C++: Simplify HashCons for new and handle extents

2025-12-17 01:03:14 +01:00 · 2018-08-30 14:48:57 -07:00
parent 9f476e585a
commit c42ecfe8f9
3 changed files with 142 additions and 178 deletions
--- a/cpp/ql/src/semmle/code/cpp/valuenumbering/HashCons.qll
+++ b/cpp/ql/src/semmle/code/cpp/valuenumbering/HashCons.qll
@@ -98,11 +98,17 @@ private cached newtype HCBase =
    mk_MemberFunctionCall(trg, qual, args, _)
  }
  or
-  HC_NewExpr(Type t, HC_Alloc alloc, HC_Init init, HC_Align align) {
-    mk_NewExpr(t, alloc, init, align, _, _)
-  }  or
-  HC_NewArrayExpr(Type t, HC_Alloc alloc, HC_Init init, HC_Align align) {
-    mk_NewArrayExpr(t, alloc, init, align, _, _)
+  // Hack to get around argument 0 of allocator calls being an error expression
+  HC_AllocatorArgZero(Type t) {
+    mk_AllocatorArgZero(t, _)
+  }
+  or
+  HC_NewExpr(Type t, HC_Alloc alloc, HC_Init init) {
+    mk_NewExpr(t, alloc, init, _)
+  }
+  or
+  HC_NewArrayExpr(Type t, HC_Alloc alloc, HC_Extent extent, HC_Init init) {
+    mk_NewArrayExpr(t, alloc, extent, init, _)
  }
  or
  HC_SizeofType(Type t) {mk_SizeofType(t, _)}
@@ -147,30 +153,27 @@ private cached newtype HCBase =
  // given a unique number based on the expression itself.
  HC_Unanalyzable(Expr e) { not analyzableExpr(e,_) }

-/** Used to implement hash-consing of `new` placement argument lists  */
-private newtype HC_Alloc =
-  HC_EmptyAllocArgs(Function fcn) {
-    exists(NewOrNewArrayExpr n |
-      n.getAllocator() = fcn
-    ) 
-  }
-  or HC_AllocArgCons(Function fcn, HashCons hc, int i, HC_Alloc list, boolean aligned) {
-    mk_AllocArgCons(fcn, hc, i, list, aligned, _)
-  }
-  or
-  HC_NoAlloc()
-
 /** Used to implement optional init on `new` expressions */
 private newtype HC_Init =
  HC_NoInit()
  or
  HC_HasInit(HashCons hc) {mk_HasInit(hc, _)}

-private newtype HC_Align = 
-  HC_NoAlign()
+/**
+ * Used to implement optional allocator call on `new` expressions
+ */
+private newtype HC_Alloc =
+  HC_NoAlloc()
  or
-  HC_HasAlign(HashCons hc) {mk_HasAlign(hc, _)}
-
+  HC_HasAlloc(HashCons hc) {mk_HasAlloc(hc, _)}
+  
+/**
+ * Used to implement optional extent expression on `new[]` exprtessions
+ */
+private newtype HC_Extent =
+  HC_NoExtent()
+  or
+  HC_HasExtent(HashCons hc) {mk_HasExtent(hc, _)}
 /** Used to implement hash-consing of argument lists  */
 private newtype HC_Args =
  HC_EmptyArgs() {
@@ -260,6 +263,7 @@ class HashCons extends HCBase {
    if this instanceof HC_ExprCall then result = "ExprCall" else
    if this instanceof HC_ConditionalExpr then result = "ConditionalExpr" else
    if this instanceof HC_NoExceptExpr then result = "NoExceptExpr" else
+    if this instanceof HC_AllocatorArgZero then result = "AllocatorArgZero" else
    result = "error"
  }

@@ -563,94 +567,57 @@ private predicate mk_ArgConsInner(HashCons head, HC_Args tail, int i, HC_Args li
  mk_ArgCons(head, i, tail, c)
 }

-/**
- * Holds if `fc` is a call to `fcn`, `fc`'s first `i` arguments have hash-cons
- * `list`, and `fc`'s argument at index `i` has hash-cons `hc`.
+/* 
+ * The 0th argument of an allocator call in a new expression is always an error expression;
+ * this works around it 
 */
-private predicate mk_AllocArgCons(Function fcn, HashCons hc, int i, HC_Alloc list, boolean aligned,
-  Call c) {
-  analyzableCall(c) and
-  c.getTarget() = fcn and
-  hc = hashCons(c.getArgument(i).getFullyConverted()) and
-  (
-    exists(HashCons head, HC_Alloc tail |
-      list = HC_AllocArgCons(fcn, head, i - 1, tail, aligned) and
-      mk_AllocArgCons(fcn, head, i - 1, tail, aligned, c) and
-      (
-        aligned = true and
-        i > 2
-        or
-        aligned = false and
-        i > 1
-      )
-    )
-    or
-    (
-      aligned = true and
-      i = 2
-      or
-      aligned = false and
-      i = 1
-    ) and
-    list = HC_EmptyAllocArgs(fcn)
+private predicate analyzableAllocatorArgZero(ErrorExpr e) {
+  exists(NewOrNewArrayExpr new |
+    new.getAllocatorCall().getChild(0) = e
+  )
+}
+
+private predicate mk_AllocatorArgZero(Type t, ErrorExpr e) {
+  exists(NewOrNewArrayExpr new |
+    new.getAllocatorCall().getChild(0) = e and
+    t = new.getType().getUnspecifiedType()
  )
 }

 private predicate mk_HasInit(HashCons hc, NewOrNewArrayExpr new) {
-  hc = hashCons(new.(NewExpr).getInitializer()) or
-  hc = hashCons(new.(NewArrayExpr).getInitializer())
+  hc = hashCons(new.(NewExpr).getInitializer().getFullyConverted()) or
+  hc = hashCons(new.(NewArrayExpr).getInitializer().getFullyConverted())
 }

-private predicate mk_HasAlign(HashCons hc, NewOrNewArrayExpr new) {
-  hc = hashCons(new.getAlignmentArgument().getFullyConverted())
+private predicate mk_HasAlloc(HashCons hc, NewOrNewArrayExpr new) {
+  hc = hashCons(new.(NewExpr).getAllocatorCall().getFullyConverted()) or
+  hc = hashCons(new.(NewArrayExpr).getAllocatorCall().getFullyConverted())
+}
+
+private predicate mk_HasExtent(HashCons hc, NewArrayExpr new) {
+  hc = hashCons(new.(NewArrayExpr).getExtent().getFullyConverted())
 }

 private predicate analyzableNewExpr(NewExpr new) {
-  strictcount(new.getAllocatedType()) = 1 and
+  strictcount(new.getAllocatedType().getUnspecifiedType()) = 1 and
  count(new.getAllocatorCall().getFullyConverted()) <= 1 and
  count(new.getInitializer().getFullyConverted()) <= 1
 }

-private predicate mk_NewExpr(Type t, HC_Alloc alloc, HC_Init init, HC_Align align, boolean aligned,
-  NewExpr new) {
+private predicate mk_NewExpr(Type t, HC_Alloc alloc, HC_Init init, NewExpr new) {
  analyzableNewExpr(new) and
-  t = new.getAllocatedType() and
+  t = new.getAllocatedType().getUnspecifiedType() and
  (
-    align = HC_HasAlign(hashCons(new.getAlignmentArgument().getFullyConverted())) and
-    aligned = true
+    alloc = HC_HasAlloc(hashCons(new.getAllocatorCall().getFullyConverted()))
    or
-    not new.hasAlignedAllocation() and
-    align = HC_NoAlign() and
-    aligned = false
-  )
-  and
-  (
-    exists(FunctionCall fc, HashCons head, HC_Alloc tail |
-      fc = new.getAllocatorCall() and
-      alloc = HC_AllocArgCons(fc.getTarget(), head, fc.getNumberOfArguments() - 1, tail, aligned) and
-      mk_AllocArgCons(fc.getTarget(), head, fc.getNumberOfArguments() - 1, tail, aligned, fc)
-    )
-    or
-    exists(FunctionCall fc |
-      fc = new.getAllocatorCall() and
-      (
-        aligned = true and
-        fc.getNumberOfArguments() = 2
-        or
-        aligned = false and
-        fc.getNumberOfArguments() = 1
-      ) and
-      alloc = HC_EmptyAllocArgs(fc.getTarget())
-    )
-    or
-    not exists(new.getAllocatorCall()) and
+    not exists(new.getAllocatorCall().getFullyConverted()) and
    alloc = HC_NoAlloc()
  )
  and
  (
-    init = HC_HasInit(hashCons(new.getInitializer()))
+    init = HC_HasInit(hashCons(new.getInitializer().getFullyConverted()))
    or
-    not exists(new.getInitializer()) and
+    not exists(new.getInitializer().getFullyConverted()) and
    init = HC_NoInit()
  )
 }
@@ -658,51 +625,35 @@ private predicate mk_NewExpr(Type t, HC_Alloc alloc, HC_Init init, HC_Align alig
 private predicate analyzableNewArrayExpr(NewArrayExpr new) {
  strictcount(new.getAllocatedType().getUnspecifiedType()) = 1 and
  count(new.getAllocatorCall().getFullyConverted()) <= 1 and
-  count(new.getInitializer().getFullyConverted()) <= 1
+  count(new.getInitializer().getFullyConverted()) <= 1 and
+  count(new.(NewArrayExpr).getExtent().getFullyConverted()) <= 1
 }

-private predicate mk_NewArrayExpr(Type t, HC_Alloc alloc, HC_Init init, HC_Align align,
-  boolean aligned, NewArrayExpr new) {
+private predicate mk_NewArrayExpr(Type t, HC_Alloc alloc, HC_Extent extent, HC_Init init, NewArrayExpr new) {
  analyzableNewArrayExpr(new) and
  t = new.getAllocatedType() and
+  
  (
-    align = HC_HasAlign(hashCons(new.getAlignmentArgument().getFullyConverted())) and
-    aligned = true
+    alloc = HC_HasAlloc(hashCons(new.getAllocatorCall().getFullyConverted()))
    or
-    not new.hasAlignedAllocation() and
-    align = HC_NoAlign() and
-    aligned = false
-  )
-  and
-  (
-    exists(FunctionCall fc, HashCons head, HC_Alloc tail |
-      fc = new.getAllocatorCall() and
-      alloc = HC_AllocArgCons(fc.getTarget(), head, fc.getNumberOfArguments() - 1, tail, aligned) and
-      mk_AllocArgCons(fc.getTarget(), head, fc.getNumberOfArguments() - 1, tail, aligned, fc)
-    )
-    or
-    exists(FunctionCall fc |
-      fc = new.getAllocatorCall() and
-      (
-        aligned = true and
-        fc.getNumberOfArguments() = 2
-        or
-        aligned = false and
-        fc.getNumberOfArguments() = 1
-      ) and
-      alloc = HC_EmptyAllocArgs(fc.getTarget())
-    )
-    or
-    not exists(new.getAllocatorCall()) and
+    not exists(new.getAllocatorCall().getFullyConverted()) and
    alloc = HC_NoAlloc()
  )
  and
  (
-    init = HC_HasInit(hashCons(new.getInitializer()))
+    init = HC_HasInit(hashCons(new.getInitializer().getFullyConverted()))
    or
-    not exists(new.getInitializer()) and
+    not exists(new.getInitializer().getFullyConverted()) and
    init = HC_NoInit()
  )
+  and
+  
+  (
+    extent = HC_HasExtent(hashCons(new.getExtent().getFullyConverted()))
+    or
+    not exists(new.getExtent().getFullyConverted()) and
+    extent = HC_NoExtent()
+  )
 }

 private predicate analyzableDeleteExpr(DeleteExpr e) {
@@ -984,14 +935,20 @@ cached HashCons hashCons(Expr e) {
    result = HC_MemberFunctionCall(fcn, qual, args)
  )
  or
-  exists(Type t, HC_Alloc alloc, HC_Init init, HC_Align align, boolean aligned
-  | mk_NewExpr(t, alloc, init, align, aligned, e) and
-    result = HC_NewExpr(t, alloc, init, align)
+  // works around an extractor issue class
+  exists(Type t
+  | mk_AllocatorArgZero(t, e) and
+    result = HC_AllocatorArgZero(t)
  )
  or
-  exists(Type t, HC_Alloc alloc, HC_Init init, HC_Align align, boolean aligned
-  | mk_NewArrayExpr(t, alloc, init, align, aligned, e) and
-    result = HC_NewArrayExpr(t, alloc, init, align)
+  exists(Type t, HC_Alloc alloc, HC_Init init
+  | mk_NewExpr(t, alloc, init, e) and
+    result = HC_NewExpr(t, alloc, init)
+  )
+  or
+  exists(Type t, HC_Alloc alloc, HC_Extent extent, HC_Init init
+  | mk_NewArrayExpr(t, alloc, extent, init, e) and
+    result = HC_NewArrayExpr(t, alloc, extent, init)
  )
  or
  exists(Type t
@@ -1108,5 +1065,6 @@ predicate analyzableExpr(Expr e, string kind) {
  (analyzableThrowExpr(e) and kind = "ThrowExpr") or
  (analyzableReThrowExpr(e) and kind = "ReThrowExpr") or
  (analyzableConditionalExpr(e) and kind = "ConditionalExpr") or
-  (analyzableNoExceptExpr(e) and kind = "NoExceptExpr")
+  (analyzableNoExceptExpr(e) and kind = "NoExceptExpr") or
+  (analyzableAllocatorArgZero(e) and kind = "AllocatorArgZero")
 }
--- a/cpp/ql/test/library-tests/valuenumbering/HashCons/HashCons.expected
+++ b/cpp/ql/test/library-tests/valuenumbering/HashCons/HashCons.expected
@@ -37,9 +37,9 @@
 | test.cpp:92:11:92:11 | x | 92:c11-c11 93:c10-c10 |
 | test.cpp:97:3:97:3 | x | 97:c3-c3 98:c3-c3 |
 | test.cpp:97:3:97:5 | ... ++ | 97:c3-c5 98:c3-c5 |
-| test.cpp:103:10:103:11 | 1 | 103:c10-c11 104:c7-c7 107:c7-c7 108:c7-c7 10:c16-c16 179:c21-c21 247:c11-c11 248:c11-c11 271:c28-c28 272:c28-c28 274:c19-c19 274:c22-c22 288:c5-c5 292:c5-c5 297:c5-c5 302:c9-c9 303:c9-c9 313:c5-c5 314:c5-c5 316:c5-c5 |
+| test.cpp:103:10:103:11 | 1 | 103:c10-c11 104:c7-c7 107:c7-c7 108:c7-c7 10:c16-c16 179:c21-c21 239:c11-c11 240:c11-c11 263:c28-c28 264:c28-c28 266:c19-c19 266:c22-c22 285:c5-c5 289:c5-c5 294:c5-c5 299:c9-c9 300:c9-c9 310:c5-c5 311:c5-c5 313:c5-c5 |
 | test.cpp:104:3:104:3 | x | 104:c3-c3 105:c3-c3 106:c3-c3 107:c3-c3 108:c3-c3 |
-| test.cpp:105:7:105:7 | 2 | 105:c7-c7 106:c7-c7 107:c11-c11 108:c11-c11 21:c16-c16 249:c11-c11 271:c24-c24 271:c31-c31 272:c24-c24 272:c31-c31 273:c24-c24 274:c15-c15 275:c15-c15 275:c19-c19 275:c22-c22 277:c15-c15 278:c15-c15 289:c5-c5 293:c5-c5 296:c5-c5 304:c9-c9 305:c9-c9 |
+| test.cpp:105:7:105:7 | 2 | 105:c7-c7 106:c7-c7 107:c11-c11 108:c11-c11 21:c16-c16 241:c11-c11 263:c24-c24 263:c31-c31 264:c24-c24 264:c31-c31 265:c24-c24 266:c15-c15 267:c15-c15 267:c19-c19 267:c22-c22 269:c15-c15 270:c15-c15 286:c5-c5 290:c5-c5 293:c5-c5 301:c9-c9 302:c9-c9 |
 | test.cpp:107:7:107:11 | ... + ... | 107:c7-c11 108:c7-c11 |
 | test.cpp:110:15:110:17 | 1 | 110:c15-c17 111:c9-c11 |
 | test.cpp:110:15:110:17 | (char *)... | 110:c15-c17 111:c9-c11 |
@@ -73,7 +73,7 @@
 | test.cpp:179:17:179:21 | ... + ... | 179:c17-c21 179:c17-c21 |
 | test.cpp:185:17:185:17 | y | 185:c17-c17 185:c17-c17 |
 | test.cpp:202:3:202:18 | sizeof(padded_t) | 202:c3-c18 204:c3-c18 |
-| test.cpp:205:24:205:34 | sizeof(int) | 205:c24-c34 253:c25-c35 254:c25-c35 |
+| test.cpp:205:24:205:34 | sizeof(int) | 205:c24-c34 245:c25-c35 246:c25-c35 |
 | test.cpp:206:25:206:43 | alignof(int_holder) | 206:c25-c43 206:c3-c21 |
 | test.cpp:208:27:208:27 | x | 208:c27-c27 210:c10-c10 211:c11-c11 211:c24-c24 |
 | test.cpp:209:10:209:15 | holder | 209:c10-c15 209:c29-c34 |
@@ -82,42 +82,51 @@
 | test.cpp:209:22:209:37 | sizeof(<expr>) | 209:c22-c37 209:c3-c18 |
 | test.cpp:210:10:210:11 | (...) | 210:c10-c11 211:c11-c12 211:c24-c25 |
 | test.cpp:211:16:211:25 | alignof(<expr>) | 211:c16-c25 211:c3-c12 |
-| test.cpp:247:3:247:12 | new | 247:c3-c12 248:c3-c12 |
-| test.cpp:253:16:253:36 | new[] | 253:c16-c36 254:c16-c36 |
-| test.cpp:256:3:256:28 | delete | 256:c3-c28 257:c3-c28 |
-| test.cpp:256:10:256:28 | new | 256:c10-c28 257:c10-c28 |
-| test.cpp:256:14:256:17 | (void *)... | 256:c14-c17 257:c14-c17 260:c18-c21 261:c20-c23 263:c11-c14 |
-| test.cpp:256:14:256:17 | ptr1 | 256:c14-c17 257:c14-c17 260:c18-c21 261:c20-c23 263:c11-c14 |
-| test.cpp:258:14:258:17 | (void *)... | 258:c14-c17 262:c11-c14 |
-| test.cpp:258:14:258:17 | ptr2 | 258:c14-c17 262:c11-c14 |
-| test.cpp:260:10:260:32 | new | 260:c10-c32 261:c12-c34 |
-| test.cpp:260:14:260:15 | 32 | 260:c14-c15 261:c16-c17 262:c7-c8 265:c7-c8 266:c7-c8 268:c7-c8 269:c7-c8 271:c16-c17 272:c16-c17 273:c16-c17 274:c7-c8 275:c7-c8 277:c7-c8 278:c7-c8 |
-| test.cpp:260:14:260:15 | (size_t)... | 260:c14-c15 261:c16-c17 262:c7-c8 265:c7-c8 266:c7-c8 268:c7-c8 269:c7-c8 271:c16-c17 272:c16-c17 273:c16-c17 274:c7-c8 275:c7-c8 277:c7-c8 278:c7-c8 |
-| test.cpp:265:3:265:19 | new | 265:c3-c19 266:c3-c19 |
-| test.cpp:268:3:268:23 | new[] | 268:c3-c23 269:c3-c23 |
-| test.cpp:268:21:268:22 | 10 | 268:c21-c22 269:c21-c22 92:c15-c16 |
-| test.cpp:271:3:271:32 | delete[] | 271:c3-c32 272:c3-c32 |
-| test.cpp:271:12:271:32 | new[] | 271:c12-c32 272:c12-c32 |
-| test.cpp:271:12:271:32 | {...} | 271:c12-c32 272:c12-c32 |
-| test.cpp:273:28:273:28 | 3 | 273:c28-c28 35:c16-c16 |
-| test.cpp:277:3:277:19 | new[] | 277:c3-c19 278:c3-c19 |
-| test.cpp:277:3:277:19 | {...} | 277:c3-c19 278:c3-c19 |
-| test.cpp:287:15:290:3 | {...} | 287:c15-c3 291:c15-c3 |
-| test.cpp:302:3:302:9 | throw ... | 302:c3-c9 303:c3-c9 |
-| test.cpp:304:3:304:9 | throw ... | 304:c3-c9 305:c3-c9 |
-| test.cpp:306:3:306:7 | re-throw exception  | 306:c3-c7 307:c3-c7 |
-| test.cpp:311:3:311:3 | x | 311:c3-c3 312:c3-c3 313:c3-c3 314:c3-c3 |
-| test.cpp:311:3:311:6 | access to array | 311:c3-c6 312:c3-c6 |
-| test.cpp:311:5:311:5 | 0 | 311:c5-c5 312:c5-c5 315:c5-c5 44:c9-c9 51:c25-c25 88:c12-c12 |
-| test.cpp:313:3:313:6 | access to array | 313:c3-c6 314:c3-c6 |
-| test.cpp:315:3:315:3 | y | 315:c3-c3 316:c3-c3 |
-| test.cpp:323:3:323:11 | test_18_p | 323:c3-c11 324:c3-c11 |
-| test.cpp:323:3:323:13 | call to expression | 323:c3-c13 324:c3-c13 |
-| test.cpp:327:3:327:11 | test_19_p | 327:c3-c11 328:c3-c11 329:c3-c11 |
-| test.cpp:327:3:327:17 | call to expression | 327:c3-c17 328:c3-c17 |
-| test.cpp:327:13:327:13 | x | 327:c13-c13 328:c13-c13 329:c16-c16 |
-| test.cpp:327:16:327:16 | y | 327:c16-c16 328:c16-c16 329:c13-c13 |
-| test.cpp:333:3:333:8 | ... == ... | 333:c3-c8 334:c3-c8 336:c3-c8 |
-| test.cpp:333:3:333:16 | ... ? ... : ... | 333:c3-c16 334:c3-c16 |
-| test.cpp:333:12:333:12 | x | 333:c12-c12 333:c3-c3 334:c12-c12 334:c3-c3 335:c12-c12 335:c8-c8 336:c16-c16 336:c3-c3 |
-| test.cpp:333:16:333:16 | y | 333:c16-c16 333:c8-c8 334:c16-c16 334:c8-c8 335:c16-c16 335:c3-c3 336:c12-c12 336:c8-c8 |
+| test.cpp:239:3:239:12 | new | 239:c3-c12 240:c3-c12 |
+| test.cpp:245:16:245:36 | new[] | 245:c16-c36 246:c16-c36 |
+| test.cpp:248:3:248:28 | delete | 248:c3-c28 249:c3-c28 |
+| test.cpp:248:10:248:28 | <error expr> | 248:c10-c28 249:c10-c28 250:c10-c28 252:c10-c32 253:c12-c34 254:c3-c25 255:c3-c25 257:c3-c19 258:c3-c19 260:c3-c23 261:c3-c23 |
+| test.cpp:248:10:248:28 | call to operator new | 248:c10-c28 249:c10-c28 |
+| test.cpp:248:10:248:28 | new | 248:c10-c28 249:c10-c28 |
+| test.cpp:248:14:248:17 | (void *)... | 248:c14-c17 249:c14-c17 252:c18-c21 253:c20-c23 255:c11-c14 |
+| test.cpp:248:14:248:17 | ptr1 | 248:c14-c17 249:c14-c17 252:c18-c21 253:c20-c23 255:c11-c14 |
+| test.cpp:250:14:250:17 | (void *)... | 250:c14-c17 254:c11-c14 |
+| test.cpp:250:14:250:17 | ptr2 | 250:c14-c17 254:c11-c14 |
+| test.cpp:252:10:252:32 | call to operator new | 252:c10-c32 253:c12-c34 |
+| test.cpp:252:10:252:32 | new | 252:c10-c32 253:c12-c34 |
+| test.cpp:252:14:252:15 | 32 | 252:c14-c15 253:c16-c17 254:c7-c8 257:c7-c8 258:c7-c8 260:c7-c8 261:c7-c8 263:c16-c17 264:c16-c17 265:c16-c17 266:c7-c8 267:c7-c8 269:c7-c8 270:c7-c8 271:c7-c8 |
+| test.cpp:252:14:252:15 | (size_t)... | 252:c14-c15 253:c16-c17 254:c7-c8 257:c7-c8 258:c7-c8 260:c7-c8 261:c7-c8 263:c16-c17 264:c16-c17 265:c16-c17 266:c7-c8 267:c7-c8 269:c7-c8 270:c7-c8 271:c7-c8 |
+| test.cpp:257:3:257:19 | call to operator new | 257:c3-c19 258:c3-c19 |
+| test.cpp:257:3:257:19 | new | 257:c3-c19 258:c3-c19 |
+| test.cpp:260:3:260:23 | call to operator new[] | 260:c3-c23 261:c3-c23 |
+| test.cpp:260:3:260:23 | new[] | 260:c3-c23 261:c3-c23 |
+| test.cpp:260:21:260:22 | 10 | 260:c21-c22 261:c21-c22 92:c15-c16 |
+| test.cpp:263:3:263:32 | delete[] | 263:c3-c32 264:c3-c32 |
+| test.cpp:263:12:263:32 | <error expr> | 263:c12-c32 264:c12-c32 265:c12-c32 266:c3-c23 267:c3-c23 269:c3-c19 270:c3-c19 271:c3-c19 |
+| test.cpp:263:12:263:32 | call to operator new[] | 263:c12-c32 264:c12-c32 265:c12-c32 266:c3-c23 267:c3-c23 269:c3-c19 270:c3-c19 271:c3-c19 |
+| test.cpp:263:12:263:32 | new[] | 263:c12-c32 264:c12-c32 |
+| test.cpp:263:12:263:32 | {...} | 263:c12-c32 264:c12-c32 |
+| test.cpp:265:28:265:28 | 3 | 265:c28-c28 271:c15-c15 35:c16-c16 |
+| test.cpp:269:3:269:19 | new[] | 269:c3-c19 270:c3-c19 |
+| test.cpp:269:3:269:19 | {...} | 269:c3-c19 270:c3-c19 |
+| test.cpp:273:3:273:12 | new[] | 273:c3-c12 274:c3-c12 |
+| test.cpp:273:11:273:11 | x | 273:c11-c11 274:c11-c11 |
+| test.cpp:284:15:287:3 | {...} | 284:c15-c3 288:c15-c3 |
+| test.cpp:299:3:299:9 | throw ... | 299:c3-c9 300:c3-c9 |
+| test.cpp:301:3:301:9 | throw ... | 301:c3-c9 302:c3-c9 |
+| test.cpp:303:3:303:7 | re-throw exception  | 303:c3-c7 304:c3-c7 |
+| test.cpp:308:3:308:3 | x | 308:c3-c3 309:c3-c3 310:c3-c3 311:c3-c3 |
+| test.cpp:308:3:308:6 | access to array | 308:c3-c6 309:c3-c6 |
+| test.cpp:308:5:308:5 | 0 | 308:c5-c5 309:c5-c5 312:c5-c5 44:c9-c9 51:c25-c25 88:c12-c12 |
+| test.cpp:310:3:310:6 | access to array | 310:c3-c6 311:c3-c6 |
+| test.cpp:312:3:312:3 | y | 312:c3-c3 313:c3-c3 |
+| test.cpp:320:3:320:11 | test_18_p | 320:c3-c11 321:c3-c11 |
+| test.cpp:320:3:320:13 | call to expression | 320:c3-c13 321:c3-c13 |
+| test.cpp:324:3:324:11 | test_19_p | 324:c3-c11 325:c3-c11 326:c3-c11 |
+| test.cpp:324:3:324:17 | call to expression | 324:c3-c17 325:c3-c17 |
+| test.cpp:324:13:324:13 | x | 324:c13-c13 325:c13-c13 326:c16-c16 |
+| test.cpp:324:16:324:16 | y | 324:c16-c16 325:c16-c16 326:c13-c13 |
+| test.cpp:330:3:330:8 | ... == ... | 330:c3-c8 331:c3-c8 333:c3-c8 |
+| test.cpp:330:3:330:16 | ... ? ... : ... | 330:c3-c16 331:c3-c16 |
+| test.cpp:330:12:330:12 | x | 330:c12-c12 330:c3-c3 331:c12-c12 331:c3-c3 332:c12-c12 332:c8-c8 333:c16-c16 333:c3-c3 |
+| test.cpp:330:16:330:16 | y | 330:c16-c16 330:c8-c8 331:c16-c16 331:c8-c8 332:c16-c16 332:c3-c3 333:c12-c12 333:c8-c8 |
--- a/cpp/ql/test/library-tests/valuenumbering/HashCons/test.cpp
+++ b/cpp/ql/test/library-tests/valuenumbering/HashCons/test.cpp
@@ -211,10 +211,6 @@ int test15(int x) {
  alignof(x) + alignof(x);
 }

-static void *operator new(size_t size) {
-  return malloc(size);
-}
-
 static void *operator new(size_t size, void *placement) {
  return placement;
 }
@@ -227,10 +223,6 @@ static void *operator new(size_t size, size_t alignment) {
  return malloc(size);
 }

-static void *operator new[](size_t size) {
-  return malloc(size);
-}
-
 static void *operator new[](size_t size, void *placement) {
  return placement;
 }
@@ -243,7 +235,7 @@ static void *operator new[](size_t size, size_t alignment) {
  return malloc(size);
 }

-void test16() {
+void test16(int y, int z) {
  new int(1);
  new int(1);
  new int(2);
@@ -276,6 +268,11 @@ void test16() {

  new(32) int[2] {};
  new(32) int[2] {};
+  new(32) int[3] {};
+
+  new int[x];
+  new int[x];
+  new int[z];
 }

 typedef struct point{