the `umask` family of functions.
  */
 private int umask(FunctionCall fc) {
-  exists(string name | name = fc.getTarget().getName() |
-    name = "umask" or
-    name = "_umask" or
-    name = "_umask_s"
-  ) and
+  fc.getTarget().getName() = ["umask", "_umask", "_umask_s"] and
   result = fc.getArgument(0).getValue().toInt()
 }
 
@@ -89,11 +85,7 @@ abstract class FileCreationExpr extends FunctionCall {
 
 class OpenCreationExpr extends FileCreationExpr {
   OpenCreationExpr() {
-    exists(string name | name = this.getTarget().getName() |
-      name = "open" or
-      name = "_open" or
-      name = "_wopen"
-    ) and
+    this.getTarget().getName() = ["open", "_open", "_wopen"] and
     sets(this.getArgument(1).getValue().toInt(), o_creat())
   }
 
@@ -134,14 +126,9 @@ private int fopenMode() {
 
 class FopenCreationExpr extends FileCreationExpr {
   FopenCreationExpr() {
-    exists(string name | name = this.getTarget().getName() |
-      name = "fopen" or
-      name = "_wfopen" or
-      name = "fsopen" or
-      name = "_wfsopen"
-    ) and
+    this.getTarget().getName() = ["fopen", "_wfopen", "fsopen", "_wfsopen"] and
     exists(string mode |
-      (mode = "w" or mode = "a") and
+      mode = ["w", "a"] and
       this.getArgument(1).getValue().matches(mode + "%")
     )
   }

cpp/ql/src/jsf/4.09 Style/AV Rule 53.ql

@@ -18,6 +18,6 @@ import cpp
 
 from File f
 where
-  (f.getExtension().toLowerCase() = "h" or f.getExtension().toLowerCase() = "hpp") and
+  f.getExtension().toLowerCase() = ["h", "hpp"] and
   f.getExtension() != "h"
 select f, "AV Rule 53: Header files will always have a file name extension of .h."

cpp/ql/src/jsf/4.12 Templates/AV Rule 104.ql

@@ -21,8 +21,8 @@ import cpp
  */
 class WarningLateTemplateSpecialization extends CompilerWarning {
   WarningLateTemplateSpecialization() {
-    this.getTag() = "partial_spec_after_instantiation" or
-    this.getTag() = "partial_spec_after_instantiation_ambiguous"
+    this.getTag() =
+      ["partial_spec_after_instantiation", "partial_spec_after_instantiation_ambiguous"]
   }
 }
 

cpp/ql/src/semmle/code/cpp/Include.qll

@@ -21,7 +21,7 @@ class Include extends PreprocessorDirective, @ppd_include {
 
   /**
    * Gets the token which occurs after `#include`, for example `"filename"`
-   * or `<filename>`.
+   * or `<filename>`.
    */
   string getIncludeText() { result = getHead() }
 

cpp/ql/src/semmle/code/cpp/commons/Environment.qll

@@ -29,7 +29,7 @@ private predicate readsEnvironment(Expr read, string sourceDescription) {
   exists(FunctionCall call, string name |
     read = call and
     call.getTarget().hasGlobalOrStdName(name) and
-    (name = "getenv" or name = "secure_getenv" or name = "_wgetenv") and
+    name = ["getenv", "secure_getenv", "_wgetenv"] and
     sourceDescription = name
   )
 }

cpp/ql/src/semmle/code/cpp/commons/Printf.qll

@@ -9,10 +9,7 @@ import semmle.code.cpp.models.interfaces.FormattingFunction
 import semmle.code.cpp.models.implementations.Printf
 
 class PrintfFormatAttribute extends FormatAttribute {
-  PrintfFormatAttribute() {
-    getArchetype() = "printf" or
-    getArchetype() = "__printf__"
-  }
+  PrintfFormatAttribute() { getArchetype() = ["printf", "__printf__"] }
 }
 
 /**
@@ -601,12 +598,12 @@ class FormatLiteral extends Literal {
         or
         len = "l" and result = this.getLongType()
         or
-        (len = "ll" or len = "L" or len = "q") and
+        len = ["ll", "L", "q"] and
         result instanceof LongLongType
         or
         len = "j" and result = this.getIntmax_t()
         or
-        (len = "z" or len = "Z") and
+        len = ["z", "Z"] and
         (result = this.getSize_t() or result = this.getSsize_t())
         or
         len = "t" and result = this.getPtrdiff_t()
@@ -639,12 +636,12 @@ class FormatLiteral extends Literal {
         or
         len = "l" and result = this.getLongType()
         or
-        (len = "ll" or len = "L" or len = "q") and
+        len = ["ll", "L", "q"] and
         result instanceof LongLongType
         or
         len = "j" and result = this.getIntmax_t()
         or
-        (len = "z" or len = "Z") and
+        len = ["z", "Z"] and
         (result = this.getSize_t() or result = this.getSsize_t())
         or
         len = "t" and result = this.getPtrdiff_t()
@@ -670,9 +667,7 @@ class FormatLiteral extends Literal {
   FloatingPointType getFloatingPointConversion(int n) {
     exists(string len |
       len = this.getLength(n) and
-      if len = "L" or len = "ll"
-      then result instanceof LongDoubleType
-      else result instanceof DoubleType
+      if len = ["L", "ll"] then result instanceof LongDoubleType else result instanceof DoubleType
     )
   }
 
@@ -689,7 +684,7 @@ class FormatLiteral extends Literal {
         or
         len = "l" and base = this.getLongType()
         or
-        (len = "ll" or len = "L") and
+        len = ["ll", "L"] and
         base instanceof LongLongType
         or
         len = "q" and base instanceof LongLongType
@@ -736,12 +731,12 @@ class FormatLiteral extends Literal {
     exists(string len, string conv |
       this.parseConvSpec(n, _, _, _, _, _, len, conv) and
       (
-        (conv = "c" or conv = "C") and
+        conv = ["c", "C"] and
         len = "h" and
         result instanceof PlainCharType
         or
-        (conv = "c" or conv = "C") and
-        (len = "l" or len = "w") and
+        conv = ["c", "C"] and
+        len = ["l", "w"] and
         result = getWideCharType()
         or
         conv = "c" and
@@ -781,12 +776,12 @@ class FormatLiteral extends Literal {
     exists(string len, string conv |
       this.parseConvSpec(n, _, _, _, _, _, len, conv) and
       (
-        (conv = "s" or conv = "S") and
+        conv = ["s", "S"] and
         len = "h" and
         result.(PointerType).getBaseType() instanceof PlainCharType
         or
-        (conv = "s" or conv = "S") and
-        (len = "l" or len = "w") and
+        conv = ["s", "S"] and
+        len = ["l", "w"] and
         result.(PointerType).getBaseType() = getWideCharType()
         or
         conv = "s" and
@@ -823,10 +818,7 @@ class FormatLiteral extends Literal {
 
   private Type getConversionType9(int n) {
     this.getConversionChar(n) = "Z" and
-    (
-      this.getLength(n) = "l" or
-      this.getLength(n) = "w"
-    ) and
+    this.getLength(n) = ["l", "w"] and
     exists(Type t |
       t.getName() = "UNICODE_STRING" and
       result.(PointerType).getBaseType() = t
@@ -979,10 +971,7 @@ class FormatLiteral extends Literal {
           len = (afterdot.maximum(1) + 6).maximum(1 + 1 + dot + afterdot + 1 + 1 + 3)
         ) // (e.g. "-1.59203e-319")
         or
-        (
-          this.getConversionChar(n).toLowerCase() = "d" or
-          this.getConversionChar(n).toLowerCase() = "i"
-        ) and
+        this.getConversionChar(n).toLowerCase() = ["d", "i"] and
         // e.g. -2^31 = "-2147483648"
         exists(int sizeBits |
           sizeBits =

cpp/ql/src/semmle/code/cpp/commons/Strcat.qll

@@ -8,14 +8,13 @@ import cpp
  */
 class StrcatFunction extends Function {
   StrcatFunction() {
-    exists(string name | name = getName() |
-      name = "strcat" or // strcat(dst, src)
-      name = "strncat" or // strncat(dst, src, max_amount)
-      name = "wcscat" or // wcscat(dst, src)
-      name = "_mbscat" or // _mbscat(dst, src)
-      name = "wcsncat" or // wcsncat(dst, src, max_amount)
-      name = "_mbsncat" or // _mbsncat(dst, src, max_amount)
-      name = "_mbsncat_l" // _mbsncat_l(dst, src, max_amount, locale)
-    )
+    getName() =
+      ["strcat", // strcat(dst, src)
+          "strncat", // strncat(dst, src, max_amount)
+          "wcscat", // wcscat(dst, src)
+          "_mbscat", // _mbscat(dst, src)
+          "wcsncat", // wcsncat(dst, src, max_amount)
+          "_mbsncat", // _mbsncat(dst, src, max_amount)
+          "_mbsncat_l"] // _mbsncat_l(dst, src, max_amount, locale)
   }
 }

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

@@ -2,6 +2,30 @@ private import DataFlowImplSpecific::Private
 private import DataFlowImplSpecific::Public
 import Cached
 
+/**
+ * The cost limits for the `AccessPathFront` to `AccessPathApprox` expansion.
+ *
+ * `apLimit` bounds the acceptable fan-out, and `tupleLimit` bounds the
+ * estimated per-`AccessPathFront` tuple cost. Access paths exceeding both of
+ * these limits are represented with lower precision during pruning.
+ */
+predicate accessPathApproxCostLimits(int apLimit, int tupleLimit) {
+  apLimit = 10 and
+  tupleLimit = 10000
+}
+
+/**
+ * The cost limits for the `AccessPathApprox` to `AccessPath` expansion.
+ *
+ * `apLimit` bounds the acceptable fan-out, and `tupleLimit` bounds the
+ * estimated per-`AccessPathApprox` tuple cost. Access paths exceeding both of
+ * these limits are represented with lower precision.
+ */
+predicate accessPathCostLimits(int apLimit, int tupleLimit) {
+  apLimit = 5 and
+  tupleLimit = 1000
+}
+
 cached
 private module Cached {
   /**

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

@@ -167,4 +167,9 @@ module Consistency {
     not isImmutableOrUnobservable(n) and
     msg = "ArgumentNode is missing PostUpdateNode."
   }
+
+  query predicate postWithInFlow(PostUpdateNode n, string msg) {
+    simpleLocalFlowStep(_, n) and
+    msg = "PostUpdateNode should not be the target of local flow."
+  }
 }

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

@@ -2,6 +2,30 @@ private import DataFlowImplSpecific::Private
 private import DataFlowImplSpecific::Public
 import Cached
 
+/**
+ * The cost limits for the `AccessPathFront` to `AccessPathApprox` expansion.
+ *
+ * `apLimit` bounds the acceptable fan-out, and `tupleLimit` bounds the
+ * estimated per-`AccessPathFront` tuple cost. Access paths exceeding both of
+ * these limits are represented with lower precision during pruning.
+ */
+predicate accessPathApproxCostLimits(int apLimit, int tupleLimit) {
+  apLimit = 10 and
+  tupleLimit = 10000
+}
+
+/**
+ * The cost limits for the `AccessPathApprox` to `AccessPath` expansion.
+ *
+ * `apLimit` bounds the acceptable fan-out, and `tupleLimit` bounds the
+ * estimated per-`AccessPathApprox` tuple cost. Access paths exceeding both of
+ * these limits are represented with lower precision.
+ */
+predicate accessPathCostLimits(int apLimit, int tupleLimit) {
+  apLimit = 5 and
+  tupleLimit = 1000
+}
+
 cached
 private module Cached {
   /**

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -167,4 +167,9 @@ module Consistency {
     not isImmutableOrUnobservable(n) and
     msg = "ArgumentNode is missing PostUpdateNode."
   }
+
+  query predicate postWithInFlow(PostUpdateNode n, string msg) {
+    simpleLocalFlowStep(_, n) and
+    msg = "PostUpdateNode should not be the target of local flow."
+  }
 }

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/PrintIRLocalFlow.qll

@@ -0,0 +1,169 @@
+private import cpp
+// The `ValueNumbering` library has to be imported right after `cpp` to ensure
+// that the cached IR gets the same checksum here as it does in queries that use
+// `ValueNumbering` without `DataFlow`.
+private import semmle.code.cpp.ir.ValueNumbering
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.DataFlow
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+
+/**
+ * Gets a short ID for an IR dataflow node.
+ * - For `Instruction`s, this is just the result ID of the instruction (e.g. `m128`).
+ * - For `Operand`s, this is the label of the operand, prefixed with the result ID of the
+ *   instruction and a dot (e.g. `m128.left`).
+ * - For `Variable`s, this is the qualified name of the variable.
+ */
+private string nodeId(DataFlow::Node node, int order1, int order2) {
+  exists(Instruction instruction | instruction = node.asInstruction() |
+    result = instruction.getResultId() and
+    order1 = instruction.getBlock().getDisplayIndex() and
+    order2 = instruction.getDisplayIndexInBlock()
+  )
+  or
+  exists(Operand operand, Instruction instruction |
+    operand = node.asOperand() and
+    instruction = operand.getUse()
+  |
+    result = instruction.getResultId() + "." + operand.getDumpId() and
+    order1 = instruction.getBlock().getDisplayIndex() and
+    order2 = instruction.getDisplayIndexInBlock()
+  )
+  or
+  result = "var(" + node.asVariable().getQualifiedName() + ")" and
+  order1 = 1000000 and
+  order2 = 0
+}
+
+/**
+ * Gets the local dataflow from other nodes in the same function to this node.
+ */
+private string getFromFlow(DataFlow::Node useNode, int order1, int order2) {
+  exists(DataFlow::Node defNode, string prefix |
+    (
+      simpleLocalFlowStep(defNode, useNode) and prefix = ""
+      or
+      any(DataFlow::Configuration cfg).isAdditionalFlowStep(defNode, useNode) and
+      defNode.getEnclosingCallable() = useNode.getEnclosingCallable() and
+      prefix = "+"
+    ) and
+    if defNode.asInstruction() = useNode.asOperand().getAnyDef()
+    then
+      // Shorthand for flow from the def of this operand.
+      result = prefix + "def" and
+      order1 = -1 and
+      order2 = 0
+    else
+      if defNode.asOperand().getUse() = useNode.asInstruction()
+      then
+        // Shorthand for flow from an operand of this instruction
+        result = prefix + defNode.asOperand().getDumpId() and
+        order1 = -1 and
+        order2 = defNode.asOperand().getDumpSortOrder()
+      else result = prefix + nodeId(defNode, order1, order2)
+  )
+}
+
+/**
+ * Gets the local dataflow from this node to other nodes in the same function.
+ */
+private string getToFlow(DataFlow::Node defNode, int order1, int order2) {
+  exists(DataFlow::Node useNode, string prefix |
+    (
+      simpleLocalFlowStep(defNode, useNode) and prefix = ""
+      or
+      any(DataFlow::Configuration cfg).isAdditionalFlowStep(defNode, useNode) and
+      defNode.getEnclosingCallable() = useNode.getEnclosingCallable() and
+      prefix = "+"
+    ) and
+    if useNode.asInstruction() = defNode.asOperand().getUse()
+    then
+      // Shorthand for flow to this operand's instruction.
+      result = prefix + "result" and
+      order1 = -1 and
+      order2 = 0
+    else result = prefix + nodeId(useNode, order1, order2)
+  )
+}
+
+/**
+ * Gets the properties of the dataflow node `node`.
+ */
+private string getNodeProperty(DataFlow::Node node, string key) {
+  // List dataflow into and out of this node. Flow into this node is printed as `src->@`, and flow
+  // out of this node is printed as `@->dest`.
+  key = "flow" and
+  result =
+    strictconcat(string flow, boolean to, int order1, int order2 |
+      flow = getFromFlow(node, order1, order2) + "->@" and to = false
+      or
+      flow = "@->" + getToFlow(node, order1, order2) and to = true
+    |
+      flow, ", " order by to, order1, order2, flow
+    )
+  or
+  // Is this node a dataflow sink?
+  key = "sink" and
+  any(DataFlow::Configuration cfg).isSink(node) and
+  result = "true"
+  or
+  // Is this node a dataflow source?
+  key = "source" and
+  any(DataFlow::Configuration cfg).isSource(node) and
+  result = "true"
+  or
+  // Is this node a dataflow barrier, and if so, what kind?
+  key = "barrier" and
+  result =
+    strictconcat(string kind |
+      any(DataFlow::Configuration cfg).isBarrier(node) and kind = "full"
+      or
+      any(DataFlow::Configuration cfg).isBarrierIn(node) and kind = "in"
+      or
+      any(DataFlow::Configuration cfg).isBarrierOut(node) and kind = "out"
+      or
+      exists(DataFlow::BarrierGuard guard |
+        any(DataFlow::Configuration cfg).isBarrierGuard(guard) and
+        node = guard.getAGuardedNode() and
+        kind = "guard(" + guard.getResultId() + ")"
+      )
+    |
+      kind, ", "
+    )
+  or
+  // Is there partial flow from a source to this node?
+  // This property will only be emitted if partial flow is enabled by overriding
+  // `DataFlow::Configration::explorationLimit()`.
+  key = "pflow" and
+  result =
+    strictconcat(DataFlow::PartialPathNode sourceNode, DataFlow::PartialPathNode destNode, int dist,
+      int order1, int order2 |
+      any(DataFlow::Configuration cfg).hasPartialFlow(sourceNode, destNode, dist) and
+      destNode.getNode() = node and
+      // Only print flow from a source in the same function.
+      sourceNode.getNode().getEnclosingCallable() = node.getEnclosingCallable()
+    |
+      nodeId(sourceNode.getNode(), order1, order2) + "+" + dist.toString(), ", "
+      order by
+        order1, order2, dist desc
+    )
+}
+
+/**
+ * Property provider for local IR dataflow.
+ */
+class LocalFlowPropertyProvider extends IRPropertyProvider {
+  override string getOperandProperty(Operand operand, string key) {
+    exists(DataFlow::Node node |
+      operand = node.asOperand() and
+      result = getNodeProperty(node, key)
+    )
+  }
+
+  override string getInstructionProperty(Instruction instruction, string key) {
+    exists(DataFlow::Node node |
+      instruction = node.asInstruction() and
+      result = getNodeProperty(node, key)
+    )
+  }
+}

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll

@@ -72,4 +72,9 @@ class IRPropertyProvider extends TIRPropertyProvider {
    * Gets the value of the property named `key` for the specified block.
    */
   string getBlockProperty(IRBlock block, string key) { none() }
+
+  /**
+   * Gets the value of the property named `key` for the specified operand.
+   */
+  string getOperandProperty(Operand operand, string key) { none() }
 }

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll

@@ -804,12 +804,26 @@ class CopyValueInstruction extends CopyInstruction, UnaryInstruction {
   final override UnaryOperand getSourceValueOperand() { result = getAnOperand() }
 }
 
+/**
+ * Gets a string describing the location pointed to by the specified address operand.
+ */
+private string getAddressOperandDescription(AddressOperand operand) {
+  result = operand.getDef().(VariableAddressInstruction).getIRVariable().toString()
+  or
+  not operand.getDef() instanceof VariableAddressInstruction and
+  result = "?"
+}
+
 /**
  * An instruction that returns a register result containing a copy of its memory operand.
  */
 class LoadInstruction extends CopyInstruction {
   LoadInstruction() { getOpcode() instanceof Opcode::Load }
 
+  final override string getImmediateString() {
+    result = getAddressOperandDescription(getSourceAddressOperand())
+  }
+
   /**
    * Gets the operand that provides the address of the value being loaded.
    */
@@ -829,6 +843,10 @@ class LoadInstruction extends CopyInstruction {
 class StoreInstruction extends CopyInstruction {
   StoreInstruction() { getOpcode() instanceof Opcode::Store }
 
+  final override string getImmediateString() {
+    result = getAddressOperandDescription(getDestinationAddressOperand())
+  }
+
   /**
    * Gets the operand that provides the address of the location to which the value will be stored.
    */
@@ -1501,6 +1519,12 @@ class SwitchInstruction extends Instruction {
 class CallInstruction extends Instruction {
   CallInstruction() { getOpcode() instanceof Opcode::Call }
 
+  final override string getImmediateString() {
+    result = getStaticCallTarget().toString()
+    or
+    not exists(getStaticCallTarget()) and result = "?"
+  }
+
   /**
    * Gets the operand the specifies the target function of the call.
    */

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll

@@ -151,6 +151,11 @@ class Operand extends TOperand {
    */
   string getDumpLabel() { result = "" }
 
+  /**
+   * Gets a string that uniquely identifies this operand on its use instruction.
+   */
+  string getDumpId() { result = "" }
+
   /**
    * Gets a string describing this operand, suitable for display in IR dumps. This consists of the
    * result ID of the instruction consumed by the operand, plus a label identifying the operand
@@ -280,6 +285,8 @@ class NonPhiOperand extends Operand {
 
   final override string getDumpLabel() { result = tag.getLabel() }
 
+  final override string getDumpId() { result = tag.getId() }
+
   final override int getDumpSortOrder() { result = tag.getSortOrder() }
 
   /**
@@ -477,6 +484,8 @@ class PhiInputOperand extends MemoryOperand, PhiOperandBase {
     result = "from " + getPredecessorBlock().getDisplayIndex().toString() + ":"
   }
 
+  final override string getDumpId() { result = getPredecessorBlock().getDisplayIndex().toString() }
+
   /**
    * Gets the predecessor block from which this value comes.
    */

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll

@@ -50,6 +50,37 @@ private string getAdditionalBlockProperty(IRBlock block, string key) {
   exists(IRPropertyProvider provider | result = provider.getBlockProperty(block, key))
 }
 
+/**
+ * Gets the properties of an operand from any active property providers.
+ */
+private string getAdditionalOperandProperty(Operand operand, string key) {
+  exists(IRPropertyProvider provider | result = provider.getOperandProperty(operand, key))
+}
+
+/**
+ * Gets a string listing the properties of the operand and their corresponding values. If the
+ * operand has no properties, this predicate has no result.
+ */
+private string getOperandPropertyListString(Operand operand) {
+  result =
+    strictconcat(string key, string value |
+      value = getAdditionalOperandProperty(operand, key)
+    |
+      key + ":" + value, ", "
+    )
+}
+
+/**
+ * Gets a string listing the properties of the operand and their corresponding values. The list is
+ * surrounded by curly braces. If the operand has no properties, this predicate returns an empty
+ * string.
+ */
+private string getOperandPropertyString(Operand operand) {
+  result = "{" + getOperandPropertyListString(operand) + "}"
+  or
+  not exists(getOperandPropertyListString(operand)) and result = ""
+}
+
 private newtype TPrintableIRNode =
   TPrintableIRFunction(IRFunction irFunc) { shouldPrintFunction(irFunc.getFunction()) } or
   TPrintableIRBlock(IRBlock block) { shouldPrintFunction(block.getEnclosingFunction()) } or
@@ -190,7 +221,7 @@ private class PrintableInstruction extends PrintableIRNode, TPrintableInstructio
       |
         resultString = instr.getResultString() and
         operationString = instr.getOperationString() and
-        operandsString = instr.getOperandsString() and
+        operandsString = getOperandsString() and
         columnWidths(block, resultWidth, operationWidth) and
         result =
           resultString + getPaddingString(resultWidth - resultString.length()) + " = " +
@@ -210,6 +241,22 @@ private class PrintableInstruction extends PrintableIRNode, TPrintableInstructio
     result = PrintableIRNode.super.getProperty(key) or
     result = getAdditionalInstructionProperty(instr, key)
   }
+
+  /**
+   * Gets the string representation of the operand list. This is the same as
+   * `Instruction::getOperandsString()`, except that each operand is annotated with any properties
+   * provided by active `IRPropertyProvider` instances.
+   */
+  private string getOperandsString() {
+    result =
+      concat(Operand operand |
+        operand = instr.getAnOperand()
+      |
+        operand.getDumpString() + getOperandPropertyString(operand), ", "
+        order by
+          operand.getDumpSortOrder()
+      )
+  }
 }
 
 private predicate columnWidths(IRBlock block, int resultWidth, int operationWidth) {

cpp/ql/src/semmle/code/cpp/ir/implementation/internal/OperandTag.qll

@@ -40,7 +40,17 @@ abstract class OperandTag extends TOperandTag {
   /**
    * Gets a label that will appear before the operand when the IR is printed.
    */
-  string getLabel() { result = "" }
+  final string getLabel() { if alwaysPrintLabel() then result = getId() + ":" else result = "" }
+
+  /**
+   * Gets an identifier that uniquely identifies this operand within its instruction.
+   */
+  abstract string getId();
+
+  /**
+   * Holds if the operand should always be prefixed with its label in the dump of its instruction.
+   */
+  predicate alwaysPrintLabel() { none() }
 }
 
 /**
@@ -69,7 +79,9 @@ class AddressOperandTag extends RegisterOperandTag, TAddressOperand {
 
   final override int getSortOrder() { result = 0 }
 
-  final override string getLabel() { result = "&:" }
+  final override predicate alwaysPrintLabel() { any() }
+
+  final override string getId() { result = "&" }
 }
 
 AddressOperandTag addressOperand() { result = TAddressOperand() }
@@ -82,6 +94,8 @@ class BufferSizeOperandTag extends RegisterOperandTag, TBufferSizeOperand {
   final override string toString() { result = "BufferSize" }
 
   final override int getSortOrder() { result = 1 }
+
+  final override string getId() { result = "size" }
 }
 
 BufferSizeOperandTag bufferSizeOperand() { result = TBufferSizeOperand() }
@@ -93,6 +107,8 @@ class SideEffectOperandTag extends TypedOperandTag, TSideEffectOperand {
   final override string toString() { result = "SideEffect" }
 
   final override int getSortOrder() { result = 2 }
+
+  final override string getId() { result = "side_effect" }
 }
 
 SideEffectOperandTag sideEffectOperand() { result = TSideEffectOperand() }
@@ -105,6 +121,8 @@ class LoadOperandTag extends TypedOperandTag, TLoadOperand {
   final override string toString() { result = "Load" }
 
   final override int getSortOrder() { result = 3 }
+
+  final override string getId() { result = "load" }
 }
 
 LoadOperandTag loadOperand() { result = TLoadOperand() }
@@ -116,6 +134,8 @@ class StoreValueOperandTag extends RegisterOperandTag, TStoreValueOperand {
   final override string toString() { result = "StoreValue" }
 
   final override int getSortOrder() { result = 4 }
+
+  final override string getId() { result = "store" }
 }
 
 StoreValueOperandTag storeValueOperand() { result = TStoreValueOperand() }
@@ -127,6 +147,8 @@ class UnaryOperandTag extends RegisterOperandTag, TUnaryOperand {
   final override string toString() { result = "Unary" }
 
   final override int getSortOrder() { result = 5 }
+
+  final override string getId() { result = "unary" }
 }
 
 UnaryOperandTag unaryOperand() { result = TUnaryOperand() }
@@ -138,6 +160,8 @@ class LeftOperandTag extends RegisterOperandTag, TLeftOperand {
   final override string toString() { result = "Left" }
 
   final override int getSortOrder() { result = 6 }
+
+  final override string getId() { result = "left" }
 }
 
 LeftOperandTag leftOperand() { result = TLeftOperand() }
@@ -149,6 +173,8 @@ class RightOperandTag extends RegisterOperandTag, TRightOperand {
   final override string toString() { result = "Right" }
 
   final override int getSortOrder() { result = 7 }
+
+  final override string getId() { result = "right" }
 }
 
 RightOperandTag rightOperand() { result = TRightOperand() }
@@ -160,6 +186,8 @@ class ConditionOperandTag extends RegisterOperandTag, TConditionOperand {
   final override string toString() { result = "Condition" }
 
   final override int getSortOrder() { result = 8 }
+
+  final override string getId() { result = "cond" }
 }
 
 ConditionOperandTag conditionOperand() { result = TConditionOperand() }
@@ -172,7 +200,9 @@ class CallTargetOperandTag extends RegisterOperandTag, TCallTargetOperand {
 
   final override int getSortOrder() { result = 10 }
 
-  final override string getLabel() { result = "func:" }
+  final override predicate alwaysPrintLabel() { any() }
+
+  final override string getId() { result = "func" }
 }
 
 CallTargetOperandTag callTargetOperand() { result = TCallTargetOperand() }
@@ -195,7 +225,9 @@ class ThisArgumentOperandTag extends ArgumentOperandTag, TThisArgumentOperand {
 
   final override int getSortOrder() { result = 11 }
 
-  final override string getLabel() { result = "this:" }
+  final override predicate alwaysPrintLabel() { any() }
+
+  final override string getId() { result = "this" }
 }
 
 ThisArgumentOperandTag thisArgumentOperand() { result = TThisArgumentOperand() }
@@ -212,9 +244,11 @@ class PositionalArgumentOperandTag extends ArgumentOperandTag, TPositionalArgume
 
   final override int getSortOrder() { result = 12 + argIndex }
 
-  final override string getLabel() { result = argIndex.toString() + ":" }
+  final override predicate alwaysPrintLabel() { any() }
 
   final int getArgIndex() { result = argIndex }
+
+  final override string getId() { result = argIndex.toString() }
 }
 
 PositionalArgumentOperandTag positionalArgumentOperand(int argIndex) {
@@ -228,7 +262,9 @@ class ChiTotalOperandTag extends ChiOperandTag, TChiTotalOperand {
 
   final override int getSortOrder() { result = 13 }
 
-  final override string getLabel() { result = "total:" }
+  final override predicate alwaysPrintLabel() { any() }
+
+  final override string getId() { result = "total" }
 }
 
 ChiTotalOperandTag chiTotalOperand() { result = TChiTotalOperand() }
@@ -238,7 +274,9 @@ class ChiPartialOperandTag extends ChiOperandTag, TChiPartialOperand {
 
   final override int getSortOrder() { result = 14 }
 
-  final override string getLabel() { result = "partial:" }
+  final override predicate alwaysPrintLabel() { any() }
+
+  final override string getId() { result = "partial" }
 }
 
 ChiPartialOperandTag chiPartialOperand() { result = TChiPartialOperand() }
@@ -252,7 +290,9 @@ class AsmOperandTag extends RegisterOperandTag, TAsmOperand {
 
   final override int getSortOrder() { result = 15 + index }
 
-  final override string getLabel() { result = index.toString() + ":" }
+  final override predicate alwaysPrintLabel() { any() }
+
+  final override string getId() { result = index.toString() }
 }
 
 AsmOperandTag asmOperand(int index) { result = TAsmOperand(index) }

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IR.qll

@@ -72,4 +72,9 @@ class IRPropertyProvider extends TIRPropertyProvider {
    * Gets the value of the property named `key` for the specified block.
    */
   string getBlockProperty(IRBlock block, string key) { none() }
+
+  /**
+   * Gets the value of the property named `key` for the specified operand.
+   */
+  string getOperandProperty(Operand operand, string key) { none() }
 }

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll

@@ -804,12 +804,26 @@ class CopyValueInstruction extends CopyInstruction, UnaryInstruction {
   final override UnaryOperand getSourceValueOperand() { result = getAnOperand() }
 }
 
+/**
+ * Gets a string describing the location pointed to by the specified address operand.
+ */
+private string getAddressOperandDescription(AddressOperand operand) {
+  result = operand.getDef().(VariableAddressInstruction).getIRVariable().toString()
+  or
+  not operand.getDef() instanceof VariableAddressInstruction and
+  result = "?"
+}
+
 /**
  * An instruction that returns a register result containing a copy of its memory operand.
  */
 class LoadInstruction extends CopyInstruction {
   LoadInstruction() { getOpcode() instanceof Opcode::Load }
 
+  final override string getImmediateString() {
+    result = getAddressOperandDescription(getSourceAddressOperand())
+  }
+
   /**
    * Gets the operand that provides the address of the value being loaded.
    */
@@ -829,6 +843,10 @@ class LoadInstruction extends CopyInstruction {
 class StoreInstruction extends CopyInstruction {
   StoreInstruction() { getOpcode() instanceof Opcode::Store }
 
+  final override string getImmediateString() {
+    result = getAddressOperandDescription(getDestinationAddressOperand())
+  }
+
   /**
    * Gets the operand that provides the address of the location to which the value will be stored.
    */
@@ -1501,6 +1519,12 @@ class SwitchInstruction extends Instruction {
 class CallInstruction extends Instruction {
   CallInstruction() { getOpcode() instanceof Opcode::Call }
 
+  final override string getImmediateString() {
+    result = getStaticCallTarget().toString()
+    or
+    not exists(getStaticCallTarget()) and result = "?"
+  }
+
   /**
    * Gets the operand the specifies the target function of the call.
    */

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll

@@ -151,6 +151,11 @@ class Operand extends TOperand {
    */
   string getDumpLabel() { result = "" }
 
+  /**
+   * Gets a string that uniquely identifies this operand on its use instruction.
+   */
+  string getDumpId() { result = "" }
+
   /**
    * Gets a string describing this operand, suitable for display in IR dumps. This consists of the
    * result ID of the instruction consumed by the operand, plus a label identifying the operand
@@ -280,6 +285,8 @@ class NonPhiOperand extends Operand {
 
   final override string getDumpLabel() { result = tag.getLabel() }
 
+  final override string getDumpId() { result = tag.getId() }
+
   final override int getDumpSortOrder() { result = tag.getSortOrder() }
 
   /**
@@ -477,6 +484,8 @@ class PhiInputOperand extends MemoryOperand, PhiOperandBase {
     result = "from " + getPredecessorBlock().getDisplayIndex().toString() + ":"
   }
 
+  final override string getDumpId() { result = getPredecessorBlock().getDisplayIndex().toString() }
+
   /**
    * Gets the predecessor block from which this value comes.
    */

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/PrintIR.qll

@@ -50,6 +50,37 @@ private string getAdditionalBlockProperty(IRBlock block, string key) {
   exists(IRPropertyProvider provider | result = provider.getBlockProperty(block, key))
 }
 
+/**
+ * Gets the properties of an operand from any active property providers.
+ */
+private string getAdditionalOperandProperty(Operand operand, string key) {
+  exists(IRPropertyProvider provider | result = provider.getOperandProperty(operand, key))
+}
+
+/**
+ * Gets a string listing the properties of the operand and their corresponding values. If the
+ * operand has no properties, this predicate has no result.
+ */
+private string getOperandPropertyListString(Operand operand) {
+  result =
+    strictconcat(string key, string value |
+      value = getAdditionalOperandProperty(operand, key)
+    |
+      key + ":" + value, ", "
+    )
+}
+
+/**
+ * Gets a string listing the properties of the operand and their corresponding values. The list is
+ * surrounded by curly braces. If the operand has no properties, this predicate returns an empty
+ * string.
+ */
+private string getOperandPropertyString(Operand operand) {
+  result = "{" + getOperandPropertyListString(operand) + "}"
+  or
+  not exists(getOperandPropertyListString(operand)) and result = ""
+}
+
 private newtype TPrintableIRNode =
   TPrintableIRFunction(IRFunction irFunc) { shouldPrintFunction(irFunc.getFunction()) } or
   TPrintableIRBlock(IRBlock block) { shouldPrintFunction(block.getEnclosingFunction()) } or
@@ -190,7 +221,7 @@ private class PrintableInstruction extends PrintableIRNode, TPrintableInstructio
       |
         resultString = instr.getResultString() and
         operationString = instr.getOperationString() and
-        operandsString = instr.getOperandsString() and
+        operandsString = getOperandsString() and
         columnWidths(block, resultWidth, operationWidth) and
         result =
           resultString + getPaddingString(resultWidth - resultString.length()) + " = " +
@@ -210,6 +241,22 @@ private class PrintableInstruction extends PrintableIRNode, TPrintableInstructio
     result = PrintableIRNode.super.getProperty(key) or
     result = getAdditionalInstructionProperty(instr, key)
   }
+
+  /**
+   * Gets the string representation of the operand list. This is the same as
+   * `Instruction::getOperandsString()`, except that each operand is annotated with any properties
+   * provided by active `IRPropertyProvider` instances.
+   */
+  private string getOperandsString() {
+    result =
+      concat(Operand operand |
+        operand = instr.getAnOperand()
+      |
+        operand.getDumpString() + getOperandPropertyString(operand), ", "
+        order by
+          operand.getDumpSortOrder()
+      )
+  }
 }
 
 private predicate columnWidths(IRBlock block, int resultWidth, int operationWidth) {

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll

@@ -72,4 +72,9 @@ class IRPropertyProvider extends TIRPropertyProvider {
    * Gets the value of the property named `key` for the specified block.
    */
   string getBlockProperty(IRBlock block, string key) { none() }
+
+  /**
+   * Gets the value of the property named `key` for the specified operand.
+   */
+  string getOperandProperty(Operand operand, string key) { none() }
 }

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll

@@ -804,12 +804,26 @@ class CopyValueInstruction extends CopyInstruction, UnaryInstruction {
   final override UnaryOperand getSourceValueOperand() { result = getAnOperand() }
 }
 
+/**
+ * Gets a string describing the location pointed to by the specified address operand.
+ */
+private string getAddressOperandDescription(AddressOperand operand) {
+  result = operand.getDef().(VariableAddressInstruction).getIRVariable().toString()
+  or
+  not operand.getDef() instanceof VariableAddressInstruction and
+  result = "?"
+}
+
 /**
  * An instruction that returns a register result containing a copy of its memory operand.
  */
 class LoadInstruction extends CopyInstruction {
   LoadInstruction() { getOpcode() instanceof Opcode::Load }
 
+  final override string getImmediateString() {
+    result = getAddressOperandDescription(getSourceAddressOperand())
+  }
+
   /**
    * Gets the operand that provides the address of the value being loaded.
    */
@@ -829,6 +843,10 @@ class LoadInstruction extends CopyInstruction {
 class StoreInstruction extends CopyInstruction {
   StoreInstruction() { getOpcode() instanceof Opcode::Store }
 
+  final override string getImmediateString() {
+    result = getAddressOperandDescription(getDestinationAddressOperand())
+  }
+
   /**
    * Gets the operand that provides the address of the location to which the value will be stored.
    */
@@ -1501,6 +1519,12 @@ class SwitchInstruction extends Instruction {
 class CallInstruction extends Instruction {
   CallInstruction() { getOpcode() instanceof Opcode::Call }
 
+  final override string getImmediateString() {
+    result = getStaticCallTarget().toString()
+    or
+    not exists(getStaticCallTarget()) and result = "?"
+  }
+
   /**
    * Gets the operand the specifies the target function of the call.
    */

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll

@@ -151,6 +151,11 @@ class Operand extends TOperand {
    */
   string getDumpLabel() { result = "" }
 
+  /**
+   * Gets a string that uniquely identifies this operand on its use instruction.
+   */
+  string getDumpId() { result = "" }
+
   /**
    * Gets a string describing this operand, suitable for display in IR dumps. This consists of the
    * result ID of the instruction consumed by the operand, plus a label identifying the operand
@@ -280,6 +285,8 @@ class NonPhiOperand extends Operand {
 
   final override string getDumpLabel() { result = tag.getLabel() }
 
+  final override string getDumpId() { result = tag.getId() }
+
   final override int getDumpSortOrder() { result = tag.getSortOrder() }
 
   /**
@@ -477,6 +484,8 @@ class PhiInputOperand extends MemoryOperand, PhiOperandBase {
     result = "from " + getPredecessorBlock().getDisplayIndex().toString() + ":"
   }
 
+  final override string getDumpId() { result = getPredecessorBlock().getDisplayIndex().toString() }
+
   /**
    * Gets the predecessor block from which this value comes.
    */

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll

@@ -50,6 +50,37 @@ private string getAdditionalBlockProperty(IRBlock block, string key) {
   exists(IRPropertyProvider provider | result = provider.getBlockProperty(block, key))
 }
 
+/**
+ * Gets the properties of an operand from any active property providers.
+ */
+private string getAdditionalOperandProperty(Operand operand, string key) {
+  exists(IRPropertyProvider provider | result = provider.getOperandProperty(operand, key))
+}
+
+/**
+ * Gets a string listing the properties of the operand and their corresponding values. If the
+ * operand has no properties, this predicate has no result.
+ */
+private string getOperandPropertyListString(Operand operand) {
+  result =
+    strictconcat(string key, string value |
+      value = getAdditionalOperandProperty(operand, key)
+    |
+      key + ":" + value, ", "
+    )
+}
+
+/**
+ * Gets a string listing the properties of the operand and their corresponding values. The list is
+ * surrounded by curly braces. If the operand has no properties, this predicate returns an empty
+ * string.
+ */
+private string getOperandPropertyString(Operand operand) {
+  result = "{" + getOperandPropertyListString(operand) + "}"
+  or
+  not exists(getOperandPropertyListString(operand)) and result = ""
+}
+
 private newtype TPrintableIRNode =
   TPrintableIRFunction(IRFunction irFunc) { shouldPrintFunction(irFunc.getFunction()) } or
   TPrintableIRBlock(IRBlock block) { shouldPrintFunction(block.getEnclosingFunction()) } or
@@ -190,7 +221,7 @@ private class PrintableInstruction extends PrintableIRNode, TPrintableInstructio
       |
         resultString = instr.getResultString() and
         operationString = instr.getOperationString() and
-        operandsString = instr.getOperandsString() and
+        operandsString = getOperandsString() and
         columnWidths(block, resultWidth, operationWidth) and
         result =
           resultString + getPaddingString(resultWidth - resultString.length()) + " = " +
@@ -210,6 +241,22 @@ private class PrintableInstruction extends PrintableIRNode, TPrintableInstructio
     result = PrintableIRNode.super.getProperty(key) or
     result = getAdditionalInstructionProperty(instr, key)
   }
+
+  /**
+   * Gets the string representation of the operand list. This is the same as
+   * `Instruction::getOperandsString()`, except that each operand is annotated with any properties
+   * provided by active `IRPropertyProvider` instances.
+   */
+  private string getOperandsString() {
+    result =
+      concat(Operand operand |
+        operand = instr.getAnOperand()
+      |
+        operand.getDumpString() + getOperandPropertyString(operand), ", "
+        order by
+          operand.getDumpSortOrder()
+      )
+  }
 }
 
 private predicate columnWidths(IRBlock block, int resultWidth, int operationWidth) {

cpp/ql/src/semmle/code/cpp/models/implementations/Gets.qll

@@ -16,11 +16,10 @@ import semmle.code.cpp.models.interfaces.FlowSource
 class GetsFunction extends DataFlowFunction, TaintFunction, ArrayFunction, AliasFunction,
   SideEffectFunction, RemoteFlowFunction {
   GetsFunction() {
-    exists(string name | hasGlobalOrStdName(name) |
-      name = "gets" or // gets(str)
-      name = "fgets" or // fgets(str, num, stream)
-      name = "fgetws" // fgetws(wstr, num, stream)
-    )
+    // gets(str)
+    // fgets(str, num, stream)
+    // fgetws(wstr, num, stream)
+    hasGlobalOrStdName(["gets", "fgets", "fgetws"])
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {

cpp/ql/src/semmle/code/cpp/models/implementations/IdentityFunction.qll

@@ -4,16 +4,13 @@ import semmle.code.cpp.models.interfaces.DataFlow
 import semmle.code.cpp.models.interfaces.SideEffect
 
 /**
- * The standard function templates `std::move` and `std::identity`
+ * The standard function templates `std::move` and `std::forward`.
  */
 class IdentityFunction extends DataFlowFunction, SideEffectFunction, AliasFunction {
   IdentityFunction() {
     this.getNamespace().getParentNamespace() instanceof GlobalNamespace and
     this.getNamespace().getName() = "std" and
-    (
-      this.getName() = "move" or
-      this.getName() = "forward"
-    )
+    this.getName() = ["move", "forward"]
   }
 
   override predicate hasOnlySpecificReadSideEffects() { any() }

cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll

@@ -52,7 +52,58 @@ class StdMapInsert extends TaintFunction {
 }
 
 /**
- * The standard map `swap` functions.
+ * The standard map `emplace` and `emplace_hint` functions.
+ */
+class StdMapEmplace extends TaintFunction {
+  StdMapEmplace() {
+    this.hasQualifiedName("std", ["map", "unordered_map"], ["emplace", "emplace_hint"])
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from the last parameter (which may be the value part used to
+    // construct a pair, or a pair to be copied / moved) to the qualifier and
+    // return value.
+    // (where the return value is a pair, this should really flow just to the first part of it)
+    input.isParameterDeref(getNumberOfParameters() - 1) and
+    (
+      output.isQualifierObject() or
+      output.isReturnValue()
+    )
+    or
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
+/**
+ * The standard map `try_emplace` function.
+ */
+class StdMapTryEmplace extends TaintFunction {
+  StdMapTryEmplace() { this.hasQualifiedName("std", ["map", "unordered_map"], "try_emplace") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from any parameter apart from the key to qualifier and return value
+    // (here we assume taint flow from any constructor parameter to the constructed object)
+    // (where the return value is a pair, this should really flow just to the first part of it)
+    exists(int arg | arg = [1 .. getNumberOfParameters() - 1] |
+      (
+        not getUnspecifiedType() instanceof Iterator or
+        arg != 1
+      ) and
+      input.isParameterDeref(arg)
+    ) and
+    (
+      output.isQualifierObject() or
+      output.isReturnValue()
+    )
+    or
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
+/**
+ * The standard map `swap` function.
  */
 class StdMapSwap extends TaintFunction {
   StdMapSwap() { this.hasQualifiedName("std", ["map", "unordered_map"], "swap") }
@@ -67,6 +118,19 @@ class StdMapSwap extends TaintFunction {
   }
 }
 
+/**
+ * The standard map `merge` function.
+ */
+class StdMapMerge extends TaintFunction {
+  StdMapMerge() { this.hasQualifiedName("std", ["map", "unordered_map"], "merge") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // container1.merge(container2)
+    input.isParameterDeref(0) and
+    output.isQualifierObject()
+  }
+}
+
 /**
  * The standard map functions `at` and `operator[]`.
  */
@@ -109,3 +173,20 @@ class StdMapErase extends TaintFunction {
     output.isReturnValue()
   }
 }
+
+/**
+ * The standard map `lower_bound`, `upper_bound` and `equal_range` functions.
+ */
+class StdMapEqualRange extends TaintFunction {
+  StdMapEqualRange() {
+    this
+        .hasQualifiedName("std", ["map", "unordered_map"],
+          ["lower_bound", "upper_bound", "equal_range"])
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from qualifier to return value
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}

cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll

@@ -49,6 +49,29 @@ class StdSetInsert extends TaintFunction {
   }
 }
 
+/**
+ * The standard set `emplace` and `emplace_hint` functions.
+ */
+class StdSetEmplace extends TaintFunction {
+  StdSetEmplace() {
+    this.hasQualifiedName("std", ["set", "unordered_set"], ["emplace", "emplace_hint"])
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from any parameter to qualifier and return value
+    // (here we assume taint flow from any constructor parameter to the constructed object)
+    // (where the return value is a pair, this should really flow just to the first part of it)
+    input.isParameter([0 .. getNumberOfParameters() - 1]) and
+    (
+      output.isQualifierObject() or
+      output.isReturnValue()
+    )
+    or
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}
+
 /**
  * The standard set `swap` functions.
  */
@@ -65,6 +88,19 @@ class StdSetSwap extends TaintFunction {
   }
 }
 
+/**
+ * The standard set `merge` function.
+ */
+class StdSetMerge extends TaintFunction {
+  StdSetMerge() { this.hasQualifiedName("std", ["set", "unordered_set"], "merge") }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // container1.merge(container2)
+    input.isParameterDeref(0) and
+    output.isQualifierObject()
+  }
+}
+
 /**
  * The standard set `find` function.
  */
@@ -90,3 +126,20 @@ class StdSetErase extends TaintFunction {
     output.isReturnValue()
   }
 }
+
+/**
+ * The standard set `lower_bound`, `upper_bound` and `equal_range` functions.
+ */
+class StdSetEqualRange extends TaintFunction {
+  StdSetEqualRange() {
+    this
+        .hasQualifiedName("std", ["set", "unordered_set"],
+          ["lower_bound", "upper_bound", "equal_range"])
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    // flow from qualifier to return value
+    input.isQualifierObject() and
+    output.isReturnValue()
+  }
+}

cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll

@@ -13,43 +13,24 @@ import semmle.code.cpp.models.interfaces.SideEffect
  */
 class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, SideEffectFunction {
   StrcpyFunction() {
-    exists(string name | name = getName() |
-      // strcpy(dst, src)
-      name = "strcpy"
-      or
-      // wcscpy(dst, src)
-      name = "wcscpy"
-      or
-      // _mbscpy(dst, src)
-      name = "_mbscpy"
-      or
-      (
-        name = "strcpy_s" or // strcpy_s(dst, max_amount, src)
-        name = "wcscpy_s" or // wcscpy_s(dst, max_amount, src)
-        name = "_mbscpy_s" // _mbscpy_s(dst, max_amount, src)
-      ) and
-      // exclude the 2-parameter template versions
-      // that find the size of a fixed size destination buffer.
-      getNumberOfParameters() = 3
-      or
-      // strncpy(dst, src, max_amount)
-      name = "strncpy"
-      or
-      // _strncpy_l(dst, src, max_amount, locale)
-      name = "_strncpy_l"
-      or
-      // wcsncpy(dst, src, max_amount)
-      name = "wcsncpy"
-      or
-      // _wcsncpy_l(dst, src, max_amount, locale)
-      name = "_wcsncpy_l"
-      or
-      // _mbsncpy(dst, src, max_amount)
-      name = "_mbsncpy"
-      or
-      // _mbsncpy_l(dst, src, max_amount, locale)
-      name = "_mbsncpy_l"
-    )
+    getName() =
+      ["strcpy", // strcpy(dst, src)
+          "wcscpy", // wcscpy(dst, src)
+          "_mbscpy", // _mbscpy(dst, src)
+          "strncpy", // strncpy(dst, src, max_amount)
+          "_strncpy_l", // _strncpy_l(dst, src, max_amount, locale)
+          "wcsncpy", // wcsncpy(dst, src, max_amount)
+          "_wcsncpy_l", // _wcsncpy_l(dst, src, max_amount, locale)
+          "_mbsncpy", // _mbsncpy(dst, src, max_amount)
+          "_mbsncpy_l"] // _mbsncpy_l(dst, src, max_amount, locale)
+    or
+    getName() =
+      ["strcpy_s", // strcpy_s(dst, max_amount, src)
+          "wcscpy_s", // wcscpy_s(dst, max_amount, src)
+          "_mbscpy_s"] and // _mbscpy_s(dst, max_amount, src)
+    // exclude the 2-parameter template versions
+    // that find the size of a fixed size destination buffer.
+    getNumberOfParameters() = 3
   }
 
   /**

cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll

@@ -460,6 +460,39 @@ private predicate isRecursiveDef(RangeSsaDefinition def, StackVariable v) {
   defDependsOnDefTransitively(def, v, def, v)
 }
 
+/**
+ * Holds if the bounds of `e` depend on a recursive definition, meaning that
+ * `e` is likely to have many candidate bounds during the main recursion.
+ */
+private predicate isRecursiveExpr(Expr e) {
+  exists(RangeSsaDefinition def, StackVariable v | exprDependsOnDef(e, def, v) |
+    isRecursiveDef(def, v)
+  )
+}
+
+/**
+ * Holds if `binop` is a binary operation that's likely to be assigned a
+ * quadratic (or more) number of candidate bounds during the analysis. This can
+ * happen when two conditions are satisfied:
+ * 1. It is likely there are many more candidate bounds for `binop` than for
+ *    its operands. For example, the number of candidate bounds for `x + y`,
+ *    denoted here nbounds(`x + y`), will be O(nbounds(`x`) * nbounds(`y`)).
+ *    In contrast, nbounds(`b ? x : y`) is only O(nbounds(`x`) + nbounds(`y`)).
+ * 2. Both operands of `binop` are recursively determined and are therefore
+ *    likely to have a large number of candidate bounds.
+ */
+private predicate isRecursiveBinary(BinaryOperation binop) {
+  (
+    binop instanceof UnsignedMulExpr
+    or
+    binop instanceof AddExpr
+    or
+    binop instanceof SubExpr
+  ) and
+  isRecursiveExpr(binop.getLeftOperand()) and
+  isRecursiveExpr(binop.getRightOperand())
+}
+
 /**
  * We distinguish 3 kinds of RangeSsaDefinition:
  *
@@ -581,7 +614,16 @@ private float getTruncatedLowerBounds(Expr expr) {
       // overflow, so we replace invalid bounds with exprMinVal.
       exists(float newLB | newLB = normalizeFloatUp(getLowerBoundsImpl(expr)) |
         if exprMinVal(expr) <= newLB and newLB <= exprMaxVal(expr)
-        then result = newLB
+        then
+          // Apply widening where we might get a combinatorial explosion.
+          if isRecursiveBinary(expr)
+          then
+            result =
+              max(float widenLB |
+                widenLB = wideningLowerBounds(expr.getUnspecifiedType()) and
+                not widenLB > newLB
+              )
+          else result = newLB
         else result = exprMinVal(expr)
       )
       or
@@ -628,7 +670,16 @@ private float getTruncatedUpperBounds(Expr expr) {
       // `exprMaxVal`.
       exists(float newUB | newUB = normalizeFloatUp(getUpperBoundsImpl(expr)) |
         if exprMinVal(expr) <= newUB and newUB <= exprMaxVal(expr)
-        then result = newUB
+        then
+          // Apply widening where we might get a combinatorial explosion.
+          if isRecursiveBinary(expr)
+          then
+            result =
+              min(float widenUB |
+                widenUB = wideningUpperBounds(expr.getUnspecifiedType()) and
+                not widenUB < newUB
+              )
+          else result = newUB
         else result = exprMaxVal(expr)
       )
       or

cpp/ql/src/semmle/code/cpp/security/BufferWrite.qll

@@ -354,11 +354,10 @@ class SnprintfBW extends BufferWriteCall {
  */
 class GetsBW extends BufferWriteCall {
   GetsBW() {
-    exists(TopLevelFunction fn, string name | fn = getTarget() and name = fn.getName() |
-      name = "gets" or // gets(dst)
-      name = "fgets" or // fgets(dst, max_amount, src_stream)
-      name = "fgetws" // fgetws(dst, max_amount, src_stream)
-    )
+    getTarget().(TopLevelFunction).getName() =
+      ["gets", // gets(dst)
+          "fgets", // fgets(dst, max_amount, src_stream)
+          "fgetws"] // fgetws(dst, max_amount, src_stream)
   }
 
   /**

cpp/ql/src/semmle/code/cpp/security/FileWrite.qll

@@ -123,9 +123,7 @@ class WriteFunctionCall extends ChainedOutputCall {
 private predicate fileStreamChain(ChainedOutputCall out, Expr source, Expr dest) {
   source = out.getSource() and
   dest = out.getEndDest() and
-  exists(string nme | nme = "basic_ofstream" or nme = "basic_fstream" |
-    dest.getUnderlyingType().(Class).getSimpleName() = nme
-  )
+  dest.getUnderlyingType().(Class).getSimpleName() = ["basic_ofstream", "basic_fstream"]
 }
 
 /**
@@ -139,15 +137,7 @@ private predicate fileWrite(Call write, Expr source, Expr dest) {
       // named functions
       name = "fwrite" and s = 0 and d = 3
       or
-      (
-        name = "fputs" or
-        name = "fputws" or
-        name = "fputc" or
-        name = "fputwc" or
-        name = "putc" or
-        name = "putwc" or
-        name = "putw"
-      ) and
+      name = ["fputs", "fputws", "fputc", "fputwc", "putc", "putwc", "putw"] and
       s = 0 and
       d = 1
     )

cpp/ql/src/semmle/code/cpp/security/OutputWrite.qll

@@ -48,10 +48,7 @@ private predicate outputFile(Expr e) {
       name = e.(VariableAccess).getTarget().(GlobalVariable).toString() or
       name = e.findRootCause().(Macro).getName()
     ) and
-    (
-      name = "stdout" or
-      name = "stderr"
-    )
+    name = ["stdout", "stderr"]
   )
 }
 

cpp/ql/src/semmle/code/cpp/security/TaintTrackingImpl.qll

@@ -252,11 +252,10 @@ private predicate insideFunctionValueMoveTo(Element src, Element dest) {
       copyValueBetweenArguments(c.getTarget(), sourceArg, destArg) and
       // Only consider copies from `printf`-like functions if the format is a string
       (
-        exists(FormattingFunctionCall ffc, FormatLiteral format, string argFormat |
+        exists(FormattingFunctionCall ffc, FormatLiteral format |
           ffc = c and
           format = ffc.getFormat() and
-          format.getConversionChar(sourceArg - ffc.getTarget().getNumberOfParameters()) = argFormat and
-          (argFormat = "s" or argFormat = "S")
+          format.getConversionChar(sourceArg - ffc.getTarget().getNumberOfParameters()) = ["s", "S"]
         )
         or
         not exists(FormatLiteral fl | fl = c.(FormattingFunctionCall).getFormat())
@@ -273,12 +272,12 @@ private predicate insideFunctionValueMoveTo(Element src, Element dest) {
       dest = c
     )
     or
-    exists(FormattingFunctionCall formattingSend, int arg, FormatLiteral format, string argFormat |
+    exists(FormattingFunctionCall formattingSend, int arg, FormatLiteral format |
       dest = formattingSend and
       formattingSend.getArgument(arg) = src and
       format = formattingSend.getFormat() and
-      format.getConversionChar(arg - formattingSend.getTarget().getNumberOfParameters()) = argFormat and
-      (argFormat = "s" or argFormat = "S" or argFormat = "@")
+      format.getConversionChar(arg - formattingSend.getTarget().getNumberOfParameters()) =
+        ["s", "S", "@"]
     )
     or
     // Expressions computed from tainted data are also tainted

cpp/ql/src/semmle/uml/MagicDraw.qll

@@ -65,15 +65,8 @@ class UMLElement extends XMLElement {
  */
 class UMLType extends UMLElement {
   UMLType() {
-    exists(string type |
-      this.getName() = "packagedElement" and
-      this.getAttribute("type").getValue() = type and
-      (
-        type = "uml:Class" or
-        type = "uml:Interface" or
-        type = "uml:PrimitiveType"
-      )
-    )
+    this.getName() = "packagedElement" and
+    this.getAttribute("type").getValue() = ["uml:Class", "uml:Interface", "uml:PrimitiveType"]
   }
 
   /**

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -21,3 +21,69 @@ argHasPostUpdate
 | lambdas.cpp:38:2:38:2 | d | ArgumentNode is missing PostUpdateNode. |
 | lambdas.cpp:45:2:45:2 | e | ArgumentNode is missing PostUpdateNode. |
 | test.cpp:67:29:67:35 | source1 | ArgumentNode is missing PostUpdateNode. |
+postWithInFlow
+| BarrierGuard.cpp:49:6:49:6 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| BarrierGuard.cpp:60:7:60:7 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:22:9:22:20 | sourceArray1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:28:22:28:23 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:50:3:50:12 | stackArray [inner post update] | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:50:3:50:15 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:60:3:60:14 | globalBottom [post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:61:3:61:14 | globalMiddle [post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:78:24:78:37 | call to allocateBottom [inner post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:148:5:148:5 | f [post update] | PostUpdateNode should not be the target of local flow. |
+| dispatch.cpp:168:8:168:8 | f [post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:24:9:24:9 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:24:20:24:20 | y [post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:26:9:26:9 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:26:19:26:24 | coords [inner post update] | PostUpdateNode should not be the target of local flow. |
+| example.c:28:23:28:25 | pos [inner post update] | PostUpdateNode should not be the target of local flow. |
+| globals.cpp:13:5:13:19 | flowTestGlobal1 [post update] | PostUpdateNode should not be the target of local flow. |
+| globals.cpp:23:5:23:19 | flowTestGlobal2 [post update] | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:23:3:23:14 | v [post update] | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:43:3:43:3 | c [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:11:5:11:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:11:5:11:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:20:5:20:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:22:7:22:9 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:24:7:24:9 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:29:5:29:7 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:31:7:31:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:39:7:39:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:44:5:44:7 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:46:7:46:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:48:7:48:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:75:9:75:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:83:9:83:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:87:11:87:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:89:11:89:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:94:9:94:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:96:11:96:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:104:11:104:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:109:9:109:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:113:11:113:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:115:11:115:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:91:3:91:9 | source1 [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:115:3:115:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:115:4:115:6 | out [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:120:3:120:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:120:4:120:6 | out [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:125:3:125:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:125:4:125:6 | out [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:333:5:333:13 | globalVar [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:347:5:347:13 | globalVar [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:359:5:359:9 | field [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:373:5:373:9 | field [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:384:10:384:13 | ref arg & ... | PostUpdateNode should not be the target of local flow. |
+| test.cpp:384:11:384:13 | tmp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:391:10:391:13 | ref arg & ... | PostUpdateNode should not be the target of local flow. |
+| test.cpp:391:11:391:13 | tmp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:400:10:400:13 | ref arg & ... | PostUpdateNode should not be the target of local flow. |
+| test.cpp:400:11:400:13 | tmp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:407:10:407:13 | ref arg & ... | PostUpdateNode should not be the target of local flow. |
+| test.cpp:407:11:407:13 | tmp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:423:21:423:25 | local [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:436:19:436:23 | local [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:465:3:465:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:465:4:465:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:470:22:470:22 | x [inner post update] | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -30,3 +30,56 @@ uniquePostUpdate
 postIsInSameCallable
 reverseRead
 argHasPostUpdate
+postWithInFlow
+| BarrierGuard.cpp:49:3:49:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| BarrierGuard.cpp:60:3:60:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:28:3:28:34 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:34:22:34:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:34:32:34:37 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:39:32:39:37 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:39:42:39:47 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:43:35:43:40 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:43:51:43:51 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:49:25:49:30 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:49:35:49:40 | Chi | PostUpdateNode should not be the target of local flow. |
+| clang.cpp:50:3:50:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:17:19:17:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:17:21:17:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:24:2:24:30 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:24:13:24:30 | Chi | PostUpdateNode should not be the target of local flow. |
+| example.c:26:2:26:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:13:12:13:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:13:15:13:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:28:10:31:2 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:28:10:31:2 | Chi | PostUpdateNode should not be the target of local flow. |
+| lambdas.cpp:43:3:43:14 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:11:5:11:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:20:5:20:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:22:7:22:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:24:7:24:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:29:5:29:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:31:7:31:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:39:7:39:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:44:5:44:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:46:7:46:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:48:7:48:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:75:5:75:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:83:5:83:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:87:7:87:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:89:7:89:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:94:5:94:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:96:7:96:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:104:7:104:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:109:5:109:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:113:7:113:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| ref.cpp:115:7:115:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:91:3:91:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:115:3:115:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:120:3:120:10 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:125:3:125:11 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:359:5:359:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:373:5:373:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:465:3:465:15 | Chi | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/fields/complex.cpp

@@ -39,17 +39,8 @@ void sink(int x)
 
 void bar(Outer &b)
 {
-  // The library correctly finds that the four `user_input` sources can make it
-  // to the `sink` calls, but it also finds some source/sink combinations that
-  // are impossible. Those false positives here are a consequence of how the
-  // shared data flow library overapproximates field flow. The library only
-  // tracks the final two fields (`f` and `inner`) and the length (3) of the field
-  // access path, and then it tracks that both `a_` and `b_` have followed `f.inner`
-  // in _some_ access path somewhere in the search. That makes the library conclude
-  // that there could be flow to `b.inner.f.a_` even when the flow was actually to
-  // `b.inner.f.b_`.
-  sink(b.inner.f.a()); // $ast=62:19 $f+:ast=63:19 $ast=64:19 $f+:ast=65:19 $ir=62:19 $f+:ir=63:19 $ir=64:19 $f+:ir=65:19
-  sink(b.inner.f.b()); // $f+:ast=62:19 $ast=63:19 $f+:ast=64:19 $ast=65:19 $f+:ir=62:19 $ir=63:19 $f+:ir=64:19 $ir=65:19
+  sink(b.inner.f.a()); // $ast=53:19 $ast=55:19 $ir=53:19 $ir=55:19
+  sink(b.inner.f.b()); // $ast=54:19 $ast=56:19 $ir=54:19 $ir=56:19
 }
 
 void foo()

cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected

@@ -39,3 +39,111 @@ argHasPostUpdate
 | by_reference.cpp:51:8:51:8 | s | ArgumentNode is missing PostUpdateNode. |
 | by_reference.cpp:57:8:57:8 | s | ArgumentNode is missing PostUpdateNode. |
 | by_reference.cpp:63:8:63:8 | s | ArgumentNode is missing PostUpdateNode. |
+postWithInFlow
+| A.cpp:25:13:25:13 | c [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:27:28:27:28 | c [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:42:11:42:12 | cc [inner post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:43:11:43:12 | ct [inner post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:100:9:100:9 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:142:10:142:10 | c [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:143:13:143:13 | b [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:183:7:183:10 | head [post update] | PostUpdateNode should not be the target of local flow. |
+| A.cpp:184:13:184:16 | next [post update] | PostUpdateNode should not be the target of local flow. |
+| B.cpp:35:13:35:17 | elem1 [post update] | PostUpdateNode should not be the target of local flow. |
+| B.cpp:36:13:36:17 | elem2 [post update] | PostUpdateNode should not be the target of local flow. |
+| B.cpp:46:13:46:16 | box1 [post update] | PostUpdateNode should not be the target of local flow. |
+| C.cpp:24:11:24:12 | s3 [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:9:21:9:24 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:11:29:11:32 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:16:21:16:23 | box [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:18:29:18:31 | box [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:30:13:30:16 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:44:19:44:22 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:57:5:57:12 | boxfield [post update] | PostUpdateNode should not be the target of local flow. |
+| D.cpp:58:20:58:23 | elem [post update] | PostUpdateNode should not be the target of local flow. |
+| E.cpp:33:19:33:19 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:9:6:9:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:13:5:13:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:17:5:17:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:25:18:25:19 | s1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:37:8:37:9 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:42:6:42:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:49:9:49:10 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:54:6:54:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:60:6:60:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:72:5:72:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:79:6:79:7 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:86:5:86:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:92:7:92:8 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:98:5:98:6 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:106:3:106:5 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:106:4:106:5 | pa [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:111:18:111:19 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:126:15:126:16 | xs [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:136:16:136:17 | xs [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:147:16:147:16 | s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:147:21:147:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:175:21:175:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:181:21:181:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:187:21:187:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:194:21:194:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:200:23:200:24 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:205:23:205:24 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:6:3:6:5 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:6:3:6:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:15:3:15:10 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:15:5:15:7 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:36:12:36:14 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:36:19:36:22 | data [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:37:17:37:19 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:38:17:38:19 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:42:15:42:17 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:42:22:42:25 | data [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:43:20:43:22 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:44:20:44:22 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:48:15:48:17 | ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:48:22:48:25 | data [post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:49:20:49:22 | ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:50:20:50:22 | ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:12:8:12:8 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:16:11:16:11 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:68:18:68:18 | s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:84:10:84:10 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:88:9:88:9 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:92:3:92:5 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:92:4:92:5 | pa [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:96:3:96:4 | pa [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:102:28:102:39 | inner_nested [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:104:22:104:22 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:106:30:106:41 | inner_nested [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:108:24:108:24 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:123:28:123:36 | inner_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:127:30:127:38 | inner_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:11:22:11:23 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:12:22:12:23 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:20:24:20:25 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:21:24:21:25 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:9:36:9:36 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:12:56:12:56 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:13:57:13:57 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:22:23:22:23 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:37:26:37:33 | call to getInner [inner post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:42:13:42:20 | call to getInner [inner post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:42:25:42:25 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:47:7:47:11 | outer [inner post update] | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:47:27:47:27 | a [post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:49:13:49:15 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:49:20:49:22 | baz [post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:53:13:53:15 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:53:35:53:43 | bufferLen [post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:54:20:54:22 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:60:16:60:18 | ref arg dst | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:61:25:61:27 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:65:25:65:27 | bar [inner post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:20:24:20:25 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:21:24:21:25 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:65:7:65:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:83:12:83:13 | f1 [post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:92:7:92:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:24:11:24:12 | ab [inner post update] | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:36:17:36:24 | nestedAB [inner post update] | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

@@ -22,3 +22,129 @@ uniquePostUpdate
 postIsInSameCallable
 reverseRead
 argHasPostUpdate
+postWithInFlow
+| A.cpp:25:7:25:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:27:22:27:32 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:98:12:98:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:100:5:100:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:142:7:142:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:143:7:143:31 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:183:7:183:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| A.cpp:184:7:184:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:6:15:6:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:15:15:15:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:35:7:35:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:36:7:36:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| B.cpp:46:7:46:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| C.cpp:22:12:22:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| C.cpp:22:12:22:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| C.cpp:24:5:24:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| C.cpp:24:16:24:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:9:21:9:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:11:29:11:36 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:16:21:16:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:18:29:18:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:28:15:28:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:35:15:35:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:42:15:42:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:49:15:49:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:56:15:56:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| D.cpp:57:5:57:42 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:9:3:9:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:13:3:13:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:17:3:17:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:21:12:21:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:21:15:21:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:22:12:22:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:22:15:22:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:23:12:23:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:23:15:23:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:35:12:35:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:35:15:35:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:37:3:37:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:40:12:40:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:40:15:40:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:42:3:42:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:47:12:47:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:47:15:47:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:49:3:49:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:52:12:52:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:52:15:52:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:54:3:54:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:59:12:59:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:59:15:59:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:60:3:60:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:70:19:70:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:70:22:70:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:72:3:72:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:77:19:77:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:77:22:77:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:79:3:79:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:84:19:84:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:84:22:84:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:86:3:86:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:91:19:91:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:91:22:91:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:92:3:92:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:98:3:98:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:106:3:106:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:111:15:111:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:147:15:147:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:175:15:175:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:181:15:181:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:187:15:187:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:194:15:194:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:200:15:200:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:205:15:205:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:5:18:5:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:5:21:5:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:6:3:6:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:14:18:14:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:14:21:14:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:15:3:15:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| arrays.cpp:36:3:36:37 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:12:5:12:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:16:5:16:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:84:3:84:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:88:3:88:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:92:3:92:20 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:96:3:96:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:102:21:102:39 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:104:15:104:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:106:21:106:41 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:108:15:108:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:122:21:122:38 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:124:15:124:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:126:21:126:40 | Chi | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:128:15:128:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:11:22:11:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:12:22:12:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:14:26:14:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:14:33:14:33 | Chi | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:20:24:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:21:24:21:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:23:28:23:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| constructors.cpp:23:35:23:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:9:30:9:44 | Chi | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:12:49:12:64 | Chi | PostUpdateNode should not be the target of local flow. |
+| qualifiers.cpp:13:51:13:65 | Chi | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:39:12:39:95 | Chi | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:49:9:49:64 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:20:24:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:21:24:21:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:23:28:23:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:23:35:23:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:65:5:65:22 | Store | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:83:9:83:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:92:5:92:22 | Store | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:20:20:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:20:34:20:34 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:27:7:27:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:27:21:27:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:28:5:28:7 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:36:10:36:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:40:20:40:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:40:34:40:34 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:42:7:42:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:42:21:42:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| struct_init.c:43:5:43:7 | Chi | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/fields/flow-diff.expected

@@ -34,10 +34,6 @@
 | by_reference.cpp:84:14:84:23 | call to user_input | by_reference.cpp:115:27:115:27 | a | AST only |
 | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:131:25:131:25 | a | AST only |
 | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:135:27:135:27 | a | AST only |
-| complex.cpp:62:19:62:28 | call to user_input | complex.cpp:52:18:52:18 | call to b | AST only |
-| complex.cpp:63:19:63:28 | call to user_input | complex.cpp:51:18:51:18 | call to a | AST only |
-| complex.cpp:64:19:64:28 | call to user_input | complex.cpp:52:18:52:18 | call to b | AST only |
-| complex.cpp:65:19:65:28 | call to user_input | complex.cpp:51:18:51:18 | call to a | AST only |
 | qualifiers.cpp:22:27:22:36 | call to user_input | qualifiers.cpp:23:23:23:23 | a | AST only |
 | qualifiers.cpp:27:28:27:37 | call to user_input | qualifiers.cpp:28:23:28:23 | a | AST only |
 | qualifiers.cpp:32:35:32:44 | call to user_input | qualifiers.cpp:33:23:33:23 | a | AST only |

cpp/ql/test/library-tests/dataflow/fields/ir-flow.expected

@@ -1,4 +0,0 @@
-| complex.cpp:51:24:51:121 | // $ast=62:19 $f+:ast=63:19 $ast=64:19 $f+:ast=65:19 $ir=62:19 $f+:ir=63:19 $ir=64:19 $f+:ir=65:19 | Fixed false positive:ir=63:19 |
-| complex.cpp:51:24:51:121 | // $ast=62:19 $f+:ast=63:19 $ast=64:19 $f+:ast=65:19 $ir=62:19 $f+:ir=63:19 $ir=64:19 $f+:ir=65:19 | Fixed false positive:ir=65:19 |
-| complex.cpp:52:24:52:121 | // $f+:ast=62:19 $ast=63:19 $f+:ast=64:19 $ast=65:19 $f+:ir=62:19 $ir=63:19 $f+:ir=64:19 $ir=65:19 | Fixed false positive:ir=62:19 |
-| complex.cpp:52:24:52:121 | // $f+:ast=62:19 $ast=63:19 $f+:ast=64:19 $ast=65:19 $f+:ir=62:19 $ir=63:19 $f+:ir=64:19 $ir=65:19 | Fixed false positive:ir=64:19 |

cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected

@@ -140,20 +140,20 @@ edges
 | by_reference.cpp:128:15:128:23 | Chi | by_reference.cpp:128:15:128:23 | Chi [a] |
 | by_reference.cpp:128:15:128:23 | Chi [a] | by_reference.cpp:136:16:136:16 | a |
 | by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] | by_reference.cpp:128:15:128:23 | Chi |
-| complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:51:18:51:18 | call to a |
-| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:51:16:51:16 | a output argument [b_] |
-| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:52:18:52:18 | call to b |
-| complex.cpp:51:16:51:16 | a output argument [b_] | complex.cpp:52:18:52:18 | call to b |
-| complex.cpp:62:12:62:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:62:19:62:28 | call to user_input | complex.cpp:62:12:62:12 | setA output argument [a_] |
-| complex.cpp:63:12:63:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
-| complex.cpp:63:19:63:28 | call to user_input | complex.cpp:63:12:63:12 | setB output argument [b_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | complex.cpp:65:12:65:12 | setB output argument [a_] |
-| complex.cpp:64:19:64:28 | call to user_input | complex.cpp:64:12:64:12 | setA output argument [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
-| complex.cpp:65:19:65:28 | call to user_input | complex.cpp:65:12:65:12 | setB output argument [b_] |
+| complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:42:18:42:18 | call to a |
+| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:42:16:42:16 | a output argument [b_] |
+| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:43:18:43:18 | call to b |
+| complex.cpp:42:16:42:16 | a output argument [b_] | complex.cpp:43:18:43:18 | call to b |
+| complex.cpp:53:12:53:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:53:19:53:28 | call to user_input | complex.cpp:53:12:53:12 | setA output argument [a_] |
+| complex.cpp:54:12:54:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
+| complex.cpp:54:19:54:28 | call to user_input | complex.cpp:54:12:54:12 | setB output argument [b_] |
+| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:56:12:56:12 | setB output argument [a_] |
+| complex.cpp:55:19:55:28 | call to user_input | complex.cpp:55:12:55:12 | setA output argument [a_] |
+| complex.cpp:56:12:56:12 | setB output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:56:12:56:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
+| complex.cpp:56:19:56:28 | call to user_input | complex.cpp:56:12:56:12 | setB output argument [b_] |
 | constructors.cpp:26:15:26:15 | *f [a_] | constructors.cpp:28:12:28:12 | call to a |
 | constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:28:10:28:10 | a output argument [b_] |
 | constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:29:12:29:12 | call to b |
@@ -371,18 +371,18 @@ nodes
 | by_reference.cpp:136:16:136:16 | a | semmle.label | a |
 | complex.cpp:40:17:40:17 | *b [a_] | semmle.label | *b [a_] |
 | complex.cpp:40:17:40:17 | *b [b_] | semmle.label | *b [b_] |
-| complex.cpp:51:16:51:16 | a output argument [b_] | semmle.label | a output argument [b_] |
-| complex.cpp:51:18:51:18 | call to a | semmle.label | call to a |
-| complex.cpp:52:18:52:18 | call to b | semmle.label | call to b |
-| complex.cpp:62:12:62:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
-| complex.cpp:62:19:62:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:63:12:63:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
-| complex.cpp:63:19:63:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:64:12:64:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
-| complex.cpp:64:19:64:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:65:12:65:12 | setB output argument [a_] | semmle.label | setB output argument [a_] |
-| complex.cpp:65:12:65:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
-| complex.cpp:65:19:65:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:42:16:42:16 | a output argument [b_] | semmle.label | a output argument [b_] |
+| complex.cpp:42:18:42:18 | call to a | semmle.label | call to a |
+| complex.cpp:43:18:43:18 | call to b | semmle.label | call to b |
+| complex.cpp:53:12:53:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
+| complex.cpp:53:19:53:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:54:12:54:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
+| complex.cpp:54:19:54:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:55:12:55:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
+| complex.cpp:55:19:55:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:56:12:56:12 | setB output argument [a_] | semmle.label | setB output argument [a_] |
+| complex.cpp:56:12:56:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
+| complex.cpp:56:19:56:28 | call to user_input | semmle.label | call to user_input |
 | constructors.cpp:26:15:26:15 | *f [a_] | semmle.label | *f [a_] |
 | constructors.cpp:26:15:26:15 | *f [b_] | semmle.label | *f [b_] |
 | constructors.cpp:28:10:28:10 | a output argument [b_] | semmle.label | a output argument [b_] |
@@ -478,10 +478,10 @@ nodes
 | by_reference.cpp:132:14:132:14 | a | by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:132:14:132:14 | a | a flows from $@ | by_reference.cpp:96:8:96:17 | call to user_input | call to user_input |
 | by_reference.cpp:134:29:134:29 | a | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:134:29:134:29 | a | a flows from $@ | by_reference.cpp:88:13:88:22 | call to user_input | call to user_input |
 | by_reference.cpp:136:16:136:16 | a | by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:136:16:136:16 | a | a flows from $@ | by_reference.cpp:96:8:96:17 | call to user_input | call to user_input |
-| complex.cpp:51:18:51:18 | call to a | complex.cpp:62:19:62:28 | call to user_input | complex.cpp:51:18:51:18 | call to a | call to a flows from $@ | complex.cpp:62:19:62:28 | call to user_input | call to user_input |
-| complex.cpp:51:18:51:18 | call to a | complex.cpp:64:19:64:28 | call to user_input | complex.cpp:51:18:51:18 | call to a | call to a flows from $@ | complex.cpp:64:19:64:28 | call to user_input | call to user_input |
-| complex.cpp:52:18:52:18 | call to b | complex.cpp:63:19:63:28 | call to user_input | complex.cpp:52:18:52:18 | call to b | call to b flows from $@ | complex.cpp:63:19:63:28 | call to user_input | call to user_input |
-| complex.cpp:52:18:52:18 | call to b | complex.cpp:65:19:65:28 | call to user_input | complex.cpp:52:18:52:18 | call to b | call to b flows from $@ | complex.cpp:65:19:65:28 | call to user_input | call to user_input |
+| complex.cpp:42:18:42:18 | call to a | complex.cpp:53:19:53:28 | call to user_input | complex.cpp:42:18:42:18 | call to a | call to a flows from $@ | complex.cpp:53:19:53:28 | call to user_input | call to user_input |
+| complex.cpp:42:18:42:18 | call to a | complex.cpp:55:19:55:28 | call to user_input | complex.cpp:42:18:42:18 | call to a | call to a flows from $@ | complex.cpp:55:19:55:28 | call to user_input | call to user_input |
+| complex.cpp:43:18:43:18 | call to b | complex.cpp:54:19:54:28 | call to user_input | complex.cpp:43:18:43:18 | call to b | call to b flows from $@ | complex.cpp:54:19:54:28 | call to user_input | call to user_input |
+| complex.cpp:43:18:43:18 | call to b | complex.cpp:56:19:56:28 | call to user_input | complex.cpp:43:18:43:18 | call to b | call to b flows from $@ | complex.cpp:56:19:56:28 | call to user_input | call to user_input |
 | constructors.cpp:28:12:28:12 | call to a | constructors.cpp:34:11:34:20 | call to user_input | constructors.cpp:28:12:28:12 | call to a | call to a flows from $@ | constructors.cpp:34:11:34:20 | call to user_input | call to user_input |
 | constructors.cpp:28:12:28:12 | call to a | constructors.cpp:36:11:36:20 | call to user_input | constructors.cpp:28:12:28:12 | call to a | call to a flows from $@ | constructors.cpp:36:11:36:20 | call to user_input | call to user_input |
 | constructors.cpp:29:12:29:12 | call to b | constructors.cpp:35:14:35:23 | call to user_input | constructors.cpp:29:12:29:12 | call to b | call to b flows from $@ | constructors.cpp:35:14:35:23 | call to user_input | call to user_input |

cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected

@@ -293,28 +293,28 @@
 | by_reference.cpp:136:16:136:16 | a | AST only |
 | complex.cpp:11:22:11:23 | a_ | AST only |
 | complex.cpp:12:22:12:23 | b_ | AST only |
-| complex.cpp:51:8:51:8 | b | AST only |
-| complex.cpp:51:10:51:14 | inner | AST only |
-| complex.cpp:51:16:51:16 | f | AST only |
-| complex.cpp:52:8:52:8 | b | AST only |
-| complex.cpp:52:10:52:14 | inner | AST only |
-| complex.cpp:52:16:52:16 | f | AST only |
-| complex.cpp:62:3:62:4 | b1 | AST only |
-| complex.cpp:62:6:62:10 | inner | AST only |
-| complex.cpp:62:12:62:12 | f | AST only |
-| complex.cpp:63:3:63:4 | b2 | AST only |
-| complex.cpp:63:6:63:10 | inner | AST only |
-| complex.cpp:63:12:63:12 | f | AST only |
-| complex.cpp:64:3:64:4 | b3 | AST only |
-| complex.cpp:64:6:64:10 | inner | AST only |
-| complex.cpp:64:12:64:12 | f | AST only |
-| complex.cpp:65:3:65:4 | b3 | AST only |
-| complex.cpp:65:6:65:10 | inner | AST only |
-| complex.cpp:65:12:65:12 | f | AST only |
-| complex.cpp:68:7:68:8 | b1 | AST only |
-| complex.cpp:71:7:71:8 | b2 | AST only |
-| complex.cpp:74:7:74:8 | b3 | AST only |
-| complex.cpp:77:7:77:8 | b4 | AST only |
+| complex.cpp:42:8:42:8 | b | AST only |
+| complex.cpp:42:10:42:14 | inner | AST only |
+| complex.cpp:42:16:42:16 | f | AST only |
+| complex.cpp:43:8:43:8 | b | AST only |
+| complex.cpp:43:10:43:14 | inner | AST only |
+| complex.cpp:43:16:43:16 | f | AST only |
+| complex.cpp:53:3:53:4 | b1 | AST only |
+| complex.cpp:53:6:53:10 | inner | AST only |
+| complex.cpp:53:12:53:12 | f | AST only |
+| complex.cpp:54:3:54:4 | b2 | AST only |
+| complex.cpp:54:6:54:10 | inner | AST only |
+| complex.cpp:54:12:54:12 | f | AST only |
+| complex.cpp:55:3:55:4 | b3 | AST only |
+| complex.cpp:55:6:55:10 | inner | AST only |
+| complex.cpp:55:12:55:12 | f | AST only |
+| complex.cpp:56:3:56:4 | b3 | AST only |
+| complex.cpp:56:6:56:10 | inner | AST only |
+| complex.cpp:56:12:56:12 | f | AST only |
+| complex.cpp:59:7:59:8 | b1 | AST only |
+| complex.cpp:62:7:62:8 | b2 | AST only |
+| complex.cpp:65:7:65:8 | b3 | AST only |
+| complex.cpp:68:7:68:8 | b4 | AST only |
 | constructors.cpp:20:24:20:25 | a_ | AST only |
 | constructors.cpp:21:24:21:25 | b_ | AST only |
 | constructors.cpp:28:10:28:10 | f | AST only |

cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected

@@ -344,28 +344,28 @@
 | complex.cpp:11:22:11:23 | this |
 | complex.cpp:12:22:12:23 | b_ |
 | complex.cpp:12:22:12:23 | this |
-| complex.cpp:51:8:51:8 | b |
-| complex.cpp:51:10:51:14 | inner |
-| complex.cpp:51:16:51:16 | f |
-| complex.cpp:52:8:52:8 | b |
-| complex.cpp:52:10:52:14 | inner |
-| complex.cpp:52:16:52:16 | f |
-| complex.cpp:62:3:62:4 | b1 |
-| complex.cpp:62:6:62:10 | inner |
-| complex.cpp:62:12:62:12 | f |
-| complex.cpp:63:3:63:4 | b2 |
-| complex.cpp:63:6:63:10 | inner |
-| complex.cpp:63:12:63:12 | f |
-| complex.cpp:64:3:64:4 | b3 |
-| complex.cpp:64:6:64:10 | inner |
-| complex.cpp:64:12:64:12 | f |
-| complex.cpp:65:3:65:4 | b3 |
-| complex.cpp:65:6:65:10 | inner |
-| complex.cpp:65:12:65:12 | f |
-| complex.cpp:68:7:68:8 | b1 |
-| complex.cpp:71:7:71:8 | b2 |
-| complex.cpp:74:7:74:8 | b3 |
-| complex.cpp:77:7:77:8 | b4 |
+| complex.cpp:42:8:42:8 | b |
+| complex.cpp:42:10:42:14 | inner |
+| complex.cpp:42:16:42:16 | f |
+| complex.cpp:43:8:43:8 | b |
+| complex.cpp:43:10:43:14 | inner |
+| complex.cpp:43:16:43:16 | f |
+| complex.cpp:53:3:53:4 | b1 |
+| complex.cpp:53:6:53:10 | inner |
+| complex.cpp:53:12:53:12 | f |
+| complex.cpp:54:3:54:4 | b2 |
+| complex.cpp:54:6:54:10 | inner |
+| complex.cpp:54:12:54:12 | f |
+| complex.cpp:55:3:55:4 | b3 |
+| complex.cpp:55:6:55:10 | inner |
+| complex.cpp:55:12:55:12 | f |
+| complex.cpp:56:3:56:4 | b3 |
+| complex.cpp:56:6:56:10 | inner |
+| complex.cpp:56:12:56:12 | f |
+| complex.cpp:59:7:59:8 | b1 |
+| complex.cpp:62:7:62:8 | b2 |
+| complex.cpp:65:7:65:8 | b3 |
+| complex.cpp:68:7:68:8 | b4 |
 | constructors.cpp:20:24:20:25 | a_ |
 | constructors.cpp:20:24:20:25 | this |
 | constructors.cpp:21:24:21:25 | b_ |

cpp/ql/test/library-tests/dataflow/fields/path-flow.expected

@@ -51,14 +51,14 @@ edges
 | A.cpp:160:29:160:29 | b | A.cpp:160:18:160:60 | call to MyList [head] |
 | A.cpp:161:18:161:40 | call to MyList [next, head] | A.cpp:162:38:162:39 | l2 [next, head] |
 | A.cpp:161:38:161:39 | l1 [head] | A.cpp:161:18:161:40 | call to MyList [next, head] |
-| A.cpp:162:18:162:40 | call to MyList [next, next, ... (3)] | A.cpp:165:10:165:11 | l3 [next, next, ... (3)] |
-| A.cpp:162:18:162:40 | call to MyList [next, next, ... (3)] | A.cpp:167:44:167:44 | l [next, next, ... (3)] |
-| A.cpp:162:38:162:39 | l2 [next, head] | A.cpp:162:18:162:40 | call to MyList [next, next, ... (3)] |
-| A.cpp:165:10:165:11 | l3 [next, next, ... (3)] | A.cpp:165:14:165:17 | next [next, head] |
+| A.cpp:162:18:162:40 | call to MyList [next, next, head] | A.cpp:165:10:165:11 | l3 [next, next, head] |
+| A.cpp:162:18:162:40 | call to MyList [next, next, head] | A.cpp:167:44:167:44 | l [next, next, head] |
+| A.cpp:162:38:162:39 | l2 [next, head] | A.cpp:162:18:162:40 | call to MyList [next, next, head] |
+| A.cpp:165:10:165:11 | l3 [next, next, head] | A.cpp:165:14:165:17 | next [next, head] |
 | A.cpp:165:14:165:17 | next [next, head] | A.cpp:165:20:165:23 | next [head] |
 | A.cpp:165:20:165:23 | next [head] | A.cpp:165:26:165:29 | head |
 | A.cpp:167:44:167:44 | l [next, head] | A.cpp:167:47:167:50 | next [head] |
-| A.cpp:167:44:167:44 | l [next, next, ... (3)] | A.cpp:167:47:167:50 | next [next, head] |
+| A.cpp:167:44:167:44 | l [next, next, head] | A.cpp:167:47:167:50 | next [next, head] |
 | A.cpp:167:47:167:50 | next [head] | A.cpp:169:12:169:12 | l [head] |
 | A.cpp:167:47:167:50 | next [next, head] | A.cpp:167:44:167:44 | l [next, head] |
 | A.cpp:169:12:169:12 | l [head] | A.cpp:169:15:169:18 | head |
@@ -113,14 +113,14 @@ edges
 | D.cpp:51:27:51:27 | e | D.cpp:51:8:51:14 | ref arg call to getBox1 [elem] |
 | D.cpp:52:14:52:14 | b [box, elem] | D.cpp:21:30:21:31 | b2 [box, elem] |
 | D.cpp:56:15:56:24 | new | D.cpp:58:5:58:27 | ... = ... |
-| D.cpp:58:5:58:12 | boxfield [post update] [box, elem] | D.cpp:58:5:58:12 | this [post update] [boxfield, box, ... (3)] |
-| D.cpp:58:5:58:12 | this [post update] [boxfield, box, ... (3)] | D.cpp:59:5:59:7 | this [boxfield, box, ... (3)] |
+| D.cpp:58:5:58:12 | boxfield [post update] [box, elem] | D.cpp:58:5:58:12 | this [post update] [boxfield, box, elem] |
+| D.cpp:58:5:58:12 | this [post update] [boxfield, box, elem] | D.cpp:59:5:59:7 | this [boxfield, box, elem] |
 | D.cpp:58:5:58:27 | ... = ... | D.cpp:58:15:58:17 | box [post update] [elem] |
 | D.cpp:58:15:58:17 | box [post update] [elem] | D.cpp:58:5:58:12 | boxfield [post update] [box, elem] |
-| D.cpp:59:5:59:7 | this [boxfield, box, ... (3)] | D.cpp:63:8:63:10 | this [boxfield, box, ... (3)] |
-| D.cpp:63:8:63:10 | this [boxfield, box, ... (3)] | D.cpp:64:10:64:17 | this [boxfield, box, ... (3)] |
+| D.cpp:59:5:59:7 | this [boxfield, box, elem] | D.cpp:63:8:63:10 | this [boxfield, box, elem] |
+| D.cpp:63:8:63:10 | this [boxfield, box, elem] | D.cpp:64:10:64:17 | this [boxfield, box, elem] |
 | D.cpp:64:10:64:17 | boxfield [box, elem] | D.cpp:64:20:64:22 | box [elem] |
-| D.cpp:64:10:64:17 | this [boxfield, box, ... (3)] | D.cpp:64:10:64:17 | boxfield [box, elem] |
+| D.cpp:64:10:64:17 | this [boxfield, box, elem] | D.cpp:64:10:64:17 | boxfield [box, elem] |
 | D.cpp:64:20:64:22 | box [elem] | D.cpp:64:25:64:28 | elem |
 | E.cpp:19:27:19:27 | p [data, buffer] | E.cpp:21:10:21:10 | p [data, buffer] |
 | E.cpp:21:10:21:10 | p [data, buffer] | E.cpp:21:13:21:16 | data [buffer] |
@@ -193,33 +193,33 @@ edges
 | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:10:8:10:15 | * ... |
 | arrays.cpp:15:14:15:23 | call to user_input | arrays.cpp:16:8:16:13 | access to array |
 | arrays.cpp:15:14:15:23 | call to user_input | arrays.cpp:17:8:17:13 | access to array |
-| arrays.cpp:36:3:36:3 | o [post update] [nested, arr, ... (3)] | arrays.cpp:37:8:37:8 | o [nested, arr, ... (3)] |
-| arrays.cpp:36:3:36:3 | o [post update] [nested, arr, ... (3)] | arrays.cpp:38:8:38:8 | o [nested, arr, ... (3)] |
+| arrays.cpp:36:3:36:3 | o [post update] [nested, arr, data] | arrays.cpp:37:8:37:8 | o [nested, arr, data] |
+| arrays.cpp:36:3:36:3 | o [post update] [nested, arr, data] | arrays.cpp:38:8:38:8 | o [nested, arr, data] |
 | arrays.cpp:36:3:36:17 | access to array [post update] [data] | arrays.cpp:36:12:36:14 | arr [inner post update] [data] |
 | arrays.cpp:36:3:36:37 | ... = ... | arrays.cpp:36:3:36:17 | access to array [post update] [data] |
-| arrays.cpp:36:5:36:10 | nested [post update] [arr, data] | arrays.cpp:36:3:36:3 | o [post update] [nested, arr, ... (3)] |
+| arrays.cpp:36:5:36:10 | nested [post update] [arr, data] | arrays.cpp:36:3:36:3 | o [post update] [nested, arr, data] |
 | arrays.cpp:36:12:36:14 | arr [inner post update] [data] | arrays.cpp:36:5:36:10 | nested [post update] [arr, data] |
 | arrays.cpp:36:26:36:35 | call to user_input | arrays.cpp:36:3:36:37 | ... = ... |
-| arrays.cpp:37:8:37:8 | o [nested, arr, ... (3)] | arrays.cpp:37:10:37:15 | nested [arr, data] |
+| arrays.cpp:37:8:37:8 | o [nested, arr, data] | arrays.cpp:37:10:37:15 | nested [arr, data] |
 | arrays.cpp:37:8:37:22 | access to array [data] | arrays.cpp:37:24:37:27 | data |
 | arrays.cpp:37:10:37:15 | nested [arr, data] | arrays.cpp:37:17:37:19 | arr [data] |
 | arrays.cpp:37:17:37:19 | arr [data] | arrays.cpp:37:8:37:22 | access to array [data] |
-| arrays.cpp:38:8:38:8 | o [nested, arr, ... (3)] | arrays.cpp:38:10:38:15 | nested [arr, data] |
+| arrays.cpp:38:8:38:8 | o [nested, arr, data] | arrays.cpp:38:10:38:15 | nested [arr, data] |
 | arrays.cpp:38:8:38:22 | access to array [data] | arrays.cpp:38:24:38:27 | data |
 | arrays.cpp:38:10:38:15 | nested [arr, data] | arrays.cpp:38:17:38:19 | arr [data] |
 | arrays.cpp:38:17:38:19 | arr [data] | arrays.cpp:38:8:38:22 | access to array [data] |
-| arrays.cpp:42:3:42:3 | o [post update] [indirect, arr, ... (3)] | arrays.cpp:43:8:43:8 | o [indirect, arr, ... (3)] |
-| arrays.cpp:42:3:42:3 | o [post update] [indirect, arr, ... (3)] | arrays.cpp:44:8:44:8 | o [indirect, arr, ... (3)] |
+| arrays.cpp:42:3:42:3 | o [post update] [indirect, arr, data] | arrays.cpp:43:8:43:8 | o [indirect, arr, data] |
+| arrays.cpp:42:3:42:3 | o [post update] [indirect, arr, data] | arrays.cpp:44:8:44:8 | o [indirect, arr, data] |
 | arrays.cpp:42:3:42:20 | access to array [post update] [data] | arrays.cpp:42:15:42:17 | arr [inner post update] [data] |
 | arrays.cpp:42:3:42:40 | ... = ... | arrays.cpp:42:3:42:20 | access to array [post update] [data] |
-| arrays.cpp:42:5:42:12 | indirect [post update] [arr, data] | arrays.cpp:42:3:42:3 | o [post update] [indirect, arr, ... (3)] |
+| arrays.cpp:42:5:42:12 | indirect [post update] [arr, data] | arrays.cpp:42:3:42:3 | o [post update] [indirect, arr, data] |
 | arrays.cpp:42:15:42:17 | arr [inner post update] [data] | arrays.cpp:42:5:42:12 | indirect [post update] [arr, data] |
 | arrays.cpp:42:29:42:38 | call to user_input | arrays.cpp:42:3:42:40 | ... = ... |
-| arrays.cpp:43:8:43:8 | o [indirect, arr, ... (3)] | arrays.cpp:43:10:43:17 | indirect [arr, data] |
+| arrays.cpp:43:8:43:8 | o [indirect, arr, data] | arrays.cpp:43:10:43:17 | indirect [arr, data] |
 | arrays.cpp:43:8:43:25 | access to array [data] | arrays.cpp:43:27:43:30 | data |
 | arrays.cpp:43:10:43:17 | indirect [arr, data] | arrays.cpp:43:20:43:22 | arr [data] |
 | arrays.cpp:43:20:43:22 | arr [data] | arrays.cpp:43:8:43:25 | access to array [data] |
-| arrays.cpp:44:8:44:8 | o [indirect, arr, ... (3)] | arrays.cpp:44:10:44:17 | indirect [arr, data] |
+| arrays.cpp:44:8:44:8 | o [indirect, arr, data] | arrays.cpp:44:10:44:17 | indirect [arr, data] |
 | arrays.cpp:44:8:44:25 | access to array [data] | arrays.cpp:44:27:44:30 | data |
 | arrays.cpp:44:10:44:17 | indirect [arr, data] | arrays.cpp:44:20:44:22 | arr [data] |
 | arrays.cpp:44:20:44:22 | arr [data] | arrays.cpp:44:8:44:25 | access to array [data] |
@@ -308,33 +308,34 @@ edges
 | by_reference.cpp:135:8:135:13 | pouter [inner_ptr, a] | by_reference.cpp:135:16:135:24 | inner_ptr [a] |
 | by_reference.cpp:135:16:135:24 | inner_ptr [a] | by_reference.cpp:135:27:135:27 | a |
 | by_reference.cpp:136:8:136:13 | pouter [a] | by_reference.cpp:136:16:136:16 | a |
-| complex.cpp:40:17:40:17 | b [inner, f, ... (3)] | complex.cpp:51:8:51:8 | b [inner, f, ... (3)] |
-| complex.cpp:40:17:40:17 | b [inner, f, ... (3)] | complex.cpp:52:8:52:8 | b [inner, f, ... (3)] |
-| complex.cpp:51:8:51:8 | b [inner, f, ... (3)] | complex.cpp:51:10:51:14 | inner [f, a_] |
-| complex.cpp:51:10:51:14 | inner [f, a_] | complex.cpp:51:16:51:16 | f [a_] |
-| complex.cpp:51:16:51:16 | f [a_] | complex.cpp:51:18:51:18 | call to a |
-| complex.cpp:52:8:52:8 | b [inner, f, ... (3)] | complex.cpp:52:10:52:14 | inner [f, b_] |
-| complex.cpp:52:10:52:14 | inner [f, b_] | complex.cpp:52:16:52:16 | f [b_] |
-| complex.cpp:52:16:52:16 | f [b_] | complex.cpp:52:18:52:18 | call to b |
-| complex.cpp:62:3:62:4 | b1 [post update] [inner, f, ... (3)] | complex.cpp:68:7:68:8 | b1 [inner, f, ... (3)] |
-| complex.cpp:62:6:62:10 | inner [post update] [f, a_] | complex.cpp:62:3:62:4 | b1 [post update] [inner, f, ... (3)] |
-| complex.cpp:62:12:62:12 | ref arg f [a_] | complex.cpp:62:6:62:10 | inner [post update] [f, a_] |
-| complex.cpp:62:19:62:28 | call to user_input | complex.cpp:62:12:62:12 | ref arg f [a_] |
-| complex.cpp:63:3:63:4 | b2 [post update] [inner, f, ... (3)] | complex.cpp:71:7:71:8 | b2 [inner, f, ... (3)] |
-| complex.cpp:63:6:63:10 | inner [post update] [f, b_] | complex.cpp:63:3:63:4 | b2 [post update] [inner, f, ... (3)] |
-| complex.cpp:63:12:63:12 | ref arg f [b_] | complex.cpp:63:6:63:10 | inner [post update] [f, b_] |
-| complex.cpp:63:19:63:28 | call to user_input | complex.cpp:63:12:63:12 | ref arg f [b_] |
-| complex.cpp:64:3:64:4 | b3 [post update] [inner, f, ... (3)] | complex.cpp:74:7:74:8 | b3 [inner, f, ... (3)] |
-| complex.cpp:64:6:64:10 | inner [post update] [f, a_] | complex.cpp:64:3:64:4 | b3 [post update] [inner, f, ... (3)] |
-| complex.cpp:64:12:64:12 | ref arg f [a_] | complex.cpp:64:6:64:10 | inner [post update] [f, a_] |
-| complex.cpp:64:19:64:28 | call to user_input | complex.cpp:64:12:64:12 | ref arg f [a_] |
-| complex.cpp:65:3:65:4 | b3 [post update] [inner, f, ... (3)] | complex.cpp:74:7:74:8 | b3 [inner, f, ... (3)] |
-| complex.cpp:65:6:65:10 | inner [post update] [f, b_] | complex.cpp:65:3:65:4 | b3 [post update] [inner, f, ... (3)] |
-| complex.cpp:65:12:65:12 | ref arg f [b_] | complex.cpp:65:6:65:10 | inner [post update] [f, b_] |
-| complex.cpp:65:19:65:28 | call to user_input | complex.cpp:65:12:65:12 | ref arg f [b_] |
-| complex.cpp:68:7:68:8 | b1 [inner, f, ... (3)] | complex.cpp:40:17:40:17 | b [inner, f, ... (3)] |
-| complex.cpp:71:7:71:8 | b2 [inner, f, ... (3)] | complex.cpp:40:17:40:17 | b [inner, f, ... (3)] |
-| complex.cpp:74:7:74:8 | b3 [inner, f, ... (3)] | complex.cpp:40:17:40:17 | b [inner, f, ... (3)] |
+| complex.cpp:40:17:40:17 | b [inner, f, a_] | complex.cpp:42:8:42:8 | b [inner, f, a_] |
+| complex.cpp:40:17:40:17 | b [inner, f, b_] | complex.cpp:43:8:43:8 | b [inner, f, b_] |
+| complex.cpp:42:8:42:8 | b [inner, f, a_] | complex.cpp:42:10:42:14 | inner [f, a_] |
+| complex.cpp:42:10:42:14 | inner [f, a_] | complex.cpp:42:16:42:16 | f [a_] |
+| complex.cpp:42:16:42:16 | f [a_] | complex.cpp:42:18:42:18 | call to a |
+| complex.cpp:43:8:43:8 | b [inner, f, b_] | complex.cpp:43:10:43:14 | inner [f, b_] |
+| complex.cpp:43:10:43:14 | inner [f, b_] | complex.cpp:43:16:43:16 | f [b_] |
+| complex.cpp:43:16:43:16 | f [b_] | complex.cpp:43:18:43:18 | call to b |
+| complex.cpp:53:3:53:4 | b1 [post update] [inner, f, a_] | complex.cpp:59:7:59:8 | b1 [inner, f, a_] |
+| complex.cpp:53:6:53:10 | inner [post update] [f, a_] | complex.cpp:53:3:53:4 | b1 [post update] [inner, f, a_] |
+| complex.cpp:53:12:53:12 | ref arg f [a_] | complex.cpp:53:6:53:10 | inner [post update] [f, a_] |
+| complex.cpp:53:19:53:28 | call to user_input | complex.cpp:53:12:53:12 | ref arg f [a_] |
+| complex.cpp:54:3:54:4 | b2 [post update] [inner, f, b_] | complex.cpp:62:7:62:8 | b2 [inner, f, b_] |
+| complex.cpp:54:6:54:10 | inner [post update] [f, b_] | complex.cpp:54:3:54:4 | b2 [post update] [inner, f, b_] |
+| complex.cpp:54:12:54:12 | ref arg f [b_] | complex.cpp:54:6:54:10 | inner [post update] [f, b_] |
+| complex.cpp:54:19:54:28 | call to user_input | complex.cpp:54:12:54:12 | ref arg f [b_] |
+| complex.cpp:55:3:55:4 | b3 [post update] [inner, f, a_] | complex.cpp:65:7:65:8 | b3 [inner, f, a_] |
+| complex.cpp:55:6:55:10 | inner [post update] [f, a_] | complex.cpp:55:3:55:4 | b3 [post update] [inner, f, a_] |
+| complex.cpp:55:12:55:12 | ref arg f [a_] | complex.cpp:55:6:55:10 | inner [post update] [f, a_] |
+| complex.cpp:55:19:55:28 | call to user_input | complex.cpp:55:12:55:12 | ref arg f [a_] |
+| complex.cpp:56:3:56:4 | b3 [post update] [inner, f, b_] | complex.cpp:65:7:65:8 | b3 [inner, f, b_] |
+| complex.cpp:56:6:56:10 | inner [post update] [f, b_] | complex.cpp:56:3:56:4 | b3 [post update] [inner, f, b_] |
+| complex.cpp:56:12:56:12 | ref arg f [b_] | complex.cpp:56:6:56:10 | inner [post update] [f, b_] |
+| complex.cpp:56:19:56:28 | call to user_input | complex.cpp:56:12:56:12 | ref arg f [b_] |
+| complex.cpp:59:7:59:8 | b1 [inner, f, a_] | complex.cpp:40:17:40:17 | b [inner, f, a_] |
+| complex.cpp:62:7:62:8 | b2 [inner, f, b_] | complex.cpp:40:17:40:17 | b [inner, f, b_] |
+| complex.cpp:65:7:65:8 | b3 [inner, f, a_] | complex.cpp:40:17:40:17 | b [inner, f, a_] |
+| complex.cpp:65:7:65:8 | b3 [inner, f, b_] | complex.cpp:40:17:40:17 | b [inner, f, b_] |
 | constructors.cpp:26:15:26:15 | f [a_] | constructors.cpp:28:10:28:10 | f [a_] |
 | constructors.cpp:26:15:26:15 | f [b_] | constructors.cpp:29:10:29:10 | f [b_] |
 | constructors.cpp:28:10:28:10 | f [a_] | constructors.cpp:28:12:28:12 | call to a |
@@ -386,16 +387,16 @@ edges
 | qualifiers.cpp:47:31:47:40 | call to user_input | qualifiers.cpp:47:5:47:42 | ... = ... |
 | qualifiers.cpp:48:10:48:14 | outer [inner, a] | qualifiers.cpp:48:16:48:20 | inner [a] |
 | qualifiers.cpp:48:16:48:20 | inner [a] | qualifiers.cpp:48:23:48:23 | a |
-| realistic.cpp:53:9:53:11 | foo [post update] [bar, baz, ... (4)] | realistic.cpp:61:21:61:23 | foo [bar, baz, ... (4)] |
-| realistic.cpp:53:9:53:18 | access to array [post update] [baz, userInput, ... (3)] | realistic.cpp:53:13:53:15 | bar [inner post update] [baz, userInput, ... (3)] |
+| realistic.cpp:53:9:53:11 | foo [post update] [bar, baz, userInput, bufferLen] | realistic.cpp:61:21:61:23 | foo [bar, baz, userInput, bufferLen] |
+| realistic.cpp:53:9:53:18 | access to array [post update] [baz, userInput, bufferLen] | realistic.cpp:53:13:53:15 | bar [inner post update] [baz, userInput, bufferLen] |
 | realistic.cpp:53:9:53:66 | ... = ... | realistic.cpp:53:25:53:33 | userInput [post update] [bufferLen] |
-| realistic.cpp:53:13:53:15 | bar [inner post update] [baz, userInput, ... (3)] | realistic.cpp:53:9:53:11 | foo [post update] [bar, baz, ... (4)] |
-| realistic.cpp:53:20:53:22 | baz [post update] [userInput, bufferLen] | realistic.cpp:53:9:53:18 | access to array [post update] [baz, userInput, ... (3)] |
+| realistic.cpp:53:13:53:15 | bar [inner post update] [baz, userInput, bufferLen] | realistic.cpp:53:9:53:11 | foo [post update] [bar, baz, userInput, bufferLen] |
+| realistic.cpp:53:20:53:22 | baz [post update] [userInput, bufferLen] | realistic.cpp:53:9:53:18 | access to array [post update] [baz, userInput, bufferLen] |
 | realistic.cpp:53:25:53:33 | userInput [post update] [bufferLen] | realistic.cpp:53:20:53:22 | baz [post update] [userInput, bufferLen] |
 | realistic.cpp:53:55:53:64 | call to user_input | realistic.cpp:53:9:53:66 | ... = ... |
-| realistic.cpp:61:21:61:23 | foo [bar, baz, ... (4)] | realistic.cpp:61:25:61:27 | bar [baz, userInput, ... (3)] |
-| realistic.cpp:61:21:61:30 | access to array [baz, userInput, ... (3)] | realistic.cpp:61:32:61:34 | baz [userInput, bufferLen] |
-| realistic.cpp:61:25:61:27 | bar [baz, userInput, ... (3)] | realistic.cpp:61:21:61:30 | access to array [baz, userInput, ... (3)] |
+| realistic.cpp:61:21:61:23 | foo [bar, baz, userInput, bufferLen] | realistic.cpp:61:25:61:27 | bar [baz, userInput, bufferLen] |
+| realistic.cpp:61:21:61:30 | access to array [baz, userInput, bufferLen] | realistic.cpp:61:32:61:34 | baz [userInput, bufferLen] |
+| realistic.cpp:61:25:61:27 | bar [baz, userInput, bufferLen] | realistic.cpp:61:21:61:30 | access to array [baz, userInput, bufferLen] |
 | realistic.cpp:61:32:61:34 | baz [userInput, bufferLen] | realistic.cpp:61:37:61:45 | userInput [bufferLen] |
 | realistic.cpp:61:37:61:45 | userInput [bufferLen] | realistic.cpp:61:47:61:55 | bufferLen |
 | simple.cpp:26:15:26:15 | f [a_] | simple.cpp:28:10:28:10 | f [a_] |
@@ -517,14 +518,14 @@ nodes
 | A.cpp:160:29:160:29 | b | semmle.label | b |
 | A.cpp:161:18:161:40 | call to MyList [next, head] | semmle.label | call to MyList [next, head] |
 | A.cpp:161:38:161:39 | l1 [head] | semmle.label | l1 [head] |
-| A.cpp:162:18:162:40 | call to MyList [next, next, ... (3)] | semmle.label | call to MyList [next, next, ... (3)] |
+| A.cpp:162:18:162:40 | call to MyList [next, next, head] | semmle.label | call to MyList [next, next, head] |
 | A.cpp:162:38:162:39 | l2 [next, head] | semmle.label | l2 [next, head] |
-| A.cpp:165:10:165:11 | l3 [next, next, ... (3)] | semmle.label | l3 [next, next, ... (3)] |
+| A.cpp:165:10:165:11 | l3 [next, next, head] | semmle.label | l3 [next, next, head] |
 | A.cpp:165:14:165:17 | next [next, head] | semmle.label | next [next, head] |
 | A.cpp:165:20:165:23 | next [head] | semmle.label | next [head] |
 | A.cpp:165:26:165:29 | head | semmle.label | head |
 | A.cpp:167:44:167:44 | l [next, head] | semmle.label | l [next, head] |
-| A.cpp:167:44:167:44 | l [next, next, ... (3)] | semmle.label | l [next, next, ... (3)] |
+| A.cpp:167:44:167:44 | l [next, next, head] | semmle.label | l [next, next, head] |
 | A.cpp:167:47:167:50 | next [head] | semmle.label | next [head] |
 | A.cpp:167:47:167:50 | next [next, head] | semmle.label | next [next, head] |
 | A.cpp:169:12:169:12 | l [head] | semmle.label | l [head] |
@@ -586,13 +587,13 @@ nodes
 | D.cpp:52:14:52:14 | b [box, elem] | semmle.label | b [box, elem] |
 | D.cpp:56:15:56:24 | new | semmle.label | new |
 | D.cpp:58:5:58:12 | boxfield [post update] [box, elem] | semmle.label | boxfield [post update] [box, elem] |
-| D.cpp:58:5:58:12 | this [post update] [boxfield, box, ... (3)] | semmle.label | this [post update] [boxfield, box, ... (3)] |
+| D.cpp:58:5:58:12 | this [post update] [boxfield, box, elem] | semmle.label | this [post update] [boxfield, box, elem] |
 | D.cpp:58:5:58:27 | ... = ... | semmle.label | ... = ... |
 | D.cpp:58:15:58:17 | box [post update] [elem] | semmle.label | box [post update] [elem] |
-| D.cpp:59:5:59:7 | this [boxfield, box, ... (3)] | semmle.label | this [boxfield, box, ... (3)] |
-| D.cpp:63:8:63:10 | this [boxfield, box, ... (3)] | semmle.label | this [boxfield, box, ... (3)] |
+| D.cpp:59:5:59:7 | this [boxfield, box, elem] | semmle.label | this [boxfield, box, elem] |
+| D.cpp:63:8:63:10 | this [boxfield, box, elem] | semmle.label | this [boxfield, box, elem] |
 | D.cpp:64:10:64:17 | boxfield [box, elem] | semmle.label | boxfield [box, elem] |
-| D.cpp:64:10:64:17 | this [boxfield, box, ... (3)] | semmle.label | this [boxfield, box, ... (3)] |
+| D.cpp:64:10:64:17 | this [boxfield, box, elem] | semmle.label | this [boxfield, box, elem] |
 | D.cpp:64:20:64:22 | box [elem] | semmle.label | box [elem] |
 | D.cpp:64:25:64:28 | elem | semmle.label | elem |
 | E.cpp:19:27:19:27 | p [data, buffer] | semmle.label | p [data, buffer] |
@@ -675,34 +676,34 @@ nodes
 | arrays.cpp:15:14:15:23 | call to user_input | semmle.label | call to user_input |
 | arrays.cpp:16:8:16:13 | access to array | semmle.label | access to array |
 | arrays.cpp:17:8:17:13 | access to array | semmle.label | access to array |
-| arrays.cpp:36:3:36:3 | o [post update] [nested, arr, ... (3)] | semmle.label | o [post update] [nested, arr, ... (3)] |
+| arrays.cpp:36:3:36:3 | o [post update] [nested, arr, data] | semmle.label | o [post update] [nested, arr, data] |
 | arrays.cpp:36:3:36:17 | access to array [post update] [data] | semmle.label | access to array [post update] [data] |
 | arrays.cpp:36:3:36:37 | ... = ... | semmle.label | ... = ... |
 | arrays.cpp:36:5:36:10 | nested [post update] [arr, data] | semmle.label | nested [post update] [arr, data] |
 | arrays.cpp:36:12:36:14 | arr [inner post update] [data] | semmle.label | arr [inner post update] [data] |
 | arrays.cpp:36:26:36:35 | call to user_input | semmle.label | call to user_input |
-| arrays.cpp:37:8:37:8 | o [nested, arr, ... (3)] | semmle.label | o [nested, arr, ... (3)] |
+| arrays.cpp:37:8:37:8 | o [nested, arr, data] | semmle.label | o [nested, arr, data] |
 | arrays.cpp:37:8:37:22 | access to array [data] | semmle.label | access to array [data] |
 | arrays.cpp:37:10:37:15 | nested [arr, data] | semmle.label | nested [arr, data] |
 | arrays.cpp:37:17:37:19 | arr [data] | semmle.label | arr [data] |
 | arrays.cpp:37:24:37:27 | data | semmle.label | data |
-| arrays.cpp:38:8:38:8 | o [nested, arr, ... (3)] | semmle.label | o [nested, arr, ... (3)] |
+| arrays.cpp:38:8:38:8 | o [nested, arr, data] | semmle.label | o [nested, arr, data] |
 | arrays.cpp:38:8:38:22 | access to array [data] | semmle.label | access to array [data] |
 | arrays.cpp:38:10:38:15 | nested [arr, data] | semmle.label | nested [arr, data] |
 | arrays.cpp:38:17:38:19 | arr [data] | semmle.label | arr [data] |
 | arrays.cpp:38:24:38:27 | data | semmle.label | data |
-| arrays.cpp:42:3:42:3 | o [post update] [indirect, arr, ... (3)] | semmle.label | o [post update] [indirect, arr, ... (3)] |
+| arrays.cpp:42:3:42:3 | o [post update] [indirect, arr, data] | semmle.label | o [post update] [indirect, arr, data] |
 | arrays.cpp:42:3:42:20 | access to array [post update] [data] | semmle.label | access to array [post update] [data] |
 | arrays.cpp:42:3:42:40 | ... = ... | semmle.label | ... = ... |
 | arrays.cpp:42:5:42:12 | indirect [post update] [arr, data] | semmle.label | indirect [post update] [arr, data] |
 | arrays.cpp:42:15:42:17 | arr [inner post update] [data] | semmle.label | arr [inner post update] [data] |
 | arrays.cpp:42:29:42:38 | call to user_input | semmle.label | call to user_input |
-| arrays.cpp:43:8:43:8 | o [indirect, arr, ... (3)] | semmle.label | o [indirect, arr, ... (3)] |
+| arrays.cpp:43:8:43:8 | o [indirect, arr, data] | semmle.label | o [indirect, arr, data] |
 | arrays.cpp:43:8:43:25 | access to array [data] | semmle.label | access to array [data] |
 | arrays.cpp:43:10:43:17 | indirect [arr, data] | semmle.label | indirect [arr, data] |
 | arrays.cpp:43:20:43:22 | arr [data] | semmle.label | arr [data] |
 | arrays.cpp:43:27:43:30 | data | semmle.label | data |
-| arrays.cpp:44:8:44:8 | o [indirect, arr, ... (3)] | semmle.label | o [indirect, arr, ... (3)] |
+| arrays.cpp:44:8:44:8 | o [indirect, arr, data] | semmle.label | o [indirect, arr, data] |
 | arrays.cpp:44:8:44:25 | access to array [data] | semmle.label | access to array [data] |
 | arrays.cpp:44:10:44:17 | indirect [arr, data] | semmle.label | indirect [arr, data] |
 | arrays.cpp:44:20:44:22 | arr [data] | semmle.label | arr [data] |
@@ -796,34 +797,36 @@ nodes
 | by_reference.cpp:135:27:135:27 | a | semmle.label | a |
 | by_reference.cpp:136:8:136:13 | pouter [a] | semmle.label | pouter [a] |
 | by_reference.cpp:136:16:136:16 | a | semmle.label | a |
-| complex.cpp:40:17:40:17 | b [inner, f, ... (3)] | semmle.label | b [inner, f, ... (3)] |
-| complex.cpp:51:8:51:8 | b [inner, f, ... (3)] | semmle.label | b [inner, f, ... (3)] |
-| complex.cpp:51:10:51:14 | inner [f, a_] | semmle.label | inner [f, a_] |
-| complex.cpp:51:16:51:16 | f [a_] | semmle.label | f [a_] |
-| complex.cpp:51:18:51:18 | call to a | semmle.label | call to a |
-| complex.cpp:52:8:52:8 | b [inner, f, ... (3)] | semmle.label | b [inner, f, ... (3)] |
-| complex.cpp:52:10:52:14 | inner [f, b_] | semmle.label | inner [f, b_] |
-| complex.cpp:52:16:52:16 | f [b_] | semmle.label | f [b_] |
-| complex.cpp:52:18:52:18 | call to b | semmle.label | call to b |
-| complex.cpp:62:3:62:4 | b1 [post update] [inner, f, ... (3)] | semmle.label | b1 [post update] [inner, f, ... (3)] |
-| complex.cpp:62:6:62:10 | inner [post update] [f, a_] | semmle.label | inner [post update] [f, a_] |
-| complex.cpp:62:12:62:12 | ref arg f [a_] | semmle.label | ref arg f [a_] |
-| complex.cpp:62:19:62:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:63:3:63:4 | b2 [post update] [inner, f, ... (3)] | semmle.label | b2 [post update] [inner, f, ... (3)] |
-| complex.cpp:63:6:63:10 | inner [post update] [f, b_] | semmle.label | inner [post update] [f, b_] |
-| complex.cpp:63:12:63:12 | ref arg f [b_] | semmle.label | ref arg f [b_] |
-| complex.cpp:63:19:63:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:64:3:64:4 | b3 [post update] [inner, f, ... (3)] | semmle.label | b3 [post update] [inner, f, ... (3)] |
-| complex.cpp:64:6:64:10 | inner [post update] [f, a_] | semmle.label | inner [post update] [f, a_] |
-| complex.cpp:64:12:64:12 | ref arg f [a_] | semmle.label | ref arg f [a_] |
-| complex.cpp:64:19:64:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:65:3:65:4 | b3 [post update] [inner, f, ... (3)] | semmle.label | b3 [post update] [inner, f, ... (3)] |
-| complex.cpp:65:6:65:10 | inner [post update] [f, b_] | semmle.label | inner [post update] [f, b_] |
-| complex.cpp:65:12:65:12 | ref arg f [b_] | semmle.label | ref arg f [b_] |
-| complex.cpp:65:19:65:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:68:7:68:8 | b1 [inner, f, ... (3)] | semmle.label | b1 [inner, f, ... (3)] |
-| complex.cpp:71:7:71:8 | b2 [inner, f, ... (3)] | semmle.label | b2 [inner, f, ... (3)] |
-| complex.cpp:74:7:74:8 | b3 [inner, f, ... (3)] | semmle.label | b3 [inner, f, ... (3)] |
+| complex.cpp:40:17:40:17 | b [inner, f, a_] | semmle.label | b [inner, f, a_] |
+| complex.cpp:40:17:40:17 | b [inner, f, b_] | semmle.label | b [inner, f, b_] |
+| complex.cpp:42:8:42:8 | b [inner, f, a_] | semmle.label | b [inner, f, a_] |
+| complex.cpp:42:10:42:14 | inner [f, a_] | semmle.label | inner [f, a_] |
+| complex.cpp:42:16:42:16 | f [a_] | semmle.label | f [a_] |
+| complex.cpp:42:18:42:18 | call to a | semmle.label | call to a |
+| complex.cpp:43:8:43:8 | b [inner, f, b_] | semmle.label | b [inner, f, b_] |
+| complex.cpp:43:10:43:14 | inner [f, b_] | semmle.label | inner [f, b_] |
+| complex.cpp:43:16:43:16 | f [b_] | semmle.label | f [b_] |
+| complex.cpp:43:18:43:18 | call to b | semmle.label | call to b |
+| complex.cpp:53:3:53:4 | b1 [post update] [inner, f, a_] | semmle.label | b1 [post update] [inner, f, a_] |
+| complex.cpp:53:6:53:10 | inner [post update] [f, a_] | semmle.label | inner [post update] [f, a_] |
+| complex.cpp:53:12:53:12 | ref arg f [a_] | semmle.label | ref arg f [a_] |
+| complex.cpp:53:19:53:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:54:3:54:4 | b2 [post update] [inner, f, b_] | semmle.label | b2 [post update] [inner, f, b_] |
+| complex.cpp:54:6:54:10 | inner [post update] [f, b_] | semmle.label | inner [post update] [f, b_] |
+| complex.cpp:54:12:54:12 | ref arg f [b_] | semmle.label | ref arg f [b_] |
+| complex.cpp:54:19:54:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:55:3:55:4 | b3 [post update] [inner, f, a_] | semmle.label | b3 [post update] [inner, f, a_] |
+| complex.cpp:55:6:55:10 | inner [post update] [f, a_] | semmle.label | inner [post update] [f, a_] |
+| complex.cpp:55:12:55:12 | ref arg f [a_] | semmle.label | ref arg f [a_] |
+| complex.cpp:55:19:55:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:56:3:56:4 | b3 [post update] [inner, f, b_] | semmle.label | b3 [post update] [inner, f, b_] |
+| complex.cpp:56:6:56:10 | inner [post update] [f, b_] | semmle.label | inner [post update] [f, b_] |
+| complex.cpp:56:12:56:12 | ref arg f [b_] | semmle.label | ref arg f [b_] |
+| complex.cpp:56:19:56:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:59:7:59:8 | b1 [inner, f, a_] | semmle.label | b1 [inner, f, a_] |
+| complex.cpp:62:7:62:8 | b2 [inner, f, b_] | semmle.label | b2 [inner, f, b_] |
+| complex.cpp:65:7:65:8 | b3 [inner, f, a_] | semmle.label | b3 [inner, f, a_] |
+| complex.cpp:65:7:65:8 | b3 [inner, f, b_] | semmle.label | b3 [inner, f, b_] |
 | constructors.cpp:26:15:26:15 | f [a_] | semmle.label | f [a_] |
 | constructors.cpp:26:15:26:15 | f [b_] | semmle.label | f [b_] |
 | constructors.cpp:28:10:28:10 | f [a_] | semmle.label | f [a_] |
@@ -883,16 +886,16 @@ nodes
 | qualifiers.cpp:48:10:48:14 | outer [inner, a] | semmle.label | outer [inner, a] |
 | qualifiers.cpp:48:16:48:20 | inner [a] | semmle.label | inner [a] |
 | qualifiers.cpp:48:23:48:23 | a | semmle.label | a |
-| realistic.cpp:53:9:53:11 | foo [post update] [bar, baz, ... (4)] | semmle.label | foo [post update] [bar, baz, ... (4)] |
-| realistic.cpp:53:9:53:18 | access to array [post update] [baz, userInput, ... (3)] | semmle.label | access to array [post update] [baz, userInput, ... (3)] |
+| realistic.cpp:53:9:53:11 | foo [post update] [bar, baz, userInput, bufferLen] | semmle.label | foo [post update] [bar, baz, userInput, bufferLen] |
+| realistic.cpp:53:9:53:18 | access to array [post update] [baz, userInput, bufferLen] | semmle.label | access to array [post update] [baz, userInput, bufferLen] |
 | realistic.cpp:53:9:53:66 | ... = ... | semmle.label | ... = ... |
-| realistic.cpp:53:13:53:15 | bar [inner post update] [baz, userInput, ... (3)] | semmle.label | bar [inner post update] [baz, userInput, ... (3)] |
+| realistic.cpp:53:13:53:15 | bar [inner post update] [baz, userInput, bufferLen] | semmle.label | bar [inner post update] [baz, userInput, bufferLen] |
 | realistic.cpp:53:20:53:22 | baz [post update] [userInput, bufferLen] | semmle.label | baz [post update] [userInput, bufferLen] |
 | realistic.cpp:53:25:53:33 | userInput [post update] [bufferLen] | semmle.label | userInput [post update] [bufferLen] |
 | realistic.cpp:53:55:53:64 | call to user_input | semmle.label | call to user_input |
-| realistic.cpp:61:21:61:23 | foo [bar, baz, ... (4)] | semmle.label | foo [bar, baz, ... (4)] |
-| realistic.cpp:61:21:61:30 | access to array [baz, userInput, ... (3)] | semmle.label | access to array [baz, userInput, ... (3)] |
-| realistic.cpp:61:25:61:27 | bar [baz, userInput, ... (3)] | semmle.label | bar [baz, userInput, ... (3)] |
+| realistic.cpp:61:21:61:23 | foo [bar, baz, userInput, bufferLen] | semmle.label | foo [bar, baz, userInput, bufferLen] |
+| realistic.cpp:61:21:61:30 | access to array [baz, userInput, bufferLen] | semmle.label | access to array [baz, userInput, bufferLen] |
+| realistic.cpp:61:25:61:27 | bar [baz, userInput, bufferLen] | semmle.label | bar [baz, userInput, bufferLen] |
 | realistic.cpp:61:32:61:34 | baz [userInput, bufferLen] | semmle.label | baz [userInput, bufferLen] |
 | realistic.cpp:61:37:61:45 | userInput [bufferLen] | semmle.label | userInput [bufferLen] |
 | realistic.cpp:61:47:61:55 | bufferLen | semmle.label | bufferLen |
@@ -1021,14 +1024,10 @@ nodes
 | by_reference.cpp:134:29:134:29 | a | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:134:29:134:29 | a | a flows from $@ | by_reference.cpp:88:13:88:22 | call to user_input | call to user_input |
 | by_reference.cpp:135:27:135:27 | a | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:135:27:135:27 | a | a flows from $@ | by_reference.cpp:88:13:88:22 | call to user_input | call to user_input |
 | by_reference.cpp:136:16:136:16 | a | by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:136:16:136:16 | a | a flows from $@ | by_reference.cpp:96:8:96:17 | call to user_input | call to user_input |
-| complex.cpp:51:18:51:18 | call to a | complex.cpp:62:19:62:28 | call to user_input | complex.cpp:51:18:51:18 | call to a | call to a flows from $@ | complex.cpp:62:19:62:28 | call to user_input | call to user_input |
-| complex.cpp:51:18:51:18 | call to a | complex.cpp:63:19:63:28 | call to user_input | complex.cpp:51:18:51:18 | call to a | call to a flows from $@ | complex.cpp:63:19:63:28 | call to user_input | call to user_input |
-| complex.cpp:51:18:51:18 | call to a | complex.cpp:64:19:64:28 | call to user_input | complex.cpp:51:18:51:18 | call to a | call to a flows from $@ | complex.cpp:64:19:64:28 | call to user_input | call to user_input |
-| complex.cpp:51:18:51:18 | call to a | complex.cpp:65:19:65:28 | call to user_input | complex.cpp:51:18:51:18 | call to a | call to a flows from $@ | complex.cpp:65:19:65:28 | call to user_input | call to user_input |
-| complex.cpp:52:18:52:18 | call to b | complex.cpp:62:19:62:28 | call to user_input | complex.cpp:52:18:52:18 | call to b | call to b flows from $@ | complex.cpp:62:19:62:28 | call to user_input | call to user_input |
-| complex.cpp:52:18:52:18 | call to b | complex.cpp:63:19:63:28 | call to user_input | complex.cpp:52:18:52:18 | call to b | call to b flows from $@ | complex.cpp:63:19:63:28 | call to user_input | call to user_input |
-| complex.cpp:52:18:52:18 | call to b | complex.cpp:64:19:64:28 | call to user_input | complex.cpp:52:18:52:18 | call to b | call to b flows from $@ | complex.cpp:64:19:64:28 | call to user_input | call to user_input |
-| complex.cpp:52:18:52:18 | call to b | complex.cpp:65:19:65:28 | call to user_input | complex.cpp:52:18:52:18 | call to b | call to b flows from $@ | complex.cpp:65:19:65:28 | call to user_input | call to user_input |
+| complex.cpp:42:18:42:18 | call to a | complex.cpp:53:19:53:28 | call to user_input | complex.cpp:42:18:42:18 | call to a | call to a flows from $@ | complex.cpp:53:19:53:28 | call to user_input | call to user_input |
+| complex.cpp:42:18:42:18 | call to a | complex.cpp:55:19:55:28 | call to user_input | complex.cpp:42:18:42:18 | call to a | call to a flows from $@ | complex.cpp:55:19:55:28 | call to user_input | call to user_input |
+| complex.cpp:43:18:43:18 | call to b | complex.cpp:54:19:54:28 | call to user_input | complex.cpp:43:18:43:18 | call to b | call to b flows from $@ | complex.cpp:54:19:54:28 | call to user_input | call to user_input |
+| complex.cpp:43:18:43:18 | call to b | complex.cpp:56:19:56:28 | call to user_input | complex.cpp:43:18:43:18 | call to b | call to b flows from $@ | complex.cpp:56:19:56:28 | call to user_input | call to user_input |
 | constructors.cpp:28:12:28:12 | call to a | constructors.cpp:34:11:34:20 | call to user_input | constructors.cpp:28:12:28:12 | call to a | call to a flows from $@ | constructors.cpp:34:11:34:20 | call to user_input | call to user_input |
 | constructors.cpp:28:12:28:12 | call to a | constructors.cpp:36:11:36:20 | call to user_input | constructors.cpp:28:12:28:12 | call to a | call to a flows from $@ | constructors.cpp:36:11:36:20 | call to user_input | call to user_input |
 | constructors.cpp:29:12:29:12 | call to b | constructors.cpp:35:14:35:23 | call to user_input | constructors.cpp:29:12:29:12 | call to b | call to b flows from $@ | constructors.cpp:35:14:35:23 | call to user_input | call to user_input |

cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp

@@ -7,11 +7,14 @@ char *source();
 
 void sink(char *);
 void sink(const char *);
+void sink(bool);
 void sink(std::pair<char *, char *>);
 void sink(std::map<char *, char *>);
 void sink(std::map<char *, char *>::iterator);
 void sink(std::unordered_map<char *, char *>);
 void sink(std::unordered_map<char *, char *>::iterator);
+void sink(std::unordered_map<char *, std::pair<int, int> >);
+void sink(std::unordered_map<char *, std::pair<int, int> >::iterator);
 
 void test_pair()
 {
@@ -176,12 +179,12 @@ void test_map()
 	m14.insert(std::make_pair("b", source()));
 	m14.insert(std::make_pair("c", source()));
 	m14.insert(std::make_pair("d", "d"));
-	sink(m2.lower_bound("b")); // tainted [NOT DETECTED]
-	sink(m2.upper_bound("b")); // tainted [NOT DETECTED]
-	sink(m2.equal_range("b").first); // tainted [NOT DETECTED]
-	sink(m2.equal_range("b").second); // tainted [NOT DETECTED]
-	sink(m2.upper_bound("c"));
-	sink(m2.equal_range("c").second);
+	sink(m2.lower_bound("b")); // tainted
+	sink(m2.upper_bound("b")); // tainted
+	sink(m2.equal_range("b").first); // tainted
+	sink(m2.equal_range("b").second); // tainted
+	sink(m2.upper_bound("c")); // [FALSE POSITIVE]
+	sink(m2.equal_range("c").second); // [FALSE POSITIVE]
 
 	// swap
 	std::map<char *, char *> m15, m16, m17, m18;
@@ -208,11 +211,11 @@ void test_map()
 	sink(m20);
 	sink(m21);
 	sink(m22); // tainted
-	m15.merge(m16);
-	m17.merge(m18);
+	m19.merge(m20);
+	m21.merge(m22);
 	sink(m19); // tainted
-	sink(m20); // tainted [NOT DETECTED]
-	sink(m21); // tainted [NOT DETECTED]
+	sink(m20);
+	sink(m21); // tainted
 	sink(m22); // tainted
 
 	// erase, clear
@@ -229,23 +232,23 @@ void test_map()
 	std::map<char *, char *> m24, m25;
 	sink(m24.emplace("abc", "def").first);
 	sink(m24);
-	sink(m24.emplace("abc", source()).first); // tainted [NOT DETECTED]
-	sink(m24); // tainted [NOT DETECTED]
+	sink(m24.emplace("abc", source()).first); // tainted
+	sink(m24); // tainted
 	sink(m25.emplace_hint(m25.begin(), "abc", "def"));
 	sink(m25);
-	sink(m25.emplace_hint(m25.begin(), "abc", source())); // tainted [NOT DETECTED]
-	sink(m25); // tainted [NOT DETECTED]
+	sink(m25.emplace_hint(m25.begin(), "abc", source())); // tainted
+	sink(m25); // tainted
 	
 	// try_emplace
 	std::map<char *, char *> m26, m27;
 	sink(m26.try_emplace("abc", "def").first);
 	sink(m26);
-	sink(m26.try_emplace("abc", source()).first); // tainted [NOT DETECTED]
-	sink(m26); // tainted [NOT DETECTED]
+	sink(m26.try_emplace("abc", source()).first); // tainted
+	sink(m26); // tainted
 	sink(m27.try_emplace(m27.begin(), "abc", "def"));
 	sink(m27);
-	sink(m27.try_emplace(m27.begin(), "abc", source())); // tainted [NOT DETECTED]
-	sink(m27); // tainted [NOT DETECTED]
+	sink(m27.try_emplace(m27.begin(), "abc", source())); // tainted
+	sink(m27); // tainted
 }
 
 void test_unordered_map()
@@ -328,9 +331,9 @@ void test_unordered_map()
 	m14.insert(std::make_pair("b", source()));
 	m14.insert(std::make_pair("c", source()));
 	m14.insert(std::make_pair("d", "d"));
-	sink(m2.equal_range("b").first); // tainted [NOT DETECTED]
-	sink(m2.equal_range("b").second); // tainted [NOT DETECTED]
-	sink(m2.equal_range("c").second);
+	sink(m2.equal_range("b").first); // tainted
+	sink(m2.equal_range("b").second); // tainted
+	sink(m2.equal_range("c").second); // [FALSE POSITIVE]
 
 	// swap
 	std::unordered_map<char *, char *> m15, m16, m17, m18;
@@ -357,11 +360,11 @@ void test_unordered_map()
 	sink(m20);
 	sink(m21);
 	sink(m22); // tainted
-	m15.merge(m16);
-	m17.merge(m18);
+	m19.merge(m20);
+	m21.merge(m22);
 	sink(m19); // tainted
-	sink(m20); // tainted [NOT DETECTED]
-	sink(m21); // tainted [NOT DETECTED]
+	sink(m20);
+	sink(m21); // tainted
 	sink(m22); // tainted
 
 	// erase, clear
@@ -378,21 +381,58 @@ void test_unordered_map()
 	std::unordered_map<char *, char *> m24, m25;
 	sink(m24.emplace("abc", "def").first);
 	sink(m24);
-	sink(m24.emplace("abc", source()).first); // tainted [NOT DETECTED]
-	sink(m24); // tainted [NOT DETECTED]
+	sink(m24.emplace("abc", source()).first); // tainted
+	sink(m24); // tainted
 	sink(m25.emplace_hint(m25.begin(), "abc", "def"));
 	sink(m25);
-	sink(m25.emplace_hint(m25.begin(), "abc", source())); // tainted [NOT DETECTED]
-	sink(m25); // tainted [NOT DETECTED]
-	
+	sink(m25.emplace_hint(m25.begin(), "abc", source())); // tainted
+	sink(m25); // tainted
+
 	// try_emplace
-	std::unordered_map<char *, char *> m26, m27;
+	std::unordered_map<char *, char *> m26, m27, m28;
 	sink(m26.try_emplace("abc", "def").first);
+	sink(m26.try_emplace("abc", "def").second);
 	sink(m26);
-	sink(m26.try_emplace("abc", source()).first); // tainted [NOT DETECTED]
-	sink(m26); // tainted [NOT DETECTED]
+	sink(m26.try_emplace("abc", source()).first); // tainted
+	sink(m26.try_emplace("abc", source()).second); // [FALSE POSITIVE]
+	sink(m26); // tainted
 	sink(m27.try_emplace(m27.begin(), "abc", "def"));
 	sink(m27);
-	sink(m27.try_emplace(m27.begin(), "abc", source())); // tainted [NOT DETECTED]
-	sink(m27); // tainted [NOT DETECTED]
+	sink(m27.try_emplace(m27.begin(), "abc", source())); // tainted
+	sink(m27); // tainted
+	sink(m28.try_emplace(m28.begin(), "abc", "def"));
+	sink(m28);
+	sink(m28.try_emplace(m28.begin(), source(), "def")); // tainted [NOT DETECTED]
+	sink(m28); // tainted [NOT DETECTED]
+
+	// additional try_emplace test cases
+	std::unordered_map<char *, std::pair<int, int>> m29, m30, m31, m32;
+	sink(m29.try_emplace("abc", 1, 2));
+	sink(m29);
+	sink(m29["abc"]);
+	sink(m30.try_emplace(source(), 1, 2)); // tainted [NOT DETECTED]
+	sink(m30); // tainted [NOT DETECTED]
+	sink(m30["abc"]);
+	sink(m31.try_emplace("abc", source(), 2)); // tainted
+	sink(m31); // tainted
+	sink(m31["abc"]); // tainted
+	sink(m32.try_emplace("abc", 1, source())); // tainted
+	sink(m32); // tainted
+	sink(m32["abc"]); // tainted
+
+	// additional emplace test cases
+	std::unordered_map<char *, char *> m33;
+	sink(m33.emplace(source(), "def").first); // tainted [NOT DETECTED]
+	sink(m33); // tainted [NOT DETECTED]
+
+	std::unordered_map<char *, char *> m34, m35;
+	sink(m34.emplace(std::pair<char *, char *>("abc", "def")).first);
+	sink(m34);
+	sink(m34.emplace(std::pair<char *, char *>("abc", source())).first); // tainted
+	sink(m34); // tainted
+	sink(m34.emplace_hint(m34.begin(), "abc", "def")); // tainted
+	sink(m35.emplace().first);
+	sink(m35);
+	sink(m35.emplace(std::pair<char *, char *>(source(), "def")).first); // tainted [NOT DETECTED]
+	sink(m35); // tainted [NOT DETECTED]
 }

cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp

@@ -66,10 +66,10 @@ void test_set()
 	s11.insert("a");
 	s11.insert(source());
 	s11.insert("c");
-	sink(s11.lower_bound("b")); // tainted [NOT DETECTED]
-	sink(s11.upper_bound("b")); // tainted [NOT DETECTED]
-	sink(s11.equal_range("b").first); // tainted [NOT DETECTED]
-	sink(s11.equal_range("b").second); // tainted [NOT DETECTED]
+	sink(s11.lower_bound("b")); // tainted
+	sink(s11.upper_bound("b")); // tainted
+	sink(s11.equal_range("b").first); // tainted
+	sink(s11.equal_range("b").second); // tainted
 
 	// swap
 	std::set<char *> s12, s13, s14, s15;
@@ -99,8 +99,8 @@ void test_set()
 	s16.merge(s17);
 	s18.merge(s19);
 	sink(s16); // tainted
-	sink(s17); // tainted [NOT DETECTED]
-	sink(s18); // tainted [NOT DETECTED]
+	sink(s17);
+	sink(s18); // tainted
 	sink(s19); // tainted
 
 	// erase, clear
@@ -117,12 +117,12 @@ void test_set()
 	std::set<char *> s21, s22;
 	sink(s21.emplace("abc").first);
 	sink(s21);
-	sink(s21.emplace(source()).first); // tainted [NOT DETECTED]
-	sink(s21); // tainted [NOT DETECTED]
+	sink(s21.emplace(source()).first); // tainted
+	sink(s21); // tainted
 	sink(s22.emplace_hint(s22.begin(), "abc"));
 	sink(s22);
-	sink(s22.emplace_hint(s22.begin(), source())); // tainted [NOT DETECTED]
-	sink(s22); // tainted [NOT DETECTED]
+	sink(s22.emplace_hint(s22.begin(), source())); // tainted
+	sink(s22); // tainted
 }
 
 void test_unordered_set()
@@ -180,8 +180,8 @@ void test_unordered_set()
 	s11.insert("a");
 	s11.insert(source());
 	s11.insert("c");
-	sink(s11.equal_range("b").first); // tainted [NOT DETECTED]
-	sink(s11.equal_range("b").second); // tainted [NOT DETECTED]
+	sink(s11.equal_range("b").first); // tainted
+	sink(s11.equal_range("b").second); // tainted
 
 	// swap
 	std::unordered_set<char *> s12, s13, s14, s15;
@@ -211,8 +211,8 @@ void test_unordered_set()
 	s16.merge(s17);
 	s18.merge(s19);
 	sink(s16); // tainted
-	sink(s17); // tainted [NOT DETECTED]
-	sink(s18); // tainted [NOT DETECTED]
+	sink(s17);
+	sink(s18); // tainted
 	sink(s19); // tainted
 
 	// erase, clear
@@ -229,10 +229,10 @@ void test_unordered_set()
 	std::unordered_set<char *> s21, s22;
 	sink(s21.emplace("abc").first);
 	sink(s21);
-	sink(s21.emplace(source()).first); // tainted [NOT DETECTED]
-	sink(s21); // tainted [NOT DETECTED]
+	sink(s21.emplace(source()).first); // tainted
+	sink(s21); // tainted
 	sink(s22.emplace_hint(s22.begin(), "abc"));
 	sink(s22);
-	sink(s22.emplace_hint(s22.begin(), source())); // tainted [NOT DETECTED]
-	sink(s22); // tainted [NOT DETECTED]
+	sink(s22.emplace_hint(s22.begin(), source())); // tainted
+	sink(s22); // tainted
 }

cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected

@@ -33,108 +33,134 @@
 | format.cpp:115:8:115:13 | buffer | format.cpp:114:37:114:50 | call to source |
 | format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
 | format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
-| map.cpp:26:9:26:13 | first | map.cpp:25:12:25:17 | call to source |
-| map.cpp:32:9:32:14 | second | map.cpp:30:13:30:18 | call to source |
-| map.cpp:41:9:41:13 | first | map.cpp:40:30:40:35 | call to source |
-| map.cpp:47:9:47:14 | second | map.cpp:45:37:45:42 | call to source |
-| map.cpp:48:7:48:7 | f | map.cpp:45:37:45:42 | call to source |
-| map.cpp:52:9:52:14 | second | map.cpp:45:37:45:42 | call to source |
-| map.cpp:53:7:53:7 | g | map.cpp:45:37:45:42 | call to source |
-| map.cpp:58:9:58:14 | second | map.cpp:45:37:45:42 | call to source |
-| map.cpp:59:7:59:7 | h | map.cpp:45:37:45:42 | call to source |
-| map.cpp:69:7:69:7 | i | map.cpp:62:37:62:42 | call to source |
-| map.cpp:71:9:71:14 | second | map.cpp:62:37:62:42 | call to source |
-| map.cpp:72:7:72:7 | j | map.cpp:62:37:62:42 | call to source |
-| map.cpp:74:9:74:14 | second | map.cpp:63:37:63:42 | call to source |
-| map.cpp:75:7:75:7 | k | map.cpp:63:37:63:42 | call to source |
-| map.cpp:78:7:78:7 | l | map.cpp:63:37:63:42 | call to source |
-| map.cpp:86:7:86:32 | call to pair | map.cpp:86:24:86:29 | call to source |
-| map.cpp:107:10:107:15 | call to insert | map.cpp:107:62:107:67 | call to source |
-| map.cpp:109:10:109:25 | call to insert_or_assign | map.cpp:109:46:109:51 | call to source |
-| map.cpp:111:7:111:8 | call to map | map.cpp:105:39:105:44 | call to source |
-| map.cpp:113:7:113:8 | call to map | map.cpp:107:62:107:67 | call to source |
-| map.cpp:114:7:114:8 | call to map | map.cpp:108:34:108:39 | call to source |
-| map.cpp:115:7:115:8 | call to map | map.cpp:109:46:109:51 | call to source |
-| map.cpp:117:10:117:13 | call to find | map.cpp:105:39:105:44 | call to source |
-| map.cpp:119:10:119:13 | call to find | map.cpp:107:62:107:67 | call to source |
-| map.cpp:120:10:120:13 | call to find | map.cpp:108:34:108:39 | call to source |
-| map.cpp:121:10:121:13 | call to find | map.cpp:109:46:109:51 | call to source |
-| map.cpp:123:10:123:13 | call to find | map.cpp:105:39:105:44 | call to source |
-| map.cpp:125:10:125:13 | call to find | map.cpp:107:62:107:67 | call to source |
-| map.cpp:126:10:126:13 | call to find | map.cpp:108:34:108:39 | call to source |
-| map.cpp:127:10:127:13 | call to find | map.cpp:109:46:109:51 | call to source |
-| map.cpp:134:7:134:8 | call to map | map.cpp:105:39:105:44 | call to source |
-| map.cpp:135:7:135:8 | call to map | map.cpp:105:39:105:44 | call to source |
-| map.cpp:136:7:136:8 | call to map | map.cpp:105:39:105:44 | call to source |
-| map.cpp:137:10:137:13 | call to find | map.cpp:105:39:105:44 | call to source |
-| map.cpp:138:10:138:13 | call to find | map.cpp:105:39:105:44 | call to source |
-| map.cpp:139:10:139:13 | call to find | map.cpp:105:39:105:44 | call to source |
-| map.cpp:151:8:151:10 | call to pair | map.cpp:105:39:105:44 | call to source |
-| map.cpp:165:7:165:27 | ... = ... | map.cpp:165:20:165:25 | call to source |
-| map.cpp:167:7:167:30 | ... = ... | map.cpp:167:23:167:28 | call to source |
-| map.cpp:169:10:169:10 | call to operator[] | map.cpp:165:20:165:25 | call to source |
-| map.cpp:171:10:171:10 | call to operator[] | map.cpp:167:23:167:28 | call to source |
-| map.cpp:190:7:190:9 | call to map | map.cpp:188:49:188:54 | call to source |
-| map.cpp:193:7:193:9 | call to map | map.cpp:189:49:189:54 | call to source |
-| map.cpp:196:7:196:9 | call to map | map.cpp:188:49:188:54 | call to source |
-| map.cpp:197:7:197:9 | call to map | map.cpp:188:49:188:54 | call to source |
-| map.cpp:198:7:198:9 | call to map | map.cpp:189:49:189:54 | call to source |
-| map.cpp:199:7:199:9 | call to map | map.cpp:189:49:189:54 | call to source |
-| map.cpp:207:7:207:9 | call to map | map.cpp:203:49:203:54 | call to source |
+| map.cpp:29:9:29:13 | first | map.cpp:28:12:28:17 | call to source |
+| map.cpp:35:9:35:14 | second | map.cpp:33:13:33:18 | call to source |
+| map.cpp:44:9:44:13 | first | map.cpp:43:30:43:35 | call to source |
+| map.cpp:50:9:50:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:51:7:51:7 | f | map.cpp:48:37:48:42 | call to source |
+| map.cpp:55:9:55:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:56:7:56:7 | g | map.cpp:48:37:48:42 | call to source |
+| map.cpp:61:9:61:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:62:7:62:7 | h | map.cpp:48:37:48:42 | call to source |
+| map.cpp:72:7:72:7 | i | map.cpp:65:37:65:42 | call to source |
+| map.cpp:74:9:74:14 | second | map.cpp:65:37:65:42 | call to source |
+| map.cpp:75:7:75:7 | j | map.cpp:65:37:65:42 | call to source |
+| map.cpp:77:9:77:14 | second | map.cpp:66:37:66:42 | call to source |
+| map.cpp:78:7:78:7 | k | map.cpp:66:37:66:42 | call to source |
+| map.cpp:81:7:81:7 | l | map.cpp:66:37:66:42 | call to source |
+| map.cpp:89:7:89:32 | call to pair | map.cpp:89:24:89:29 | call to source |
+| map.cpp:110:10:110:15 | call to insert | map.cpp:110:62:110:67 | call to source |
+| map.cpp:112:10:112:25 | call to insert_or_assign | map.cpp:112:46:112:51 | call to source |
+| map.cpp:114:7:114:8 | call to map | map.cpp:108:39:108:44 | call to source |
+| map.cpp:116:7:116:8 | call to map | map.cpp:110:62:110:67 | call to source |
+| map.cpp:117:7:117:8 | call to map | map.cpp:111:34:111:39 | call to source |
+| map.cpp:118:7:118:8 | call to map | map.cpp:112:46:112:51 | call to source |
+| map.cpp:120:10:120:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:122:10:122:13 | call to find | map.cpp:110:62:110:67 | call to source |
+| map.cpp:123:10:123:13 | call to find | map.cpp:111:34:111:39 | call to source |
+| map.cpp:124:10:124:13 | call to find | map.cpp:112:46:112:51 | call to source |
+| map.cpp:126:10:126:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:128:10:128:13 | call to find | map.cpp:110:62:110:67 | call to source |
+| map.cpp:129:10:129:13 | call to find | map.cpp:111:34:111:39 | call to source |
+| map.cpp:130:10:130:13 | call to find | map.cpp:112:46:112:51 | call to source |
+| map.cpp:137:7:137:8 | call to map | map.cpp:108:39:108:44 | call to source |
+| map.cpp:138:7:138:8 | call to map | map.cpp:108:39:108:44 | call to source |
+| map.cpp:139:7:139:8 | call to map | map.cpp:108:39:108:44 | call to source |
+| map.cpp:140:10:140:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:141:10:141:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:142:10:142:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:154:8:154:10 | call to pair | map.cpp:108:39:108:44 | call to source |
+| map.cpp:168:7:168:27 | ... = ... | map.cpp:168:20:168:25 | call to source |
+| map.cpp:170:7:170:30 | ... = ... | map.cpp:170:23:170:28 | call to source |
+| map.cpp:172:10:172:10 | call to operator[] | map.cpp:168:20:168:25 | call to source |
+| map.cpp:174:10:174:10 | call to operator[] | map.cpp:170:23:170:28 | call to source |
+| map.cpp:182:10:182:20 | call to lower_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:183:10:183:20 | call to upper_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:186:10:186:20 | call to upper_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:193:7:193:9 | call to map | map.cpp:191:49:191:54 | call to source |
+| map.cpp:196:7:196:9 | call to map | map.cpp:192:49:192:54 | call to source |
+| map.cpp:199:7:199:9 | call to map | map.cpp:191:49:191:54 | call to source |
+| map.cpp:200:7:200:9 | call to map | map.cpp:191:49:191:54 | call to source |
+| map.cpp:201:7:201:9 | call to map | map.cpp:192:49:192:54 | call to source |
+| map.cpp:202:7:202:9 | call to map | map.cpp:192:49:192:54 | call to source |
 | map.cpp:210:7:210:9 | call to map | map.cpp:206:49:206:54 | call to source |
-| map.cpp:213:7:213:9 | call to map | map.cpp:203:49:203:54 | call to source |
+| map.cpp:213:7:213:9 | call to map | map.cpp:209:49:209:54 | call to source |
 | map.cpp:216:7:216:9 | call to map | map.cpp:206:49:206:54 | call to source |
-| map.cpp:222:7:222:9 | call to map | map.cpp:220:49:220:54 | call to source |
-| map.cpp:222:7:222:9 | call to map | map.cpp:221:49:221:54 | call to source |
-| map.cpp:223:11:223:15 | call to erase | map.cpp:220:49:220:54 | call to source |
-| map.cpp:223:11:223:15 | call to erase | map.cpp:221:49:221:54 | call to source |
-| map.cpp:224:7:224:9 | call to map | map.cpp:220:49:220:54 | call to source |
-| map.cpp:224:7:224:9 | call to map | map.cpp:221:49:221:54 | call to source |
-| map.cpp:226:7:226:9 | call to map | map.cpp:220:49:220:54 | call to source |
-| map.cpp:226:7:226:9 | call to map | map.cpp:221:49:221:54 | call to source |
-| map.cpp:259:10:259:15 | call to insert | map.cpp:259:62:259:67 | call to source |
-| map.cpp:261:10:261:25 | call to insert_or_assign | map.cpp:261:46:261:51 | call to source |
-| map.cpp:263:7:263:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
-| map.cpp:265:7:265:8 | call to unordered_map | map.cpp:259:62:259:67 | call to source |
-| map.cpp:266:7:266:8 | call to unordered_map | map.cpp:260:34:260:39 | call to source |
-| map.cpp:267:7:267:8 | call to unordered_map | map.cpp:261:46:261:51 | call to source |
-| map.cpp:269:10:269:13 | call to find | map.cpp:257:39:257:44 | call to source |
-| map.cpp:271:10:271:13 | call to find | map.cpp:259:62:259:67 | call to source |
-| map.cpp:272:10:272:13 | call to find | map.cpp:260:34:260:39 | call to source |
-| map.cpp:273:10:273:13 | call to find | map.cpp:261:46:261:51 | call to source |
-| map.cpp:275:10:275:13 | call to find | map.cpp:257:39:257:44 | call to source |
-| map.cpp:277:10:277:13 | call to find | map.cpp:259:62:259:67 | call to source |
-| map.cpp:278:10:278:13 | call to find | map.cpp:260:34:260:39 | call to source |
-| map.cpp:279:10:279:13 | call to find | map.cpp:261:46:261:51 | call to source |
-| map.cpp:286:7:286:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
-| map.cpp:287:7:287:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
-| map.cpp:288:7:288:8 | call to unordered_map | map.cpp:257:39:257:44 | call to source |
-| map.cpp:289:10:289:13 | call to find | map.cpp:257:39:257:44 | call to source |
-| map.cpp:290:10:290:13 | call to find | map.cpp:257:39:257:44 | call to source |
-| map.cpp:291:10:291:13 | call to find | map.cpp:257:39:257:44 | call to source |
-| map.cpp:303:8:303:10 | call to pair | map.cpp:257:39:257:44 | call to source |
-| map.cpp:317:7:317:27 | ... = ... | map.cpp:317:20:317:25 | call to source |
-| map.cpp:319:7:319:30 | ... = ... | map.cpp:319:23:319:28 | call to source |
-| map.cpp:321:10:321:10 | call to operator[] | map.cpp:317:20:317:25 | call to source |
-| map.cpp:323:10:323:10 | call to operator[] | map.cpp:319:23:319:28 | call to source |
-| map.cpp:339:7:339:9 | call to unordered_map | map.cpp:337:49:337:54 | call to source |
-| map.cpp:342:7:342:9 | call to unordered_map | map.cpp:338:49:338:54 | call to source |
-| map.cpp:345:7:345:9 | call to unordered_map | map.cpp:337:49:337:54 | call to source |
-| map.cpp:346:7:346:9 | call to unordered_map | map.cpp:337:49:337:54 | call to source |
-| map.cpp:347:7:347:9 | call to unordered_map | map.cpp:338:49:338:54 | call to source |
-| map.cpp:348:7:348:9 | call to unordered_map | map.cpp:338:49:338:54 | call to source |
-| map.cpp:356:7:356:9 | call to unordered_map | map.cpp:352:49:352:54 | call to source |
+| map.cpp:218:7:218:9 | call to map | map.cpp:209:49:209:54 | call to source |
+| map.cpp:219:7:219:9 | call to map | map.cpp:209:49:209:54 | call to source |
+| map.cpp:225:7:225:9 | call to map | map.cpp:223:49:223:54 | call to source |
+| map.cpp:225:7:225:9 | call to map | map.cpp:224:49:224:54 | call to source |
+| map.cpp:226:11:226:15 | call to erase | map.cpp:223:49:223:54 | call to source |
+| map.cpp:226:11:226:15 | call to erase | map.cpp:224:49:224:54 | call to source |
+| map.cpp:227:7:227:9 | call to map | map.cpp:223:49:223:54 | call to source |
+| map.cpp:227:7:227:9 | call to map | map.cpp:224:49:224:54 | call to source |
+| map.cpp:229:7:229:9 | call to map | map.cpp:223:49:223:54 | call to source |
+| map.cpp:229:7:229:9 | call to map | map.cpp:224:49:224:54 | call to source |
+| map.cpp:236:7:236:9 | call to map | map.cpp:235:26:235:31 | call to source |
+| map.cpp:239:11:239:22 | call to emplace_hint | map.cpp:239:44:239:49 | call to source |
+| map.cpp:240:7:240:9 | call to map | map.cpp:239:44:239:49 | call to source |
+| map.cpp:247:7:247:9 | call to map | map.cpp:246:30:246:35 | call to source |
+| map.cpp:250:11:250:21 | call to try_emplace | map.cpp:250:43:250:48 | call to source |
+| map.cpp:251:7:251:9 | call to map | map.cpp:250:43:250:48 | call to source |
+| map.cpp:262:10:262:15 | call to insert | map.cpp:262:62:262:67 | call to source |
+| map.cpp:264:10:264:25 | call to insert_or_assign | map.cpp:264:46:264:51 | call to source |
+| map.cpp:266:7:266:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
+| map.cpp:268:7:268:8 | call to unordered_map | map.cpp:262:62:262:67 | call to source |
+| map.cpp:269:7:269:8 | call to unordered_map | map.cpp:263:34:263:39 | call to source |
+| map.cpp:270:7:270:8 | call to unordered_map | map.cpp:264:46:264:51 | call to source |
+| map.cpp:272:10:272:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:274:10:274:13 | call to find | map.cpp:262:62:262:67 | call to source |
+| map.cpp:275:10:275:13 | call to find | map.cpp:263:34:263:39 | call to source |
+| map.cpp:276:10:276:13 | call to find | map.cpp:264:46:264:51 | call to source |
+| map.cpp:278:10:278:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:280:10:280:13 | call to find | map.cpp:262:62:262:67 | call to source |
+| map.cpp:281:10:281:13 | call to find | map.cpp:263:34:263:39 | call to source |
+| map.cpp:282:10:282:13 | call to find | map.cpp:264:46:264:51 | call to source |
+| map.cpp:289:7:289:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
+| map.cpp:290:7:290:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
+| map.cpp:291:7:291:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
+| map.cpp:292:10:292:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:293:10:293:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:294:10:294:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:306:8:306:10 | call to pair | map.cpp:260:39:260:44 | call to source |
+| map.cpp:320:7:320:27 | ... = ... | map.cpp:320:20:320:25 | call to source |
+| map.cpp:322:7:322:30 | ... = ... | map.cpp:322:23:322:28 | call to source |
+| map.cpp:324:10:324:10 | call to operator[] | map.cpp:320:20:320:25 | call to source |
+| map.cpp:326:10:326:10 | call to operator[] | map.cpp:322:23:322:28 | call to source |
+| map.cpp:342:7:342:9 | call to unordered_map | map.cpp:340:49:340:54 | call to source |
+| map.cpp:345:7:345:9 | call to unordered_map | map.cpp:341:49:341:54 | call to source |
+| map.cpp:348:7:348:9 | call to unordered_map | map.cpp:340:49:340:54 | call to source |
+| map.cpp:349:7:349:9 | call to unordered_map | map.cpp:340:49:340:54 | call to source |
+| map.cpp:350:7:350:9 | call to unordered_map | map.cpp:341:49:341:54 | call to source |
+| map.cpp:351:7:351:9 | call to unordered_map | map.cpp:341:49:341:54 | call to source |
 | map.cpp:359:7:359:9 | call to unordered_map | map.cpp:355:49:355:54 | call to source |
-| map.cpp:362:7:362:9 | call to unordered_map | map.cpp:352:49:352:54 | call to source |
+| map.cpp:362:7:362:9 | call to unordered_map | map.cpp:358:49:358:54 | call to source |
 | map.cpp:365:7:365:9 | call to unordered_map | map.cpp:355:49:355:54 | call to source |
-| map.cpp:371:7:371:9 | call to unordered_map | map.cpp:369:49:369:54 | call to source |
-| map.cpp:371:7:371:9 | call to unordered_map | map.cpp:370:49:370:54 | call to source |
-| map.cpp:372:11:372:15 | call to erase | map.cpp:369:49:369:54 | call to source |
-| map.cpp:372:11:372:15 | call to erase | map.cpp:370:49:370:54 | call to source |
-| map.cpp:373:7:373:9 | call to unordered_map | map.cpp:369:49:369:54 | call to source |
-| map.cpp:373:7:373:9 | call to unordered_map | map.cpp:370:49:370:54 | call to source |
-| map.cpp:375:7:375:9 | call to unordered_map | map.cpp:369:49:369:54 | call to source |
-| map.cpp:375:7:375:9 | call to unordered_map | map.cpp:370:49:370:54 | call to source |
+| map.cpp:367:7:367:9 | call to unordered_map | map.cpp:358:49:358:54 | call to source |
+| map.cpp:368:7:368:9 | call to unordered_map | map.cpp:358:49:358:54 | call to source |
+| map.cpp:374:7:374:9 | call to unordered_map | map.cpp:372:49:372:54 | call to source |
+| map.cpp:374:7:374:9 | call to unordered_map | map.cpp:373:49:373:54 | call to source |
+| map.cpp:375:11:375:15 | call to erase | map.cpp:372:49:372:54 | call to source |
+| map.cpp:375:11:375:15 | call to erase | map.cpp:373:49:373:54 | call to source |
+| map.cpp:376:7:376:9 | call to unordered_map | map.cpp:372:49:372:54 | call to source |
+| map.cpp:376:7:376:9 | call to unordered_map | map.cpp:373:49:373:54 | call to source |
+| map.cpp:378:7:378:9 | call to unordered_map | map.cpp:372:49:372:54 | call to source |
+| map.cpp:378:7:378:9 | call to unordered_map | map.cpp:373:49:373:54 | call to source |
+| map.cpp:385:7:385:9 | call to unordered_map | map.cpp:384:26:384:31 | call to source |
+| map.cpp:388:11:388:22 | call to emplace_hint | map.cpp:388:44:388:49 | call to source |
+| map.cpp:389:7:389:9 | call to unordered_map | map.cpp:388:44:388:49 | call to source |
+| map.cpp:398:7:398:9 | call to unordered_map | map.cpp:396:30:396:35 | call to source |
+| map.cpp:398:7:398:9 | call to unordered_map | map.cpp:397:30:397:35 | call to source |
+| map.cpp:401:11:401:21 | call to try_emplace | map.cpp:401:43:401:48 | call to source |
+| map.cpp:402:7:402:9 | call to unordered_map | map.cpp:401:43:401:48 | call to source |
+| map.cpp:416:7:416:41 | call to pair | map.cpp:416:30:416:35 | call to source |
+| map.cpp:417:7:417:9 | call to unordered_map | map.cpp:416:30:416:35 | call to source |
+| map.cpp:418:7:418:16 | call to pair | map.cpp:416:30:416:35 | call to source |
+| map.cpp:419:7:419:41 | call to pair | map.cpp:419:33:419:38 | call to source |
+| map.cpp:420:7:420:9 | call to unordered_map | map.cpp:419:33:419:38 | call to source |
+| map.cpp:421:7:421:16 | call to pair | map.cpp:419:33:419:38 | call to source |
+| map.cpp:432:7:432:9 | call to unordered_map | map.cpp:431:52:431:57 | call to source |
+| map.cpp:433:11:433:22 | call to emplace_hint | map.cpp:431:52:431:57 | call to source |
 | movableclass.cpp:44:8:44:9 | s1 | movableclass.cpp:39:21:39:26 | call to source |
 | movableclass.cpp:45:8:45:9 | s2 | movableclass.cpp:40:23:40:28 | call to source |
 | movableclass.cpp:46:8:46:9 | s3 | movableclass.cpp:42:8:42:13 | call to source |
@@ -158,6 +184,8 @@
 | set.cpp:50:10:50:13 | call to find | set.cpp:20:17:20:22 | call to source |
 | set.cpp:51:11:51:14 | call to find | set.cpp:20:17:20:22 | call to source |
 | set.cpp:61:8:61:8 | call to operator* | set.cpp:20:17:20:22 | call to source |
+| set.cpp:69:11:69:21 | call to lower_bound | set.cpp:67:13:67:18 | call to source |
+| set.cpp:70:11:70:21 | call to upper_bound | set.cpp:67:13:67:18 | call to source |
 | set.cpp:78:7:78:9 | call to set | set.cpp:76:13:76:18 | call to source |
 | set.cpp:81:7:81:9 | call to set | set.cpp:77:13:77:18 | call to source |
 | set.cpp:84:7:84:9 | call to set | set.cpp:76:13:76:18 | call to source |
@@ -167,6 +195,7 @@
 | set.cpp:95:7:95:9 | call to set | set.cpp:91:13:91:18 | call to source |
 | set.cpp:98:7:98:9 | call to set | set.cpp:94:13:94:18 | call to source |
 | set.cpp:101:7:101:9 | call to set | set.cpp:91:13:91:18 | call to source |
+| set.cpp:103:7:103:9 | call to set | set.cpp:94:13:94:18 | call to source |
 | set.cpp:104:7:104:9 | call to set | set.cpp:94:13:94:18 | call to source |
 | set.cpp:110:7:110:9 | call to set | set.cpp:108:13:108:18 | call to source |
 | set.cpp:110:7:110:9 | call to set | set.cpp:109:13:109:18 | call to source |
@@ -176,6 +205,9 @@
 | set.cpp:112:7:112:9 | call to set | set.cpp:109:13:109:18 | call to source |
 | set.cpp:114:7:114:9 | call to set | set.cpp:108:13:108:18 | call to source |
 | set.cpp:114:7:114:9 | call to set | set.cpp:109:13:109:18 | call to source |
+| set.cpp:121:7:121:9 | call to set | set.cpp:120:19:120:24 | call to source |
+| set.cpp:124:11:124:22 | call to emplace_hint | set.cpp:124:37:124:42 | call to source |
+| set.cpp:125:7:125:9 | call to set | set.cpp:124:37:124:42 | call to source |
 | set.cpp:136:10:136:15 | call to insert | set.cpp:136:29:136:34 | call to source |
 | set.cpp:140:7:140:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
 | set.cpp:142:7:142:8 | call to unordered_set | set.cpp:136:29:136:34 | call to source |
@@ -201,6 +233,7 @@
 | set.cpp:207:7:207:9 | call to unordered_set | set.cpp:203:13:203:18 | call to source |
 | set.cpp:210:7:210:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
 | set.cpp:213:7:213:9 | call to unordered_set | set.cpp:203:13:203:18 | call to source |
+| set.cpp:215:7:215:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
 | set.cpp:216:7:216:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
 | set.cpp:222:7:222:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
 | set.cpp:222:7:222:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
@@ -210,6 +243,9 @@
 | set.cpp:224:7:224:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
 | set.cpp:226:7:226:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
 | set.cpp:226:7:226:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
+| set.cpp:233:7:233:9 | call to unordered_set | set.cpp:232:19:232:24 | call to source |
+| set.cpp:236:11:236:22 | call to emplace_hint | set.cpp:236:37:236:42 | call to source |
+| set.cpp:237:7:237:9 | call to unordered_set | set.cpp:236:37:236:42 | call to source |
 | smart_pointer.cpp:12:10:12:10 | call to operator* | smart_pointer.cpp:11:52:11:57 | call to source |
 | smart_pointer.cpp:13:10:13:10 | p | smart_pointer.cpp:11:52:11:57 | call to source |
 | smart_pointer.cpp:24:10:24:10 | call to operator* | smart_pointer.cpp:23:52:23:57 | call to source |

cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected

@@ -17,91 +17,119 @@
 | copyableclass.cpp:67:11:67:21 | copyableclass.cpp:67:13:67:18 | IR only |
 | copyableclass_declonly.cpp:42:8:42:9 | copyableclass_declonly.cpp:34:30:34:35 | AST only |
 | copyableclass_declonly.cpp:67:11:67:11 | copyableclass_declonly.cpp:67:13:67:18 | AST only |
-| map.cpp:46:9:46:13 | map.cpp:45:37:45:42 | IR only |
-| map.cpp:51:9:51:13 | map.cpp:45:37:45:42 | IR only |
-| map.cpp:57:9:57:13 | map.cpp:45:37:45:42 | IR only |
-| map.cpp:67:9:67:13 | map.cpp:62:37:62:42 | IR only |
-| map.cpp:68:9:68:14 | map.cpp:62:37:62:42 | IR only |
-| map.cpp:70:9:70:13 | map.cpp:62:37:62:42 | IR only |
-| map.cpp:73:9:73:13 | map.cpp:63:37:63:42 | IR only |
-| map.cpp:76:9:76:13 | map.cpp:63:37:63:42 | IR only |
-| map.cpp:77:9:77:14 | map.cpp:63:37:63:42 | IR only |
-| map.cpp:87:34:87:38 | map.cpp:87:24:87:29 | IR only |
-| map.cpp:88:34:88:39 | map.cpp:88:24:88:29 | IR only |
-| map.cpp:105:7:105:54 | map.cpp:105:39:105:44 | IR only |
-| map.cpp:108:7:108:48 | map.cpp:108:34:108:39 | IR only |
-| map.cpp:111:7:111:8 | map.cpp:105:39:105:44 | AST only |
-| map.cpp:113:7:113:8 | map.cpp:107:62:107:67 | AST only |
-| map.cpp:114:7:114:8 | map.cpp:108:34:108:39 | AST only |
-| map.cpp:115:7:115:8 | map.cpp:109:46:109:51 | AST only |
-| map.cpp:120:10:120:13 | map.cpp:108:34:108:39 | AST only |
-| map.cpp:121:10:121:13 | map.cpp:109:46:109:51 | AST only |
-| map.cpp:126:10:126:13 | map.cpp:108:34:108:39 | AST only |
-| map.cpp:127:10:127:13 | map.cpp:109:46:109:51 | AST only |
-| map.cpp:134:7:134:8 | map.cpp:105:39:105:44 | AST only |
-| map.cpp:135:7:135:8 | map.cpp:105:39:105:44 | AST only |
-| map.cpp:136:7:136:8 | map.cpp:105:39:105:44 | AST only |
-| map.cpp:137:10:137:13 | map.cpp:105:39:105:44 | AST only |
-| map.cpp:138:10:138:13 | map.cpp:105:39:105:44 | AST only |
-| map.cpp:152:12:152:16 | map.cpp:105:39:105:44 | IR only |
-| map.cpp:153:12:153:17 | map.cpp:105:39:105:44 | IR only |
-| map.cpp:158:12:158:16 | map.cpp:105:39:105:44 | IR only |
-| map.cpp:159:12:159:17 | map.cpp:105:39:105:44 | IR only |
-| map.cpp:169:10:169:10 | map.cpp:165:20:165:25 | AST only |
-| map.cpp:171:10:171:10 | map.cpp:167:23:167:28 | AST only |
-| map.cpp:190:7:190:9 | map.cpp:188:49:188:54 | AST only |
-| map.cpp:193:7:193:9 | map.cpp:189:49:189:54 | AST only |
-| map.cpp:196:7:196:9 | map.cpp:188:49:188:54 | AST only |
-| map.cpp:197:7:197:9 | map.cpp:188:49:188:54 | AST only |
-| map.cpp:198:7:198:9 | map.cpp:189:49:189:54 | AST only |
-| map.cpp:199:7:199:9 | map.cpp:189:49:189:54 | AST only |
-| map.cpp:207:7:207:9 | map.cpp:203:49:203:54 | AST only |
+| map.cpp:49:9:49:13 | map.cpp:48:37:48:42 | IR only |
+| map.cpp:54:9:54:13 | map.cpp:48:37:48:42 | IR only |
+| map.cpp:60:9:60:13 | map.cpp:48:37:48:42 | IR only |
+| map.cpp:70:9:70:13 | map.cpp:65:37:65:42 | IR only |
+| map.cpp:71:9:71:14 | map.cpp:65:37:65:42 | IR only |
+| map.cpp:73:9:73:13 | map.cpp:65:37:65:42 | IR only |
+| map.cpp:76:9:76:13 | map.cpp:66:37:66:42 | IR only |
+| map.cpp:79:9:79:13 | map.cpp:66:37:66:42 | IR only |
+| map.cpp:80:9:80:14 | map.cpp:66:37:66:42 | IR only |
+| map.cpp:90:34:90:38 | map.cpp:90:24:90:29 | IR only |
+| map.cpp:91:34:91:39 | map.cpp:91:24:91:29 | IR only |
+| map.cpp:108:7:108:54 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:111:7:111:48 | map.cpp:111:34:111:39 | IR only |
+| map.cpp:114:7:114:8 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:116:7:116:8 | map.cpp:110:62:110:67 | AST only |
+| map.cpp:117:7:117:8 | map.cpp:111:34:111:39 | AST only |
+| map.cpp:118:7:118:8 | map.cpp:112:46:112:51 | AST only |
+| map.cpp:123:10:123:13 | map.cpp:111:34:111:39 | AST only |
+| map.cpp:124:10:124:13 | map.cpp:112:46:112:51 | AST only |
+| map.cpp:129:10:129:13 | map.cpp:111:34:111:39 | AST only |
+| map.cpp:130:10:130:13 | map.cpp:112:46:112:51 | AST only |
+| map.cpp:137:7:137:8 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:138:7:138:8 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:139:7:139:8 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:140:10:140:13 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:141:10:141:13 | map.cpp:108:39:108:44 | AST only |
+| map.cpp:155:12:155:16 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:156:12:156:17 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:161:12:161:16 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:162:12:162:17 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:172:10:172:10 | map.cpp:168:20:168:25 | AST only |
+| map.cpp:174:10:174:10 | map.cpp:170:23:170:28 | AST only |
+| map.cpp:184:7:184:31 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:185:7:185:32 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:187:7:187:32 | map.cpp:108:39:108:44 | IR only |
+| map.cpp:193:7:193:9 | map.cpp:191:49:191:54 | AST only |
+| map.cpp:196:7:196:9 | map.cpp:192:49:192:54 | AST only |
+| map.cpp:199:7:199:9 | map.cpp:191:49:191:54 | AST only |
+| map.cpp:200:7:200:9 | map.cpp:191:49:191:54 | AST only |
+| map.cpp:201:7:201:9 | map.cpp:192:49:192:54 | AST only |
+| map.cpp:202:7:202:9 | map.cpp:192:49:192:54 | AST only |
 | map.cpp:210:7:210:9 | map.cpp:206:49:206:54 | AST only |
-| map.cpp:213:7:213:9 | map.cpp:203:49:203:54 | AST only |
+| map.cpp:213:7:213:9 | map.cpp:209:49:209:54 | AST only |
 | map.cpp:216:7:216:9 | map.cpp:206:49:206:54 | AST only |
-| map.cpp:222:7:222:9 | map.cpp:220:49:220:54 | AST only |
-| map.cpp:222:7:222:9 | map.cpp:221:49:221:54 | AST only |
-| map.cpp:224:7:224:9 | map.cpp:220:49:220:54 | AST only |
-| map.cpp:224:7:224:9 | map.cpp:221:49:221:54 | AST only |
-| map.cpp:226:7:226:9 | map.cpp:220:49:220:54 | AST only |
-| map.cpp:226:7:226:9 | map.cpp:221:49:221:54 | AST only |
-| map.cpp:257:7:257:54 | map.cpp:257:39:257:44 | IR only |
-| map.cpp:260:7:260:48 | map.cpp:260:34:260:39 | IR only |
-| map.cpp:263:7:263:8 | map.cpp:257:39:257:44 | AST only |
-| map.cpp:265:7:265:8 | map.cpp:259:62:259:67 | AST only |
-| map.cpp:266:7:266:8 | map.cpp:260:34:260:39 | AST only |
-| map.cpp:267:7:267:8 | map.cpp:261:46:261:51 | AST only |
-| map.cpp:272:10:272:13 | map.cpp:260:34:260:39 | AST only |
-| map.cpp:273:10:273:13 | map.cpp:261:46:261:51 | AST only |
-| map.cpp:278:10:278:13 | map.cpp:260:34:260:39 | AST only |
-| map.cpp:279:10:279:13 | map.cpp:261:46:261:51 | AST only |
-| map.cpp:286:7:286:8 | map.cpp:257:39:257:44 | AST only |
-| map.cpp:287:7:287:8 | map.cpp:257:39:257:44 | AST only |
-| map.cpp:288:7:288:8 | map.cpp:257:39:257:44 | AST only |
-| map.cpp:289:10:289:13 | map.cpp:257:39:257:44 | AST only |
-| map.cpp:290:10:290:13 | map.cpp:257:39:257:44 | AST only |
-| map.cpp:304:12:304:16 | map.cpp:257:39:257:44 | IR only |
-| map.cpp:305:12:305:17 | map.cpp:257:39:257:44 | IR only |
-| map.cpp:310:12:310:16 | map.cpp:257:39:257:44 | IR only |
-| map.cpp:311:12:311:17 | map.cpp:257:39:257:44 | IR only |
-| map.cpp:321:10:321:10 | map.cpp:317:20:317:25 | AST only |
-| map.cpp:323:10:323:10 | map.cpp:319:23:319:28 | AST only |
-| map.cpp:339:7:339:9 | map.cpp:337:49:337:54 | AST only |
-| map.cpp:342:7:342:9 | map.cpp:338:49:338:54 | AST only |
-| map.cpp:345:7:345:9 | map.cpp:337:49:337:54 | AST only |
-| map.cpp:346:7:346:9 | map.cpp:337:49:337:54 | AST only |
-| map.cpp:347:7:347:9 | map.cpp:338:49:338:54 | AST only |
-| map.cpp:348:7:348:9 | map.cpp:338:49:338:54 | AST only |
-| map.cpp:356:7:356:9 | map.cpp:352:49:352:54 | AST only |
+| map.cpp:218:7:218:9 | map.cpp:209:49:209:54 | AST only |
+| map.cpp:219:7:219:9 | map.cpp:209:49:209:54 | AST only |
+| map.cpp:225:7:225:9 | map.cpp:223:49:223:54 | AST only |
+| map.cpp:225:7:225:9 | map.cpp:224:49:224:54 | AST only |
+| map.cpp:227:7:227:9 | map.cpp:223:49:223:54 | AST only |
+| map.cpp:227:7:227:9 | map.cpp:224:49:224:54 | AST only |
+| map.cpp:229:7:229:9 | map.cpp:223:49:223:54 | AST only |
+| map.cpp:229:7:229:9 | map.cpp:224:49:224:54 | AST only |
+| map.cpp:235:7:235:40 | map.cpp:235:26:235:31 | IR only |
+| map.cpp:236:7:236:9 | map.cpp:235:26:235:31 | AST only |
+| map.cpp:240:7:240:9 | map.cpp:239:44:239:49 | AST only |
+| map.cpp:246:7:246:44 | map.cpp:246:30:246:35 | IR only |
+| map.cpp:247:7:247:9 | map.cpp:246:30:246:35 | AST only |
+| map.cpp:251:7:251:9 | map.cpp:250:43:250:48 | AST only |
+| map.cpp:260:7:260:54 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:263:7:263:48 | map.cpp:263:34:263:39 | IR only |
+| map.cpp:266:7:266:8 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:268:7:268:8 | map.cpp:262:62:262:67 | AST only |
+| map.cpp:269:7:269:8 | map.cpp:263:34:263:39 | AST only |
+| map.cpp:270:7:270:8 | map.cpp:264:46:264:51 | AST only |
+| map.cpp:275:10:275:13 | map.cpp:263:34:263:39 | AST only |
+| map.cpp:276:10:276:13 | map.cpp:264:46:264:51 | AST only |
+| map.cpp:281:10:281:13 | map.cpp:263:34:263:39 | AST only |
+| map.cpp:282:10:282:13 | map.cpp:264:46:264:51 | AST only |
+| map.cpp:289:7:289:8 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:290:7:290:8 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:291:7:291:8 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:292:10:292:13 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:293:10:293:13 | map.cpp:260:39:260:44 | AST only |
+| map.cpp:307:12:307:16 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:308:12:308:17 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:313:12:313:16 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:314:12:314:17 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:324:10:324:10 | map.cpp:320:20:320:25 | AST only |
+| map.cpp:326:10:326:10 | map.cpp:322:23:322:28 | AST only |
+| map.cpp:334:7:334:31 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:335:7:335:32 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:336:7:336:32 | map.cpp:260:39:260:44 | IR only |
+| map.cpp:342:7:342:9 | map.cpp:340:49:340:54 | AST only |
+| map.cpp:345:7:345:9 | map.cpp:341:49:341:54 | AST only |
+| map.cpp:348:7:348:9 | map.cpp:340:49:340:54 | AST only |
+| map.cpp:349:7:349:9 | map.cpp:340:49:340:54 | AST only |
+| map.cpp:350:7:350:9 | map.cpp:341:49:341:54 | AST only |
+| map.cpp:351:7:351:9 | map.cpp:341:49:341:54 | AST only |
 | map.cpp:359:7:359:9 | map.cpp:355:49:355:54 | AST only |
-| map.cpp:362:7:362:9 | map.cpp:352:49:352:54 | AST only |
+| map.cpp:362:7:362:9 | map.cpp:358:49:358:54 | AST only |
 | map.cpp:365:7:365:9 | map.cpp:355:49:355:54 | AST only |
-| map.cpp:371:7:371:9 | map.cpp:369:49:369:54 | AST only |
-| map.cpp:371:7:371:9 | map.cpp:370:49:370:54 | AST only |
-| map.cpp:373:7:373:9 | map.cpp:369:49:369:54 | AST only |
-| map.cpp:373:7:373:9 | map.cpp:370:49:370:54 | AST only |
-| map.cpp:375:7:375:9 | map.cpp:369:49:369:54 | AST only |
-| map.cpp:375:7:375:9 | map.cpp:370:49:370:54 | AST only |
+| map.cpp:367:7:367:9 | map.cpp:358:49:358:54 | AST only |
+| map.cpp:368:7:368:9 | map.cpp:358:49:358:54 | AST only |
+| map.cpp:374:7:374:9 | map.cpp:372:49:372:54 | AST only |
+| map.cpp:374:7:374:9 | map.cpp:373:49:373:54 | AST only |
+| map.cpp:376:7:376:9 | map.cpp:372:49:372:54 | AST only |
+| map.cpp:376:7:376:9 | map.cpp:373:49:373:54 | AST only |
+| map.cpp:378:7:378:9 | map.cpp:372:49:372:54 | AST only |
+| map.cpp:378:7:378:9 | map.cpp:373:49:373:54 | AST only |
+| map.cpp:384:7:384:40 | map.cpp:384:26:384:31 | IR only |
+| map.cpp:385:7:385:9 | map.cpp:384:26:384:31 | AST only |
+| map.cpp:389:7:389:9 | map.cpp:388:44:388:49 | AST only |
+| map.cpp:396:7:396:44 | map.cpp:396:30:396:35 | IR only |
+| map.cpp:397:40:397:45 | map.cpp:397:30:397:35 | IR only |
+| map.cpp:398:7:398:9 | map.cpp:396:30:396:35 | AST only |
+| map.cpp:398:7:398:9 | map.cpp:397:30:397:35 | AST only |
+| map.cpp:402:7:402:9 | map.cpp:401:43:401:48 | AST only |
+| map.cpp:417:7:417:9 | map.cpp:416:30:416:35 | AST only |
+| map.cpp:418:7:418:16 | map.cpp:416:30:416:35 | AST only |
+| map.cpp:420:7:420:9 | map.cpp:419:33:419:38 | AST only |
+| map.cpp:421:7:421:16 | map.cpp:419:33:419:38 | AST only |
+| map.cpp:431:7:431:67 | map.cpp:431:52:431:57 | IR only |
+| map.cpp:432:7:432:9 | map.cpp:431:52:431:57 | AST only |
 | movableclass.cpp:65:11:65:11 | movableclass.cpp:65:13:65:18 | AST only |
 | movableclass.cpp:65:11:65:21 | movableclass.cpp:65:13:65:18 | IR only |
 | set.cpp:20:7:20:31 | set.cpp:20:17:20:22 | IR only |
@@ -115,6 +143,8 @@
 | set.cpp:48:10:48:13 | set.cpp:20:17:20:22 | AST only |
 | set.cpp:49:10:49:13 | set.cpp:20:17:20:22 | AST only |
 | set.cpp:61:8:61:11 | set.cpp:20:17:20:22 | IR only |
+| set.cpp:71:7:71:32 | set.cpp:67:13:67:18 | IR only |
+| set.cpp:72:7:72:33 | set.cpp:67:13:67:18 | IR only |
 | set.cpp:78:7:78:9 | set.cpp:76:13:76:18 | AST only |
 | set.cpp:81:7:81:9 | set.cpp:77:13:77:18 | AST only |
 | set.cpp:84:7:84:9 | set.cpp:76:13:76:18 | AST only |
@@ -124,6 +154,7 @@
 | set.cpp:95:7:95:9 | set.cpp:91:13:91:18 | AST only |
 | set.cpp:98:7:98:9 | set.cpp:94:13:94:18 | AST only |
 | set.cpp:101:7:101:9 | set.cpp:91:13:91:18 | AST only |
+| set.cpp:103:7:103:9 | set.cpp:94:13:94:18 | AST only |
 | set.cpp:104:7:104:9 | set.cpp:94:13:94:18 | AST only |
 | set.cpp:110:7:110:9 | set.cpp:108:13:108:18 | AST only |
 | set.cpp:110:7:110:9 | set.cpp:109:13:109:18 | AST only |
@@ -131,6 +162,9 @@
 | set.cpp:112:7:112:9 | set.cpp:109:13:109:18 | AST only |
 | set.cpp:114:7:114:9 | set.cpp:108:13:108:18 | AST only |
 | set.cpp:114:7:114:9 | set.cpp:109:13:109:18 | AST only |
+| set.cpp:120:7:120:33 | set.cpp:120:19:120:24 | IR only |
+| set.cpp:121:7:121:9 | set.cpp:120:19:120:24 | AST only |
+| set.cpp:125:7:125:9 | set.cpp:124:37:124:42 | AST only |
 | set.cpp:134:7:134:31 | set.cpp:134:17:134:22 | IR only |
 | set.cpp:140:7:140:8 | set.cpp:134:17:134:22 | AST only |
 | set.cpp:142:7:142:8 | set.cpp:136:29:136:34 | AST only |
@@ -142,6 +176,8 @@
 | set.cpp:162:10:162:13 | set.cpp:134:17:134:22 | AST only |
 | set.cpp:163:10:163:13 | set.cpp:134:17:134:22 | AST only |
 | set.cpp:175:8:175:11 | set.cpp:134:17:134:22 | IR only |
+| set.cpp:183:7:183:32 | set.cpp:181:13:181:18 | IR only |
+| set.cpp:184:7:184:33 | set.cpp:181:13:181:18 | IR only |
 | set.cpp:190:7:190:9 | set.cpp:188:13:188:18 | AST only |
 | set.cpp:193:7:193:9 | set.cpp:189:13:189:18 | AST only |
 | set.cpp:196:7:196:9 | set.cpp:188:13:188:18 | AST only |
@@ -151,6 +187,7 @@
 | set.cpp:207:7:207:9 | set.cpp:203:13:203:18 | AST only |
 | set.cpp:210:7:210:9 | set.cpp:206:13:206:18 | AST only |
 | set.cpp:213:7:213:9 | set.cpp:203:13:203:18 | AST only |
+| set.cpp:215:7:215:9 | set.cpp:206:13:206:18 | AST only |
 | set.cpp:216:7:216:9 | set.cpp:206:13:206:18 | AST only |
 | set.cpp:222:7:222:9 | set.cpp:220:13:220:18 | AST only |
 | set.cpp:222:7:222:9 | set.cpp:221:13:221:18 | AST only |
@@ -158,6 +195,9 @@
 | set.cpp:224:7:224:9 | set.cpp:221:13:221:18 | AST only |
 | set.cpp:226:7:226:9 | set.cpp:220:13:220:18 | AST only |
 | set.cpp:226:7:226:9 | set.cpp:221:13:221:18 | AST only |
+| set.cpp:232:7:232:33 | set.cpp:232:19:232:24 | IR only |
+| set.cpp:233:7:233:9 | set.cpp:232:19:232:24 | AST only |
+| set.cpp:237:7:237:9 | set.cpp:236:37:236:42 | AST only |
 | smart_pointer.cpp:12:10:12:10 | smart_pointer.cpp:11:52:11:57 | AST only |
 | smart_pointer.cpp:24:10:24:10 | smart_pointer.cpp:23:52:23:57 | AST only |
 | standalone_iterators.cpp:41:10:41:10 | standalone_iterators.cpp:39:45:39:51 | AST only |

cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected

@@ -42,69 +42,91 @@
 | format.cpp:115:8:115:13 | Argument 0 indirection | format.cpp:114:37:114:50 | call to source |
 | format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
 | format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
-| map.cpp:26:9:26:13 | first | map.cpp:25:12:25:17 | call to source |
-| map.cpp:32:9:32:14 | second | map.cpp:30:13:30:18 | call to source |
-| map.cpp:41:9:41:13 | first | map.cpp:40:30:40:35 | call to source |
-| map.cpp:46:9:46:13 | first | map.cpp:45:37:45:42 | call to source |
-| map.cpp:47:9:47:14 | second | map.cpp:45:37:45:42 | call to source |
-| map.cpp:48:7:48:7 | f | map.cpp:45:37:45:42 | call to source |
-| map.cpp:51:9:51:13 | first | map.cpp:45:37:45:42 | call to source |
-| map.cpp:52:9:52:14 | second | map.cpp:45:37:45:42 | call to source |
-| map.cpp:53:7:53:7 | g | map.cpp:45:37:45:42 | call to source |
-| map.cpp:57:9:57:13 | first | map.cpp:45:37:45:42 | call to source |
-| map.cpp:58:9:58:14 | second | map.cpp:45:37:45:42 | call to source |
-| map.cpp:59:7:59:7 | h | map.cpp:45:37:45:42 | call to source |
-| map.cpp:67:9:67:13 | first | map.cpp:62:37:62:42 | call to source |
-| map.cpp:68:9:68:14 | second | map.cpp:62:37:62:42 | call to source |
-| map.cpp:69:7:69:7 | i | map.cpp:62:37:62:42 | call to source |
-| map.cpp:70:9:70:13 | first | map.cpp:62:37:62:42 | call to source |
-| map.cpp:71:9:71:14 | second | map.cpp:62:37:62:42 | call to source |
-| map.cpp:72:7:72:7 | j | map.cpp:62:37:62:42 | call to source |
-| map.cpp:73:9:73:13 | first | map.cpp:63:37:63:42 | call to source |
-| map.cpp:74:9:74:14 | second | map.cpp:63:37:63:42 | call to source |
-| map.cpp:75:7:75:7 | k | map.cpp:63:37:63:42 | call to source |
-| map.cpp:76:9:76:13 | first | map.cpp:63:37:63:42 | call to source |
-| map.cpp:77:9:77:14 | second | map.cpp:63:37:63:42 | call to source |
-| map.cpp:78:7:78:7 | l | map.cpp:63:37:63:42 | call to source |
-| map.cpp:86:7:86:32 | call to pair | map.cpp:86:24:86:29 | call to source |
-| map.cpp:87:34:87:38 | first | map.cpp:87:24:87:29 | call to source |
-| map.cpp:88:34:88:39 | second | map.cpp:88:24:88:29 | call to source |
-| map.cpp:105:7:105:54 | call to iterator | map.cpp:105:39:105:44 | call to source |
-| map.cpp:107:10:107:15 | call to insert | map.cpp:107:62:107:67 | call to source |
-| map.cpp:108:7:108:48 | call to iterator | map.cpp:108:34:108:39 | call to source |
-| map.cpp:109:10:109:25 | call to insert_or_assign | map.cpp:109:46:109:51 | call to source |
-| map.cpp:117:10:117:13 | call to find | map.cpp:105:39:105:44 | call to source |
-| map.cpp:119:10:119:13 | call to find | map.cpp:107:62:107:67 | call to source |
-| map.cpp:123:10:123:13 | call to find | map.cpp:105:39:105:44 | call to source |
-| map.cpp:125:10:125:13 | call to find | map.cpp:107:62:107:67 | call to source |
-| map.cpp:139:10:139:13 | call to find | map.cpp:105:39:105:44 | call to source |
-| map.cpp:151:8:151:10 | call to pair | map.cpp:105:39:105:44 | call to source |
-| map.cpp:152:12:152:16 | first | map.cpp:105:39:105:44 | call to source |
-| map.cpp:153:12:153:17 | second | map.cpp:105:39:105:44 | call to source |
-| map.cpp:158:12:158:16 | first | map.cpp:105:39:105:44 | call to source |
-| map.cpp:159:12:159:17 | second | map.cpp:105:39:105:44 | call to source |
-| map.cpp:165:7:165:27 | ... = ... | map.cpp:165:20:165:25 | call to source |
-| map.cpp:167:7:167:30 | ... = ... | map.cpp:167:23:167:28 | call to source |
-| map.cpp:223:11:223:15 | call to erase | map.cpp:220:49:220:54 | call to source |
-| map.cpp:223:11:223:15 | call to erase | map.cpp:221:49:221:54 | call to source |
-| map.cpp:257:7:257:54 | call to iterator | map.cpp:257:39:257:44 | call to source |
-| map.cpp:259:10:259:15 | call to insert | map.cpp:259:62:259:67 | call to source |
-| map.cpp:260:7:260:48 | call to iterator | map.cpp:260:34:260:39 | call to source |
-| map.cpp:261:10:261:25 | call to insert_or_assign | map.cpp:261:46:261:51 | call to source |
-| map.cpp:269:10:269:13 | call to find | map.cpp:257:39:257:44 | call to source |
-| map.cpp:271:10:271:13 | call to find | map.cpp:259:62:259:67 | call to source |
-| map.cpp:275:10:275:13 | call to find | map.cpp:257:39:257:44 | call to source |
-| map.cpp:277:10:277:13 | call to find | map.cpp:259:62:259:67 | call to source |
-| map.cpp:291:10:291:13 | call to find | map.cpp:257:39:257:44 | call to source |
-| map.cpp:303:8:303:10 | call to pair | map.cpp:257:39:257:44 | call to source |
-| map.cpp:304:12:304:16 | first | map.cpp:257:39:257:44 | call to source |
-| map.cpp:305:12:305:17 | second | map.cpp:257:39:257:44 | call to source |
-| map.cpp:310:12:310:16 | first | map.cpp:257:39:257:44 | call to source |
-| map.cpp:311:12:311:17 | second | map.cpp:257:39:257:44 | call to source |
-| map.cpp:317:7:317:27 | ... = ... | map.cpp:317:20:317:25 | call to source |
-| map.cpp:319:7:319:30 | ... = ... | map.cpp:319:23:319:28 | call to source |
-| map.cpp:372:11:372:15 | call to erase | map.cpp:369:49:369:54 | call to source |
-| map.cpp:372:11:372:15 | call to erase | map.cpp:370:49:370:54 | call to source |
+| map.cpp:29:9:29:13 | first | map.cpp:28:12:28:17 | call to source |
+| map.cpp:35:9:35:14 | second | map.cpp:33:13:33:18 | call to source |
+| map.cpp:44:9:44:13 | first | map.cpp:43:30:43:35 | call to source |
+| map.cpp:49:9:49:13 | first | map.cpp:48:37:48:42 | call to source |
+| map.cpp:50:9:50:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:51:7:51:7 | f | map.cpp:48:37:48:42 | call to source |
+| map.cpp:54:9:54:13 | first | map.cpp:48:37:48:42 | call to source |
+| map.cpp:55:9:55:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:56:7:56:7 | g | map.cpp:48:37:48:42 | call to source |
+| map.cpp:60:9:60:13 | first | map.cpp:48:37:48:42 | call to source |
+| map.cpp:61:9:61:14 | second | map.cpp:48:37:48:42 | call to source |
+| map.cpp:62:7:62:7 | h | map.cpp:48:37:48:42 | call to source |
+| map.cpp:70:9:70:13 | first | map.cpp:65:37:65:42 | call to source |
+| map.cpp:71:9:71:14 | second | map.cpp:65:37:65:42 | call to source |
+| map.cpp:72:7:72:7 | i | map.cpp:65:37:65:42 | call to source |
+| map.cpp:73:9:73:13 | first | map.cpp:65:37:65:42 | call to source |
+| map.cpp:74:9:74:14 | second | map.cpp:65:37:65:42 | call to source |
+| map.cpp:75:7:75:7 | j | map.cpp:65:37:65:42 | call to source |
+| map.cpp:76:9:76:13 | first | map.cpp:66:37:66:42 | call to source |
+| map.cpp:77:9:77:14 | second | map.cpp:66:37:66:42 | call to source |
+| map.cpp:78:7:78:7 | k | map.cpp:66:37:66:42 | call to source |
+| map.cpp:79:9:79:13 | first | map.cpp:66:37:66:42 | call to source |
+| map.cpp:80:9:80:14 | second | map.cpp:66:37:66:42 | call to source |
+| map.cpp:81:7:81:7 | l | map.cpp:66:37:66:42 | call to source |
+| map.cpp:89:7:89:32 | call to pair | map.cpp:89:24:89:29 | call to source |
+| map.cpp:90:34:90:38 | first | map.cpp:90:24:90:29 | call to source |
+| map.cpp:91:34:91:39 | second | map.cpp:91:24:91:29 | call to source |
+| map.cpp:108:7:108:54 | call to iterator | map.cpp:108:39:108:44 | call to source |
+| map.cpp:110:10:110:15 | call to insert | map.cpp:110:62:110:67 | call to source |
+| map.cpp:111:7:111:48 | call to iterator | map.cpp:111:34:111:39 | call to source |
+| map.cpp:112:10:112:25 | call to insert_or_assign | map.cpp:112:46:112:51 | call to source |
+| map.cpp:120:10:120:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:122:10:122:13 | call to find | map.cpp:110:62:110:67 | call to source |
+| map.cpp:126:10:126:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:128:10:128:13 | call to find | map.cpp:110:62:110:67 | call to source |
+| map.cpp:142:10:142:13 | call to find | map.cpp:108:39:108:44 | call to source |
+| map.cpp:154:8:154:10 | call to pair | map.cpp:108:39:108:44 | call to source |
+| map.cpp:155:12:155:16 | first | map.cpp:108:39:108:44 | call to source |
+| map.cpp:156:12:156:17 | second | map.cpp:108:39:108:44 | call to source |
+| map.cpp:161:12:161:16 | first | map.cpp:108:39:108:44 | call to source |
+| map.cpp:162:12:162:17 | second | map.cpp:108:39:108:44 | call to source |
+| map.cpp:168:7:168:27 | ... = ... | map.cpp:168:20:168:25 | call to source |
+| map.cpp:170:7:170:30 | ... = ... | map.cpp:170:23:170:28 | call to source |
+| map.cpp:182:10:182:20 | call to lower_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:183:10:183:20 | call to upper_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:184:7:184:31 | call to iterator | map.cpp:108:39:108:44 | call to source |
+| map.cpp:185:7:185:32 | call to iterator | map.cpp:108:39:108:44 | call to source |
+| map.cpp:186:10:186:20 | call to upper_bound | map.cpp:108:39:108:44 | call to source |
+| map.cpp:187:7:187:32 | call to iterator | map.cpp:108:39:108:44 | call to source |
+| map.cpp:226:11:226:15 | call to erase | map.cpp:223:49:223:54 | call to source |
+| map.cpp:226:11:226:15 | call to erase | map.cpp:224:49:224:54 | call to source |
+| map.cpp:235:7:235:40 | call to iterator | map.cpp:235:26:235:31 | call to source |
+| map.cpp:239:11:239:22 | call to emplace_hint | map.cpp:239:44:239:49 | call to source |
+| map.cpp:246:7:246:44 | call to iterator | map.cpp:246:30:246:35 | call to source |
+| map.cpp:250:11:250:21 | call to try_emplace | map.cpp:250:43:250:48 | call to source |
+| map.cpp:260:7:260:54 | call to iterator | map.cpp:260:39:260:44 | call to source |
+| map.cpp:262:10:262:15 | call to insert | map.cpp:262:62:262:67 | call to source |
+| map.cpp:263:7:263:48 | call to iterator | map.cpp:263:34:263:39 | call to source |
+| map.cpp:264:10:264:25 | call to insert_or_assign | map.cpp:264:46:264:51 | call to source |
+| map.cpp:272:10:272:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:274:10:274:13 | call to find | map.cpp:262:62:262:67 | call to source |
+| map.cpp:278:10:278:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:280:10:280:13 | call to find | map.cpp:262:62:262:67 | call to source |
+| map.cpp:294:10:294:13 | call to find | map.cpp:260:39:260:44 | call to source |
+| map.cpp:306:8:306:10 | call to pair | map.cpp:260:39:260:44 | call to source |
+| map.cpp:307:12:307:16 | first | map.cpp:260:39:260:44 | call to source |
+| map.cpp:308:12:308:17 | second | map.cpp:260:39:260:44 | call to source |
+| map.cpp:313:12:313:16 | first | map.cpp:260:39:260:44 | call to source |
+| map.cpp:314:12:314:17 | second | map.cpp:260:39:260:44 | call to source |
+| map.cpp:320:7:320:27 | ... = ... | map.cpp:320:20:320:25 | call to source |
+| map.cpp:322:7:322:30 | ... = ... | map.cpp:322:23:322:28 | call to source |
+| map.cpp:334:7:334:31 | call to iterator | map.cpp:260:39:260:44 | call to source |
+| map.cpp:335:7:335:32 | call to iterator | map.cpp:260:39:260:44 | call to source |
+| map.cpp:336:7:336:32 | call to iterator | map.cpp:260:39:260:44 | call to source |
+| map.cpp:375:11:375:15 | call to erase | map.cpp:372:49:372:54 | call to source |
+| map.cpp:375:11:375:15 | call to erase | map.cpp:373:49:373:54 | call to source |
+| map.cpp:384:7:384:40 | call to iterator | map.cpp:384:26:384:31 | call to source |
+| map.cpp:388:11:388:22 | call to emplace_hint | map.cpp:388:44:388:49 | call to source |
+| map.cpp:396:7:396:44 | call to iterator | map.cpp:396:30:396:35 | call to source |
+| map.cpp:397:40:397:45 | second | map.cpp:397:30:397:35 | call to source |
+| map.cpp:401:11:401:21 | call to try_emplace | map.cpp:401:43:401:48 | call to source |
+| map.cpp:416:7:416:41 | call to pair | map.cpp:416:30:416:35 | call to source |
+| map.cpp:419:7:419:41 | call to pair | map.cpp:419:33:419:38 | call to source |
+| map.cpp:431:7:431:67 | call to iterator | map.cpp:431:52:431:57 | call to source |
+| map.cpp:433:11:433:22 | call to emplace_hint | map.cpp:431:52:431:57 | call to source |
 | movableclass.cpp:44:8:44:9 | s1 | movableclass.cpp:39:21:39:26 | call to source |
 | movableclass.cpp:45:8:45:9 | s2 | movableclass.cpp:40:23:40:28 | call to source |
 | movableclass.cpp:46:8:46:9 | s3 | movableclass.cpp:42:8:42:13 | call to source |
@@ -121,8 +143,14 @@
 | set.cpp:51:11:51:14 | call to find | set.cpp:20:17:20:22 | call to source |
 | set.cpp:61:8:61:8 | call to operator* | set.cpp:20:17:20:22 | call to source |
 | set.cpp:61:8:61:11 | (reference dereference) | set.cpp:20:17:20:22 | call to source |
+| set.cpp:69:11:69:21 | call to lower_bound | set.cpp:67:13:67:18 | call to source |
+| set.cpp:70:11:70:21 | call to upper_bound | set.cpp:67:13:67:18 | call to source |
+| set.cpp:71:7:71:32 | call to iterator | set.cpp:67:13:67:18 | call to source |
+| set.cpp:72:7:72:33 | call to iterator | set.cpp:67:13:67:18 | call to source |
 | set.cpp:111:11:111:15 | call to erase | set.cpp:108:13:108:18 | call to source |
 | set.cpp:111:11:111:15 | call to erase | set.cpp:109:13:109:18 | call to source |
+| set.cpp:120:7:120:33 | call to iterator | set.cpp:120:19:120:24 | call to source |
+| set.cpp:124:11:124:22 | call to emplace_hint | set.cpp:124:37:124:42 | call to source |
 | set.cpp:134:7:134:31 | call to iterator | set.cpp:134:17:134:22 | call to source |
 | set.cpp:136:10:136:15 | call to insert | set.cpp:136:29:136:34 | call to source |
 | set.cpp:146:10:146:13 | call to find | set.cpp:134:17:134:22 | call to source |
@@ -132,8 +160,12 @@
 | set.cpp:165:11:165:14 | call to find | set.cpp:134:17:134:22 | call to source |
 | set.cpp:175:8:175:8 | call to operator* | set.cpp:134:17:134:22 | call to source |
 | set.cpp:175:8:175:11 | (reference dereference) | set.cpp:134:17:134:22 | call to source |
+| set.cpp:183:7:183:32 | call to iterator | set.cpp:181:13:181:18 | call to source |
+| set.cpp:184:7:184:33 | call to iterator | set.cpp:181:13:181:18 | call to source |
 | set.cpp:223:11:223:15 | call to erase | set.cpp:220:13:220:18 | call to source |
 | set.cpp:223:11:223:15 | call to erase | set.cpp:221:13:221:18 | call to source |
+| set.cpp:232:7:232:33 | call to iterator | set.cpp:232:19:232:24 | call to source |
+| set.cpp:236:11:236:22 | call to emplace_hint | set.cpp:236:37:236:42 | call to source |
 | smart_pointer.cpp:13:10:13:10 | Argument 0 indirection | smart_pointer.cpp:11:52:11:57 | call to source |
 | smart_pointer.cpp:25:10:25:10 | Argument 0 indirection | smart_pointer.cpp:23:52:23:57 | call to source |
 | smart_pointer.cpp:52:12:52:14 | call to get | smart_pointer.cpp:51:52:51:57 | call to source |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected

@@ -582,6 +582,16 @@
 | test.c:635:9:635:10 | ss | -32768 |
 | test.c:638:7:638:8 | ss | -32768 |
 | test.c:639:9:639:10 | ss | -1 |
+| test.c:645:8:645:8 | s | -2147483648 |
+| test.c:645:15:645:15 | s | 0 |
+| test.c:645:23:645:23 | s | 0 |
+| test.c:646:18:646:18 | s | 0 |
+| test.c:646:22:646:22 | s | 0 |
+| test.c:647:9:647:14 | result | 0 |
+| test.c:653:7:653:7 | i | 0 |
+| test.c:654:9:654:9 | i | -2147483648 |
+| test.c:658:7:658:7 | u | 0 |
+| test.c:659:9:659:9 | u | 0 |
 | test.cpp:10:7:10:7 | b | -2147483648 |
 | test.cpp:11:5:11:5 | x | -2147483648 |
 | test.cpp:13:10:13:10 | x | -2147483648 |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c

@@ -638,4 +638,24 @@ void two_bounds_from_one_test(short ss, unsigned short us) {
   if (ss + 1 < sizeof(int)) {
     out(ss); // -1 .. 2
   }
-}
+}
+
+void widen_recursive_expr() {
+  int s;
+  for (s = 0; s < 10; s++) {
+    int result = s + s; // 0 .. 9 [BUG: upper bound is 15 due to widening]
+    out(result); // 0 .. 18 [BUG: upper bound is 127 due to double widening]
+  }
+}
+
+void guard_bound_out_of_range(void) {
+  int i = 0;
+  if (i < 0) {
+    out(i); // unreachable [BUG: is -max .. +max]
+  }
+
+  unsigned int u = 0;
+  if (u < 0) {
+    out(u); // unreachable [BUG: is 0 .. +max]
+  }
+}

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected

@@ -582,6 +582,16 @@
 | test.c:635:9:635:10 | ss | 32767 |
 | test.c:638:7:638:8 | ss | 32767 |
 | test.c:639:9:639:10 | ss | 2 |
+| test.c:645:8:645:8 | s | 2147483647 |
+| test.c:645:15:645:15 | s | 127 |
+| test.c:645:23:645:23 | s | 15 |
+| test.c:646:18:646:18 | s | 15 |
+| test.c:646:22:646:22 | s | 15 |
+| test.c:647:9:647:14 | result | 127 |
+| test.c:653:7:653:7 | i | 0 |
+| test.c:654:9:654:9 | i | 2147483647 |
+| test.c:658:7:658:7 | u | 0 |
+| test.c:659:9:659:9 | u | 4294967295 |
 | test.cpp:10:7:10:7 | b | 2147483647 |
 | test.cpp:11:5:11:5 | x | 2147483647 |
 | test.cpp:13:10:13:10 | x | 2147483647 |

cpp/ql/test/library-tests/syntax-zoo/dataflow-consistency.expected

@@ -70,3 +70,56 @@ argHasPostUpdate
 | destructors.cpp:52:14:52:16 | ref | ArgumentNode is missing PostUpdateNode. |
 | ir.cpp:623:5:623:5 | r | ArgumentNode is missing PostUpdateNode. |
 | ir.cpp:625:5:625:5 | s | ArgumentNode is missing PostUpdateNode. |
+postWithInFlow
+| VacuousDestructorCall.cpp:10:22:10:22 | i [inner post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:11:4:13 | m_x [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:17:4:19 | m_y [post update] | PostUpdateNode should not be the target of local flow. |
+| assignexpr.cpp:9:4:9:4 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:34:23:34:31 | staticint [inner post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:39:37:39:45 | carry_out [inner post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:43:41:43:49 | staticint [inner post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:51:30:51:38 | staticint [inner post update] | PostUpdateNode should not be the target of local flow. |
+| builtin.c:54:29:54:38 | atomic_int [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:3:5:3:9 | m_ptr [post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:17:11:17:15 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:20:11:20:15 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:28:11:28:15 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:31:11:31:15 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:34:9:34:13 | m_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| conditional_destructors.cpp:6:13:6:15 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| conditional_destructors.cpp:18:13:18:15 | val [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:7:7:7:8 | el [post update] | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:77:19:77:21 | call to Val | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:11:82:14 | call to Val | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:45:82:48 | call to Val | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:51:82:51 | call to Val | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:177:5:177:5 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:177:5:177:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:178:5:178:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:178:7:178:7 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:183:5:183:5 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:183:5:183:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:184:5:184:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:184:7:184:7 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:342:5:342:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:342:6:342:6 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:428:8:428:8 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:429:8:429:8 | y [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:643:15:643:17 | m_a [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:644:11:644:14 | this [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:644:17:644:19 | m_a [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:645:9:645:11 | m_a [post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:654:11:654:14 | this [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:745:8:745:8 | base_s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:754:8:754:8 | middle_s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:763:8:763:8 | derived_s [inner post update] | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:809:7:809:13 | call to Base | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:810:7:810:26 | call to Base | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:823:7:823:13 | call to Base | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:824:7:824:26 | call to Base | PostUpdateNode should not be the target of local flow. |
+| misc.c:130:7:130:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| misc.c:131:9:131:9 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| misc.c:220:3:220:5 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| misc.c:220:4:220:5 | sp [inner post update] | PostUpdateNode should not be the target of local flow. |
+| static_init_templates.cpp:3:2:3:4 | ref [post update] | PostUpdateNode should not be the target of local flow. |
+| static_init_templates.cpp:21:2:21:4 | val [post update] | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

@@ -1472,3 +1472,92 @@ uniquePostUpdate
 postIsInSameCallable
 reverseRead
 argHasPostUpdate
+postWithInFlow
+| aggregateinitializer.c:3:14:3:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| aggregateinitializer.c:3:21:3:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:3:27:3:27 | Chi | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:3:35:3:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:11:4:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:17:4:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| assignexpr.cpp:9:2:9:12 | Store | PostUpdateNode should not be the target of local flow. |
+| bad_asts.cpp:15:10:15:12 | Store | PostUpdateNode should not be the target of local flow. |
+| builtin.c:14:26:14:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| builtin.c:14:29:14:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| builtin.c:14:32:14:32 | Chi | PostUpdateNode should not be the target of local flow. |
+| builtin.c:14:35:14:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:3:5:3:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| condition_decls.cpp:3:21:3:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| conditional_destructors.cpp:6:13:6:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| conditional_destructors.cpp:18:13:18:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:65:19:65:45 | Store | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:17:82:55 | Chi | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:45:82:48 | Chi | PostUpdateNode should not be the target of local flow. |
+| defdestructordeleteexpr.cpp:4:9:4:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| deleteexpr.cpp:7:9:7:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:177:5:177:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:178:5:178:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:183:5:183:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:184:5:184:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:342:5:342:10 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:428:5:428:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:429:5:429:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:504:19:504:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:504:22:504:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:505:16:505:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:505:19:505:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:506:16:506:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:506:16:506:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:513:14:513:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:513:14:513:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:514:14:514:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:514:19:514:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:514:22:514:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:515:19:515:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:515:22:515:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:515:29:515:29 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:515:32:515:32 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:516:17:516:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:516:19:516:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:516:24:516:28 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:516:26:516:26 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:521:19:521:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:521:22:521:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:521:25:521:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:522:16:522:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:522:19:522:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:531:14:531:14 | Store | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:577:16:577:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:577:19:577:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:578:19:578:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:578:22:578:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:579:16:579:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:579:19:579:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:643:9:643:21 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:644:9:644:23 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:645:9:645:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:659:9:659:14 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:660:13:660:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:661:9:661:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:943:3:943:11 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:947:3:947:25 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:26:962:30 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:962:41:962:45 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:130:5:130:11 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:131:5:131:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:154:32:154:32 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:154:35:154:35 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:154:40:154:40 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:154:43:154:43 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:157:14:157:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:158:14:158:18 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:160:31:160:33 | Chi | PostUpdateNode should not be the target of local flow. |
+| misc.c:160:31:160:33 | Chi | PostUpdateNode should not be the target of local flow. |
+| range_analysis.c:102:5:102:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| static_init_templates.cpp:3:2:3:8 | Chi | PostUpdateNode should not be the target of local flow. |
+| static_init_templates.cpp:21:2:21:12 | Chi | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected

@@ -30,39 +30,39 @@ test.cpp:
 #    3|         valnum = unique
 #    5|     r5_1(glval<int>)           = VariableAddress[p0]     : 
 #    5|         valnum = r1_5, r5_1, r6_1
-#    5|     r5_2(int)                  = Load                    : &:r5_1, m1_6
+#    5|     r5_2(int)                  = Load[p0]                : &:r5_1, m1_6
 #    5|         valnum = m1_6, r5_2, r6_2
 #    5|     r5_3(glval<int>)           = VariableAddress[p1]     : 
 #    5|         valnum = r1_7, r5_3, r6_3
-#    5|     r5_4(int)                  = Load                    : &:r5_3, m1_8
+#    5|     r5_4(int)                  = Load[p1]                : &:r5_3, m1_8
 #    5|         valnum = m1_8, r5_4, r6_4
 #    5|     r5_5(int)                  = Add                     : r5_2, r5_4
 #    5|         valnum = m5_7, m6_7, m7_4, r5_5, r6_5, r7_2
 #    5|     r5_6(glval<int>)           = VariableAddress[x]      : 
 #    5|         valnum = r2_1, r5_6, r6_6, r7_1
-#    5|     m5_7(int)                  = Store                   : &:r5_6, r5_5
+#    5|     m5_7(int)                  = Store[x]                : &:r5_6, r5_5
 #    5|         valnum = m5_7, m6_7, m7_4, r5_5, r6_5, r7_2
 #    6|     r6_1(glval<int>)           = VariableAddress[p0]     : 
 #    6|         valnum = r1_5, r5_1, r6_1
-#    6|     r6_2(int)                  = Load                    : &:r6_1, m1_6
+#    6|     r6_2(int)                  = Load[p0]                : &:r6_1, m1_6
 #    6|         valnum = m1_6, r5_2, r6_2
 #    6|     r6_3(glval<int>)           = VariableAddress[p1]     : 
 #    6|         valnum = r1_7, r5_3, r6_3
-#    6|     r6_4(int)                  = Load                    : &:r6_3, m1_8
+#    6|     r6_4(int)                  = Load[p1]                : &:r6_3, m1_8
 #    6|         valnum = m1_8, r5_4, r6_4
 #    6|     r6_5(int)                  = Add                     : r6_2, r6_4
 #    6|         valnum = m5_7, m6_7, m7_4, r5_5, r6_5, r7_2
 #    6|     r6_6(glval<int>)           = VariableAddress[x]      : 
 #    6|         valnum = r2_1, r5_6, r6_6, r7_1
-#    6|     m6_7(int)                  = Store                   : &:r6_6, r6_5
+#    6|     m6_7(int)                  = Store[x]                : &:r6_6, r6_5
 #    6|         valnum = m5_7, m6_7, m7_4, r5_5, r6_5, r7_2
 #    7|     r7_1(glval<int>)           = VariableAddress[x]      : 
 #    7|         valnum = r2_1, r5_6, r6_6, r7_1
-#    7|     r7_2(int)                  = Load                    : &:r7_1, m6_7
+#    7|     r7_2(int)                  = Load[x]                 : &:r7_1, m6_7
 #    7|         valnum = m5_7, m6_7, m7_4, r5_5, r6_5, r7_2
 #    7|     r7_3(glval<int>)           = VariableAddress[y]      : 
 #    7|         valnum = r2_3, r7_3
-#    7|     m7_4(int)                  = Store                   : &:r7_3, r7_2
+#    7|     m7_4(int)                  = Store[y]                : &:r7_3, r7_2
 #    7|         valnum = m5_7, m6_7, m7_4, r5_5, r6_5, r7_2
 #    8|     v8_1(void)                 = NoOp                    : 
 #    1|     v1_9(void)                 = ReturnVoid              : 
@@ -100,51 +100,51 @@ test.cpp:
 #   14|         valnum = unique
 #   16|     r16_1(glval<int>)           = VariableAddress[p0]       : 
 #   16|         valnum = r12_5, r16_1, r17_1
-#   16|     r16_2(int)                  = Load                      : &:r16_1, m12_6
+#   16|     r16_2(int)                  = Load[p0]                  : &:r16_1, m12_6
 #   16|         valnum = m12_6, r16_2, r17_2
 #   16|     r16_3(glval<int>)           = VariableAddress[p1]       : 
 #   16|         valnum = r12_7, r16_3, r17_3
-#   16|     r16_4(int)                  = Load                      : &:r16_3, m12_8
+#   16|     r16_4(int)                  = Load[p1]                  : &:r16_3, m12_8
 #   16|         valnum = m12_8, r16_4, r17_4
 #   16|     r16_5(int)                  = Add                       : r16_2, r16_4
 #   16|         valnum = r16_5, r17_5
 #   16|     r16_6(glval<int>)           = VariableAddress[global01] : 
 #   16|         valnum = r16_6, r17_6
-#   16|     r16_7(int)                  = Load                      : &:r16_6, ~m12_3
+#   16|     r16_7(int)                  = Load[global01]            : &:r16_6, ~m12_3
 #   16|         valnum = r16_7, r17_7
 #   16|     r16_8(int)                  = Add                       : r16_5, r16_7
 #   16|         valnum = m16_10, m17_10, m18_4, r16_8, r17_8, r18_2
 #   16|     r16_9(glval<int>)           = VariableAddress[x]        : 
 #   16|         valnum = r13_1, r16_9, r17_9, r18_1
-#   16|     m16_10(int)                 = Store                     : &:r16_9, r16_8
+#   16|     m16_10(int)                 = Store[x]                  : &:r16_9, r16_8
 #   16|         valnum = m16_10, m17_10, m18_4, r16_8, r17_8, r18_2
 #   17|     r17_1(glval<int>)           = VariableAddress[p0]       : 
 #   17|         valnum = r12_5, r16_1, r17_1
-#   17|     r17_2(int)                  = Load                      : &:r17_1, m12_6
+#   17|     r17_2(int)                  = Load[p0]                  : &:r17_1, m12_6
 #   17|         valnum = m12_6, r16_2, r17_2
 #   17|     r17_3(glval<int>)           = VariableAddress[p1]       : 
 #   17|         valnum = r12_7, r16_3, r17_3
-#   17|     r17_4(int)                  = Load                      : &:r17_3, m12_8
+#   17|     r17_4(int)                  = Load[p1]                  : &:r17_3, m12_8
 #   17|         valnum = m12_8, r16_4, r17_4
 #   17|     r17_5(int)                  = Add                       : r17_2, r17_4
 #   17|         valnum = r16_5, r17_5
 #   17|     r17_6(glval<int>)           = VariableAddress[global01] : 
 #   17|         valnum = r16_6, r17_6
-#   17|     r17_7(int)                  = Load                      : &:r17_6, ~m12_3
+#   17|     r17_7(int)                  = Load[global01]            : &:r17_6, ~m12_3
 #   17|         valnum = r16_7, r17_7
 #   17|     r17_8(int)                  = Add                       : r17_5, r17_7
 #   17|         valnum = m16_10, m17_10, m18_4, r16_8, r17_8, r18_2
 #   17|     r17_9(glval<int>)           = VariableAddress[x]        : 
 #   17|         valnum = r13_1, r16_9, r17_9, r18_1
-#   17|     m17_10(int)                 = Store                     : &:r17_9, r17_8
+#   17|     m17_10(int)                 = Store[x]                  : &:r17_9, r17_8
 #   17|         valnum = m16_10, m17_10, m18_4, r16_8, r17_8, r18_2
 #   18|     r18_1(glval<int>)           = VariableAddress[x]        : 
 #   18|         valnum = r13_1, r16_9, r17_9, r18_1
-#   18|     r18_2(int)                  = Load                      : &:r18_1, m17_10
+#   18|     r18_2(int)                  = Load[x]                   : &:r18_1, m17_10
 #   18|         valnum = m16_10, m17_10, m18_4, r16_8, r17_8, r18_2
 #   18|     r18_3(glval<int>)           = VariableAddress[y]        : 
 #   18|         valnum = r13_3, r18_3
-#   18|     m18_4(int)                  = Store                     : &:r18_3, r18_2
+#   18|     m18_4(int)                  = Store[y]                  : &:r18_3, r18_2
 #   18|         valnum = m16_10, m17_10, m18_4, r16_8, r17_8, r18_2
 #   19|     v19_1(void)                 = NoOp                      : 
 #   12|     v12_9(void)                 = ReturnVoid                : 
@@ -182,58 +182,58 @@ test.cpp:
 #   27|         valnum = unique
 #   29|     r29_1(glval<int>)           = VariableAddress[p0]              : 
 #   29|         valnum = r25_5, r29_1, r31_1
-#   29|     r29_2(int)                  = Load                             : &:r29_1, m25_6
+#   29|     r29_2(int)                  = Load[p0]                         : &:r29_1, m25_6
 #   29|         valnum = m25_6, r29_2, r31_2
 #   29|     r29_3(glval<int>)           = VariableAddress[p1]              : 
 #   29|         valnum = r25_7, r29_3, r31_3
-#   29|     r29_4(int)                  = Load                             : &:r29_3, m25_8
+#   29|     r29_4(int)                  = Load[p1]                         : &:r29_3, m25_8
 #   29|         valnum = m25_8, r29_4, r31_4
 #   29|     r29_5(int)                  = Add                              : r29_2, r29_4
 #   29|         valnum = r29_5, r31_5
 #   29|     r29_6(glval<int>)           = VariableAddress[global02]        : 
 #   29|         valnum = r29_6, r31_6
-#   29|     r29_7(int)                  = Load                             : &:r29_6, ~m25_3
+#   29|     r29_7(int)                  = Load[global02]                   : &:r29_6, ~m25_3
 #   29|         valnum = unique
 #   29|     r29_8(int)                  = Add                              : r29_5, r29_7
 #   29|         valnum = m29_10, r29_8
 #   29|     r29_9(glval<int>)           = VariableAddress[x]               : 
 #   29|         valnum = r26_1, r29_9, r31_9, r32_1
-#   29|     m29_10(int)                 = Store                            : &:r29_9, r29_8
+#   29|     m29_10(int)                 = Store[x]                         : &:r29_9, r29_8
 #   29|         valnum = m29_10, r29_8
 #   30|     r30_1(glval<unknown>)       = FunctionAddress[change_global02] : 
 #   30|         valnum = unique
-#   30|     v30_2(void)                 = Call                             : func:r30_1
+#   30|     v30_2(void)                 = Call[change_global02]            : func:r30_1
 #   30|     m30_3(unknown)              = ^CallSideEffect                  : ~m25_4
 #   30|         valnum = unique
 #   30|     m30_4(unknown)              = Chi                              : total:m25_4, partial:m30_3
 #   30|         valnum = unique
 #   31|     r31_1(glval<int>)           = VariableAddress[p0]              : 
 #   31|         valnum = r25_5, r29_1, r31_1
-#   31|     r31_2(int)                  = Load                             : &:r31_1, m25_6
+#   31|     r31_2(int)                  = Load[p0]                         : &:r31_1, m25_6
 #   31|         valnum = m25_6, r29_2, r31_2
 #   31|     r31_3(glval<int>)           = VariableAddress[p1]              : 
 #   31|         valnum = r25_7, r29_3, r31_3
-#   31|     r31_4(int)                  = Load                             : &:r31_3, m25_8
+#   31|     r31_4(int)                  = Load[p1]                         : &:r31_3, m25_8
 #   31|         valnum = m25_8, r29_4, r31_4
 #   31|     r31_5(int)                  = Add                              : r31_2, r31_4
 #   31|         valnum = r29_5, r31_5
 #   31|     r31_6(glval<int>)           = VariableAddress[global02]        : 
 #   31|         valnum = r29_6, r31_6
-#   31|     r31_7(int)                  = Load                             : &:r31_6, ~m30_4
+#   31|     r31_7(int)                  = Load[global02]                   : &:r31_6, ~m30_4
 #   31|         valnum = unique
 #   31|     r31_8(int)                  = Add                              : r31_5, r31_7
 #   31|         valnum = m31_10, m32_4, r31_8, r32_2
 #   31|     r31_9(glval<int>)           = VariableAddress[x]               : 
 #   31|         valnum = r26_1, r29_9, r31_9, r32_1
-#   31|     m31_10(int)                 = Store                            : &:r31_9, r31_8
+#   31|     m31_10(int)                 = Store[x]                         : &:r31_9, r31_8
 #   31|         valnum = m31_10, m32_4, r31_8, r32_2
 #   32|     r32_1(glval<int>)           = VariableAddress[x]               : 
 #   32|         valnum = r26_1, r29_9, r31_9, r32_1
-#   32|     r32_2(int)                  = Load                             : &:r32_1, m31_10
+#   32|     r32_2(int)                  = Load[x]                          : &:r32_1, m31_10
 #   32|         valnum = m31_10, m32_4, r31_8, r32_2
 #   32|     r32_3(glval<int>)           = VariableAddress[y]               : 
 #   32|         valnum = r26_3, r32_3
-#   32|     m32_4(int)                  = Store                            : &:r32_3, r32_2
+#   32|     m32_4(int)                  = Store[y]                         : &:r32_3, r32_2
 #   32|         valnum = m31_10, m32_4, r31_8, r32_2
 #   33|     v33_1(void)                 = NoOp                             : 
 #   25|     v25_9(void)                 = ReturnVoid                       : 
@@ -261,7 +261,7 @@ test.cpp:
 #   39|         valnum = r39_9, r44_2
 #   39|     m39_10(int *)               = InitializeParameter[p2]   : &:r39_9
 #   39|         valnum = m39_10, r39_11, r44_3, r44_4
-#   39|     r39_11(int *)               = Load                      : &:r39_9, m39_10
+#   39|     r39_11(int *)               = Load[p2]                  : &:r39_9, m39_10
 #   39|         valnum = m39_10, r39_11, r44_3, r44_4
 #   39|     m39_12(unknown)             = InitializeIndirection[p2] : &:r39_11
 #   39|         valnum = unique
@@ -279,63 +279,63 @@ test.cpp:
 #   41|         valnum = unique
 #   43|     r43_1(glval<int>)           = VariableAddress[p0]       : 
 #   43|         valnum = r39_5, r43_1, r45_1
-#   43|     r43_2(int)                  = Load                      : &:r43_1, m39_6
+#   43|     r43_2(int)                  = Load[p0]                  : &:r43_1, m39_6
 #   43|         valnum = m39_6, r43_2, r45_2
 #   43|     r43_3(glval<int>)           = VariableAddress[p1]       : 
 #   43|         valnum = r39_7, r43_3, r45_3
-#   43|     r43_4(int)                  = Load                      : &:r43_3, m39_8
+#   43|     r43_4(int)                  = Load[p1]                  : &:r43_3, m39_8
 #   43|         valnum = m39_8, r43_4, r45_4
 #   43|     r43_5(int)                  = Add                       : r43_2, r43_4
 #   43|         valnum = r43_5, r45_5
 #   43|     r43_6(glval<int>)           = VariableAddress[global03] : 
 #   43|         valnum = r43_6, r45_6
-#   43|     r43_7(int)                  = Load                      : &:r43_6, ~m39_3
+#   43|     r43_7(int)                  = Load[global03]            : &:r43_6, ~m39_3
 #   43|         valnum = r43_7, r45_7
 #   43|     r43_8(int)                  = Add                       : r43_5, r43_7
 #   43|         valnum = m43_10, m45_10, m46_4, r43_8, r45_8, r46_2
 #   43|     r43_9(glval<int>)           = VariableAddress[x]        : 
 #   43|         valnum = r40_1, r43_9, r45_9, r46_1
-#   43|     m43_10(int)                 = Store                     : &:r43_9, r43_8
+#   43|     m43_10(int)                 = Store[x]                  : &:r43_9, r43_8
 #   43|         valnum = m43_10, m45_10, m46_4, r43_8, r45_8, r46_2
 #   44|     r44_1(int)                  = Constant[0]               : 
 #   44|         valnum = m44_5, r44_1
 #   44|     r44_2(glval<int *>)         = VariableAddress[p2]       : 
 #   44|         valnum = r39_9, r44_2
-#   44|     r44_3(int *)                = Load                      : &:r44_2, m39_10
+#   44|     r44_3(int *)                = Load[p2]                  : &:r44_2, m39_10
 #   44|         valnum = m39_10, r39_11, r44_3, r44_4
 #   44|     r44_4(glval<int>)           = CopyValue                 : r44_3
 #   44|         valnum = m39_10, r39_11, r44_3, r44_4
-#   44|     m44_5(int)                  = Store                     : &:r44_4, r44_1
+#   44|     m44_5(int)                  = Store[?]                  : &:r44_4, r44_1
 #   44|         valnum = m44_5, r44_1
 #   44|     m44_6(unknown)              = Chi                       : total:m39_12, partial:m44_5
 #   44|         valnum = unique
 #   45|     r45_1(glval<int>)           = VariableAddress[p0]       : 
 #   45|         valnum = r39_5, r43_1, r45_1
-#   45|     r45_2(int)                  = Load                      : &:r45_1, m39_6
+#   45|     r45_2(int)                  = Load[p0]                  : &:r45_1, m39_6
 #   45|         valnum = m39_6, r43_2, r45_2
 #   45|     r45_3(glval<int>)           = VariableAddress[p1]       : 
 #   45|         valnum = r39_7, r43_3, r45_3
-#   45|     r45_4(int)                  = Load                      : &:r45_3, m39_8
+#   45|     r45_4(int)                  = Load[p1]                  : &:r45_3, m39_8
 #   45|         valnum = m39_8, r43_4, r45_4
 #   45|     r45_5(int)                  = Add                       : r45_2, r45_4
 #   45|         valnum = r43_5, r45_5
 #   45|     r45_6(glval<int>)           = VariableAddress[global03] : 
 #   45|         valnum = r43_6, r45_6
-#   45|     r45_7(int)                  = Load                      : &:r45_6, ~m39_3
+#   45|     r45_7(int)                  = Load[global03]            : &:r45_6, ~m39_3
 #   45|         valnum = r43_7, r45_7
 #   45|     r45_8(int)                  = Add                       : r45_5, r45_7
 #   45|         valnum = m43_10, m45_10, m46_4, r43_8, r45_8, r46_2
 #   45|     r45_9(glval<int>)           = VariableAddress[x]        : 
 #   45|         valnum = r40_1, r43_9, r45_9, r46_1
-#   45|     m45_10(int)                 = Store                     : &:r45_9, r45_8
+#   45|     m45_10(int)                 = Store[x]                  : &:r45_9, r45_8
 #   45|         valnum = m43_10, m45_10, m46_4, r43_8, r45_8, r46_2
 #   46|     r46_1(glval<int>)           = VariableAddress[x]        : 
 #   46|         valnum = r40_1, r43_9, r45_9, r46_1
-#   46|     r46_2(int)                  = Load                      : &:r46_1, m45_10
+#   46|     r46_2(int)                  = Load[x]                   : &:r46_1, m45_10
 #   46|         valnum = m43_10, m45_10, m46_4, r43_8, r45_8, r46_2
 #   46|     r46_3(glval<int>)           = VariableAddress[y]        : 
 #   46|         valnum = r40_3, r46_3
-#   46|     m46_4(int)                  = Store                     : &:r46_3, r46_2
+#   46|     m46_4(int)                  = Store[y]                  : &:r46_3, r46_2
 #   46|         valnum = m43_10, m45_10, m46_4, r43_8, r45_8, r46_2
 #   47|     v47_1(void)                 = NoOp                      : 
 #   39|     v39_13(void)                = ReturnIndirection[p2]     : &:r39_11, m44_6
@@ -356,7 +356,7 @@ test.cpp:
 #   49|         valnum = r49_5, r53_2, r56_6
 #   49|     m49_6(char *)              = InitializeParameter[str]     : &:r49_5
 #   49|         valnum = m49_6, r49_7, r53_3, r56_7
-#   49|     r49_7(char *)              = Load                         : &:r49_5, m49_6
+#   49|     r49_7(char *)              = Load[str]                    : &:r49_5, m49_6
 #   49|         valnum = m49_6, r49_7, r53_3, r56_7
 #   49|     m49_8(unknown)             = InitializeIndirection[str]   : &:r49_7
 #   49|         valnum = unique
@@ -364,7 +364,7 @@ test.cpp:
 #   49|         valnum = r49_9, r55_1
 #   49|     m49_10(char *)             = InitializeParameter[chars]   : &:r49_9
 #   49|         valnum = m49_10, m55_4, r49_11, r55_2
-#   49|     r49_11(char *)             = Load                         : &:r49_9, m49_10
+#   49|     r49_11(char *)             = Load[chars]                  : &:r49_9, m49_10
 #   49|         valnum = m49_10, m55_4, r49_11, r55_2
 #   49|     m49_12(unknown)            = InitializeIndirection[chars] : &:r49_11
 #   49|         valnum = unique
@@ -376,7 +376,7 @@ test.cpp:
 #   51|         valnum = r51_1, r62_1, r65_2
 #   51|     r51_2(unsigned int)        = Constant[0]                  : 
 #   51|         valnum = m51_3, r51_2
-#   51|     m51_3(unsigned int)        = Store                        : &:r51_1, r51_2
+#   51|     m51_3(unsigned int)        = Store[result]                : &:r51_1, r51_2
 #   51|         valnum = m51_3, r51_2
 #-----|   Goto -> Block 1
 
@@ -385,9 +385,9 @@ test.cpp:
 #   53|         valnum = m53_1, m65_4, r62_2, r65_3
 #   53|     r53_2(glval<char *>) = VariableAddress[str] : 
 #   53|         valnum = r49_5, r53_2, r56_6
-#   53|     r53_3(char *)        = Load                 : &:r53_2, m49_6
+#   53|     r53_3(char *)        = Load[str]            : &:r53_2, m49_6
 #   53|         valnum = m49_6, r49_7, r53_3, r56_7
-#   53|     r53_4(char)          = Load                 : &:r53_3, ~m49_8
+#   53|     r53_4(char)          = Load[?]              : &:r53_3, ~m49_8
 #   53|         valnum = r53_4, r56_8
 #   53|     r53_5(int)           = Convert              : r53_4
 #   53|         valnum = r53_5, r56_9
@@ -402,11 +402,11 @@ test.cpp:
 #   55|   Block 2
 #   55|     r55_1(glval<char *>) = VariableAddress[chars] : 
 #   55|         valnum = r49_9, r55_1
-#   55|     r55_2(char *)        = Load                   : &:r55_1, m49_10
+#   55|     r55_2(char *)        = Load[chars]            : &:r55_1, m49_10
 #   55|         valnum = m49_10, m55_4, r49_11, r55_2
 #   55|     r55_3(glval<char *>) = VariableAddress[ptr]   : 
 #   55|         valnum = r50_1, r55_3, r56_12, r56_19, r56_2, r59_1
-#   55|     m55_4(char *)        = Store                  : &:r55_3, r55_2
+#   55|     m55_4(char *)        = Store[ptr]             : &:r55_3, r55_2
 #   55|         valnum = m49_10, m55_4, r49_11, r55_2
 #-----|   Goto -> Block 3
 
@@ -415,17 +415,17 @@ test.cpp:
 #   56|         valnum = m56_1, r56_13, r56_20, r56_3, r59_2
 #   56|     r56_2(glval<char *>) = VariableAddress[ptr] : 
 #   56|         valnum = r50_1, r55_3, r56_12, r56_19, r56_2, r59_1
-#   56|     r56_3(char *)        = Load                 : &:r56_2, m56_1
+#   56|     r56_3(char *)        = Load[ptr]            : &:r56_2, m56_1
 #   56|         valnum = m56_1, r56_13, r56_20, r56_3, r59_2
-#   56|     r56_4(char)          = Load                 : &:r56_3, ~m49_4
+#   56|     r56_4(char)          = Load[?]              : &:r56_3, ~m49_4
 #   56|         valnum = r56_14, r56_4, r59_3
 #   56|     r56_5(int)           = Convert              : r56_4
 #   56|         valnum = r56_15, r56_5, r59_4
 #   56|     r56_6(glval<char *>) = VariableAddress[str] : 
 #   56|         valnum = r49_5, r53_2, r56_6
-#   56|     r56_7(char *)        = Load                 : &:r56_6, m49_6
+#   56|     r56_7(char *)        = Load[str]            : &:r56_6, m49_6
 #   56|         valnum = m49_6, r49_7, r53_3, r56_7
-#   56|     r56_8(char)          = Load                 : &:r56_7, ~m49_8
+#   56|     r56_8(char)          = Load[?]              : &:r56_7, ~m49_8
 #   56|         valnum = r53_4, r56_8
 #   56|     r56_9(int)           = Convert              : r56_8
 #   56|         valnum = r53_5, r56_9
@@ -438,9 +438,9 @@ test.cpp:
 #   56|   Block 4
 #   56|     r56_12(glval<char *>) = VariableAddress[ptr] : 
 #   56|         valnum = r50_1, r55_3, r56_12, r56_19, r56_2, r59_1
-#   56|     r56_13(char *)        = Load                 : &:r56_12, m56_1
+#   56|     r56_13(char *)        = Load[ptr]            : &:r56_12, m56_1
 #   56|         valnum = m56_1, r56_13, r56_20, r56_3, r59_2
-#   56|     r56_14(char)          = Load                 : &:r56_13, ~m49_4
+#   56|     r56_14(char)          = Load[?]              : &:r56_13, ~m49_4
 #   56|         valnum = r56_14, r56_4, r59_3
 #   56|     r56_15(int)           = Convert              : r56_14
 #   56|         valnum = r56_15, r56_5, r59_4
@@ -455,22 +455,22 @@ test.cpp:
 #   56|   Block 5
 #   56|     r56_19(glval<char *>) = VariableAddress[ptr] : 
 #   56|         valnum = r50_1, r55_3, r56_12, r56_19, r56_2, r59_1
-#   56|     r56_20(char *)        = Load                 : &:r56_19, m56_1
+#   56|     r56_20(char *)        = Load[ptr]            : &:r56_19, m56_1
 #   56|         valnum = m56_1, r56_13, r56_20, r56_3, r59_2
 #   56|     r56_21(int)           = Constant[1]          : 
 #   56|         valnum = unique
 #   56|     r56_22(char *)        = PointerAdd[1]        : r56_20, r56_21
 #   56|         valnum = m56_23, r56_22
-#   56|     m56_23(char *)        = Store                : &:r56_19, r56_22
+#   56|     m56_23(char *)        = Store[ptr]           : &:r56_19, r56_22
 #   56|         valnum = m56_23, r56_22
 #-----|   Goto (back edge) -> Block 3
 
 #   59|   Block 6
 #   59|     r59_1(glval<char *>) = VariableAddress[ptr] : 
 #   59|         valnum = r50_1, r55_3, r56_12, r56_19, r56_2, r59_1
-#   59|     r59_2(char *)        = Load                 : &:r59_1, m56_1
+#   59|     r59_2(char *)        = Load[ptr]            : &:r59_1, m56_1
 #   59|         valnum = m56_1, r56_13, r56_20, r56_3, r59_2
-#   59|     r59_3(char)          = Load                 : &:r59_2, ~m49_4
+#   59|     r59_3(char)          = Load[?]              : &:r59_2, ~m49_4
 #   59|         valnum = r56_14, r56_4, r59_3
 #   59|     r59_4(int)           = Convert              : r59_3
 #   59|         valnum = r56_15, r56_5, r59_4
@@ -489,13 +489,13 @@ test.cpp:
 #   62|   Block 8
 #   62|     r62_1(glval<unsigned int>) = VariableAddress[result] : 
 #   62|         valnum = r51_1, r62_1, r65_2
-#   62|     r62_2(unsigned int)        = Load                    : &:r62_1, m53_1
+#   62|     r62_2(unsigned int)        = Load[result]            : &:r62_1, m53_1
 #   62|         valnum = m53_1, m65_4, r62_2, r65_3
 #   62|     r62_3(unsigned int)        = Constant[1]             : 
 #   62|         valnum = unique
 #   62|     r62_4(unsigned int)        = Add                     : r62_2, r62_3
 #   62|         valnum = m62_5, r62_4
-#   62|     m62_5(unsigned int)        = Store                   : &:r62_1, r62_4
+#   62|     m62_5(unsigned int)        = Store[result]           : &:r62_1, r62_4
 #   62|         valnum = m62_5, r62_4
 #-----|   Goto (back edge) -> Block 1
 
@@ -505,9 +505,9 @@ test.cpp:
 #   65|         valnum = r49_15, r65_1
 #   65|     r65_2(glval<unsigned int>)  = VariableAddress[result]  : 
 #   65|         valnum = r51_1, r62_1, r65_2
-#   65|     r65_3(unsigned int)         = Load                     : &:r65_2, m53_1
+#   65|     r65_3(unsigned int)         = Load[result]             : &:r65_2, m53_1
 #   65|         valnum = m53_1, m65_4, r62_2, r65_3
-#   65|     m65_4(unsigned int)         = Store                    : &:r65_1, r65_3
+#   65|     m65_4(unsigned int)         = Store[#return]           : &:r65_1, r65_3
 #   65|         valnum = m53_1, m65_4, r62_2, r65_3
 #   49|     v49_13(void)                = ReturnIndirection[str]   : &:r49_7, m49_8
 #   49|     v49_14(void)                = ReturnIndirection[chars] : &:r49_11, m49_12
@@ -530,7 +530,7 @@ test.cpp:
 #   75|         valnum = r75_5, r79_4, r79_9
 #   75|     m75_6(two_values *)         = InitializeParameter[vals]   : &:r75_5
 #   75|         valnum = m75_6, r75_7, r79_10, r79_5
-#   75|     r75_7(two_values *)         = Load                        : &:r75_5, m75_6
+#   75|     r75_7(two_values *)         = Load[vals]                  : &:r75_5, m75_6
 #   75|         valnum = m75_6, r75_7, r79_10, r79_5
 #   75|     m75_8(unknown)              = InitializeIndirection[vals] : &:r75_7
 #   75|         valnum = unique
@@ -538,7 +538,7 @@ test.cpp:
 #   77|         valnum = r77_1, r79_1, r80_6
 #   77|     r77_2(glval<unknown>)       = FunctionAddress[getAValue]  : 
 #   77|         valnum = unique
-#   77|     r77_3(int)                  = Call                        : func:r77_2
+#   77|     r77_3(int)                  = Call[getAValue]             : func:r77_2
 #   77|         valnum = unique
 #   77|     m77_4(unknown)              = ^CallSideEffect             : ~m75_4
 #   77|         valnum = unique
@@ -546,31 +546,31 @@ test.cpp:
 #   77|         valnum = unique
 #   77|     r77_6(signed short)         = Convert                     : r77_3
 #   77|         valnum = m77_7, r77_6, r79_2
-#   77|     m77_7(signed short)         = Store                       : &:r77_1, r77_6
+#   77|     m77_7(signed short)         = Store[v]                    : &:r77_1, r77_6
 #   77|         valnum = m77_7, r77_6, r79_2
 #   79|     r79_1(glval<signed short>)  = VariableAddress[v]          : 
 #   79|         valnum = r77_1, r79_1, r80_6
-#   79|     r79_2(signed short)         = Load                        : &:r79_1, m77_7
+#   79|     r79_2(signed short)         = Load[v]                     : &:r79_1, m77_7
 #   79|         valnum = m77_7, r77_6, r79_2
 #   79|     r79_3(int)                  = Convert                     : r79_2
 #   79|         valnum = unique
 #   79|     r79_4(glval<two_values *>)  = VariableAddress[vals]       : 
 #   79|         valnum = r75_5, r79_4, r79_9
-#   79|     r79_5(two_values *)         = Load                        : &:r79_4, m75_6
+#   79|     r79_5(two_values *)         = Load[vals]                  : &:r79_4, m75_6
 #   79|         valnum = m75_6, r75_7, r79_10, r79_5
 #   79|     r79_6(glval<signed short>)  = FieldAddress[val1]          : r79_5
 #   79|         valnum = unique
-#   79|     r79_7(signed short)         = Load                        : &:r79_6, ~m75_8
+#   79|     r79_7(signed short)         = Load[?]                     : &:r79_6, ~m75_8
 #   79|         valnum = unique
 #   79|     r79_8(int)                  = Convert                     : r79_7
 #   79|         valnum = unique
 #   79|     r79_9(glval<two_values *>)  = VariableAddress[vals]       : 
 #   79|         valnum = r75_5, r79_4, r79_9
-#   79|     r79_10(two_values *)        = Load                        : &:r79_9, m75_6
+#   79|     r79_10(two_values *)        = Load[vals]                  : &:r79_9, m75_6
 #   79|         valnum = m75_6, r75_7, r79_10, r79_5
 #   79|     r79_11(glval<signed short>) = FieldAddress[val2]          : r79_10
 #   79|         valnum = unique
-#   79|     r79_12(signed short)        = Load                        : &:r79_11, ~m75_8
+#   79|     r79_12(signed short)        = Load[?]                     : &:r79_11, ~m75_8
 #   79|         valnum = unique
 #   79|     r79_13(int)                 = Convert                     : r79_12
 #   79|         valnum = unique
@@ -585,7 +585,7 @@ test.cpp:
 #   80|   Block 1
 #   80|     r80_1(glval<unknown>)      = FunctionAddress[getAValue] : 
 #   80|         valnum = unique
-#   80|     r80_2(int)                 = Call                       : func:r80_1
+#   80|     r80_2(int)                 = Call[getAValue]            : func:r80_1
 #   80|         valnum = unique
 #   80|     m80_3(unknown)             = ^CallSideEffect            : ~m77_5
 #   80|         valnum = unique
@@ -595,7 +595,7 @@ test.cpp:
 #   80|         valnum = m80_7, r80_5
 #   80|     r80_6(glval<signed short>) = VariableAddress[v]         : 
 #   80|         valnum = r77_1, r79_1, r80_6
-#   80|     m80_7(signed short)        = Store                      : &:r80_6, r80_5
+#   80|     m80_7(signed short)        = Store[v]                   : &:r80_6, r80_5
 #   80|         valnum = m80_7, r80_5
 #-----|   Goto -> Block 2
 
@@ -629,7 +629,7 @@ test.cpp:
 #   84|         valnum = r84_9, r88_1
 #   84|     m84_10(void *)       = InitializeParameter[p]   : &:r84_9
 #   84|         valnum = m84_10, r84_11, r88_2
-#   84|     r84_11(void *)       = Load                     : &:r84_9, m84_10
+#   84|     r84_11(void *)       = Load[p]                  : &:r84_9, m84_10
 #   84|         valnum = m84_10, r84_11, r88_2
 #   84|     m84_12(unknown)      = InitializeIndirection[p] : &:r84_11
 #   84|         valnum = unique
@@ -639,7 +639,7 @@ test.cpp:
 #   86|         valnum = unique
 #   88|     r88_1(glval<void *>) = VariableAddress[p]       : 
 #   88|         valnum = r84_9, r88_1
-#   88|     r88_2(void *)        = Load                     : &:r88_1, m84_10
+#   88|     r88_2(void *)        = Load[p]                  : &:r88_1, m84_10
 #   88|         valnum = m84_10, r84_11, r88_2
 #   88|     r88_3(void *)        = Constant[0]              : 
 #   88|         valnum = unique
@@ -654,11 +654,11 @@ test.cpp:
 #   88|         valnum = m88_10, m88_6, r88_8
 #   88|     r88_7(glval<int>) = VariableAddress[#temp88:7] : 
 #   88|         valnum = r88_13, r88_17, r88_7
-#   88|     r88_8(int)        = Load                       : &:r88_7, m88_6
+#   88|     r88_8(int)        = Load[#temp88:7]            : &:r88_7, m88_6
 #   88|         valnum = m88_10, m88_6, r88_8
 #   88|     r88_9(glval<int>) = VariableAddress[v]         : 
 #   88|         valnum = r86_1, r88_9
-#   88|     m88_10(int)       = Store                      : &:r88_9, r88_8
+#   88|     m88_10(int)       = Store[v]                   : &:r88_9, r88_8
 #   88|         valnum = m88_10, m88_6, r88_8
 #   89|     v89_1(void)       = NoOp                       : 
 #   84|     v84_13(void)      = ReturnIndirection[p]       : &:r84_11, m84_12
@@ -669,22 +669,22 @@ test.cpp:
 #   88|   Block 2
 #   88|     r88_11(glval<int>) = VariableAddress[x]         : 
 #   88|         valnum = r84_5, r88_11
-#   88|     r88_12(int)        = Load                       : &:r88_11, m84_6
+#   88|     r88_12(int)        = Load[x]                    : &:r88_11, m84_6
 #   88|         valnum = m84_6, m88_14, r88_12
 #   88|     r88_13(glval<int>) = VariableAddress[#temp88:7] : 
 #   88|         valnum = r88_13, r88_17, r88_7
-#   88|     m88_14(int)        = Store                      : &:r88_13, r88_12
+#   88|     m88_14(int)        = Store[#temp88:7]           : &:r88_13, r88_12
 #   88|         valnum = m84_6, m88_14, r88_12
 #-----|   Goto -> Block 1
 
 #   88|   Block 3
 #   88|     r88_15(glval<int>) = VariableAddress[y]         : 
 #   88|         valnum = r84_7, r88_15
-#   88|     r88_16(int)        = Load                       : &:r88_15, m84_8
+#   88|     r88_16(int)        = Load[y]                    : &:r88_15, m84_8
 #   88|         valnum = m84_8, m88_18, r88_16
 #   88|     r88_17(glval<int>) = VariableAddress[#temp88:7] : 
 #   88|         valnum = r88_13, r88_17, r88_7
-#   88|     m88_18(int)        = Store                      : &:r88_17, r88_16
+#   88|     m88_18(int)        = Store[#temp88:7]           : &:r88_17, r88_16
 #   88|         valnum = m84_8, m88_18, r88_16
 #-----|   Goto -> Block 1
 
@@ -703,19 +703,19 @@ test.cpp:
 #   92|         valnum = m92_4, m92_6, m93_4, r92_2, r92_5, r93_3
 #   92|     r92_3(glval<int>) = VariableAddress[x]       : 
 #   92|         valnum = r92_1, r92_3, r93_2
-#   92|     m92_4(int)        = Store                    : &:r92_3, r92_2
+#   92|     m92_4(int)        = Store[x]                 : &:r92_3, r92_2
 #   92|         valnum = m92_4, m92_6, m93_4, r92_2, r92_5, r93_3
 #   92|     r92_5(int)        = CopyValue                : r92_2
 #   92|         valnum = m92_4, m92_6, m93_4, r92_2, r92_5, r93_3
-#   92|     m92_6(int)        = Store                    : &:r92_1, r92_5
+#   92|     m92_6(int)        = Store[x]                 : &:r92_1, r92_5
 #   92|         valnum = m92_4, m92_6, m93_4, r92_2, r92_5, r93_3
 #   93|     r93_1(glval<int>) = VariableAddress[#return] : 
 #   93|         valnum = r91_5, r93_1
 #   93|     r93_2(glval<int>) = VariableAddress[x]       : 
 #   93|         valnum = r92_1, r92_3, r93_2
-#   93|     r93_3(int)        = Load                     : &:r93_2, m92_6
+#   93|     r93_3(int)        = Load[x]                  : &:r93_2, m92_6
 #   93|         valnum = m92_4, m92_6, m93_4, r92_2, r92_5, r93_3
-#   93|     m93_4(int)        = Store                    : &:r93_1, r93_3
+#   93|     m93_4(int)        = Store[#return]           : &:r93_1, r93_3
 #   93|         valnum = m92_4, m92_6, m93_4, r92_2, r92_5, r93_3
 #   91|     r91_5(glval<int>) = VariableAddress[#return] : 
 #   91|         valnum = r91_5, r93_1
@@ -736,7 +736,7 @@ test.cpp:
 #  104|         valnum = r104_5, r105_2, r106_2
 #  104|     m104_6(Derived *)        = InitializeParameter[pd]                 : &:r104_5
 #  104|         valnum = m104_6, r104_7, r105_3, r106_3
-#  104|     r104_7(Derived *)        = Load                                    : &:r104_5, m104_6
+#  104|     r104_7(Derived *)        = Load[pd]                                : &:r104_5, m104_6
 #  104|         valnum = m104_6, r104_7, r105_3, r106_3
 #  104|     m104_8(unknown)          = InitializeIndirection[pd]               : &:r104_7
 #  104|         valnum = unique
@@ -744,45 +744,45 @@ test.cpp:
 #  105|         valnum = unique
 #  105|     r105_2(glval<Derived *>) = VariableAddress[pd]                     : 
 #  105|         valnum = r104_5, r105_2, r106_2
-#  105|     r105_3(Derived *)        = Load                                    : &:r105_2, m104_6
+#  105|     r105_3(Derived *)        = Load[pd]                                : &:r105_2, m104_6
 #  105|         valnum = m104_6, r104_7, r105_3, r106_3
 #  105|     r105_4(Base *)           = ConvertToNonVirtualBase[Derived : Base] : r105_3
 #  105|         valnum = m106_5, r105_4, r106_4, r107_3
 #  105|     r105_5(glval<int>)       = FieldAddress[b]                         : r105_4
 #  105|         valnum = r105_5, r107_4
-#  105|     r105_6(int)              = Load                                    : &:r105_5, ~m104_8
+#  105|     r105_6(int)              = Load[?]                                 : &:r105_5, ~m104_8
 #  105|         valnum = m105_7, m107_6, m109_4, r105_6, r107_5, r109_3
-#  105|     m105_7(int)              = Store                                   : &:r105_1, r105_6
+#  105|     m105_7(int)              = Store[x]                                : &:r105_1, r105_6
 #  105|         valnum = m105_7, m107_6, m109_4, r105_6, r107_5, r109_3
 #  106|     r106_1(glval<Base *>)    = VariableAddress[pb]                     : 
 #  106|         valnum = r106_1, r107_2
 #  106|     r106_2(glval<Derived *>) = VariableAddress[pd]                     : 
 #  106|         valnum = r104_5, r105_2, r106_2
-#  106|     r106_3(Derived *)        = Load                                    : &:r106_2, m104_6
+#  106|     r106_3(Derived *)        = Load[pd]                                : &:r106_2, m104_6
 #  106|         valnum = m104_6, r104_7, r105_3, r106_3
 #  106|     r106_4(Base *)           = ConvertToNonVirtualBase[Derived : Base] : r106_3
 #  106|         valnum = m106_5, r105_4, r106_4, r107_3
-#  106|     m106_5(Base *)           = Store                                   : &:r106_1, r106_4
+#  106|     m106_5(Base *)           = Store[pb]                               : &:r106_1, r106_4
 #  106|         valnum = m106_5, r105_4, r106_4, r107_3
 #  107|     r107_1(glval<int>)       = VariableAddress[y]                      : 
 #  107|         valnum = r107_1, r109_2
 #  107|     r107_2(glval<Base *>)    = VariableAddress[pb]                     : 
 #  107|         valnum = r106_1, r107_2
-#  107|     r107_3(Base *)           = Load                                    : &:r107_2, m106_5
+#  107|     r107_3(Base *)           = Load[pb]                                : &:r107_2, m106_5
 #  107|         valnum = m106_5, r105_4, r106_4, r107_3
 #  107|     r107_4(glval<int>)       = FieldAddress[b]                         : r107_3
 #  107|         valnum = r105_5, r107_4
-#  107|     r107_5(int)              = Load                                    : &:r107_4, ~m104_8
+#  107|     r107_5(int)              = Load[?]                                 : &:r107_4, ~m104_8
 #  107|         valnum = m105_7, m107_6, m109_4, r105_6, r107_5, r109_3
-#  107|     m107_6(int)              = Store                                   : &:r107_1, r107_5
+#  107|     m107_6(int)              = Store[y]                                : &:r107_1, r107_5
 #  107|         valnum = m105_7, m107_6, m109_4, r105_6, r107_5, r109_3
 #  109|     r109_1(glval<int>)       = VariableAddress[#return]                : 
 #  109|         valnum = r104_10, r109_1
 #  109|     r109_2(glval<int>)       = VariableAddress[y]                      : 
 #  109|         valnum = r107_1, r109_2
-#  109|     r109_3(int)              = Load                                    : &:r109_2, m107_6
+#  109|     r109_3(int)              = Load[y]                                 : &:r109_2, m107_6
 #  109|         valnum = m105_7, m107_6, m109_4, r105_6, r107_5, r109_3
-#  109|     m109_4(int)              = Store                                   : &:r109_1, r109_3
+#  109|     m109_4(int)              = Store[#return]                          : &:r109_1, r109_3
 #  109|         valnum = m105_7, m107_6, m109_4, r105_6, r107_5, r109_3
 #  104|     v104_9(void)             = ReturnIndirection[pd]                   : &:r104_7, m104_8
 #  104|     r104_10(glval<int>)      = VariableAddress[#return]                : 
@@ -826,7 +826,7 @@ test.cpp:
 #  124|         valnum = r124_5, r125_2, r126_2, r128_3, r129_2
 #  124|     m124_6(A *)        = InitializeParameter[pa]   : &:r124_5
 #  124|         valnum = m124_6, r124_7, r125_3, r126_3, r128_4, r129_3
-#  124|     r124_7(A *)        = Load                      : &:r124_5, m124_6
+#  124|     r124_7(A *)        = Load[pa]                  : &:r124_5, m124_6
 #  124|         valnum = m124_6, r124_7, r125_3, r126_3, r128_4, r129_3
 #  124|     m124_8(unknown)    = InitializeIndirection[pa] : &:r124_7
 #  124|         valnum = unique
@@ -838,37 +838,37 @@ test.cpp:
 #  125|         valnum = unique
 #  125|     r125_2(glval<A *>) = VariableAddress[pa]       : 
 #  125|         valnum = r124_5, r125_2, r126_2, r128_3, r129_2
-#  125|     r125_3(A *)        = Load                      : &:r125_2, m124_6
+#  125|     r125_3(A *)        = Load[pa]                  : &:r125_2, m124_6
 #  125|         valnum = m124_6, r124_7, r125_3, r126_3, r128_4, r129_3
 #  125|     r125_4(glval<int>) = FieldAddress[x]           : r125_3
 #  125|         valnum = r125_4, r126_4, r128_5, r129_4
-#  125|     r125_5(int)        = Load                      : &:r125_4, ~m124_8
+#  125|     r125_5(int)        = Load[?]                   : &:r125_4, ~m124_8
 #  125|         valnum = m125_6, m126_6, r125_5, r126_5
-#  125|     m125_6(int)        = Store                     : &:r125_1, r125_5
+#  125|     m125_6(int)        = Store[b]                  : &:r125_1, r125_5
 #  125|         valnum = m125_6, m126_6, r125_5, r126_5
 #  126|     r126_1(glval<int>) = VariableAddress[c]        : 
 #  126|         valnum = unique
 #  126|     r126_2(glval<A *>) = VariableAddress[pa]       : 
 #  126|         valnum = r124_5, r125_2, r126_2, r128_3, r129_2
-#  126|     r126_3(A *)        = Load                      : &:r126_2, m124_6
+#  126|     r126_3(A *)        = Load[pa]                  : &:r126_2, m124_6
 #  126|         valnum = m124_6, r124_7, r125_3, r126_3, r128_4, r129_3
 #  126|     r126_4(glval<int>) = FieldAddress[x]           : r126_3
 #  126|         valnum = r125_4, r126_4, r128_5, r129_4
-#  126|     r126_5(int)        = Load                      : &:r126_4, ~m124_8
+#  126|     r126_5(int)        = Load[?]                   : &:r126_4, ~m124_8
 #  126|         valnum = m125_6, m126_6, r125_5, r126_5
-#  126|     m126_6(int)        = Store                     : &:r126_1, r126_5
+#  126|     m126_6(int)        = Store[c]                  : &:r126_1, r126_5
 #  126|         valnum = m125_6, m126_6, r125_5, r126_5
 #  128|     r128_1(glval<int>) = VariableAddress[n]        : 
 #  128|         valnum = r124_9, r128_1
-#  128|     r128_2(int)        = Load                      : &:r128_1, m124_10
+#  128|     r128_2(int)        = Load[n]                   : &:r128_1, m124_10
 #  128|         valnum = m124_10, m128_6, m129_6, r128_2, r129_5
 #  128|     r128_3(glval<A *>) = VariableAddress[pa]       : 
 #  128|         valnum = r124_5, r125_2, r126_2, r128_3, r129_2
-#  128|     r128_4(A *)        = Load                      : &:r128_3, m124_6
+#  128|     r128_4(A *)        = Load[pa]                  : &:r128_3, m124_6
 #  128|         valnum = m124_6, r124_7, r125_3, r126_3, r128_4, r129_3
 #  128|     r128_5(glval<int>) = FieldAddress[x]           : r128_4
 #  128|         valnum = r125_4, r126_4, r128_5, r129_4
-#  128|     m128_6(int)        = Store                     : &:r128_5, r128_2
+#  128|     m128_6(int)        = Store[?]                  : &:r128_5, r128_2
 #  128|         valnum = m124_10, m128_6, m129_6, r128_2, r129_5
 #  128|     m128_7(unknown)    = Chi                       : total:m124_8, partial:m128_6
 #  128|         valnum = unique
@@ -876,13 +876,13 @@ test.cpp:
 #  129|         valnum = unique
 #  129|     r129_2(glval<A *>) = VariableAddress[pa]       : 
 #  129|         valnum = r124_5, r125_2, r126_2, r128_3, r129_2
-#  129|     r129_3(A *)        = Load                      : &:r129_2, m124_6
+#  129|     r129_3(A *)        = Load[pa]                  : &:r129_2, m124_6
 #  129|         valnum = m124_6, r124_7, r125_3, r126_3, r128_4, r129_3
 #  129|     r129_4(glval<int>) = FieldAddress[x]           : r129_3
 #  129|         valnum = r125_4, r126_4, r128_5, r129_4
-#  129|     r129_5(int)        = Load                      : &:r129_4, m128_6
+#  129|     r129_5(int)        = Load[?]                   : &:r129_4, m128_6
 #  129|         valnum = m124_10, m128_6, m129_6, r128_2, r129_5
-#  129|     m129_6(int)        = Store                     : &:r129_1, r129_5
+#  129|     m129_6(int)        = Store[d]                  : &:r129_1, r129_5
 #  129|         valnum = m124_10, m128_6, m129_6, r128_2, r129_5
 #  130|     v130_1(void)       = NoOp                      : 
 #  124|     v124_11(void)      = ReturnIndirection[pa]     : &:r124_7, m128_7
@@ -903,37 +903,37 @@ test.cpp:
 #  136|         valnum = unique
 #  136|     r136_2(glval<A *>) = VariableAddress[global_a] : 
 #  136|         valnum = r136_2, r137_2, r139_3, r140_2
-#  136|     r136_3(A *)        = Load                      : &:r136_2, ~m135_3
+#  136|     r136_3(A *)        = Load[global_a]            : &:r136_2, ~m135_3
 #  136|         valnum = r136_3, r137_3, r139_4
 #  136|     r136_4(glval<int>) = FieldAddress[x]           : r136_3
 #  136|         valnum = r136_4, r137_4, r139_5
-#  136|     r136_5(int)        = Load                      : &:r136_4, ~m135_4
+#  136|     r136_5(int)        = Load[?]                   : &:r136_4, ~m135_4
 #  136|         valnum = m136_6, m137_6, r136_5, r137_5
-#  136|     m136_6(int)        = Store                     : &:r136_1, r136_5
+#  136|     m136_6(int)        = Store[b]                  : &:r136_1, r136_5
 #  136|         valnum = m136_6, m137_6, r136_5, r137_5
 #  137|     r137_1(glval<int>) = VariableAddress[c]        : 
 #  137|         valnum = unique
 #  137|     r137_2(glval<A *>) = VariableAddress[global_a] : 
 #  137|         valnum = r136_2, r137_2, r139_3, r140_2
-#  137|     r137_3(A *)        = Load                      : &:r137_2, ~m135_3
+#  137|     r137_3(A *)        = Load[global_a]            : &:r137_2, ~m135_3
 #  137|         valnum = r136_3, r137_3, r139_4
 #  137|     r137_4(glval<int>) = FieldAddress[x]           : r137_3
 #  137|         valnum = r136_4, r137_4, r139_5
-#  137|     r137_5(int)        = Load                      : &:r137_4, ~m135_4
+#  137|     r137_5(int)        = Load[?]                   : &:r137_4, ~m135_4
 #  137|         valnum = m136_6, m137_6, r136_5, r137_5
-#  137|     m137_6(int)        = Store                     : &:r137_1, r137_5
+#  137|     m137_6(int)        = Store[c]                  : &:r137_1, r137_5
 #  137|         valnum = m136_6, m137_6, r136_5, r137_5
 #  139|     r139_1(glval<int>) = VariableAddress[global_n] : 
 #  139|         valnum = unique
-#  139|     r139_2(int)        = Load                      : &:r139_1, ~m135_3
+#  139|     r139_2(int)        = Load[global_n]            : &:r139_1, ~m135_3
 #  139|         valnum = m139_6, r139_2
 #  139|     r139_3(glval<A *>) = VariableAddress[global_a] : 
 #  139|         valnum = r136_2, r137_2, r139_3, r140_2
-#  139|     r139_4(A *)        = Load                      : &:r139_3, ~m135_3
+#  139|     r139_4(A *)        = Load[global_a]            : &:r139_3, ~m135_3
 #  139|         valnum = r136_3, r137_3, r139_4
 #  139|     r139_5(glval<int>) = FieldAddress[x]           : r139_4
 #  139|         valnum = r136_4, r137_4, r139_5
-#  139|     m139_6(int)        = Store                     : &:r139_5, r139_2
+#  139|     m139_6(int)        = Store[?]                  : &:r139_5, r139_2
 #  139|         valnum = m139_6, r139_2
 #  139|     m139_7(unknown)    = Chi                       : total:m135_4, partial:m139_6
 #  139|         valnum = unique
@@ -941,13 +941,13 @@ test.cpp:
 #  140|         valnum = unique
 #  140|     r140_2(glval<A *>) = VariableAddress[global_a] : 
 #  140|         valnum = r136_2, r137_2, r139_3, r140_2
-#  140|     r140_3(A *)        = Load                      : &:r140_2, ~m139_7
+#  140|     r140_3(A *)        = Load[global_a]            : &:r140_2, ~m139_7
 #  140|         valnum = unique
 #  140|     r140_4(glval<int>) = FieldAddress[x]           : r140_3
 #  140|         valnum = unique
-#  140|     r140_5(int)        = Load                      : &:r140_4, ~m139_7
+#  140|     r140_5(int)        = Load[?]                   : &:r140_4, ~m139_7
 #  140|         valnum = m140_6, r140_5
-#  140|     m140_6(int)        = Store                     : &:r140_1, r140_5
+#  140|     m140_6(int)        = Store[d]                  : &:r140_1, r140_5
 #  140|         valnum = m140_6, r140_5
 #  141|     v141_1(void)       = NoOp                      : 
 #  135|     v135_5(void)       = ReturnVoid                : 
@@ -967,7 +967,7 @@ test.cpp:
 #  143|         valnum = r143_5, r144_2, r145_2, r147_3, r149_2
 #  143|     m143_6(A *)        = InitializeParameter[pa]   : &:r143_5
 #  143|         valnum = m143_6, r143_7, r144_3, r145_3, r147_4, r149_3
-#  143|     r143_7(A *)        = Load                      : &:r143_5, m143_6
+#  143|     r143_7(A *)        = Load[pa]                  : &:r143_5, m143_6
 #  143|         valnum = m143_6, r143_7, r144_3, r145_3, r147_4, r149_3
 #  143|     m143_8(unknown)    = InitializeIndirection[pa] : &:r143_7
 #  143|         valnum = unique
@@ -975,37 +975,37 @@ test.cpp:
 #  144|         valnum = unique
 #  144|     r144_2(glval<A *>) = VariableAddress[pa]       : 
 #  144|         valnum = r143_5, r144_2, r145_2, r147_3, r149_2
-#  144|     r144_3(A *)        = Load                      : &:r144_2, m143_6
+#  144|     r144_3(A *)        = Load[pa]                  : &:r144_2, m143_6
 #  144|         valnum = m143_6, r143_7, r144_3, r145_3, r147_4, r149_3
 #  144|     r144_4(glval<int>) = FieldAddress[x]           : r144_3
 #  144|         valnum = r144_4, r149_4
-#  144|     r144_5(int)        = Load                      : &:r144_4, ~m143_8
+#  144|     r144_5(int)        = Load[?]                   : &:r144_4, ~m143_8
 #  144|         valnum = m144_6, m149_6, r144_5, r149_5
-#  144|     m144_6(int)        = Store                     : &:r144_1, r144_5
+#  144|     m144_6(int)        = Store[b]                  : &:r144_1, r144_5
 #  144|         valnum = m144_6, m149_6, r144_5, r149_5
 #  145|     r145_1(glval<int>) = VariableAddress[c]        : 
 #  145|         valnum = unique
 #  145|     r145_2(glval<A *>) = VariableAddress[pa]       : 
 #  145|         valnum = r143_5, r144_2, r145_2, r147_3, r149_2
-#  145|     r145_3(A *)        = Load                      : &:r145_2, m143_6
+#  145|     r145_3(A *)        = Load[pa]                  : &:r145_2, m143_6
 #  145|         valnum = m143_6, r143_7, r144_3, r145_3, r147_4, r149_3
 #  145|     r145_4(glval<int>) = FieldAddress[y]           : r145_3
 #  145|         valnum = r145_4, r147_5
-#  145|     r145_5(int)        = Load                      : &:r145_4, ~m143_8
+#  145|     r145_5(int)        = Load[?]                   : &:r145_4, ~m143_8
 #  145|         valnum = m145_6, r145_5
-#  145|     m145_6(int)        = Store                     : &:r145_1, r145_5
+#  145|     m145_6(int)        = Store[c]                  : &:r145_1, r145_5
 #  145|         valnum = m145_6, r145_5
 #  147|     r147_1(glval<int>) = VariableAddress[global_n] : 
 #  147|         valnum = unique
-#  147|     r147_2(int)        = Load                      : &:r147_1, ~m143_3
+#  147|     r147_2(int)        = Load[global_n]            : &:r147_1, ~m143_3
 #  147|         valnum = m147_6, r147_2
 #  147|     r147_3(glval<A *>) = VariableAddress[pa]       : 
 #  147|         valnum = r143_5, r144_2, r145_2, r147_3, r149_2
-#  147|     r147_4(A *)        = Load                      : &:r147_3, m143_6
+#  147|     r147_4(A *)        = Load[pa]                  : &:r147_3, m143_6
 #  147|         valnum = m143_6, r143_7, r144_3, r145_3, r147_4, r149_3
 #  147|     r147_5(glval<int>) = FieldAddress[y]           : r147_4
 #  147|         valnum = r145_4, r147_5
-#  147|     m147_6(int)        = Store                     : &:r147_5, r147_2
+#  147|     m147_6(int)        = Store[?]                  : &:r147_5, r147_2
 #  147|         valnum = m147_6, r147_2
 #  147|     m147_7(unknown)    = Chi                       : total:m143_8, partial:m147_6
 #  147|         valnum = unique
@@ -1013,13 +1013,13 @@ test.cpp:
 #  149|         valnum = unique
 #  149|     r149_2(glval<A *>) = VariableAddress[pa]       : 
 #  149|         valnum = r143_5, r144_2, r145_2, r147_3, r149_2
-#  149|     r149_3(A *)        = Load                      : &:r149_2, m143_6
+#  149|     r149_3(A *)        = Load[pa]                  : &:r149_2, m143_6
 #  149|         valnum = m143_6, r143_7, r144_3, r145_3, r147_4, r149_3
 #  149|     r149_4(glval<int>) = FieldAddress[x]           : r149_3
 #  149|         valnum = r144_4, r149_4
-#  149|     r149_5(int)        = Load                      : &:r149_4, ~m143_8
+#  149|     r149_5(int)        = Load[?]                   : &:r149_4, ~m143_8
 #  149|         valnum = m144_6, m149_6, r144_5, r149_5
-#  149|     m149_6(int)        = Store                     : &:r149_1, r149_5
+#  149|     m149_6(int)        = Store[d]                  : &:r149_1, r149_5
 #  149|         valnum = m144_6, m149_6, r144_5, r149_5
 #  150|     v150_1(void)       = NoOp                      : 
 #  143|     v143_9(void)       = ReturnIndirection[pa]     : &:r143_7, m147_7
@@ -1044,37 +1044,37 @@ test.cpp:
 #  153|         valnum = unique
 #  153|     r153_2(glval<A *>) = VariableAddress[global_a] : 
 #  153|         valnum = r153_2, r154_2, r156_3, r158_2
-#  153|     r153_3(A *)        = Load                      : &:r153_2, ~m152_3
+#  153|     r153_3(A *)        = Load[global_a]            : &:r153_2, ~m152_3
 #  153|         valnum = r153_3, r154_3, r156_4
 #  153|     r153_4(glval<int>) = FieldAddress[x]           : r153_3
 #  153|         valnum = r153_4, r154_4
-#  153|     r153_5(int)        = Load                      : &:r153_4, ~m152_4
+#  153|     r153_5(int)        = Load[?]                   : &:r153_4, ~m152_4
 #  153|         valnum = m153_6, m154_6, r153_5, r154_5
-#  153|     m153_6(int)        = Store                     : &:r153_1, r153_5
+#  153|     m153_6(int)        = Store[b]                  : &:r153_1, r153_5
 #  153|         valnum = m153_6, m154_6, r153_5, r154_5
 #  154|     r154_1(glval<int>) = VariableAddress[c]        : 
 #  154|         valnum = unique
 #  154|     r154_2(glval<A *>) = VariableAddress[global_a] : 
 #  154|         valnum = r153_2, r154_2, r156_3, r158_2
-#  154|     r154_3(A *)        = Load                      : &:r154_2, ~m152_3
+#  154|     r154_3(A *)        = Load[global_a]            : &:r154_2, ~m152_3
 #  154|         valnum = r153_3, r154_3, r156_4
 #  154|     r154_4(glval<int>) = FieldAddress[x]           : r154_3
 #  154|         valnum = r153_4, r154_4
-#  154|     r154_5(int)        = Load                      : &:r154_4, ~m152_4
+#  154|     r154_5(int)        = Load[?]                   : &:r154_4, ~m152_4
 #  154|         valnum = m153_6, m154_6, r153_5, r154_5
-#  154|     m154_6(int)        = Store                     : &:r154_1, r154_5
+#  154|     m154_6(int)        = Store[c]                  : &:r154_1, r154_5
 #  154|         valnum = m153_6, m154_6, r153_5, r154_5
 #  156|     r156_1(glval<int>) = VariableAddress[n]        : 
 #  156|         valnum = r152_5, r156_1
-#  156|     r156_2(int)        = Load                      : &:r156_1, m152_6
+#  156|     r156_2(int)        = Load[n]                   : &:r156_1, m152_6
 #  156|         valnum = m152_6, m156_6, r156_2
 #  156|     r156_3(glval<A *>) = VariableAddress[global_a] : 
 #  156|         valnum = r153_2, r154_2, r156_3, r158_2
-#  156|     r156_4(A *)        = Load                      : &:r156_3, ~m152_3
+#  156|     r156_4(A *)        = Load[global_a]            : &:r156_3, ~m152_3
 #  156|         valnum = r153_3, r154_3, r156_4
 #  156|     r156_5(glval<int>) = FieldAddress[y]           : r156_4
 #  156|         valnum = unique
-#  156|     m156_6(int)        = Store                     : &:r156_5, r156_2
+#  156|     m156_6(int)        = Store[?]                  : &:r156_5, r156_2
 #  156|         valnum = m152_6, m156_6, r156_2
 #  156|     m156_7(unknown)    = Chi                       : total:m152_4, partial:m156_6
 #  156|         valnum = unique
@@ -1082,13 +1082,13 @@ test.cpp:
 #  158|         valnum = unique
 #  158|     r158_2(glval<A *>) = VariableAddress[global_a] : 
 #  158|         valnum = r153_2, r154_2, r156_3, r158_2
-#  158|     r158_3(A *)        = Load                      : &:r158_2, ~m156_7
+#  158|     r158_3(A *)        = Load[global_a]            : &:r158_2, ~m156_7
 #  158|         valnum = unique
 #  158|     r158_4(glval<int>) = FieldAddress[x]           : r158_3
 #  158|         valnum = unique
-#  158|     r158_5(int)        = Load                      : &:r158_4, ~m156_7
+#  158|     r158_5(int)        = Load[?]                   : &:r158_4, ~m156_7
 #  158|         valnum = m158_6, r158_5
-#  158|     m158_6(int)        = Store                     : &:r158_1, r158_5
+#  158|     m158_6(int)        = Store[d]                  : &:r158_1, r158_5
 #  158|         valnum = m158_6, r158_5
 #  159|     v159_1(void)       = NoOp                      : 
 #  152|     v152_7(void)       = ReturnVoid                :