Merge branch 'main' into modelchanges2

cpp/change-notes/2020-11-02-unused-local-variable.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Two issues causing the 'Unused local variable' query (`cpp/unused-local-variable`) to produce false positive results have been fixed.

cpp/ql/src/Best Practices/Unused Entities/UnusedLocals.ql

@@ -57,5 +57,12 @@ where
   not declarationHasSideEffects(v) and
   not exists(AsmStmt s | f = s.getEnclosingFunction()) and
   not v.getAnAttribute().getName() = "unused" and
-  not any(ErrorExpr e).getEnclosingFunction() = f // unextracted expr likely used `v`
+  not any(ErrorExpr e).getEnclosingFunction() = f and // unextracted expr may use `v`
+  not exists(
+    Literal l // this case can be removed when the `myFunction2( [obj](){} );` test case doesn't depend on this exclusion
+  |
+    l.getEnclosingFunction() = f and
+    not exists(l.getValue())
+  ) and
+  not any(ConditionDeclExpr cde).getEnclosingFunction() = f // this case can be removed when the `if (a = b; a)` test case doesn't depend on this exclusion
 select v, "Variable " + v.getName() + " is not used"

cpp/ql/src/IDEContextual.qll

@@ -0,0 +1,22 @@
+/**
+ * Provides shared predicates related to contextual queries in the code viewer.
+ */
+
+import semmle.files.FileSystem
+
+/**
+ * Returns the `File` matching the given source file name as encoded by the VS
+ * Code extension.
+ */
+cached
+File getFileBySourceArchiveName(string name) {
+  // The name provided for a file in the source archive by the VS Code extension
+  // has some differences from the absolute path in the database:
+  // 1. colons are replaced by underscores
+  // 2. there's a leading slash, even for Windows paths: "C:/foo/bar" ->
+  //    "/C_/foo/bar"
+  // 3. double slashes in UNC prefixes are replaced with a single slash
+  // We can handle 2 and 3 together by unconditionally adding a leading slash
+  // before replacing double slashes.
+  name = ("/" + result.getAbsolutePath().replaceAll(":", "_")).replaceAll("//", "/")
+}

cpp/ql/src/Security/CWE/CWE-020/CountUntrustedDataToExternalAPI.qhelp

@@ -0,0 +1,48 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Using unsanitized untrusted data in an external API can cause a variety of security issues. This query reports 
+all external APIs that are used with untrusted data, along with how frequently the API is used, and how many 
+unique sources of untrusted data flow to this API. This query is designed primarily to help identify which APIs 
+may be relevant for security analysis of this application.</p>
+
+<p>An external API is defined as a call to a function that is not defined in the source code, and is not
+modeled as a taint step in the default taint library. External APIs may be from the C++ standard library,
+third party dependencies or from internal dependencies. The query will report the function name, along with
+either <code>[param x]</code>, where <code>x</code> indicates the position of the parameter receiving the
+untrusted data or <code>[qualifier]</code> indicating the untrusted data is used as the qualifier to the
+function call.</p>
+
+</overview>
+<recommendation>
+
+<p>For each result:</p>
+
+<ul>
+  <li>If the result highlights a known sink, no action is required.</li>
+  <li>If the result highlights an unknown sink for a problem, then add modeling for the sink to the relevant query.</li>
+  <li>If the result represents a call to an external API which transfers taint, add the appropriate modeling, and 
+  re-run the query to determine what new results have appeared due to this additional modeling.</li>
+</ul>
+
+<p>Otherwise, the result is likely uninteresting. Custom versions of this query can extend the <code>SafeExternalAPIFunction</code> 
+class to exclude known safe external APIs from future analysis.</p>
+
+</recommendation>
+<example>
+
+<p>If the query were to return the API <code>fputs [param 1]</code> 
+then we should first consider whether this a security relevant sink. In this case, this is writing to a <code>FILE*</code>, so we should 
+consider whether this is an XSS sink. If it is, we should confirm that it is handled by the XSS query.</p>
+
+<p>If the query were to return the API <code>strcat [param 1]</code>, then this should be
+reviewed as a possible taint step, because tainted data would flow from the 1st argument to the 0th argument of the call.</p>
+
+<p>Note that both examples are correctly handled by the standard taint tracking library and XSS query.</p>
+</example>
+<references>
+
+</references>
+</qhelp>

cpp/ql/src/Security/CWE/CWE-020/CountUntrustedDataToExternalAPI.ql

@@ -0,0 +1,17 @@
+/**
+ * @name Frequency counts for external APIs that are used with untrusted data
+ * @description This reports the external APIs that are used with untrusted data, along with how
+ *              frequently the API is called, and how many unique sources of untrusted data flow
+ *              to it.
+ * @id cpp/count-untrusted-data-external-api
+ * @kind table
+ * @tags security external/cwe/cwe-20
+ */
+
+import cpp
+import ExternalAPIs
+
+from ExternalAPIUsedWithUntrustedData externalAPI
+select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses,
+  externalAPI.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
+    numberOfUntrustedSources desc

cpp/ql/src/Security/CWE/CWE-020/ExternalAPISinkExample.cpp

@@ -0,0 +1,13 @@
+#include <cstdio>
+
+void do_get(FILE* request, FILE* response) {
+  char page[1024];
+  fgets(page, 1024, request);
+
+  char buffer[1024];
+  strcat(buffer, "The page \"");
+  strcat(buffer, page);
+  strcat(buffer, "\" was not found.");
+
+  fputs(buffer, response);
+}

cpp/ql/src/Security/CWE/CWE-020/ExternalAPITaintStepExample.cpp

@@ -0,0 +1,13 @@
+#include <cstdio>
+
+void do_get(FILE* request, FILE* response) {
+  char user_id[1024];
+  fgets(user_id, 1024, request);
+
+  char buffer[1024];
+  strcat(buffer, "SELECT * FROM user WHERE user_id='");
+  strcat(buffer, user_id);
+  strcat(buffer, "'");
+
+  // ...
+}

cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll

@@ -0,0 +1,50 @@
+/**
+ * Definitions for reasoning about untrusted data used in APIs defined outside the
+ * database.
+ */
+
+private import cpp
+private import semmle.code.cpp.models.interfaces.DataFlow
+private import semmle.code.cpp.models.interfaces.Taint
+import ExternalAPIsSpecific
+
+/** A node representing untrusted data being passed to an external API. */
+class UntrustedExternalAPIDataNode extends ExternalAPIDataNode {
+  UntrustedExternalAPIDataNode() { any(UntrustedDataToExternalAPIConfig c).hasFlow(_, this) }
+
+  /** Gets a source of untrusted data which is passed to this external API data node. */
+  DataFlow::Node getAnUntrustedSource() {
+    any(UntrustedDataToExternalAPIConfig c).hasFlow(result, this)
+  }
+}
+
+private newtype TExternalAPI =
+  TExternalAPIParameter(Function f, int index) {
+    exists(UntrustedExternalAPIDataNode n |
+      f = n.getExternalFunction() and
+      index = n.getIndex()
+    )
+  }
+
+/** An external API which is used with untrusted data. */
+class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
+  /** Gets a possibly untrusted use of this external API. */
+  UntrustedExternalAPIDataNode getUntrustedDataNode() {
+    this = TExternalAPIParameter(result.getExternalFunction(), result.getIndex())
+  }
+
+  /** Gets the number of untrusted sources used with this external API. */
+  int getNumberOfUntrustedSources() {
+    result = strictcount(getUntrustedDataNode().getAnUntrustedSource())
+  }
+
+  /** Gets a textual representation of this element. */
+  string toString() {
+    exists(Function f, int index, string indexString |
+      if index = -1 then indexString = "qualifier" else indexString = "param " + index
+    |
+      this = TExternalAPIParameter(f, index) and
+      result = f.toString() + " [" + indexString + "]"
+    )
+  }
+}

cpp/ql/src/Security/CWE/CWE-020/ExternalAPIsSpecific.qll

@@ -0,0 +1,56 @@
+/**
+ * Provides AST-specific definitions for use in the `ExternalAPI` library.
+ */
+
+import semmle.code.cpp.dataflow.TaintTracking
+import semmle.code.cpp.models.interfaces.FlowSource
+import semmle.code.cpp.models.interfaces.DataFlow
+import SafeExternalAPIFunction
+
+/** A node representing untrusted data being passed to an external API. */
+class ExternalAPIDataNode extends DataFlow::Node {
+  Call call;
+  int i;
+
+  ExternalAPIDataNode() {
+    // Argument to call to a function
+    (
+      this.asExpr() = call.getArgument(i)
+      or
+      i = -1 and this.asExpr() = call.getQualifier()
+    ) and
+    exists(Function f |
+      f = call.getTarget() and
+      // Defined outside the source archive
+      not f.hasDefinition() and
+      // Not already modeled as a dataflow or taint step
+      not f instanceof DataFlowFunction and
+      not f instanceof TaintFunction and
+      // Not a call to a known safe external API
+      not f instanceof SafeExternalAPIFunction
+    )
+  }
+
+  /** Gets the called API `Function`. */
+  Function getExternalFunction() { result = call.getTarget() }
+
+  /** Gets the index which is passed untrusted data (where -1 indicates the qualifier). */
+  int getIndex() { result = i }
+
+  /** Gets the description of the function being called. */
+  string getFunctionDescription() { result = getExternalFunction().toString() }
+}
+
+/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalAPIDataNode`s. */
+class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
+  UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfig" }
+
+  override predicate isSource(DataFlow::Node source) {
+    exists(RemoteFlowFunction remoteFlow |
+      remoteFlow = source.asExpr().(Call).getTarget() and
+      remoteFlow.hasRemoteFlowSource(_, _)
+    )
+  }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalAPIDataNode }
+}

cpp/ql/src/Security/CWE/CWE-020/IRCountUntrustedDataToExternalAPI.qhelp

@@ -0,0 +1,48 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Using unsanitized untrusted data in an external API can cause a variety of security issues. This query reports 
+all external APIs that are used with untrusted data, along with how frequently the API is used, and how many 
+unique sources of untrusted data flow to this API. This query is designed primarily to help identify which APIs 
+may be relevant for security analysis of this application.</p>
+
+<p>An external API is defined as a call to a function that is not defined in the source code, and is not
+modeled as a taint step in the default taint library. External APIs may be from the C++ standard library,
+third party dependencies or from internal dependencies. The query will report the function name, along with
+either <code>[param x]</code>, where <code>x</code> indicates the position of the parameter receiving the
+untrusted data or <code>[qualifier]</code> indicating the untrusted data is used as the qualifier to the
+function call.</p>
+
+</overview>
+<recommendation>
+
+<p>For each result:</p>
+
+<ul>
+  <li>If the result highlights a known sink, no action is required.</li>
+  <li>If the result highlights an unknown sink for a problem, then add modeling for the sink to the relevant query.</li>
+  <li>If the result represents a call to an external API which transfers taint, add the appropriate modeling, and 
+  re-run the query to determine what new results have appeared due to this additional modeling.</li>
+</ul>
+
+<p>Otherwise, the result is likely uninteresting. Custom versions of this query can extend the <code>SafeExternalAPIFunction</code> 
+class to exclude known safe external APIs from future analysis.</p>
+
+</recommendation>
+<example>
+
+<p>If the query were to return the API <code>fputs [param 1]</code> 
+then we should first consider whether this a security relevant sink. In this case, this is writing to a <code>FILE*</code>, so we should 
+consider whether this is an XSS sink. If it is, we should confirm that it is handled by the XSS query.</p>
+
+<p>If the query were to return the API <code>strcat [param 1]</code>, then this should be
+reviewed as a possible taint step, because tainted data would flow from the 1st argument to the 0th argument of the call.</p>
+
+<p>Note that both examples are correctly handled by the standard taint tracking library and XSS query.</p>
+</example>
+<references>
+
+</references>
+</qhelp>

cpp/ql/src/Security/CWE/CWE-020/IRCountUntrustedDataToExternalAPI.ql

@@ -0,0 +1,17 @@
+/**
+ * @name Frequency counts for external APIs that are used with untrusted data
+ * @description This reports the external APIs that are used with untrusted data, along with how
+ *              frequently the API is called, and how many unique sources of untrusted data flow
+ *              to it.
+ * @id cpp/count-untrusted-data-external-api-ir
+ * @kind table
+ * @tags security external/cwe/cwe-20
+ */
+
+import cpp
+import ir.ExternalAPIs
+
+from ExternalAPIUsedWithUntrustedData externalAPI
+select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses,
+  externalAPI.getNumberOfUntrustedSources() as numberOfUntrustedSources order by
+    numberOfUntrustedSources desc

cpp/ql/src/Security/CWE/CWE-020/IRUntrustedDataToExternalAPI.qhelp

@@ -0,0 +1,59 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Using unsanitized untrusted data in an external API can cause a variety of security issues. This query reports 
+external APIs that use untrusted data. The results are not filtered, so you can audit all examples.
+The query provides data for security reviews of the application and you can also use it to identify external APIs
+that should be modeled as either taint steps, or sinks for specific problems.</p>
+
+<p>An external API is defined as a call to a function that is not defined in the source code, and is not modeled
+as a taint step in the default taint library. External APIs may be from the
+C++ standard library, third-party dependencies or from internal dependencies. The query reports uses of 
+untrusted data in either the qualifier or as one of the arguments of external APIs.</p>
+
+</overview>
+<recommendation>
+
+<p>For each result:</p>
+
+<ul>
+  <li>If the result highlights a known sink, confirm that the result is reported by the relevant query, or 
+  that the result is a false positive because this data is sanitized.</li>
+  <li>If the result highlights an unknown sink for a problem, then add modeling for the sink to the relevant query, 
+  and confirm that the result is either found, or is safe due to appropriate sanitization.</li>
+  <li>If the result represents a call to an external API that transfers taint, add the appropriate modeling, and 
+  re-run the query to determine what new results have appeared due to this additional modeling.</li>
+</ul>
+
+<p>Otherwise, the result is likely uninteresting. Custom versions of this query can extend the <code>SafeExternalAPIFunction</code> 
+class to exclude known safe external APIs from future analysis.</p>
+
+</recommendation>
+<example>
+
+<p>In this first example, input is read from <code>fgets</code> and then ultimately used in a call to the 
+<code>fputs</code> external API:</p>
+
+<sample src="ExternalAPISinkExample.cpp" />
+
+<p>This is an XSS sink. The XSS query should therefore be reviewed to confirm that this sink is appropriately modeled, 
+and if it is, to confirm that the query reports this particular result, or that the result is a false positive due to 
+some existing sanitization.</p>
+
+<p>In this second example, again a request parameter is read from <code>fgets</code>.</p>
+
+<sample src="ExternalAPITaintStepExample.cpp" />
+
+<p>If the query reported the call to <code>strcat</code> on line 9, this would suggest that this external API is 
+not currently modeled as a taint step in the taint tracking library. The next step would be to model this as a taint step, then
+re-run the query to determine what additional results might be found. In this example, it seems likely that <code>buffer</code>
+will be executed as an SQL query, potentially leading to an SQL injection vulnerability.</p>
+
+<p>Note that both examples are correctly handled by the standard taint tracking library and XSS query.</p>
+</example>
+<references>
+
+</references>
+</qhelp>

cpp/ql/src/Security/CWE/CWE-020/IRUntrustedDataToExternalAPI.ql

@@ -0,0 +1,21 @@
+/**
+ * @name Untrusted data passed to external API
+ * @description Data provided remotely is used in this external API without sanitization, which could be a security risk.
+ * @id cpp/untrusted-data-to-external-api-ir
+ * @kind path-problem
+ * @precision low
+ * @problem.severity error
+ * @tags security external/cwe/cwe-20
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import ir.ExternalAPIs
+import semmle.code.cpp.security.FlowSources
+import DataFlow::PathGraph
+
+from UntrustedDataToExternalAPIConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
+where config.hasFlowPath(source, sink)
+select sink, source, sink,
+  "Call to " + sink.getNode().(ExternalAPIDataNode).getExternalFunction().toString() +
+    " with untrusted data from $@.", source, source.getNode().(RemoteFlowSource).getSourceType()

cpp/ql/src/Security/CWE/CWE-020/SafeExternalAPIFunction.qll

@@ -0,0 +1,20 @@
+/**
+ * Provides a class for modeling external functions that are "safe" from a security perspective.
+ */
+
+private import cpp
+private import semmle.code.cpp.models.implementations.Pure
+
+/**
+ * A `Function` that is considered a "safe" external API from a security perspective.
+ */
+abstract class SafeExternalAPIFunction extends Function { }
+
+/** The default set of "safe" external APIs. */
+private class DefaultSafeExternalAPIFunction extends SafeExternalAPIFunction {
+  DefaultSafeExternalAPIFunction() {
+    this instanceof PureStrFunction or
+    this instanceof StrLenFunction or
+    this instanceof PureMemFunction
+  }
+}

cpp/ql/src/Security/CWE/CWE-020/UntrustedDataToExternalAPI.qhelp

@@ -0,0 +1,59 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Using unsanitized untrusted data in an external API can cause a variety of security issues. This query reports 
+external APIs that use untrusted data. The results are not filtered, so you can audit all examples.
+The query provides data for security reviews of the application and you can also use it to identify external APIs
+that should be modeled as either taint steps, or sinks for specific problems.</p>
+
+<p>An external API is defined as a call to a function that is not defined in the source code, and is not modeled
+as a taint step in the default taint library. External APIs may be from the
+C++ standard library, third-party dependencies or from internal dependencies. The query reports uses of 
+untrusted data in either the qualifier or as one of the arguments of external APIs.</p>
+
+</overview>
+<recommendation>
+
+<p>For each result:</p>
+
+<ul>
+  <li>If the result highlights a known sink, confirm that the result is reported by the relevant query, or 
+  that the result is a false positive because this data is sanitized.</li>
+  <li>If the result highlights an unknown sink for a problem, then add modeling for the sink to the relevant query, 
+  and confirm that the result is either found, or is safe due to appropriate sanitization.</li>
+  <li>If the result represents a call to an external API that transfers taint, add the appropriate modeling, and 
+  re-run the query to determine what new results have appeared due to this additional modeling.</li>
+</ul>
+
+<p>Otherwise, the result is likely uninteresting. Custom versions of this query can extend the <code>SafeExternalAPIFunction</code> 
+class to exclude known safe external APIs from future analysis.</p>
+
+</recommendation>
+<example>
+
+<p>In this first example, input is read from <code>fgets</code> and then ultimately used in a call to the 
+<code>fputs</code> external API:</p>
+
+<sample src="ExternalAPISinkExample.cpp" />
+
+<p>This is an XSS sink. The XSS query should therefore be reviewed to confirm that this sink is appropriately modeled, 
+and if it is, to confirm that the query reports this particular result, or that the result is a false positive due to 
+some existing sanitization.</p>
+
+<p>In this second example, again a request parameter is read from <code>fgets</code>.</p>
+
+<sample src="ExternalAPITaintStepExample.cpp" />
+
+<p>If the query reported the call to <code>strcat</code> on line 9, this would suggest that this external API is 
+not currently modeled as a taint step in the taint tracking library. The next step would be to model this as a taint step, then
+re-run the query to determine what additional results might be found. In this example, it seems likely that <code>buffer</code>
+will be executed as an SQL query, potentially leading to an SQL injection vulnerability.</p>
+
+<p>Note that both examples are correctly handled by the standard taint tracking library and XSS query.</p>
+</example>
+<references>
+
+</references>
+</qhelp>

cpp/ql/src/Security/CWE/CWE-020/UntrustedDataToExternalAPI.ql

@@ -0,0 +1,20 @@
+/**
+ * @name Untrusted data passed to external API
+ * @description Data provided remotely is used in this external API without sanitization, which could be a security risk.
+ * @id cpp/untrusted-data-to-external-api
+ * @kind path-problem
+ * @precision low
+ * @problem.severity error
+ * @tags security external/cwe/cwe-20
+ */
+
+import cpp
+import semmle.code.cpp.dataflow.TaintTracking
+import ExternalAPIs
+import DataFlow::PathGraph
+
+from UntrustedDataToExternalAPIConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
+where config.hasFlowPath(source, sink)
+select sink, source, sink,
+  "Call to " + sink.getNode().(ExternalAPIDataNode).getExternalFunction().toString() +
+    " with untrusted data from $@.", source, source.toString()

cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll

@@ -0,0 +1,50 @@
+/**
+ * Definitions for reasoning about untrusted data used in APIs defined outside the
+ * database.
+ */
+
+private import cpp
+private import semmle.code.cpp.models.interfaces.DataFlow
+private import semmle.code.cpp.models.interfaces.Taint
+import ExternalAPIsSpecific
+
+/** A node representing untrusted data being passed to an external API. */
+class UntrustedExternalAPIDataNode extends ExternalAPIDataNode {
+  UntrustedExternalAPIDataNode() { any(UntrustedDataToExternalAPIConfig c).hasFlow(_, this) }
+
+  /** Gets a source of untrusted data which is passed to this external API data node. */
+  DataFlow::Node getAnUntrustedSource() {
+    any(UntrustedDataToExternalAPIConfig c).hasFlow(result, this)
+  }
+}
+
+private newtype TExternalAPI =
+  TExternalAPIParameter(Function f, int index) {
+    exists(UntrustedExternalAPIDataNode n |
+      f = n.getExternalFunction() and
+      index = n.getIndex()
+    )
+  }
+
+/** An external API which is used with untrusted data. */
+class ExternalAPIUsedWithUntrustedData extends TExternalAPI {
+  /** Gets a possibly untrusted use of this external API. */
+  UntrustedExternalAPIDataNode getUntrustedDataNode() {
+    this = TExternalAPIParameter(result.getExternalFunction(), result.getIndex())
+  }
+
+  /** Gets the number of untrusted sources used with this external API. */
+  int getNumberOfUntrustedSources() {
+    result = strictcount(getUntrustedDataNode().getAnUntrustedSource())
+  }
+
+  /** Gets a textual representation of this element. */
+  string toString() {
+    exists(Function f, int index, string indexString |
+      if index = -1 then indexString = "qualifier" else indexString = "param " + index
+    |
+      this = TExternalAPIParameter(f, index) and
+      result = f.toString() + " [" + indexString + "]"
+    )
+  }
+}

cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIsSpecific.qll

@@ -0,0 +1,51 @@
+/**
+ * Provides IR-specific definitions for use in the `ExternalAPI` library.
+ */
+
+import semmle.code.cpp.ir.dataflow.TaintTracking
+private import semmle.code.cpp.security.FlowSources
+private import semmle.code.cpp.models.interfaces.DataFlow
+import SafeExternalAPIFunction
+
+/** A node representing untrusted data being passed to an external API. */
+class ExternalAPIDataNode extends DataFlow::Node {
+  Call call;
+  int i;
+
+  ExternalAPIDataNode() {
+    // Argument to call to a function
+    (
+      this.asExpr() = call.getArgument(i)
+      or
+      i = -1 and this.asExpr() = call.getQualifier()
+    ) and
+    exists(Function f |
+      f = call.getTarget() and
+      // Defined outside the source archive
+      not f.hasDefinition() and
+      // Not already modeled as a dataflow or taint step
+      not f instanceof DataFlowFunction and
+      not f instanceof TaintFunction and
+      // Not a call to a known safe external API
+      not f instanceof SafeExternalAPIFunction
+    )
+  }
+
+  /** Gets the called API `Function`. */
+  Function getExternalFunction() { result = call.getTarget() }
+
+  /** Gets the index which is passed untrusted data (where -1 indicates the qualifier). */
+  int getIndex() { result = i }
+
+  /** Gets the description of the function being called. */
+  string getFunctionDescription() { result = getExternalFunction().toString() }
+}
+
+/** A configuration for tracking flow from `RemoteFlowSource`s to `ExternalAPIDataNode`s. */
+class UntrustedDataToExternalAPIConfig extends TaintTracking::Configuration {
+  UntrustedDataToExternalAPIConfig() { this = "UntrustedDataToExternalAPIConfigIR" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink instanceof ExternalAPIDataNode }
+}

cpp/ql/src/Security/CWE/CWE-020/ir/SafeExternalAPIFunction.qll

@@ -0,0 +1,20 @@
+/**
+ * Provides a class for modeling external functions that are "safe" from a security perspective.
+ */
+
+private import cpp
+private import semmle.code.cpp.models.implementations.Pure
+
+/**
+ * A `Function` that is considered a "safe" external API from a security perspective.
+ */
+abstract class SafeExternalAPIFunction extends Function { }
+
+/** The default set of "safe" external APIs. */
+private class DefaultSafeExternalAPIFunction extends SafeExternalAPIFunction {
+  DefaultSafeExternalAPIFunction() {
+    this instanceof PureStrFunction or
+    this instanceof StrLenFunction or
+    this instanceof PureMemFunction
+  }
+}

cpp/ql/src/definitions.qll

@@ -4,6 +4,7 @@
  */
 
 import cpp
+import IDEContextual
 
 /**
  * Any element that might be the source or target of a jump-to-definition
@@ -207,11 +208,3 @@ Top definitionOf(Top e, string kind) {
   // later on.
   strictcount(result.getLocation()) < 10
 }
-
-/**
- * Returns an appropriately encoded version of a filename `name`
- * passed by the VS Code extension in order to coincide with the
- * output of `.getFile()` on locatable entities.
- */
-cached
-File getEncodedFile(string name) { result.getAbsolutePath().replaceAll(":", "_") = name }

cpp/ql/src/localDefinitions.ql

@@ -12,5 +12,5 @@ import definitions
 external string selectedSourceFile();
 
 from Top e, Top def, string kind
-where def = definitionOf(e, kind) and e.getFile() = getEncodedFile(selectedSourceFile())
+where def = definitionOf(e, kind) and e.getFile() = getFileBySourceArchiveName(selectedSourceFile())
 select e, def, kind

cpp/ql/src/localReferences.ql

@@ -12,5 +12,6 @@ import definitions
 external string selectedSourceFile();
 
 from Top e, Top def, string kind
-where def = definitionOf(e, kind) and def.getFile() = getEncodedFile(selectedSourceFile())
+where
+  def = definitionOf(e, kind) and def.getFile() = getFileBySourceArchiveName(selectedSourceFile())
 select e, def, kind

cpp/ql/src/printAst.ql

@@ -22,6 +22,6 @@ class Cfg extends PrintASTConfiguration {
    * Print All functions from the selected file.
    */
   override predicate shouldPrintFunction(Function func) {
-    func.getFile() = getEncodedFile(selectedSourceFile())
+    func.getFile() = getFileBySourceArchiveName(selectedSourceFile())
   }
 }

cpp/ql/src/semmle/code/cpp/Element.qll

@@ -65,11 +65,10 @@ class ElementBase extends @element {
    * which they belong; for example, `AddExpr` is a primary class, but
    * `BinaryOperation` is not.
    *
-   * This predicate always has a result. If no primary class can be
-   * determined, the result is `"???"`. If multiple primary classes match,
-   * this predicate can have multiple results.
+   * This predicate can have multiple results if multiple primary classes match.
+   * For some elements, this predicate may not have a result.
    */
-  string getAPrimaryQlClass() { result = "???" }
+  string getAPrimaryQlClass() { none() }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/Print.qll

@@ -304,7 +304,7 @@ private class SpecifiedDumpType extends DerivedDumpType, SpecifiedType {
       basePrefix = getBaseType().(DumpType).getDeclaratorPrefix() and
       if getBaseType().getUnspecifiedType() instanceof RoutineType
       then result = basePrefix
-      else result = basePrefix + " " + getSpecifierString().trim()
+      else result = basePrefix + " " + getSpecifierString()
     )
   }
 
@@ -312,7 +312,7 @@ private class SpecifiedDumpType extends DerivedDumpType, SpecifiedType {
     exists(string baseSuffix |
       baseSuffix = getBaseType().(DumpType).getDeclaratorSuffixBeforeQualifiers() and
       if getBaseType().getUnspecifiedType() instanceof RoutineType
-      then result = baseSuffix + " " + getSpecifierString().trim()
+      then result = baseSuffix + " " + getSpecifierString()
       else result = baseSuffix
     )
   }

cpp/ql/src/semmle/code/cpp/PrintAST.qll

@@ -91,7 +91,8 @@ private newtype TPrintASTNode =
   TDeclarationEntryNode(DeclStmt stmt, DeclarationEntry entry) {
     // We create a unique node for each pair of (stmt, entry), to avoid having one node with
     // multiple parents due to extractor bug CPP-413.
-    stmt.getADeclarationEntry() = entry
+    stmt.getADeclarationEntry() = entry and
+    shouldPrintFunction(stmt.getEnclosingFunction())
   } or
   TParametersNode(Function func) { shouldPrintFunction(func) } or
   TConstructorInitializersNode(Constructor ctor) {
@@ -234,11 +235,27 @@ class PrintASTNode extends TPrintASTNode {
   private Function getEnclosingFunction() { result = getParent*().(FunctionNode).getFunction() }
 }
 
+/**
+ * Class that restricts the elements that we compute `qlClass` for.
+ */
+private class PrintableElement extends Element {
+  PrintableElement() {
+    exists(TASTNode(this))
+    or
+    exists(TDeclarationEntryNode(_, this))
+    or
+    this instanceof Type
+  }
+
+  pragma[noinline]
+  string getAPrimaryQlClass0() { result = getAPrimaryQlClass() }
+}
+
 /**
  * Retrieves the canonical QL class(es) for entity `el`
  */
-private string qlClass(ElementBase el) {
-  result = "[" + concat(el.getAPrimaryQlClass(), ",") + "] "
+private string qlClass(PrintableElement el) {
+  result = "[" + concat(el.getAPrimaryQlClass0(), ",") + "] "
   // Alternative implementation -- do not delete. It is useful for QL class discovery.
   //result = "["+ concat(el.getAQlClass(), ",") + "] "
 }

cpp/ql/src/semmle/code/cpp/Type.qll

@@ -1304,14 +1304,16 @@ class SpecifiedType extends DerivedType {
   }
 
   /**
+   * INTERNAL: Do not use.
+   *
    * Gets all the specifiers of this type as a string in a fixed order (the order
    * only depends on the specifiers, not on the source program). This is intended
    * for debugging queries only and is an expensive operation.
    */
-  string getSpecifierString() { internalSpecString(this, result, 1) }
+  string getSpecifierString() { result = concat(this.getASpecifier().getName(), " ") }
 
   override string explain() {
-    result = this.getSpecifierString() + "{" + this.getBaseType().explain() + "}"
+    result = this.getSpecifierString() + " {" + this.getBaseType().explain() + "}"
   }
 
   override predicate isDeeplyConst() {
@@ -1710,28 +1712,6 @@ class AutoType extends TemplateParameter {
   }
 }
 
-//
-// Internal implementation predicates
-//
-private predicate allSpecifiers(int i, string s) { s = rank[i](string t | specifiers(_, t) | t) }
-
-private predicate internalSpecString(Type t, string res, int i) {
-  (
-    if allSpecifiers(i, t.getASpecifier().getName())
-    then
-      exists(string spec, string rest |
-        allSpecifiers(i, spec) and
-        res = spec + " " + rest and
-        internalSpecString(t, rest, i + 1)
-      )
-    else (
-      allSpecifiers(i, _) and internalSpecString(t, res, i + 1)
-    )
-  )
-  or
-  i = count(Specifier s) + 1 and res = ""
-}
-
 private predicate suppressUnusedThis(Type t) { any() }
 
 /** A source code location referring to a type */

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -228,7 +228,7 @@ private class ArrayContent extends Content, TArrayContent {
 private predicate fieldStoreStepNoChi(Node node1, FieldContent f, PostUpdateNode node2) {
   exists(StoreInstruction store, Class c |
     store = node2.asInstruction() and
-    store.getSourceValue() = node1.asInstruction() and
+    store.getSourceValueOperand() = node1.asOperand() and
     getWrittenField(store, f.(FieldContent).getAField(), c) and
     f.hasOffset(c, _, _)
   )
@@ -253,10 +253,10 @@ private predicate getWrittenField(Instruction instr, Field f, Class c) {
 }
 
 private predicate fieldStoreStepChi(Node node1, FieldContent f, PostUpdateNode node2) {
-  exists(StoreInstruction store, ChiInstruction chi |
-    node1.asInstruction() = store and
+  exists(ChiPartialOperand operand, ChiInstruction chi |
+    chi.getPartialOperand() = operand and
+    node1.asOperand() = operand and
     node2.asInstruction() = chi and
-    chi.getPartial() = store and
     exists(Class c |
       c = chi.getResultType() and
       exists(int startBit, int endBit |
@@ -264,7 +264,7 @@ private predicate fieldStoreStepChi(Node node1, FieldContent f, PostUpdateNode n
         f.hasOffset(c, startBit, endBit)
       )
       or
-      getWrittenField(store, f.getAField(), c) and
+      getWrittenField(operand.getDef(), f.getAField(), c) and
       f.hasOffset(c, _, _)
     )
   )
@@ -272,8 +272,13 @@ private predicate fieldStoreStepChi(Node node1, FieldContent f, PostUpdateNode n
 
 private predicate arrayStoreStepChi(Node node1, ArrayContent a, PostUpdateNode node2) {
   a = TArrayContent() and
-  exists(StoreInstruction store |
-    node1.asInstruction() = store and
+  exists(ChiPartialOperand operand, ChiInstruction chi, StoreInstruction store |
+    chi.getPartialOperand() = operand and
+    store = operand.getDef() and
+    node1.asOperand() = operand and
+    // This `ChiInstruction` will always have a non-conflated result because both `ArrayStoreNode`
+    // and `PointerStoreNode` require it in their characteristic predicates.
+    node2.asInstruction() = chi and
     (
       // `x[i] = taint()`
       // This matches the characteristic predicate in `ArrayStoreNode`.
@@ -282,10 +287,7 @@ private predicate arrayStoreStepChi(Node node1, ArrayContent a, PostUpdateNode n
       // `*p = taint()`
       // This matches the characteristic predicate in `PointerStoreNode`.
       store.getDestinationAddress().(CopyValueInstruction).getUnary() instanceof LoadInstruction
-    ) and
-    // This `ChiInstruction` will always have a non-conflated result because both `ArrayStoreNode`
-    // and `PointerStoreNode` require it in their characteristic predicates.
-    node2.asInstruction().(ChiInstruction).getPartial() = store
+    )
   )
 }
 
@@ -306,7 +308,7 @@ predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
 private predicate fieldStoreStepAfterArraySuppression(
   Node node1, FieldContent f, PostUpdateNode node2
 ) {
-  exists(BufferMayWriteSideEffectInstruction write, ChiInstruction chi, Class c |
+  exists(WriteSideEffectInstruction write, ChiInstruction chi, Class c |
     not chi.isResultConflated() and
     node1.asInstruction() = chi and
     node2.asInstruction() = chi and
@@ -334,17 +336,17 @@ private predicate getLoadedField(LoadInstruction load, Field f, Class c) {
  * `node2`.
  */
 private predicate fieldReadStep(Node node1, FieldContent f, Node node2) {
-  exists(LoadInstruction load |
-    node2.asInstruction() = load and
-    node1.asInstruction() = load.getSourceValueOperand().getAnyDef() and
+  exists(LoadOperand operand |
+    node2.asOperand() = operand and
+    node1.asInstruction() = operand.getAnyDef() and
     exists(Class c |
-      c = load.getSourceValueOperand().getAnyDef().getResultType() and
+      c = operand.getAnyDef().getResultType() and
       exists(int startBit, int endBit |
-        load.getSourceValueOperand().getUsedInterval(unbindInt(startBit), unbindInt(endBit)) and
+        operand.getUsedInterval(unbindInt(startBit), unbindInt(endBit)) and
         f.hasOffset(c, startBit, endBit)
       )
       or
-      getLoadedField(load, f.getAField(), c) and
+      getLoadedField(operand.getUse(), f.getAField(), c) and
       f.hasOffset(c, _, _)
     )
   )
@@ -365,7 +367,7 @@ private predicate fieldReadStep(Node node1, FieldContent f, Node node2) {
  */
 predicate suppressArrayRead(Node node1, ArrayContent a, Node node2) {
   a = TArrayContent() and
-  exists(BufferMayWriteSideEffectInstruction write, ChiInstruction chi |
+  exists(WriteSideEffectInstruction write, ChiInstruction chi |
     node1.asInstruction() = write and
     node2.asInstruction() = chi and
     chi.getPartial() = write and
@@ -386,20 +388,20 @@ private Instruction skipOneCopyValueInstructionRec(CopyValueInstruction copy) {
   result = skipOneCopyValueInstructionRec(copy.getUnary())
 }
 
-private Instruction skipCopyValueInstructions(Instruction instr) {
-  not result instanceof CopyValueInstruction and result = instr
+private Instruction skipCopyValueInstructions(Operand op) {
+  not result instanceof CopyValueInstruction and result = op.getDef()
   or
-  result = skipOneCopyValueInstructionRec(instr)
+  result = skipOneCopyValueInstructionRec(op.getDef())
 }
 
 private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
   a = TArrayContent() and
   // Explicit dereferences such as `*p` or `p[i]` where `p` is a pointer or array.
-  exists(LoadInstruction load, Instruction address |
-    load.getSourceValueOperand().isDefinitionInexact() and
-    node1.asInstruction() = load.getSourceValueOperand().getAnyDef() and
-    load = node2.asInstruction() and
-    address = skipCopyValueInstructions(load.getSourceAddress()) and
+  exists(LoadOperand operand, Instruction address |
+    operand.isDefinitionInexact() and
+    node1.asInstruction() = operand.getAnyDef() and
+    operand = node2.asOperand() and
+    address = skipCopyValueInstructions(operand.getAddressOperand()) and
     (
       address instanceof LoadInstruction or
       address instanceof ArrayToPointerConvertInstruction or
@@ -420,18 +422,18 @@ private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
  * use(x);
  * ```
  * the load on `x` in `use(x)` will exactly overlap with its definition (in this case the definition
- * is a `BufferMayWriteSideEffect`). This predicate pops the `ArrayContent` (pushed by the store in `f`)
+ * is a `WriteSideEffect`). This predicate pops the `ArrayContent` (pushed by the store in `f`)
  * from the access path.
  */
 private predicate exactReadStep(Node node1, ArrayContent a, Node node2) {
   a = TArrayContent() and
-  exists(BufferMayWriteSideEffectInstruction write, ChiInstruction chi |
+  exists(WriteSideEffectInstruction write, ChiInstruction chi |
     not chi.isResultConflated() and
     chi.getPartial() = write and
     node1.asInstruction() = write and
     node2.asInstruction() = chi and
     // To distinquish this case from the `arrayReadStep` case we require that the entire variable was
-    // overwritten by the `BufferMayWriteSideEffectInstruction` (i.e., there is a load that reads the
+    // overwritten by the `WriteSideEffectInstruction` (i.e., there is a load that reads the
     // entire variable).
     exists(LoadInstruction load | load.getSourceValue() = chi)
   )

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -396,16 +396,16 @@ private FieldAddressInstruction getFieldInstruction(Instruction instr) {
 
 /**
  * The target of a `fieldStoreStepAfterArraySuppression` store step, which is used to convert
- * an `ArrayContent` to a `FieldContent` when the `BufferMayWriteSideEffect` instruction stores
+ * an `ArrayContent` to a `FieldContent` when the `WriteSideEffect` instruction stores
  * into a field. See the QLDoc for `suppressArrayRead` for an example of where such a conversion
  * is inserted.
  */
-private class BufferMayWriteSideEffectFieldStoreQualifierNode extends PartialDefinitionNode {
+private class WriteSideEffectFieldStoreQualifierNode extends PartialDefinitionNode {
   override ChiInstruction instr;
-  BufferMayWriteSideEffectInstruction write;
+  WriteSideEffectInstruction write;
   FieldAddressInstruction field;
 
-  BufferMayWriteSideEffectFieldStoreQualifierNode() {
+  WriteSideEffectFieldStoreQualifierNode() {
     not instr.isResultConflated() and
     instr.getPartial() = write and
     field = getFieldInstruction(write.getDestinationAddress())

cpp/ql/src/semmle/code/cpp/ir/implementation/MemoryAccessKind.qll

@@ -10,6 +10,7 @@ private newtype TMemoryAccessKind =
   TEntireAllocationMemoryAccess() or
   TEscapedMemoryAccess() or
   TNonLocalMemoryAccess() or
+  TEscapedInitializationMemoryAccess() or
   TPhiMemoryAccess() or
   TUnmodeledMemoryAccess() or
   TChiTotalMemoryAccess() or
@@ -76,6 +77,14 @@ class NonLocalMemoryAccess extends MemoryAccessKind, TNonLocalMemoryAccess {
   override string toString() { result = "nonlocal" }
 }
 
+/**
+ * The operand or result accesses all memory whose address has escaped and can define read-only
+ * memory (such as string constants).
+ */
+class EscapedInitializationMemoryAccess extends MemoryAccessKind, TEscapedInitializationMemoryAccess {
+  override string toString() { result = "escaped(init)" }
+}
+
 /**
  * The operand is a Phi operand, which accesses the same memory as its
  * definition.

cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll

@@ -979,19 +979,8 @@ module Opcode {
   class AliasedDefinition extends Opcode, TAliasedDefinition {
     final override string toString() { result = "AliasedDefinition" }
 
-    final override MemoryAccessKind getWriteMemoryAccess() { result instanceof EscapedMemoryAccess }
-  }
-
-  /**
-   * The `Opcode` for an `InitializeNonLocalInstruction`.
-   *
-   * See the `InitializeNonLocalInstruction` documentation for more details.
-   */
-  class InitializeNonLocal extends Opcode, TInitializeNonLocal {
-    final override string toString() { result = "InitializeNonLocal" }
-
     final override MemoryAccessKind getWriteMemoryAccess() {
-      result instanceof NonLocalMemoryAccess
+      result instanceof EscapedInitializationMemoryAccess
     }
   }
 

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll

@@ -163,6 +163,46 @@ class IRBlock extends IRBlockBase {
     not strictlyDominates(result)
   }
 
+  /**
+   * Holds if this block immediately post-dominates `block`.
+   *
+   * Block `A` immediate post-dominates block `B` if block `A` strictly post-dominates block `B` and
+   * block `B` is a direct successor of block `A`.
+   */
+  final predicate immediatelyPostDominates(IRBlock block) {
+    blockImmediatelyPostDominates(this, block)
+  }
+
+  /**
+   * Holds if this block strictly post-dominates `block`.
+   *
+   * Block `A` strictly post-dominates block `B` if block `A` post-dominates block `B` and blocks `A`
+   * and `B` are not the same block.
+   */
+  final predicate strictlyPostDominates(IRBlock block) {
+    blockImmediatelyPostDominates+(this, block)
+  }
+
+  /**
+   * Holds if this block is a post-dominator of `block`.
+   *
+   * Block `A` post-dominates block `B` if any control flow path from `B` to the exit block of the
+   * function must pass through block `A`. A block always post-dominates itself.
+   */
+  final predicate postDominates(IRBlock block) { strictlyPostDominates(block) or this = block }
+
+  /**
+   * Gets a block on the post-dominance frontier of this block.
+   *
+   * The post-dominance frontier of block `A` is the set of blocks `B` such that block `A` does not
+   * post-dominate block `B`, but block `A` does post-dominate an immediate successor of block `B`.
+   */
+  pragma[noinline]
+  final IRBlock postPominanceFrontier() {
+    postDominates(result.getASuccessor()) and
+    not strictlyPostDominates(result)
+  }
+
   /**
    * Holds if this block is reachable from the entry block of its function.
    */
@@ -280,3 +320,12 @@ private module Cached {
 }
 
 private Instruction getFirstInstruction(TIRBlock block) { block = MkIRBlock(result) }
+
+private predicate blockFunctionExit(IRBlock exit) {
+  exit.getLastInstruction() instanceof ExitFunctionInstruction
+}
+
+private predicate blockPredecessor(IRBlock src, IRBlock pred) { src.getAPredecessor() = pred }
+
+private predicate blockImmediatelyPostDominates(IRBlock postDominator, IRBlock block) =
+  idominance(blockFunctionExit/1, blockPredecessor/2)(_, postDominator, block)

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll

@@ -441,34 +441,6 @@ module InstructionConsistency {
     isOnAliasedDefinitionChain(instr.(PhiInstruction).getAnInputOperand().getAnyDef())
   }
 
-  private predicate shouldBeConflated(Instruction instr) {
-    isOnAliasedDefinitionChain(instr)
-    or
-    instr.getOpcode() instanceof Opcode::InitializeNonLocal
-  }
-
-  query predicate notMarkedAsConflated(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    shouldBeConflated(instr) and
-    not instr.isResultConflated() and
-    message =
-      "Instruction '" + instr.toString() +
-        "' should be marked as having a conflated result in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
-  query predicate wronglyMarkedAsConflated(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    instr.isResultConflated() and
-    not shouldBeConflated(instr) and
-    message =
-      "Instruction '" + instr.toString() +
-        "' should not be marked as having a conflated result in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
   query predicate invalidOverlap(
     MemoryOperand useOperand, string message, OptionalIRFunction irFunc, string irFuncText
   ) {

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll

@@ -92,6 +92,11 @@ class Instruction extends Construction::TStageInstruction {
       else result = "r"
   }
 
+  private string getConflationPrefix() {
+    shouldGenerateDumpStrings() and
+    if isResultConflated() then result = "%" else result = ""
+  }
+
   /**
    * Gets the zero-based index of this instruction within its block. This is
    * used by debugging and printing code only.
@@ -143,7 +148,8 @@ class Instruction extends Construction::TStageInstruction {
    */
   final string getResultString() {
     shouldGenerateDumpStrings() and
-    result = getResultId() + "(" + getResultLanguageType().getDumpString() + ")"
+    result =
+      getConflationPrefix() + getResultId() + "(" + getResultLanguageType().getDumpString() + ")"
   }
 
   /**
@@ -584,16 +590,6 @@ class InitializeParameterInstruction extends VariableInstruction {
   final Language::Parameter getParameter() { result = var.(IRUserVariable).getVariable() }
 }
 
-/**
- * An instruction that initializes all memory that existed before this function was called.
- *
- * This instruction provides a definition for memory that, because it was actually allocated and
- * initialized elsewhere, would not otherwise have a definition in this function.
- */
-class InitializeNonLocalInstruction extends Instruction {
-  InitializeNonLocalInstruction() { getOpcode() instanceof Opcode::InitializeNonLocal }
-}
-
 /**
  * An instruction that initializes the memory pointed to by a parameter of the enclosing function
  * with the value of that memory on entry to the function.

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll

@@ -81,8 +81,11 @@ private newtype TMemoryLocation =
   TAllNonLocalMemory(IRFunction irFunc, boolean isMayAccess) {
     isMayAccess = false or isMayAccess = true
   } or
-  TAllAliasedMemory(IRFunction irFunc, boolean isMayAccess) {
-    isMayAccess = false or isMayAccess = true
+  TAllAliasedMemory(IRFunction irFunc, boolean isMayAccess, boolean canDefineReadOnly) {
+    isMayAccess = false and
+    canDefineReadOnly = [true, false]
+    or
+    isMayAccess = true and canDefineReadOnly = false
   }
 
 /**
@@ -154,7 +157,7 @@ abstract class AllocationMemoryLocation extends MemoryLocation {
 
   final override VirtualVariable getVirtualVariable() {
     if allocationEscapes(var)
-    then result = TAllAliasedMemory(var.getEnclosingIRFunction(), false)
+    then result = TAllAliasedMemory(var.getEnclosingIRFunction(), false, true)
     else result.(AllocationMemoryLocation).getAllocation() = var
   }
 
@@ -284,7 +287,9 @@ class UnknownMemoryLocation extends TUnknownMemoryLocation, MemoryLocation {
 
   final override string toStringInternal() { result = "{Unknown}" }
 
-  final override VirtualVariable getVirtualVariable() { result = TAllAliasedMemory(irFunc, false) }
+  final override VirtualVariable getVirtualVariable() {
+    result = TAllAliasedMemory(irFunc, false, true)
+  }
 
   final override Language::LanguageType getType() {
     result = any(IRUnknownType type).getCanonicalLanguageType()
@@ -325,13 +330,7 @@ class AllNonLocalMemory extends TAllNonLocalMemory, MemoryLocation {
 
   final override predicate isMayAccess() { isMayAccess = true }
 
-  override predicate canDefineReadOnly() {
-    // A "must" access that defines all non-local memory appears only on the `InitializeNonLocal`
-    // instruction, which provides the initial definition for all memory outside of the current
-    // function's stack frame. This memory includes string literals and other read-only globals, so
-    // we allow such an access to be the definition for a use of a read-only location.
-    not isMayAccess()
-  }
+  override predicate canDefineReadOnly() { none() }
 }
 
 /**
@@ -340,8 +339,9 @@ class AllNonLocalMemory extends TAllNonLocalMemory, MemoryLocation {
 class AllAliasedMemory extends TAllAliasedMemory, MemoryLocation {
   IRFunction irFunc;
   boolean isMayAccess;
+  boolean canDefineReadOnly;
 
-  AllAliasedMemory() { this = TAllAliasedMemory(irFunc, isMayAccess) }
+  AllAliasedMemory() { this = TAllAliasedMemory(irFunc, isMayAccess, canDefineReadOnly) }
 
   final override string toStringInternal() { result = "{AllAliased}" }
 
@@ -355,14 +355,18 @@ class AllAliasedMemory extends TAllAliasedMemory, MemoryLocation {
 
   final override string getUniqueId() { result = " " + toString() }
 
-  final override VirtualVariable getVirtualVariable() { result = TAllAliasedMemory(irFunc, false) }
+  final override VirtualVariable getVirtualVariable() {
+    result = TAllAliasedMemory(irFunc, false, true)
+  }
 
   final override predicate isMayAccess() { isMayAccess = true }
+
+  final override predicate canDefineReadOnly() { canDefineReadOnly = true }
 }
 
 /** A virtual variable that groups all escaped memory within a function. */
 class AliasedVirtualVariable extends AllAliasedMemory, VirtualVariable {
-  AliasedVirtualVariable() { not isMayAccess() }
+  AliasedVirtualVariable() { not isMayAccess() and canDefineReadOnly() }
 }
 
 /**
@@ -562,6 +566,9 @@ private Overlap getVariableMemoryLocationOverlap(
       use.getEndBitOffset())
 }
 
+bindingset[result, b]
+private boolean unbindBool(boolean b) { result != b.booleanNot() }
+
 MemoryLocation getResultMemoryLocation(Instruction instr) {
   exists(MemoryAccessKind kind, boolean isMayAccess |
     kind = instr.getResultMemoryAccess() and
@@ -574,7 +581,8 @@ MemoryLocation getResultMemoryLocation(Instruction instr) {
           exists(Allocation var, IRType type, IntValue startBitOffset, IntValue endBitOffset |
             hasResultMemoryAccess(instr, var, type, _, startBitOffset, endBitOffset, isMayAccess) and
             result =
-              TVariableMemoryLocation(var, type, _, startBitOffset, endBitOffset, isMayAccess)
+              TVariableMemoryLocation(var, type, _, startBitOffset, endBitOffset,
+                unbindBool(isMayAccess))
           )
         else result = TUnknownMemoryLocation(instr.getEnclosingIRFunction(), isMayAccess)
       )
@@ -582,10 +590,13 @@ MemoryLocation getResultMemoryLocation(Instruction instr) {
       kind instanceof EntireAllocationMemoryAccess and
       result =
         TEntireAllocationMemoryLocation(getAddressOperandAllocation(instr.getResultAddressOperand()),
-          isMayAccess)
+          unbindBool(isMayAccess))
       or
       kind instanceof EscapedMemoryAccess and
-      result = TAllAliasedMemory(instr.getEnclosingIRFunction(), isMayAccess)
+      result = TAllAliasedMemory(instr.getEnclosingIRFunction(), isMayAccess, false)
+      or
+      kind instanceof EscapedInitializationMemoryAccess and
+      result = TAllAliasedMemory(instr.getEnclosingIRFunction(), false, true)
       or
       kind instanceof NonLocalMemoryAccess and
       result = TAllNonLocalMemory(instr.getEnclosingIRFunction(), isMayAccess)
@@ -616,7 +627,10 @@ MemoryLocation getOperandMemoryLocation(MemoryOperand operand) {
           isMayAccess)
       or
       kind instanceof EscapedMemoryAccess and
-      result = TAllAliasedMemory(operand.getEnclosingIRFunction(), isMayAccess)
+      result = TAllAliasedMemory(operand.getEnclosingIRFunction(), isMayAccess, false)
+      or
+      kind instanceof EscapedInitializationMemoryAccess and
+      result = TAllAliasedMemory(operand.getEnclosingIRFunction(), false, true)
       or
       kind instanceof NonLocalMemoryAccess and
       result = TAllNonLocalMemory(operand.getEnclosingIRFunction(), isMayAccess)

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll

@@ -68,8 +68,6 @@ private module Cached {
   predicate hasConflatedMemoryResult(Instruction instruction) {
     instruction instanceof AliasedDefinitionInstruction
     or
-    instruction.getOpcode() instanceof Opcode::InitializeNonLocal
-    or
     // Chi instructions track virtual variables, and therefore a chi instruction is
     // conflated if it's associated with the aliased virtual variable.
     exists(OldInstruction oldInstruction | instruction = getChi(oldInstruction) |

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRBlock.qll

@@ -163,6 +163,46 @@ class IRBlock extends IRBlockBase {
     not strictlyDominates(result)
   }
 
+  /**
+   * Holds if this block immediately post-dominates `block`.
+   *
+   * Block `A` immediate post-dominates block `B` if block `A` strictly post-dominates block `B` and
+   * block `B` is a direct successor of block `A`.
+   */
+  final predicate immediatelyPostDominates(IRBlock block) {
+    blockImmediatelyPostDominates(this, block)
+  }
+
+  /**
+   * Holds if this block strictly post-dominates `block`.
+   *
+   * Block `A` strictly post-dominates block `B` if block `A` post-dominates block `B` and blocks `A`
+   * and `B` are not the same block.
+   */
+  final predicate strictlyPostDominates(IRBlock block) {
+    blockImmediatelyPostDominates+(this, block)
+  }
+
+  /**
+   * Holds if this block is a post-dominator of `block`.
+   *
+   * Block `A` post-dominates block `B` if any control flow path from `B` to the exit block of the
+   * function must pass through block `A`. A block always post-dominates itself.
+   */
+  final predicate postDominates(IRBlock block) { strictlyPostDominates(block) or this = block }
+
+  /**
+   * Gets a block on the post-dominance frontier of this block.
+   *
+   * The post-dominance frontier of block `A` is the set of blocks `B` such that block `A` does not
+   * post-dominate block `B`, but block `A` does post-dominate an immediate successor of block `B`.
+   */
+  pragma[noinline]
+  final IRBlock postPominanceFrontier() {
+    postDominates(result.getASuccessor()) and
+    not strictlyPostDominates(result)
+  }
+
   /**
    * Holds if this block is reachable from the entry block of its function.
    */
@@ -280,3 +320,12 @@ private module Cached {
 }
 
 private Instruction getFirstInstruction(TIRBlock block) { block = MkIRBlock(result) }
+
+private predicate blockFunctionExit(IRBlock exit) {
+  exit.getLastInstruction() instanceof ExitFunctionInstruction
+}
+
+private predicate blockPredecessor(IRBlock src, IRBlock pred) { src.getAPredecessor() = pred }
+
+private predicate blockImmediatelyPostDominates(IRBlock postDominator, IRBlock block) =
+  idominance(blockFunctionExit/1, blockPredecessor/2)(_, postDominator, block)

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll

@@ -441,34 +441,6 @@ module InstructionConsistency {
     isOnAliasedDefinitionChain(instr.(PhiInstruction).getAnInputOperand().getAnyDef())
   }
 
-  private predicate shouldBeConflated(Instruction instr) {
-    isOnAliasedDefinitionChain(instr)
-    or
-    instr.getOpcode() instanceof Opcode::InitializeNonLocal
-  }
-
-  query predicate notMarkedAsConflated(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    shouldBeConflated(instr) and
-    not instr.isResultConflated() and
-    message =
-      "Instruction '" + instr.toString() +
-        "' should be marked as having a conflated result in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
-  query predicate wronglyMarkedAsConflated(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    instr.isResultConflated() and
-    not shouldBeConflated(instr) and
-    message =
-      "Instruction '" + instr.toString() +
-        "' should not be marked as having a conflated result in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
   query predicate invalidOverlap(
     MemoryOperand useOperand, string message, OptionalIRFunction irFunc, string irFuncText
   ) {

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll

@@ -92,6 +92,11 @@ class Instruction extends Construction::TStageInstruction {
       else result = "r"
   }
 
+  private string getConflationPrefix() {
+    shouldGenerateDumpStrings() and
+    if isResultConflated() then result = "%" else result = ""
+  }
+
   /**
    * Gets the zero-based index of this instruction within its block. This is
    * used by debugging and printing code only.
@@ -143,7 +148,8 @@ class Instruction extends Construction::TStageInstruction {
    */
   final string getResultString() {
     shouldGenerateDumpStrings() and
-    result = getResultId() + "(" + getResultLanguageType().getDumpString() + ")"
+    result =
+      getConflationPrefix() + getResultId() + "(" + getResultLanguageType().getDumpString() + ")"
   }
 
   /**
@@ -584,16 +590,6 @@ class InitializeParameterInstruction extends VariableInstruction {
   final Language::Parameter getParameter() { result = var.(IRUserVariable).getVariable() }
 }
 
-/**
- * An instruction that initializes all memory that existed before this function was called.
- *
- * This instruction provides a definition for memory that, because it was actually allocated and
- * initialized elsewhere, would not otherwise have a definition in this function.
- */
-class InitializeNonLocalInstruction extends Instruction {
-  InitializeNonLocalInstruction() { getOpcode() instanceof Opcode::InitializeNonLocal }
-}
-
 /**
  * An instruction that initializes the memory pointed to by a parameter of the enclosing function
  * with the value of that memory on entry to the function.

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll

@@ -166,8 +166,6 @@ predicate hasModeledMemoryResult(Instruction instruction) { none() }
 
 predicate hasConflatedMemoryResult(Instruction instruction) {
   instruction instanceof AliasedDefinitionInstruction
-  or
-  instruction.getOpcode() instanceof Opcode::InitializeNonLocal
 }
 
 Instruction getRegisterOperandDefinition(Instruction instruction, RegisterOperandTag tag) {

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll

@@ -28,7 +28,6 @@ newtype TInstructionTag =
   ReturnTag() or
   ExitFunctionTag() or
   AliasedDefinitionTag() or
-  InitializeNonLocalTag() or
   AliasedUseTag() or
   SwitchBranchTag() or
   CallTargetTag() or
@@ -128,8 +127,6 @@ string getInstructionTagId(TInstructionTag tag) {
   or
   tag = AliasedDefinitionTag() and result = "AliasedDef"
   or
-  tag = InitializeNonLocalTag() and result = "InitNonLocal"
-  or
   tag = AliasedUseTag() and result = "AliasedUse"
   or
   tag = SwitchBranchTag() and result = "SwitchBranch"

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll

@@ -114,11 +114,8 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
       tag = EnterFunctionTag() and
       result = getInstruction(AliasedDefinitionTag())
       or
-      tag = AliasedDefinitionTag() and
-      result = getInstruction(InitializeNonLocalTag())
-      or
       (
-        tag = InitializeNonLocalTag() and
+        tag = AliasedDefinitionTag() and
         if exists(getThisType())
         then result = getParameter(-1).getFirstInstruction()
         else
@@ -176,10 +173,6 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
       opcode instanceof Opcode::AliasedDefinition and
       resultType = getUnknownType()
       or
-      tag = InitializeNonLocalTag() and
-      opcode instanceof Opcode::InitializeNonLocal and
-      resultType = getUnknownType()
-      or
       tag = ReturnValueAddressTag() and
       opcode instanceof Opcode::VariableAddress and
       resultType = getTypeForGLValue(getReturnType()) and

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll

@@ -163,6 +163,46 @@ class IRBlock extends IRBlockBase {
     not strictlyDominates(result)
   }
 
+  /**
+   * Holds if this block immediately post-dominates `block`.
+   *
+   * Block `A` immediate post-dominates block `B` if block `A` strictly post-dominates block `B` and
+   * block `B` is a direct successor of block `A`.
+   */
+  final predicate immediatelyPostDominates(IRBlock block) {
+    blockImmediatelyPostDominates(this, block)
+  }
+
+  /**
+   * Holds if this block strictly post-dominates `block`.
+   *
+   * Block `A` strictly post-dominates block `B` if block `A` post-dominates block `B` and blocks `A`
+   * and `B` are not the same block.
+   */
+  final predicate strictlyPostDominates(IRBlock block) {
+    blockImmediatelyPostDominates+(this, block)
+  }
+
+  /**
+   * Holds if this block is a post-dominator of `block`.
+   *
+   * Block `A` post-dominates block `B` if any control flow path from `B` to the exit block of the
+   * function must pass through block `A`. A block always post-dominates itself.
+   */
+  final predicate postDominates(IRBlock block) { strictlyPostDominates(block) or this = block }
+
+  /**
+   * Gets a block on the post-dominance frontier of this block.
+   *
+   * The post-dominance frontier of block `A` is the set of blocks `B` such that block `A` does not
+   * post-dominate block `B`, but block `A` does post-dominate an immediate successor of block `B`.
+   */
+  pragma[noinline]
+  final IRBlock postPominanceFrontier() {
+    postDominates(result.getASuccessor()) and
+    not strictlyPostDominates(result)
+  }
+
   /**
    * Holds if this block is reachable from the entry block of its function.
    */
@@ -280,3 +320,12 @@ private module Cached {
 }
 
 private Instruction getFirstInstruction(TIRBlock block) { block = MkIRBlock(result) }
+
+private predicate blockFunctionExit(IRBlock exit) {
+  exit.getLastInstruction() instanceof ExitFunctionInstruction
+}
+
+private predicate blockPredecessor(IRBlock src, IRBlock pred) { src.getAPredecessor() = pred }
+
+private predicate blockImmediatelyPostDominates(IRBlock postDominator, IRBlock block) =
+  idominance(blockFunctionExit/1, blockPredecessor/2)(_, postDominator, block)

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll

@@ -441,34 +441,6 @@ module InstructionConsistency {
     isOnAliasedDefinitionChain(instr.(PhiInstruction).getAnInputOperand().getAnyDef())
   }
 
-  private predicate shouldBeConflated(Instruction instr) {
-    isOnAliasedDefinitionChain(instr)
-    or
-    instr.getOpcode() instanceof Opcode::InitializeNonLocal
-  }
-
-  query predicate notMarkedAsConflated(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    shouldBeConflated(instr) and
-    not instr.isResultConflated() and
-    message =
-      "Instruction '" + instr.toString() +
-        "' should be marked as having a conflated result in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
-  query predicate wronglyMarkedAsConflated(
-    Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
-  ) {
-    instr.isResultConflated() and
-    not shouldBeConflated(instr) and
-    message =
-      "Instruction '" + instr.toString() +
-        "' should not be marked as having a conflated result in function '$@'." and
-    irFunc = getInstructionIRFunction(instr, irFuncText)
-  }
-
   query predicate invalidOverlap(
     MemoryOperand useOperand, string message, OptionalIRFunction irFunc, string irFuncText
   ) {

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll

@@ -92,6 +92,11 @@ class Instruction extends Construction::TStageInstruction {
       else result = "r"
   }
 
+  private string getConflationPrefix() {
+    shouldGenerateDumpStrings() and
+    if isResultConflated() then result = "%" else result = ""
+  }
+
   /**
    * Gets the zero-based index of this instruction within its block. This is
    * used by debugging and printing code only.
@@ -143,7 +148,8 @@ class Instruction extends Construction::TStageInstruction {
    */
   final string getResultString() {
     shouldGenerateDumpStrings() and
-    result = getResultId() + "(" + getResultLanguageType().getDumpString() + ")"
+    result =
+      getConflationPrefix() + getResultId() + "(" + getResultLanguageType().getDumpString() + ")"
   }
 
   /**
@@ -584,16 +590,6 @@ class InitializeParameterInstruction extends VariableInstruction {
   final Language::Parameter getParameter() { result = var.(IRUserVariable).getVariable() }
 }
 
-/**
- * An instruction that initializes all memory that existed before this function was called.
- *
- * This instruction provides a definition for memory that, because it was actually allocated and
- * initialized elsewhere, would not otherwise have a definition in this function.
- */
-class InitializeNonLocalInstruction extends Instruction {
-  InitializeNonLocalInstruction() { getOpcode() instanceof Opcode::InitializeNonLocal }
-}
-
 /**
  * An instruction that initializes the memory pointed to by a parameter of the enclosing function
  * with the value of that memory on entry to the function.

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll

@@ -68,8 +68,6 @@ private module Cached {
   predicate hasConflatedMemoryResult(Instruction instruction) {
     instruction instanceof AliasedDefinitionInstruction
     or
-    instruction.getOpcode() instanceof Opcode::InitializeNonLocal
-    or
     // Chi instructions track virtual variables, and therefore a chi instruction is
     // conflated if it's associated with the aliased virtual variable.
     exists(OldInstruction oldInstruction | instruction = getChi(oldInstruction) |

cpp/ql/src/semmle/code/cpp/models/Models.qll

@@ -1,6 +1,7 @@
 private import implementations.Allocation
 private import implementations.Deallocation
 private import implementations.Fread
+private import implementations.Getenv
 private import implementations.Gets
 private import implementations.IdentityFunction
 private import implementations.Inet

cpp/ql/src/semmle/code/cpp/models/implementations/Getenv.qll

@@ -0,0 +1,21 @@
+/**
+ * Provides an implementation class modeling the POSIX function `getenv`.
+ */
+
+import cpp
+import semmle.code.cpp.models.interfaces.FlowSource
+
+/**
+ * The POSIX function `getenv`.
+ */
+class Getenv extends LocalFlowFunction {
+  Getenv() { this.hasGlobalName("getenv") }
+
+  override predicate hasLocalFlowSource(FunctionOutput output, string description) {
+    (
+      output.isReturnValueDeref() or
+      output.isReturnValue()
+    ) and
+    description = "an environment variable"
+  }
+}

cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll

@@ -3,8 +3,8 @@ import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.Alias
 import semmle.code.cpp.models.interfaces.SideEffect
 
-private class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction,
-  SideEffectFunction {
+/** Pure string functions. */
+private class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction, SideEffectFunction {
   PureStrFunction() {
     hasGlobalOrStdName([
         "atof", "atoi", "atol", "atoll", "strcasestr", "strchnul", "strchr", "strchrnul", "strstr",
@@ -59,6 +59,7 @@ private class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunctio
   }
 }
 
+/** String standard `strlen` function, and related functions for computing string lengths. */
 private class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFunction {
   StrLenFunction() {
     hasGlobalOrStdName(["strlen", "strnlen", "wcslen"])
@@ -92,6 +93,7 @@ private class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFun
   }
 }
 
+/** Pure functions. */
 private class PureFunction extends TaintFunction, SideEffectFunction {
   PureFunction() { hasGlobalOrStdName(["abs", "labs"]) }
 
@@ -107,3 +109,49 @@ private class PureFunction extends TaintFunction, SideEffectFunction {
 
   override predicate hasOnlySpecificWriteSideEffects() { any() }
 }
+
+/** Pure raw-memory functions. */
+class PureMemFunction extends AliasFunction, ArrayFunction, TaintFunction, SideEffectFunction {
+  PureMemFunction() { hasGlobalOrStdName(["memchr", "memrchr", "rawmemchr", "memcmp", "memmem"]) }
+
+  override predicate hasArrayInput(int bufParam) {
+    getParameter(bufParam).getUnspecifiedType() instanceof PointerType
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    exists(ParameterIndex i |
+      input.isParameter(i) and
+      exists(getParameter(i))
+      or
+      input.isParameterDeref(i) and
+      getParameter(i).getUnspecifiedType() instanceof PointerType
+    ) and
+    (
+      output.isReturnValueDeref() and
+      getUnspecifiedType() instanceof PointerType
+      or
+      output.isReturnValue()
+    )
+  }
+
+  override predicate parameterNeverEscapes(int i) {
+    getParameter(i).getUnspecifiedType() instanceof PointerType and
+    not parameterEscapesOnlyViaReturn(i)
+  }
+
+  override predicate parameterEscapesOnlyViaReturn(int i) {
+    i = 0 and
+    getUnspecifiedType() instanceof PointerType
+  }
+
+  override predicate parameterIsAlwaysReturned(int i) { none() }
+
+  override predicate hasOnlySpecificReadSideEffects() { any() }
+
+  override predicate hasOnlySpecificWriteSideEffects() { any() }
+
+  override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) {
+    getParameter(i).getUnspecifiedType() instanceof PointerType and
+    buffer = true
+  }
+}

cpp/ql/src/semmle/code/cpp/models/interfaces/FlowSource.qll

@@ -11,7 +11,7 @@ import FunctionInputsAndOutputs
 import semmle.code.cpp.models.Models
 
 /**
- * A library function which returns data read from a network connection.
+ * A library function that returns data that may be read from a network connection.
  */
 abstract class RemoteFlowFunction extends Function {
   /**
@@ -19,3 +19,13 @@ abstract class RemoteFlowFunction extends Function {
    */
   abstract predicate hasRemoteFlowSource(FunctionOutput output, string description);
 }
+
+/**
+ * A library function that returns data that is directly controlled by a user.
+ */
+abstract class LocalFlowFunction extends Function {
+  /**
+   * Holds if data described by `description` flows from `output` of a call to this function.
+   */
+  abstract predicate hasLocalFlowSource(FunctionOutput output, string description);
+}

cpp/ql/src/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll

@@ -132,6 +132,16 @@ class FunctionInput extends TFunctionInput {
    * part of itself, or one of its other inputs.
    */
   predicate isReturnValueDeref() { none() }
+
+  /**
+   * Holds if `i >= 0` and `isParameterDeref(i)` holds for this is value, or
+   * if `i = -1` and `isQualifierObject()` holds for this value.
+   */
+  final predicate isParameterDerefOrQualifierObject(ParameterIndex i) {
+    i >= 0 and this.isParameterDeref(i)
+    or
+    i = -1 and this.isQualifierObject()
+  }
 }
 
 /**
@@ -370,6 +380,16 @@ class FunctionOutput extends TFunctionOutput {
    * DEPRECATED: Use `isReturnValueDeref()` instead.
    */
   deprecated final predicate isOutReturnPointer() { isReturnValueDeref() }
+
+  /**
+   * Holds if `i >= 0` and `isParameterDeref(i)` holds for this is the value, or
+   * if `i = -1` and `isQualifierObject()` holds for this value.
+   */
+  final predicate isParameterDerefOrQualifierObject(ParameterIndex i) {
+    i >= 0 and this.isParameterDeref(i)
+    or
+    i = -1 and this.isQualifierObject()
+  }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/security/FlowSources.qll

@@ -7,38 +7,94 @@ import semmle.code.cpp.ir.dataflow.DataFlow
 private import semmle.code.cpp.ir.IR
 import semmle.code.cpp.models.interfaces.FlowSource
 
-/** A data flow source of remote user input. */
-abstract class RemoteFlowSource extends DataFlow::Node {
-  /** Gets a string that describes the type of this remote flow source. */
+/** A data flow source of user input, whether local or remote. */
+abstract class FlowSource extends DataFlow::Node {
+  /** Gets a string that describes the type of this flow source. */
   abstract string getSourceType();
 }
 
-private class TaintedReturnSource extends RemoteFlowSource {
+/** A data flow source of remote user input. */
+abstract class RemoteFlowSource extends FlowSource { }
+
+/** A data flow source of local user input. */
+abstract class LocalFlowSource extends FlowSource { }
+
+private class RemoteReturnSource extends RemoteFlowSource {
   string sourceType;
 
-  TaintedReturnSource() {
+  RemoteReturnSource() {
     exists(RemoteFlowFunction func, CallInstruction instr, FunctionOutput output |
       asInstruction() = instr and
       instr.getStaticCallTarget() = func and
       func.hasRemoteFlowSource(output, sourceType) and
-      output.isReturnValue()
+      (
+        output.isReturnValue()
+        or
+        output.isReturnValueDeref()
+      )
     )
   }
 
   override string getSourceType() { result = sourceType }
 }
 
-private class TaintedParameterSource extends RemoteFlowSource {
+private class RemoteParameterSource extends RemoteFlowSource {
   string sourceType;
 
-  TaintedParameterSource() {
+  RemoteParameterSource() {
     exists(RemoteFlowFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
       asInstruction() = instr and
       instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
       func.hasRemoteFlowSource(output, sourceType) and
-      output.isParameterDeref(instr.getIndex())
+      output.isParameterDerefOrQualifierObject(instr.getIndex())
     )
   }
 
   override string getSourceType() { result = sourceType }
 }
+
+private class LocalReturnSource extends LocalFlowSource {
+  string sourceType;
+
+  LocalReturnSource() {
+    exists(LocalFlowFunction func, CallInstruction instr, FunctionOutput output |
+      asInstruction() = instr and
+      instr.getStaticCallTarget() = func and
+      func.hasLocalFlowSource(output, sourceType) and
+      (
+        output.isReturnValue()
+        or
+        output.isReturnValueDeref()
+      )
+    )
+  }
+
+  override string getSourceType() { result = sourceType }
+}
+
+private class LocalParameterSource extends LocalFlowSource {
+  string sourceType;
+
+  LocalParameterSource() {
+    exists(LocalFlowFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
+      asInstruction() = instr and
+      instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
+      func.hasLocalFlowSource(output, sourceType) and
+      output.isParameterDerefOrQualifierObject(instr.getIndex())
+    )
+  }
+
+  override string getSourceType() { result = sourceType }
+}
+
+private class ArgvSource extends LocalFlowSource {
+  ArgvSource() {
+    exists(Parameter argv |
+      argv.hasName("argv") and
+      argv.getFunction().hasGlobalName("main") and
+      this.asExpr() = argv.getAnAccess()
+    )
+  }
+
+  override string getSourceType() { result = "a command-line argument" }
+}

cpp/ql/test/library-tests/clang_ms/element.expected

@@ -76,6 +76,7 @@
 | file://:0:0:0:0 | declaration of 1st parameter |
 | file://:0:0:0:0 | declaration of 1st parameter |
 | file://:0:0:0:0 | declared_constexpr |
+| file://:0:0:0:0 | declared_constinit |
 | file://:0:0:0:0 | decltype(nullptr) |
 | file://:0:0:0:0 | definition of fp_offset |
 | file://:0:0:0:0 | definition of gp_offset |

cpp/ql/test/library-tests/conditions/elements.expected

@@ -46,6 +46,7 @@
 | file://:0:0:0:0 | const __va_list_tag |
 | file://:0:0:0:0 | const __va_list_tag & |
 | file://:0:0:0:0 | declared_constexpr |
+| file://:0:0:0:0 | declared_constinit |
 | file://:0:0:0:0 | decltype(nullptr) |
 | file://:0:0:0:0 | definition of <error> |
 | file://:0:0:0:0 | definition of fp_offset |

cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

@@ -121,6 +121,14 @@ postWithInFlow
 | complex.cpp:12:22:12:27 | Chi | PostUpdateNode should not be the target of local flow. |
 | complex.cpp:14:26:14:26 | Chi | PostUpdateNode should not be the target of local flow. |
 | complex.cpp:14:33:14:33 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:22:11:22:17 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:25:7:25:7 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:42:16:42:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:43:16:43:16 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:53:12:53:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:54:12:54:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:55:12:55:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| complex.cpp:56:12:56:12 | Chi | PostUpdateNode should not be the target of local flow. |
 | constructors.cpp:20:24:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
 | constructors.cpp:21:24:21:29 | Chi | PostUpdateNode should not be the target of local flow. |
 | constructors.cpp:23:28:23:28 | Chi | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected

@@ -4,9 +4,8 @@ edges
 | A.cpp:55:12:55:19 | new | A.cpp:55:5:55:5 | set output argument [c] |
 | A.cpp:57:11:57:24 | B output argument [c] | A.cpp:57:28:57:30 | call to get |
 | A.cpp:57:17:57:23 | new | A.cpp:57:11:57:24 | B output argument [c] |
-| A.cpp:98:12:98:18 | new | A.cpp:100:5:100:13 | Store |
+| A.cpp:98:12:98:18 | new | A.cpp:100:5:100:13 | Chi [a] |
 | A.cpp:100:5:100:13 | Chi [a] | A.cpp:103:14:103:14 | *c [a] |
-| A.cpp:100:5:100:13 | Store | A.cpp:100:5:100:13 | Chi [a] |
 | A.cpp:103:14:103:14 | *c [a] | A.cpp:107:16:107:16 | a |
 | A.cpp:126:5:126:5 | Chi [c] | A.cpp:131:8:131:8 | f7 output argument [c] |
 | A.cpp:126:5:126:5 | set output argument [c] | A.cpp:126:5:126:5 | Chi [c] |
@@ -14,11 +13,9 @@ edges
 | A.cpp:131:8:131:8 | Chi [c] | A.cpp:132:13:132:13 | c |
 | A.cpp:131:8:131:8 | f7 output argument [c] | A.cpp:131:8:131:8 | Chi [c] |
 | A.cpp:142:7:142:20 | Chi [c] | A.cpp:151:18:151:18 | D output argument [c] |
-| A.cpp:142:7:142:20 | Store | A.cpp:142:7:142:20 | Chi [c] |
-| A.cpp:142:14:142:20 | new | A.cpp:142:7:142:20 | Store |
+| A.cpp:142:14:142:20 | new | A.cpp:142:7:142:20 | Chi [c] |
 | A.cpp:143:7:143:31 | Chi [b] | A.cpp:151:12:151:24 | D output argument [b] |
-| A.cpp:143:7:143:31 | Store | A.cpp:143:7:143:31 | Chi [b] |
-| A.cpp:143:25:143:31 | new | A.cpp:143:7:143:31 | Store |
+| A.cpp:143:25:143:31 | new | A.cpp:143:7:143:31 | Chi [b] |
 | A.cpp:150:12:150:18 | new | A.cpp:151:12:151:24 | D output argument [b] |
 | A.cpp:151:12:151:24 | Chi [b] | A.cpp:152:13:152:13 | b |
 | A.cpp:151:12:151:24 | D output argument [b] | A.cpp:151:12:151:24 | Chi [b] |
@@ -27,20 +24,16 @@ edges
 | C.cpp:18:12:18:18 | C output argument [s1] | C.cpp:27:8:27:11 | *#this [s1] |
 | C.cpp:18:12:18:18 | C output argument [s3] | C.cpp:27:8:27:11 | *#this [s3] |
 | C.cpp:22:12:22:21 | Chi [s1] | C.cpp:24:5:24:25 | Chi [s1] |
-| C.cpp:22:12:22:21 | Store | C.cpp:22:12:22:21 | Chi [s1] |
-| C.cpp:22:12:22:21 | new | C.cpp:22:12:22:21 | Store |
+| C.cpp:22:12:22:21 | new | C.cpp:22:12:22:21 | Chi [s1] |
 | C.cpp:24:5:24:25 | Chi [s1] | C.cpp:18:12:18:18 | C output argument [s1] |
 | C.cpp:24:5:24:25 | Chi [s3] | C.cpp:18:12:18:18 | C output argument [s3] |
-| C.cpp:24:5:24:25 | Store | C.cpp:24:5:24:25 | Chi [s3] |
-| C.cpp:24:16:24:25 | new | C.cpp:24:5:24:25 | Store |
+| C.cpp:24:16:24:25 | new | C.cpp:24:5:24:25 | Chi [s3] |
 | C.cpp:27:8:27:11 | *#this [s1] | C.cpp:29:10:29:11 | s1 |
 | C.cpp:27:8:27:11 | *#this [s3] | C.cpp:31:10:31:11 | s3 |
 | aliasing.cpp:9:3:9:22 | Chi [m1] | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] |
-| aliasing.cpp:9:3:9:22 | Store | aliasing.cpp:9:3:9:22 | Chi [m1] |
-| aliasing.cpp:9:11:9:20 | call to user_input | aliasing.cpp:9:3:9:22 | Store |
+| aliasing.cpp:9:11:9:20 | call to user_input | aliasing.cpp:9:3:9:22 | Chi [m1] |
 | aliasing.cpp:13:3:13:21 | Chi [m1] | aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] |
-| aliasing.cpp:13:3:13:21 | Store | aliasing.cpp:13:3:13:21 | Chi [m1] |
-| aliasing.cpp:13:10:13:19 | call to user_input | aliasing.cpp:13:3:13:21 | Store |
+| aliasing.cpp:13:10:13:19 | call to user_input | aliasing.cpp:13:3:13:21 | Chi [m1] |
 | aliasing.cpp:25:17:25:19 | Chi [m1] | aliasing.cpp:29:11:29:12 | m1 |
 | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] | aliasing.cpp:25:17:25:19 | Chi [m1] |
 | aliasing.cpp:26:19:26:20 | Chi [m1] | aliasing.cpp:30:11:30:12 | m1 |
@@ -48,15 +41,13 @@ edges
 | aliasing.cpp:37:13:37:22 | call to user_input | aliasing.cpp:38:11:38:12 | m1 |
 | aliasing.cpp:42:11:42:20 | call to user_input | aliasing.cpp:43:13:43:14 | m1 |
 | aliasing.cpp:60:3:60:22 | Chi [m1] | aliasing.cpp:61:13:61:14 | Store [m1] |
-| aliasing.cpp:60:3:60:22 | Store | aliasing.cpp:60:3:60:22 | Chi [m1] |
-| aliasing.cpp:60:11:60:20 | call to user_input | aliasing.cpp:60:3:60:22 | Store |
+| aliasing.cpp:60:11:60:20 | call to user_input | aliasing.cpp:60:3:60:22 | Chi [m1] |
 | aliasing.cpp:61:13:61:14 | Store [m1] | aliasing.cpp:62:14:62:15 | m1 |
 | aliasing.cpp:79:11:79:20 | call to user_input | aliasing.cpp:80:12:80:13 | m1 |
 | aliasing.cpp:86:10:86:19 | call to user_input | aliasing.cpp:87:12:87:13 | m1 |
 | aliasing.cpp:92:12:92:21 | call to user_input | aliasing.cpp:93:12:93:13 | m1 |
 | aliasing.cpp:98:3:98:21 | Chi [m1] | aliasing.cpp:100:14:100:14 | Store [m1] |
-| aliasing.cpp:98:3:98:21 | Store | aliasing.cpp:98:3:98:21 | Chi [m1] |
-| aliasing.cpp:98:10:98:19 | call to user_input | aliasing.cpp:98:3:98:21 | Store |
+| aliasing.cpp:98:10:98:19 | call to user_input | aliasing.cpp:98:3:98:21 | Chi [m1] |
 | aliasing.cpp:100:14:100:14 | Store [m1] | aliasing.cpp:102:8:102:10 | * ... |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:121:15:121:16 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:126:15:126:20 | taint_a_ptr output argument [array content] |
@@ -67,8 +58,7 @@ edges
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:175:15:175:22 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:187:15:187:22 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:200:15:200:24 | taint_a_ptr output argument [array content] |
-| aliasing.cpp:106:3:106:20 | Store | aliasing.cpp:106:3:106:20 | Chi [array content] |
-| aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:106:3:106:20 | Store |
+| aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:106:3:106:20 | Chi [array content] |
 | aliasing.cpp:121:15:121:16 | Chi [array content] | aliasing.cpp:122:8:122:12 | access to array |
 | aliasing.cpp:121:15:121:16 | taint_a_ptr output argument [array content] | aliasing.cpp:121:15:121:16 | Chi [array content] |
 | aliasing.cpp:126:15:126:20 | Chi [array content] | aliasing.cpp:127:8:127:16 | * ... |
@@ -106,20 +96,16 @@ edges
 | by_reference.cpp:68:21:68:30 | call to user_input | by_reference.cpp:68:17:68:18 | nonMemberSetA output argument [a] |
 | by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] |
 | by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:84:3:84:25 | Store | by_reference.cpp:84:3:84:25 | Chi [a] |
-| by_reference.cpp:84:14:84:23 | call to user_input | by_reference.cpp:84:3:84:25 | Store |
+| by_reference.cpp:84:14:84:23 | call to user_input | by_reference.cpp:84:3:84:25 | Chi [a] |
 | by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] |
 | by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:88:3:88:24 | Store | by_reference.cpp:88:3:88:24 | Chi [a] |
-| by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:88:3:88:24 | Store |
+| by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:88:3:88:24 | Chi [a] |
 | by_reference.cpp:92:3:92:20 | Chi [array content] | by_reference.cpp:104:15:104:22 | taint_a_ptr output argument [array content] |
 | by_reference.cpp:92:3:92:20 | Chi [array content] | by_reference.cpp:108:15:108:24 | taint_a_ptr output argument [array content] |
-| by_reference.cpp:92:3:92:20 | Store | by_reference.cpp:92:3:92:20 | Chi [array content] |
-| by_reference.cpp:92:9:92:18 | call to user_input | by_reference.cpp:92:3:92:20 | Store |
+| by_reference.cpp:92:9:92:18 | call to user_input | by_reference.cpp:92:3:92:20 | Chi [array content] |
 | by_reference.cpp:96:3:96:19 | Chi [array content] | by_reference.cpp:124:15:124:21 | taint_a_ref output argument [array content] |
 | by_reference.cpp:96:3:96:19 | Chi [array content] | by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] |
-| by_reference.cpp:96:3:96:19 | Store | by_reference.cpp:96:3:96:19 | Chi [array content] |
-| by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:96:3:96:19 | Store |
+| by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:96:3:96:19 | Chi [array content] |
 | by_reference.cpp:102:21:102:39 | Chi [a] | by_reference.cpp:110:27:110:27 | a |
 | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | by_reference.cpp:102:21:102:39 | Chi [a] |
 | by_reference.cpp:104:15:104:22 | Chi | by_reference.cpp:104:15:104:22 | Chi [a] |
@@ -141,18 +127,34 @@ edges
 | by_reference.cpp:128:15:128:23 | Chi [a] | by_reference.cpp:136:16:136:16 | a |
 | by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] | by_reference.cpp:128:15:128:23 | Chi |
 | complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:42:18:42:18 | call to a |
+| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:42:16:42:16 | Chi [b_] |
 | complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:42:16:42:16 | a output argument [b_] |
 | complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:43:18:43:18 | call to b |
+| complex.cpp:42:16:42:16 | Chi [b_] | complex.cpp:43:18:43:18 | call to b |
+| complex.cpp:42:16:42:16 | a output argument [b_] | complex.cpp:42:16:42:16 | Chi [b_] |
 | complex.cpp:42:16:42:16 | a output argument [b_] | complex.cpp:43:18:43:18 | call to b |
+| complex.cpp:53:12:53:12 | Chi [a_] | complex.cpp:40:17:40:17 | *b [a_] |
 | complex.cpp:53:12:53:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:53:12:53:12 | setA output argument [a_] | complex.cpp:53:12:53:12 | Chi [a_] |
 | complex.cpp:53:19:53:28 | call to user_input | complex.cpp:53:12:53:12 | setA output argument [a_] |
+| complex.cpp:54:12:54:12 | Chi [b_] | complex.cpp:40:17:40:17 | *b [b_] |
 | complex.cpp:54:12:54:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
+| complex.cpp:54:12:54:12 | setB output argument [b_] | complex.cpp:54:12:54:12 | Chi [b_] |
 | complex.cpp:54:19:54:28 | call to user_input | complex.cpp:54:12:54:12 | setB output argument [b_] |
+| complex.cpp:55:12:55:12 | Chi [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:55:12:55:12 | Chi [a_] | complex.cpp:56:12:56:12 | Chi [a_] |
+| complex.cpp:55:12:55:12 | Chi [a_] | complex.cpp:56:12:56:12 | setB output argument [a_] |
 | complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:55:12:55:12 | Chi [a_] |
+| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:56:12:56:12 | Chi [a_] |
 | complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:56:12:56:12 | setB output argument [a_] |
 | complex.cpp:55:19:55:28 | call to user_input | complex.cpp:55:12:55:12 | setA output argument [a_] |
+| complex.cpp:56:12:56:12 | Chi [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:56:12:56:12 | Chi [b_] | complex.cpp:40:17:40:17 | *b [b_] |
 | complex.cpp:56:12:56:12 | setB output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:56:12:56:12 | setB output argument [a_] | complex.cpp:56:12:56:12 | Chi [a_] |
 | complex.cpp:56:12:56:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
+| complex.cpp:56:12:56:12 | setB output argument [b_] | complex.cpp:56:12:56:12 | Chi [b_] |
 | complex.cpp:56:19:56:28 | call to user_input | complex.cpp:56:12:56:12 | setB output argument [b_] |
 | constructors.cpp:26:15:26:15 | *f [a_] | constructors.cpp:28:12:28:12 | call to a |
 | constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:28:10:28:10 | a output argument [b_] |
@@ -184,19 +186,16 @@ edges
 | simple.cpp:65:11:65:20 | call to user_input | simple.cpp:65:5:65:22 | Store [i] |
 | simple.cpp:66:12:66:12 | Store [i] | simple.cpp:67:13:67:13 | i |
 | simple.cpp:83:9:83:28 | Chi [f1] | simple.cpp:84:14:84:20 | call to getf2f1 |
-| simple.cpp:83:9:83:28 | Store | simple.cpp:83:9:83:28 | Chi [f1] |
-| simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:9:83:28 | Store |
+| simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:9:83:28 | Chi [f1] |
 | simple.cpp:92:5:92:22 | Store [i] | simple.cpp:93:20:93:20 | Store [i] |
 | simple.cpp:92:11:92:20 | call to user_input | simple.cpp:92:5:92:22 | Store [i] |
 | simple.cpp:93:20:93:20 | Store [i] | simple.cpp:94:13:94:13 | i |
 | struct_init.c:14:24:14:25 | *ab [a] | struct_init.c:15:12:15:12 | a |
 | struct_init.c:20:20:20:29 | Chi [a] | struct_init.c:14:24:14:25 | *ab [a] |
-| struct_init.c:20:20:20:29 | Store | struct_init.c:20:20:20:29 | Chi [a] |
-| struct_init.c:20:20:20:29 | call to user_input | struct_init.c:20:20:20:29 | Store |
+| struct_init.c:20:20:20:29 | call to user_input | struct_init.c:20:20:20:29 | Chi [a] |
 | struct_init.c:20:20:20:29 | call to user_input | struct_init.c:22:11:22:11 | a |
 | struct_init.c:27:7:27:16 | Chi [a] | struct_init.c:14:24:14:25 | *ab [a] |
-| struct_init.c:27:7:27:16 | Store | struct_init.c:27:7:27:16 | Chi [a] |
-| struct_init.c:27:7:27:16 | call to user_input | struct_init.c:27:7:27:16 | Store |
+| struct_init.c:27:7:27:16 | call to user_input | struct_init.c:27:7:27:16 | Chi [a] |
 | struct_init.c:27:7:27:16 | call to user_input | struct_init.c:31:23:31:23 | a |
 nodes
 | A.cpp:55:5:55:5 | set output argument [c] | semmle.label | set output argument [c] |
@@ -208,7 +207,6 @@ nodes
 | A.cpp:57:28:57:30 | call to get | semmle.label | call to get |
 | A.cpp:98:12:98:18 | new | semmle.label | new |
 | A.cpp:100:5:100:13 | Chi [a] | semmle.label | Chi [a] |
-| A.cpp:100:5:100:13 | Store | semmle.label | Store |
 | A.cpp:103:14:103:14 | *c [a] | semmle.label | *c [a] |
 | A.cpp:107:16:107:16 | a | semmle.label | a |
 | A.cpp:126:5:126:5 | Chi [c] | semmle.label | Chi [c] |
@@ -218,10 +216,8 @@ nodes
 | A.cpp:131:8:131:8 | f7 output argument [c] | semmle.label | f7 output argument [c] |
 | A.cpp:132:13:132:13 | c | semmle.label | c |
 | A.cpp:142:7:142:20 | Chi [c] | semmle.label | Chi [c] |
-| A.cpp:142:7:142:20 | Store | semmle.label | Store |
 | A.cpp:142:14:142:20 | new | semmle.label | new |
 | A.cpp:143:7:143:31 | Chi [b] | semmle.label | Chi [b] |
-| A.cpp:143:7:143:31 | Store | semmle.label | Store |
 | A.cpp:143:25:143:31 | new | semmle.label | new |
 | A.cpp:150:12:150:18 | new | semmle.label | new |
 | A.cpp:151:12:151:24 | Chi [b] | semmle.label | Chi [b] |
@@ -233,21 +229,17 @@ nodes
 | C.cpp:18:12:18:18 | C output argument [s1] | semmle.label | C output argument [s1] |
 | C.cpp:18:12:18:18 | C output argument [s3] | semmle.label | C output argument [s3] |
 | C.cpp:22:12:22:21 | Chi [s1] | semmle.label | Chi [s1] |
-| C.cpp:22:12:22:21 | Store | semmle.label | Store |
 | C.cpp:22:12:22:21 | new | semmle.label | new |
 | C.cpp:24:5:24:25 | Chi [s1] | semmle.label | Chi [s1] |
 | C.cpp:24:5:24:25 | Chi [s3] | semmle.label | Chi [s3] |
-| C.cpp:24:5:24:25 | Store | semmle.label | Store |
 | C.cpp:24:16:24:25 | new | semmle.label | new |
 | C.cpp:27:8:27:11 | *#this [s1] | semmle.label | *#this [s1] |
 | C.cpp:27:8:27:11 | *#this [s3] | semmle.label | *#this [s3] |
 | C.cpp:29:10:29:11 | s1 | semmle.label | s1 |
 | C.cpp:31:10:31:11 | s3 | semmle.label | s3 |
 | aliasing.cpp:9:3:9:22 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:9:3:9:22 | Store | semmle.label | Store |
 | aliasing.cpp:9:11:9:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:13:3:13:21 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:13:3:13:21 | Store | semmle.label | Store |
 | aliasing.cpp:13:10:13:19 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:25:17:25:19 | Chi [m1] | semmle.label | Chi [m1] |
 | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] | semmle.label | pointerSetter output argument [m1] |
@@ -260,7 +252,6 @@ nodes
 | aliasing.cpp:42:11:42:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:43:13:43:14 | m1 | semmle.label | m1 |
 | aliasing.cpp:60:3:60:22 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:60:3:60:22 | Store | semmle.label | Store |
 | aliasing.cpp:60:11:60:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:61:13:61:14 | Store [m1] | semmle.label | Store [m1] |
 | aliasing.cpp:62:14:62:15 | m1 | semmle.label | m1 |
@@ -271,12 +262,10 @@ nodes
 | aliasing.cpp:92:12:92:21 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:93:12:93:13 | m1 | semmle.label | m1 |
 | aliasing.cpp:98:3:98:21 | Chi [m1] | semmle.label | Chi [m1] |
-| aliasing.cpp:98:3:98:21 | Store | semmle.label | Store |
 | aliasing.cpp:98:10:98:19 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:100:14:100:14 | Store [m1] | semmle.label | Store [m1] |
 | aliasing.cpp:102:8:102:10 | * ... | semmle.label | * ... |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | semmle.label | Chi [array content] |
-| aliasing.cpp:106:3:106:20 | Store | semmle.label | Store |
 | aliasing.cpp:106:9:106:18 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:121:15:121:16 | Chi [array content] | semmle.label | Chi [array content] |
 | aliasing.cpp:121:15:121:16 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
@@ -330,16 +319,12 @@ nodes
 | by_reference.cpp:68:21:68:30 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:69:8:69:20 | call to nonMemberGetA | semmle.label | call to nonMemberGetA |
 | by_reference.cpp:84:3:84:25 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:84:3:84:25 | Store | semmle.label | Store |
 | by_reference.cpp:84:14:84:23 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:88:3:88:24 | Chi [a] | semmle.label | Chi [a] |
-| by_reference.cpp:88:3:88:24 | Store | semmle.label | Store |
 | by_reference.cpp:88:13:88:22 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:92:3:92:20 | Chi [array content] | semmle.label | Chi [array content] |
-| by_reference.cpp:92:3:92:20 | Store | semmle.label | Store |
 | by_reference.cpp:92:9:92:18 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:96:3:96:19 | Chi [array content] | semmle.label | Chi [array content] |
-| by_reference.cpp:96:3:96:19 | Store | semmle.label | Store |
 | by_reference.cpp:96:8:96:17 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:102:21:102:39 | Chi [a] | semmle.label | Chi [a] |
 | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | semmle.label | taint_inner_a_ptr output argument [a] |
@@ -371,15 +356,21 @@ nodes
 | by_reference.cpp:136:16:136:16 | a | semmle.label | a |
 | complex.cpp:40:17:40:17 | *b [a_] | semmle.label | *b [a_] |
 | complex.cpp:40:17:40:17 | *b [b_] | semmle.label | *b [b_] |
+| complex.cpp:42:16:42:16 | Chi [b_] | semmle.label | Chi [b_] |
 | complex.cpp:42:16:42:16 | a output argument [b_] | semmle.label | a output argument [b_] |
 | complex.cpp:42:18:42:18 | call to a | semmle.label | call to a |
 | complex.cpp:43:18:43:18 | call to b | semmle.label | call to b |
+| complex.cpp:53:12:53:12 | Chi [a_] | semmle.label | Chi [a_] |
 | complex.cpp:53:12:53:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | complex.cpp:53:19:53:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:54:12:54:12 | Chi [b_] | semmle.label | Chi [b_] |
 | complex.cpp:54:12:54:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
 | complex.cpp:54:19:54:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:55:12:55:12 | Chi [a_] | semmle.label | Chi [a_] |
 | complex.cpp:55:12:55:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | complex.cpp:55:19:55:28 | call to user_input | semmle.label | call to user_input |
+| complex.cpp:56:12:56:12 | Chi [a_] | semmle.label | Chi [a_] |
+| complex.cpp:56:12:56:12 | Chi [b_] | semmle.label | Chi [b_] |
 | complex.cpp:56:12:56:12 | setB output argument [a_] | semmle.label | setB output argument [a_] |
 | complex.cpp:56:12:56:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
 | complex.cpp:56:19:56:28 | call to user_input | semmle.label | call to user_input |
@@ -415,7 +406,6 @@ nodes
 | simple.cpp:66:12:66:12 | Store [i] | semmle.label | Store [i] |
 | simple.cpp:67:13:67:13 | i | semmle.label | i |
 | simple.cpp:83:9:83:28 | Chi [f1] | semmle.label | Chi [f1] |
-| simple.cpp:83:9:83:28 | Store | semmle.label | Store |
 | simple.cpp:83:17:83:26 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:84:14:84:20 | call to getf2f1 | semmle.label | call to getf2f1 |
 | simple.cpp:92:5:92:22 | Store [i] | semmle.label | Store [i] |
@@ -425,11 +415,9 @@ nodes
 | struct_init.c:14:24:14:25 | *ab [a] | semmle.label | *ab [a] |
 | struct_init.c:15:12:15:12 | a | semmle.label | a |
 | struct_init.c:20:20:20:29 | Chi [a] | semmle.label | Chi [a] |
-| struct_init.c:20:20:20:29 | Store | semmle.label | Store |
 | struct_init.c:20:20:20:29 | call to user_input | semmle.label | call to user_input |
 | struct_init.c:22:11:22:11 | a | semmle.label | a |
 | struct_init.c:27:7:27:16 | Chi [a] | semmle.label | Chi [a] |
-| struct_init.c:27:7:27:16 | Store | semmle.label | Store |
 | struct_init.c:27:7:27:16 | call to user_input | semmle.label | call to user_input |
 | struct_init.c:31:23:31:23 | a | semmle.label | a |
 #select

cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected

@@ -294,22 +294,16 @@
 | complex.cpp:11:22:11:23 | a_ | AST only |
 | complex.cpp:12:22:12:23 | b_ | AST only |
 | complex.cpp:42:8:42:8 | b | AST only |
-| complex.cpp:42:10:42:14 | inner | AST only |
 | complex.cpp:42:16:42:16 | f | AST only |
 | complex.cpp:43:8:43:8 | b | AST only |
-| complex.cpp:43:10:43:14 | inner | AST only |
 | complex.cpp:43:16:43:16 | f | AST only |
 | complex.cpp:53:3:53:4 | b1 | AST only |
-| complex.cpp:53:6:53:10 | inner | AST only |
 | complex.cpp:53:12:53:12 | f | AST only |
 | complex.cpp:54:3:54:4 | b2 | AST only |
-| complex.cpp:54:6:54:10 | inner | AST only |
 | complex.cpp:54:12:54:12 | f | AST only |
 | complex.cpp:55:3:55:4 | b3 | AST only |
-| complex.cpp:55:6:55:10 | inner | AST only |
 | complex.cpp:55:12:55:12 | f | AST only |
 | complex.cpp:56:3:56:4 | b3 | AST only |
-| complex.cpp:56:6:56:10 | inner | AST only |
 | complex.cpp:56:12:56:12 | f | AST only |
 | complex.cpp:59:7:59:8 | b1 | AST only |
 | complex.cpp:62:7:62:8 | b2 | AST only |

cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected

@@ -51,6 +51,12 @@
 | by_reference.cpp:128:15:128:20 | pouter |
 | complex.cpp:11:22:11:23 | this |
 | complex.cpp:12:22:12:23 | this |
+| complex.cpp:42:10:42:14 | inner |
+| complex.cpp:43:10:43:14 | inner |
+| complex.cpp:53:6:53:10 | inner |
+| complex.cpp:54:6:54:10 | inner |
+| complex.cpp:55:6:55:10 | inner |
+| complex.cpp:56:6:56:10 | inner |
 | constructors.cpp:20:24:20:25 | this |
 | constructors.cpp:21:24:21:25 | this |
 | qualifiers.cpp:9:30:9:33 | this |

cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency.expected

@@ -17,8 +17,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.expected

@@ -17,8 +17,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/ir/ir/raw_consistency.expected

@@ -17,8 +17,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency.expected

@@ -17,8 +17,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.expected

@@ -17,8 +17,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency.expected

@@ -17,8 +17,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.expected

@@ -17,8 +17,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/ir/ssa/ssa.cpp

@@ -311,3 +311,12 @@ class ThisAliasTest {
     this->x = arg;
   }
 };
+
+int staticLocalInit(int x) {
+    static int a = 0;  // Constant initialization
+    static int b = sizeof(x);  // Constant initialization
+    static int c = x;  // Dynamic initialization
+    static int d;  // Zero initialization
+
+    return a + b + c + d;
+}

cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_consistency.expected

@@ -17,8 +17,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_consistency_unsound.expected

@@ -17,8 +17,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_consistency.expected

@@ -19,66 +19,66 @@ instructionWithoutSuccessor
 | ms_try_mix.cpp:48:10:48:13 | Chi: call to C | Instruction 'Chi: call to C' has no successors in function '$@'. | ms_try_mix.cpp:47:6:47:28 | void ms_empty_finally_at_end() | void ms_empty_finally_at_end() |
 | stmt_expr.cpp:27:5:27:15 | Store: ... = ... | Instruction 'Store: ... = ...' has no successors in function '$@'. | stmt_expr.cpp:21:6:21:6 | void stmtexpr::g(int) | void stmtexpr::g(int) |
 | vla.c:5:9:5:14 | Uninitialized: definition of matrix | Instruction 'Uninitialized: definition of matrix' has no successors in function '$@'. | vla.c:3:5:3:8 | int main(int, char**) | int main(int, char**) |
-| vla.c:11:6:11:16 | Chi: vla_typedef | Instruction 'Chi: vla_typedef' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
+| vla.c:11:6:11:16 | AliasedDefinition: vla_typedef | Instruction 'AliasedDefinition: vla_typedef' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
 ambiguousSuccessors
-| allocators.cpp:14:5:14:8 | Chi: main | Instruction 'Chi: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
-| array_delete.cpp:5:6:5:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| assignexpr.cpp:6:6:6:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| allocators.cpp:14:5:14:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| array_delete.cpp:5:6:5:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| assignexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
 | break_labels.c:2:11:2:11 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | break_labels.c:2:11:2:11 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | break_labels.c:2:11:2:11 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | break_labels.c:2:11:2:11 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| conditional_destructors.cpp:29:6:29:7 | Chi: f1 | Instruction 'Chi: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
-| conditional_destructors.cpp:38:6:38:7 | Chi: f2 | Instruction 'Chi: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
-| constmemberaccess.cpp:6:6:6:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| constructorinitializer.cpp:6:6:6:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| defconstructornewexpr.cpp:3:6:3:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| defdestructordeleteexpr.cpp:3:6:3:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| deleteexpr.cpp:6:6:6:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| dostmt.c:8:6:8:18 | Chi: always_true_1 | Instruction 'Chi: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| dostmt.c:16:6:16:18 | Chi: always_true_2 | Instruction 'Chi: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
-| dostmt.c:25:6:25:18 | Chi: always_true_3 | Instruction 'Chi: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
+| conditional_destructors.cpp:29:6:29:7 | AliasedDefinition: f1 | Instruction 'AliasedDefinition: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| conditional_destructors.cpp:38:6:38:7 | AliasedDefinition: f2 | Instruction 'AliasedDefinition: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| constmemberaccess.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| constructorinitializer.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| defconstructornewexpr.cpp:3:6:3:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| defdestructordeleteexpr.cpp:3:6:3:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| deleteexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| dostmt.c:8:6:8:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| dostmt.c:16:6:16:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| dostmt.c:25:6:25:18 | AliasedDefinition: always_true_3 | Instruction 'AliasedDefinition: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
 | duff.c:2:12:2:12 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | duff.c:2:12:2:12 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | duff.c:2:12:2:12 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | duff.c:2:12:2:12 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| fieldaccess.cpp:6:6:6:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| forstmt.cpp:1:6:1:7 | Chi: f1 | Instruction 'Chi: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
-| forstmt.cpp:8:6:8:7 | Chi: f2 | Instruction 'Chi: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
-| ifelsestmt.c:1:6:1:19 | Chi: always_false_1 | Instruction 'Chi: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
-| ifelsestmt.c:11:6:11:19 | Chi: always_false_2 | Instruction 'Chi: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
-| ifelsestmt.c:19:6:19:18 | Chi: always_true_1 | Instruction 'Chi: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| ifelsestmt.c:29:6:29:18 | Chi: always_true_2 | Instruction 'Chi: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| fieldaccess.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| forstmt.cpp:1:6:1:7 | AliasedDefinition: f1 | Instruction 'AliasedDefinition: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| forstmt.cpp:8:6:8:7 | AliasedDefinition: f2 | Instruction 'AliasedDefinition: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| ifelsestmt.c:1:6:1:19 | AliasedDefinition: always_false_1 | Instruction 'AliasedDefinition: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
+| ifelsestmt.c:11:6:11:19 | AliasedDefinition: always_false_2 | Instruction 'AliasedDefinition: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
+| ifelsestmt.c:19:6:19:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| ifelsestmt.c:29:6:29:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
 | ifelsestmt.c:37:24:37:24 | InitializeParameter: y | Instruction 'InitializeParameter: y' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:32:6:32:11 | void normal(int, int) | void normal(int, int) |
-| ifstmt.c:1:6:1:19 | Chi: always_false_1 | Instruction 'Chi: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
-| ifstmt.c:8:6:8:19 | Chi: always_false_2 | Instruction 'Chi: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
-| ifstmt.c:14:6:14:18 | Chi: always_true_1 | Instruction 'Chi: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| ifstmt.c:21:6:21:18 | Chi: always_true_2 | Instruction 'Chi: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| ifstmt.c:1:6:1:19 | AliasedDefinition: always_false_1 | Instruction 'AliasedDefinition: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
+| ifstmt.c:8:6:8:19 | AliasedDefinition: always_false_2 | Instruction 'AliasedDefinition: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
+| ifstmt.c:14:6:14:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| ifstmt.c:21:6:21:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
 | ifstmt.c:27:24:27:24 | InitializeParameter: y | Instruction 'InitializeParameter: y' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:32:6:32:11 | void normal(int, int) | void normal(int, int) |
-| membercallexpr.cpp:6:6:6:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| membercallexpr_args.cpp:7:6:7:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| newexpr.cpp:6:6:6:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| no_dynamic_init.cpp:9:5:9:8 | Chi: main | Instruction 'Chi: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| membercallexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| membercallexpr_args.cpp:7:6:7:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| newexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| no_dynamic_init.cpp:9:5:9:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| nonmembercallexpr.c:1:6:1:6 | Chi: g | Instruction 'Chi: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
-| parameterinitializer.cpp:18:5:18:8 | Chi: main | Instruction 'Chi: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
-| pmcallexpr.cpp:6:6:6:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| revsubscriptexpr.c:1:6:1:6 | Chi: g | Instruction 'Chi: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
-| staticmembercallexpr.cpp:6:6:6:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| staticmembercallexpr_args.cpp:7:6:7:6 | Chi: f | Instruction 'Chi: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| stream_it.cpp:16:5:16:8 | Chi: main | Instruction 'Chi: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| nonmembercallexpr.c:1:6:1:6 | AliasedDefinition: g | Instruction 'AliasedDefinition: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
+| parameterinitializer.cpp:18:5:18:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| pmcallexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| revsubscriptexpr.c:1:6:1:6 | AliasedDefinition: g | Instruction 'AliasedDefinition: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
+| staticmembercallexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| staticmembercallexpr_args.cpp:7:6:7:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| stream_it.cpp:16:5:16:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
 | switchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | switchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | switchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | switchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| whilestmt.c:1:6:1:19 | Chi: always_false_1 | Instruction 'Chi: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
-| whilestmt.c:8:6:8:19 | Chi: always_false_2 | Instruction 'Chi: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
-| whilestmt.c:15:6:15:18 | Chi: always_true_1 | Instruction 'Chi: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| whilestmt.c:23:6:23:18 | Chi: always_true_2 | Instruction 'Chi: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
-| whilestmt.c:32:6:32:18 | Chi: always_true_3 | Instruction 'Chi: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
+| whilestmt.c:1:6:1:19 | AliasedDefinition: always_false_1 | Instruction 'AliasedDefinition: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
+| whilestmt.c:8:6:8:19 | AliasedDefinition: always_false_2 | Instruction 'AliasedDefinition: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
+| whilestmt.c:15:6:15:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| whilestmt.c:23:6:23:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| whilestmt.c:32:6:32:18 | AliasedDefinition: always_true_3 | Instruction 'AliasedDefinition: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
 unexplainedLoop
 unnecessaryPhiInstruction
 memoryOperandDefinitionIsUnmodeled
@@ -89,8 +89,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

@@ -3,12 +3,8 @@ uniqueType
 uniqueNodeLocation
 | aggregateinitializer.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | aggregateinitializer.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| aggregateinitializer.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| aggregateinitializer.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| aggregateinitializer.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | aggregateinitializer.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | aggregateinitializer.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| aggregateinitializer.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | aggregateinitializer.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | aggregateinitializer.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | aggregateinitializer.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -34,12 +30,8 @@ uniqueNodeLocation
 | allocators.cpp:14:5:14:8 | Address | Node should have one location but has 4. |
 | allocators.cpp:14:5:14:8 | AliasedDefinition | Node should have one location but has 4. |
 | allocators.cpp:14:5:14:8 | AliasedUse | Node should have one location but has 4. |
-| allocators.cpp:14:5:14:8 | Chi | Node should have one location but has 4. |
-| allocators.cpp:14:5:14:8 | ChiPartial | Node should have one location but has 4. |
-| allocators.cpp:14:5:14:8 | ChiTotal | Node should have one location but has 4. |
 | allocators.cpp:14:5:14:8 | EnterFunction | Node should have one location but has 4. |
 | allocators.cpp:14:5:14:8 | ExitFunction | Node should have one location but has 4. |
-| allocators.cpp:14:5:14:8 | InitializeNonLocal | Node should have one location but has 4. |
 | allocators.cpp:14:5:14:8 | Load | Node should have one location but has 4. |
 | allocators.cpp:14:5:14:8 | Phi | Node should have one location but has 4. |
 | allocators.cpp:14:5:14:8 | Phi | Node should have one location but has 4. |
@@ -56,12 +48,8 @@ uniqueNodeLocation
 | allocators.cpp:14:5:14:8 | VariableAddress | Node should have one location but has 4. |
 | array_delete.cpp:5:6:5:6 | AliasedDefinition | Node should have one location but has 14. |
 | array_delete.cpp:5:6:5:6 | AliasedUse | Node should have one location but has 14. |
-| array_delete.cpp:5:6:5:6 | Chi | Node should have one location but has 14. |
-| array_delete.cpp:5:6:5:6 | ChiPartial | Node should have one location but has 14. |
-| array_delete.cpp:5:6:5:6 | ChiTotal | Node should have one location but has 14. |
 | array_delete.cpp:5:6:5:6 | EnterFunction | Node should have one location but has 14. |
 | array_delete.cpp:5:6:5:6 | ExitFunction | Node should have one location but has 14. |
-| array_delete.cpp:5:6:5:6 | InitializeNonLocal | Node should have one location but has 14. |
 | array_delete.cpp:5:6:5:6 | Phi | Node should have one location but has 14. |
 | array_delete.cpp:5:6:5:6 | Phi | Node should have one location but has 14. |
 | array_delete.cpp:5:6:5:6 | Phi | Node should have one location but has 14. |
@@ -81,12 +69,8 @@ uniqueNodeLocation
 | array_delete.cpp:5:6:5:6 | SideEffect | Node should have one location but has 14. |
 | assignexpr.cpp:6:6:6:6 | AliasedDefinition | Node should have one location but has 14. |
 | assignexpr.cpp:6:6:6:6 | AliasedUse | Node should have one location but has 14. |
-| assignexpr.cpp:6:6:6:6 | Chi | Node should have one location but has 14. |
-| assignexpr.cpp:6:6:6:6 | ChiPartial | Node should have one location but has 14. |
-| assignexpr.cpp:6:6:6:6 | ChiTotal | Node should have one location but has 14. |
 | assignexpr.cpp:6:6:6:6 | EnterFunction | Node should have one location but has 14. |
 | assignexpr.cpp:6:6:6:6 | ExitFunction | Node should have one location but has 14. |
-| assignexpr.cpp:6:6:6:6 | InitializeNonLocal | Node should have one location but has 14. |
 | assignexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | assignexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | assignexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
@@ -106,12 +90,8 @@ uniqueNodeLocation
 | assignexpr.cpp:6:6:6:6 | SideEffect | Node should have one location but has 14. |
 | break_labels.c:2:5:2:5 | AliasedDefinition | Node should have one location but has 20. |
 | break_labels.c:2:5:2:5 | AliasedUse | Node should have one location but has 20. |
-| break_labels.c:2:5:2:5 | Chi | Node should have one location but has 20. |
-| break_labels.c:2:5:2:5 | ChiPartial | Node should have one location but has 20. |
-| break_labels.c:2:5:2:5 | ChiTotal | Node should have one location but has 20. |
 | break_labels.c:2:5:2:5 | EnterFunction | Node should have one location but has 20. |
 | break_labels.c:2:5:2:5 | ExitFunction | Node should have one location but has 20. |
-| break_labels.c:2:5:2:5 | InitializeNonLocal | Node should have one location but has 20. |
 | break_labels.c:2:5:2:5 | Phi | Node should have one location but has 20. |
 | break_labels.c:2:5:2:5 | Phi | Node should have one location but has 20. |
 | break_labels.c:2:5:2:5 | Phi | Node should have one location but has 20. |
@@ -142,12 +122,8 @@ uniqueNodeLocation
 | break_labels.c:2:11:2:11 | x | Node should have one location but has 4. |
 | conditional_destructors.cpp:29:6:29:7 | AliasedDefinition | Node should have one location but has 2. |
 | conditional_destructors.cpp:29:6:29:7 | AliasedUse | Node should have one location but has 2. |
-| conditional_destructors.cpp:29:6:29:7 | Chi | Node should have one location but has 2. |
-| conditional_destructors.cpp:29:6:29:7 | ChiPartial | Node should have one location but has 2. |
-| conditional_destructors.cpp:29:6:29:7 | ChiTotal | Node should have one location but has 2. |
 | conditional_destructors.cpp:29:6:29:7 | EnterFunction | Node should have one location but has 2. |
 | conditional_destructors.cpp:29:6:29:7 | ExitFunction | Node should have one location but has 2. |
-| conditional_destructors.cpp:29:6:29:7 | InitializeNonLocal | Node should have one location but has 2. |
 | conditional_destructors.cpp:29:6:29:7 | Phi | Node should have one location but has 2. |
 | conditional_destructors.cpp:29:6:29:7 | Phi | Node should have one location but has 2. |
 | conditional_destructors.cpp:29:6:29:7 | Phi | Node should have one location but has 2. |
@@ -155,12 +131,8 @@ uniqueNodeLocation
 | conditional_destructors.cpp:29:6:29:7 | SideEffect | Node should have one location but has 2. |
 | conditional_destructors.cpp:38:6:38:7 | AliasedDefinition | Node should have one location but has 2. |
 | conditional_destructors.cpp:38:6:38:7 | AliasedUse | Node should have one location but has 2. |
-| conditional_destructors.cpp:38:6:38:7 | Chi | Node should have one location but has 2. |
-| conditional_destructors.cpp:38:6:38:7 | ChiPartial | Node should have one location but has 2. |
-| conditional_destructors.cpp:38:6:38:7 | ChiTotal | Node should have one location but has 2. |
 | conditional_destructors.cpp:38:6:38:7 | EnterFunction | Node should have one location but has 2. |
 | conditional_destructors.cpp:38:6:38:7 | ExitFunction | Node should have one location but has 2. |
-| conditional_destructors.cpp:38:6:38:7 | InitializeNonLocal | Node should have one location but has 2. |
 | conditional_destructors.cpp:38:6:38:7 | Phi | Node should have one location but has 2. |
 | conditional_destructors.cpp:38:6:38:7 | Phi | Node should have one location but has 2. |
 | conditional_destructors.cpp:38:6:38:7 | Phi | Node should have one location but has 2. |
@@ -170,12 +142,8 @@ uniqueNodeLocation
 | constmemberaccess.cpp:3:7:3:7 | x | Node should have one location but has 2. |
 | constmemberaccess.cpp:6:6:6:6 | AliasedDefinition | Node should have one location but has 14. |
 | constmemberaccess.cpp:6:6:6:6 | AliasedUse | Node should have one location but has 14. |
-| constmemberaccess.cpp:6:6:6:6 | Chi | Node should have one location but has 14. |
-| constmemberaccess.cpp:6:6:6:6 | ChiPartial | Node should have one location but has 14. |
-| constmemberaccess.cpp:6:6:6:6 | ChiTotal | Node should have one location but has 14. |
 | constmemberaccess.cpp:6:6:6:6 | EnterFunction | Node should have one location but has 14. |
 | constmemberaccess.cpp:6:6:6:6 | ExitFunction | Node should have one location but has 14. |
-| constmemberaccess.cpp:6:6:6:6 | InitializeNonLocal | Node should have one location but has 14. |
 | constmemberaccess.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | constmemberaccess.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | constmemberaccess.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
@@ -199,12 +167,8 @@ uniqueNodeLocation
 | constructorinitializer.cpp:3:16:3:16 | y | Node should have one location but has 2. |
 | constructorinitializer.cpp:6:6:6:6 | AliasedDefinition | Node should have one location but has 14. |
 | constructorinitializer.cpp:6:6:6:6 | AliasedUse | Node should have one location but has 14. |
-| constructorinitializer.cpp:6:6:6:6 | Chi | Node should have one location but has 14. |
-| constructorinitializer.cpp:6:6:6:6 | ChiPartial | Node should have one location but has 14. |
-| constructorinitializer.cpp:6:6:6:6 | ChiTotal | Node should have one location but has 14. |
 | constructorinitializer.cpp:6:6:6:6 | EnterFunction | Node should have one location but has 14. |
 | constructorinitializer.cpp:6:6:6:6 | ExitFunction | Node should have one location but has 14. |
-| constructorinitializer.cpp:6:6:6:6 | InitializeNonLocal | Node should have one location but has 14. |
 | constructorinitializer.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | constructorinitializer.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | constructorinitializer.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
@@ -224,12 +188,8 @@ uniqueNodeLocation
 | constructorinitializer.cpp:6:6:6:6 | SideEffect | Node should have one location but has 14. |
 | defconstructornewexpr.cpp:3:6:3:6 | AliasedDefinition | Node should have one location but has 14. |
 | defconstructornewexpr.cpp:3:6:3:6 | AliasedUse | Node should have one location but has 14. |
-| defconstructornewexpr.cpp:3:6:3:6 | Chi | Node should have one location but has 14. |
-| defconstructornewexpr.cpp:3:6:3:6 | ChiPartial | Node should have one location but has 14. |
-| defconstructornewexpr.cpp:3:6:3:6 | ChiTotal | Node should have one location but has 14. |
 | defconstructornewexpr.cpp:3:6:3:6 | EnterFunction | Node should have one location but has 14. |
 | defconstructornewexpr.cpp:3:6:3:6 | ExitFunction | Node should have one location but has 14. |
-| defconstructornewexpr.cpp:3:6:3:6 | InitializeNonLocal | Node should have one location but has 14. |
 | defconstructornewexpr.cpp:3:6:3:6 | Phi | Node should have one location but has 14. |
 | defconstructornewexpr.cpp:3:6:3:6 | Phi | Node should have one location but has 14. |
 | defconstructornewexpr.cpp:3:6:3:6 | Phi | Node should have one location but has 14. |
@@ -249,12 +209,8 @@ uniqueNodeLocation
 | defconstructornewexpr.cpp:3:6:3:6 | SideEffect | Node should have one location but has 14. |
 | defdestructordeleteexpr.cpp:3:6:3:6 | AliasedDefinition | Node should have one location but has 14. |
 | defdestructordeleteexpr.cpp:3:6:3:6 | AliasedUse | Node should have one location but has 14. |
-| defdestructordeleteexpr.cpp:3:6:3:6 | Chi | Node should have one location but has 14. |
-| defdestructordeleteexpr.cpp:3:6:3:6 | ChiPartial | Node should have one location but has 14. |
-| defdestructordeleteexpr.cpp:3:6:3:6 | ChiTotal | Node should have one location but has 14. |
 | defdestructordeleteexpr.cpp:3:6:3:6 | EnterFunction | Node should have one location but has 14. |
 | defdestructordeleteexpr.cpp:3:6:3:6 | ExitFunction | Node should have one location but has 14. |
-| defdestructordeleteexpr.cpp:3:6:3:6 | InitializeNonLocal | Node should have one location but has 14. |
 | defdestructordeleteexpr.cpp:3:6:3:6 | Phi | Node should have one location but has 14. |
 | defdestructordeleteexpr.cpp:3:6:3:6 | Phi | Node should have one location but has 14. |
 | defdestructordeleteexpr.cpp:3:6:3:6 | Phi | Node should have one location but has 14. |
@@ -274,12 +230,8 @@ uniqueNodeLocation
 | defdestructordeleteexpr.cpp:3:6:3:6 | SideEffect | Node should have one location but has 14. |
 | deleteexpr.cpp:6:6:6:6 | AliasedDefinition | Node should have one location but has 14. |
 | deleteexpr.cpp:6:6:6:6 | AliasedUse | Node should have one location but has 14. |
-| deleteexpr.cpp:6:6:6:6 | Chi | Node should have one location but has 14. |
-| deleteexpr.cpp:6:6:6:6 | ChiPartial | Node should have one location but has 14. |
-| deleteexpr.cpp:6:6:6:6 | ChiTotal | Node should have one location but has 14. |
 | deleteexpr.cpp:6:6:6:6 | EnterFunction | Node should have one location but has 14. |
 | deleteexpr.cpp:6:6:6:6 | ExitFunction | Node should have one location but has 14. |
-| deleteexpr.cpp:6:6:6:6 | InitializeNonLocal | Node should have one location but has 14. |
 | deleteexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | deleteexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | deleteexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
@@ -299,51 +251,31 @@ uniqueNodeLocation
 | deleteexpr.cpp:6:6:6:6 | SideEffect | Node should have one location but has 14. |
 | dostmt.c:8:6:8:18 | AliasedDefinition | Node should have one location but has 4. |
 | dostmt.c:8:6:8:18 | AliasedUse | Node should have one location but has 4. |
-| dostmt.c:8:6:8:18 | Chi | Node should have one location but has 4. |
-| dostmt.c:8:6:8:18 | ChiPartial | Node should have one location but has 4. |
-| dostmt.c:8:6:8:18 | ChiTotal | Node should have one location but has 4. |
 | dostmt.c:8:6:8:18 | EnterFunction | Node should have one location but has 4. |
 | dostmt.c:8:6:8:18 | ExitFunction | Node should have one location but has 4. |
-| dostmt.c:8:6:8:18 | InitializeNonLocal | Node should have one location but has 4. |
 | dostmt.c:8:6:8:18 | ReturnVoid | Node should have one location but has 4. |
 | dostmt.c:8:6:8:18 | SideEffect | Node should have one location but has 4. |
 | dostmt.c:8:6:8:18 | Unreached | Node should have one location but has 4. |
 | dostmt.c:16:6:16:18 | AliasedDefinition | Node should have one location but has 4. |
 | dostmt.c:16:6:16:18 | AliasedUse | Node should have one location but has 4. |
-| dostmt.c:16:6:16:18 | Chi | Node should have one location but has 4. |
-| dostmt.c:16:6:16:18 | ChiPartial | Node should have one location but has 4. |
-| dostmt.c:16:6:16:18 | ChiTotal | Node should have one location but has 4. |
 | dostmt.c:16:6:16:18 | EnterFunction | Node should have one location but has 4. |
 | dostmt.c:16:6:16:18 | ExitFunction | Node should have one location but has 4. |
-| dostmt.c:16:6:16:18 | InitializeNonLocal | Node should have one location but has 4. |
 | dostmt.c:16:6:16:18 | ReturnVoid | Node should have one location but has 4. |
 | dostmt.c:16:6:16:18 | SideEffect | Node should have one location but has 4. |
 | dostmt.c:16:6:16:18 | Unreached | Node should have one location but has 4. |
 | dostmt.c:25:6:25:18 | AliasedDefinition | Node should have one location but has 2. |
-| dostmt.c:25:6:25:18 | Chi | Node should have one location but has 2. |
-| dostmt.c:25:6:25:18 | ChiPartial | Node should have one location but has 2. |
-| dostmt.c:25:6:25:18 | ChiTotal | Node should have one location but has 2. |
 | dostmt.c:25:6:25:18 | EnterFunction | Node should have one location but has 2. |
-| dostmt.c:25:6:25:18 | InitializeNonLocal | Node should have one location but has 2. |
 | dostmt.c:25:6:25:18 | Unreached | Node should have one location but has 2. |
 | dostmt.c:32:6:32:11 | AliasedDefinition | Node should have one location but has 4. |
 | dostmt.c:32:6:32:11 | AliasedUse | Node should have one location but has 4. |
-| dostmt.c:32:6:32:11 | Chi | Node should have one location but has 4. |
-| dostmt.c:32:6:32:11 | ChiPartial | Node should have one location but has 4. |
-| dostmt.c:32:6:32:11 | ChiTotal | Node should have one location but has 4. |
 | dostmt.c:32:6:32:11 | EnterFunction | Node should have one location but has 4. |
 | dostmt.c:32:6:32:11 | ExitFunction | Node should have one location but has 4. |
-| dostmt.c:32:6:32:11 | InitializeNonLocal | Node should have one location but has 4. |
 | dostmt.c:32:6:32:11 | ReturnVoid | Node should have one location but has 4. |
 | dostmt.c:32:6:32:11 | SideEffect | Node should have one location but has 4. |
 | duff.c:2:6:2:6 | AliasedDefinition | Node should have one location but has 20. |
 | duff.c:2:6:2:6 | AliasedUse | Node should have one location but has 20. |
-| duff.c:2:6:2:6 | Chi | Node should have one location but has 20. |
-| duff.c:2:6:2:6 | ChiPartial | Node should have one location but has 20. |
-| duff.c:2:6:2:6 | ChiTotal | Node should have one location but has 20. |
 | duff.c:2:6:2:6 | EnterFunction | Node should have one location but has 20. |
 | duff.c:2:6:2:6 | ExitFunction | Node should have one location but has 20. |
-| duff.c:2:6:2:6 | InitializeNonLocal | Node should have one location but has 20. |
 | duff.c:2:6:2:6 | Phi | Node should have one location but has 20. |
 | duff.c:2:6:2:6 | Phi | Node should have one location but has 20. |
 | duff.c:2:6:2:6 | Phi | Node should have one location but has 20. |
@@ -374,12 +306,8 @@ uniqueNodeLocation
 | duff.c:2:12:2:12 | x | Node should have one location but has 4. |
 | dummyblock.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | dummyblock.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| dummyblock.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| dummyblock.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| dummyblock.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | dummyblock.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | dummyblock.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| dummyblock.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | dummyblock.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | dummyblock.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | dummyblock.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -404,12 +332,8 @@ uniqueNodeLocation
 | dummyblock.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | emptyblock.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | emptyblock.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| emptyblock.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| emptyblock.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| emptyblock.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | emptyblock.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | emptyblock.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| emptyblock.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | emptyblock.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | emptyblock.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | emptyblock.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -434,12 +358,8 @@ uniqueNodeLocation
 | emptyblock.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | enum.c:5:5:5:5 | AliasedDefinition | Node should have one location but has 20. |
 | enum.c:5:5:5:5 | AliasedUse | Node should have one location but has 20. |
-| enum.c:5:5:5:5 | Chi | Node should have one location but has 20. |
-| enum.c:5:5:5:5 | ChiPartial | Node should have one location but has 20. |
-| enum.c:5:5:5:5 | ChiTotal | Node should have one location but has 20. |
 | enum.c:5:5:5:5 | EnterFunction | Node should have one location but has 20. |
 | enum.c:5:5:5:5 | ExitFunction | Node should have one location but has 20. |
-| enum.c:5:5:5:5 | InitializeNonLocal | Node should have one location but has 20. |
 | enum.c:5:5:5:5 | Phi | Node should have one location but has 20. |
 | enum.c:5:5:5:5 | Phi | Node should have one location but has 20. |
 | enum.c:5:5:5:5 | Phi | Node should have one location but has 20. |
@@ -464,12 +384,8 @@ uniqueNodeLocation
 | enum.c:5:5:5:5 | Unreached | Node should have one location but has 20. |
 | exprstmt.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | exprstmt.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| exprstmt.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| exprstmt.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| exprstmt.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | exprstmt.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | exprstmt.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| exprstmt.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | exprstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | exprstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | exprstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -495,12 +411,8 @@ uniqueNodeLocation
 | fieldaccess.cpp:3:7:3:7 | x | Node should have one location but has 2. |
 | fieldaccess.cpp:6:6:6:6 | AliasedDefinition | Node should have one location but has 14. |
 | fieldaccess.cpp:6:6:6:6 | AliasedUse | Node should have one location but has 14. |
-| fieldaccess.cpp:6:6:6:6 | Chi | Node should have one location but has 14. |
-| fieldaccess.cpp:6:6:6:6 | ChiPartial | Node should have one location but has 14. |
-| fieldaccess.cpp:6:6:6:6 | ChiTotal | Node should have one location but has 14. |
 | fieldaccess.cpp:6:6:6:6 | EnterFunction | Node should have one location but has 14. |
 | fieldaccess.cpp:6:6:6:6 | ExitFunction | Node should have one location but has 14. |
-| fieldaccess.cpp:6:6:6:6 | InitializeNonLocal | Node should have one location but has 14. |
 | fieldaccess.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | fieldaccess.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | fieldaccess.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
@@ -554,12 +466,8 @@ uniqueNodeLocation
 | file://:0:0:0:0 | VariableAddress | Node should have one location but has 0. |
 | forstmt.cpp:1:6:1:7 | AliasedDefinition | Node should have one location but has 2. |
 | forstmt.cpp:1:6:1:7 | AliasedUse | Node should have one location but has 2. |
-| forstmt.cpp:1:6:1:7 | Chi | Node should have one location but has 2. |
-| forstmt.cpp:1:6:1:7 | ChiPartial | Node should have one location but has 2. |
-| forstmt.cpp:1:6:1:7 | ChiTotal | Node should have one location but has 2. |
 | forstmt.cpp:1:6:1:7 | EnterFunction | Node should have one location but has 2. |
 | forstmt.cpp:1:6:1:7 | ExitFunction | Node should have one location but has 2. |
-| forstmt.cpp:1:6:1:7 | InitializeNonLocal | Node should have one location but has 2. |
 | forstmt.cpp:1:6:1:7 | Phi | Node should have one location but has 2. |
 | forstmt.cpp:1:6:1:7 | Phi | Node should have one location but has 2. |
 | forstmt.cpp:1:6:1:7 | Phi | Node should have one location but has 2. |
@@ -567,12 +475,8 @@ uniqueNodeLocation
 | forstmt.cpp:1:6:1:7 | SideEffect | Node should have one location but has 2. |
 | forstmt.cpp:8:6:8:7 | AliasedDefinition | Node should have one location but has 2. |
 | forstmt.cpp:8:6:8:7 | AliasedUse | Node should have one location but has 2. |
-| forstmt.cpp:8:6:8:7 | Chi | Node should have one location but has 2. |
-| forstmt.cpp:8:6:8:7 | ChiPartial | Node should have one location but has 2. |
-| forstmt.cpp:8:6:8:7 | ChiTotal | Node should have one location but has 2. |
 | forstmt.cpp:8:6:8:7 | EnterFunction | Node should have one location but has 2. |
 | forstmt.cpp:8:6:8:7 | ExitFunction | Node should have one location but has 2. |
-| forstmt.cpp:8:6:8:7 | InitializeNonLocal | Node should have one location but has 2. |
 | forstmt.cpp:8:6:8:7 | Phi | Node should have one location but has 2. |
 | forstmt.cpp:8:6:8:7 | Phi | Node should have one location but has 2. |
 | forstmt.cpp:8:6:8:7 | Phi | Node should have one location but has 2. |
@@ -581,56 +485,36 @@ uniqueNodeLocation
 | forstmt.cpp:8:6:8:7 | Unreached | Node should have one location but has 2. |
 | ifelsestmt.c:1:6:1:19 | AliasedDefinition | Node should have one location but has 3. |
 | ifelsestmt.c:1:6:1:19 | AliasedUse | Node should have one location but has 3. |
-| ifelsestmt.c:1:6:1:19 | Chi | Node should have one location but has 3. |
-| ifelsestmt.c:1:6:1:19 | ChiPartial | Node should have one location but has 3. |
-| ifelsestmt.c:1:6:1:19 | ChiTotal | Node should have one location but has 3. |
 | ifelsestmt.c:1:6:1:19 | EnterFunction | Node should have one location but has 3. |
 | ifelsestmt.c:1:6:1:19 | ExitFunction | Node should have one location but has 3. |
-| ifelsestmt.c:1:6:1:19 | InitializeNonLocal | Node should have one location but has 3. |
 | ifelsestmt.c:1:6:1:19 | ReturnVoid | Node should have one location but has 3. |
 | ifelsestmt.c:1:6:1:19 | SideEffect | Node should have one location but has 3. |
 | ifelsestmt.c:1:6:1:19 | Unreached | Node should have one location but has 3. |
 | ifelsestmt.c:11:6:11:19 | AliasedDefinition | Node should have one location but has 3. |
 | ifelsestmt.c:11:6:11:19 | AliasedUse | Node should have one location but has 3. |
-| ifelsestmt.c:11:6:11:19 | Chi | Node should have one location but has 3. |
-| ifelsestmt.c:11:6:11:19 | ChiPartial | Node should have one location but has 3. |
-| ifelsestmt.c:11:6:11:19 | ChiTotal | Node should have one location but has 3. |
 | ifelsestmt.c:11:6:11:19 | EnterFunction | Node should have one location but has 3. |
 | ifelsestmt.c:11:6:11:19 | ExitFunction | Node should have one location but has 3. |
-| ifelsestmt.c:11:6:11:19 | InitializeNonLocal | Node should have one location but has 3. |
 | ifelsestmt.c:11:6:11:19 | ReturnVoid | Node should have one location but has 3. |
 | ifelsestmt.c:11:6:11:19 | SideEffect | Node should have one location but has 3. |
 | ifelsestmt.c:11:6:11:19 | Unreached | Node should have one location but has 3. |
 | ifelsestmt.c:19:6:19:18 | AliasedDefinition | Node should have one location but has 4. |
 | ifelsestmt.c:19:6:19:18 | AliasedUse | Node should have one location but has 4. |
-| ifelsestmt.c:19:6:19:18 | Chi | Node should have one location but has 4. |
-| ifelsestmt.c:19:6:19:18 | ChiPartial | Node should have one location but has 4. |
-| ifelsestmt.c:19:6:19:18 | ChiTotal | Node should have one location but has 4. |
 | ifelsestmt.c:19:6:19:18 | EnterFunction | Node should have one location but has 4. |
 | ifelsestmt.c:19:6:19:18 | ExitFunction | Node should have one location but has 4. |
-| ifelsestmt.c:19:6:19:18 | InitializeNonLocal | Node should have one location but has 4. |
 | ifelsestmt.c:19:6:19:18 | ReturnVoid | Node should have one location but has 4. |
 | ifelsestmt.c:19:6:19:18 | SideEffect | Node should have one location but has 4. |
 | ifelsestmt.c:19:6:19:18 | Unreached | Node should have one location but has 4. |
 | ifelsestmt.c:29:6:29:18 | AliasedDefinition | Node should have one location but has 4. |
 | ifelsestmt.c:29:6:29:18 | AliasedUse | Node should have one location but has 4. |
-| ifelsestmt.c:29:6:29:18 | Chi | Node should have one location but has 4. |
-| ifelsestmt.c:29:6:29:18 | ChiPartial | Node should have one location but has 4. |
-| ifelsestmt.c:29:6:29:18 | ChiTotal | Node should have one location but has 4. |
 | ifelsestmt.c:29:6:29:18 | EnterFunction | Node should have one location but has 4. |
 | ifelsestmt.c:29:6:29:18 | ExitFunction | Node should have one location but has 4. |
-| ifelsestmt.c:29:6:29:18 | InitializeNonLocal | Node should have one location but has 4. |
 | ifelsestmt.c:29:6:29:18 | ReturnVoid | Node should have one location but has 4. |
 | ifelsestmt.c:29:6:29:18 | SideEffect | Node should have one location but has 4. |
 | ifelsestmt.c:29:6:29:18 | Unreached | Node should have one location but has 4. |
 | ifelsestmt.c:37:6:37:11 | AliasedDefinition | Node should have one location but has 4. |
 | ifelsestmt.c:37:6:37:11 | AliasedUse | Node should have one location but has 4. |
-| ifelsestmt.c:37:6:37:11 | Chi | Node should have one location but has 4. |
-| ifelsestmt.c:37:6:37:11 | ChiPartial | Node should have one location but has 4. |
-| ifelsestmt.c:37:6:37:11 | ChiTotal | Node should have one location but has 4. |
 | ifelsestmt.c:37:6:37:11 | EnterFunction | Node should have one location but has 4. |
 | ifelsestmt.c:37:6:37:11 | ExitFunction | Node should have one location but has 4. |
-| ifelsestmt.c:37:6:37:11 | InitializeNonLocal | Node should have one location but has 4. |
 | ifelsestmt.c:37:6:37:11 | ReturnVoid | Node should have one location but has 4. |
 | ifelsestmt.c:37:6:37:11 | SideEffect | Node should have one location but has 4. |
 | ifelsestmt.c:37:17:37:17 | Address | Node should have one location but has 2. |
@@ -643,56 +527,36 @@ uniqueNodeLocation
 | ifelsestmt.c:37:24:37:24 | y | Node should have one location but has 2. |
 | ifstmt.c:1:6:1:19 | AliasedDefinition | Node should have one location but has 3. |
 | ifstmt.c:1:6:1:19 | AliasedUse | Node should have one location but has 3. |
-| ifstmt.c:1:6:1:19 | Chi | Node should have one location but has 3. |
-| ifstmt.c:1:6:1:19 | ChiPartial | Node should have one location but has 3. |
-| ifstmt.c:1:6:1:19 | ChiTotal | Node should have one location but has 3. |
 | ifstmt.c:1:6:1:19 | EnterFunction | Node should have one location but has 3. |
 | ifstmt.c:1:6:1:19 | ExitFunction | Node should have one location but has 3. |
-| ifstmt.c:1:6:1:19 | InitializeNonLocal | Node should have one location but has 3. |
 | ifstmt.c:1:6:1:19 | ReturnVoid | Node should have one location but has 3. |
 | ifstmt.c:1:6:1:19 | SideEffect | Node should have one location but has 3. |
 | ifstmt.c:1:6:1:19 | Unreached | Node should have one location but has 3. |
 | ifstmt.c:8:6:8:19 | AliasedDefinition | Node should have one location but has 3. |
 | ifstmt.c:8:6:8:19 | AliasedUse | Node should have one location but has 3. |
-| ifstmt.c:8:6:8:19 | Chi | Node should have one location but has 3. |
-| ifstmt.c:8:6:8:19 | ChiPartial | Node should have one location but has 3. |
-| ifstmt.c:8:6:8:19 | ChiTotal | Node should have one location but has 3. |
 | ifstmt.c:8:6:8:19 | EnterFunction | Node should have one location but has 3. |
 | ifstmt.c:8:6:8:19 | ExitFunction | Node should have one location but has 3. |
-| ifstmt.c:8:6:8:19 | InitializeNonLocal | Node should have one location but has 3. |
 | ifstmt.c:8:6:8:19 | ReturnVoid | Node should have one location but has 3. |
 | ifstmt.c:8:6:8:19 | SideEffect | Node should have one location but has 3. |
 | ifstmt.c:8:6:8:19 | Unreached | Node should have one location but has 3. |
 | ifstmt.c:14:6:14:18 | AliasedDefinition | Node should have one location but has 4. |
 | ifstmt.c:14:6:14:18 | AliasedUse | Node should have one location but has 4. |
-| ifstmt.c:14:6:14:18 | Chi | Node should have one location but has 4. |
-| ifstmt.c:14:6:14:18 | ChiPartial | Node should have one location but has 4. |
-| ifstmt.c:14:6:14:18 | ChiTotal | Node should have one location but has 4. |
 | ifstmt.c:14:6:14:18 | EnterFunction | Node should have one location but has 4. |
 | ifstmt.c:14:6:14:18 | ExitFunction | Node should have one location but has 4. |
-| ifstmt.c:14:6:14:18 | InitializeNonLocal | Node should have one location but has 4. |
 | ifstmt.c:14:6:14:18 | ReturnVoid | Node should have one location but has 4. |
 | ifstmt.c:14:6:14:18 | SideEffect | Node should have one location but has 4. |
 | ifstmt.c:14:6:14:18 | Unreached | Node should have one location but has 4. |
 | ifstmt.c:21:6:21:18 | AliasedDefinition | Node should have one location but has 4. |
 | ifstmt.c:21:6:21:18 | AliasedUse | Node should have one location but has 4. |
-| ifstmt.c:21:6:21:18 | Chi | Node should have one location but has 4. |
-| ifstmt.c:21:6:21:18 | ChiPartial | Node should have one location but has 4. |
-| ifstmt.c:21:6:21:18 | ChiTotal | Node should have one location but has 4. |
 | ifstmt.c:21:6:21:18 | EnterFunction | Node should have one location but has 4. |
 | ifstmt.c:21:6:21:18 | ExitFunction | Node should have one location but has 4. |
-| ifstmt.c:21:6:21:18 | InitializeNonLocal | Node should have one location but has 4. |
 | ifstmt.c:21:6:21:18 | ReturnVoid | Node should have one location but has 4. |
 | ifstmt.c:21:6:21:18 | SideEffect | Node should have one location but has 4. |
 | ifstmt.c:21:6:21:18 | Unreached | Node should have one location but has 4. |
 | ifstmt.c:27:6:27:11 | AliasedDefinition | Node should have one location but has 4. |
 | ifstmt.c:27:6:27:11 | AliasedUse | Node should have one location but has 4. |
-| ifstmt.c:27:6:27:11 | Chi | Node should have one location but has 4. |
-| ifstmt.c:27:6:27:11 | ChiPartial | Node should have one location but has 4. |
-| ifstmt.c:27:6:27:11 | ChiTotal | Node should have one location but has 4. |
 | ifstmt.c:27:6:27:11 | EnterFunction | Node should have one location but has 4. |
 | ifstmt.c:27:6:27:11 | ExitFunction | Node should have one location but has 4. |
-| ifstmt.c:27:6:27:11 | InitializeNonLocal | Node should have one location but has 4. |
 | ifstmt.c:27:6:27:11 | ReturnVoid | Node should have one location but has 4. |
 | ifstmt.c:27:6:27:11 | SideEffect | Node should have one location but has 4. |
 | ifstmt.c:27:17:27:17 | Address | Node should have one location but has 2. |
@@ -705,12 +569,8 @@ uniqueNodeLocation
 | ifstmt.c:27:24:27:24 | y | Node should have one location but has 2. |
 | initializer.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | initializer.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| initializer.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| initializer.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| initializer.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | initializer.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | initializer.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| initializer.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | initializer.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | initializer.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | initializer.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -735,12 +595,8 @@ uniqueNodeLocation
 | initializer.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | landexpr.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | landexpr.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| landexpr.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| landexpr.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| landexpr.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | landexpr.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | landexpr.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| landexpr.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | landexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | landexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | landexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -765,12 +621,8 @@ uniqueNodeLocation
 | landexpr.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | lorexpr.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | lorexpr.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| lorexpr.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| lorexpr.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| lorexpr.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | lorexpr.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | lorexpr.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| lorexpr.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | lorexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | lorexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | lorexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -795,12 +647,8 @@ uniqueNodeLocation
 | lorexpr.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | ltrbinopexpr.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | ltrbinopexpr.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| ltrbinopexpr.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| ltrbinopexpr.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| ltrbinopexpr.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | ltrbinopexpr.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | ltrbinopexpr.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| ltrbinopexpr.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | ltrbinopexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | ltrbinopexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | ltrbinopexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -825,12 +673,8 @@ uniqueNodeLocation
 | ltrbinopexpr.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | membercallexpr.cpp:6:6:6:6 | AliasedDefinition | Node should have one location but has 14. |
 | membercallexpr.cpp:6:6:6:6 | AliasedUse | Node should have one location but has 14. |
-| membercallexpr.cpp:6:6:6:6 | Chi | Node should have one location but has 14. |
-| membercallexpr.cpp:6:6:6:6 | ChiPartial | Node should have one location but has 14. |
-| membercallexpr.cpp:6:6:6:6 | ChiTotal | Node should have one location but has 14. |
 | membercallexpr.cpp:6:6:6:6 | EnterFunction | Node should have one location but has 14. |
 | membercallexpr.cpp:6:6:6:6 | ExitFunction | Node should have one location but has 14. |
-| membercallexpr.cpp:6:6:6:6 | InitializeNonLocal | Node should have one location but has 14. |
 | membercallexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | membercallexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | membercallexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
@@ -853,12 +697,8 @@ uniqueNodeLocation
 | membercallexpr_args.cpp:4:21:4:21 | y | Node should have one location but has 2. |
 | membercallexpr_args.cpp:7:6:7:6 | AliasedDefinition | Node should have one location but has 14. |
 | membercallexpr_args.cpp:7:6:7:6 | AliasedUse | Node should have one location but has 14. |
-| membercallexpr_args.cpp:7:6:7:6 | Chi | Node should have one location but has 14. |
-| membercallexpr_args.cpp:7:6:7:6 | ChiPartial | Node should have one location but has 14. |
-| membercallexpr_args.cpp:7:6:7:6 | ChiTotal | Node should have one location but has 14. |
 | membercallexpr_args.cpp:7:6:7:6 | EnterFunction | Node should have one location but has 14. |
 | membercallexpr_args.cpp:7:6:7:6 | ExitFunction | Node should have one location but has 14. |
-| membercallexpr_args.cpp:7:6:7:6 | InitializeNonLocal | Node should have one location but has 14. |
 | membercallexpr_args.cpp:7:6:7:6 | Phi | Node should have one location but has 14. |
 | membercallexpr_args.cpp:7:6:7:6 | Phi | Node should have one location but has 14. |
 | membercallexpr_args.cpp:7:6:7:6 | Phi | Node should have one location but has 14. |
@@ -882,12 +722,8 @@ uniqueNodeLocation
 | newexpr.cpp:3:16:3:16 | y | Node should have one location but has 2. |
 | newexpr.cpp:6:6:6:6 | AliasedDefinition | Node should have one location but has 14. |
 | newexpr.cpp:6:6:6:6 | AliasedUse | Node should have one location but has 14. |
-| newexpr.cpp:6:6:6:6 | Chi | Node should have one location but has 14. |
-| newexpr.cpp:6:6:6:6 | ChiPartial | Node should have one location but has 14. |
-| newexpr.cpp:6:6:6:6 | ChiTotal | Node should have one location but has 14. |
 | newexpr.cpp:6:6:6:6 | EnterFunction | Node should have one location but has 14. |
 | newexpr.cpp:6:6:6:6 | ExitFunction | Node should have one location but has 14. |
-| newexpr.cpp:6:6:6:6 | InitializeNonLocal | Node should have one location but has 14. |
 | newexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | newexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | newexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
@@ -908,12 +744,8 @@ uniqueNodeLocation
 | no_dynamic_init.cpp:9:5:9:8 | Address | Node should have one location but has 4. |
 | no_dynamic_init.cpp:9:5:9:8 | AliasedDefinition | Node should have one location but has 4. |
 | no_dynamic_init.cpp:9:5:9:8 | AliasedUse | Node should have one location but has 4. |
-| no_dynamic_init.cpp:9:5:9:8 | Chi | Node should have one location but has 4. |
-| no_dynamic_init.cpp:9:5:9:8 | ChiPartial | Node should have one location but has 4. |
-| no_dynamic_init.cpp:9:5:9:8 | ChiTotal | Node should have one location but has 4. |
 | no_dynamic_init.cpp:9:5:9:8 | EnterFunction | Node should have one location but has 4. |
 | no_dynamic_init.cpp:9:5:9:8 | ExitFunction | Node should have one location but has 4. |
-| no_dynamic_init.cpp:9:5:9:8 | InitializeNonLocal | Node should have one location but has 4. |
 | no_dynamic_init.cpp:9:5:9:8 | Load | Node should have one location but has 4. |
 | no_dynamic_init.cpp:9:5:9:8 | Phi | Node should have one location but has 4. |
 | no_dynamic_init.cpp:9:5:9:8 | Phi | Node should have one location but has 4. |
@@ -930,12 +762,8 @@ uniqueNodeLocation
 | no_dynamic_init.cpp:9:5:9:8 | VariableAddress | Node should have one location but has 4. |
 | nodefaultswitchstmt.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | nodefaultswitchstmt.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| nodefaultswitchstmt.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| nodefaultswitchstmt.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| nodefaultswitchstmt.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | nodefaultswitchstmt.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | nodefaultswitchstmt.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| nodefaultswitchstmt.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | nodefaultswitchstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | nodefaultswitchstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | nodefaultswitchstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -966,22 +794,14 @@ uniqueNodeLocation
 | nodefaultswitchstmt.c:1:12:1:12 | x | Node should have one location but has 4. |
 | nonmembercallexpr.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 2. |
 | nonmembercallexpr.c:1:6:1:6 | AliasedUse | Node should have one location but has 2. |
-| nonmembercallexpr.c:1:6:1:6 | Chi | Node should have one location but has 2. |
-| nonmembercallexpr.c:1:6:1:6 | ChiPartial | Node should have one location but has 2. |
-| nonmembercallexpr.c:1:6:1:6 | ChiTotal | Node should have one location but has 2. |
 | nonmembercallexpr.c:1:6:1:6 | EnterFunction | Node should have one location but has 2. |
 | nonmembercallexpr.c:1:6:1:6 | ExitFunction | Node should have one location but has 2. |
-| nonmembercallexpr.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 2. |
 | nonmembercallexpr.c:1:6:1:6 | ReturnVoid | Node should have one location but has 2. |
 | nonmembercallexpr.c:1:6:1:6 | SideEffect | Node should have one location but has 2. |
 | nonmembercallexpr.c:3:6:3:6 | AliasedDefinition | Node should have one location but has 20. |
 | nonmembercallexpr.c:3:6:3:6 | AliasedUse | Node should have one location but has 20. |
-| nonmembercallexpr.c:3:6:3:6 | Chi | Node should have one location but has 20. |
-| nonmembercallexpr.c:3:6:3:6 | ChiPartial | Node should have one location but has 20. |
-| nonmembercallexpr.c:3:6:3:6 | ChiTotal | Node should have one location but has 20. |
 | nonmembercallexpr.c:3:6:3:6 | EnterFunction | Node should have one location but has 20. |
 | nonmembercallexpr.c:3:6:3:6 | ExitFunction | Node should have one location but has 20. |
-| nonmembercallexpr.c:3:6:3:6 | InitializeNonLocal | Node should have one location but has 20. |
 | nonmembercallexpr.c:3:6:3:6 | Phi | Node should have one location but has 20. |
 | nonmembercallexpr.c:3:6:3:6 | Phi | Node should have one location but has 20. |
 | nonmembercallexpr.c:3:6:3:6 | Phi | Node should have one location but has 20. |
@@ -1006,12 +826,8 @@ uniqueNodeLocation
 | nonmembercallexpr.c:3:6:3:6 | Unreached | Node should have one location but has 20. |
 | nonmemberfp2callexpr.c:3:6:3:6 | AliasedDefinition | Node should have one location but has 20. |
 | nonmemberfp2callexpr.c:3:6:3:6 | AliasedUse | Node should have one location but has 20. |
-| nonmemberfp2callexpr.c:3:6:3:6 | Chi | Node should have one location but has 20. |
-| nonmemberfp2callexpr.c:3:6:3:6 | ChiPartial | Node should have one location but has 20. |
-| nonmemberfp2callexpr.c:3:6:3:6 | ChiTotal | Node should have one location but has 20. |
 | nonmemberfp2callexpr.c:3:6:3:6 | EnterFunction | Node should have one location but has 20. |
 | nonmemberfp2callexpr.c:3:6:3:6 | ExitFunction | Node should have one location but has 20. |
-| nonmemberfp2callexpr.c:3:6:3:6 | InitializeNonLocal | Node should have one location but has 20. |
 | nonmemberfp2callexpr.c:3:6:3:6 | Phi | Node should have one location but has 20. |
 | nonmemberfp2callexpr.c:3:6:3:6 | Phi | Node should have one location but has 20. |
 | nonmemberfp2callexpr.c:3:6:3:6 | Phi | Node should have one location but has 20. |
@@ -1036,12 +852,8 @@ uniqueNodeLocation
 | nonmemberfp2callexpr.c:3:6:3:6 | Unreached | Node should have one location but has 20. |
 | nonmemberfpcallexpr.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | nonmemberfpcallexpr.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| nonmemberfpcallexpr.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| nonmemberfpcallexpr.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| nonmemberfpcallexpr.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | nonmemberfpcallexpr.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | nonmemberfpcallexpr.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| nonmemberfpcallexpr.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | nonmemberfpcallexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | nonmemberfpcallexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | nonmemberfpcallexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -1067,12 +879,8 @@ uniqueNodeLocation
 | parameterinitializer.cpp:18:5:18:8 | Address | Node should have one location but has 4. |
 | parameterinitializer.cpp:18:5:18:8 | AliasedDefinition | Node should have one location but has 4. |
 | parameterinitializer.cpp:18:5:18:8 | AliasedUse | Node should have one location but has 4. |
-| parameterinitializer.cpp:18:5:18:8 | Chi | Node should have one location but has 4. |
-| parameterinitializer.cpp:18:5:18:8 | ChiPartial | Node should have one location but has 4. |
-| parameterinitializer.cpp:18:5:18:8 | ChiTotal | Node should have one location but has 4. |
 | parameterinitializer.cpp:18:5:18:8 | EnterFunction | Node should have one location but has 4. |
 | parameterinitializer.cpp:18:5:18:8 | ExitFunction | Node should have one location but has 4. |
-| parameterinitializer.cpp:18:5:18:8 | InitializeNonLocal | Node should have one location but has 4. |
 | parameterinitializer.cpp:18:5:18:8 | Load | Node should have one location but has 4. |
 | parameterinitializer.cpp:18:5:18:8 | Phi | Node should have one location but has 4. |
 | parameterinitializer.cpp:18:5:18:8 | Phi | Node should have one location but has 4. |
@@ -1089,12 +897,8 @@ uniqueNodeLocation
 | parameterinitializer.cpp:18:5:18:8 | VariableAddress | Node should have one location but has 4. |
 | pmcallexpr.cpp:6:6:6:6 | AliasedDefinition | Node should have one location but has 14. |
 | pmcallexpr.cpp:6:6:6:6 | AliasedUse | Node should have one location but has 14. |
-| pmcallexpr.cpp:6:6:6:6 | Chi | Node should have one location but has 14. |
-| pmcallexpr.cpp:6:6:6:6 | ChiPartial | Node should have one location but has 14. |
-| pmcallexpr.cpp:6:6:6:6 | ChiTotal | Node should have one location but has 14. |
 | pmcallexpr.cpp:6:6:6:6 | EnterFunction | Node should have one location but has 14. |
 | pmcallexpr.cpp:6:6:6:6 | ExitFunction | Node should have one location but has 14. |
-| pmcallexpr.cpp:6:6:6:6 | InitializeNonLocal | Node should have one location but has 14. |
 | pmcallexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | pmcallexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | pmcallexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
@@ -1114,12 +918,8 @@ uniqueNodeLocation
 | pmcallexpr.cpp:6:6:6:6 | SideEffect | Node should have one location but has 14. |
 | questionexpr.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | questionexpr.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| questionexpr.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| questionexpr.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| questionexpr.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | questionexpr.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | questionexpr.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| questionexpr.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | questionexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | questionexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | questionexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -1144,22 +944,14 @@ uniqueNodeLocation
 | questionexpr.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | revsubscriptexpr.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 2. |
 | revsubscriptexpr.c:1:6:1:6 | AliasedUse | Node should have one location but has 2. |
-| revsubscriptexpr.c:1:6:1:6 | Chi | Node should have one location but has 2. |
-| revsubscriptexpr.c:1:6:1:6 | ChiPartial | Node should have one location but has 2. |
-| revsubscriptexpr.c:1:6:1:6 | ChiTotal | Node should have one location but has 2. |
 | revsubscriptexpr.c:1:6:1:6 | EnterFunction | Node should have one location but has 2. |
 | revsubscriptexpr.c:1:6:1:6 | ExitFunction | Node should have one location but has 2. |
-| revsubscriptexpr.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 2. |
 | revsubscriptexpr.c:1:6:1:6 | ReturnVoid | Node should have one location but has 2. |
 | revsubscriptexpr.c:1:6:1:6 | SideEffect | Node should have one location but has 2. |
 | staticmembercallexpr.cpp:6:6:6:6 | AliasedDefinition | Node should have one location but has 14. |
 | staticmembercallexpr.cpp:6:6:6:6 | AliasedUse | Node should have one location but has 14. |
-| staticmembercallexpr.cpp:6:6:6:6 | Chi | Node should have one location but has 14. |
-| staticmembercallexpr.cpp:6:6:6:6 | ChiPartial | Node should have one location but has 14. |
-| staticmembercallexpr.cpp:6:6:6:6 | ChiTotal | Node should have one location but has 14. |
 | staticmembercallexpr.cpp:6:6:6:6 | EnterFunction | Node should have one location but has 14. |
 | staticmembercallexpr.cpp:6:6:6:6 | ExitFunction | Node should have one location but has 14. |
-| staticmembercallexpr.cpp:6:6:6:6 | InitializeNonLocal | Node should have one location but has 14. |
 | staticmembercallexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | staticmembercallexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
 | staticmembercallexpr.cpp:6:6:6:6 | Phi | Node should have one location but has 14. |
@@ -1182,12 +974,8 @@ uniqueNodeLocation
 | staticmembercallexpr_args.cpp:4:28:4:28 | y | Node should have one location but has 2. |
 | staticmembercallexpr_args.cpp:7:6:7:6 | AliasedDefinition | Node should have one location but has 14. |
 | staticmembercallexpr_args.cpp:7:6:7:6 | AliasedUse | Node should have one location but has 14. |
-| staticmembercallexpr_args.cpp:7:6:7:6 | Chi | Node should have one location but has 14. |
-| staticmembercallexpr_args.cpp:7:6:7:6 | ChiPartial | Node should have one location but has 14. |
-| staticmembercallexpr_args.cpp:7:6:7:6 | ChiTotal | Node should have one location but has 14. |
 | staticmembercallexpr_args.cpp:7:6:7:6 | EnterFunction | Node should have one location but has 14. |
 | staticmembercallexpr_args.cpp:7:6:7:6 | ExitFunction | Node should have one location but has 14. |
-| staticmembercallexpr_args.cpp:7:6:7:6 | InitializeNonLocal | Node should have one location but has 14. |
 | staticmembercallexpr_args.cpp:7:6:7:6 | Phi | Node should have one location but has 14. |
 | staticmembercallexpr_args.cpp:7:6:7:6 | Phi | Node should have one location but has 14. |
 | staticmembercallexpr_args.cpp:7:6:7:6 | Phi | Node should have one location but has 14. |
@@ -1208,12 +996,8 @@ uniqueNodeLocation
 | stream_it.cpp:16:5:16:8 | Address | Node should have one location but has 4. |
 | stream_it.cpp:16:5:16:8 | AliasedDefinition | Node should have one location but has 4. |
 | stream_it.cpp:16:5:16:8 | AliasedUse | Node should have one location but has 4. |
-| stream_it.cpp:16:5:16:8 | Chi | Node should have one location but has 4. |
-| stream_it.cpp:16:5:16:8 | ChiPartial | Node should have one location but has 4. |
-| stream_it.cpp:16:5:16:8 | ChiTotal | Node should have one location but has 4. |
 | stream_it.cpp:16:5:16:8 | EnterFunction | Node should have one location but has 4. |
 | stream_it.cpp:16:5:16:8 | ExitFunction | Node should have one location but has 4. |
-| stream_it.cpp:16:5:16:8 | InitializeNonLocal | Node should have one location but has 4. |
 | stream_it.cpp:16:5:16:8 | Load | Node should have one location but has 4. |
 | stream_it.cpp:16:5:16:8 | Phi | Node should have one location but has 4. |
 | stream_it.cpp:16:5:16:8 | Phi | Node should have one location but has 4. |
@@ -1230,12 +1014,8 @@ uniqueNodeLocation
 | stream_it.cpp:16:5:16:8 | VariableAddress | Node should have one location but has 4. |
 | subscriptexpr.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | subscriptexpr.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| subscriptexpr.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| subscriptexpr.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| subscriptexpr.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | subscriptexpr.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | subscriptexpr.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| subscriptexpr.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | subscriptexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | subscriptexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | subscriptexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -1260,12 +1040,8 @@ uniqueNodeLocation
 | subscriptexpr.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | switchstmt.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | switchstmt.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| switchstmt.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| switchstmt.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| switchstmt.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | switchstmt.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | switchstmt.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| switchstmt.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | switchstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | switchstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | switchstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -1296,12 +1072,8 @@ uniqueNodeLocation
 | switchstmt.c:1:12:1:12 | x | Node should have one location but has 4. |
 | tinyforstmt.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | tinyforstmt.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| tinyforstmt.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| tinyforstmt.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| tinyforstmt.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | tinyforstmt.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | tinyforstmt.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| tinyforstmt.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | tinyforstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | tinyforstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | tinyforstmt.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -1326,12 +1098,8 @@ uniqueNodeLocation
 | tinyforstmt.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | unaryopexpr.c:1:6:1:6 | AliasedDefinition | Node should have one location but has 20. |
 | unaryopexpr.c:1:6:1:6 | AliasedUse | Node should have one location but has 20. |
-| unaryopexpr.c:1:6:1:6 | Chi | Node should have one location but has 20. |
-| unaryopexpr.c:1:6:1:6 | ChiPartial | Node should have one location but has 20. |
-| unaryopexpr.c:1:6:1:6 | ChiTotal | Node should have one location but has 20. |
 | unaryopexpr.c:1:6:1:6 | EnterFunction | Node should have one location but has 20. |
 | unaryopexpr.c:1:6:1:6 | ExitFunction | Node should have one location but has 20. |
-| unaryopexpr.c:1:6:1:6 | InitializeNonLocal | Node should have one location but has 20. |
 | unaryopexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | unaryopexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
 | unaryopexpr.c:1:6:1:6 | Phi | Node should have one location but has 20. |
@@ -1356,63 +1124,39 @@ uniqueNodeLocation
 | unaryopexpr.c:1:6:1:6 | Unreached | Node should have one location but has 20. |
 | whilestmt.c:1:6:1:19 | AliasedDefinition | Node should have one location but has 3. |
 | whilestmt.c:1:6:1:19 | AliasedUse | Node should have one location but has 3. |
-| whilestmt.c:1:6:1:19 | Chi | Node should have one location but has 3. |
-| whilestmt.c:1:6:1:19 | ChiPartial | Node should have one location but has 3. |
-| whilestmt.c:1:6:1:19 | ChiTotal | Node should have one location but has 3. |
 | whilestmt.c:1:6:1:19 | EnterFunction | Node should have one location but has 3. |
 | whilestmt.c:1:6:1:19 | ExitFunction | Node should have one location but has 3. |
-| whilestmt.c:1:6:1:19 | InitializeNonLocal | Node should have one location but has 3. |
 | whilestmt.c:1:6:1:19 | ReturnVoid | Node should have one location but has 3. |
 | whilestmt.c:1:6:1:19 | SideEffect | Node should have one location but has 3. |
 | whilestmt.c:1:6:1:19 | Unreached | Node should have one location but has 3. |
 | whilestmt.c:8:6:8:19 | AliasedDefinition | Node should have one location but has 3. |
 | whilestmt.c:8:6:8:19 | AliasedUse | Node should have one location but has 3. |
-| whilestmt.c:8:6:8:19 | Chi | Node should have one location but has 3. |
-| whilestmt.c:8:6:8:19 | ChiPartial | Node should have one location but has 3. |
-| whilestmt.c:8:6:8:19 | ChiTotal | Node should have one location but has 3. |
 | whilestmt.c:8:6:8:19 | EnterFunction | Node should have one location but has 3. |
 | whilestmt.c:8:6:8:19 | ExitFunction | Node should have one location but has 3. |
-| whilestmt.c:8:6:8:19 | InitializeNonLocal | Node should have one location but has 3. |
 | whilestmt.c:8:6:8:19 | ReturnVoid | Node should have one location but has 3. |
 | whilestmt.c:8:6:8:19 | SideEffect | Node should have one location but has 3. |
 | whilestmt.c:8:6:8:19 | Unreached | Node should have one location but has 3. |
 | whilestmt.c:15:6:15:18 | AliasedDefinition | Node should have one location but has 4. |
 | whilestmt.c:15:6:15:18 | AliasedUse | Node should have one location but has 4. |
-| whilestmt.c:15:6:15:18 | Chi | Node should have one location but has 4. |
-| whilestmt.c:15:6:15:18 | ChiPartial | Node should have one location but has 4. |
-| whilestmt.c:15:6:15:18 | ChiTotal | Node should have one location but has 4. |
 | whilestmt.c:15:6:15:18 | EnterFunction | Node should have one location but has 4. |
 | whilestmt.c:15:6:15:18 | ExitFunction | Node should have one location but has 4. |
-| whilestmt.c:15:6:15:18 | InitializeNonLocal | Node should have one location but has 4. |
 | whilestmt.c:15:6:15:18 | ReturnVoid | Node should have one location but has 4. |
 | whilestmt.c:15:6:15:18 | SideEffect | Node should have one location but has 4. |
 | whilestmt.c:15:6:15:18 | Unreached | Node should have one location but has 4. |
 | whilestmt.c:23:6:23:18 | AliasedDefinition | Node should have one location but has 4. |
 | whilestmt.c:23:6:23:18 | AliasedUse | Node should have one location but has 4. |
-| whilestmt.c:23:6:23:18 | Chi | Node should have one location but has 4. |
-| whilestmt.c:23:6:23:18 | ChiPartial | Node should have one location but has 4. |
-| whilestmt.c:23:6:23:18 | ChiTotal | Node should have one location but has 4. |
 | whilestmt.c:23:6:23:18 | EnterFunction | Node should have one location but has 4. |
 | whilestmt.c:23:6:23:18 | ExitFunction | Node should have one location but has 4. |
-| whilestmt.c:23:6:23:18 | InitializeNonLocal | Node should have one location but has 4. |
 | whilestmt.c:23:6:23:18 | ReturnVoid | Node should have one location but has 4. |
 | whilestmt.c:23:6:23:18 | SideEffect | Node should have one location but has 4. |
 | whilestmt.c:23:6:23:18 | Unreached | Node should have one location but has 4. |
 | whilestmt.c:32:6:32:18 | AliasedDefinition | Node should have one location but has 2. |
-| whilestmt.c:32:6:32:18 | Chi | Node should have one location but has 2. |
-| whilestmt.c:32:6:32:18 | ChiPartial | Node should have one location but has 2. |
-| whilestmt.c:32:6:32:18 | ChiTotal | Node should have one location but has 2. |
 | whilestmt.c:32:6:32:18 | EnterFunction | Node should have one location but has 2. |
-| whilestmt.c:32:6:32:18 | InitializeNonLocal | Node should have one location but has 2. |
 | whilestmt.c:32:6:32:18 | Unreached | Node should have one location but has 2. |
 | whilestmt.c:39:6:39:11 | AliasedDefinition | Node should have one location but has 4. |
 | whilestmt.c:39:6:39:11 | AliasedUse | Node should have one location but has 4. |
-| whilestmt.c:39:6:39:11 | Chi | Node should have one location but has 4. |
-| whilestmt.c:39:6:39:11 | ChiPartial | Node should have one location but has 4. |
-| whilestmt.c:39:6:39:11 | ChiTotal | Node should have one location but has 4. |
 | whilestmt.c:39:6:39:11 | EnterFunction | Node should have one location but has 4. |
 | whilestmt.c:39:6:39:11 | ExitFunction | Node should have one location but has 4. |
-| whilestmt.c:39:6:39:11 | InitializeNonLocal | Node should have one location but has 4. |
 | whilestmt.c:39:6:39:11 | ReturnVoid | Node should have one location but has 4. |
 | whilestmt.c:39:6:39:11 | SideEffect | Node should have one location but has 4. |
 missingLocation
@@ -1491,6 +1235,7 @@ postWithInFlow
 | conditional_destructors.cpp:18:13:18:19 | Chi | PostUpdateNode should not be the target of local flow. |
 | cpp11.cpp:65:19:65:45 | Store | PostUpdateNode should not be the target of local flow. |
 | cpp11.cpp:82:17:82:55 | Chi | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:17:82:55 | Chi | PostUpdateNode should not be the target of local flow. |
 | cpp11.cpp:82:45:82:48 | Chi | PostUpdateNode should not be the target of local flow. |
 | defdestructordeleteexpr.cpp:4:9:4:15 | Chi | PostUpdateNode should not be the target of local flow. |
 | deleteexpr.cpp:7:9:7:15 | Chi | PostUpdateNode should not be the target of local flow. |
@@ -1541,6 +1286,18 @@ postWithInFlow
 | ir.cpp:659:9:659:14 | Chi | PostUpdateNode should not be the target of local flow. |
 | ir.cpp:660:13:660:13 | Chi | PostUpdateNode should not be the target of local flow. |
 | ir.cpp:661:9:661:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:662:9:662:19 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:663:5:663:5 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:745:8:745:8 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:745:8:745:8 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:748:10:748:10 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:754:8:754:8 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:757:12:757:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:763:8:763:8 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:766:13:766:13 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:775:15:775:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:784:15:784:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:793:15:793:15 | Chi | PostUpdateNode should not be the target of local flow. |
 | ir.cpp:943:3:943:11 | Chi | PostUpdateNode should not be the target of local flow. |
 | ir.cpp:947:3:947:25 | Chi | PostUpdateNode should not be the target of local flow. |
 | ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
@@ -1564,3 +1321,4 @@ postWithInFlow
 | range_analysis.c:102:5:102:15 | Chi | PostUpdateNode should not be the target of local flow. |
 | static_init_templates.cpp:3:2:3:8 | Chi | PostUpdateNode should not be the target of local flow. |
 | static_init_templates.cpp:21:2:21:12 | Chi | PostUpdateNode should not be the target of local flow. |
+| static_init_templates.cpp:240:7:240:7 | Chi | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/syntax-zoo/raw_consistency.expected

@@ -57,7 +57,7 @@ instructionWithoutSuccessor
 | vla.c:5:9:5:14 | Uninitialized: definition of matrix | Instruction 'Uninitialized: definition of matrix' has no successors in function '$@'. | vla.c:3:5:3:8 | int main(int, char**) | int main(int, char**) |
 | vla.c:5:16:5:19 | Load: argc | Instruction 'Load: argc' has no successors in function '$@'. | vla.c:3:5:3:8 | int main(int, char**) | int main(int, char**) |
 | vla.c:5:27:5:33 | BufferReadSideEffect: (const char *)... | Instruction 'BufferReadSideEffect: (const char *)...' has no successors in function '$@'. | vla.c:3:5:3:8 | int main(int, char**) | int main(int, char**) |
-| vla.c:11:6:11:16 | InitializeNonLocal: vla_typedef | Instruction 'InitializeNonLocal: vla_typedef' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
+| vla.c:11:6:11:16 | AliasedDefinition: vla_typedef | Instruction 'AliasedDefinition: vla_typedef' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
 | vla.c:12:33:12:44 | Add: ... + ... | Instruction 'Add: ... + ...' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
 | vla.c:12:50:12:62 | Mul: ... * ... | Instruction 'Mul: ... * ...' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
 | vla.c:13:12:13:14 | Uninitialized: definition of var | Instruction 'Uninitialized: definition of var' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
@@ -66,64 +66,64 @@ instructionWithoutSuccessor
 | vla.c:14:74:14:79 | CallSideEffect: call to getInt | Instruction 'CallSideEffect: call to getInt' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
 | vla.c:14:92:14:94 | Store: (char *)... | Instruction 'Store: (char *)...' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
 ambiguousSuccessors
-| allocators.cpp:14:5:14:8 | InitializeNonLocal: main | Instruction 'InitializeNonLocal: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
-| array_delete.cpp:5:6:5:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| assignexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| allocators.cpp:14:5:14:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| array_delete.cpp:5:6:5:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| assignexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
 | break_labels.c:2:11:2:11 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | break_labels.c:2:11:2:11 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | break_labels.c:2:11:2:11 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | break_labels.c:2:11:2:11 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| conditional_destructors.cpp:29:6:29:7 | InitializeNonLocal: f1 | Instruction 'InitializeNonLocal: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
-| conditional_destructors.cpp:38:6:38:7 | InitializeNonLocal: f2 | Instruction 'InitializeNonLocal: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
-| constmemberaccess.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| constructorinitializer.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| defconstructornewexpr.cpp:3:6:3:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| defdestructordeleteexpr.cpp:3:6:3:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| deleteexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| dostmt.c:8:6:8:18 | InitializeNonLocal: always_true_1 | Instruction 'InitializeNonLocal: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| dostmt.c:16:6:16:18 | InitializeNonLocal: always_true_2 | Instruction 'InitializeNonLocal: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
-| dostmt.c:25:6:25:18 | InitializeNonLocal: always_true_3 | Instruction 'InitializeNonLocal: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
+| conditional_destructors.cpp:29:6:29:7 | AliasedDefinition: f1 | Instruction 'AliasedDefinition: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| conditional_destructors.cpp:38:6:38:7 | AliasedDefinition: f2 | Instruction 'AliasedDefinition: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| constmemberaccess.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| constructorinitializer.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| defconstructornewexpr.cpp:3:6:3:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| defdestructordeleteexpr.cpp:3:6:3:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| deleteexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| dostmt.c:8:6:8:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| dostmt.c:16:6:16:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| dostmt.c:25:6:25:18 | AliasedDefinition: always_true_3 | Instruction 'AliasedDefinition: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
 | duff.c:2:12:2:12 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | duff.c:2:12:2:12 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | duff.c:2:12:2:12 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | duff.c:2:12:2:12 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| fieldaccess.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| forstmt.cpp:1:6:1:7 | InitializeNonLocal: f1 | Instruction 'InitializeNonLocal: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
-| forstmt.cpp:8:6:8:7 | InitializeNonLocal: f2 | Instruction 'InitializeNonLocal: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
-| ifelsestmt.c:1:6:1:19 | InitializeNonLocal: always_false_1 | Instruction 'InitializeNonLocal: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
-| ifelsestmt.c:11:6:11:19 | InitializeNonLocal: always_false_2 | Instruction 'InitializeNonLocal: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
-| ifelsestmt.c:19:6:19:18 | InitializeNonLocal: always_true_1 | Instruction 'InitializeNonLocal: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| ifelsestmt.c:29:6:29:18 | InitializeNonLocal: always_true_2 | Instruction 'InitializeNonLocal: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| fieldaccess.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| forstmt.cpp:1:6:1:7 | AliasedDefinition: f1 | Instruction 'AliasedDefinition: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| forstmt.cpp:8:6:8:7 | AliasedDefinition: f2 | Instruction 'AliasedDefinition: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| ifelsestmt.c:1:6:1:19 | AliasedDefinition: always_false_1 | Instruction 'AliasedDefinition: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
+| ifelsestmt.c:11:6:11:19 | AliasedDefinition: always_false_2 | Instruction 'AliasedDefinition: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
+| ifelsestmt.c:19:6:19:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| ifelsestmt.c:29:6:29:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
 | ifelsestmt.c:37:24:37:24 | InitializeParameter: y | Instruction 'InitializeParameter: y' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:32:6:32:11 | void normal(int, int) | void normal(int, int) |
-| ifstmt.c:1:6:1:19 | InitializeNonLocal: always_false_1 | Instruction 'InitializeNonLocal: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
-| ifstmt.c:8:6:8:19 | InitializeNonLocal: always_false_2 | Instruction 'InitializeNonLocal: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
-| ifstmt.c:14:6:14:18 | InitializeNonLocal: always_true_1 | Instruction 'InitializeNonLocal: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| ifstmt.c:21:6:21:18 | InitializeNonLocal: always_true_2 | Instruction 'InitializeNonLocal: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| ifstmt.c:1:6:1:19 | AliasedDefinition: always_false_1 | Instruction 'AliasedDefinition: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
+| ifstmt.c:8:6:8:19 | AliasedDefinition: always_false_2 | Instruction 'AliasedDefinition: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
+| ifstmt.c:14:6:14:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| ifstmt.c:21:6:21:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
 | ifstmt.c:27:24:27:24 | InitializeParameter: y | Instruction 'InitializeParameter: y' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:32:6:32:11 | void normal(int, int) | void normal(int, int) |
-| membercallexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| membercallexpr_args.cpp:7:6:7:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| newexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| no_dynamic_init.cpp:9:5:9:8 | InitializeNonLocal: main | Instruction 'InitializeNonLocal: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| membercallexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| membercallexpr_args.cpp:7:6:7:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| newexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| no_dynamic_init.cpp:9:5:9:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| nonmembercallexpr.c:1:6:1:6 | InitializeNonLocal: g | Instruction 'InitializeNonLocal: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
-| parameterinitializer.cpp:18:5:18:8 | InitializeNonLocal: main | Instruction 'InitializeNonLocal: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
-| pmcallexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| revsubscriptexpr.c:1:6:1:6 | InitializeNonLocal: g | Instruction 'InitializeNonLocal: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
-| staticmembercallexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| staticmembercallexpr_args.cpp:7:6:7:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| stream_it.cpp:16:5:16:8 | InitializeNonLocal: main | Instruction 'InitializeNonLocal: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| nonmembercallexpr.c:1:6:1:6 | AliasedDefinition: g | Instruction 'AliasedDefinition: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
+| parameterinitializer.cpp:18:5:18:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| pmcallexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| revsubscriptexpr.c:1:6:1:6 | AliasedDefinition: g | Instruction 'AliasedDefinition: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
+| staticmembercallexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| staticmembercallexpr_args.cpp:7:6:7:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| stream_it.cpp:16:5:16:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
 | switchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | switchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | switchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | switchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| whilestmt.c:1:6:1:19 | InitializeNonLocal: always_false_1 | Instruction 'InitializeNonLocal: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
-| whilestmt.c:8:6:8:19 | InitializeNonLocal: always_false_2 | Instruction 'InitializeNonLocal: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
-| whilestmt.c:15:6:15:18 | InitializeNonLocal: always_true_1 | Instruction 'InitializeNonLocal: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| whilestmt.c:23:6:23:18 | InitializeNonLocal: always_true_2 | Instruction 'InitializeNonLocal: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
-| whilestmt.c:32:6:32:18 | InitializeNonLocal: always_true_3 | Instruction 'InitializeNonLocal: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
+| whilestmt.c:1:6:1:19 | AliasedDefinition: always_false_1 | Instruction 'AliasedDefinition: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
+| whilestmt.c:8:6:8:19 | AliasedDefinition: always_false_2 | Instruction 'AliasedDefinition: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
+| whilestmt.c:15:6:15:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| whilestmt.c:23:6:23:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| whilestmt.c:32:6:32:18 | AliasedDefinition: always_true_3 | Instruction 'AliasedDefinition: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
 unexplainedLoop
 unnecessaryPhiInstruction
 memoryOperandDefinitionIsUnmodeled
@@ -139,8 +139,6 @@ useNotDominatedByDefinition
 | try_catch.cpp:21:13:21:24 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | try_catch.cpp:19:6:19:23 | void throw_from_nonstmt(int) | void throw_from_nonstmt(int) |
 | vla.c:3:27:3:30 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | vla.c:3:5:3:8 | int main(int, char**) | int main(int, char**) |
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_consistency.expected

@@ -19,66 +19,66 @@ instructionWithoutSuccessor
 | ms_try_mix.cpp:48:10:48:13 | IndirectMayWriteSideEffect: call to C | Instruction 'IndirectMayWriteSideEffect: call to C' has no successors in function '$@'. | ms_try_mix.cpp:47:6:47:28 | void ms_empty_finally_at_end() | void ms_empty_finally_at_end() |
 | stmt_expr.cpp:27:5:27:15 | Store: ... = ... | Instruction 'Store: ... = ...' has no successors in function '$@'. | stmt_expr.cpp:21:6:21:6 | void stmtexpr::g(int) | void stmtexpr::g(int) |
 | vla.c:5:9:5:14 | Uninitialized: definition of matrix | Instruction 'Uninitialized: definition of matrix' has no successors in function '$@'. | vla.c:3:5:3:8 | int main(int, char**) | int main(int, char**) |
-| vla.c:11:6:11:16 | InitializeNonLocal: vla_typedef | Instruction 'InitializeNonLocal: vla_typedef' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
+| vla.c:11:6:11:16 | AliasedDefinition: vla_typedef | Instruction 'AliasedDefinition: vla_typedef' has no successors in function '$@'. | vla.c:11:6:11:16 | void vla_typedef() | void vla_typedef() |
 ambiguousSuccessors
-| allocators.cpp:14:5:14:8 | InitializeNonLocal: main | Instruction 'InitializeNonLocal: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
-| array_delete.cpp:5:6:5:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| assignexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| allocators.cpp:14:5:14:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| array_delete.cpp:5:6:5:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| assignexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
 | break_labels.c:2:11:2:11 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | break_labels.c:2:11:2:11 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | break_labels.c:2:11:2:11 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | break_labels.c:2:11:2:11 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| conditional_destructors.cpp:29:6:29:7 | InitializeNonLocal: f1 | Instruction 'InitializeNonLocal: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
-| conditional_destructors.cpp:38:6:38:7 | InitializeNonLocal: f2 | Instruction 'InitializeNonLocal: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
-| constmemberaccess.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| constructorinitializer.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| defconstructornewexpr.cpp:3:6:3:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| defdestructordeleteexpr.cpp:3:6:3:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| deleteexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| dostmt.c:8:6:8:18 | InitializeNonLocal: always_true_1 | Instruction 'InitializeNonLocal: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| dostmt.c:16:6:16:18 | InitializeNonLocal: always_true_2 | Instruction 'InitializeNonLocal: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
-| dostmt.c:25:6:25:18 | InitializeNonLocal: always_true_3 | Instruction 'InitializeNonLocal: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
+| conditional_destructors.cpp:29:6:29:7 | AliasedDefinition: f1 | Instruction 'AliasedDefinition: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| conditional_destructors.cpp:38:6:38:7 | AliasedDefinition: f2 | Instruction 'AliasedDefinition: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| constmemberaccess.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| constructorinitializer.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| defconstructornewexpr.cpp:3:6:3:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| defdestructordeleteexpr.cpp:3:6:3:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| deleteexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| dostmt.c:8:6:8:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| dostmt.c:16:6:16:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| dostmt.c:25:6:25:18 | AliasedDefinition: always_true_3 | Instruction 'AliasedDefinition: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
 | duff.c:2:12:2:12 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | duff.c:2:12:2:12 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | duff.c:2:12:2:12 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | duff.c:2:12:2:12 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| fieldaccess.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| forstmt.cpp:1:6:1:7 | InitializeNonLocal: f1 | Instruction 'InitializeNonLocal: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
-| forstmt.cpp:8:6:8:7 | InitializeNonLocal: f2 | Instruction 'InitializeNonLocal: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
-| ifelsestmt.c:1:6:1:19 | InitializeNonLocal: always_false_1 | Instruction 'InitializeNonLocal: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
-| ifelsestmt.c:11:6:11:19 | InitializeNonLocal: always_false_2 | Instruction 'InitializeNonLocal: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
-| ifelsestmt.c:19:6:19:18 | InitializeNonLocal: always_true_1 | Instruction 'InitializeNonLocal: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| ifelsestmt.c:29:6:29:18 | InitializeNonLocal: always_true_2 | Instruction 'InitializeNonLocal: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| fieldaccess.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| forstmt.cpp:1:6:1:7 | AliasedDefinition: f1 | Instruction 'AliasedDefinition: f1' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| forstmt.cpp:8:6:8:7 | AliasedDefinition: f2 | Instruction 'AliasedDefinition: f2' has 2 successors of kind 'Goto' in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| ifelsestmt.c:1:6:1:19 | AliasedDefinition: always_false_1 | Instruction 'AliasedDefinition: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
+| ifelsestmt.c:11:6:11:19 | AliasedDefinition: always_false_2 | Instruction 'AliasedDefinition: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
+| ifelsestmt.c:19:6:19:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| ifelsestmt.c:29:6:29:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
 | ifelsestmt.c:37:24:37:24 | InitializeParameter: y | Instruction 'InitializeParameter: y' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:32:6:32:11 | void normal(int, int) | void normal(int, int) |
-| ifstmt.c:1:6:1:19 | InitializeNonLocal: always_false_1 | Instruction 'InitializeNonLocal: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
-| ifstmt.c:8:6:8:19 | InitializeNonLocal: always_false_2 | Instruction 'InitializeNonLocal: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
-| ifstmt.c:14:6:14:18 | InitializeNonLocal: always_true_1 | Instruction 'InitializeNonLocal: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| ifstmt.c:21:6:21:18 | InitializeNonLocal: always_true_2 | Instruction 'InitializeNonLocal: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| ifstmt.c:1:6:1:19 | AliasedDefinition: always_false_1 | Instruction 'AliasedDefinition: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
+| ifstmt.c:8:6:8:19 | AliasedDefinition: always_false_2 | Instruction 'AliasedDefinition: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
+| ifstmt.c:14:6:14:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| ifstmt.c:21:6:21:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
 | ifstmt.c:27:24:27:24 | InitializeParameter: y | Instruction 'InitializeParameter: y' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:32:6:32:11 | void normal(int, int) | void normal(int, int) |
-| membercallexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| membercallexpr_args.cpp:7:6:7:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| newexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| no_dynamic_init.cpp:9:5:9:8 | InitializeNonLocal: main | Instruction 'InitializeNonLocal: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| membercallexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| membercallexpr_args.cpp:7:6:7:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| newexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| no_dynamic_init.cpp:9:5:9:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| nonmembercallexpr.c:1:6:1:6 | InitializeNonLocal: g | Instruction 'InitializeNonLocal: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
-| parameterinitializer.cpp:18:5:18:8 | InitializeNonLocal: main | Instruction 'InitializeNonLocal: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
-| pmcallexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| revsubscriptexpr.c:1:6:1:6 | InitializeNonLocal: g | Instruction 'InitializeNonLocal: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
-| staticmembercallexpr.cpp:6:6:6:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| staticmembercallexpr_args.cpp:7:6:7:6 | InitializeNonLocal: f | Instruction 'InitializeNonLocal: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
-| stream_it.cpp:16:5:16:8 | InitializeNonLocal: main | Instruction 'InitializeNonLocal: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| nonmembercallexpr.c:1:6:1:6 | AliasedDefinition: g | Instruction 'AliasedDefinition: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
+| parameterinitializer.cpp:18:5:18:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
+| pmcallexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| revsubscriptexpr.c:1:6:1:6 | AliasedDefinition: g | Instruction 'AliasedDefinition: g' has 2 successors of kind 'Goto' in function '$@'. | nonmembercallexpr.c:1:6:1:6 | void g(); void g())(); void(* g(); void(* g())() | void g(); void g())(); void(* g(); void(* g())() |
+| staticmembercallexpr.cpp:6:6:6:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| staticmembercallexpr_args.cpp:7:6:7:6 | AliasedDefinition: f | Instruction 'AliasedDefinition: f' has 14 successors of kind 'Goto' in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| stream_it.cpp:16:5:16:8 | AliasedDefinition: main | Instruction 'AliasedDefinition: main' has 4 successors of kind 'Goto' in function '$@'. | allocators.cpp:14:5:14:8 | int main() | int main() |
 | switchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | switchstmt.c:1:12:1:12 | InitializeParameter: i | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | switchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: i' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
 | switchstmt.c:1:12:1:12 | InitializeParameter: x | Instruction 'InitializeParameter: x' has 19 successors of kind 'Goto' in function '$@'. | aggregateinitializer.c:1:6:1:6 | int f(int); void f(int) | int f(int); void f(int) |
-| whilestmt.c:1:6:1:19 | InitializeNonLocal: always_false_1 | Instruction 'InitializeNonLocal: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
-| whilestmt.c:8:6:8:19 | InitializeNonLocal: always_false_2 | Instruction 'InitializeNonLocal: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
-| whilestmt.c:15:6:15:18 | InitializeNonLocal: always_true_1 | Instruction 'InitializeNonLocal: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
-| whilestmt.c:23:6:23:18 | InitializeNonLocal: always_true_2 | Instruction 'InitializeNonLocal: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
-| whilestmt.c:32:6:32:18 | InitializeNonLocal: always_true_3 | Instruction 'InitializeNonLocal: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
+| whilestmt.c:1:6:1:19 | AliasedDefinition: always_false_1 | Instruction 'AliasedDefinition: always_false_1' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:1:6:1:19 | void always_false_1() | void always_false_1() |
+| whilestmt.c:8:6:8:19 | AliasedDefinition: always_false_2 | Instruction 'AliasedDefinition: always_false_2' has 3 successors of kind 'Goto' in function '$@'. | ifelsestmt.c:11:6:11:19 | void always_false_2() | void always_false_2() |
+| whilestmt.c:15:6:15:18 | AliasedDefinition: always_true_1 | Instruction 'AliasedDefinition: always_true_1' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:8:6:8:18 | void always_true_1() | void always_true_1() |
+| whilestmt.c:23:6:23:18 | AliasedDefinition: always_true_2 | Instruction 'AliasedDefinition: always_true_2' has 4 successors of kind 'Goto' in function '$@'. | dostmt.c:16:6:16:18 | void always_true_2() | void always_true_2() |
+| whilestmt.c:32:6:32:18 | AliasedDefinition: always_true_3 | Instruction 'AliasedDefinition: always_true_3' has 2 successors of kind 'Goto' in function '$@'. | dostmt.c:25:6:25:18 | void always_true_3() | void always_true_3() |
 unexplainedLoop
 unnecessaryPhiInstruction
 memoryOperandDefinitionIsUnmodeled
@@ -89,8 +89,6 @@ lostReachability
 backEdgeCountMismatch
 useNotDominatedByDefinition
 switchInstructionWithoutDefaultEdge
-notMarkedAsConflated
-wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
 fieldAddressOnNonPointer

cpp/ql/test/library-tests/templates/instantiations_functions/elements.expected

@@ -106,6 +106,7 @@
 | file://:0:0:0:0 | declaration of 1st parameter |
 | file://:0:0:0:0 | declaration of 1st parameter |
 | file://:0:0:0:0 | declared_constexpr |
+| file://:0:0:0:0 | declared_constinit |
 | file://:0:0:0:0 | decltype(nullptr) |
 | file://:0:0:0:0 | definition of fp_offset |
 | file://:0:0:0:0 | definition of gp_offset |

cpp/ql/test/library-tests/unnamed/elements.expected

@@ -38,6 +38,7 @@
 | file://:0:0:0:0 | char32_t | Other |
 | file://:0:0:0:0 | const | Other |
 | file://:0:0:0:0 | declared_constexpr | Other |
+| file://:0:0:0:0 | declared_constinit | Other |
 | file://:0:0:0:0 | decltype(nullptr) | Other |
 | file://:0:0:0:0 | definition of fp_offset | Other |
 | file://:0:0:0:0 | definition of gp_offset | Other |

cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/UnusedLocals.expected

@@ -1,10 +1,12 @@
-| code2.cpp:4:6:4:7 | v1 | Variable v1 is not used |
-| code2.cpp:6:6:6:7 | v3 | Variable v3 is not used |
-| code2.cpp:10:16:10:17 | v7 | Variable v7 is not used |
-| code2.cpp:25:16:25:17 | v1 | Variable v1 is not used |
-| code2.cpp:26:16:26:17 | v2 | Variable v2 is not used |
-| code2.cpp:41:11:41:16 | myVar1 | Variable myVar1 is not used |
-| code2.cpp:63:7:63:8 | v3 | Variable v3 is not used |
+| code2.cpp:5:6:5:7 | v1 | Variable v1 is not used |
+| code2.cpp:7:6:7:7 | v3 | Variable v3 is not used |
+| code2.cpp:11:16:11:17 | v7 | Variable v7 is not used |
+| code2.cpp:26:16:26:17 | v1 | Variable v1 is not used |
+| code2.cpp:27:16:27:17 | v2 | Variable v2 is not used |
+| code2.cpp:42:11:42:16 | myVar1 | Variable myVar1 is not used |
+| code2.cpp:64:7:64:8 | v3 | Variable v3 is not used |
+| code2.cpp:108:11:108:12 | v2 | Variable v2 is not used |
+| code2.cpp:128:9:128:9 | b | Variable b is not used |
 | code.c:10:18:10:18 | y | Variable y is not used |
 | code.c:11:18:11:18 | z | Variable z is not used |
 | code.c:18:7:18:7 | x | Variable x is not used |

cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp

@@ -1,3 +1,4 @@
+// semmle-extractor-options: -std=c++17
 
 int test_const_init()
 {
@@ -76,3 +77,89 @@ void test_expect()
 		}
 	}
 }
+
+// ---
+
+template<class T>
+class MyContainer
+{
+public:
+	struct Iterator {
+		const T& operator*() const;
+		bool operator!=(const Iterator &rhs) const;
+		Iterator operator++();
+	};
+
+	Iterator begin();
+	Iterator end();
+};
+
+void output(int value);
+
+void test_range_based_for()
+{
+	MyContainer<int> myContainer;
+	
+	for (int v1 : myContainer) // GOOD: v1 is used
+	{
+		output(v1);
+	}
+	
+	for (int v2 : myContainer) // BAD: v2 is not used
+	{
+	}
+}
+
+// ---
+
+int test_lambdas1()
+{
+	int a, b, c, d, e; // (b is not used, but is explicitly captured)
+	auto myLambda = [a, b, &c](int x, int y) -> int // (y is not used, but is a parameter)
+	{
+		return a + c + x;
+	};
+
+	return myLambda(d, e);
+}
+
+int test_lambdas2()
+{
+	int a, b; // BAD: b is not used
+	auto myLambda = [=]() -> int // BAD: myLambda is not used [NOT DETECTED] (due to containing a Constructor)
+	{
+		return a;
+	};
+
+	return 0;
+}
+
+// ---
+
+void test_if_initializer()
+{
+	bool a = false, b = true; // GOOD: a, b are both used
+
+	if (a = b; a)
+	{
+		// ...
+	}
+}
+
+// ---
+
+class MyObj
+{
+public:
+	MyObj();
+};
+
+template<class T>
+void myFunction2(T t);
+
+void test_captured_contructor()
+{
+	const auto &obj = MyObj(); // GOOD: obj is used
+
+	myFunction2( [obj](){} );
+}

cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected

@@ -5,10 +5,6 @@ edges
 | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
 | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
 | tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
-| tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
-| tests.c:28:22:28:25 | argv | tests.c:28:22:28:28 | access to array |
-| tests.c:28:22:28:28 | access to array | tests.c:28:22:28:28 | (const char *)... |
-| tests.c:28:22:28:28 | access to array | tests.c:28:22:28:28 | access to array |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
 | tests.c:29:28:29:31 | argv | tests.c:29:28:29:34 | access to array |
@@ -19,10 +15,6 @@ edges
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
 | tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
-| tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
-| tests.c:34:10:34:13 | argv | tests.c:34:10:34:16 | access to array |
-| tests.c:34:10:34:16 | access to array | tests.c:34:10:34:16 | (const char *)... |
-| tests.c:34:10:34:16 | access to array | tests.c:34:10:34:16 | access to array |
 nodes
 | tests.c:28:22:28:25 | argv | semmle.label | argv |
 | tests.c:28:22:28:25 | argv | semmle.label | argv |

cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected

@@ -5,10 +5,6 @@ edges
 | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
 | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
 | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
-| argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
-| argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array |
-| argvLocal.c:95:9:95:15 | access to array | argvLocal.c:95:9:95:15 | (const char *)... |
-| argvLocal.c:95:9:95:15 | access to array | argvLocal.c:95:9:95:15 | access to array |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
 | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array |
@@ -39,8 +35,6 @@ edges
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
-| argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
-| argvLocal.c:105:14:105:17 | argv | argvLocal.c:106:9:106:13 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array |
@@ -51,16 +45,10 @@ edges
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
-| argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
-| argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
 | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
-| argvLocal.c:106:9:106:13 | access to array | argvLocal.c:106:9:106:13 | (const char *)... |
-| argvLocal.c:106:9:106:13 | access to array | argvLocal.c:106:9:106:13 | access to array |
-| argvLocal.c:110:9:110:11 | * ... | argvLocal.c:110:9:110:11 | (const char *)... |
-| argvLocal.c:110:9:110:11 | * ... | argvLocal.c:110:9:110:11 | * ... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | (const char *)... |
 | argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | i3 |

cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

@@ -59,9 +59,8 @@ edges
 | test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
 | test.cpp:241:2:241:32 | Chi [array content] | test.cpp:279:17:279:20 | get_size output argument [array content] |
 | test.cpp:241:2:241:32 | Chi [array content] | test.cpp:295:18:295:21 | get_size output argument [array content] |
-| test.cpp:241:2:241:32 | Store | test.cpp:241:2:241:32 | Chi [array content] |
-| test.cpp:241:18:241:23 | call to getenv | test.cpp:241:2:241:32 | Store |
-| test.cpp:241:18:241:31 | (const char *)... | test.cpp:241:2:241:32 | Store |
+| test.cpp:241:18:241:23 | call to getenv | test.cpp:241:2:241:32 | Chi [array content] |
+| test.cpp:241:18:241:31 | (const char *)... | test.cpp:241:2:241:32 | Chi [array content] |
 | test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
 | test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
 | test.cpp:249:20:249:33 | (const char *)... | test.cpp:253:11:253:29 | ... * ... |
@@ -144,7 +143,7 @@ nodes
 | test.cpp:235:2:235:9 | Argument 0 | semmle.label | Argument 0 |
 | test.cpp:237:2:237:8 | Argument 0 | semmle.label | Argument 0 |
 | test.cpp:241:2:241:32 | Chi [array content] | semmle.label | Chi [array content] |
-| test.cpp:241:2:241:32 | Store | semmle.label | Store |
+| test.cpp:241:2:241:32 | ChiPartial | semmle.label | ChiPartial |
 | test.cpp:241:18:241:23 | call to getenv | semmle.label | call to getenv |
 | test.cpp:241:18:241:31 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:249:20:249:25 | call to getenv | semmle.label | call to getenv |

cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected

@@ -43,13 +43,11 @@ edges
 | test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
 | test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
 | test.cpp:13:2:13:15 | Chi [array content] | test.cpp:30:13:30:14 | get_rand2 output argument [array content] |
-| test.cpp:13:2:13:15 | Store | test.cpp:13:2:13:15 | Chi [array content] |
-| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Store |
-| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Store |
+| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Chi [array content] |
+| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Chi [array content] |
 | test.cpp:18:2:18:14 | Chi [array content] | test.cpp:36:13:36:13 | get_rand3 output argument [array content] |
-| test.cpp:18:2:18:14 | Store | test.cpp:18:2:18:14 | Chi [array content] |
-| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Store |
-| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Store |
+| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Chi [array content] |
+| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Chi [array content] |
 | test.cpp:24:11:24:18 | call to get_rand | test.cpp:25:7:25:7 | r |
 | test.cpp:24:11:24:18 | call to get_rand | test.cpp:25:7:25:7 | r |
 | test.cpp:30:13:30:14 | Chi | test.cpp:31:7:31:7 | r |
@@ -111,11 +109,11 @@ nodes
 | test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
 | test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
 | test.cpp:13:2:13:15 | Chi [array content] | semmle.label | Chi [array content] |
-| test.cpp:13:2:13:15 | Store | semmle.label | Store |
+| test.cpp:13:2:13:15 | ChiPartial | semmle.label | ChiPartial |
 | test.cpp:13:10:13:13 | call to rand | semmle.label | call to rand |
 | test.cpp:13:10:13:13 | call to rand | semmle.label | call to rand |
 | test.cpp:18:2:18:14 | Chi [array content] | semmle.label | Chi [array content] |
-| test.cpp:18:2:18:14 | Store | semmle.label | Store |
+| test.cpp:18:2:18:14 | ChiPartial | semmle.label | ChiPartial |
 | test.cpp:18:9:18:12 | call to rand | semmle.label | call to rand |
 | test.cpp:18:9:18:12 | call to rand | semmle.label | call to rand |
 | test.cpp:24:11:24:18 | call to get_rand | semmle.label | call to get_rand |