Merge pull request #20319 from jketema/ir-vla-sizeof

C++: Support `sizeof` VLAs in the IR

cpp/ql/lib/change-notes/2025-09-02-vla.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added predicates `getTransitiveNumberOfVlaDimensionStmts`, `getTransitiveVlaDimensionStmt`, and `getParentVlaDecl` to `VlaDeclStmt` for handling `VlaDeclStmt`s whose base type defined in terms of an other `VlaDeclStmt` via a `typedef`.

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll

@@ -97,7 +97,14 @@ newtype TInstructionTag =
     exists(Stmt s | exists(s.getImplicitDestructorCall(index)))
   } or
   CoAwaitBranchTag() or
-  BoolToIntConversionTag()
+  BoolToIntConversionTag() or
+  SizeofVlaBaseSizeTag() or
+  SizeofVlaConversionTag(int index) {
+    exists(VlaDeclStmt v | exists(v.getTransitiveVlaDimensionStmt(index)))
+  } or
+  SizeofVlaDimensionTag(int index) {
+    exists(VlaDeclStmt v | exists(v.getTransitiveVlaDimensionStmt(index)))
+  }
 
 class InstructionTag extends TInstructionTag {
   final string toString() { result = getInstructionTagId(this) }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -123,13 +123,16 @@ private predicate ignoreExprAndDescendants(Expr expr) {
   //  or
   ignoreExprAndDescendants(getRealParent(expr)) // recursive case
   or
-  // va_start doesn't evaluate its argument, so we don't need to translate it.
+  // va_start does not evaluate its argument, so we do not need to translate it.
   exists(BuiltInVarArgsStart vaStartExpr |
     vaStartExpr.getLastNamedParameter().getFullyConverted() = expr
   )
   or
+  // sizeof does not evaluate its argument, so we do not need to translate it.
+  exists(SizeofExprOperator sizeofExpr | sizeofExpr.getExprOperand().getFullyConverted() = expr)
+  or
   // The children of C11 _Generic expressions are just surface syntax.
-  exists(C11GenericExpr generic | generic.getAChild() = expr)
+  exists(C11GenericExpr generic | generic.getAChild().getFullyConverted() = expr)
   or
   // Do not translate implicit destructor calls for unnamed temporary variables that are
   // conditionally constructed (until we have a mechanism for calling these only when the

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll

@@ -187,7 +187,7 @@ Variable getEnclosingVariable(Expr e) {
 }
 
 /**
- * The IR translation of the "core"  part of an expression. This is the part of
+ * The IR translation of the "core" part of an expression. This is the part of
  * the expression that produces the result value of the expression, before any
  * lvalue-to-rvalue conversion on the result. Every expression has a single
  * `TranslatedCoreExpr`.
@@ -4094,6 +4094,155 @@ class TranslatedStmtExpr extends TranslatedNonConstantExpr {
   TranslatedStmt getStmt() { result = getTranslatedStmt(expr.getStmt()) }
 }
 
+private VlaDeclStmt getVlaDeclStmt(Expr expr, int pointerDerefCount) {
+  expr.(VariableAccess).getTarget() = result.getVariable() and
+  pointerDerefCount = 0
+  or
+  not expr.(PointerDereferenceExpr).getOperand() instanceof AddressOfExpr and
+  result = getVlaDeclStmt(expr.(PointerDereferenceExpr).getOperand(), pointerDerefCount - 1)
+  or
+  // Skip sequences of the form `*&...`
+  result =
+    getVlaDeclStmt(expr.(PointerDereferenceExpr).getOperand().(AddressOfExpr).getOperand(),
+      pointerDerefCount)
+  or
+  result = getVlaDeclStmt(expr.(ArrayExpr).getArrayBase(), pointerDerefCount - 1)
+}
+
+/**
+ * The IR translation of `SizeofExprOperator` when its result is non-constant, i.e.,
+ * when the operand expression refers to a variable length array.
+ */
+class TranslatedSizeofExpr extends TranslatedNonConstantExpr {
+  override SizeofExprOperator expr;
+  VlaDeclStmt vlaDeclStmt;
+  int vlaDimensions;
+  int pointerDerefCount;
+
+  TranslatedSizeofExpr() {
+    vlaDeclStmt = getVlaDeclStmt(expr.getExprOperand(), pointerDerefCount) and
+    vlaDimensions = vlaDeclStmt.getTransitiveNumberOfVlaDimensionStmts() and
+    pointerDerefCount < vlaDimensions
+  }
+
+  final override Instruction getFirstInstruction(EdgeKind kind) {
+    result = this.getInstruction(SizeofVlaBaseSizeTag()) and
+    kind instanceof GotoEdge
+  }
+
+  override Instruction getALastInstructionInternal() {
+    result = this.getInstruction(SizeofVlaDimensionTag(vlaDimensions - 1))
+  }
+
+  final override TranslatedElement getChildInternal(int id) { none() }
+
+  final override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
+    opcode instanceof Opcode::Constant and
+    tag = SizeofVlaBaseSizeTag() and
+    resultType = this.getResultType()
+    or
+    exists(int n, Type dimType |
+      pointerDerefCount <= n and
+      n < vlaDimensions and
+      dimType = this.getDimensionExpr(n).getUnderlyingType() and
+      tag = SizeofVlaConversionTag(n)
+    |
+      (
+        expr.getUnderlyingType() = dimType and
+        opcode instanceof Opcode::CopyValue
+        or
+        not expr.getUnderlyingType() = dimType and
+        opcode instanceof Opcode::Convert
+      )
+    ) and
+    resultType = this.getResultType()
+    or
+    opcode instanceof Opcode::Mul and
+    exists(int n | pointerDerefCount <= n and n < vlaDimensions | tag = SizeofVlaDimensionTag(n)) and
+    resultType = this.getResultType()
+  }
+
+  final override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
+    tag = SizeofVlaBaseSizeTag() and
+    result = this.getInstruction(SizeofVlaConversionTag(pointerDerefCount)) and
+    kind instanceof GotoEdge
+    or
+    exists(int n | pointerDerefCount <= n and n < vlaDimensions |
+      tag = SizeofVlaConversionTag(n) and
+      result = this.getInstruction(SizeofVlaDimensionTag(n))
+    ) and
+    kind instanceof GotoEdge
+    or
+    exists(int n | pointerDerefCount <= n and n < vlaDimensions - 1 |
+      tag = SizeofVlaDimensionTag(n) and
+      result = this.getInstruction(SizeofVlaConversionTag(n + 1))
+    ) and
+    kind instanceof GotoEdge
+    or
+    tag = SizeofVlaDimensionTag(vlaDimensions - 1) and
+    result = this.getParent().getChildSuccessor(this, kind)
+  }
+
+  override string getInstructionConstantValue(InstructionTag tag) {
+    tag = SizeofVlaBaseSizeTag() and
+    result = this.getBaseType(vlaDeclStmt).getSize().toString()
+  }
+
+  private Type getBaseType(VlaDeclStmt v) {
+    not exists(v.getParentVlaDecl()) and
+    (
+      result =
+        this.getBaseType(v.getVariable().getUnderlyingType(), v.getNumberOfVlaDimensionStmts())
+      or
+      result = this.getBaseType(v.getType().getUnderlyingType(), v.getNumberOfVlaDimensionStmts())
+    )
+    or
+    result = this.getBaseType(v.getParentVlaDecl())
+  }
+
+  private Type getBaseType(Type type, int n) {
+    n = 0 and
+    result = type
+    or
+    result = this.getBaseType(type.(DerivedType).getBaseType(), n - 1)
+  }
+
+  override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
+    exists(int n | pointerDerefCount <= n and n < vlaDimensions |
+      tag = SizeofVlaConversionTag(n) and
+      (
+        operandTag instanceof UnaryOperandTag and
+        result = getTranslatedExpr(this.getDimensionExpr(n)).getResult()
+      )
+    )
+    or
+    exists(int n | pointerDerefCount <= n and n < vlaDimensions |
+      tag = SizeofVlaDimensionTag(n) and
+      (
+        operandTag instanceof LeftOperandTag and
+        (
+          n - 1 >= pointerDerefCount and
+          result = this.getInstruction(SizeofVlaDimensionTag(n - 1))
+          or
+          n - 1 < pointerDerefCount and
+          result = this.getInstruction(SizeofVlaBaseSizeTag())
+        )
+        or
+        operandTag instanceof RightOperandTag and
+        result = this.getInstruction(SizeofVlaConversionTag(n))
+      )
+    )
+  }
+
+  private Expr getDimensionExpr(int n) {
+    result = vlaDeclStmt.getTransitiveVlaDimensionStmt(n).getDimensionExpr().getFullyConverted()
+  }
+
+  final override Instruction getResult() {
+    result = this.getInstruction(SizeofVlaDimensionTag(vlaDimensions - 1))
+  }
+}
+
 class TranslatedErrorExpr extends TranslatedSingleInstructionExpr {
   override ErrorExpr expr;
 

cpp/ql/lib/semmle/code/cpp/stmts/Stmt.qll

@@ -2355,6 +2355,20 @@ class VlaDeclStmt extends Stmt, @stmt_vla_decl {
     )
   }
 
+  /**
+   * Gets the number of VLA dimension statements in this VLA declaration
+   * statement and transitively of the VLA declaration used to define its
+   * base type. if any.
+   */
+  int getTransitiveNumberOfVlaDimensionStmts() {
+    not exists(this.getParentVlaDecl()) and
+    result = this.getNumberOfVlaDimensionStmts()
+    or
+    result =
+      this.getNumberOfVlaDimensionStmts() +
+        this.getParentVlaDecl().getTransitiveNumberOfVlaDimensionStmts()
+  }
+
   /**
    * Gets the `i`th VLA dimension statement in this VLA
    * declaration statement.
@@ -2367,6 +2381,19 @@ class VlaDeclStmt extends Stmt, @stmt_vla_decl {
     )
   }
 
+  /**
+   * Gets the `i`th VLA dimension statement in this VLA declaration
+   * statement or transitively of the VLA declaration used to define
+   * its base type.
+   */
+  VlaDimensionStmt getTransitiveVlaDimensionStmt(int i) {
+    i < this.getNumberOfVlaDimensionStmts() and
+    result = this.getVlaDimensionStmt(i)
+    or
+    result =
+      this.getParentVlaDecl().getTransitiveVlaDimensionStmt(i - this.getNumberOfVlaDimensionStmts())
+  }
+
   /**
    * Gets the type that this VLA declaration statement relates to,
    * if any.
@@ -2378,4 +2405,31 @@ class VlaDeclStmt extends Stmt, @stmt_vla_decl {
    * if any.
    */
   Variable getVariable() { variable_vla(unresolveElement(result), underlyingElement(this)) }
+
+  /**
+   * Get the VLA declaration used to define the base type of
+   * this VLA declaration, if any.
+   */
+  VlaDeclStmt getParentVlaDecl() {
+    exists(Variable v, Type baseType |
+      v = this.getVariable() and
+      baseType = this.getBaseType(v.getType(), this.getNumberOfVlaDimensionStmts())
+    |
+      result.getType() = baseType
+    )
+    or
+    exists(Type t, Type baseType |
+      t = this.getType().(TypedefType).getBaseType() and
+      baseType = this.getBaseType(t, this.getNumberOfVlaDimensionStmts())
+    |
+      result.getType() = baseType
+    )
+  }
+
+  private Type getBaseType(Type type, int n) {
+    n = 0 and
+    result = type
+    or
+    result = this.getBaseType(type.(DerivedType).getBaseType(), n - 1)
+  }
 }

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -24581,6 +24581,516 @@ ir.cpp:
 # 2776|                 Value = [CStyleCast] 42
 # 2776|                 ValueCategory = prvalue
 # 2777|     getStmt(2): [ReturnStmt] return ...
+# 2779| [TopLevelFunction] void vla_sizeof_test(int, size_t, char)
+# 2779|   <params>: 
+# 2779|     getParameter(0): [Parameter] len1
+# 2779|         Type = [IntType] int
+# 2779|     getParameter(1): [Parameter] len2
+# 2779|         Type = [CTypedefType,Size_t] size_t
+# 2779|     getParameter(2): [Parameter] len3
+# 2779|         Type = [PlainCharType] char
+# 2779|   getEntryPoint(): [BlockStmt] { ... }
+# 2780|     getStmt(0): [DeclStmt] declaration
+# 2780|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of tmp1
+# 2780|           Type = [ArrayType] char[]
+# 2780|     getStmt(1): [VlaDimensionStmt] VLA dimension size
+# 2780|       getDimensionExpr(): [VariableAccess] len1
+# 2780|           Type = [IntType] int
+# 2780|           ValueCategory = prvalue(load)
+# 2780|     getStmt(2): [VlaDeclStmt] VLA declaration
+# 2781|     getStmt(3): [DeclStmt] declaration
+# 2781|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of x
+# 2781|           Type = [CTypedefType,Size_t] size_t
+# 2781|         getVariable().getInitializer(): [Initializer] initializer for x
+# 2781|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2781|               Type = [LongType] unsigned long
+# 2781|               ValueCategory = prvalue
+# 2781|             getExprOperand(): [VariableAccess] tmp1
+# 2781|                 Type = [ArrayType] char[]
+# 2781|                 ValueCategory = lvalue
+# 2781|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2781|                 Type = [ArrayType] char[]
+# 2781|                 ValueCategory = lvalue
+# 2782|     getStmt(4): [DeclStmt] declaration
+# 2782|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of tmp2
+# 2782|           Type = [ArrayType] int[][]
+# 2782|     getStmt(5): [VlaDimensionStmt] VLA dimension size
+# 2782|       getDimensionExpr(): [VariableAccess] len1
+# 2782|           Type = [IntType] int
+# 2782|           ValueCategory = prvalue(load)
+# 2782|     getStmt(6): [VlaDimensionStmt] VLA dimension size
+# 2782|       getDimensionExpr(): [VariableAccess] len2
+# 2782|           Type = [CTypedefType,Size_t] size_t
+# 2782|           ValueCategory = prvalue(load)
+# 2782|     getStmt(7): [VlaDeclStmt] VLA declaration
+# 2783|     getStmt(8): [DeclStmt] declaration
+# 2783|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of y
+# 2783|           Type = [CTypedefType,Size_t] size_t
+# 2783|         getVariable().getInitializer(): [Initializer] initializer for y
+# 2783|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2783|               Type = [LongType] unsigned long
+# 2783|               ValueCategory = prvalue
+# 2783|             getExprOperand(): [VariableAccess] tmp2
+# 2783|                 Type = [ArrayType] int[][]
+# 2783|                 ValueCategory = lvalue
+# 2783|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2783|                 Type = [ArrayType] int[][]
+# 2783|                 ValueCategory = lvalue
+# 2784|     getStmt(9): [DeclStmt] declaration
+# 2784|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of z
+# 2784|           Type = [CTypedefType,Size_t] size_t
+# 2784|         getVariable().getInitializer(): [Initializer] initializer for z
+# 2784|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2784|               Type = [LongType] unsigned long
+# 2784|               ValueCategory = prvalue
+# 2784|             getExprOperand(): [PointerDereferenceExpr] * ...
+# 2784|                 Type = [ArrayType] int[]
+# 2784|                 ValueCategory = lvalue
+# 2784|               getOperand(): [VariableAccess] tmp2
+# 2784|                   Type = [ArrayType] int[][]
+# 2784|                   ValueCategory = lvalue
+# 2784|               getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2784|                   Type = [PointerType] int(*)[]
+# 2784|                   ValueCategory = prvalue
+# 2784|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2784|                 Type = [ArrayType] int[]
+# 2784|                 ValueCategory = lvalue
+# 2785|     getStmt(10): [DeclStmt] declaration
+# 2785|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of tmp3
+# 2785|           Type = [ArrayType] int[][][]
+# 2785|     getStmt(11): [VlaDimensionStmt] VLA dimension size
+# 2785|       getDimensionExpr(): [VariableAccess] len1
+# 2785|           Type = [IntType] int
+# 2785|           ValueCategory = prvalue(load)
+# 2785|     getStmt(12): [VlaDimensionStmt] VLA dimension size
+# 2785|       getDimensionExpr(): [VariableAccess] len2
+# 2785|           Type = [CTypedefType,Size_t] size_t
+# 2785|           ValueCategory = prvalue(load)
+# 2785|     getStmt(13): [VlaDimensionStmt] VLA dimension size
+# 2785|       getDimensionExpr(): [VariableAccess] len3
+# 2785|           Type = [PlainCharType] char
+# 2785|           ValueCategory = prvalue(load)
+# 2785|     getStmt(14): [VlaDeclStmt] VLA declaration
+# 2786|     getStmt(15): [DeclStmt] declaration
+# 2786|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of w
+# 2786|           Type = [CTypedefType,Size_t] size_t
+# 2786|         getVariable().getInitializer(): [Initializer] initializer for w
+# 2786|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2786|               Type = [LongType] unsigned long
+# 2786|               ValueCategory = prvalue
+# 2786|             getExprOperand(): [VariableAccess] tmp3
+# 2786|                 Type = [ArrayType] int[][][]
+# 2786|                 ValueCategory = lvalue
+# 2786|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2786|                 Type = [ArrayType] int[][][]
+# 2786|                 ValueCategory = lvalue
+# 2787|     getStmt(16): [DeclStmt] declaration
+# 2787|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of v
+# 2787|           Type = [CTypedefType,Size_t] size_t
+# 2787|         getVariable().getInitializer(): [Initializer] initializer for v
+# 2787|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2787|               Type = [LongType] unsigned long
+# 2787|               ValueCategory = prvalue
+# 2787|             getExprOperand(): [PointerDereferenceExpr] * ...
+# 2787|                 Type = [ArrayType] int[][]
+# 2787|                 ValueCategory = lvalue
+# 2787|               getOperand(): [VariableAccess] tmp3
+# 2787|                   Type = [ArrayType] int[][][]
+# 2787|                   ValueCategory = lvalue
+# 2787|               getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2787|                   Type = [PointerType] int(*)[][]
+# 2787|                   ValueCategory = prvalue
+# 2787|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2787|                 Type = [ArrayType] int[][]
+# 2787|                 ValueCategory = lvalue
+# 2788|     getStmt(17): [DeclStmt] declaration
+# 2788|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of u
+# 2788|           Type = [CTypedefType,Size_t] size_t
+# 2788|         getVariable().getInitializer(): [Initializer] initializer for u
+# 2788|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2788|               Type = [LongType] unsigned long
+# 2788|               ValueCategory = prvalue
+# 2788|             getExprOperand(): [PointerDereferenceExpr] * ...
+# 2788|                 Type = [ArrayType] int[]
+# 2788|                 ValueCategory = lvalue
+# 2788|               getOperand(): [PointerDereferenceExpr] * ...
+# 2788|                   Type = [ArrayType] int[][]
+# 2788|                   ValueCategory = lvalue
+# 2788|                 getOperand(): [VariableAccess] tmp3
+# 2788|                     Type = [ArrayType] int[][][]
+# 2788|                     ValueCategory = lvalue
+# 2788|                 getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2788|                     Type = [PointerType] int(*)[][]
+# 2788|                     ValueCategory = prvalue
+# 2788|               getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2788|                   Type = [PointerType] int(*)[]
+# 2788|                   ValueCategory = prvalue
+# 2788|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2788|                 Type = [ArrayType] int[]
+# 2788|                 ValueCategory = lvalue
+# 2789|     getStmt(18): [DeclStmt] declaration
+# 2789|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of t
+# 2789|           Type = [CTypedefType,Size_t] size_t
+# 2789|         getVariable().getInitializer(): [Initializer] initializer for t
+# 2789|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2789|               Type = [LongType] unsigned long
+# 2789|               Value = [SizeofExprOperator] 4
+# 2789|               ValueCategory = prvalue
+# 2789|             getExprOperand(): [PointerDereferenceExpr] * ...
+# 2789|                 Type = [IntType] int
+# 2789|                 ValueCategory = lvalue
+# 2789|               getOperand(): [PointerDereferenceExpr] * ...
+# 2789|                   Type = [ArrayType] int[]
+# 2789|                   ValueCategory = lvalue
+# 2789|                 getOperand(): [PointerDereferenceExpr] * ...
+# 2789|                     Type = [ArrayType] int[][]
+# 2789|                     ValueCategory = lvalue
+# 2789|                   getOperand(): [VariableAccess] tmp3
+# 2789|                       Type = [ArrayType] int[][][]
+# 2789|                       ValueCategory = lvalue
+# 2789|                   getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2789|                       Type = [PointerType] int(*)[][]
+# 2789|                       ValueCategory = prvalue
+# 2789|                 getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2789|                     Type = [PointerType] int(*)[]
+# 2789|                     ValueCategory = prvalue
+# 2789|               getOperand().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2789|                   Type = [IntPointerType] int *
+# 2789|                   ValueCategory = prvalue
+# 2789|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2789|                 Type = [IntType] int
+# 2789|                 ValueCategory = lvalue
+# 2790|     getStmt(19): [ReturnStmt] return ...
+# 2792| [TopLevelFunction] void vla_sizeof_test2(int, size_t, char)
+# 2792|   <params>: 
+# 2792|     getParameter(0): [Parameter] len1
+# 2792|         Type = [IntType] int
+# 2792|     getParameter(1): [Parameter] len2
+# 2792|         Type = [CTypedefType,Size_t] size_t
+# 2792|     getParameter(2): [Parameter] len3
+# 2792|         Type = [PlainCharType] char
+# 2792|   getEntryPoint(): [BlockStmt] { ... }
+# 2793|     getStmt(0): [DeclStmt] declaration
+# 2793|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of tmp1
+# 2793|           Type = [ArrayType] int[][]
+# 2793|     getStmt(1): [VlaDimensionStmt] VLA dimension size
+# 2793|       getDimensionExpr(): [VariableAccess] len1
+# 2793|           Type = [IntType] int
+# 2793|           ValueCategory = prvalue(load)
+# 2793|     getStmt(2): [VlaDimensionStmt] VLA dimension size
+# 2793|       getDimensionExpr(): [VariableAccess] len2
+# 2793|           Type = [CTypedefType,Size_t] size_t
+# 2793|           ValueCategory = prvalue(load)
+# 2793|     getStmt(3): [VlaDeclStmt] VLA declaration
+# 2794|     getStmt(4): [DeclStmt] declaration
+# 2794|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of z
+# 2794|           Type = [CTypedefType,Size_t] size_t
+# 2794|         getVariable().getInitializer(): [Initializer] initializer for z
+# 2794|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2794|               Type = [LongType] unsigned long
+# 2794|               ValueCategory = prvalue
+# 2794|             getExprOperand(): [ArrayExpr] access to array
+# 2794|                 Type = [ArrayType] int[]
+# 2794|                 ValueCategory = lvalue
+# 2794|               getArrayBase(): [VariableAccess] tmp1
+# 2794|                   Type = [ArrayType] int[][]
+# 2794|                   ValueCategory = lvalue
+# 2794|               getArrayOffset(): [Literal] 1
+# 2794|                   Type = [IntType] int
+# 2794|                   Value = [Literal] 1
+# 2794|                   ValueCategory = prvalue
+# 2794|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2794|                   Type = [PointerType] int(*)[]
+# 2794|                   ValueCategory = prvalue
+# 2794|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2794|                 Type = [ArrayType] int[]
+# 2794|                 ValueCategory = lvalue
+# 2795|     getStmt(5): [DeclStmt] declaration
+# 2795|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of tmp2
+# 2795|           Type = [ArrayType] int[][][]
+# 2795|     getStmt(6): [VlaDimensionStmt] VLA dimension size
+# 2795|       getDimensionExpr(): [VariableAccess] len1
+# 2795|           Type = [IntType] int
+# 2795|           ValueCategory = prvalue(load)
+# 2795|     getStmt(7): [VlaDimensionStmt] VLA dimension size
+# 2795|       getDimensionExpr(): [VariableAccess] len2
+# 2795|           Type = [CTypedefType,Size_t] size_t
+# 2795|           ValueCategory = prvalue(load)
+# 2795|     getStmt(8): [VlaDimensionStmt] VLA dimension size
+# 2795|       getDimensionExpr(): [VariableAccess] len3
+# 2795|           Type = [PlainCharType] char
+# 2795|           ValueCategory = prvalue(load)
+# 2795|     getStmt(9): [VlaDeclStmt] VLA declaration
+# 2796|     getStmt(10): [DeclStmt] declaration
+# 2796|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of v
+# 2796|           Type = [CTypedefType,Size_t] size_t
+# 2796|         getVariable().getInitializer(): [Initializer] initializer for v
+# 2796|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2796|               Type = [LongType] unsigned long
+# 2796|               ValueCategory = prvalue
+# 2796|             getExprOperand(): [ArrayExpr] access to array
+# 2796|                 Type = [ArrayType] int[][]
+# 2796|                 ValueCategory = lvalue
+# 2796|               getArrayBase(): [VariableAccess] tmp2
+# 2796|                   Type = [ArrayType] int[][][]
+# 2796|                   ValueCategory = lvalue
+# 2796|               getArrayOffset(): [Literal] 1
+# 2796|                   Type = [IntType] int
+# 2796|                   Value = [Literal] 1
+# 2796|                   ValueCategory = prvalue
+# 2796|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2796|                   Type = [PointerType] int(*)[][]
+# 2796|                   ValueCategory = prvalue
+# 2796|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2796|                 Type = [ArrayType] int[][]
+# 2796|                 ValueCategory = lvalue
+# 2797|     getStmt(11): [DeclStmt] declaration
+# 2797|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of u
+# 2797|           Type = [CTypedefType,Size_t] size_t
+# 2797|         getVariable().getInitializer(): [Initializer] initializer for u
+# 2797|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2797|               Type = [LongType] unsigned long
+# 2797|               ValueCategory = prvalue
+# 2797|             getExprOperand(): [ArrayExpr] access to array
+# 2797|                 Type = [ArrayType] int[]
+# 2797|                 ValueCategory = lvalue
+# 2797|               getArrayBase(): [ArrayExpr] access to array
+# 2797|                   Type = [ArrayType] int[][]
+# 2797|                   ValueCategory = lvalue
+# 2797|                 getArrayBase(): [VariableAccess] tmp2
+# 2797|                     Type = [ArrayType] int[][][]
+# 2797|                     ValueCategory = lvalue
+# 2797|                 getArrayOffset(): [Literal] 1
+# 2797|                     Type = [IntType] int
+# 2797|                     Value = [Literal] 1
+# 2797|                     ValueCategory = prvalue
+# 2797|                 getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2797|                     Type = [PointerType] int(*)[][]
+# 2797|                     ValueCategory = prvalue
+# 2797|               getArrayOffset(): [Literal] 2
+# 2797|                   Type = [IntType] int
+# 2797|                   Value = [Literal] 2
+# 2797|                   ValueCategory = prvalue
+# 2797|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2797|                   Type = [PointerType] int(*)[]
+# 2797|                   ValueCategory = prvalue
+# 2797|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2797|                 Type = [ArrayType] int[]
+# 2797|                 ValueCategory = lvalue
+# 2798|     getStmt(12): [DeclStmt] declaration
+# 2798|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of t
+# 2798|           Type = [CTypedefType,Size_t] size_t
+# 2798|         getVariable().getInitializer(): [Initializer] initializer for t
+# 2798|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2798|               Type = [LongType] unsigned long
+# 2798|               Value = [SizeofExprOperator] 4
+# 2798|               ValueCategory = prvalue
+# 2798|             getExprOperand(): [ArrayExpr] access to array
+# 2798|                 Type = [IntType] int
+# 2798|                 ValueCategory = lvalue
+# 2798|               getArrayBase(): [ArrayExpr] access to array
+# 2798|                   Type = [ArrayType] int[]
+# 2798|                   ValueCategory = lvalue
+# 2798|                 getArrayBase(): [ArrayExpr] access to array
+# 2798|                     Type = [ArrayType] int[][]
+# 2798|                     ValueCategory = lvalue
+# 2798|                   getArrayBase(): [VariableAccess] tmp2
+# 2798|                       Type = [ArrayType] int[][][]
+# 2798|                       ValueCategory = lvalue
+# 2798|                   getArrayOffset(): [Literal] 1
+# 2798|                       Type = [IntType] int
+# 2798|                       Value = [Literal] 1
+# 2798|                       ValueCategory = prvalue
+# 2798|                   getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2798|                       Type = [PointerType] int(*)[][]
+# 2798|                       ValueCategory = prvalue
+# 2798|                 getArrayOffset(): [Literal] 2
+# 2798|                     Type = [IntType] int
+# 2798|                     Value = [Literal] 2
+# 2798|                     ValueCategory = prvalue
+# 2798|                 getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2798|                     Type = [PointerType] int(*)[]
+# 2798|                     ValueCategory = prvalue
+# 2798|               getArrayOffset(): [Literal] 3
+# 2798|                   Type = [IntType] int
+# 2798|                   Value = [Literal] 3
+# 2798|                   ValueCategory = prvalue
+# 2798|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2798|                   Type = [IntPointerType] int *
+# 2798|                   ValueCategory = prvalue
+# 2798|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2798|                 Type = [IntType] int
+# 2798|                 ValueCategory = lvalue
+# 2799|     getStmt(13): [ReturnStmt] return ...
+# 2801| [TopLevelFunction] size_t vla_sizeof_test3(int, size_t, char, bool)
+# 2801|   <params>: 
+# 2801|     getParameter(0): [Parameter] len1
+# 2801|         Type = [IntType] int
+# 2801|     getParameter(1): [Parameter] len2
+# 2801|         Type = [CTypedefType,Size_t] size_t
+# 2801|     getParameter(2): [Parameter] len3
+# 2801|         Type = [PlainCharType] char
+# 2801|     getParameter(3): [Parameter] b
+# 2801|         Type = [BoolType] bool
+# 2801|   getEntryPoint(): [BlockStmt] { ... }
+# 2802|     getStmt(0): [DeclStmt] declaration
+# 2802|       getDeclarationEntry(0): [TypeDeclarationEntry] declaration of arr
+# 2802|           Type = [CTypedefType,LocalTypedefType] arr
+# 2802|     getStmt(1): [VlaDimensionStmt] VLA dimension size
+# 2802|       getDimensionExpr(): [VariableAccess] len1
+# 2802|           Type = [IntType] int
+# 2802|           ValueCategory = prvalue(load)
+# 2802|     getStmt(2): [VlaDimensionStmt] VLA dimension size
+# 2802|       getDimensionExpr(): [VariableAccess] len2
+# 2802|           Type = [CTypedefType,Size_t] size_t
+# 2802|           ValueCategory = prvalue(load)
+# 2802|     getStmt(3): [VlaDeclStmt] VLA declaration
+# 2803|     getStmt(4): [DeclStmt] declaration
+# 2803|       getDeclarationEntry(0): [TypeDeclarationEntry] declaration of arr2
+# 2803|           Type = [CTypedefType,LocalTypedefType] arr2
+# 2803|     getStmt(5): [VlaDeclStmt] VLA declaration
+# 2804|     getStmt(6): [DeclStmt] declaration
+# 2804|       getDeclarationEntry(0): [TypeDeclarationEntry] declaration of arr3
+# 2804|           Type = [CTypedefType,LocalTypedefType] arr3
+# 2804|     getStmt(7): [VlaDimensionStmt] VLA dimension size
+# 2804|       getDimensionExpr(): [VariableAccess] len3
+# 2804|           Type = [PlainCharType] char
+# 2804|           ValueCategory = prvalue(load)
+# 2804|     getStmt(8): [VlaDeclStmt] VLA declaration
+# 2806|     getStmt(9): [IfStmt] if (...) ... 
+# 2806|       getCondition(): [VariableAccess] b
+# 2806|           Type = [BoolType] bool
+# 2806|           ValueCategory = prvalue(load)
+# 2806|       getThen(): [BlockStmt] { ... }
+# 2807|         getStmt(0): [DeclStmt] declaration
+# 2807|           getDeclarationEntry(0): [VariableDeclarationEntry] definition of tmp
+# 2807|               Type = [CTypedefType,LocalTypedefType] arr3
+# 2807|         getStmt(1): [VlaDeclStmt] VLA declaration
+# 2808|         getStmt(2): [ReturnStmt] return ...
+# 2808|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2808|               Type = [LongType] unsigned long
+# 2808|               ValueCategory = prvalue
+# 2808|             getExprOperand(): [ArrayExpr] access to array
+# 2808|                 Type = [CTypedefType,LocalTypedefType] arr2
+# 2808|                 ValueCategory = lvalue
+# 2808|               getArrayBase(): [VariableAccess] tmp
+# 2808|                   Type = [CTypedefType,LocalTypedefType] arr3
+# 2808|                   ValueCategory = lvalue
+# 2808|               getArrayOffset(): [Literal] 1
+# 2808|                   Type = [IntType] int
+# 2808|                   Value = [Literal] 1
+# 2808|                   ValueCategory = prvalue
+# 2808|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2808|                   Type = [PointerType] arr2 *
+# 2808|                   ValueCategory = prvalue
+# 2808|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2808|                 Type = [CTypedefType,LocalTypedefType] arr2
+# 2808|                 ValueCategory = lvalue
+# 2811|     getStmt(10): [ReturnStmt] return ...
+# 2811|       getExpr(): [Literal] 0
+# 2811|           Type = [IntType] int
+# 2811|           Value = [Literal] 0
+# 2811|           ValueCategory = prvalue
+# 2811|       getExpr().getFullyConverted(): [CStyleCast] (size_t)...
+# 2811|           Conversion = [IntegralConversion] integral conversion
+# 2811|           Type = [CTypedefType,Size_t] size_t
+# 2811|           Value = [CStyleCast] 0
+# 2811|           ValueCategory = prvalue
+# 2814| [TopLevelFunction] void vla_sizeof_test4(int, size_t)
+# 2814|   <params>: 
+# 2814|     getParameter(0): [Parameter] len1
+# 2814|         Type = [IntType] int
+# 2814|     getParameter(1): [Parameter] len2
+# 2814|         Type = [CTypedefType,Size_t] size_t
+# 2814|   getEntryPoint(): [BlockStmt] { ... }
+# 2815|     getStmt(0): [DeclStmt] declaration
+# 2815|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of tmp1
+# 2815|           Type = [ArrayType] int[][]
+# 2815|     getStmt(1): [VlaDimensionStmt] VLA dimension size
+# 2815|       getDimensionExpr(): [VariableAccess] len1
+# 2815|           Type = [IntType] int
+# 2815|           ValueCategory = prvalue(load)
+# 2815|     getStmt(2): [VlaDimensionStmt] VLA dimension size
+# 2815|       getDimensionExpr(): [VariableAccess] len2
+# 2815|           Type = [CTypedefType,Size_t] size_t
+# 2815|           ValueCategory = prvalue(load)
+# 2815|     getStmt(3): [VlaDeclStmt] VLA declaration
+# 2816|     getStmt(4): [DeclStmt] declaration
+# 2816|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of z
+# 2816|           Type = [CTypedefType,Size_t] size_t
+# 2816|         getVariable().getInitializer(): [Initializer] initializer for z
+# 2816|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2816|               Type = [LongType] unsigned long
+# 2816|               ValueCategory = prvalue
+# 2816|             getExprOperand(): [ArrayExpr] access to array
+# 2816|                 Type = [ArrayType] int[]
+# 2816|                 ValueCategory = lvalue
+# 2816|               getArrayBase(): [VariableAccess] tmp1
+# 2816|                   Type = [ArrayType] int[][]
+# 2816|                   ValueCategory = lvalue
+# 2816|               getArrayOffset(): [Literal] 1
+# 2816|                   Type = [IntType] int
+# 2816|                   Value = [Literal] 1
+# 2816|                   ValueCategory = prvalue
+# 2816|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 2816|                   Type = [PointerType] int(*)[]
+# 2816|                   ValueCategory = prvalue
+# 2816|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2816|                 Type = [ArrayType] int[]
+# 2816|                 ValueCategory = lvalue
+# 2817|     getStmt(5): [ReturnStmt] return ...
+# 2819| [TopLevelFunction] void vla_sizeof_test5(int, size_t)
+# 2819|   <params>: 
+# 2819|     getParameter(0): [Parameter] len1
+# 2819|         Type = [IntType] int
+# 2819|     getParameter(1): [Parameter] len2
+# 2819|         Type = [CTypedefType,Size_t] size_t
+# 2819|   getEntryPoint(): [BlockStmt] { ... }
+# 2820|     getStmt(0): [DeclStmt] declaration
+# 2820|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of tmp1
+# 2820|           Type = [ArrayType] int[][]
+# 2820|     getStmt(1): [VlaDimensionStmt] VLA dimension size
+# 2820|       getDimensionExpr(): [VariableAccess] len1
+# 2820|           Type = [IntType] int
+# 2820|           ValueCategory = prvalue(load)
+# 2820|     getStmt(2): [VlaDimensionStmt] VLA dimension size
+# 2820|       getDimensionExpr(): [VariableAccess] len2
+# 2820|           Type = [CTypedefType,Size_t] size_t
+# 2820|           ValueCategory = prvalue(load)
+# 2820|     getStmt(3): [VlaDeclStmt] VLA declaration
+# 2821|     getStmt(4): [DeclStmt] declaration
+# 2821|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of z
+# 2821|           Type = [CTypedefType,Size_t] size_t
+# 2821|         getVariable().getInitializer(): [Initializer] initializer for z
+# 2821|           getExpr(): [SizeofExprOperator] sizeof(<expr>)
+# 2821|               Type = [LongType] unsigned long
+# 2821|               ValueCategory = prvalue
+# 2821|             getExprOperand(): [ArrayExpr] access to array
+# 2821|                 Type = [ArrayType] int[]
+# 2821|                 ValueCategory = lvalue
+# 2821|               getArrayBase(): [PointerDereferenceExpr] * ...
+# 2821|                   Type = [ArrayType] int[][]
+# 2821|                   ValueCategory = lvalue
+# 2821|                 getOperand(): [AddressOfExpr] & ...
+# 2821|                     Type = [PointerType] int(*)[][]
+# 2821|                     ValueCategory = prvalue
+# 2821|                   getOperand(): [VariableAccess] tmp1
+# 2821|                       Type = [ArrayType] int[][]
+# 2821|                       ValueCategory = lvalue
+# 2821|               getArrayOffset(): [Literal] 1
+# 2821|                   Type = [IntType] int
+# 2821|                   Value = [Literal] 1
+# 2821|                   ValueCategory = prvalue
+# 2821|               getArrayBase().getFullyConverted(): [ParenthesisExpr] (...)
+# 2821|                   Type = [PointerType] int(*)[]
+# 2821|                   ValueCategory = prvalue
+# 2821|                 getExpr(): [ArrayToPointerConversion] array to pointer conversion
+# 2821|                     Type = [PointerType] int(*)[]
+# 2821|                     ValueCategory = prvalue
+# 2821|             getExprOperand().getFullyConverted(): [ParenthesisExpr] (...)
+# 2821|                 Type = [ArrayType] int[]
+# 2821|                 ValueCategory = lvalue
+# 2822|     getStmt(5): [ReturnStmt] return ...
 ir23.cpp:
 #    1| [TopLevelFunction] bool consteval_1()
 #    1|   <params>: 

cpp/ql/test/library-tests/ir/ir/aliased_ir.expected

@@ -20430,6 +20430,247 @@ ir.cpp:
 # 2774|     v2774_6(void)           = AliasedUse                    : ~m2776_6
 # 2774|     v2774_7(void)           = ExitFunction                  : 
 
+# 2779| void vla_sizeof_test(int, size_t, char)
+# 2779|   Block 0
+# 2779|     v2779_1(void)                 = EnterFunction             : 
+# 2779|     m2779_2(unknown)              = AliasedDefinition         : 
+# 2779|     m2779_3(unknown)              = InitializeNonLocal        : 
+# 2779|     m2779_4(unknown)              = Chi                       : total:m2779_2, partial:m2779_3
+# 2779|     r2779_5(glval<int>)           = VariableAddress[len1]     : 
+# 2779|     m2779_6(int)                  = InitializeParameter[len1] : &:r2779_5
+# 2779|     r2779_7(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2779|     m2779_8(unsigned long)        = InitializeParameter[len2] : &:r2779_7
+# 2779|     r2779_9(glval<char>)          = VariableAddress[len3]     : 
+# 2779|     m2779_10(char)                = InitializeParameter[len3] : &:r2779_9
+# 2780|     r2780_1(glval<char[]>)        = VariableAddress[tmp1]     : 
+# 2780|     m2780_2(char[])               = Uninitialized[tmp1]       : &:r2780_1
+# 2780|     r2780_3(glval<int>)           = VariableAddress[len1]     : 
+# 2780|     r2780_4(int)                  = Load[len1]                : &:r2780_3, m2779_6
+# 2780|     v2780_5(void)                 = NoOp                      : 
+# 2781|     r2781_1(glval<unsigned long>) = VariableAddress[x]        : 
+# 2781|     r2781_2(unsigned long)        = Constant[1]               : 
+# 2781|     r2781_3(unsigned long)        = Convert                   : r2780_4
+# 2781|     r2781_4(unsigned long)        = Mul                       : r2781_2, r2781_3
+# 2781|     m2781_5(unsigned long)        = Store[x]                  : &:r2781_1, r2781_4
+# 2782|     r2782_1(glval<int[][]>)       = VariableAddress[tmp2]     : 
+# 2782|     m2782_2(int[][])              = Uninitialized[tmp2]       : &:r2782_1
+# 2782|     r2782_3(glval<int>)           = VariableAddress[len1]     : 
+# 2782|     r2782_4(int)                  = Load[len1]                : &:r2782_3, m2779_6
+# 2782|     r2782_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2782|     r2782_6(unsigned long)        = Load[len2]                : &:r2782_5, m2779_8
+# 2782|     v2782_7(void)                 = NoOp                      : 
+# 2783|     r2783_1(glval<unsigned long>) = VariableAddress[y]        : 
+# 2783|     r2783_2(unsigned long)        = Constant[4]               : 
+# 2783|     r2783_3(unsigned long)        = Convert                   : r2782_4
+# 2783|     r2783_4(unsigned long)        = Mul                       : r2783_2, r2783_3
+# 2783|     r2783_5(unsigned long)        = CopyValue                 : r2782_6
+# 2783|     r2783_6(unsigned long)        = Mul                       : r2783_4, r2783_5
+# 2783|     m2783_7(unsigned long)        = Store[y]                  : &:r2783_1, r2783_6
+# 2784|     r2784_1(glval<unsigned long>) = VariableAddress[z]        : 
+# 2784|     r2784_2(unsigned long)        = Constant[4]               : 
+# 2784|     r2784_3(unsigned long)        = CopyValue                 : r2782_6
+# 2784|     r2784_4(unsigned long)        = Mul                       : r2784_2, r2784_3
+# 2784|     m2784_5(unsigned long)        = Store[z]                  : &:r2784_1, r2784_4
+# 2785|     r2785_1(glval<int[][][]>)     = VariableAddress[tmp3]     : 
+# 2785|     m2785_2(int[][][])            = Uninitialized[tmp3]       : &:r2785_1
+# 2785|     r2785_3(glval<int>)           = VariableAddress[len1]     : 
+# 2785|     r2785_4(int)                  = Load[len1]                : &:r2785_3, m2779_6
+# 2785|     r2785_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2785|     r2785_6(unsigned long)        = Load[len2]                : &:r2785_5, m2779_8
+# 2785|     r2785_7(glval<char>)          = VariableAddress[len3]     : 
+# 2785|     r2785_8(char)                 = Load[len3]                : &:r2785_7, m2779_10
+# 2785|     v2785_9(void)                 = NoOp                      : 
+# 2786|     r2786_1(glval<unsigned long>) = VariableAddress[w]        : 
+# 2786|     r2786_2(unsigned long)        = Constant[4]               : 
+# 2786|     r2786_3(unsigned long)        = Convert                   : r2785_4
+# 2786|     r2786_4(unsigned long)        = Mul                       : r2786_2, r2786_3
+# 2786|     r2786_5(unsigned long)        = CopyValue                 : r2785_6
+# 2786|     r2786_6(unsigned long)        = Mul                       : r2786_4, r2786_5
+# 2786|     r2786_7(unsigned long)        = Convert                   : r2785_8
+# 2786|     r2786_8(unsigned long)        = Mul                       : r2786_6, r2786_7
+# 2786|     m2786_9(unsigned long)        = Store[w]                  : &:r2786_1, r2786_8
+# 2787|     r2787_1(glval<unsigned long>) = VariableAddress[v]        : 
+# 2787|     r2787_2(unsigned long)        = Constant[4]               : 
+# 2787|     r2787_3(unsigned long)        = CopyValue                 : r2785_6
+# 2787|     r2787_4(unsigned long)        = Mul                       : r2787_2, r2787_3
+# 2787|     r2787_5(unsigned long)        = Convert                   : r2785_8
+# 2787|     r2787_6(unsigned long)        = Mul                       : r2787_4, r2787_5
+# 2787|     m2787_7(unsigned long)        = Store[v]                  : &:r2787_1, r2787_6
+# 2788|     r2788_1(glval<unsigned long>) = VariableAddress[u]        : 
+# 2788|     r2788_2(unsigned long)        = Constant[4]               : 
+# 2788|     r2788_3(unsigned long)        = Convert                   : r2785_8
+# 2788|     r2788_4(unsigned long)        = Mul                       : r2788_2, r2788_3
+# 2788|     m2788_5(unsigned long)        = Store[u]                  : &:r2788_1, r2788_4
+# 2789|     r2789_1(glval<unsigned long>) = VariableAddress[t]        : 
+# 2789|     r2789_2(unsigned long)        = Constant[4]               : 
+# 2789|     m2789_3(unsigned long)        = Store[t]                  : &:r2789_1, r2789_2
+# 2790|     v2790_1(void)                 = NoOp                      : 
+# 2779|     v2779_11(void)                = ReturnVoid                : 
+# 2779|     v2779_12(void)                = AliasedUse                : m2779_3
+# 2779|     v2779_13(void)                = ExitFunction              : 
+
+# 2792| void vla_sizeof_test2(int, size_t, char)
+# 2792|   Block 0
+# 2792|     v2792_1(void)                 = EnterFunction             : 
+# 2792|     m2792_2(unknown)              = AliasedDefinition         : 
+# 2792|     m2792_3(unknown)              = InitializeNonLocal        : 
+# 2792|     m2792_4(unknown)              = Chi                       : total:m2792_2, partial:m2792_3
+# 2792|     r2792_5(glval<int>)           = VariableAddress[len1]     : 
+# 2792|     m2792_6(int)                  = InitializeParameter[len1] : &:r2792_5
+# 2792|     r2792_7(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2792|     m2792_8(unsigned long)        = InitializeParameter[len2] : &:r2792_7
+# 2792|     r2792_9(glval<char>)          = VariableAddress[len3]     : 
+# 2792|     m2792_10(char)                = InitializeParameter[len3] : &:r2792_9
+# 2793|     r2793_1(glval<int[][]>)       = VariableAddress[tmp1]     : 
+# 2793|     m2793_2(int[][])              = Uninitialized[tmp1]       : &:r2793_1
+# 2793|     r2793_3(glval<int>)           = VariableAddress[len1]     : 
+# 2793|     r2793_4(int)                  = Load[len1]                : &:r2793_3, m2792_6
+# 2793|     r2793_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2793|     r2793_6(unsigned long)        = Load[len2]                : &:r2793_5, m2792_8
+# 2793|     v2793_7(void)                 = NoOp                      : 
+# 2794|     r2794_1(glval<unsigned long>) = VariableAddress[z]        : 
+# 2794|     r2794_2(unsigned long)        = Constant[4]               : 
+# 2794|     r2794_3(unsigned long)        = CopyValue                 : r2793_6
+# 2794|     r2794_4(unsigned long)        = Mul                       : r2794_2, r2794_3
+# 2794|     m2794_5(unsigned long)        = Store[z]                  : &:r2794_1, r2794_4
+# 2795|     r2795_1(glval<int[][][]>)     = VariableAddress[tmp2]     : 
+# 2795|     m2795_2(int[][][])            = Uninitialized[tmp2]       : &:r2795_1
+# 2795|     r2795_3(glval<int>)           = VariableAddress[len1]     : 
+# 2795|     r2795_4(int)                  = Load[len1]                : &:r2795_3, m2792_6
+# 2795|     r2795_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2795|     r2795_6(unsigned long)        = Load[len2]                : &:r2795_5, m2792_8
+# 2795|     r2795_7(glval<char>)          = VariableAddress[len3]     : 
+# 2795|     r2795_8(char)                 = Load[len3]                : &:r2795_7, m2792_10
+# 2795|     v2795_9(void)                 = NoOp                      : 
+# 2796|     r2796_1(glval<unsigned long>) = VariableAddress[v]        : 
+# 2796|     r2796_2(unsigned long)        = Constant[4]               : 
+# 2796|     r2796_3(unsigned long)        = CopyValue                 : r2795_6
+# 2796|     r2796_4(unsigned long)        = Mul                       : r2796_2, r2796_3
+# 2796|     r2796_5(unsigned long)        = Convert                   : r2795_8
+# 2796|     r2796_6(unsigned long)        = Mul                       : r2796_4, r2796_5
+# 2796|     m2796_7(unsigned long)        = Store[v]                  : &:r2796_1, r2796_6
+# 2797|     r2797_1(glval<unsigned long>) = VariableAddress[u]        : 
+# 2797|     r2797_2(unsigned long)        = Constant[4]               : 
+# 2797|     r2797_3(unsigned long)        = Convert                   : r2795_8
+# 2797|     r2797_4(unsigned long)        = Mul                       : r2797_2, r2797_3
+# 2797|     m2797_5(unsigned long)        = Store[u]                  : &:r2797_1, r2797_4
+# 2798|     r2798_1(glval<unsigned long>) = VariableAddress[t]        : 
+# 2798|     r2798_2(unsigned long)        = Constant[4]               : 
+# 2798|     m2798_3(unsigned long)        = Store[t]                  : &:r2798_1, r2798_2
+# 2799|     v2799_1(void)                 = NoOp                      : 
+# 2792|     v2792_11(void)                = ReturnVoid                : 
+# 2792|     v2792_12(void)                = AliasedUse                : m2792_3
+# 2792|     v2792_13(void)                = ExitFunction              : 
+
+# 2801| size_t vla_sizeof_test3(int, size_t, char, bool)
+# 2801|   Block 0
+# 2801|     v2801_1(void)                 = EnterFunction             : 
+# 2801|     m2801_2(unknown)              = AliasedDefinition         : 
+# 2801|     m2801_3(unknown)              = InitializeNonLocal        : 
+# 2801|     m2801_4(unknown)              = Chi                       : total:m2801_2, partial:m2801_3
+# 2801|     r2801_5(glval<int>)           = VariableAddress[len1]     : 
+# 2801|     m2801_6(int)                  = InitializeParameter[len1] : &:r2801_5
+# 2801|     r2801_7(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2801|     m2801_8(unsigned long)        = InitializeParameter[len2] : &:r2801_7
+# 2801|     r2801_9(glval<char>)          = VariableAddress[len3]     : 
+# 2801|     m2801_10(char)                = InitializeParameter[len3] : &:r2801_9
+# 2801|     r2801_11(glval<bool>)         = VariableAddress[b]        : 
+# 2801|     m2801_12(bool)                = InitializeParameter[b]    : &:r2801_11
+# 2802|     r2802_1(glval<int>)           = VariableAddress[len1]     : 
+# 2802|     r2802_2(int)                  = Load[len1]                : &:r2802_1, m2801_6
+# 2802|     r2802_3(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2802|     r2802_4(unsigned long)        = Load[len2]                : &:r2802_3, m2801_8
+# 2802|     v2802_5(void)                 = NoOp                      : 
+# 2803|     v2803_1(void)                 = NoOp                      : 
+# 2804|     r2804_1(glval<char>)          = VariableAddress[len3]     : 
+# 2804|     r2804_2(char)                 = Load[len3]                : &:r2804_1, m2801_10
+# 2804|     v2804_3(void)                 = NoOp                      : 
+# 2806|     r2806_1(glval<bool>)          = VariableAddress[b]        : 
+# 2806|     r2806_2(bool)                 = Load[b]                   : &:r2806_1, m2801_12
+# 2806|     v2806_3(void)                 = ConditionalBranch         : r2806_2
+#-----|   False -> Block 3
+#-----|   True -> Block 2
+
+# 2801|   Block 1
+# 2801|     m2801_13(unsigned long)        = Phi                      : from 2:m2808_7, from 3:m2811_3
+# 2801|     r2801_14(glval<unsigned long>) = VariableAddress[#return] : 
+# 2801|     v2801_15(void)                 = ReturnValue              : &:r2801_14, m2801_13
+# 2801|     v2801_16(void)                 = AliasedUse               : m2801_3
+# 2801|     v2801_17(void)                 = ExitFunction             : 
+
+# 2807|   Block 2
+# 2807|     r2807_1(glval<long[][][]>)    = VariableAddress[tmp]     : 
+# 2807|     m2807_2(long[][][])           = Uninitialized[tmp]       : &:r2807_1
+# 2807|     v2807_3(void)                 = NoOp                     : 
+# 2808|     r2808_1(glval<unsigned long>) = VariableAddress[#return] : 
+# 2808|     r2808_2(unsigned long)        = Constant[8]              : 
+# 2808|     r2808_3(unsigned long)        = Convert                  : r2802_2
+# 2808|     r2808_4(unsigned long)        = Mul                      : r2808_2, r2808_3
+# 2808|     r2808_5(unsigned long)        = CopyValue                : r2802_4
+# 2808|     r2808_6(unsigned long)        = Mul                      : r2808_4, r2808_5
+# 2808|     m2808_7(unsigned long)        = Store[#return]           : &:r2808_1, r2808_6
+#-----|   Goto -> Block 1
+
+# 2811|   Block 3
+# 2811|     r2811_1(glval<unsigned long>) = VariableAddress[#return] : 
+# 2811|     r2811_2(unsigned long)        = Constant[0]              : 
+# 2811|     m2811_3(unsigned long)        = Store[#return]           : &:r2811_1, r2811_2
+#-----|   Goto -> Block 1
+
+# 2814| void vla_sizeof_test4(int, size_t)
+# 2814|   Block 0
+# 2814|     v2814_1(void)                 = EnterFunction             : 
+# 2814|     m2814_2(unknown)              = AliasedDefinition         : 
+# 2814|     m2814_3(unknown)              = InitializeNonLocal        : 
+# 2814|     m2814_4(unknown)              = Chi                       : total:m2814_2, partial:m2814_3
+# 2814|     r2814_5(glval<int>)           = VariableAddress[len1]     : 
+# 2814|     m2814_6(int)                  = InitializeParameter[len1] : &:r2814_5
+# 2814|     r2814_7(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2814|     m2814_8(unsigned long)        = InitializeParameter[len2] : &:r2814_7
+# 2815|     r2815_1(glval<int[][]>)       = VariableAddress[tmp1]     : 
+# 2815|     m2815_2(int[][])              = Uninitialized[tmp1]       : &:r2815_1
+# 2815|     r2815_3(glval<int>)           = VariableAddress[len1]     : 
+# 2815|     r2815_4(int)                  = Load[len1]                : &:r2815_3, m2814_6
+# 2815|     r2815_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2815|     r2815_6(unsigned long)        = Load[len2]                : &:r2815_5, m2814_8
+# 2815|     v2815_7(void)                 = NoOp                      : 
+# 2816|     r2816_1(glval<unsigned long>) = VariableAddress[z]        : 
+# 2816|     r2816_2(unsigned long)        = Constant[4]               : 
+# 2816|     r2816_3(unsigned long)        = CopyValue                 : r2815_6
+# 2816|     r2816_4(unsigned long)        = Mul                       : r2816_2, r2816_3
+# 2816|     m2816_5(unsigned long)        = Store[z]                  : &:r2816_1, r2816_4
+# 2817|     v2817_1(void)                 = NoOp                      : 
+# 2814|     v2814_9(void)                 = ReturnVoid                : 
+# 2814|     v2814_10(void)                = AliasedUse                : m2814_3
+# 2814|     v2814_11(void)                = ExitFunction              : 
+
+# 2819| void vla_sizeof_test5(int, size_t)
+# 2819|   Block 0
+# 2819|     v2819_1(void)                 = EnterFunction             : 
+# 2819|     m2819_2(unknown)              = AliasedDefinition         : 
+# 2819|     m2819_3(unknown)              = InitializeNonLocal        : 
+# 2819|     m2819_4(unknown)              = Chi                       : total:m2819_2, partial:m2819_3
+# 2819|     r2819_5(glval<int>)           = VariableAddress[len1]     : 
+# 2819|     m2819_6(int)                  = InitializeParameter[len1] : &:r2819_5
+# 2819|     r2819_7(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2819|     m2819_8(unsigned long)        = InitializeParameter[len2] : &:r2819_7
+# 2820|     r2820_1(glval<int[][]>)       = VariableAddress[tmp1]     : 
+# 2820|     m2820_2(int[][])              = Uninitialized[tmp1]       : &:r2820_1
+# 2820|     r2820_3(glval<int>)           = VariableAddress[len1]     : 
+# 2820|     r2820_4(int)                  = Load[len1]                : &:r2820_3, m2819_6
+# 2820|     r2820_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2820|     r2820_6(unsigned long)        = Load[len2]                : &:r2820_5, m2819_8
+# 2820|     v2820_7(void)                 = NoOp                      : 
+# 2821|     r2821_1(glval<unsigned long>) = VariableAddress[z]        : 
+# 2821|     r2821_2(unsigned long)        = Constant[4]               : 
+# 2821|     r2821_3(unsigned long)        = CopyValue                 : r2820_6
+# 2821|     r2821_4(unsigned long)        = Mul                       : r2821_2, r2821_3
+# 2821|     m2821_5(unsigned long)        = Store[z]                  : &:r2821_1, r2821_4
+# 2822|     v2822_1(void)                 = NoOp                      : 
+# 2819|     v2819_9(void)                 = ReturnVoid                : 
+# 2819|     v2819_10(void)                = AliasedUse                : m2819_3
+# 2819|     v2819_11(void)                = ExitFunction              : 
+
 ir23.cpp:
 #    1| bool consteval_1()
 #    1|   Block 0

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -2776,4 +2776,49 @@ void test_allocation_with_initializer() {
     long* p2 = new long(42);
 }
 
+void vla_sizeof_test(int len1, size_t len2, char len3) {
+  char tmp1[len1];
+  size_t x = sizeof(tmp1);
+  int tmp2[len1][len2];
+  size_t y = sizeof(tmp2);
+  size_t z = sizeof(*tmp2);
+  int tmp3[len1][len2][len3];
+  size_t w = sizeof(tmp3);
+  size_t v = sizeof(*tmp3);
+  size_t u = sizeof(**tmp3);
+  size_t t = sizeof(***tmp3);
+}
+
+void vla_sizeof_test2(int len1, size_t len2, char len3) {
+  int tmp1[len1][len2];
+  size_t z = sizeof(tmp1[1]);
+  int tmp2[len1][len2][len3];
+  size_t v = sizeof(tmp2[1]);
+  size_t u = sizeof(tmp2[1][2]);
+  size_t t = sizeof(tmp2[1][2][3]);
+}
+
+size_t vla_sizeof_test3(int len1, size_t len2, char len3, bool b) {
+  typedef long arr[len1][len2];
+  typedef arr arr2;
+  typedef arr2 arr3[len3];
+
+  if (b) {
+    arr3 tmp;
+    return sizeof(tmp[1]);
+  } 
+
+  return 0;
+}
+
+void vla_sizeof_test4(int len1, size_t len2) {
+  int tmp1[len1][len2];
+  size_t z = sizeof(1[tmp1]);
+}
+
+void vla_sizeof_test5(int len1, size_t len2) {
+  int tmp1[len1][len2];
+  size_t z = sizeof((*&tmp1)[1]);
+}
+
 // semmle-extractor-options: -std=c++20 --clang

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -18577,6 +18577,241 @@ ir.cpp:
 # 2774|     v2774_5(void)           = AliasedUse                    : ~m?
 # 2774|     v2774_6(void)           = ExitFunction                  : 
 
+# 2779| void vla_sizeof_test(int, size_t, char)
+# 2779|   Block 0
+# 2779|     v2779_1(void)                 = EnterFunction             : 
+# 2779|     mu2779_2(unknown)             = AliasedDefinition         : 
+# 2779|     mu2779_3(unknown)             = InitializeNonLocal        : 
+# 2779|     r2779_4(glval<int>)           = VariableAddress[len1]     : 
+# 2779|     mu2779_5(int)                 = InitializeParameter[len1] : &:r2779_4
+# 2779|     r2779_6(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2779|     mu2779_7(unsigned long)       = InitializeParameter[len2] : &:r2779_6
+# 2779|     r2779_8(glval<char>)          = VariableAddress[len3]     : 
+# 2779|     mu2779_9(char)                = InitializeParameter[len3] : &:r2779_8
+# 2780|     r2780_1(glval<char[]>)        = VariableAddress[tmp1]     : 
+# 2780|     mu2780_2(char[])              = Uninitialized[tmp1]       : &:r2780_1
+# 2780|     r2780_3(glval<int>)           = VariableAddress[len1]     : 
+# 2780|     r2780_4(int)                  = Load[len1]                : &:r2780_3, ~m?
+# 2780|     v2780_5(void)                 = NoOp                      : 
+# 2781|     r2781_1(glval<unsigned long>) = VariableAddress[x]        : 
+# 2781|     r2781_2(unsigned long)        = Constant[1]               : 
+# 2781|     r2781_3(unsigned long)        = Convert                   : r2780_4
+# 2781|     r2781_4(unsigned long)        = Mul                       : r2781_2, r2781_3
+# 2781|     mu2781_5(unsigned long)       = Store[x]                  : &:r2781_1, r2781_4
+# 2782|     r2782_1(glval<int[][]>)       = VariableAddress[tmp2]     : 
+# 2782|     mu2782_2(int[][])             = Uninitialized[tmp2]       : &:r2782_1
+# 2782|     r2782_3(glval<int>)           = VariableAddress[len1]     : 
+# 2782|     r2782_4(int)                  = Load[len1]                : &:r2782_3, ~m?
+# 2782|     r2782_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2782|     r2782_6(unsigned long)        = Load[len2]                : &:r2782_5, ~m?
+# 2782|     v2782_7(void)                 = NoOp                      : 
+# 2783|     r2783_1(glval<unsigned long>) = VariableAddress[y]        : 
+# 2783|     r2783_2(unsigned long)        = Constant[4]               : 
+# 2783|     r2783_3(unsigned long)        = Convert                   : r2782_4
+# 2783|     r2783_4(unsigned long)        = Mul                       : r2783_2, r2783_3
+# 2783|     r2783_5(unsigned long)        = CopyValue                 : r2782_6
+# 2783|     r2783_6(unsigned long)        = Mul                       : r2783_4, r2783_5
+# 2783|     mu2783_7(unsigned long)       = Store[y]                  : &:r2783_1, r2783_6
+# 2784|     r2784_1(glval<unsigned long>) = VariableAddress[z]        : 
+# 2784|     r2784_2(unsigned long)        = Constant[4]               : 
+# 2784|     r2784_3(unsigned long)        = CopyValue                 : r2782_6
+# 2784|     r2784_4(unsigned long)        = Mul                       : r2784_2, r2784_3
+# 2784|     mu2784_5(unsigned long)       = Store[z]                  : &:r2784_1, r2784_4
+# 2785|     r2785_1(glval<int[][][]>)     = VariableAddress[tmp3]     : 
+# 2785|     mu2785_2(int[][][])           = Uninitialized[tmp3]       : &:r2785_1
+# 2785|     r2785_3(glval<int>)           = VariableAddress[len1]     : 
+# 2785|     r2785_4(int)                  = Load[len1]                : &:r2785_3, ~m?
+# 2785|     r2785_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2785|     r2785_6(unsigned long)        = Load[len2]                : &:r2785_5, ~m?
+# 2785|     r2785_7(glval<char>)          = VariableAddress[len3]     : 
+# 2785|     r2785_8(char)                 = Load[len3]                : &:r2785_7, ~m?
+# 2785|     v2785_9(void)                 = NoOp                      : 
+# 2786|     r2786_1(glval<unsigned long>) = VariableAddress[w]        : 
+# 2786|     r2786_2(unsigned long)        = Constant[4]               : 
+# 2786|     r2786_3(unsigned long)        = Convert                   : r2785_4
+# 2786|     r2786_4(unsigned long)        = Mul                       : r2786_2, r2786_3
+# 2786|     r2786_5(unsigned long)        = CopyValue                 : r2785_6
+# 2786|     r2786_6(unsigned long)        = Mul                       : r2786_4, r2786_5
+# 2786|     r2786_7(unsigned long)        = Convert                   : r2785_8
+# 2786|     r2786_8(unsigned long)        = Mul                       : r2786_6, r2786_7
+# 2786|     mu2786_9(unsigned long)       = Store[w]                  : &:r2786_1, r2786_8
+# 2787|     r2787_1(glval<unsigned long>) = VariableAddress[v]        : 
+# 2787|     r2787_2(unsigned long)        = Constant[4]               : 
+# 2787|     r2787_3(unsigned long)        = CopyValue                 : r2785_6
+# 2787|     r2787_4(unsigned long)        = Mul                       : r2787_2, r2787_3
+# 2787|     r2787_5(unsigned long)        = Convert                   : r2785_8
+# 2787|     r2787_6(unsigned long)        = Mul                       : r2787_4, r2787_5
+# 2787|     mu2787_7(unsigned long)       = Store[v]                  : &:r2787_1, r2787_6
+# 2788|     r2788_1(glval<unsigned long>) = VariableAddress[u]        : 
+# 2788|     r2788_2(unsigned long)        = Constant[4]               : 
+# 2788|     r2788_3(unsigned long)        = Convert                   : r2785_8
+# 2788|     r2788_4(unsigned long)        = Mul                       : r2788_2, r2788_3
+# 2788|     mu2788_5(unsigned long)       = Store[u]                  : &:r2788_1, r2788_4
+# 2789|     r2789_1(glval<unsigned long>) = VariableAddress[t]        : 
+# 2789|     r2789_2(unsigned long)        = Constant[4]               : 
+# 2789|     mu2789_3(unsigned long)       = Store[t]                  : &:r2789_1, r2789_2
+# 2790|     v2790_1(void)                 = NoOp                      : 
+# 2779|     v2779_10(void)                = ReturnVoid                : 
+# 2779|     v2779_11(void)                = AliasedUse                : ~m?
+# 2779|     v2779_12(void)                = ExitFunction              : 
+
+# 2792| void vla_sizeof_test2(int, size_t, char)
+# 2792|   Block 0
+# 2792|     v2792_1(void)                 = EnterFunction             : 
+# 2792|     mu2792_2(unknown)             = AliasedDefinition         : 
+# 2792|     mu2792_3(unknown)             = InitializeNonLocal        : 
+# 2792|     r2792_4(glval<int>)           = VariableAddress[len1]     : 
+# 2792|     mu2792_5(int)                 = InitializeParameter[len1] : &:r2792_4
+# 2792|     r2792_6(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2792|     mu2792_7(unsigned long)       = InitializeParameter[len2] : &:r2792_6
+# 2792|     r2792_8(glval<char>)          = VariableAddress[len3]     : 
+# 2792|     mu2792_9(char)                = InitializeParameter[len3] : &:r2792_8
+# 2793|     r2793_1(glval<int[][]>)       = VariableAddress[tmp1]     : 
+# 2793|     mu2793_2(int[][])             = Uninitialized[tmp1]       : &:r2793_1
+# 2793|     r2793_3(glval<int>)           = VariableAddress[len1]     : 
+# 2793|     r2793_4(int)                  = Load[len1]                : &:r2793_3, ~m?
+# 2793|     r2793_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2793|     r2793_6(unsigned long)        = Load[len2]                : &:r2793_5, ~m?
+# 2793|     v2793_7(void)                 = NoOp                      : 
+# 2794|     r2794_1(glval<unsigned long>) = VariableAddress[z]        : 
+# 2794|     r2794_2(unsigned long)        = Constant[4]               : 
+# 2794|     r2794_3(unsigned long)        = CopyValue                 : r2793_6
+# 2794|     r2794_4(unsigned long)        = Mul                       : r2794_2, r2794_3
+# 2794|     mu2794_5(unsigned long)       = Store[z]                  : &:r2794_1, r2794_4
+# 2795|     r2795_1(glval<int[][][]>)     = VariableAddress[tmp2]     : 
+# 2795|     mu2795_2(int[][][])           = Uninitialized[tmp2]       : &:r2795_1
+# 2795|     r2795_3(glval<int>)           = VariableAddress[len1]     : 
+# 2795|     r2795_4(int)                  = Load[len1]                : &:r2795_3, ~m?
+# 2795|     r2795_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2795|     r2795_6(unsigned long)        = Load[len2]                : &:r2795_5, ~m?
+# 2795|     r2795_7(glval<char>)          = VariableAddress[len3]     : 
+# 2795|     r2795_8(char)                 = Load[len3]                : &:r2795_7, ~m?
+# 2795|     v2795_9(void)                 = NoOp                      : 
+# 2796|     r2796_1(glval<unsigned long>) = VariableAddress[v]        : 
+# 2796|     r2796_2(unsigned long)        = Constant[4]               : 
+# 2796|     r2796_3(unsigned long)        = CopyValue                 : r2795_6
+# 2796|     r2796_4(unsigned long)        = Mul                       : r2796_2, r2796_3
+# 2796|     r2796_5(unsigned long)        = Convert                   : r2795_8
+# 2796|     r2796_6(unsigned long)        = Mul                       : r2796_4, r2796_5
+# 2796|     mu2796_7(unsigned long)       = Store[v]                  : &:r2796_1, r2796_6
+# 2797|     r2797_1(glval<unsigned long>) = VariableAddress[u]        : 
+# 2797|     r2797_2(unsigned long)        = Constant[4]               : 
+# 2797|     r2797_3(unsigned long)        = Convert                   : r2795_8
+# 2797|     r2797_4(unsigned long)        = Mul                       : r2797_2, r2797_3
+# 2797|     mu2797_5(unsigned long)       = Store[u]                  : &:r2797_1, r2797_4
+# 2798|     r2798_1(glval<unsigned long>) = VariableAddress[t]        : 
+# 2798|     r2798_2(unsigned long)        = Constant[4]               : 
+# 2798|     mu2798_3(unsigned long)       = Store[t]                  : &:r2798_1, r2798_2
+# 2799|     v2799_1(void)                 = NoOp                      : 
+# 2792|     v2792_10(void)                = ReturnVoid                : 
+# 2792|     v2792_11(void)                = AliasedUse                : ~m?
+# 2792|     v2792_12(void)                = ExitFunction              : 
+
+# 2801| size_t vla_sizeof_test3(int, size_t, char, bool)
+# 2801|   Block 0
+# 2801|     v2801_1(void)                 = EnterFunction             : 
+# 2801|     mu2801_2(unknown)             = AliasedDefinition         : 
+# 2801|     mu2801_3(unknown)             = InitializeNonLocal        : 
+# 2801|     r2801_4(glval<int>)           = VariableAddress[len1]     : 
+# 2801|     mu2801_5(int)                 = InitializeParameter[len1] : &:r2801_4
+# 2801|     r2801_6(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2801|     mu2801_7(unsigned long)       = InitializeParameter[len2] : &:r2801_6
+# 2801|     r2801_8(glval<char>)          = VariableAddress[len3]     : 
+# 2801|     mu2801_9(char)                = InitializeParameter[len3] : &:r2801_8
+# 2801|     r2801_10(glval<bool>)         = VariableAddress[b]        : 
+# 2801|     mu2801_11(bool)               = InitializeParameter[b]    : &:r2801_10
+# 2802|     r2802_1(glval<int>)           = VariableAddress[len1]     : 
+# 2802|     r2802_2(int)                  = Load[len1]                : &:r2802_1, ~m?
+# 2802|     r2802_3(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2802|     r2802_4(unsigned long)        = Load[len2]                : &:r2802_3, ~m?
+# 2802|     v2802_5(void)                 = NoOp                      : 
+# 2803|     v2803_1(void)                 = NoOp                      : 
+# 2804|     r2804_1(glval<char>)          = VariableAddress[len3]     : 
+# 2804|     r2804_2(char)                 = Load[len3]                : &:r2804_1, ~m?
+# 2804|     v2804_3(void)                 = NoOp                      : 
+# 2806|     r2806_1(glval<bool>)          = VariableAddress[b]        : 
+# 2806|     r2806_2(bool)                 = Load[b]                   : &:r2806_1, ~m?
+# 2806|     v2806_3(void)                 = ConditionalBranch         : r2806_2
+#-----|   False -> Block 3
+#-----|   True -> Block 2
+
+# 2801|   Block 1
+# 2801|     r2801_12(glval<unsigned long>) = VariableAddress[#return] : 
+# 2801|     v2801_13(void)                 = ReturnValue              : &:r2801_12, ~m?
+# 2801|     v2801_14(void)                 = AliasedUse               : ~m?
+# 2801|     v2801_15(void)                 = ExitFunction             : 
+
+# 2807|   Block 2
+# 2807|     r2807_1(glval<long[][][]>)    = VariableAddress[tmp]     : 
+# 2807|     mu2807_2(long[][][])          = Uninitialized[tmp]       : &:r2807_1
+# 2807|     v2807_3(void)                 = NoOp                     : 
+# 2808|     r2808_1(glval<unsigned long>) = VariableAddress[#return] : 
+# 2808|     r2808_2(unsigned long)        = Constant[8]              : 
+# 2808|     r2808_3(unsigned long)        = Convert                  : r2802_2
+# 2808|     r2808_4(unsigned long)        = Mul                      : r2808_2, r2808_3
+# 2808|     r2808_5(unsigned long)        = CopyValue                : r2802_4
+# 2808|     r2808_6(unsigned long)        = Mul                      : r2808_4, r2808_5
+# 2808|     mu2808_7(unsigned long)       = Store[#return]           : &:r2808_1, r2808_6
+#-----|   Goto -> Block 1
+
+# 2811|   Block 3
+# 2811|     r2811_1(glval<unsigned long>) = VariableAddress[#return] : 
+# 2811|     r2811_2(unsigned long)        = Constant[0]              : 
+# 2811|     mu2811_3(unsigned long)       = Store[#return]           : &:r2811_1, r2811_2
+#-----|   Goto -> Block 1
+
+# 2814| void vla_sizeof_test4(int, size_t)
+# 2814|   Block 0
+# 2814|     v2814_1(void)                 = EnterFunction             : 
+# 2814|     mu2814_2(unknown)             = AliasedDefinition         : 
+# 2814|     mu2814_3(unknown)             = InitializeNonLocal        : 
+# 2814|     r2814_4(glval<int>)           = VariableAddress[len1]     : 
+# 2814|     mu2814_5(int)                 = InitializeParameter[len1] : &:r2814_4
+# 2814|     r2814_6(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2814|     mu2814_7(unsigned long)       = InitializeParameter[len2] : &:r2814_6
+# 2815|     r2815_1(glval<int[][]>)       = VariableAddress[tmp1]     : 
+# 2815|     mu2815_2(int[][])             = Uninitialized[tmp1]       : &:r2815_1
+# 2815|     r2815_3(glval<int>)           = VariableAddress[len1]     : 
+# 2815|     r2815_4(int)                  = Load[len1]                : &:r2815_3, ~m?
+# 2815|     r2815_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2815|     r2815_6(unsigned long)        = Load[len2]                : &:r2815_5, ~m?
+# 2815|     v2815_7(void)                 = NoOp                      : 
+# 2816|     r2816_1(glval<unsigned long>) = VariableAddress[z]        : 
+# 2816|     r2816_2(unsigned long)        = Constant[4]               : 
+# 2816|     r2816_3(unsigned long)        = CopyValue                 : r2815_6
+# 2816|     r2816_4(unsigned long)        = Mul                       : r2816_2, r2816_3
+# 2816|     mu2816_5(unsigned long)       = Store[z]                  : &:r2816_1, r2816_4
+# 2817|     v2817_1(void)                 = NoOp                      : 
+# 2814|     v2814_8(void)                 = ReturnVoid                : 
+# 2814|     v2814_9(void)                 = AliasedUse                : ~m?
+# 2814|     v2814_10(void)                = ExitFunction              : 
+
+# 2819| void vla_sizeof_test5(int, size_t)
+# 2819|   Block 0
+# 2819|     v2819_1(void)                 = EnterFunction             : 
+# 2819|     mu2819_2(unknown)             = AliasedDefinition         : 
+# 2819|     mu2819_3(unknown)             = InitializeNonLocal        : 
+# 2819|     r2819_4(glval<int>)           = VariableAddress[len1]     : 
+# 2819|     mu2819_5(int)                 = InitializeParameter[len1] : &:r2819_4
+# 2819|     r2819_6(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2819|     mu2819_7(unsigned long)       = InitializeParameter[len2] : &:r2819_6
+# 2820|     r2820_1(glval<int[][]>)       = VariableAddress[tmp1]     : 
+# 2820|     mu2820_2(int[][])             = Uninitialized[tmp1]       : &:r2820_1
+# 2820|     r2820_3(glval<int>)           = VariableAddress[len1]     : 
+# 2820|     r2820_4(int)                  = Load[len1]                : &:r2820_3, ~m?
+# 2820|     r2820_5(glval<unsigned long>) = VariableAddress[len2]     : 
+# 2820|     r2820_6(unsigned long)        = Load[len2]                : &:r2820_5, ~m?
+# 2820|     v2820_7(void)                 = NoOp                      : 
+# 2821|     r2821_1(glval<unsigned long>) = VariableAddress[z]        : 
+# 2821|     r2821_2(unsigned long)        = Constant[4]               : 
+# 2821|     r2821_3(unsigned long)        = CopyValue                 : r2820_6
+# 2821|     r2821_4(unsigned long)        = Mul                       : r2821_2, r2821_3
+# 2821|     mu2821_5(unsigned long)       = Store[z]                  : &:r2821_1, r2821_4
+# 2822|     v2822_1(void)                 = NoOp                      : 
+# 2819|     v2819_8(void)                 = ReturnVoid                : 
+# 2819|     v2819_9(void)                 = AliasedUse                : ~m?
+# 2819|     v2819_10(void)                = ExitFunction              : 
+
 ir23.cpp:
 #    1| bool consteval_1()
 #    1|   Block 0