Merge pull request #15474 from michaelnebel/csharp/primaryconstructors

C# 12: Primary constructors.
2026-04-22 15:25:18 +02:00 · 2024-02-14 10:09:23 +01:00
parent fb2d36ddac 7c59c7b28c
commit bafea9190d
24 changed files with 659 additions and 114 deletions
--- a/csharp/ql/lib/change-notes/2024-02-12-primary-constructors.md
+++ b/csharp/ql/lib/change-notes/2024-02-12-primary-constructors.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: The QL and data flow library now support primary constructors.
--- a/csharp/ql/lib/semmle/code/csharp/Callable.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Callable.qll
@@ -406,6 +406,24 @@ class InstanceConstructor extends Constructor {
  override string getAPrimaryQlClass() { result = "InstanceConstructor" }
 }

+/**
+ * A primary constructor, for example `public class C(object o)` on line 1 in
+ * ```csharp
+ * public class C(object o) {
+ *  ...
+ * }
+ * ```
+ */
+class PrimaryConstructor extends Constructor {
+  PrimaryConstructor() {
+    not this.hasBody() and
+    this.getDeclaringType().fromSource() and
+    this.fromSource()
+  }
+
+  override string getAPrimaryQlClass() { result = "PrimaryConstructor" }
+}
+
 /**
 * A destructor, for example `~C() { }` on line 2 in
 *
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -21,6 +21,7 @@ private import semmle.code.csharp.frameworks.system.threading.Tasks
 private import semmle.code.cil.Ssa::Ssa as CilSsa
 private import semmle.code.cil.internal.SsaImpl as CilSsaImpl
 private import codeql.util.Unit
+private import codeql.util.Boolean

 /** Gets the callable in which this node occurs. */
 DataFlowCallable nodeGetEnclosingCallable(Node n) {
@@ -37,6 +38,19 @@ predicate isArgumentNode(ArgumentNode arg, DataFlowCall c, ArgumentPosition pos)
  arg.argumentOf(c, pos)
 }

+/**
+ * Gets a control flow node used for data flow purposes for the primary constructor
+ * parameter access `pa`.
+ */
+private ControlFlow::Node getAPrimaryConstructorParameterCfn(ParameterAccess pa) {
+  pa.getTarget().getCallable() instanceof PrimaryConstructor and
+  (
+    result = pa.(ParameterRead).getAControlFlowNode()
+    or
+    pa = any(AssignableDefinition def | result = def.getAControlFlowNode()).getTargetAccess()
+  )
+}
+
 abstract class NodeImpl extends Node {
  /** Do not call: use `getEnclosingCallable()` instead. */
  abstract DataFlowCallable getEnclosingCallableImpl();
@@ -124,9 +138,22 @@ private module ThisFlow {
    n.(InstanceParameterNode).getCallable() = cfn.(ControlFlow::Nodes::EntryNode).getCallable()
    or
    n.asExprAtNode(cfn) = any(Expr e | e instanceof ThisAccess or e instanceof BaseAccess)
+    or
+    n =
+      any(InstanceParameterAccessNode pan |
+        pan.getUnderlyingControlFlowNode() = cfn and pan.isPreUpdate()
+      )
  }

-  private predicate thisAccess(Node n, BasicBlock bb, int i) { thisAccess(n, bb.getNode(i)) }
+  private predicate thisAccess(Node n, BasicBlock bb, int i) {
+    thisAccess(n, bb.getNode(i))
+    or
+    exists(Parameter p | n.(PrimaryConstructorThisAccessNode).getParameter() = p |
+      bb.getCallable() = p.getCallable() and
+      i = p.getPosition() + 1 and
+      not n instanceof PostUpdateNode
+    )
+  }

  private predicate thisRank(Node n, BasicBlock bb, int rankix) {
    exists(int i |
@@ -202,7 +229,7 @@ CIL::DataFlowNode asCilDataFlowNode(Node node) {

 /** Provides predicates related to local data flow. */
 module LocalFlow {
-  private class LocalExprStepConfiguration extends ControlFlowReachabilityConfiguration {
+  class LocalExprStepConfiguration extends ControlFlowReachabilityConfiguration {
    LocalExprStepConfiguration() { this = "LocalExprStepConfiguration" }

    override predicate candidate(
@@ -925,7 +952,17 @@ private module Cached {
    TParamsArgumentNode(ControlFlow::Node callCfn) {
      callCfn = any(Call c | isParamsArg(c, _, _)).getAControlFlowNode()
    } or
-    TFlowInsensitiveFieldNode(FieldOrProperty f) { f.isFieldLike() }
+    TFlowInsensitiveFieldNode(FieldOrProperty f) { f.isFieldLike() } or
+    TInstanceParameterAccessNode(ControlFlow::Node cfn, boolean isPostUpdate) {
+      exists(ParameterAccess pa | cfn = getAPrimaryConstructorParameterCfn(pa) |
+        isPostUpdate = false
+        or
+        pa instanceof ParameterWrite and isPostUpdate = true
+      )
+    } or
+    TPrimaryConstructorThisAccessNode(Parameter p, Boolean isPostUpdate) {
+      p.getCallable() instanceof PrimaryConstructor
+    }

  /**
   * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
@@ -961,14 +998,20 @@ private module Cached {
    TFieldContent(Field f) { f.isUnboundDeclaration() } or
    TPropertyContent(Property p) { p.isUnboundDeclaration() } or
    TElementContent() or
-    TSyntheticFieldContent(SyntheticField f)
+    TSyntheticFieldContent(SyntheticField f) or
+    TPrimaryConstructorParameterContent(Parameter p) {
+      p.getCallable() instanceof PrimaryConstructor
+    }

  cached
  newtype TContentApprox =
    TFieldApproxContent(string firstChar) { firstChar = approximateFieldContent(_) } or
    TPropertyApproxContent(string firstChar) { firstChar = approximatePropertyContent(_) } or
    TElementApproxContent() or
-    TSyntheticFieldApproxContent()
+    TSyntheticFieldApproxContent() or
+    TPrimaryConstructorParameterApproxContent(string firstChar) {
+      firstChar = approximatePrimaryConstructorParameterContent(_)
+    }

  pragma[nomagic]
  private predicate commonSubTypeGeneral(DataFlowTypeOrUnifiable t1, RelevantGvnType t2) {
@@ -1037,6 +1080,10 @@ predicate nodeIsHidden(Node n) {
  n.asExpr() = any(WithExpr we).getInitializer()
  or
  n instanceof FlowInsensitiveFieldNode
+  or
+  n instanceof InstanceParameterAccessNode
+  or
+  n instanceof PrimaryConstructorThisAccessNode
 }

 /** A CIL SSA definition, viewed as a node in a data flow graph. */
@@ -1745,6 +1792,100 @@ class FlowSummaryNode extends NodeImpl, TFlowSummaryNode {
  override string toStringImpl() { result = this.getSummaryNode().toString() }
 }

+/**
+ * A data-flow node used to model reading and writing of primary constructor parameters.
+ * For example, in
+ * ```csharp
+ * public class C(object o)
+ * {
+ *    public object GetParam() => o; // (1)
+ *
+ *    public void SetParam(object value) => o = value; // (2)
+ * }
+ * ```
+ * the first access to `o` (1) is modeled as `this.o_backing_field` and
+ * the second access to `o` (2) is modeled as `this.o_backing_field = value`.
+ * Both models need a pre-update this node, and the latter need an additional post-update this access,
+ * all of which are represented by an `InstanceParameterAccessNode` node.
+ */
+class InstanceParameterAccessNode extends NodeImpl, TInstanceParameterAccessNode {
+  private ControlFlow::Node cfn;
+  private boolean isPostUpdate;
+  private Parameter p;
+
+  InstanceParameterAccessNode() {
+    this = TInstanceParameterAccessNode(cfn, isPostUpdate) and
+    exists(ParameterAccess pa | cfn = getAPrimaryConstructorParameterCfn(pa) and pa.getTarget() = p)
+  }
+
+  override DataFlowCallable getEnclosingCallableImpl() {
+    result.asCallable() = cfn.getEnclosingCallable()
+  }
+
+  override Type getTypeImpl() { result = cfn.getEnclosingCallable().getDeclaringType() }
+
+  override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() { none() }
+
+  override Location getLocationImpl() { result = cfn.getLocation() }
+
+  override string toStringImpl() { result = "this" }
+
+  /**
+   * Gets the underlying control flow node.
+   */
+  ControlFlow::Node getUnderlyingControlFlowNode() { result = cfn }
+
+  /**
+   * Gets the primary constructor parameter that this is a this access to.
+   */
+  Parameter getParameter() { result = p }
+
+  /**
+   * Holds if the this parameter access node corresponds to a pre-update node.
+   */
+  predicate isPreUpdate() { isPostUpdate = false }
+}
+
+/**
+ * A data-flow node used to synthesize the body of a primary constructor.
+ *
+ * For example, in
+ * ```csharp
+ * public class C(object o) { }
+ * ```
+ * we synthesize the primary constructor for `C` as
+ * ```csharp
+ * public C(object o) => this.o_backing_field = o;
+ * ```
+ * The synthesized (pre/post-update) this access is represented an `PrimaryConstructorThisAccessNode` node.
+ */
+class PrimaryConstructorThisAccessNode extends NodeImpl, TPrimaryConstructorThisAccessNode {
+  private Parameter p;
+  private boolean isPostUpdate;
+
+  PrimaryConstructorThisAccessNode() { this = TPrimaryConstructorThisAccessNode(p, isPostUpdate) }
+
+  override DataFlowCallable getEnclosingCallableImpl() { result.asCallable() = p.getCallable() }
+
+  override Type getTypeImpl() { result = p.getCallable().getDeclaringType() }
+
+  override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() { none() }
+
+  override Location getLocationImpl() { result = p.getLocation() }
+
+  override string toStringImpl() { result = "this" }
+
+  /**
+   * Gets the primary constructor parameter that this is a this access to.
+   */
+  Parameter getParameter() { result = p }
+
+  /**
+   * Holds if this is a this access for a primary constructor parameter write.
+   */
+  predicate isPostUpdate() { isPostUpdate = true }
+}
+
 /** A field or a property. */
 class FieldOrProperty extends Assignable, Modifiable {
  FieldOrProperty() {
@@ -1881,6 +2022,18 @@ private PropertyContent getResultContent() {
  result.getProperty() = any(SystemThreadingTasksTaskTClass c_).getResultProperty()
 }

+private predicate primaryConstructorParameterStore(
+  SsaDefinitionExtNode node1, PrimaryConstructorParameterContent c, Node node2
+) {
+  exists(Ssa::ExplicitDefinition def, ControlFlow::Node cfn, Parameter p |
+    def = node1.getDefinitionExt() and
+    p = def.getSourceVariable().getAssignable() and
+    cfn = def.getControlFlowNode() and
+    node2 = TInstanceParameterAccessNode(cfn, true) and
+    c.getParameter() = p
+  )
+}
+
 /**
 * Holds if data can flow from `node1` to `node2` via an assignment to
 * content `c`.
@@ -1918,6 +2071,14 @@ predicate storeStep(Node node1, ContentSet c, Node node2) {
    c = getResultContent()
  )
  or
+  primaryConstructorParameterStore(node1, c, node2)
+  or
+  exists(Parameter p |
+    node1 = TExplicitParameterNode(p) and
+    node2 = TPrimaryConstructorThisAccessNode(p, true) and
+    c.(PrimaryConstructorParameterContent).getParameter() = p
+  )
+  or
  FlowSummaryImpl::Private::Steps::summaryStoreStep(node1.(FlowSummaryNode).getSummaryNode(), c,
    node2.(FlowSummaryNode).getSummaryNode())
 }
@@ -2010,6 +2171,14 @@ predicate readStep(Node node1, ContentSet c, Node node2) {
    node2.asExpr().(AwaitExpr).getExpr() = node1.asExpr() and
    c = getResultContent()
    or
+    node1 =
+      any(InstanceParameterAccessNode n |
+        n.getUnderlyingControlFlowNode() = node2.(ExprNode).getControlFlowNode() and
+        n.getParameter() = c.(PrimaryConstructorParameterContent).getParameter() and
+        n.isPreUpdate()
+      ) and
+    node2.asExpr() instanceof ParameterRead
+    or
    // node1 = (..., node2, ...)
    // node1.ItemX flows to node2
    exists(TupleExpr te, int i, Expr item |
@@ -2072,6 +2241,8 @@ predicate clearsContent(Node n, ContentSet c) {
    c.(FieldContent).getField() = f.getUnboundDeclaration() and
    not f.isRef()
  )
+  or
+  n = any(PostUpdateNode n1 | primaryConstructorParameterStore(_, c, n1)).getPreUpdateNode()
 }

 /**
@@ -2361,6 +2532,32 @@ module PostUpdateNodes {

    override Node getPreUpdateNode() { result.(FlowSummaryNode).getSummaryNode() = preUpdateNode }
  }
+
+  private class InstanceParameterAccessPostUpdateNode extends PostUpdateNode,
+    InstanceParameterAccessNode
+  {
+    private ControlFlow::Node cfn;
+
+    InstanceParameterAccessPostUpdateNode() { this = TInstanceParameterAccessNode(cfn, true) }
+
+    override Node getPreUpdateNode() { result = TInstanceParameterAccessNode(cfn, false) }
+
+    override string toStringImpl() { result = "[post] this" }
+  }
+
+  private class PrimaryConstructorThisAccessPostUpdateNode extends PostUpdateNode,
+    PrimaryConstructorThisAccessNode
+  {
+    private Parameter p;
+
+    PrimaryConstructorThisAccessPostUpdateNode() {
+      this = TPrimaryConstructorThisAccessNode(p, true)
+    }
+
+    override Node getPreUpdateNode() { result = TPrimaryConstructorThisAccessNode(p, false) }
+
+    override string toStringImpl() { result = "[post] this" }
+  }
 }

 private import PostUpdateNodes
@@ -2537,6 +2734,11 @@ class ContentApprox extends TContentApprox {
    this = TElementApproxContent() and result = "element"
    or
    this = TSyntheticFieldApproxContent() and result = "approximated synthetic field"
+    or
+    exists(string firstChar |
+      this = TPrimaryConstructorParameterApproxContent(firstChar) and
+      result = "approximated parameter field " + firstChar
+    )
  }
 }

@@ -2550,6 +2752,14 @@ private string approximatePropertyContent(PropertyContent pc) {
  result = pc.getProperty().getName().prefix(1)
 }

+/**
+ * Gets a string for approximating the name of a synthetic field corresponding
+ * to a primary constructor parameter.
+ */
+private string approximatePrimaryConstructorParameterContent(PrimaryConstructorParameterContent pc) {
+  result = pc.getParameter().getName().prefix(1)
+}
+
 /** Gets an approximated value for content `c`. */
 pragma[nomagic]
 ContentApprox getContentApprox(Content c) {
@@ -2560,6 +2770,9 @@ ContentApprox getContentApprox(Content c) {
  c instanceof ElementContent and result = TElementApproxContent()
  or
  c instanceof SyntheticFieldContent and result = TSyntheticFieldApproxContent()
+  or
+  result =
+    TPrimaryConstructorParameterApproxContent(approximatePrimaryConstructorParameterContent(c))
 }

 /**
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
@@ -239,6 +239,23 @@ class PropertyContent extends Content, TPropertyContent {
  override Location getLocation() { result = p.getLocation() }
 }

+/**
+ * A reference to a synthetic field corresponding to a
+ * primary constructor parameter.
+ */
+class PrimaryConstructorParameterContent extends Content, TPrimaryConstructorParameterContent {
+  private Parameter p;
+
+  PrimaryConstructorParameterContent() { this = TPrimaryConstructorParameterContent(p) }
+
+  /** Gets the underlying parameter. */
+  Parameter getParameter() { result = p }
+
+  override string toString() { result = "parameter " + p.getName() }
+
+  override Location getLocation() { result = p.getLocation() }
+}
+
 /** A reference to an element in a collection. */
 class ElementContent extends Content, TElementContent {
  override string toString() { result = "element" }
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -870,6 +870,39 @@ private module CapturedVariableImpl {
      )
    )
  }
+
+  /**
+   * Holds if captured local scope variable `v` is written inside the callable
+   * to which `bb` belongs.
+   *
+   * In this case a pseudo-read is inserted at the exit node at index `i` in `bb`,
+   * in order to make the write live.
+   *
+   * Example:
+   *
+   * ```csharp
+   * class C {
+   *   void M1() {
+   *     int i = 0;
+   *     void M2() { i = 2; };
+   *     M2();
+   *     System.Console.WriteLine(i);
+   *   }
+   * }
+   * ```
+   *
+   * The write to `i` inside `M2` on line 4 is live because of the implicit call
+   * definition on line 5.
+   */
+  predicate capturedExitRead(
+    ControlFlow::BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable v
+  ) {
+    exists(ControlFlow::Nodes::AnnotatedExitNode exit |
+      exit.isNormal() and
+      variableDefinition(bb.getAPredecessor*(), _, v, _) and
+      exit = bb.getNode(i)
+    )
+  }
 }

 /**
@@ -1083,7 +1116,7 @@ private predicate variableReadPseudo(ControlFlow::BasicBlock bb, int i, Ssa::Sou
  or
  refReadBeforeWrite(bb, i, v)
  or
-  capturedReadOut(bb, i, v, _, _, _)
+  CapturedVariableImpl::capturedExitRead(bb, i, v)
  or
  capturedReadIn(bb, i, v, _, _, _)
 }
--- a/csharp/ql/test/library-tests/constructors/PrimaryConstructor.expected
+++ b/csharp/ql/test/library-tests/constructors/PrimaryConstructor.expected
@@ -0,0 +1,2 @@
+| constructors.cs:23:18:23:19 | C1 |
+| constructors.cs:28:18:28:19 | C2 |
--- a/csharp/ql/test/library-tests/constructors/PrimaryConstructor.ql
+++ b/csharp/ql/test/library-tests/constructors/PrimaryConstructor.ql
@@ -0,0 +1,4 @@
+import csharp
+
+from PrimaryConstructor c
+select c
--- a/csharp/ql/test/library-tests/constructors/PrintAst.expected
+++ b/csharp/ql/test/library-tests/constructors/PrintAst.expected
@@ -17,3 +17,30 @@ constructors.cs:
 #   16|             -1: [TypeMention] int
 #   16|             0: [LocalVariableAccess] access to local variable i
 #   16|             1: [IntLiteral] 0
+#   21| [NamespaceDeclaration] namespace ... { ... }
+#   23|   1: [Class] C1
+#   23|     4: [InstanceConstructor,PrimaryConstructor] C1
+#-----|       2: (Parameters)
+#   23|         0: [Parameter] o
+#   23|           -1: [TypeMention] object
+#   23|         1: [Parameter] s
+#   23|           -1: [TypeMention] string
+#   25|     5: [InstanceConstructor] C1
+#-----|       2: (Parameters)
+#   25|         0: [Parameter] o
+#   25|           -1: [TypeMention] object
+#   25|       3: [ConstructorInitializer] call to constructor C1
+#   25|         0: [ParameterAccess] access to parameter o
+#   25|         1: [StringLiteralUtf16] "default"
+#   25|       4: [BlockStmt] {...}
+#   28|   2: [Class] C2
+#-----|     3: (Base types)
+#   28|       0: [TypeMention] C1
+#   28|     4: [InstanceConstructor,PrimaryConstructor] C2
+#-----|       2: (Parameters)
+#   28|         0: [Parameter] o
+#   28|           -1: [TypeMention] object
+#   28|         1: [Parameter] s
+#   28|           -1: [TypeMention] string
+#   28|         2: [Parameter] i
+#   28|           -1: [TypeMention] int
--- a/csharp/ql/test/library-tests/constructors/constructors.cs
+++ b/csharp/ql/test/library-tests/constructors/constructors.cs
@@ -17,3 +17,13 @@ namespace Constructors
        }
    }
 }
+
+namespace PrimaryConstructors
+{
+    public class C1(object o, string s)
+    {
+        public C1(object o) : this(o, "default") { }
+    }
+
+    public class C2(object o, string s, int i) : C1(o, s) { }
+}
--- a/csharp/ql/test/library-tests/csharp9/PrintAst.expected
+++ b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
@@ -878,7 +878,7 @@ Record.cs:
 #   27|       1: [Parameter] right
 #   27|   14: [Property] EqualityContract
 #   27|     3: [Getter] get_EqualityContract
-#   27|   15: [InstanceConstructor] Person1
+#   27|   15: [InstanceConstructor,PrimaryConstructor] Person1
 #-----|     2: (Parameters)
 #   27|       0: [Parameter] FirstName
 #   27|         -1: [TypeMention] string
@@ -905,7 +905,7 @@ Record.cs:
 #   29|       1: [Parameter] right
 #   29|   15: [Property] EqualityContract
 #   29|     3: [Getter] get_EqualityContract
-#   29|   16: [InstanceConstructor] Teacher1
+#   29|   16: [InstanceConstructor,PrimaryConstructor] Teacher1
 #-----|     2: (Parameters)
 #   29|       0: [Parameter] FirstName
 #   29|         -1: [TypeMention] string
@@ -929,7 +929,7 @@ Record.cs:
 #   32|       1: [Parameter] right
 #   32|   15: [Property] EqualityContract
 #   32|     3: [Getter] get_EqualityContract
-#   32|   16: [InstanceConstructor] Student1
+#   32|   16: [InstanceConstructor,PrimaryConstructor] Student1
 #-----|     2: (Parameters)
 #   32|       0: [Parameter] FirstName
 #   32|         -1: [TypeMention] string
@@ -953,7 +953,7 @@ Record.cs:
 #   35|       1: [Parameter] right
 #   35|   14: [Property] EqualityContract
 #   35|     3: [Getter] get_EqualityContract
-#   35|   15: [InstanceConstructor] Pet
+#   35|   15: [InstanceConstructor,PrimaryConstructor] Pet
 #-----|     2: (Parameters)
 #   35|       0: [Parameter] Name
 #   35|         -1: [TypeMention] string
@@ -977,7 +977,7 @@ Record.cs:
 #-----|     2: (Parameters)
 #   41|       0: [Parameter] left
 #   41|       1: [Parameter] right
-#   41|   14: [InstanceConstructor] Dog
+#   41|   14: [InstanceConstructor,PrimaryConstructor] Dog
 #-----|     2: (Parameters)
 #   41|       0: [Parameter] Name
 #   41|         -1: [TypeMention] string
@@ -1018,7 +1018,7 @@ Record.cs:
 #   54|       1: [Parameter] right
 #   54|   14: [Property] EqualityContract
 #   54|     3: [Getter] get_EqualityContract
-#   54|   15: [InstanceConstructor] R1
+#   54|   15: [InstanceConstructor,PrimaryConstructor] R1
 #-----|     2: (Parameters)
 #   54|       0: [Parameter] A
 #   54|         -1: [TypeMention] string
@@ -1038,7 +1038,7 @@ Record.cs:
 #   56|       1: [Parameter] right
 #   56|   15: [Property] EqualityContract
 #   56|     3: [Getter] get_EqualityContract
-#   56|   16: [InstanceConstructor] R2
+#   56|   16: [InstanceConstructor,PrimaryConstructor] R2
 #-----|     2: (Parameters)
 #   56|       0: [Parameter] A
 #   56|         -1: [TypeMention] string
--- a/csharp/ql/test/library-tests/dataflow/constructors/ConstructorFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/constructors/ConstructorFlow.expected
@@ -0,0 +1,138 @@
+testFailures
+edges
+| Constructors.cs:5:24:5:25 | [post] this access : C_no_ctor [field s1] : Object | Constructors.cs:9:27:9:41 | object creation of type C_no_ctor : C_no_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:5:29:5:45 | call to method Source<Object> : Object | Constructors.cs:5:24:5:25 | [post] this access : C_no_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:9:27:9:41 | object creation of type C_no_ctor : C_no_ctor [field s1] : Object | Constructors.cs:10:13:10:13 | access to local variable c : C_no_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:10:13:10:13 | access to local variable c : C_no_ctor [field s1] : Object | Constructors.cs:13:21:13:22 | this : C_no_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:13:21:13:22 | this : C_no_ctor [field s1] : Object | Constructors.cs:15:18:15:19 | this access : C_no_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:15:18:15:19 | this access : C_no_ctor [field s1] : Object | Constructors.cs:15:18:15:19 | access to field s1 | provenance |  |
+| Constructors.cs:21:24:21:25 | [post] this access : C_with_ctor [field s1] : Object | Constructors.cs:25:29:25:45 | object creation of type C_with_ctor : C_with_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:21:29:21:45 | call to method Source<Object> : Object | Constructors.cs:21:24:21:25 | [post] this access : C_with_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:25:29:25:45 | object creation of type C_with_ctor : C_with_ctor [field s1] : Object | Constructors.cs:26:13:26:13 | access to local variable c : C_with_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:26:13:26:13 | access to local variable c : C_with_ctor [field s1] : Object | Constructors.cs:31:21:31:22 | this : C_with_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:31:21:31:22 | this : C_with_ctor [field s1] : Object | Constructors.cs:33:18:33:19 | this access : C_with_ctor [field s1] : Object | provenance |  |
+| Constructors.cs:33:18:33:19 | this access : C_with_ctor [field s1] : Object | Constructors.cs:33:18:33:19 | access to field s1 | provenance |  |
+| Constructors.cs:41:26:41:26 | o : Object | Constructors.cs:41:38:41:38 | access to parameter o : Object | provenance |  |
+| Constructors.cs:41:38:41:38 | access to parameter o : Object | Constructors.cs:41:32:41:34 | [post] this access : C1 [field Obj] : Object | provenance |  |
+| Constructors.cs:44:28:44:35 | o21param : Object | Constructors.cs:46:31:46:38 | access to parameter o21param : Object | provenance |  |
+| Constructors.cs:46:31:46:38 | access to parameter o21param : Object | Constructors.cs:46:23:46:27 | [post] this access : C2 [field Obj21] : Object | provenance |  |
+| Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | access to parameter o22param : Object | provenance |  |
+| Constructors.cs:50:32:50:36 | this : C2 [field Obj21] : Object | Constructors.cs:50:32:50:36 | this access : C2 [field Obj21] : Object | provenance |  |
+| Constructors.cs:50:32:50:36 | this access : C2 [field Obj21] : Object | Constructors.cs:50:32:50:36 | access to field Obj21 : Object | provenance |  |
+| Constructors.cs:52:35:52:35 | o : Object | Constructors.cs:54:13:54:24 | SSA def(o22param) : Object | provenance |  |
+| Constructors.cs:57:54:57:55 | o2 : Object | Constructors.cs:59:13:59:19 | SSA def(o1) : Object | provenance |  |
+| Constructors.cs:62:41:62:41 | o : Object | Constructors.cs:64:37:64:37 | access to parameter o : Object | provenance |  |
+| Constructors.cs:64:37:64:37 | access to parameter o : Object | Constructors.cs:57:54:57:55 | o2 : Object | provenance |  |
+| Constructors.cs:64:37:64:37 | access to parameter o : Object | Constructors.cs:64:27:64:34 | SSA def(o22param) : Object | provenance |  |
+| Constructors.cs:70:17:70:33 | call to method Source<Object> : Object | Constructors.cs:71:25:71:25 | access to local variable o : Object | provenance |  |
+| Constructors.cs:71:18:71:26 | object creation of type C1 : C1 [field Obj] : Object | Constructors.cs:72:14:72:15 | access to local variable c1 : C1 [field Obj] : Object | provenance |  |
+| Constructors.cs:71:25:71:25 | access to local variable o : Object | Constructors.cs:41:26:41:26 | o : Object | provenance |  |
+| Constructors.cs:71:25:71:25 | access to local variable o : Object | Constructors.cs:71:18:71:26 | object creation of type C1 : C1 [field Obj] : Object | provenance |  |
+| Constructors.cs:72:14:72:15 | access to local variable c1 : C1 [field Obj] : Object | Constructors.cs:72:14:72:19 | access to field Obj | provenance |  |
+| Constructors.cs:77:19:77:35 | call to method Source<Object> : Object | Constructors.cs:79:25:79:27 | access to local variable o21 : Object | provenance |  |
+| Constructors.cs:78:19:78:35 | call to method Source<Object> : Object | Constructors.cs:79:30:79:32 | access to local variable o22 : Object | provenance |  |
+| Constructors.cs:79:18:79:33 | object creation of type C2 : C2 [field Obj21] : Object | Constructors.cs:80:14:80:15 | access to local variable c2 : C2 [field Obj21] : Object | provenance |  |
+| Constructors.cs:79:18:79:33 | object creation of type C2 : C2 [field Obj21] : Object | Constructors.cs:82:14:82:15 | access to local variable c2 : C2 [field Obj21] : Object | provenance |  |
+| Constructors.cs:79:18:79:33 | object creation of type C2 : C2 [parameter o22param] : Object | Constructors.cs:81:14:81:15 | access to local variable c2 : C2 [parameter o22param] : Object | provenance |  |
+| Constructors.cs:79:25:79:27 | access to local variable o21 : Object | Constructors.cs:44:28:44:35 | o21param : Object | provenance |  |
+| Constructors.cs:79:25:79:27 | access to local variable o21 : Object | Constructors.cs:79:18:79:33 | object creation of type C2 : C2 [field Obj21] : Object | provenance |  |
+| Constructors.cs:79:30:79:32 | access to local variable o22 : Object | Constructors.cs:44:45:44:52 | o22param : Object | provenance |  |
+| Constructors.cs:79:30:79:32 | access to local variable o22 : Object | Constructors.cs:79:18:79:33 | object creation of type C2 : C2 [parameter o22param] : Object | provenance |  |
+| Constructors.cs:80:14:80:15 | access to local variable c2 : C2 [field Obj21] : Object | Constructors.cs:80:14:80:21 | access to field Obj21 | provenance |  |
+| Constructors.cs:81:14:81:15 | access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | provenance |  |
+| Constructors.cs:81:14:81:15 | access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:81:14:81:21 | access to property Obj22 | provenance |  |
+| Constructors.cs:82:14:82:15 | access to local variable c2 : C2 [field Obj21] : Object | Constructors.cs:50:32:50:36 | this : C2 [field Obj21] : Object | provenance |  |
+| Constructors.cs:82:14:82:15 | access to local variable c2 : C2 [field Obj21] : Object | Constructors.cs:82:14:82:21 | access to property Obj23 | provenance |  |
+| Constructors.cs:91:21:91:37 | call to method Source<Object> : Object | Constructors.cs:92:19:92:23 | access to local variable taint : Object | provenance |  |
+| Constructors.cs:92:9:92:10 | [post] access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:93:14:93:15 | access to local variable c2 : C2 [parameter o22param] : Object | provenance |  |
+| Constructors.cs:92:19:92:23 | access to local variable taint : Object | Constructors.cs:52:35:52:35 | o : Object | provenance |  |
+| Constructors.cs:92:19:92:23 | access to local variable taint : Object | Constructors.cs:92:9:92:10 | [post] access to local variable c2 : C2 [parameter o22param] : Object | provenance |  |
+| Constructors.cs:93:14:93:15 | access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | provenance |  |
+| Constructors.cs:93:14:93:15 | access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:93:14:93:21 | access to property Obj22 | provenance |  |
+| Constructors.cs:99:21:99:37 | call to method Source<Object> : Object | Constructors.cs:100:25:100:29 | access to local variable taint : Object | provenance |  |
+| Constructors.cs:100:9:100:10 | [post] access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:101:14:101:15 | access to local variable c2 : C2 [parameter o22param] : Object | provenance |  |
+| Constructors.cs:100:25:100:29 | access to local variable taint : Object | Constructors.cs:62:41:62:41 | o : Object | provenance |  |
+| Constructors.cs:100:25:100:29 | access to local variable taint : Object | Constructors.cs:100:9:100:10 | [post] access to local variable c2 : C2 [parameter o22param] : Object | provenance |  |
+| Constructors.cs:101:14:101:15 | access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | provenance |  |
+| Constructors.cs:101:14:101:15 | access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:101:14:101:21 | access to property Obj22 | provenance |  |
+nodes
+| Constructors.cs:5:24:5:25 | [post] this access : C_no_ctor [field s1] : Object | semmle.label | [post] this access : C_no_ctor [field s1] : Object |
+| Constructors.cs:5:29:5:45 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
+| Constructors.cs:9:27:9:41 | object creation of type C_no_ctor : C_no_ctor [field s1] : Object | semmle.label | object creation of type C_no_ctor : C_no_ctor [field s1] : Object |
+| Constructors.cs:10:13:10:13 | access to local variable c : C_no_ctor [field s1] : Object | semmle.label | access to local variable c : C_no_ctor [field s1] : Object |
+| Constructors.cs:13:21:13:22 | this : C_no_ctor [field s1] : Object | semmle.label | this : C_no_ctor [field s1] : Object |
+| Constructors.cs:15:18:15:19 | access to field s1 | semmle.label | access to field s1 |
+| Constructors.cs:15:18:15:19 | this access : C_no_ctor [field s1] : Object | semmle.label | this access : C_no_ctor [field s1] : Object |
+| Constructors.cs:21:24:21:25 | [post] this access : C_with_ctor [field s1] : Object | semmle.label | [post] this access : C_with_ctor [field s1] : Object |
+| Constructors.cs:21:29:21:45 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
+| Constructors.cs:25:29:25:45 | object creation of type C_with_ctor : C_with_ctor [field s1] : Object | semmle.label | object creation of type C_with_ctor : C_with_ctor [field s1] : Object |
+| Constructors.cs:26:13:26:13 | access to local variable c : C_with_ctor [field s1] : Object | semmle.label | access to local variable c : C_with_ctor [field s1] : Object |
+| Constructors.cs:31:21:31:22 | this : C_with_ctor [field s1] : Object | semmle.label | this : C_with_ctor [field s1] : Object |
+| Constructors.cs:33:18:33:19 | access to field s1 | semmle.label | access to field s1 |
+| Constructors.cs:33:18:33:19 | this access : C_with_ctor [field s1] : Object | semmle.label | this access : C_with_ctor [field s1] : Object |
+| Constructors.cs:41:26:41:26 | o : Object | semmle.label | o : Object |
+| Constructors.cs:41:32:41:34 | [post] this access : C1 [field Obj] : Object | semmle.label | [post] this access : C1 [field Obj] : Object |
+| Constructors.cs:41:38:41:38 | access to parameter o : Object | semmle.label | access to parameter o : Object |
+| Constructors.cs:44:28:44:35 | o21param : Object | semmle.label | o21param : Object |
+| Constructors.cs:44:45:44:52 | o22param : Object | semmle.label | o22param : Object |
+| Constructors.cs:46:23:46:27 | [post] this access : C2 [field Obj21] : Object | semmle.label | [post] this access : C2 [field Obj21] : Object |
+| Constructors.cs:46:31:46:38 | access to parameter o21param : Object | semmle.label | access to parameter o21param : Object |
+| Constructors.cs:48:32:48:39 | access to parameter o22param : Object | semmle.label | access to parameter o22param : Object |
+| Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | semmle.label | this : C2 [parameter o22param] : Object |
+| Constructors.cs:50:32:50:36 | access to field Obj21 : Object | semmle.label | access to field Obj21 : Object |
+| Constructors.cs:50:32:50:36 | this : C2 [field Obj21] : Object | semmle.label | this : C2 [field Obj21] : Object |
+| Constructors.cs:50:32:50:36 | this access : C2 [field Obj21] : Object | semmle.label | this access : C2 [field Obj21] : Object |
+| Constructors.cs:52:35:52:35 | o : Object | semmle.label | o : Object |
+| Constructors.cs:54:13:54:24 | SSA def(o22param) : Object | semmle.label | SSA def(o22param) : Object |
+| Constructors.cs:57:54:57:55 | o2 : Object | semmle.label | o2 : Object |
+| Constructors.cs:59:13:59:19 | SSA def(o1) : Object | semmle.label | SSA def(o1) : Object |
+| Constructors.cs:62:41:62:41 | o : Object | semmle.label | o : Object |
+| Constructors.cs:64:27:64:34 | SSA def(o22param) : Object | semmle.label | SSA def(o22param) : Object |
+| Constructors.cs:64:37:64:37 | access to parameter o : Object | semmle.label | access to parameter o : Object |
+| Constructors.cs:70:17:70:33 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
+| Constructors.cs:71:18:71:26 | object creation of type C1 : C1 [field Obj] : Object | semmle.label | object creation of type C1 : C1 [field Obj] : Object |
+| Constructors.cs:71:25:71:25 | access to local variable o : Object | semmle.label | access to local variable o : Object |
+| Constructors.cs:72:14:72:15 | access to local variable c1 : C1 [field Obj] : Object | semmle.label | access to local variable c1 : C1 [field Obj] : Object |
+| Constructors.cs:72:14:72:19 | access to field Obj | semmle.label | access to field Obj |
+| Constructors.cs:77:19:77:35 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
+| Constructors.cs:78:19:78:35 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
+| Constructors.cs:79:18:79:33 | object creation of type C2 : C2 [field Obj21] : Object | semmle.label | object creation of type C2 : C2 [field Obj21] : Object |
+| Constructors.cs:79:18:79:33 | object creation of type C2 : C2 [parameter o22param] : Object | semmle.label | object creation of type C2 : C2 [parameter o22param] : Object |
+| Constructors.cs:79:25:79:27 | access to local variable o21 : Object | semmle.label | access to local variable o21 : Object |
+| Constructors.cs:79:30:79:32 | access to local variable o22 : Object | semmle.label | access to local variable o22 : Object |
+| Constructors.cs:80:14:80:15 | access to local variable c2 : C2 [field Obj21] : Object | semmle.label | access to local variable c2 : C2 [field Obj21] : Object |
+| Constructors.cs:80:14:80:21 | access to field Obj21 | semmle.label | access to field Obj21 |
+| Constructors.cs:81:14:81:15 | access to local variable c2 : C2 [parameter o22param] : Object | semmle.label | access to local variable c2 : C2 [parameter o22param] : Object |
+| Constructors.cs:81:14:81:21 | access to property Obj22 | semmle.label | access to property Obj22 |
+| Constructors.cs:82:14:82:15 | access to local variable c2 : C2 [field Obj21] : Object | semmle.label | access to local variable c2 : C2 [field Obj21] : Object |
+| Constructors.cs:82:14:82:21 | access to property Obj23 | semmle.label | access to property Obj23 |
+| Constructors.cs:91:21:91:37 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
+| Constructors.cs:92:9:92:10 | [post] access to local variable c2 : C2 [parameter o22param] : Object | semmle.label | [post] access to local variable c2 : C2 [parameter o22param] : Object |
+| Constructors.cs:92:19:92:23 | access to local variable taint : Object | semmle.label | access to local variable taint : Object |
+| Constructors.cs:93:14:93:15 | access to local variable c2 : C2 [parameter o22param] : Object | semmle.label | access to local variable c2 : C2 [parameter o22param] : Object |
+| Constructors.cs:93:14:93:21 | access to property Obj22 | semmle.label | access to property Obj22 |
+| Constructors.cs:99:21:99:37 | call to method Source<Object> : Object | semmle.label | call to method Source<Object> : Object |
+| Constructors.cs:100:9:100:10 | [post] access to local variable c2 : C2 [parameter o22param] : Object | semmle.label | [post] access to local variable c2 : C2 [parameter o22param] : Object |
+| Constructors.cs:100:25:100:29 | access to local variable taint : Object | semmle.label | access to local variable taint : Object |
+| Constructors.cs:101:14:101:15 | access to local variable c2 : C2 [parameter o22param] : Object | semmle.label | access to local variable c2 : C2 [parameter o22param] : Object |
+| Constructors.cs:101:14:101:21 | access to property Obj22 | semmle.label | access to property Obj22 |
+subpaths
+| Constructors.cs:64:37:64:37 | access to parameter o : Object | Constructors.cs:57:54:57:55 | o2 : Object | Constructors.cs:59:13:59:19 | SSA def(o1) : Object | Constructors.cs:64:27:64:34 | SSA def(o22param) : Object |
+| Constructors.cs:71:25:71:25 | access to local variable o : Object | Constructors.cs:41:26:41:26 | o : Object | Constructors.cs:41:32:41:34 | [post] this access : C1 [field Obj] : Object | Constructors.cs:71:18:71:26 | object creation of type C1 : C1 [field Obj] : Object |
+| Constructors.cs:79:25:79:27 | access to local variable o21 : Object | Constructors.cs:44:28:44:35 | o21param : Object | Constructors.cs:46:23:46:27 | [post] this access : C2 [field Obj21] : Object | Constructors.cs:79:18:79:33 | object creation of type C2 : C2 [field Obj21] : Object |
+| Constructors.cs:79:30:79:32 | access to local variable o22 : Object | Constructors.cs:44:45:44:52 | o22param : Object | Constructors.cs:44:45:44:52 | o22param : Object | Constructors.cs:79:18:79:33 | object creation of type C2 : C2 [parameter o22param] : Object |
+| Constructors.cs:81:14:81:15 | access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | access to parameter o22param : Object | Constructors.cs:81:14:81:21 | access to property Obj22 |
+| Constructors.cs:82:14:82:15 | access to local variable c2 : C2 [field Obj21] : Object | Constructors.cs:50:32:50:36 | this : C2 [field Obj21] : Object | Constructors.cs:50:32:50:36 | access to field Obj21 : Object | Constructors.cs:82:14:82:21 | access to property Obj23 |
+| Constructors.cs:92:19:92:23 | access to local variable taint : Object | Constructors.cs:52:35:52:35 | o : Object | Constructors.cs:54:13:54:24 | SSA def(o22param) : Object | Constructors.cs:92:9:92:10 | [post] access to local variable c2 : C2 [parameter o22param] : Object |
+| Constructors.cs:93:14:93:15 | access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | access to parameter o22param : Object | Constructors.cs:93:14:93:21 | access to property Obj22 |
+| Constructors.cs:100:25:100:29 | access to local variable taint : Object | Constructors.cs:62:41:62:41 | o : Object | Constructors.cs:64:27:64:34 | SSA def(o22param) : Object | Constructors.cs:100:9:100:10 | [post] access to local variable c2 : C2 [parameter o22param] : Object |
+| Constructors.cs:101:14:101:15 | access to local variable c2 : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | this : C2 [parameter o22param] : Object | Constructors.cs:48:32:48:39 | access to parameter o22param : Object | Constructors.cs:101:14:101:21 | access to property Obj22 |
+#select
+| Constructors.cs:15:18:15:19 | access to field s1 | Constructors.cs:5:29:5:45 | call to method Source<Object> : Object | Constructors.cs:15:18:15:19 | access to field s1 | $@ | Constructors.cs:5:29:5:45 | call to method Source<Object> : Object | call to method Source<Object> : Object |
+| Constructors.cs:33:18:33:19 | access to field s1 | Constructors.cs:21:29:21:45 | call to method Source<Object> : Object | Constructors.cs:33:18:33:19 | access to field s1 | $@ | Constructors.cs:21:29:21:45 | call to method Source<Object> : Object | call to method Source<Object> : Object |
+| Constructors.cs:72:14:72:19 | access to field Obj | Constructors.cs:70:17:70:33 | call to method Source<Object> : Object | Constructors.cs:72:14:72:19 | access to field Obj | $@ | Constructors.cs:70:17:70:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
+| Constructors.cs:80:14:80:21 | access to field Obj21 | Constructors.cs:77:19:77:35 | call to method Source<Object> : Object | Constructors.cs:80:14:80:21 | access to field Obj21 | $@ | Constructors.cs:77:19:77:35 | call to method Source<Object> : Object | call to method Source<Object> : Object |
+| Constructors.cs:81:14:81:21 | access to property Obj22 | Constructors.cs:78:19:78:35 | call to method Source<Object> : Object | Constructors.cs:81:14:81:21 | access to property Obj22 | $@ | Constructors.cs:78:19:78:35 | call to method Source<Object> : Object | call to method Source<Object> : Object |
+| Constructors.cs:82:14:82:21 | access to property Obj23 | Constructors.cs:77:19:77:35 | call to method Source<Object> : Object | Constructors.cs:82:14:82:21 | access to property Obj23 | $@ | Constructors.cs:77:19:77:35 | call to method Source<Object> : Object | call to method Source<Object> : Object |
+| Constructors.cs:93:14:93:21 | access to property Obj22 | Constructors.cs:91:21:91:37 | call to method Source<Object> : Object | Constructors.cs:93:14:93:21 | access to property Obj22 | $@ | Constructors.cs:91:21:91:37 | call to method Source<Object> : Object | call to method Source<Object> : Object |
+| Constructors.cs:101:14:101:21 | access to property Obj22 | Constructors.cs:99:21:99:37 | call to method Source<Object> : Object | Constructors.cs:101:14:101:21 | access to property Obj22 | $@ | Constructors.cs:99:21:99:37 | call to method Source<Object> : Object | call to method Source<Object> : Object |
--- a/csharp/ql/test/library-tests/dataflow/constructors/ConstructorFlow.ql
+++ b/csharp/ql/test/library-tests/dataflow/constructors/ConstructorFlow.ql
@@ -0,0 +1,12 @@
+/**
+ * @kind path-problem
+ */
+
+import csharp
+import TestUtilities.InlineFlowTest
+import ValueFlowTest<DefaultFlowConfig>
+import PathGraph
+
+from PathNode source, PathNode sink
+where flowPath(source, sink)
+select sink, source, sink, "$@", source, source.toString()
--- a/csharp/ql/test/library-tests/dataflow/constructors/Constructors.cs
+++ b/csharp/ql/test/library-tests/dataflow/constructors/Constructors.cs
@@ -0,0 +1,107 @@
+public class Constructors
+{
+    public class C_no_ctor
+    {
+        private object s1 = Source<object>(1);
+
+        void M1()
+        {
+            C_no_ctor c = new C_no_ctor();
+            c.M2();
+        }
+
+        public void M2()
+        {
+            Sink(s1); // $ hasValueFlow=1
+        }
+    }
+
+    public class C_with_ctor
+    {
+        private object s1 = Source<object>(1);
+
+        void M1()
+        {
+            C_with_ctor c = new C_with_ctor();
+            c.M2();
+        }
+
+        public C_with_ctor() { }
+
+        public void M2()
+        {
+            Sink(s1); // $ hasValueFlow=1
+        }
+    }
+
+    public class C1
+    {
+        public object Obj;
+
+        public C1(object o) => Obj = o;
+    }
+
+    public class C2(object o21param, object o22param)
+    {
+        public object Obj21 = o21param;
+
+        public object Obj22 => o22param;
+
+        public object Obj23 => Obj21;
+
+        public void SetObj(object o)
+        {
+            o22param = o;
+        }
+
+        private void SetObjOut(out object o1, object o2)
+        {
+            o1 = o2;
+        }
+
+        public void SetObjViaOut(object o)
+        {
+            SetObjOut(out o22param, o);
+        }
+    }
+
+    public void M1()
+    {
+        var o = Source<object>(1);
+        var c1 = new C1(o);
+        Sink(c1.Obj); // $ hasValueFlow=1
+    }
+
+    public void M2()
+    {
+        var o21 = Source<object>(2);
+        var o22 = Source<object>(3);
+        var c2 = new C2(o21, o22);
+        Sink(c2.Obj21); // $ hasValueFlow=2
+        Sink(c2.Obj22); // $ hasValueFlow=3
+        Sink(c2.Obj23); // $ hasValueFlow=2
+    }
+
+    public void M3()
+    {
+        var c2 = new C2(new object(), new object());
+        Sink(c2.Obj21); // No flow
+        Sink(c2.Obj22); // No flow
+        Sink(c2.Obj23); // No flow
+        var taint = Source<object>(4);
+        c2.SetObj(taint);
+        Sink(c2.Obj22); // $ hasValueFlow=4
+    }
+
+    public void M4()
+    {
+        var c2 = new C2(new object(), new object());
+        var taint = Source<object>(5);
+        c2.SetObjViaOut(taint);
+        Sink(c2.Obj22); // $ hasValueFlow=5
+    }
+
+    public static void Sink(object o) { }
+
+    public static T Source<T>(object source) => throw null;
+}
--- a/csharp/ql/test/library-tests/dataflow/fields/C_ctor.cs
+++ b/csharp/ql/test/library-tests/dataflow/fields/C_ctor.cs
@@ -1,42 +0,0 @@
-public class C_no_ctor
-{
-    private Elem s1 = Util.Source<Elem>(1);
-
-    void M1()
-    {
-        C_no_ctor c = new C_no_ctor();
-        c.M2();
-    }
-
-    public void M2()
-    {
-        Util.Sink(s1); // $ hasValueFlow=1
-    }
-}
-
-public class C_with_ctor
-{
-    private Elem s1 = Util.Source<Elem>(1);
-
-    void M1()
-    {
-        C_with_ctor c = new C_with_ctor();
-        c.M2();
-    }
-
-    public C_with_ctor() { }
-
-    public void M2()
-    {
-        Util.Sink(s1); // $ hasValueFlow=1
-    }
-}
-
-class Util
-{
-    public static void Sink(object o) { }
-
-    public static T Source<T>(object source) => throw null;
-}
-
-public class Elem { }
--- a/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected
+++ b/csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected
@@ -308,30 +308,6 @@ edges
 | C.cs:25:14:25:15 | this access : C [field s3] : Elem | C.cs:25:14:25:15 | access to field s3 | provenance |  |
 | C.cs:27:14:27:15 | this access : C [property s5] : Elem | C.cs:27:14:27:15 | access to property s5 | provenance |  |
 | C.cs:27:14:27:15 | this access : C [property s5] : Elem | C.cs:27:14:27:15 | access to property s5 | provenance |  |
-| C_ctor.cs:3:18:3:19 | [post] this access : C_no_ctor [field s1] : Elem | C_ctor.cs:7:23:7:37 | object creation of type C_no_ctor : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:3:18:3:19 | [post] this access : C_no_ctor [field s1] : Elem | C_ctor.cs:7:23:7:37 | object creation of type C_no_ctor : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:3:23:3:42 | call to method Source<Elem> : Elem | C_ctor.cs:3:18:3:19 | [post] this access : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:3:23:3:42 | call to method Source<Elem> : Elem | C_ctor.cs:3:18:3:19 | [post] this access : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:7:23:7:37 | object creation of type C_no_ctor : C_no_ctor [field s1] : Elem | C_ctor.cs:8:9:8:9 | access to local variable c : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:7:23:7:37 | object creation of type C_no_ctor : C_no_ctor [field s1] : Elem | C_ctor.cs:8:9:8:9 | access to local variable c : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:8:9:8:9 | access to local variable c : C_no_ctor [field s1] : Elem | C_ctor.cs:11:17:11:18 | this : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:8:9:8:9 | access to local variable c : C_no_ctor [field s1] : Elem | C_ctor.cs:11:17:11:18 | this : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:11:17:11:18 | this : C_no_ctor [field s1] : Elem | C_ctor.cs:13:19:13:20 | this access : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:11:17:11:18 | this : C_no_ctor [field s1] : Elem | C_ctor.cs:13:19:13:20 | this access : C_no_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:13:19:13:20 | this access : C_no_ctor [field s1] : Elem | C_ctor.cs:13:19:13:20 | access to field s1 | provenance |  |
-| C_ctor.cs:13:19:13:20 | this access : C_no_ctor [field s1] : Elem | C_ctor.cs:13:19:13:20 | access to field s1 | provenance |  |
-| C_ctor.cs:19:18:19:19 | [post] this access : C_with_ctor [field s1] : Elem | C_ctor.cs:23:25:23:41 | object creation of type C_with_ctor : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:19:18:19:19 | [post] this access : C_with_ctor [field s1] : Elem | C_ctor.cs:23:25:23:41 | object creation of type C_with_ctor : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:19:23:19:42 | call to method Source<Elem> : Elem | C_ctor.cs:19:18:19:19 | [post] this access : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:19:23:19:42 | call to method Source<Elem> : Elem | C_ctor.cs:19:18:19:19 | [post] this access : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:23:25:23:41 | object creation of type C_with_ctor : C_with_ctor [field s1] : Elem | C_ctor.cs:24:9:24:9 | access to local variable c : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:23:25:23:41 | object creation of type C_with_ctor : C_with_ctor [field s1] : Elem | C_ctor.cs:24:9:24:9 | access to local variable c : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:24:9:24:9 | access to local variable c : C_with_ctor [field s1] : Elem | C_ctor.cs:29:17:29:18 | this : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:24:9:24:9 | access to local variable c : C_with_ctor [field s1] : Elem | C_ctor.cs:29:17:29:18 | this : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:29:17:29:18 | this : C_with_ctor [field s1] : Elem | C_ctor.cs:31:19:31:20 | this access : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:29:17:29:18 | this : C_with_ctor [field s1] : Elem | C_ctor.cs:31:19:31:20 | this access : C_with_ctor [field s1] : Elem | provenance |  |
-| C_ctor.cs:31:19:31:20 | this access : C_with_ctor [field s1] : Elem | C_ctor.cs:31:19:31:20 | access to field s1 | provenance |  |
-| C_ctor.cs:31:19:31:20 | this access : C_with_ctor [field s1] : Elem | C_ctor.cs:31:19:31:20 | access to field s1 | provenance |  |
 | D.cs:8:9:8:11 | this : D [field trivialPropField] : Object | D.cs:8:22:8:25 | this access : D [field trivialPropField] : Object | provenance |  |
 | D.cs:8:9:8:11 | this : D [field trivialPropField] : Object | D.cs:8:22:8:25 | this access : D [field trivialPropField] : Object | provenance |  |
 | D.cs:8:22:8:25 | this access : D [field trivialPropField] : Object | D.cs:8:22:8:42 | access to field trivialPropField : Object | provenance |  |
@@ -1281,34 +1257,6 @@ nodes
 | C.cs:27:14:27:15 | this access : C [property s5] : Elem | semmle.label | this access : C [property s5] : Elem |
 | C.cs:28:14:28:15 | access to property s6 | semmle.label | access to property s6 |
 | C.cs:28:14:28:15 | access to property s6 | semmle.label | access to property s6 |
-| C_ctor.cs:3:18:3:19 | [post] this access : C_no_ctor [field s1] : Elem | semmle.label | [post] this access : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:3:18:3:19 | [post] this access : C_no_ctor [field s1] : Elem | semmle.label | [post] this access : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:3:23:3:42 | call to method Source<Elem> : Elem | semmle.label | call to method Source<Elem> : Elem |
-| C_ctor.cs:3:23:3:42 | call to method Source<Elem> : Elem | semmle.label | call to method Source<Elem> : Elem |
-| C_ctor.cs:7:23:7:37 | object creation of type C_no_ctor : C_no_ctor [field s1] : Elem | semmle.label | object creation of type C_no_ctor : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:7:23:7:37 | object creation of type C_no_ctor : C_no_ctor [field s1] : Elem | semmle.label | object creation of type C_no_ctor : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:8:9:8:9 | access to local variable c : C_no_ctor [field s1] : Elem | semmle.label | access to local variable c : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:8:9:8:9 | access to local variable c : C_no_ctor [field s1] : Elem | semmle.label | access to local variable c : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:11:17:11:18 | this : C_no_ctor [field s1] : Elem | semmle.label | this : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:11:17:11:18 | this : C_no_ctor [field s1] : Elem | semmle.label | this : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:13:19:13:20 | access to field s1 | semmle.label | access to field s1 |
-| C_ctor.cs:13:19:13:20 | access to field s1 | semmle.label | access to field s1 |
-| C_ctor.cs:13:19:13:20 | this access : C_no_ctor [field s1] : Elem | semmle.label | this access : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:13:19:13:20 | this access : C_no_ctor [field s1] : Elem | semmle.label | this access : C_no_ctor [field s1] : Elem |
-| C_ctor.cs:19:18:19:19 | [post] this access : C_with_ctor [field s1] : Elem | semmle.label | [post] this access : C_with_ctor [field s1] : Elem |
-| C_ctor.cs:19:18:19:19 | [post] this access : C_with_ctor [field s1] : Elem | semmle.label | [post] this access : C_with_ctor [field s1] : Elem |
-| C_ctor.cs:19:23:19:42 | call to method Source<Elem> : Elem | semmle.label | call to method Source<Elem> : Elem |
-| C_ctor.cs:19:23:19:42 | call to method Source<Elem> : Elem | semmle.label | call to method Source<Elem> : Elem |
-| C_ctor.cs:23:25:23:41 | object creation of type C_with_ctor : C_with_ctor [field s1] : Elem | semmle.label | object creation of type C_with_ctor : C_with_ctor [field s1] : Elem |
-| C_ctor.cs:23:25:23:41 | object creation of type C_with_ctor : C_with_ctor [field s1] : Elem | semmle.label | object creation of type C_with_ctor : C_with_ctor [field s1] : Elem |
-| C_ctor.cs:24:9:24:9 | access to local variable c : C_with_ctor [field s1] : Elem | semmle.label | access to local variable c : C_with_ctor [field s1] : Elem |
-| C_ctor.cs:24:9:24:9 | access to local variable c : C_with_ctor [field s1] : Elem | semmle.label | access to local variable c : C_with_ctor [field s1] : Elem |
-| C_ctor.cs:29:17:29:18 | this : C_with_ctor [field s1] : Elem | semmle.label | this : C_with_ctor [field s1] : Elem |
-| C_ctor.cs:29:17:29:18 | this : C_with_ctor [field s1] : Elem | semmle.label | this : C_with_ctor [field s1] : Elem |
-| C_ctor.cs:31:19:31:20 | access to field s1 | semmle.label | access to field s1 |
-| C_ctor.cs:31:19:31:20 | access to field s1 | semmle.label | access to field s1 |
-| C_ctor.cs:31:19:31:20 | this access : C_with_ctor [field s1] : Elem | semmle.label | this access : C_with_ctor [field s1] : Elem |
-| C_ctor.cs:31:19:31:20 | this access : C_with_ctor [field s1] : Elem | semmle.label | this access : C_with_ctor [field s1] : Elem |
 | D.cs:8:9:8:11 | this : D [field trivialPropField] : Object | semmle.label | this : D [field trivialPropField] : Object |
 | D.cs:8:9:8:11 | this : D [field trivialPropField] : Object | semmle.label | this : D [field trivialPropField] : Object |
 | D.cs:8:22:8:25 | this access : D [field trivialPropField] : Object | semmle.label | this access : D [field trivialPropField] : Object |
@@ -2121,10 +2069,6 @@ subpaths
 | C.cs:27:14:27:15 | access to property s5 | C.cs:7:37:7:51 | call to method Source<Elem> : Elem | C.cs:27:14:27:15 | access to property s5 | $@ | C.cs:7:37:7:51 | call to method Source<Elem> : Elem | call to method Source<Elem> : Elem |
 | C.cs:28:14:28:15 | access to property s6 | C.cs:8:30:8:44 | call to method Source<Elem> : Elem | C.cs:28:14:28:15 | access to property s6 | $@ | C.cs:8:30:8:44 | call to method Source<Elem> : Elem | call to method Source<Elem> : Elem |
 | C.cs:28:14:28:15 | access to property s6 | C.cs:8:30:8:44 | call to method Source<Elem> : Elem | C.cs:28:14:28:15 | access to property s6 | $@ | C.cs:8:30:8:44 | call to method Source<Elem> : Elem | call to method Source<Elem> : Elem |
-| C_ctor.cs:13:19:13:20 | access to field s1 | C_ctor.cs:3:23:3:42 | call to method Source<Elem> : Elem | C_ctor.cs:13:19:13:20 | access to field s1 | $@ | C_ctor.cs:3:23:3:42 | call to method Source<Elem> : Elem | call to method Source<Elem> : Elem |
-| C_ctor.cs:13:19:13:20 | access to field s1 | C_ctor.cs:3:23:3:42 | call to method Source<Elem> : Elem | C_ctor.cs:13:19:13:20 | access to field s1 | $@ | C_ctor.cs:3:23:3:42 | call to method Source<Elem> : Elem | call to method Source<Elem> : Elem |
-| C_ctor.cs:31:19:31:20 | access to field s1 | C_ctor.cs:19:23:19:42 | call to method Source<Elem> : Elem | C_ctor.cs:31:19:31:20 | access to field s1 | $@ | C_ctor.cs:19:23:19:42 | call to method Source<Elem> : Elem | call to method Source<Elem> : Elem |
-| C_ctor.cs:31:19:31:20 | access to field s1 | C_ctor.cs:19:23:19:42 | call to method Source<Elem> : Elem | C_ctor.cs:31:19:31:20 | access to field s1 | $@ | C_ctor.cs:19:23:19:42 | call to method Source<Elem> : Elem | call to method Source<Elem> : Elem |
 | D.cs:32:14:32:23 | access to property AutoProp | D.cs:29:17:29:33 | call to method Source<Object> : Object | D.cs:32:14:32:23 | access to property AutoProp | $@ | D.cs:29:17:29:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | D.cs:32:14:32:23 | access to property AutoProp | D.cs:29:17:29:33 | call to method Source<Object> : Object | D.cs:32:14:32:23 | access to property AutoProp | $@ | D.cs:29:17:29:33 | call to method Source<Object> : Object | call to method Source<Object> : Object |
 | D.cs:39:14:39:26 | access to property TrivialProp | D.cs:37:26:37:42 | call to method Source<Object> : Object | D.cs:39:14:39:26 | access to property TrivialProp | $@ | D.cs:37:26:37:42 | call to method Source<Object> : Object | call to method Source<Object> : Object |
--- a/csharp/ql/test/library-tests/dataflow/ssa/Capture.cs
+++ b/csharp/ql/test/library-tests/dataflow/ssa/Capture.cs
@@ -148,7 +148,7 @@ class Capture
        void M5()
        {
            Use(e);
-            e = 0; // Should *not* get an SSA definition (`e` is never read)
+            e = 0; // Should *not* get an SSA definition (`e` is never read), but does since captured variables are conservatively considered live
        }

        var f = 12;
@@ -165,7 +165,7 @@ class Capture
            Use(g);
        };

-        var h = 12; // Should *not* get an SSA definition
+        var h = 12; // Should *not* get an SSA definition, but does since captured variables are conservatively considered live
        void M8()
        {
            h = 0;
--- a/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SSAPhi.expected
@@ -4,6 +4,7 @@
 | DefUse.cs:6:14:6:14 | y | DefUse.cs:23:9:23:15 | SSA phi(y) | DefUse.cs:18:13:18:18 | SSA def(y) |
 | DefUse.cs:6:14:6:14 | y | DefUse.cs:42:9:42:15 | SSA phi(y) | DefUse.cs:28:13:28:18 | SSA def(y) |
 | DefUse.cs:6:14:6:14 | y | DefUse.cs:42:9:42:15 | SSA phi(y) | DefUse.cs:39:13:39:18 | SSA def(y) |
+| DefUse.cs:59:13:59:13 | i | DefUse.cs:3:17:3:19 | SSA phi(i) | DefUse.cs:76:9:76:11 | SSA def(i) |
 | DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA phi(x1) | DefUse.cs:79:13:79:18 | SSA def(x1) |
 | DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA phi(x1) | DefUse.cs:80:30:80:31 | SSA def(x1) |
 | DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:16:98:17 | SSA phi(x5) | DefUse.cs:97:13:97:18 | SSA def(x5) |
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaCapturedVariableDef.expected
@@ -27,14 +27,19 @@
 | in | Properties.cs:74:23:74:23 | a | Properties.cs:74:23:74:54 | SSA def(a) | Properties.cs:82:24:82:46 | SSA capture def(a) | Properties.cs:82:9:82:47 | call to method Select<Int32,Int32> | true |
 | in | Properties.cs:75:23:75:23 | b | Properties.cs:75:23:75:35 | SSA def(b) | Properties.cs:85:24:85:46 | SSA capture def(b) | Properties.cs:85:9:85:47 | call to method Select<Int32,Int32> | true |
 | out | Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:38:9:38:11 | delegate call | false |
+| out | Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:44:9:44:12 | call to method M | true |
 | out | Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:38:9:38:11 | delegate call | false |
 | out | Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:44:9:44:12 | call to method M | true |
 | out | Capture.cs:29:13:29:13 | z | Capture.cs:30:28:30:32 | SSA def(z) | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:32:9:32:11 | delegate call | false |
+| out | Capture.cs:29:13:29:13 | z | Capture.cs:30:28:30:32 | SSA def(z) | Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:44:9:44:12 | call to method M | true |
 | out | Capture.cs:50:20:50:20 | a | Capture.cs:52:28:52:40 | SSA def(a) | Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:53:9:53:11 | delegate call | false |
 | out | Capture.cs:59:13:59:13 | i | Capture.cs:60:36:60:38 | SSA def(i) | Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:61:9:61:25 | call to method Select<String,Int32> | true |
 | out | Capture.cs:75:13:75:13 | i | Capture.cs:76:80:76:80 | SSA def(i) | Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:77:9:77:25 | call to method Select<String,Int32> | true |
+| out | Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:103:9:107:10 | call to local function fn | true |
+| out | Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:128:9:128:12 | call to local function M2 | false |
 | out | Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:136:9:136:12 | call to local function M3 | false |
 | out | Capture.cs:139:13:139:13 | d | Capture.cs:142:13:142:17 | SSA def(d) | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:144:9:144:12 | call to local function M4 | false |
+| out | Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:160:9:160:12 | call to local function M6 | false |
 | out | Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:176:13:176:16 | call to local function M9 | false |
 | out | Capture.cs:229:13:229:13 | i | Capture.cs:235:21:235:25 | SSA def(i) | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:236:9:236:12 | call to local function M3 | false |
 | out | DefUse.cs:167:23:167:23 | i | DefUse.cs:173:13:173:17 | SSA def(i) | DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:181:9:181:11 | delegate call | false |
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
@@ -2,6 +2,7 @@
 | Capture.cs:6:16:6:16 | i | Capture.cs:10:20:27:9 | SSA capture def(i) |
 | Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) |
 | Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) |
+| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) |
 | Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | SSA def(x) |
 | Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) |
 | Capture.cs:8:13:8:13 | x | Capture.cs:19:24:23:13 | SSA capture def(x) |
@@ -16,6 +17,7 @@
 | Capture.cs:29:13:29:13 | z | Capture.cs:30:28:30:32 | SSA def(z) |
 | Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) |
 | Capture.cs:29:13:29:13 | z | Capture.cs:37:9:37:13 | SSA def(z) |
+| Capture.cs:29:13:29:13 | z | Capture.cs:44:9:44:12 | SSA call def(z) |
 | Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | SSA def(c) |
 | Capture.cs:50:20:50:20 | a | Capture.cs:50:20:50:20 | SSA param(a) |
 | Capture.cs:50:20:50:20 | a | Capture.cs:52:28:52:40 | SSA def(a) |
@@ -50,22 +52,28 @@
 | Capture.cs:94:13:94:13 | y | Capture.cs:96:12:100:9 | SSA capture def(y) |
 | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) |
 | Capture.cs:102:13:102:13 | z | Capture.cs:102:13:102:18 | SSA def(z) |
+| Capture.cs:102:13:102:13 | z | Capture.cs:103:9:107:10 | SSA call def(z) |
 | Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) |
 | Capture.cs:114:13:114:13 | a | Capture.cs:114:13:114:18 | SSA def(a) |
 | Capture.cs:114:13:114:13 | a | Capture.cs:115:9:119:9 | SSA capture def(a) |
 | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) |
 | Capture.cs:122:13:122:13 | b | Capture.cs:122:13:122:18 | SSA def(b) |
 | Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) |
+| Capture.cs:122:13:122:13 | b | Capture.cs:128:9:128:12 | SSA call def(b) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:130:13:130:18 | SSA def(c) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:136:9:136:12 | SSA call def(c) |
 | Capture.cs:139:13:139:13 | d | Capture.cs:139:13:139:18 | SSA def(d) |
 | Capture.cs:139:13:139:13 | d | Capture.cs:142:13:142:17 | SSA def(d) |
 | Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) |
+| Capture.cs:147:13:147:13 | e | Capture.cs:147:13:147:18 | SSA def(e) |
 | Capture.cs:147:13:147:13 | e | Capture.cs:148:9:152:9 | SSA capture def(e) |
+| Capture.cs:147:13:147:13 | e | Capture.cs:151:13:151:17 | SSA def(e) |
 | Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) |
 | Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) |
+| Capture.cs:154:13:154:13 | f | Capture.cs:160:9:160:12 | SSA call def(f) |
 | Capture.cs:162:13:162:13 | g | Capture.cs:163:9:166:9 | SSA capture def(g) |
+| Capture.cs:168:13:168:13 | h | Capture.cs:168:13:168:18 | SSA def(h) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | SSA def(h) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:176:13:176:16 | SSA call def(h) |
@@ -86,6 +94,7 @@
 | Capture.cs:229:13:229:13 | i | Capture.cs:235:21:235:25 | SSA def(i) |
 | Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) |
 | Capture.cs:242:13:242:13 | i | Capture.cs:242:13:242:17 | SSA def(i) |
+| Capture.cs:242:13:242:13 | i | Capture.cs:245:13:245:17 | SSA def(i) |
 | Capture.cs:242:13:242:13 | i | Capture.cs:254:27:254:27 | SSA def(i) |
 | Capture.cs:248:36:248:36 | j | Capture.cs:251:13:251:17 | SSA def(j) |
 | Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) |
@@ -94,6 +103,7 @@
 | Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) |
 | Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) |
 | Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) |
+| Consistency.cs:38:13:38:13 | i | Consistency.cs:38:13:38:13 | SSA def(i) |
 | Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | SSA def(i) |
 | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) |
 | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) |
@@ -119,7 +129,9 @@
 | DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) |
 | DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) |
 | DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) |
+| DefUse.cs:59:13:59:13 | i | DefUse.cs:3:17:3:19 | SSA phi(i) |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | SSA def(i) |
+| DefUse.cs:59:13:59:13 | i | DefUse.cs:60:37:60:41 | SSA def(i) |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | SSA def(i) |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | SSA def(i) |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | SSA def(i) |
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected
@@ -16,7 +16,9 @@
 | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:38:9:38:11 | delegate call |
 | Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:38:9:38:11 | delegate call |
 | Capture.cs:43:9:43:13 | SSA def(x) | Capture.cs:43:9:43:13 | ... = ... |
+| Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:44:9:44:12 | call to method M |
 | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:44:9:44:12 | call to method M |
+| Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:44:9:44:12 | call to method M |
 | Capture.cs:50:20:50:20 | SSA param(a) | Capture.cs:50:20:50:20 | a |
 | Capture.cs:52:16:52:43 | SSA def(b) | Capture.cs:52:16:52:43 | Action b = ... |
 | Capture.cs:52:28:52:40 | SSA def(a) | Capture.cs:52:28:52:40 | ... = ... |
@@ -50,22 +52,28 @@
 | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:96:12:100:9 | (...) => ... |
 | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:98:17:98:21 | Int32 x = ... |
 | Capture.cs:102:13:102:18 | SSA def(z) | Capture.cs:102:13:102:18 | Int32 z = ... |
+| Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:103:9:107:10 | call to local function fn |
 | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:105:13:105:17 | ... = ... |
 | Capture.cs:114:13:114:18 | SSA def(a) | Capture.cs:114:13:114:18 | Int32 a = ... |
 | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:115:9:119:9 | M1 |
 | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:117:17:117:21 | Int32 x = ... |
 | Capture.cs:122:13:122:18 | SSA def(b) | Capture.cs:122:13:122:18 | Int32 b = ... |
 | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:125:13:125:17 | ... = ... |
+| Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:128:9:128:12 | call to local function M2 |
 | Capture.cs:130:13:130:18 | SSA def(c) | Capture.cs:130:13:130:18 | Int32 c = ... |
 | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:133:13:133:17 | ... = ... |
 | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:136:9:136:12 | call to local function M3 |
 | Capture.cs:139:13:139:18 | SSA def(d) | Capture.cs:139:13:139:18 | Int32 d = ... |
 | Capture.cs:142:13:142:17 | SSA def(d) | Capture.cs:142:13:142:17 | ... = ... |
 | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:144:9:144:12 | call to local function M4 |
+| Capture.cs:147:13:147:18 | SSA def(e) | Capture.cs:147:13:147:18 | Int32 e = ... |
 | Capture.cs:148:9:152:9 | SSA capture def(e) | Capture.cs:148:9:152:9 | M5 |
+| Capture.cs:151:13:151:17 | SSA def(e) | Capture.cs:151:13:151:17 | ... = ... |
 | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:154:13:154:18 | Int32 f = ... |
 | Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:158:13:158:17 | ... = ... |
+| Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:160:9:160:12 | call to local function M6 |
 | Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:163:9:166:9 | M7 |
+| Capture.cs:168:13:168:18 | SSA def(h) | Capture.cs:168:13:168:18 | Int32 h = ... |
 | Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:171:13:171:17 | ... = ... |
 | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:174:17:174:21 | ... = ... |
 | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:176:13:176:16 | call to local function M9 |
@@ -86,6 +94,7 @@
 | Capture.cs:235:21:235:25 | SSA def(i) | Capture.cs:235:21:235:25 | ... = ... |
 | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:236:9:236:12 | call to local function M3 |
 | Capture.cs:242:13:242:17 | SSA def(i) | Capture.cs:242:13:242:17 | Int32 i = ... |
+| Capture.cs:245:13:245:17 | SSA def(i) | Capture.cs:245:13:245:17 | ... = ... |
 | Capture.cs:251:13:251:17 | SSA def(j) | Capture.cs:251:13:251:17 | ... = ... |
 | Capture.cs:254:27:254:27 | SSA def(i) | Capture.cs:254:9:254:28 | call to local function CaptureAndRef |
 | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:7:25:7:25 | b |
@@ -94,6 +103,7 @@
 | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:25:9:25:30 | call to method Out |
 | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:25:9:25:30 | call to method Out |
 | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:32:9:32:29 | ... = ... |
+| Consistency.cs:38:13:38:13 | SSA def(i) | Consistency.cs:38:13:38:13 | Int32 i |
 | Consistency.cs:39:28:39:32 | SSA def(i) | Consistency.cs:39:28:39:32 | ... = ... |
 | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:44:11:44:11 | S s |
 | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:30:49:30 | a |
@@ -117,6 +127,7 @@
 | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:53:9:53:17 | ... = ... |
 | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:56:9:56:16 | ... = ... |
 | DefUse.cs:59:13:59:17 | SSA def(i) | DefUse.cs:59:13:59:17 | Int32 i = ... |
+| DefUse.cs:60:37:60:41 | SSA def(i) | DefUse.cs:60:37:60:41 | ... = ... |
 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:63:9:63:18 | ... = ... |
 | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:66:9:66:18 | ... = ... |
 | DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:67:19:67:27 | TestClass tc = ... |
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected
@@ -43,8 +43,11 @@
 | Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:133:13:133:17 | ... = ... |
 | Capture.cs:139:13:139:13 | d | Capture.cs:139:13:139:18 | SSA def(d) | Capture.cs:139:13:139:18 | Int32 d = ... |
 | Capture.cs:139:13:139:13 | d | Capture.cs:142:13:142:17 | SSA def(d) | Capture.cs:142:13:142:17 | ... = ... |
+| Capture.cs:147:13:147:13 | e | Capture.cs:147:13:147:18 | SSA def(e) | Capture.cs:147:13:147:18 | Int32 e = ... |
+| Capture.cs:147:13:147:13 | e | Capture.cs:151:13:151:17 | SSA def(e) | Capture.cs:151:13:151:17 | ... = ... |
 | Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:154:13:154:18 | Int32 f = ... |
 | Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:158:13:158:17 | ... = ... |
+| Capture.cs:168:13:168:13 | h | Capture.cs:168:13:168:18 | SSA def(h) | Capture.cs:168:13:168:18 | Int32 h = ... |
 | Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:171:13:171:17 | ... = ... |
 | Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:174:17:174:21 | ... = ... |
 | Capture.cs:182:17:182:17 | i | Capture.cs:182:17:182:21 | SSA def(i) | Capture.cs:182:17:182:21 | Int32 i = ... |
@@ -58,6 +61,7 @@
 | Capture.cs:229:13:229:13 | i | Capture.cs:232:9:232:13 | SSA def(i) | Capture.cs:232:9:232:13 | ... = ... |
 | Capture.cs:229:13:229:13 | i | Capture.cs:235:21:235:25 | SSA def(i) | Capture.cs:235:21:235:25 | ... = ... |
 | Capture.cs:242:13:242:13 | i | Capture.cs:242:13:242:17 | SSA def(i) | Capture.cs:242:13:242:17 | Int32 i = ... |
+| Capture.cs:242:13:242:13 | i | Capture.cs:245:13:245:17 | SSA def(i) | Capture.cs:245:13:245:17 | ... = ... |
 | Capture.cs:242:13:242:13 | i | Capture.cs:254:27:254:27 | SSA def(i) | Capture.cs:254:27:254:27 | access to local variable i |
 | Capture.cs:248:36:248:36 | j | Capture.cs:251:13:251:17 | SSA def(j) | Capture.cs:251:13:251:17 | ... = ... |
 | Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:7:25:7:25 | b |
@@ -65,6 +69,7 @@
 | Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | [finally: exception(Exception)] SSA def(i) | Consistency.cs:15:17:15:21 | Int32 i = ... |
 | Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:25:29:25:29 | Consistency c |
 | Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:32:9:32:29 | ... = ... |
+| Consistency.cs:38:13:38:13 | i | Consistency.cs:38:13:38:13 | SSA def(i) | Consistency.cs:38:13:38:13 | Int32 i |
 | Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | SSA def(i) | Consistency.cs:39:28:39:32 | ... = ... |
 | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:44:11:44:11 | S s |
 | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:30:49:30 | a |
@@ -88,6 +93,7 @@
 | DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:53:9:53:17 | ... = ... |
 | DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:56:9:56:16 | ... = ... |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | SSA def(i) | DefUse.cs:59:13:59:17 | Int32 i = ... |
+| DefUse.cs:59:13:59:13 | i | DefUse.cs:60:37:60:41 | SSA def(i) | DefUse.cs:60:37:60:41 | ... = ... |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | SSA def(i) | DefUse.cs:71:9:71:13 | ... = ... |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | SSA def(i) | DefUse.cs:72:9:72:11 | ...++ |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | SSA def(i) | DefUse.cs:75:9:75:13 | ... = ... |
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitCall.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitCall.expected
@@ -1,12 +1,17 @@
 | Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:13:13:13:17 | ... = ... |
+| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:13:13:13:17 | ... = ... |
 | Capture.cs:8:13:8:13 | x | Capture.cs:38:9:38:11 | SSA call def(x) | Capture.cs:15:13:15:17 | ... = ... |
 | Capture.cs:8:13:8:13 | x | Capture.cs:44:9:44:12 | SSA call def(x) | Capture.cs:15:13:15:17 | ... = ... |
 | Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:30:28:30:32 | ... = ... |
+| Capture.cs:29:13:29:13 | z | Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:30:28:30:32 | ... = ... |
 | Capture.cs:50:20:50:20 | a | Capture.cs:53:9:53:11 | SSA call def(a) | Capture.cs:52:28:52:40 | ... = ... |
 | Capture.cs:59:13:59:13 | i | Capture.cs:61:9:61:25 | SSA call def(i) | Capture.cs:60:36:60:38 | ...++ |
 | Capture.cs:75:13:75:13 | i | Capture.cs:77:9:77:25 | SSA call def(i) | Capture.cs:76:80:76:80 | access to local variable i |
+| Capture.cs:102:13:102:13 | z | Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:105:13:105:17 | ... = ... |
+| Capture.cs:122:13:122:13 | b | Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:125:13:125:17 | ... = ... |
 | Capture.cs:130:13:130:13 | c | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:133:13:133:17 | ... = ... |
 | Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:142:13:142:17 | ... = ... |
+| Capture.cs:154:13:154:13 | f | Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:158:13:158:17 | ... = ... |
 | Capture.cs:168:13:168:13 | h | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:174:17:174:21 | ... = ... |
 | Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:235:21:235:25 | ... = ... |
 | DefUse.cs:167:23:167:23 | i | DefUse.cs:181:9:181:11 | SSA call def(i) | DefUse.cs:173:13:173:17 | ... = ... |
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
@@ -3,6 +3,9 @@
 | Capture.cs:6:16:6:16 | i | Capture.cs:13:13:13:17 | SSA def(i) | Capture.cs:13:13:13:17 | SSA def(i) |
 | Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:6:16:6:16 | SSA param(i) |
 | Capture.cs:6:16:6:16 | i | Capture.cs:38:9:38:11 | SSA call def(i) | Capture.cs:38:9:38:11 | SSA call def(i) |
+| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:6:16:6:16 | SSA param(i) |
+| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:38:9:38:11 | SSA call def(i) |
+| Capture.cs:6:16:6:16 | i | Capture.cs:44:9:44:12 | SSA call def(i) | Capture.cs:44:9:44:12 | SSA call def(i) |
 | Capture.cs:8:13:8:13 | x | Capture.cs:8:13:8:17 | SSA def(x) | Capture.cs:8:13:8:17 | SSA def(x) |
 | Capture.cs:8:13:8:13 | x | Capture.cs:15:13:15:17 | SSA def(x) | Capture.cs:15:13:15:17 | SSA def(x) |
 | Capture.cs:8:13:8:13 | x | Capture.cs:19:24:23:13 | SSA capture def(x) | Capture.cs:19:24:23:13 | SSA capture def(x) |
@@ -20,6 +23,8 @@
 | Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:29:13:29:17 | SSA def(z) |
 | Capture.cs:29:13:29:13 | z | Capture.cs:32:9:32:11 | SSA call def(z) | Capture.cs:32:9:32:11 | SSA call def(z) |
 | Capture.cs:29:13:29:13 | z | Capture.cs:37:9:37:13 | SSA def(z) | Capture.cs:37:9:37:13 | SSA def(z) |
+| Capture.cs:29:13:29:13 | z | Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:37:9:37:13 | SSA def(z) |
+| Capture.cs:29:13:29:13 | z | Capture.cs:44:9:44:12 | SSA call def(z) | Capture.cs:44:9:44:12 | SSA call def(z) |
 | Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | SSA def(c) | Capture.cs:30:16:30:35 | SSA def(c) |
 | Capture.cs:50:20:50:20 | a | Capture.cs:50:20:50:20 | SSA param(a) | Capture.cs:50:20:50:20 | SSA param(a) |
 | Capture.cs:50:20:50:20 | a | Capture.cs:52:28:52:40 | SSA def(a) | Capture.cs:52:28:52:40 | SSA def(a) |
@@ -57,12 +62,16 @@
 | Capture.cs:94:13:94:13 | y | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:96:12:100:9 | SSA capture def(y) |
 | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:98:17:98:21 | SSA def(x) |
 | Capture.cs:102:13:102:13 | z | Capture.cs:102:13:102:18 | SSA def(z) | Capture.cs:102:13:102:18 | SSA def(z) |
+| Capture.cs:102:13:102:13 | z | Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:102:13:102:18 | SSA def(z) |
+| Capture.cs:102:13:102:13 | z | Capture.cs:103:9:107:10 | SSA call def(z) | Capture.cs:103:9:107:10 | SSA call def(z) |
 | Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:105:13:105:17 | SSA def(z) |
 | Capture.cs:114:13:114:13 | a | Capture.cs:114:13:114:18 | SSA def(a) | Capture.cs:114:13:114:18 | SSA def(a) |
 | Capture.cs:114:13:114:13 | a | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:115:9:119:9 | SSA capture def(a) |
 | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:117:17:117:21 | SSA def(x) |
 | Capture.cs:122:13:122:13 | b | Capture.cs:122:13:122:18 | SSA def(b) | Capture.cs:122:13:122:18 | SSA def(b) |
 | Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:125:13:125:17 | SSA def(b) |
+| Capture.cs:122:13:122:13 | b | Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:122:13:122:18 | SSA def(b) |
+| Capture.cs:122:13:122:13 | b | Capture.cs:128:9:128:12 | SSA call def(b) | Capture.cs:128:9:128:12 | SSA call def(b) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:130:13:130:18 | SSA def(c) | Capture.cs:130:13:130:18 | SSA def(c) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:133:13:133:17 | SSA def(c) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:136:9:136:12 | SSA call def(c) | Capture.cs:130:13:130:18 | SSA def(c) |
@@ -71,10 +80,15 @@
 | Capture.cs:139:13:139:13 | d | Capture.cs:142:13:142:17 | SSA def(d) | Capture.cs:142:13:142:17 | SSA def(d) |
 | Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:139:13:139:18 | SSA def(d) |
 | Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:144:9:144:12 | SSA call def(d) |
+| Capture.cs:147:13:147:13 | e | Capture.cs:147:13:147:18 | SSA def(e) | Capture.cs:147:13:147:18 | SSA def(e) |
 | Capture.cs:147:13:147:13 | e | Capture.cs:148:9:152:9 | SSA capture def(e) | Capture.cs:148:9:152:9 | SSA capture def(e) |
+| Capture.cs:147:13:147:13 | e | Capture.cs:151:13:151:17 | SSA def(e) | Capture.cs:151:13:151:17 | SSA def(e) |
 | Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:154:13:154:18 | SSA def(f) |
 | Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:158:13:158:17 | SSA def(f) |
+| Capture.cs:154:13:154:13 | f | Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:154:13:154:18 | SSA def(f) |
+| Capture.cs:154:13:154:13 | f | Capture.cs:160:9:160:12 | SSA call def(f) | Capture.cs:160:9:160:12 | SSA call def(f) |
 | Capture.cs:162:13:162:13 | g | Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:163:9:166:9 | SSA capture def(g) |
+| Capture.cs:168:13:168:13 | h | Capture.cs:168:13:168:18 | SSA def(h) | Capture.cs:168:13:168:18 | SSA def(h) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:171:13:171:17 | SSA def(h) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:174:17:174:21 | SSA def(h) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:176:13:176:16 | SSA call def(h) | Capture.cs:171:13:171:17 | SSA def(h) |
@@ -97,6 +111,7 @@
 | Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:232:9:232:13 | SSA def(i) |
 | Capture.cs:229:13:229:13 | i | Capture.cs:236:9:236:12 | SSA call def(i) | Capture.cs:236:9:236:12 | SSA call def(i) |
 | Capture.cs:242:13:242:13 | i | Capture.cs:242:13:242:17 | SSA def(i) | Capture.cs:242:13:242:17 | SSA def(i) |
+| Capture.cs:242:13:242:13 | i | Capture.cs:245:13:245:17 | SSA def(i) | Capture.cs:245:13:245:17 | SSA def(i) |
 | Capture.cs:242:13:242:13 | i | Capture.cs:254:27:254:27 | SSA def(i) | Capture.cs:254:27:254:27 | SSA def(i) |
 | Capture.cs:248:36:248:36 | j | Capture.cs:251:13:251:17 | SSA def(j) | Capture.cs:251:13:251:17 | SSA def(j) |
 | Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:7:25:7:25 | SSA param(b) |
@@ -105,6 +120,7 @@
 | Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:25:29:25:29 | SSA def(c) |
 | Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) |
 | Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:32:9:32:29 | SSA def(c) |
+| Consistency.cs:38:13:38:13 | i | Consistency.cs:38:13:38:13 | SSA def(i) | Consistency.cs:38:13:38:13 | SSA def(i) |
 | Consistency.cs:38:13:38:13 | i | Consistency.cs:39:28:39:32 | SSA def(i) | Consistency.cs:39:28:39:32 | SSA def(i) |
 | Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:44:11:44:11 | SSA def(s) |
 | Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:30:49:30 | SSA param(a) |
@@ -133,7 +149,9 @@
 | DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:50:23:50:23 | SSA def(z) |
 | DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:53:9:53:17 | SSA def(this.Field) |
 | DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:56:9:56:16 | SSA def(this.Prop) |
+| DefUse.cs:59:13:59:13 | i | DefUse.cs:3:17:3:19 | SSA phi(i) | DefUse.cs:76:9:76:11 | SSA def(i) |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:59:13:59:17 | SSA def(i) | DefUse.cs:59:13:59:17 | SSA def(i) |
+| DefUse.cs:59:13:59:13 | i | DefUse.cs:60:37:60:41 | SSA def(i) | DefUse.cs:60:37:60:41 | SSA def(i) |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:71:9:71:13 | SSA def(i) | DefUse.cs:71:9:71:13 | SSA def(i) |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:72:9:72:11 | SSA def(i) | DefUse.cs:72:9:72:11 | SSA def(i) |
 | DefUse.cs:59:13:59:13 | i | DefUse.cs:75:9:75:13 | SSA def(i) | DefUse.cs:75:9:75:13 | SSA def(i) |
--- a/csharp/ql/test/library-tests/dataflow/tuples/PrintAst.expected
+++ b/csharp/ql/test/library-tests/dataflow/tuples/PrintAst.expected
@@ -363,7 +363,7 @@ Tuples.cs:
 #   95|         1: [Parameter] right
 #   95|     14: [Property] EqualityContract
 #   95|       3: [Getter] get_EqualityContract
-#   95|     15: [InstanceConstructor] R1
+#   95|     15: [InstanceConstructor,PrimaryConstructor] R1
 #-----|       2: (Parameters)
 #   95|         0: [Parameter] i
 #   95|           -1: [TypeMention] string