Merge branch 'main' into deduplicate-dataflow-results-take-3

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj

@@ -11,12 +11,12 @@
   <ItemGroup>
     <PackageReference Include="System.IO.FileSystem" Version="4.3.0" />
     <PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
-    <PackageReference Include="xunit" Version="2.5.0" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.0">
+    <PackageReference Include="xunit" Version="2.4.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.7.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
   </ItemGroup>
 
   <ItemGroup>

cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj

@@ -17,7 +17,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Build" Version="17.7.2" />
+    <PackageReference Include="Microsoft.Build" Version="17.3.2" />
   </ItemGroup>
 
   <ItemGroup>

cpp/ql/lib/change-notes/2023-09-06-as-defining-argument-off-by-one-fix.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `DataFlow::asDefiningArgument` predicate now takes its argument from the range starting at `1` instead of `2`. Queries that depend on the single-parameter version of `DataFlow::asDefiningArgument` should have their arguments updated accordingly.

cpp/ql/lib/change-notes/2023-09-07-return-from-end.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Treat functions that reach the end of the function as returning in the IR.
+  They used to be treated as unreachable but it is allowed in C. 

cpp/ql/lib/change-notes/2023-09-08-more-unreachble.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Functions that do not return due to calling functions that don't return (e.g. `exit`) are now detected as
+ non-returning in the IR and dataflow.

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -275,9 +275,7 @@ class Node extends TIRDataFlowNode {
    * after the `f` has returned.
    */
   Expr asDefiningArgument(int index) {
-    // Subtract one because `DefinitionByReferenceNode` is defined to be in
-    // the range `[0 ... n - 1]` for some `n` instead of `[1 ... n]`.
-    this.(DefinitionByReferenceNode).getIndirectionIndex() = index - 1 and
+    this.(DefinitionByReferenceNode).getIndirectionIndex() = index and
     result = this.(DefinitionByReferenceNode).getArgument()
   }
 

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll

@@ -405,9 +405,6 @@ predicate hasUnreachedInstruction(IRFunction func) {
   exists(Call c |
     c.getEnclosingFunction() = func.getFunction() and
     any(Options opt).exits(c.getTarget())
-  ) and
-  not exists(TranslatedUnreachableReturnStmt return |
-    return.getEnclosingFunction().getFunction() = func.getFunction()
   )
 }
 

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll

@@ -442,29 +442,26 @@ class TranslatedReturnVoidStmt extends TranslatedReturnStmt {
 
 /**
  * The IR translation of an implicit `return` statement generated by the extractor to handle control
- * flow that reaches the end of a non-`void`-returning function body. Since such control flow
- * produces undefined behavior, we simply generate an `Unreached` instruction to prevent that flow
- * from continuing on to pollute other analysis. The assumption is that the developer is certain
- * that the implicit `return` is unreachable, even if the compiler cannot prove it.
+ * flow that reaches the end of a non-`void`-returning function body. Such control flow
+ * produces undefined behavior in C++ but not in C. However even in C using the return value is
+ * undefined behaviour. We make it return uninitialized memory to get as much flow as possible.
  */
-class TranslatedUnreachableReturnStmt extends TranslatedReturnStmt {
-  TranslatedUnreachableReturnStmt() {
+class TranslatedNoValueReturnStmt extends TranslatedReturnStmt, TranslatedVariableInitialization {
+  TranslatedNoValueReturnStmt() {
     not stmt.hasExpr() and hasReturnValue(stmt.getEnclosingFunction())
   }
 
-  override TranslatedElement getChild(int id) { none() }
-
-  override Instruction getFirstInstruction() { result = this.getInstruction(OnlyInstructionTag()) }
-
-  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
-    tag = OnlyInstructionTag() and
-    opcode instanceof Opcode::Unreached and
-    resultType = getVoidType()
+  final override Instruction getInitializationSuccessor() {
+    result = this.getEnclosingFunction().getReturnSuccessorInstruction()
   }
 
-  override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) { none() }
+  final override Type getTargetType() { result = this.getEnclosingFunction().getReturnType() }
 
-  override Instruction getChildSuccessor(TranslatedElement child) { none() }
+  final override TranslatedInitialization getInitialization() { none() }
+
+  final override IRVariable getIRVariable() {
+    result = this.getEnclosingFunction().getReturnVariable()
+  }
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll

@@ -10,6 +10,65 @@ predicate isInfeasibleInstructionSuccessor(Instruction instr, EdgeKind kind) {
   or
   instr.getSuccessor(kind) instanceof UnreachedInstruction and
   kind instanceof GotoEdge
+  or
+  isCallToNonReturningFunction(instr) and exists(instr.getSuccessor(kind))
+}
+
+/**
+ * Holds if all calls to `f` never return (e.g. they call `exit` or loop forever)
+ */
+private predicate isNonReturningFunction(IRFunction f) {
+  // If the function has an instruction with a missing successor then
+  // the analysis is probably going to be incorrect, so assume they exit.
+  not hasInstructionWithMissingSuccessor(f) and
+  (
+    // If all flows to the exit block are pass through an unreachable then f never returns.
+    any(UnreachedInstruction instr).getBlock().postDominates(f.getEntryBlock())
+    or
+    // If there is no flow to the exit block then f never returns.
+    not exists(IRBlock entry, IRBlock exit |
+      exit = f.getExitFunctionInstruction().getBlock() and
+      entry = f.getEntryBlock() and
+      exit = entry.getASuccessor*()
+    )
+    or
+    // If all flows to the exit block are pass through a call that never returns then f never returns.
+    exists(CallInstruction ci |
+      ci.getBlock().postDominates(f.getEntryBlock()) and
+      isCallToNonReturningFunction(ci)
+    )
+  )
+}
+
+/**
+ * Holds if `f` has an instruction with a missing successor.
+ * This matches `instructionWithoutSuccessor` from `IRConsistency`, but
+ * avoids generating the error strings.
+ */
+predicate hasInstructionWithMissingSuccessor(IRFunction f) {
+  exists(Instruction missingSucc |
+    missingSucc.getEnclosingIRFunction() = f and
+    not exists(missingSucc.getASuccessor()) and
+    not missingSucc instanceof ExitFunctionInstruction and
+    // Phi instructions aren't linked into the instruction-level flow graph.
+    not missingSucc instanceof PhiInstruction and
+    not missingSucc instanceof UnreachedInstruction
+  )
+}
+
+/**
+ * Holds if the call `ci` never returns.
+ */
+private predicate isCallToNonReturningFunction(CallInstruction ci) {
+  exists(IRFunction callee, Language::Function staticTarget |
+    staticTarget = ci.getStaticCallTarget() and
+    staticTarget = callee.getFunction() and
+    // We can't easily tell if the call is virtual or not
+    // if the callee is virtual. So assume that the call is virtual
+    // if the target is.
+    not staticTarget.isVirtual() and
+    isNonReturningFunction(callee)
+  )
 }
 
 pragma[noinline]

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlockInternal.qll

@@ -1,2 +1,3 @@
 import semmle.code.cpp.ir.implementation.raw.IR as IR
 import semmle.code.cpp.ir.implementation.raw.constant.ConstantAnalysis as ConstantAnalysis
+import semmle.code.cpp.ir.internal.IRCppLanguage as Language

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/ReachableBlock.qll

@@ -10,6 +10,65 @@ predicate isInfeasibleInstructionSuccessor(Instruction instr, EdgeKind kind) {
   or
   instr.getSuccessor(kind) instanceof UnreachedInstruction and
   kind instanceof GotoEdge
+  or
+  isCallToNonReturningFunction(instr) and exists(instr.getSuccessor(kind))
+}
+
+/**
+ * Holds if all calls to `f` never return (e.g. they call `exit` or loop forever)
+ */
+private predicate isNonReturningFunction(IRFunction f) {
+  // If the function has an instruction with a missing successor then
+  // the analysis is probably going to be incorrect, so assume they exit.
+  not hasInstructionWithMissingSuccessor(f) and
+  (
+    // If all flows to the exit block are pass through an unreachable then f never returns.
+    any(UnreachedInstruction instr).getBlock().postDominates(f.getEntryBlock())
+    or
+    // If there is no flow to the exit block then f never returns.
+    not exists(IRBlock entry, IRBlock exit |
+      exit = f.getExitFunctionInstruction().getBlock() and
+      entry = f.getEntryBlock() and
+      exit = entry.getASuccessor*()
+    )
+    or
+    // If all flows to the exit block are pass through a call that never returns then f never returns.
+    exists(CallInstruction ci |
+      ci.getBlock().postDominates(f.getEntryBlock()) and
+      isCallToNonReturningFunction(ci)
+    )
+  )
+}
+
+/**
+ * Holds if `f` has an instruction with a missing successor.
+ * This matches `instructionWithoutSuccessor` from `IRConsistency`, but
+ * avoids generating the error strings.
+ */
+predicate hasInstructionWithMissingSuccessor(IRFunction f) {
+  exists(Instruction missingSucc |
+    missingSucc.getEnclosingIRFunction() = f and
+    not exists(missingSucc.getASuccessor()) and
+    not missingSucc instanceof ExitFunctionInstruction and
+    // Phi instructions aren't linked into the instruction-level flow graph.
+    not missingSucc instanceof PhiInstruction and
+    not missingSucc instanceof UnreachedInstruction
+  )
+}
+
+/**
+ * Holds if the call `ci` never returns.
+ */
+private predicate isCallToNonReturningFunction(CallInstruction ci) {
+  exists(IRFunction callee, Language::Function staticTarget |
+    staticTarget = ci.getStaticCallTarget() and
+    staticTarget = callee.getFunction() and
+    // We can't easily tell if the call is virtual or not
+    // if the callee is virtual. So assume that the call is virtual
+    // if the target is.
+    not staticTarget.isVirtual() and
+    isNonReturningFunction(callee)
+  )
 }
 
 pragma[noinline]

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/ReachableBlockInternal.qll

@@ -1,2 +1,3 @@
 import semmle.code.cpp.ir.implementation.unaliased_ssa.IR as IR
 import semmle.code.cpp.ir.implementation.unaliased_ssa.constant.ConstantAnalysis as ConstantAnalysis
+import semmle.code.cpp.ir.internal.IRCppLanguage as Language

cpp/ql/src/change-notes/2023-09-08-unreachble-edges.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* The queries `cpp/double-free` and `cpp/use-after-free` find fewer false positives
+  in cases where a non-returning function is called.

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -15740,6 +15740,112 @@ ir.cpp:
 # 2072|             Value = [VariableAccess] 116
 # 2072|             ValueCategory = prvalue(load)
 # 2073|     getStmt(2): [ReturnStmt] return ...
+# 2075| [TopLevelFunction] void exit(int)
+# 2075|   <params>: 
+# 2075|     getParameter(0): [Parameter] code
+# 2075|         Type = [IntType] int
+# 2077| [TopLevelFunction] int NonExit()
+# 2077|   <params>: 
+# 2077|   getEntryPoint(): [BlockStmt] { ... }
+# 2078|     getStmt(0): [DeclStmt] declaration
+# 2078|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of x
+# 2078|           Type = [IntType] int
+# 2078|         getVariable().getInitializer(): [Initializer] initializer for x
+# 2078|           getExpr(): [FunctionCall] call to Add
+# 2078|               Type = [IntType] int
+# 2078|               ValueCategory = prvalue
+# 2078|             getArgument(0): [Literal] 3
+# 2078|                 Type = [IntType] int
+# 2078|                 Value = [Literal] 3
+# 2078|                 ValueCategory = prvalue
+# 2078|             getArgument(1): [Literal] 4
+# 2078|                 Type = [IntType] int
+# 2078|                 Value = [Literal] 4
+# 2078|                 ValueCategory = prvalue
+# 2079|     getStmt(1): [IfStmt] if (...) ... 
+# 2079|       getCondition(): [EQExpr] ... == ...
+# 2079|           Type = [BoolType] bool
+# 2079|           ValueCategory = prvalue
+# 2079|         getLeftOperand(): [VariableAccess] x
+# 2079|             Type = [IntType] int
+# 2079|             ValueCategory = prvalue(load)
+# 2079|         getRightOperand(): [Literal] 7
+# 2079|             Type = [IntType] int
+# 2079|             Value = [Literal] 7
+# 2079|             ValueCategory = prvalue
+# 2080|       getThen(): [ExprStmt] ExprStmt
+# 2080|         getExpr(): [FunctionCall] call to exit
+# 2080|             Type = [VoidType] void
+# 2080|             ValueCategory = prvalue
+# 2080|           getArgument(0): [Literal] 3
+# 2080|               Type = [IntType] int
+# 2080|               Value = [Literal] 3
+# 2080|               ValueCategory = prvalue
+# 2081|     getStmt(2): [ExprStmt] ExprStmt
+# 2081|       getExpr(): [FunctionCall] call to VoidFunc
+# 2081|           Type = [VoidType] void
+# 2081|           ValueCategory = prvalue
+# 2082|     getStmt(3): [ReturnStmt] return ...
+# 2082|       getExpr(): [VariableAccess] x
+# 2082|           Type = [IntType] int
+# 2082|           ValueCategory = prvalue(load)
+# 2085| [TopLevelFunction] void CallsNonExit()
+# 2085|   <params>: 
+# 2085|   getEntryPoint(): [BlockStmt] { ... }
+# 2086|     getStmt(0): [ExprStmt] ExprStmt
+# 2086|       getExpr(): [FunctionCall] call to VoidFunc
+# 2086|           Type = [VoidType] void
+# 2086|           ValueCategory = prvalue
+# 2087|     getStmt(1): [ExprStmt] ExprStmt
+# 2087|       getExpr(): [FunctionCall] call to exit
+# 2087|           Type = [VoidType] void
+# 2087|           ValueCategory = prvalue
+# 2087|         getArgument(0): [Literal] 3
+# 2087|             Type = [IntType] int
+# 2087|             Value = [Literal] 3
+# 2087|             ValueCategory = prvalue
+# 2088|     getStmt(2): [ReturnStmt] return ...
+# 2090| [TopLevelFunction] int TransNonExit()
+# 2090|   <params>: 
+# 2090|   getEntryPoint(): [BlockStmt] { ... }
+# 2091|     getStmt(0): [DeclStmt] declaration
+# 2091|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of x
+# 2091|           Type = [IntType] int
+# 2091|         getVariable().getInitializer(): [Initializer] initializer for x
+# 2091|           getExpr(): [FunctionCall] call to Add
+# 2091|               Type = [IntType] int
+# 2091|               ValueCategory = prvalue
+# 2091|             getArgument(0): [Literal] 3
+# 2091|                 Type = [IntType] int
+# 2091|                 Value = [Literal] 3
+# 2091|                 ValueCategory = prvalue
+# 2091|             getArgument(1): [Literal] 4
+# 2091|                 Type = [IntType] int
+# 2091|                 Value = [Literal] 4
+# 2091|                 ValueCategory = prvalue
+# 2092|     getStmt(1): [IfStmt] if (...) ... 
+# 2092|       getCondition(): [EQExpr] ... == ...
+# 2092|           Type = [BoolType] bool
+# 2092|           ValueCategory = prvalue
+# 2092|         getLeftOperand(): [VariableAccess] x
+# 2092|             Type = [IntType] int
+# 2092|             ValueCategory = prvalue(load)
+# 2092|         getRightOperand(): [Literal] 7
+# 2092|             Type = [IntType] int
+# 2092|             Value = [Literal] 7
+# 2092|             ValueCategory = prvalue
+# 2093|       getThen(): [ExprStmt] ExprStmt
+# 2093|         getExpr(): [FunctionCall] call to CallsNonExit
+# 2093|             Type = [VoidType] void
+# 2093|             ValueCategory = prvalue
+# 2094|     getStmt(2): [ExprStmt] ExprStmt
+# 2094|       getExpr(): [FunctionCall] call to VoidFunc
+# 2094|           Type = [VoidType] void
+# 2094|           ValueCategory = prvalue
+# 2095|     getStmt(3): [ReturnStmt] return ...
+# 2095|       getExpr(): [VariableAccess] x
+# 2095|           Type = [IntType] int
+# 2095|           ValueCategory = prvalue(load)
 perf-regression.cpp:
 #    4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
 #    4|   <params>: 

cpp/ql/test/library-tests/ir/ir/aliased_ir.ql

@@ -0,0 +1,11 @@
+/**
+ * @kind graph
+ */
+
+private import cpp
+private import semmle.code.cpp.ir.implementation.aliased_ssa.PrintIR
+private import PrintConfig
+
+private class PrintConfig extends PrintIRConfiguration {
+  override predicate shouldPrintDeclaration(Declaration decl) { shouldDumpDeclaration(decl) }
+}

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -2072,4 +2072,27 @@ void test_constant_folding() {
   test_constant_folding_use(x);
 }
 
+void exit(int code);
+
+int NonExit() {
+    int x = Add(3,4);
+    if (x == 7)
+        exit(3);
+    VoidFunc();
+    return x;
+}
+
+void CallsNonExit() {
+    VoidFunc();
+    exit(3);
+}
+
+int TransNonExit() {
+    int x = Add(3,4);
+    if (x == 7)
+        CallsNonExit();
+    VoidFunc();
+    return x;
+}
+
 // semmle-extractor-options: -std=c++17 --clang

cpp/ql/test/library-tests/ir/ir/operand_locations.expected

@@ -6207,10 +6207,12 @@
 | ir.cpp:1286:25:1286:49 | ChiPartial | partial:m1286_7 |
 | ir.cpp:1286:25:1286:49 | ChiTotal | total:m1286_4 |
 | ir.cpp:1286:25:1286:49 | SideEffect | ~m1286_4 |
-| ir.cpp:1289:5:1289:22 | Address | &:r1289_9 |
+| ir.cpp:1289:5:1289:22 | Address | &:r1289_10 |
 | ir.cpp:1289:5:1289:22 | ChiPartial | partial:m1289_3 |
 | ir.cpp:1289:5:1289:22 | ChiTotal | total:m1289_2 |
-| ir.cpp:1289:5:1289:22 | Load | m1291_4 |
+| ir.cpp:1289:5:1289:22 | Load | m1289_9 |
+| ir.cpp:1289:5:1289:22 | Phi | from 2:m1291_4 |
+| ir.cpp:1289:5:1289:22 | Phi | from 3:m1293_2 |
 | ir.cpp:1289:5:1289:22 | SideEffect | m1289_3 |
 | ir.cpp:1289:29:1289:29 | Address | &:r1289_5 |
 | ir.cpp:1289:36:1289:36 | Address | &:r1289_7 |
@@ -6221,6 +6223,7 @@
 | ir.cpp:1291:16:1291:16 | Address | &:r1291_2 |
 | ir.cpp:1291:16:1291:16 | Load | m1289_8 |
 | ir.cpp:1291:16:1291:16 | StoreValue | r1291_3 |
+| ir.cpp:1293:1:1293:1 | Address | &:r1293_1 |
 | ir.cpp:1295:6:1295:15 | ChiPartial | partial:m1295_3 |
 | ir.cpp:1295:6:1295:15 | ChiTotal | total:m1295_2 |
 | ir.cpp:1295:6:1295:15 | SideEffect | ~m1296_8 |
@@ -8393,16 +8396,23 @@
 | ir.cpp:1747:39:1747:39 | ChiTotal | total:m1747_20 |
 | ir.cpp:1747:39:1747:39 | SideEffect | ~m1747_4 |
 | ir.cpp:1747:39:1747:39 | SideEffect | ~m1747_15 |
+| ir.cpp:1750:5:1750:34 | Address | &:r1750_5 |
 | ir.cpp:1750:5:1750:34 | ChiPartial | partial:m1750_3 |
 | ir.cpp:1750:5:1750:34 | ChiTotal | total:m1750_2 |
+| ir.cpp:1750:5:1750:34 | Load | m1755_2 |
+| ir.cpp:1750:5:1750:34 | SideEffect | ~m1754_10 |
 | ir.cpp:1751:51:1751:51 | Address | &:r1751_1 |
 | ir.cpp:1751:51:1751:51 | Address | &:r1751_1 |
 | ir.cpp:1751:51:1751:51 | Address | &:r1751_3 |
+| ir.cpp:1751:51:1751:51 | Address | &:r1751_3 |
 | ir.cpp:1751:51:1751:51 | Load | m1751_2 |
+| ir.cpp:1751:51:1751:51 | SideEffect | m1751_4 |
 | ir.cpp:1752:48:1752:48 | Address | &:r1752_1 |
 | ir.cpp:1752:48:1752:48 | Address | &:r1752_1 |
 | ir.cpp:1752:48:1752:48 | Address | &:r1752_3 |
+| ir.cpp:1752:48:1752:48 | Address | &:r1752_3 |
 | ir.cpp:1752:48:1752:48 | Load | m1752_2 |
+| ir.cpp:1752:48:1752:48 | SideEffect | m1752_4 |
 | ir.cpp:1753:40:1753:41 | Address | &:r1753_1 |
 | ir.cpp:1753:40:1753:41 | Address | &:r1753_1 |
 | ir.cpp:1753:40:1753:41 | Arg(this) | this:r1753_1 |
@@ -8435,6 +8445,7 @@
 | ir.cpp:1754:42:1754:42 | SideEffect | ~m1752_4 |
 | ir.cpp:1754:42:1754:42 | Unary | r1754_5 |
 | ir.cpp:1754:42:1754:42 | Unary | r1754_6 |
+| ir.cpp:1755:1:1755:1 | Address | &:r1755_1 |
 | ir.cpp:1757:6:1757:22 | ChiPartial | partial:m1757_3 |
 | ir.cpp:1757:6:1757:22 | ChiTotal | total:m1757_2 |
 | ir.cpp:1757:6:1757:22 | SideEffect | m1757_3 |
@@ -9588,22 +9599,27 @@
 | ir.cpp:2021:23:2021:40 | SideEffect | ~m2021_27 |
 | ir.cpp:2021:23:2021:40 | Unary | r2021_20 |
 | ir.cpp:2021:23:2021:40 | Unary | r2021_28 |
+| ir.cpp:2026:14:2026:22 | Address | &:r2026_7 |
 | ir.cpp:2026:14:2026:22 | ChiPartial | partial:m2026_3 |
 | ir.cpp:2026:14:2026:22 | ChiTotal | total:m2026_2 |
+| ir.cpp:2026:14:2026:22 | Load | m2031_2 |
+| ir.cpp:2026:14:2026:22 | SideEffect | ~m2028_6 |
 | ir.cpp:2026:37:2026:37 | Address | &:r2026_5 |
 | ir.cpp:2027:16:2027:16 | Address | &:r2027_1 |
-| ir.cpp:2028:3:2028:3 | Address | &:r2028_9 |
+| ir.cpp:2028:3:2028:3 | Address | &:r2028_10 |
 | ir.cpp:2028:7:2028:7 | Address | &:r2028_1 |
 | ir.cpp:2028:7:2028:7 | Left | r2028_2 |
 | ir.cpp:2028:7:2028:7 | Load | m2026_6 |
 | ir.cpp:2028:7:2028:13 | Condition | r2028_4 |
-| ir.cpp:2028:7:2030:28 | Address | &:r2028_7 |
-| ir.cpp:2028:7:2030:28 | Address | &:r2028_11 |
-| ir.cpp:2028:7:2030:28 | Address | &:r2028_13 |
-| ir.cpp:2028:7:2030:28 | Load | m2028_6 |
-| ir.cpp:2028:7:2030:28 | Phi | from 2:m2028_12 |
-| ir.cpp:2028:7:2030:28 | Phi | from 3:m2028_14 |
-| ir.cpp:2028:7:2030:28 | StoreValue | r2028_8 |
+| ir.cpp:2028:7:2030:28 | Address | &:r2028_8 |
+| ir.cpp:2028:7:2030:28 | Address | &:r2028_12 |
+| ir.cpp:2028:7:2030:28 | Address | &:r2028_14 |
+| ir.cpp:2028:7:2030:28 | Load | m2028_7 |
+| ir.cpp:2028:7:2030:28 | Phi | from 2:m2028_13 |
+| ir.cpp:2028:7:2030:28 | Phi | from 2:~m2029_6 |
+| ir.cpp:2028:7:2030:28 | Phi | from 3:m2028_15 |
+| ir.cpp:2028:7:2030:28 | Phi | from 3:~m2030_6 |
+| ir.cpp:2028:7:2030:28 | StoreValue | r2028_9 |
 | ir.cpp:2028:11:2028:13 | Right | r2028_3 |
 | ir.cpp:2029:6:2029:20 | CallTarget | func:r2029_1 |
 | ir.cpp:2029:6:2029:20 | ChiPartial | partial:m2029_5 |
@@ -9626,6 +9642,7 @@
 | ir.cpp:2030:22:2030:22 | Arg(0) | 0:r2030_3 |
 | ir.cpp:2030:22:2030:22 | Load | m2026_6 |
 | ir.cpp:2030:26:2030:27 | Unary | r2030_7 |
+| ir.cpp:2031:1:2031:1 | Address | &:r2031_1 |
 | ir.cpp:2033:6:2033:17 | ChiPartial | partial:m2033_3 |
 | ir.cpp:2033:6:2033:17 | ChiTotal | total:m2033_2 |
 | ir.cpp:2033:6:2033:17 | SideEffect | ~m2036_6 |
@@ -9721,8 +9738,11 @@
 | ir.cpp:2051:32:2051:32 | Address | &:r2051_7 |
 | ir.cpp:2051:32:2051:32 | Load | m2051_6 |
 | ir.cpp:2051:32:2051:32 | SideEffect | m2051_8 |
+| ir.cpp:2056:5:2056:18 | Address | &:r2056_5 |
 | ir.cpp:2056:5:2056:18 | ChiPartial | partial:m2056_3 |
 | ir.cpp:2056:5:2056:18 | ChiTotal | total:m2056_2 |
+| ir.cpp:2056:5:2056:18 | Load | m2066_2 |
+| ir.cpp:2056:5:2056:18 | SideEffect | ~m2065_6 |
 | ir.cpp:2058:12:2058:13 | Address | &:r2058_1 |
 | ir.cpp:2058:17:2058:27 | Address | &:r2058_4 |
 | ir.cpp:2058:17:2058:27 | Address | &:r2058_8 |
@@ -9796,6 +9816,7 @@
 | ir.cpp:2065:12:2065:12 | Address | &:r2065_2 |
 | ir.cpp:2065:12:2065:12 | Arg(0) | 0:r2065_3 |
 | ir.cpp:2065:12:2065:12 | Load | m2064_15 |
+| ir.cpp:2066:1:2066:1 | Address | &:r2066_1 |
 | ir.cpp:2070:6:2070:26 | ChiPartial | partial:m2070_3 |
 | ir.cpp:2070:6:2070:26 | ChiTotal | total:m2070_2 |
 | ir.cpp:2070:6:2070:26 | SideEffect | ~m2072_5 |
@@ -9806,6 +9827,75 @@
 | ir.cpp:2072:3:2072:27 | ChiTotal | total:m2070_4 |
 | ir.cpp:2072:3:2072:27 | SideEffect | ~m2070_4 |
 | ir.cpp:2072:29:2072:29 | Arg(0) | 0:r2072_2 |
+| ir.cpp:2077:5:2077:11 | Address | &:r2077_6 |
+| ir.cpp:2077:5:2077:11 | ChiPartial | partial:m2077_3 |
+| ir.cpp:2077:5:2077:11 | ChiTotal | total:m2077_2 |
+| ir.cpp:2077:5:2077:11 | Load | m2082_4 |
+| ir.cpp:2077:5:2077:11 | SideEffect | ~m2081_4 |
+| ir.cpp:2078:9:2078:9 | Address | &:r2078_1 |
+| ir.cpp:2078:13:2078:15 | CallTarget | func:r2078_2 |
+| ir.cpp:2078:13:2078:15 | ChiPartial | partial:m2078_6 |
+| ir.cpp:2078:13:2078:15 | ChiTotal | total:m2077_4 |
+| ir.cpp:2078:13:2078:15 | SideEffect | ~m2077_4 |
+| ir.cpp:2078:13:2078:15 | StoreValue | r2078_5 |
+| ir.cpp:2078:17:2078:17 | Arg(0) | 0:r2078_3 |
+| ir.cpp:2078:19:2078:19 | Arg(1) | 1:r2078_4 |
+| ir.cpp:2079:9:2079:9 | Address | &:r2079_1 |
+| ir.cpp:2079:9:2079:9 | Left | r2079_2 |
+| ir.cpp:2079:9:2079:9 | Load | m2078_8 |
+| ir.cpp:2079:9:2079:14 | Condition | r2079_4 |
+| ir.cpp:2079:14:2079:14 | Right | r2079_3 |
+| ir.cpp:2080:9:2080:12 | CallTarget | func:r2080_1 |
+| ir.cpp:2080:9:2080:12 | ChiPartial | partial:m2080_4 |
+| ir.cpp:2080:9:2080:12 | ChiTotal | total:m2078_7 |
+| ir.cpp:2080:9:2080:12 | SideEffect | ~m2078_7 |
+| ir.cpp:2080:14:2080:14 | Arg(0) | 0:r2080_2 |
+| ir.cpp:2081:5:2081:12 | CallTarget | func:r2081_1 |
+| ir.cpp:2081:5:2081:12 | ChiPartial | partial:m2081_3 |
+| ir.cpp:2081:5:2081:12 | ChiTotal | total:m2078_7 |
+| ir.cpp:2081:5:2081:12 | SideEffect | ~m2078_7 |
+| ir.cpp:2082:5:2082:13 | Address | &:r2082_1 |
+| ir.cpp:2082:12:2082:12 | Address | &:r2082_2 |
+| ir.cpp:2082:12:2082:12 | Load | m2078_8 |
+| ir.cpp:2082:12:2082:12 | StoreValue | r2082_3 |
+| ir.cpp:2085:6:2085:17 | ChiPartial | partial:m2085_3 |
+| ir.cpp:2085:6:2085:17 | ChiTotal | total:m2085_2 |
+| ir.cpp:2086:5:2086:12 | CallTarget | func:r2086_1 |
+| ir.cpp:2086:5:2086:12 | ChiPartial | partial:m2086_3 |
+| ir.cpp:2086:5:2086:12 | ChiTotal | total:m2085_4 |
+| ir.cpp:2086:5:2086:12 | SideEffect | ~m2085_4 |
+| ir.cpp:2087:5:2087:8 | CallTarget | func:r2087_1 |
+| ir.cpp:2087:5:2087:8 | ChiPartial | partial:m2087_4 |
+| ir.cpp:2087:5:2087:8 | ChiTotal | total:m2086_4 |
+| ir.cpp:2087:5:2087:8 | SideEffect | ~m2086_4 |
+| ir.cpp:2087:10:2087:10 | Arg(0) | 0:r2087_2 |
+| ir.cpp:2090:5:2090:16 | Address | &:r2090_6 |
+| ir.cpp:2090:5:2090:16 | ChiPartial | partial:m2090_3 |
+| ir.cpp:2090:5:2090:16 | ChiTotal | total:m2090_2 |
+| ir.cpp:2090:5:2090:16 | Load | m2095_4 |
+| ir.cpp:2090:5:2090:16 | SideEffect | ~m2094_4 |
+| ir.cpp:2091:9:2091:9 | Address | &:r2091_1 |
+| ir.cpp:2091:13:2091:15 | CallTarget | func:r2091_2 |
+| ir.cpp:2091:13:2091:15 | ChiPartial | partial:m2091_6 |
+| ir.cpp:2091:13:2091:15 | ChiTotal | total:m2090_4 |
+| ir.cpp:2091:13:2091:15 | SideEffect | ~m2090_4 |
+| ir.cpp:2091:13:2091:15 | StoreValue | r2091_5 |
+| ir.cpp:2091:17:2091:17 | Arg(0) | 0:r2091_3 |
+| ir.cpp:2091:19:2091:19 | Arg(1) | 1:r2091_4 |
+| ir.cpp:2092:9:2092:9 | Address | &:r2092_1 |
+| ir.cpp:2092:9:2092:9 | Left | r2092_2 |
+| ir.cpp:2092:9:2092:9 | Load | m2091_8 |
+| ir.cpp:2092:9:2092:14 | Condition | r2092_4 |
+| ir.cpp:2092:14:2092:14 | Right | r2092_3 |
+| ir.cpp:2093:9:2093:20 | CallTarget | func:r2093_1 |
+| ir.cpp:2094:5:2094:12 | CallTarget | func:r2094_1 |
+| ir.cpp:2094:5:2094:12 | ChiPartial | partial:m2094_3 |
+| ir.cpp:2094:5:2094:12 | ChiTotal | total:m2091_7 |
+| ir.cpp:2094:5:2094:12 | SideEffect | ~m2091_7 |
+| ir.cpp:2095:5:2095:13 | Address | &:r2095_1 |
+| ir.cpp:2095:12:2095:12 | Address | &:r2095_2 |
+| ir.cpp:2095:12:2095:12 | Load | m2091_8 |
+| ir.cpp:2095:12:2095:12 | StoreValue | r2095_3 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_7 |

cpp/ql/test/library-tests/ir/ir/raw_consistency.expected

@@ -12,13 +12,15 @@ unnecessaryPhiInstruction
 memoryOperandDefinitionIsUnmodeled
 operandAcrossFunctions
 instructionWithoutUniqueBlock
+missingCanonicalLanguageType
+multipleCanonicalLanguageTypes
 containsLoopOfForwardEdges
+missingIRType
+multipleIRTypes
 lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 | ir.cpp:1486:8:1486:8 | Unary | Operand 'Unary' is not dominated by its definition in function '$@'. | ir.cpp:1486:8:1486:8 | void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct() | void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct() |
-| ir.cpp:1751:51:1751:51 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | ir.cpp:1750:5:1750:34 | int implicit_copy_constructor_test(CopyConstructorTestNonVirtualClass const&, CopyConstructorTestVirtualClass const&) | int implicit_copy_constructor_test(CopyConstructorTestNonVirtualClass const&, CopyConstructorTestVirtualClass const&) |
-| ir.cpp:1752:48:1752:48 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | ir.cpp:1750:5:1750:34 | int implicit_copy_constructor_test(CopyConstructorTestNonVirtualClass const&, CopyConstructorTestVirtualClass const&) | int implicit_copy_constructor_test(CopyConstructorTestNonVirtualClass const&, CopyConstructorTestVirtualClass const&) |
 | try_except.c:13:13:13:13 | Left | Operand 'Left' is not dominated by its definition in function '$@'. | try_except.c:6:6:6:6 | void f() | void f() |
 | try_except.c:13:13:13:13 | Left | Operand 'Left' is not dominated by its definition in function '$@'. | try_except.c:6:6:6:6 | void f() | void f() |
 | try_except.c:39:15:39:15 | Left | Operand 'Left' is not dominated by its definition in function '$@'. | try_except.c:32:6:32:6 | void h(int) | void h(int) |
@@ -35,8 +37,4 @@ nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer
 thisArgumentIsNonPointer
 nonUniqueIRVariable
-missingCanonicalLanguageType
-multipleCanonicalLanguageTypes
-missingIRType
-multipleIRTypes
 missingCppType

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -7201,21 +7201,26 @@ ir.cpp:
 # 1290|     r1290_1(glval<bool>) = VariableAddress[b]     : 
 # 1290|     r1290_2(bool)        = Load[b]                : &:r1290_1, ~m?
 # 1290|     v1290_3(void)        = ConditionalBranch      : r1290_2
-#-----|   False -> Block 2
-#-----|   True -> Block 1
+#-----|   False -> Block 3
+#-----|   True -> Block 2
 
-# 1291|   Block 1
-# 1291|     r1291_1(glval<int>) = VariableAddress[#return] : 
-# 1291|     r1291_2(glval<int>) = VariableAddress[x]       : 
-# 1291|     r1291_3(int)        = Load[x]                  : &:r1291_2, ~m?
-# 1291|     mu1291_4(int)       = Store[#return]           : &:r1291_1, r1291_3
+# 1289|   Block 1
 # 1289|     r1289_8(glval<int>) = VariableAddress[#return] : 
 # 1289|     v1289_9(void)       = ReturnValue              : &:r1289_8, ~m?
 # 1289|     v1289_10(void)      = AliasedUse               : ~m?
 # 1289|     v1289_11(void)      = ExitFunction             : 
 
-# 1293|   Block 2
-# 1293|     v1293_1(void) = Unreached : 
+# 1291|   Block 2
+# 1291|     r1291_1(glval<int>) = VariableAddress[#return] : 
+# 1291|     r1291_2(glval<int>) = VariableAddress[x]       : 
+# 1291|     r1291_3(int)        = Load[x]                  : &:r1291_2, ~m?
+# 1291|     mu1291_4(int)       = Store[#return]           : &:r1291_1, r1291_3
+#-----|   Goto -> Block 1
+
+# 1293|   Block 3
+# 1293|     r1293_1(glval<int>) = VariableAddress[#return] : 
+# 1293|     mu1293_2(int)       = Uninitialized[#return]   : &:r1293_1
+#-----|   Goto -> Block 1
 
 # 1295| void returnVoid(int, int)
 # 1295|   Block 0
@@ -9526,15 +9531,14 @@ ir.cpp:
 # 1754|     mu1754_9(unknown)                                    = ^CallSideEffect                                     : ~m?
 # 1754|     v1754_10(void)                                       = ^BufferReadSideEffect[0]                            : &:r1754_7, ~m?
 # 1754|     mu1754_11(CopyConstructorTestVirtualClass)           = ^IndirectMayWriteSideEffect[-1]                     : &:r1754_1
-# 1755|     v1755_1(void)                                        = Unreached                                           : 
-
-# 1751|   Block 1
-# 1751|     v1751_5(void)       = ReturnIndirection[x]     : &:r1751_3, ~m?
-# 1752|     v1752_5(void)       = ReturnIndirection[y]     : &:r1752_3, ~m?
-# 1750|     r1750_4(glval<int>) = VariableAddress[#return] : 
-# 1750|     v1750_5(void)       = ReturnValue              : &:r1750_4, ~m?
-# 1750|     v1750_6(void)       = AliasedUse               : ~m?
-# 1750|     v1750_7(void)       = ExitFunction             : 
+# 1755|     r1755_1(glval<int>)                                  = VariableAddress[#return]                            : 
+# 1755|     mu1755_2(int)                                        = Uninitialized[#return]                              : &:r1755_1
+# 1751|     v1751_5(void)                                        = ReturnIndirection[x]                                : &:r1751_3, ~m?
+# 1752|     v1752_5(void)                                        = ReturnIndirection[y]                                : &:r1752_3, ~m?
+# 1750|     r1750_4(glval<int>)                                  = VariableAddress[#return]                            : 
+# 1750|     v1750_5(void)                                        = ReturnValue                                         : &:r1750_4, ~m?
+# 1750|     v1750_6(void)                                        = AliasedUse                                          : ~m?
+# 1750|     v1750_7(void)                                        = ExitFunction                                        : 
 
 # 1757| void if_initialization(int)
 # 1757|   Block 0
@@ -10199,24 +10203,32 @@ ir.cpp:
 # 1900|     r1900_3(int)        = Constant[10]           : 
 # 1900|     r1900_4(bool)       = CompareLT              : r1900_2, r1900_3
 # 1900|     v1900_5(void)       = ConditionalBranch      : r1900_4
-#-----|   False -> Block 2
-#-----|   True -> Block 1
+#-----|   False -> Block 3
+#-----|   True -> Block 2
 
-# 1901|   Block 1
-# 1901|     r1901_1(glval<int>) = VariableAddress[#return] : 
-# 1901|     r1901_2(glval<int>) = VariableAddress[x]       : 
-# 1901|     r1901_3(int)        = Load[x]                  : &:r1901_2, ~m?
-# 1901|     mu1901_4(int)       = Store[#return]           : &:r1901_1, r1901_3
+# 1899|   Block 1
 # 1899|     r1899_6(glval<int>) = VariableAddress[#return] : 
 # 1899|     v1899_7(void)       = ReturnValue              : &:r1899_6, ~m?
 # 1899|     v1899_8(void)       = AliasedUse               : ~m?
 # 1899|     v1899_9(void)       = ExitFunction             : 
 
-# 1903|   Block 2
+# 1901|   Block 2
+# 1901|     r1901_1(glval<int>) = VariableAddress[#return] : 
+# 1901|     r1901_2(glval<int>) = VariableAddress[x]       : 
+# 1901|     r1901_3(int)        = Load[x]                  : &:r1901_2, ~m?
+# 1901|     mu1901_4(int)       = Store[#return]           : &:r1901_1, r1901_3
+#-----|   Goto -> Block 1
+
+# 1903|   Block 3
 # 1903|     r1903_1(glval<unknown>) = FunctionAddress[noreturnFunc] : 
 # 1903|     v1903_2(void)           = Call[noreturnFunc]            : func:r1903_1
 # 1903|     mu1903_3(unknown)       = ^CallSideEffect               : ~m?
-# 1905|     v1905_1(void)           = Unreached                     : 
+# 1899|     v1899_10(void)          = Unreached                     : 
+
+# 1905|   Block 4
+# 1905|     r1905_1(glval<int>) = VariableAddress[#return] : 
+# 1905|     mu1905_2(int)       = Uninitialized[#return]   : &:r1905_1
+#-----|   Goto -> Block 1
 
 # 1907| int noreturnTest2(int)
 # 1907|   Block 0
@@ -11069,23 +11081,22 @@ ir.cpp:
 # 2028|     r2028_3(unsigned int)        = Constant[100]          : 
 # 2028|     r2028_4(bool)                = CompareLT              : r2028_2, r2028_3
 # 2028|     v2028_5(void)                = ConditionalBranch      : r2028_4
-#-----|   False -> Block 4
-#-----|   True -> Block 3
+#-----|   False -> Block 3
+#-----|   True -> Block 2
 
-# 2026|   Block 1
-# 2026|     r2026_6(glval<unsigned int>) = VariableAddress[#return] : 
-# 2026|     v2026_7(void)                = ReturnValue              : &:r2026_6, ~m?
-# 2026|     v2026_8(void)                = AliasedUse               : ~m?
-# 2026|     v2026_9(void)                = ExitFunction             : 
-
-# 2028|   Block 2
+# 2028|   Block 1
 # 2028|     r2028_6(glval<unsigned int>) = VariableAddress[#temp2028:7] : 
 # 2028|     r2028_7(unsigned int)        = Load[#temp2028:7]            : &:r2028_6, ~m?
 # 2028|     r2028_8(glval<unsigned int>) = VariableAddress[y]           : 
 # 2028|     mu2028_9(unsigned int)       = Store[y]                     : &:r2028_8, r2028_7
-# 2031|     v2031_1(void)                = Unreached                    : 
+# 2031|     r2031_1(glval<unsigned int>) = VariableAddress[#return]     : 
+# 2031|     mu2031_2(unsigned int)       = Uninitialized[#return]       : &:r2031_1
+# 2026|     r2026_6(glval<unsigned int>) = VariableAddress[#return]     : 
+# 2026|     v2026_7(void)                = ReturnValue                  : &:r2026_6, ~m?
+# 2026|     v2026_8(void)                = AliasedUse                   : ~m?
+# 2026|     v2026_9(void)                = ExitFunction                 : 
 
-# 2029|   Block 3
+# 2029|   Block 2
 # 2029|     r2029_1(glval<unknown>)       = FunctionAddress[CommaTestHelper] : 
 # 2029|     r2029_2(glval<unsigned int>)  = VariableAddress[x]               : 
 # 2029|     r2029_3(unsigned int)         = Load[x]                          : &:r2029_2, ~m?
@@ -11096,9 +11107,9 @@ ir.cpp:
 # 2029|     r2029_8(unsigned int)         = CopyValue                        : r2029_7
 # 2028|     r2028_10(glval<unsigned int>) = VariableAddress[#temp2028:7]     : 
 # 2028|     mu2028_11(unsigned int)       = Store[#temp2028:7]               : &:r2028_10, r2029_8
-#-----|   Goto -> Block 2
+#-----|   Goto -> Block 1
 
-# 2030|   Block 4
+# 2030|   Block 3
 # 2030|     r2030_1(glval<unknown>)       = FunctionAddress[CommaTestHelper] : 
 # 2030|     r2030_2(glval<unsigned int>)  = VariableAddress[x]               : 
 # 2030|     r2030_3(unsigned int)         = Load[x]                          : &:r2030_2, ~m?
@@ -11109,7 +11120,7 @@ ir.cpp:
 # 2030|     r2030_8(unsigned int)         = Convert                          : r2030_7
 # 2028|     r2028_12(glval<unsigned int>) = VariableAddress[#temp2028:7]     : 
 # 2028|     mu2028_13(unsigned int)       = Store[#temp2028:7]               : &:r2028_12, r2030_8
-#-----|   Goto -> Block 2
+#-----|   Goto -> Block 1
 
 # 2033| void NewDeleteMem()
 # 2033|   Block 0
@@ -11295,13 +11306,12 @@ ir.cpp:
 # 2065|     r2065_3(Derived2 *)        = Load[d]                                   : &:r2065_2, ~m?
 # 2065|     v2065_4(void)              = Call[?]                                   : func:r2065_1, 0:r2065_3
 # 2065|     mu2065_5(unknown)          = ^CallSideEffect                           : ~m?
-# 2066|     v2066_1(void)              = Unreached                                 : 
-
-# 2056|   Block 1
-# 2056|     r2056_4(glval<int>) = VariableAddress[#return] : 
-# 2056|     v2056_5(void)       = ReturnValue              : &:r2056_4, ~m?
-# 2056|     v2056_6(void)       = AliasedUse               : ~m?
-# 2056|     v2056_7(void)       = ExitFunction             : 
+# 2066|     r2066_1(glval<int>)        = VariableAddress[#return]                  : 
+# 2066|     mu2066_2(int)              = Uninitialized[#return]                    : &:r2066_1
+# 2056|     r2056_4(glval<int>)        = VariableAddress[#return]                  : 
+# 2056|     v2056_5(void)              = ReturnValue                               : &:r2056_4, ~m?
+# 2056|     v2056_6(void)              = AliasedUse                                : ~m?
+# 2056|     v2056_7(void)              = ExitFunction                              : 
 
 # 2070| void test_constant_folding()
 # 2070|   Block 0
@@ -11320,6 +11330,105 @@ ir.cpp:
 # 2070|     v2070_5(void)           = AliasedUse                                 : ~m?
 # 2070|     v2070_6(void)           = ExitFunction                               : 
 
+# 2077| int NonExit()
+# 2077|   Block 0
+# 2077|     v2077_1(void)           = EnterFunction        : 
+# 2077|     mu2077_2(unknown)       = AliasedDefinition    : 
+# 2077|     mu2077_3(unknown)       = InitializeNonLocal   : 
+# 2078|     r2078_1(glval<int>)     = VariableAddress[x]   : 
+# 2078|     r2078_2(glval<unknown>) = FunctionAddress[Add] : 
+# 2078|     r2078_3(int)            = Constant[3]          : 
+# 2078|     r2078_4(int)            = Constant[4]          : 
+# 2078|     r2078_5(int)            = Call[Add]            : func:r2078_2, 0:r2078_3, 1:r2078_4
+# 2078|     mu2078_6(unknown)       = ^CallSideEffect      : ~m?
+# 2078|     mu2078_7(int)           = Store[x]             : &:r2078_1, r2078_5
+# 2079|     r2079_1(glval<int>)     = VariableAddress[x]   : 
+# 2079|     r2079_2(int)            = Load[x]              : &:r2079_1, ~m?
+# 2079|     r2079_3(int)            = Constant[7]          : 
+# 2079|     r2079_4(bool)           = CompareEQ            : r2079_2, r2079_3
+# 2079|     v2079_5(void)           = ConditionalBranch    : r2079_4
+#-----|   False -> Block 2
+#-----|   True -> Block 1
+
+# 2080|   Block 1
+# 2080|     r2080_1(glval<unknown>) = FunctionAddress[exit] : 
+# 2080|     r2080_2(int)            = Constant[3]           : 
+# 2080|     v2080_3(void)           = Call[exit]            : func:r2080_1, 0:r2080_2
+# 2080|     mu2080_4(unknown)       = ^CallSideEffect       : ~m?
+# 2077|     v2077_4(void)           = Unreached             : 
+
+# 2081|   Block 2
+# 2081|     r2081_1(glval<unknown>) = FunctionAddress[VoidFunc] : 
+# 2081|     v2081_2(void)           = Call[VoidFunc]            : func:r2081_1
+# 2081|     mu2081_3(unknown)       = ^CallSideEffect           : ~m?
+# 2082|     r2082_1(glval<int>)     = VariableAddress[#return]  : 
+# 2082|     r2082_2(glval<int>)     = VariableAddress[x]        : 
+# 2082|     r2082_3(int)            = Load[x]                   : &:r2082_2, ~m?
+# 2082|     mu2082_4(int)           = Store[#return]            : &:r2082_1, r2082_3
+# 2077|     r2077_5(glval<int>)     = VariableAddress[#return]  : 
+# 2077|     v2077_6(void)           = ReturnValue               : &:r2077_5, ~m?
+# 2077|     v2077_7(void)           = AliasedUse                : ~m?
+# 2077|     v2077_8(void)           = ExitFunction              : 
+
+# 2085| void CallsNonExit()
+# 2085|   Block 0
+# 2085|     v2085_1(void)           = EnterFunction             : 
+# 2085|     mu2085_2(unknown)       = AliasedDefinition         : 
+# 2085|     mu2085_3(unknown)       = InitializeNonLocal        : 
+# 2086|     r2086_1(glval<unknown>) = FunctionAddress[VoidFunc] : 
+# 2086|     v2086_2(void)           = Call[VoidFunc]            : func:r2086_1
+# 2086|     mu2086_3(unknown)       = ^CallSideEffect           : ~m?
+# 2087|     r2087_1(glval<unknown>) = FunctionAddress[exit]     : 
+# 2087|     r2087_2(int)            = Constant[3]               : 
+# 2087|     v2087_3(void)           = Call[exit]                : func:r2087_1, 0:r2087_2
+# 2087|     mu2087_4(unknown)       = ^CallSideEffect           : ~m?
+# 2085|     v2085_4(void)           = Unreached                 : 
+
+# 2088|   Block 1
+# 2088|     v2088_1(void) = NoOp         : 
+# 2085|     v2085_5(void) = ReturnVoid   : 
+# 2085|     v2085_6(void) = AliasedUse   : ~m?
+# 2085|     v2085_7(void) = ExitFunction : 
+
+# 2090| int TransNonExit()
+# 2090|   Block 0
+# 2090|     v2090_1(void)           = EnterFunction        : 
+# 2090|     mu2090_2(unknown)       = AliasedDefinition    : 
+# 2090|     mu2090_3(unknown)       = InitializeNonLocal   : 
+# 2091|     r2091_1(glval<int>)     = VariableAddress[x]   : 
+# 2091|     r2091_2(glval<unknown>) = FunctionAddress[Add] : 
+# 2091|     r2091_3(int)            = Constant[3]          : 
+# 2091|     r2091_4(int)            = Constant[4]          : 
+# 2091|     r2091_5(int)            = Call[Add]            : func:r2091_2, 0:r2091_3, 1:r2091_4
+# 2091|     mu2091_6(unknown)       = ^CallSideEffect      : ~m?
+# 2091|     mu2091_7(int)           = Store[x]             : &:r2091_1, r2091_5
+# 2092|     r2092_1(glval<int>)     = VariableAddress[x]   : 
+# 2092|     r2092_2(int)            = Load[x]              : &:r2092_1, ~m?
+# 2092|     r2092_3(int)            = Constant[7]          : 
+# 2092|     r2092_4(bool)           = CompareEQ            : r2092_2, r2092_3
+# 2092|     v2092_5(void)           = ConditionalBranch    : r2092_4
+#-----|   False -> Block 2
+#-----|   True -> Block 1
+
+# 2093|   Block 1
+# 2093|     r2093_1(glval<unknown>) = FunctionAddress[CallsNonExit] : 
+# 2093|     v2093_2(void)           = Call[CallsNonExit]            : func:r2093_1
+# 2093|     mu2093_3(unknown)       = ^CallSideEffect               : ~m?
+#-----|   Goto -> Block 2
+
+# 2094|   Block 2
+# 2094|     r2094_1(glval<unknown>) = FunctionAddress[VoidFunc] : 
+# 2094|     v2094_2(void)           = Call[VoidFunc]            : func:r2094_1
+# 2094|     mu2094_3(unknown)       = ^CallSideEffect           : ~m?
+# 2095|     r2095_1(glval<int>)     = VariableAddress[#return]  : 
+# 2095|     r2095_2(glval<int>)     = VariableAddress[x]        : 
+# 2095|     r2095_3(int)            = Load[x]                   : &:r2095_2, ~m?
+# 2095|     mu2095_4(int)           = Store[#return]            : &:r2095_1, r2095_3
+# 2090|     r2090_4(glval<int>)     = VariableAddress[#return]  : 
+# 2090|     v2090_5(void)           = ReturnValue               : &:r2090_4, ~m?
+# 2090|     v2090_6(void)           = AliasedUse                : ~m?
+# 2090|     v2090_7(void)           = ExitFunction              : 
+
 perf-regression.cpp:
 #    6| void Big::Big()
 #    6|   Block 0

cpp/ql/test/library-tests/syntax-zoo/raw_consistency.expected

@@ -34,13 +34,15 @@ unnecessaryPhiInstruction
 memoryOperandDefinitionIsUnmodeled
 operandAcrossFunctions
 instructionWithoutUniqueBlock
+missingCanonicalLanguageType
+multipleCanonicalLanguageTypes
 containsLoopOfForwardEdges
+missingIRType
+multipleIRTypes
 lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 | VacuousDestructorCall.cpp:2:29:2:29 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | VacuousDestructorCall.cpp:2:6:2:6 | void CallDestructor<int>(int, int*) | void CallDestructor<int>(int, int*) |
-| misc.c:219:47:219:48 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | misc.c:219:5:219:26 | int assign_designated_init(someStruct*) | int assign_designated_init(someStruct*) |
-| ms_assume.cpp:11:30:11:33 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | ms_assume.cpp:11:12:11:12 | int f(int, char*[]) | int f(int, char*[]) |
 | ms_try_except.cpp:9:19:9:19 | Left | Operand 'Left' is not dominated by its definition in function '$@'. | ms_try_except.cpp:2:6:2:18 | void ms_try_except(int) | void ms_try_except(int) |
 | ms_try_except.cpp:9:19:9:19 | Left | Operand 'Left' is not dominated by its definition in function '$@'. | ms_try_except.cpp:2:6:2:18 | void ms_try_except(int) | void ms_try_except(int) |
 | ms_try_except.cpp:19:17:19:21 | Left | Operand 'Left' is not dominated by its definition in function '$@'. | ms_try_except.cpp:2:6:2:18 | void ms_try_except(int) | void ms_try_except(int) |
@@ -58,8 +60,4 @@ thisArgumentIsNonPointer
 | pointer_to_member.cpp:23:5:23:54 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | pointer_to_member.cpp:14:5:14:9 | int usePM(int PM::*) | int usePM(int PM::*) |
 | pointer_to_member.cpp:24:5:24:49 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | pointer_to_member.cpp:14:5:14:9 | int usePM(int PM::*) | int usePM(int PM::*) |
 nonUniqueIRVariable
-missingCanonicalLanguageType
-multipleCanonicalLanguageTypes
-missingIRType
-multipleIRTypes
 missingCppType

cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree.expected

@@ -4,7 +4,6 @@ edges
 | test.cpp:106:7:106:10 | data | test.cpp:108:6:108:9 | data |
 | test.cpp:116:7:116:10 | data | test.cpp:119:6:119:9 | data |
 | test.cpp:127:7:127:10 | data | test.cpp:130:6:130:9 | data |
-| test.cpp:138:7:138:10 | data | test.cpp:141:6:141:9 | data |
 | test.cpp:164:9:164:9 | c | test.cpp:165:2:165:2 | c |
 | test.cpp:164:9:164:9 | c | test.cpp:166:3:166:4 | * ... |
 | test.cpp:181:7:181:10 | data | test.cpp:186:6:186:9 | data |
@@ -23,8 +22,6 @@ nodes
 | test.cpp:119:6:119:9 | data | semmle.label | data |
 | test.cpp:127:7:127:10 | data | semmle.label | data |
 | test.cpp:130:6:130:9 | data | semmle.label | data |
-| test.cpp:138:7:138:10 | data | semmle.label | data |
-| test.cpp:141:6:141:9 | data | semmle.label | data |
 | test.cpp:164:9:164:9 | c | semmle.label | c |
 | test.cpp:165:2:165:2 | c | semmle.label | c |
 | test.cpp:166:3:166:4 | * ... | semmle.label | * ... |
@@ -45,7 +42,6 @@ subpaths
 | test.cpp:108:6:108:9 | data | test.cpp:106:7:106:10 | data | test.cpp:108:6:108:9 | data | Memory may have been previously freed by $@. | test.cpp:106:2:106:5 | call to free | call to free |
 | test.cpp:119:6:119:9 | data | test.cpp:116:7:116:10 | data | test.cpp:119:6:119:9 | data | Memory may have been previously freed by $@. | test.cpp:116:2:116:5 | call to free | call to free |
 | test.cpp:130:6:130:9 | data | test.cpp:127:7:127:10 | data | test.cpp:130:6:130:9 | data | Memory may have been previously freed by $@. | test.cpp:127:2:127:5 | call to free | call to free |
-| test.cpp:141:6:141:9 | data | test.cpp:138:7:138:10 | data | test.cpp:141:6:141:9 | data | Memory may have been previously freed by $@. | test.cpp:138:2:138:5 | call to free | call to free |
 | test.cpp:165:2:165:2 | c | test.cpp:164:9:164:9 | c | test.cpp:165:2:165:2 | c | Memory may have been previously freed by $@. | test.cpp:164:2:164:10 | delete | delete |
 | test.cpp:166:3:166:4 | * ... | test.cpp:164:9:164:9 | c | test.cpp:166:3:166:4 | * ... | Memory may have been previously freed by $@. | test.cpp:164:2:164:10 | delete | delete |
 | test.cpp:186:6:186:9 | data | test.cpp:181:7:181:10 | data | test.cpp:186:6:186:9 | data | Memory may have been previously freed by $@. | test.cpp:181:2:181:5 | call to free | call to free |

cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/test.cpp

@@ -138,7 +138,7 @@ void test9()
 	free(data);
 	noReturnWrapper();
 	use_if_nonzero(data); // GOOD
-	use(data); // GOOD [FALSE POSITIVE]
+	use(data); // GOOD
 }
 
 void test10()