From 823ed447df465beee6ca6d7fb5d6f410d2708c35 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Thu, 12 Nov 2020 21:57:29 +0100
Subject: [PATCH 001/343] Python: Add new-style tests should perhaps move
 `LocalFlowStepTest` and `MaximalFlowStep` into where  they are referenced
 (they did not seem too reusable after all). Should also add argument tests in
 the same way.

---
 .../dataflow/FlowTestUtil/FlowTest.qll        |  31 ++++
 .../FlowTestUtil/LocalFlowStepTest.qll        |  13 ++
 .../dataflow/FlowTestUtil/MaximalFlowTest.qll |  34 +++++
 .../dataflow/basic/localFlowStepTest.expected |   0
 .../dataflow/basic/localFlowStepTest.ql       |   1 +
 .../dataflow/basic/maximalFlowTest.expected   |   0
 .../dataflow/basic/maximalFlowTest.ql         |   1 +
 .../test/experimental/dataflow/basic/test.py  |  12 +-
 .../dataflow/coverage/dataflowTest.expected   |   0
 .../dataflow/coverage/dataflowTest.ql         |  13 ++
 .../dataflow/coverage/datamodel.py            |  12 +-
 .../coverage/maximalFlowTest.expected         |   0
 .../dataflow/coverage/maximalFlowTest.ql      |   1 +
 .../experimental/dataflow/coverage/test.py    | 140 +++++++++---------
 14 files changed, 176 insertions(+), 82 deletions(-)
 create mode 100644 python/ql/test/experimental/dataflow/FlowTestUtil/FlowTest.qll
 create mode 100644 python/ql/test/experimental/dataflow/FlowTestUtil/LocalFlowStepTest.qll
 create mode 100644 python/ql/test/experimental/dataflow/FlowTestUtil/MaximalFlowTest.qll
 create mode 100644 python/ql/test/experimental/dataflow/basic/localFlowStepTest.expected
 create mode 100644 python/ql/test/experimental/dataflow/basic/localFlowStepTest.ql
 create mode 100644 python/ql/test/experimental/dataflow/basic/maximalFlowTest.expected
 create mode 100644 python/ql/test/experimental/dataflow/basic/maximalFlowTest.ql
 create mode 100644 python/ql/test/experimental/dataflow/coverage/dataflowTest.expected
 create mode 100644 python/ql/test/experimental/dataflow/coverage/dataflowTest.ql
 create mode 100644 python/ql/test/experimental/dataflow/coverage/maximalFlowTest.expected
 create mode 100644 python/ql/test/experimental/dataflow/coverage/maximalFlowTest.ql

diff --git a/python/ql/test/experimental/dataflow/FlowTestUtil/FlowTest.qll b/python/ql/test/experimental/dataflow/FlowTestUtil/FlowTest.qll
new file mode 100644
index 00000000000..9f0762f6488
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/FlowTestUtil/FlowTest.qll
@@ -0,0 +1,31 @@
+import python
+import semmle.python.dataflow.new.DataFlow
+import TestUtilities.InlineExpectationsTest
+
+abstract class FlowTest extends InlineExpectationsTest {
+  bindingset[this]
+  FlowTest() { any() }
+
+  abstract string flowTag();
+
+  abstract predicate relevantFlow(DataFlow::Node fromNode, DataFlow::Node toNode);
+
+  override string getARelevantTag() { result = this.flowTag() }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(DataFlow::Node fromNode, DataFlow::Node toNode | this.relevantFlow(fromNode, toNode) |
+      location = toNode.getLocation() and
+      tag = this.flowTag() and
+      value =
+        "\"" + fromNode.toString() + lineStr(fromNode, toNode) + " -> " + toNode.toString() + "\"" and
+      element = toNode.toString()
+    )
+  }
+
+  pragma[inline]
+  private string lineStr(DataFlow::Node fromNode, DataFlow::Node toNode) {
+    if fromNode.getLocation().getStartLine() = toNode.getLocation().getStartLine()
+    then result = ""
+    else result = ", l:" + fromNode.getLocation().getStartLine()
+  }
+}
diff --git a/python/ql/test/experimental/dataflow/FlowTestUtil/LocalFlowStepTest.qll b/python/ql/test/experimental/dataflow/FlowTestUtil/LocalFlowStepTest.qll
new file mode 100644
index 00000000000..c2c180627ec
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/FlowTestUtil/LocalFlowStepTest.qll
@@ -0,0 +1,13 @@
+import python
+import semmle.python.dataflow.new.DataFlow
+import FlowTest
+
+class LocalFlowStepTest extends FlowTest {
+  LocalFlowStepTest() { this = "LocalFlowStepTest" }
+
+  override string flowTag() { result = "step" }
+
+  override predicate relevantFlow(DataFlow::Node fromNode, DataFlow::Node toNode) {
+    DataFlow::localFlowStep(fromNode, toNode)
+  }
+}
diff --git a/python/ql/test/experimental/dataflow/FlowTestUtil/MaximalFlowTest.qll b/python/ql/test/experimental/dataflow/FlowTestUtil/MaximalFlowTest.qll
new file mode 100644
index 00000000000..792aa2b848d
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/FlowTestUtil/MaximalFlowTest.qll
@@ -0,0 +1,34 @@
+import python
+import semmle.python.dataflow.new.DataFlow
+import FlowTest
+
+class MaximalFlowTest extends FlowTest {
+  MaximalFlowTest() { this = "MaximalFlowTest" }
+
+  override string flowTag() { result = "flow" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    source != sink and
+    exists(MaximalFlowsConfig cfg | cfg.hasFlow(source, sink))
+  }
+}
+
+/**
+ * A configuration to find all "maximal" flows.
+ * To be used on small programs.
+ */
+class MaximalFlowsConfig extends DataFlow::Configuration {
+  MaximalFlowsConfig() { this = "MaximalFlowsConfig" }
+
+  override predicate isSource(DataFlow::Node node) {
+    not node.asCfgNode() instanceof CallNode and
+    not node.asCfgNode().getNode() instanceof Return and
+    not node instanceof DataFlow::ParameterNode and
+    not exists(DataFlow::Node pred | DataFlow::localFlowStep(pred, node))
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    not any(CallNode c).getArg(_) = node.asCfgNode() and
+    not exists(DataFlow::Node succ | DataFlow::localFlowStep(node, succ))
+  }
+}
diff --git a/python/ql/test/experimental/dataflow/basic/localFlowStepTest.expected b/python/ql/test/experimental/dataflow/basic/localFlowStepTest.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/python/ql/test/experimental/dataflow/basic/localFlowStepTest.ql b/python/ql/test/experimental/dataflow/basic/localFlowStepTest.ql
new file mode 100644
index 00000000000..6e57f26cd0f
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/basic/localFlowStepTest.ql
@@ -0,0 +1 @@
+import experimental.dataflow.FlowTestUtil.LocalFlowStepTest
diff --git a/python/ql/test/experimental/dataflow/basic/maximalFlowTest.expected b/python/ql/test/experimental/dataflow/basic/maximalFlowTest.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/python/ql/test/experimental/dataflow/basic/maximalFlowTest.ql b/python/ql/test/experimental/dataflow/basic/maximalFlowTest.ql
new file mode 100644
index 00000000000..ec171dcd9fd
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/basic/maximalFlowTest.ql
@@ -0,0 +1 @@
+import experimental.dataflow.FlowTestUtil.MaximalFlowTest
diff --git a/python/ql/test/experimental/dataflow/basic/test.py b/python/ql/test/experimental/dataflow/basic/test.py
index 416467d9dc9..e97068a041c 100644
--- a/python/ql/test/experimental/dataflow/basic/test.py
+++ b/python/ql/test/experimental/dataflow/basic/test.py
@@ -1,7 +1,7 @@
-def obfuscated_id(x):
-  y = x
-  z = y
-  return z
+def obfuscated_id(x): #$ step="ControlFlowNode for FunctionExpr -> GSSA Variable obfuscated_id"
+  y = x #$ step="ControlFlowNode for x -> SSA variable y" step="SSA variable x, l:1 -> ControlFlowNode for x"
+  z = y #$ step="ControlFlowNode for y -> SSA variable z" step="SSA variable y, l:2 -> ControlFlowNode for y"
+  return z #$ flow="ControlFlowNode for IntegerLiteral, l:6 -> ControlFlowNode for z" step="SSA variable z, l:3 -> ControlFlowNode for z"
 
-a = 42
-b = obfuscated_id(a)
+a = 42 #$ step="ControlFlowNode for IntegerLiteral -> GSSA Variable a"
+b = obfuscated_id(a) #$ flow="ControlFlowNode for IntegerLiteral, l:6 -> GSSA Variable b" flow="ControlFlowNode for FunctionExpr, l:1 -> ControlFlowNode for obfuscated_id" step="ControlFlowNode for obfuscated_id() -> GSSA Variable b" step="GSSA Variable obfuscated_id, l:1 -> ControlFlowNode for obfuscated_id" step="GSSA Variable a, l:6 -> ControlFlowNode for a"
diff --git a/python/ql/test/experimental/dataflow/coverage/dataflowTest.expected b/python/ql/test/experimental/dataflow/coverage/dataflowTest.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/python/ql/test/experimental/dataflow/coverage/dataflowTest.ql b/python/ql/test/experimental/dataflow/coverage/dataflowTest.ql
new file mode 100644
index 00000000000..c7b2b5bfe15
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/coverage/dataflowTest.ql
@@ -0,0 +1,13 @@
+import python
+import experimental.dataflow.FlowTestUtil.FlowTest
+import experimental.dataflow.testConfig
+
+class DataFlowTest extends FlowTest {
+  DataFlowTest() { this = "DataFlowTest" }
+
+  override string flowTag() { result = "flow" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(TestConfiguration cfg | cfg.hasFlow(source, sink))
+  }
+}
diff --git a/python/ql/test/experimental/dataflow/coverage/datamodel.py b/python/ql/test/experimental/dataflow/coverage/datamodel.py
index f5f3680dd55..d6ab9bd3dcb 100644
--- a/python/ql/test/experimental/dataflow/coverage/datamodel.py
+++ b/python/ql/test/experimental/dataflow/coverage/datamodel.py
@@ -35,7 +35,7 @@ def SINK_F(x):
 def f(a, b):
   return a
 
-SINK(f(SOURCE, 3))
+SINK(f(SOURCE, 3)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for f()"
 
 # Instance methods
 # An instance method object combines a class, a class instance and any callable object (normally a user-defined function).
@@ -68,8 +68,8 @@ c = C()
 func_obj = c.method.__func__
 
 # When an instance method object is called, the underlying function (__func__) is called, inserting the class instance (__self__) in front of the argument list. For instance, when C is a class which contains a definition for a function f(), and x is an instance of C, calling x.f(1) is equivalent to calling C.f(x, 1).
-SINK(c.method(SOURCE, C))
-SINK(C.method(c, SOURCE, C))
+SINK(c.method(SOURCE, C)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:38 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute()"
+SINK(C.method(c, SOURCE, C)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:38 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:71 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute()"
 SINK(func_obj(c, SOURCE, C))
 
 
@@ -77,8 +77,8 @@ SINK(func_obj(c, SOURCE, C))
 c_func_obj = C.classmethod.__func__
 
 # When an instance method object is derived from a class method object, the “class instance” stored in __self__ will actually be the class itself, so that calling either x.f(1) or C.f(1) is equivalent to calling f(C,1) where f is the underlying function.
-SINK(c.classmethod(SOURCE))
-SINK(C.classmethod(SOURCE))
+SINK(c.classmethod(SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:38 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:71 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:72 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:73 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute()"
+SINK(C.classmethod(SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:38 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:71 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:72 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:73 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:80 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute()"
 SINK(c_func_obj(C, SOURCE))
 
 # Generator functions
@@ -156,4 +156,4 @@ customized = Customized()
 SINK(Customized.a)
 SINK_F(Customized.b)
 SINK(customized.a)
-SINK(customized.b)  # Flow found
+SINK(customized.b)  #$ flow="ControlFlowNode for SOURCE, l:152 -> ControlFlowNode for Attribute" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute"
diff --git a/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.expected b/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.ql b/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.ql
new file mode 100644
index 00000000000..ec171dcd9fd
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.ql
@@ -0,0 +1 @@
+import experimental.dataflow.FlowTestUtil.MaximalFlowTest
diff --git a/python/ql/test/experimental/dataflow/coverage/test.py b/python/ql/test/experimental/dataflow/coverage/test.py
index cddb88f5ccb..ab7b9f02405 100644
--- a/python/ql/test/experimental/dataflow/coverage/test.py
+++ b/python/ql/test/experimental/dataflow/coverage/test.py
@@ -41,7 +41,7 @@ def SINK_F(x):
 def test_tuple_with_local_flow():
     x = (NONSOURCE, SOURCE)
     y = x[1]
-    SINK(y)
+    SINK(y) #$ flow="ControlFlowNode for SOURCE, l:42 -> ControlFlowNode for y" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for y"
 
 
 def test_tuple_negative():
@@ -53,45 +53,45 @@ def test_tuple_negative():
 # 6.2.1. Identifiers (Names)
 def test_names():
     x = SOURCE
-    SINK(x)
+    SINK(x) #$ flow="ControlFlowNode for SOURCE, l:55 -> ControlFlowNode for x" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
 
 
 # 6.2.2. Literals
 def test_string_literal():
     x = "source"
-    SINK(x)
+    SINK(x) #$ flow="ControlFlowNode for Str, l:61 -> ControlFlowNode for x" 
 
 
 def test_bytes_literal():
     x = b"source"
-    SINK(x)
+    SINK(x) #$ flow="ControlFlowNode for Str, l:66 -> ControlFlowNode for x"
 
 
 def test_integer_literal():
     x = 42
-    SINK(x)
+    SINK(x) #$ flow="ControlFlowNode for IntegerLiteral, l:71 -> ControlFlowNode for x"
 
 
 def test_floatnumber_literal():
     x = 42.0
-    SINK(x)
+    SINK(x) #$ flow="ControlFlowNode for FloatLiteral, l:76 -> ControlFlowNode for x"
 
 
 def test_imagnumber_literal():
     x = 42j
-    SINK(x)  # Flow missing
+    SINK(x) #$ MISSING:flow="ControlFlowNode for FloatLiteral, l:81 -> ControlFlowNode for x"
 
 
 # 6.2.3. Parenthesized forms
 def test_parenthesized_form():
     x = (SOURCE)
-    SINK(x)
+    SINK(x) #$ flow="ControlFlowNode for SOURCE, l:87 -> ControlFlowNode for x" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
 
 
 # 6.2.5. List displays
 def test_list_display():
     x = [SOURCE]
-    SINK(x[0])
+    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:93 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_list_display_negative():
@@ -101,109 +101,109 @@ def test_list_display_negative():
 
 def test_list_comprehension():
     x = [SOURCE for y in [NONSOURCE]]
-    SINK(x[0])
+    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:103 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_list_comprehension_flow():
     x = [y for y in [SOURCE]]
-    SINK(x[0])
+    SINK(x[0]) #$  flow="ControlFlowNode for SOURCE, l:108 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_list_comprehension_inflow():
     l = [SOURCE]
     x = [y for y in l]
-    SINK(x[0])
+    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:113 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_nested_list_display():
     x = [*[SOURCE]]
-    SINK(x[0])  # Flow missing
+    SINK(x[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:119 -> ControlFlowNode for Subscript" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 # 6.2.6. Set displays
 def test_set_display():
     x = {SOURCE}
-    SINK(x.pop())
+    SINK(x.pop()) #$ flow="ControlFlowNode for SOURCE, l:125 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def test_set_comprehension():
     x = {SOURCE for y in [NONSOURCE]}
-    SINK(x.pop())
+    SINK(x.pop()) #$ flow="ControlFlowNode for SOURCE, l:130 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def test_set_comprehension_flow():
     x = {y for y in [SOURCE]}
-    SINK(x.pop())
+    SINK(x.pop()) #$ flow="ControlFlowNode for SOURCE, l:135 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def test_set_comprehension_inflow():
     l = {SOURCE}
     x = {y for y in l}
-    SINK(x.pop())
+    SINK(x.pop()) #$ flow="ControlFlowNode for SOURCE, l:140 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def test_nested_set_display():
     x = {*{SOURCE}}
-    SINK(x.pop())  # Flow missing
+    SINK(x.pop()) #$ MISSING:flow="ControlFlowNode for SOURCE, l:146 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 # 6.2.7. Dictionary displays
 def test_dict_display():
     x = {"s": SOURCE}
-    SINK(x["s"])
+    SINK(x["s"]) #$ flow="ControlFlowNode for SOURCE, l:152 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_dict_display_pop():
     x = {"s": SOURCE}
-    SINK(x.pop("s"))
+    SINK(x.pop("s")) #$ flow="ControlFlowNode for SOURCE, l:157 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def test_dict_comprehension():
     x = {y: SOURCE for y in ["s"]}
-    SINK(x["s"])  # Flow missing
+    SINK(x["s"]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:152 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_dict_comprehension_pop():
     x = {y: SOURCE for y in ["s"]}
-    SINK(x.pop("s"))  # Flow missing
+    SINK(x.pop("s")) #$ MISSING:flow="ControlFlowNode for SOURCE, l:167 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def test_nested_dict_display():
     x = {**{"s": SOURCE}}
-    SINK(x["s"])  # Flow missing
+    SINK(x["s"]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:172 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_nested_dict_display_pop():
     x = {**{"s": SOURCE}}
-    SINK(x.pop("s"))  # Flow missing
+    SINK(x.pop("s")) #$ MISSING:flow="ControlFlowNode for SOURCE, l:177 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 # Nested comprehensions
 def test_nested_comprehension():
     x = [y for z in [[SOURCE]] for y in z]
-    SINK(x[0])
+    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:183 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_nested_comprehension_deep_with_local_flow():
     x = [y for v in [[[[SOURCE]]]] for u in v for z in u for y in z]
-    SINK(x[0])
+    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:188 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_nested_comprehension_dict():
     d = {"s": [SOURCE]}
     x = [y for k, v in d.items() for y in v]
-    SINK(x[0])  # Flow missing
+    SINK(x[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:193 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_nested_comprehension_paren():
     x = [y for y in (z for z in [SOURCE])]
-    SINK(x[0])
+    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:199 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 # 6.2.8. Generator expressions
 def test_generator():
     x = (SOURCE for y in [NONSOURCE])
-    SINK([*x][0])  # Flow missing
+    SINK([*x][0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:205 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 # 6.2.9. Yield expressions
@@ -213,7 +213,7 @@ def gen(x):
 
 def test_yield():
     g = gen(SOURCE)
-    SINK(next(g))  # Flow missing
+    SINK(next(g)) #$ MISSING:flow="ControlFlowNode for SOURCE, l:215 -> ControlFlowNode for next()" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for next()"
 
 
 def gen_from(x):
@@ -222,19 +222,19 @@ def gen_from(x):
 
 def test_yield_from():
     g = gen_from(SOURCE)
-    SINK(next(g))  # Flow missing
+    SINK(next(g)) #$ MISSING:flow="ControlFlowNode for SOURCE, l:224 -> ControlFlowNode for next()" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for next()"
 
 
 # a statement rather than an expression, but related to generators
 def test_for():
     for x in gen(SOURCE):
-        SINK(x)  # Flow missing
+        SINK(x) #$ MISSING:flow="ControlFlowNode for SOURCE, l:230 -> ControlFlowNode for x" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
 
 
 # 6.2.9.1. Generator-iterator methods
 def test___next__():
     g = gen(SOURCE)
-    SINK(g.__next__())  # Flow missing
+    SINK(g.__next__()) #$ MISSING:flow="ControlFlowNode for SOURCE, l:236 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def gen2(x):
@@ -246,7 +246,7 @@ def gen2(x):
 def test_send():
     g = gen2(NONSOURCE)
     n = next(g)
-    SINK(g.send(SOURCE))  # Flow missing
+    SINK(g.send(SOURCE)) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def gen_ex(x):
@@ -259,7 +259,7 @@ def gen_ex(x):
 def test_throw():
     g = gen_ex(SOURCE)
     n = next(g)
-    SINK(g.throw(TypeError))  # Flow missing
+    SINK(g.throw(TypeError)) #$ MISSING:flow="ControlFlowNode for SOURCE, l:260 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 # no `test_close` as `close` involves no data flow
@@ -280,7 +280,7 @@ def runa(a):
 
 async def atest___anext__():
     g = agen(SOURCE)
-    SINK(await g.__anext__())  # Flow missing
+    SINK(await g.__anext__()) #$ MISSING:flow="ControlFlowNode for SOURCE, l:282 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def test___anext__():
@@ -296,7 +296,7 @@ async def agen2(x):
 async def atest_asend():
     g = agen2(NONSOURCE)
     n = await g.__anext__()
-    SINK(await g.asend(SOURCE))  # Flow missing
+    SINK(await g.asend(SOURCE)) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def test_asend():
@@ -313,7 +313,7 @@ async def agen_ex(x):
 async def atest_athrow():
     g = agen_ex(SOURCE)
     n = await g.__anext__()
-    SINK(await g.athrow(TypeError))  # Flow missing
+    SINK(await g.athrow(TypeError)) #$ MISSING:flow="ControlFlowNode for SOURCE, l:314 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
 
 
 def test_athrow():
@@ -326,22 +326,22 @@ class C:
 
 
 def test_attribute_reference():
-    SINK(C.a)  # Flow missing
+    SINK(C.a) #$ MISSING:flow="ControlFlowNode for SOURCE, l:325 -> ControlFlowNode for Attribute" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute"
 
 
 # overriding __getattr__ should be tested by the class coverage tests
 
 # 6.3.2. Subscriptions
 def test_subscription_tuple():
-    SINK((SOURCE,)[0])
+    SINK((SOURCE,)[0]) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_subscription_list():
-    SINK([SOURCE][0])
+    SINK([SOURCE][0]) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 def test_subscription_mapping():
-    SINK({"s": SOURCE}["s"])
+    SINK({"s": SOURCE}["s"]) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 # overriding __getitem__ should be tested by the class coverage tests
@@ -353,7 +353,7 @@ l = [SOURCE]
 
 def test_slicing():
     s = l[0:1:1]
-    SINK(s[0])  # Flow missing
+    SINK(s[0]) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for Subscript" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
 
 
 # The grammar seems to allow `l[0:1:1, 0:1]`, but the interpreter does not like it
@@ -364,7 +364,7 @@ def second(a, b):
 
 
 def test_call_positional():
-    SINK(second(NONSOURCE, SOURCE))
+    SINK(second(NONSOURCE, SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
 
 
 def test_call_positional_negative():
@@ -372,15 +372,15 @@ def test_call_positional_negative():
 
 
 def test_call_keyword():
-    SINK(second(NONSOURCE, b=SOURCE))
+    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
 
 
 def test_call_unpack_iterable():
-    SINK(second(NONSOURCE, *[SOURCE]))  # Flow missing
+    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
 
 
 def test_call_unpack_mapping():
-    SINK(second(NONSOURCE, **{"b": SOURCE}))
+    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
 
 
 def f_extra_pos(a, *b):
@@ -388,7 +388,7 @@ def f_extra_pos(a, *b):
 
 
 def test_call_extra_pos():
-    SINK(f_extra_pos(NONSOURCE, SOURCE))
+    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_pos()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_pos()"
 
 
 def f_extra_keyword(a, **b):
@@ -396,7 +396,7 @@ def f_extra_keyword(a, **b):
 
 
 def test_call_extra_keyword():
-    SINK(f_extra_keyword(NONSOURCE, b=SOURCE))
+    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_keyword()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_keyword()"
 
 
 # return the name of the first extra keyword argument
@@ -406,18 +406,18 @@ def f_extra_keyword_flow(**a):
 
 # call the function with our source as the name of the keyword arguemnt
 def test_call_extra_keyword_flow():
-    SINK(f_extra_keyword_flow(**{SOURCE: None}))  # Flow missing
+    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_keyword()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_keyword()"
 
 
 # 6.12. Assignment expressions
 def test_assignment_expression():
     x = NONSOURCE
-    SINK(x := SOURCE)  # Flow missing
+    SINK(x := SOURCE) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for x" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
 
 
 # 6.13. Conditional expressions
 def test_conditional_true():
-    SINK(SOURCE if True else NONSOURCE)
+    SINK(SOURCE if True else NONSOURCE) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for IfExp" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for IfExp"
 
 
 def test_conditional_true_guards():
@@ -425,7 +425,7 @@ def test_conditional_true_guards():
 
 
 def test_conditional_false():
-    SINK(NONSOURCE if False else SOURCE)
+    SINK(NONSOURCE if False else SOURCE) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for IfExp" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for IfExp"
 
 
 def test_conditional_false_guards():
@@ -435,13 +435,13 @@ def test_conditional_false_guards():
 # Condition is evaluated first, so x is SOURCE once chosen
 def test_conditional_evaluation_true():
     x = NONSOURCE
-    SINK(x if (SOURCE == (x := SOURCE)) else NONSOURCE)  # Flow missing
+    SINK(x if (SOURCE == (x := SOURCE)) else NONSOURCE) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for IfExp" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for IfExp"
 
 
 # Condition is evaluated first, so x is SOURCE once chosen
 def test_conditional_evaluation_false():
     x = NONSOURCE
-    SINK(NONSOURCE if (NONSOURCE == (x := SOURCE)) else x)  # Flow missing
+    SINK(NONSOURCE if (NONSOURCE == (x := SOURCE)) else x) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for IfExp" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for IfExp"
 
 
 # 6.14. Lambdas
@@ -449,14 +449,14 @@ def test_lambda():
     def f(x):
         return x
 
-    SINK(f(SOURCE))
+    SINK(f(SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f()"
 
 
 def test_lambda_positional():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, SOURCE))
+    SINK(second(NONSOURCE, SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
 
 
 def test_lambda_positional_negative():
@@ -470,50 +470,50 @@ def test_lambda_keyword():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, b=SOURCE))
+    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
 
 
 def test_lambda_unpack_iterable():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, *[SOURCE]))  # Flow missing
+    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"  # Flow missing
 
 
 def test_lambda_unpack_mapping():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, **{"b": SOURCE}))
+    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
 
 
 def test_lambda_extra_pos():
     f_extra_pos = lambda a, *b: b[0]
-    SINK(f_extra_pos(NONSOURCE, SOURCE))
+    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_pos()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_pos()"
 
 
 def test_lambda_extra_keyword():
     f_extra_keyword = lambda a, **b: b["b"]
-    SINK(f_extra_keyword(NONSOURCE, b=SOURCE))
+    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_keyword()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_keyword()"
 
 
 # call the function with our source as the name of the keyword argument
 def test_lambda_extra_keyword_flow():
     # return the name of the first extra keyword argument
     f_extra_keyword_flow = lambda **a: [*a][0]
-    SINK(f_extra_keyword_flow(**{SOURCE: None}))  # Flow missing
+    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_keyword()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_keyword()"
 
 
 @expects(4)
 def test_swap():
     a = SOURCE
     b = NONSOURCE
-    SINK(a)
+    SINK(a) #$ flow="ControlFlowNode for SOURCE, l:509 -> ControlFlowNode for a" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for a"
     SINK_F(b)
 
     a, b = b, a
     SINK_F(a)
-    SINK(b)
+    SINK(b) #$ flow="ControlFlowNode for SOURCE, l:509 -> ControlFlowNode for b" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for b"
 
 
 def test_deep_callgraph():
@@ -538,7 +538,7 @@ def test_deep_callgraph():
         return f5(arg)
 
     x = f6(SOURCE)
-    SINK(x)  # Flow missing
+    SINK(x) #$ MISSING:flow="ControlFlowNode for SOURCE, l:540 -> ControlFlowNode for x" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
 
 
 @expects(2)
@@ -547,7 +547,7 @@ def test_dynamic_tuple_creation_1():
     tup += (SOURCE,)
     tup += (NONSOURCE,)
 
-    SINK(tup[0])  # Flow missing
+    SINK(tup[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:547 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
     SINK_F(tup[1])
 
 
@@ -557,7 +557,7 @@ def test_dynamic_tuple_creation_2():
     tup += (SOURCE,)
     tup += (NONSOURCE,)
 
-    SINK(tup[0])  # Flow missing
+    SINK(tup[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:557 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
     SINK_F(tup[1])
 
 
@@ -567,7 +567,7 @@ def test_dynamic_tuple_creation_3():
     tup2 = (NONSOURCE,)
     tup = tup1 + tup2
 
-    SINK(tup[0])  # Flow missing
+    SINK(tup[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:566 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
     SINK_F(tup[1])
 
 
@@ -578,5 +578,5 @@ def test_dynamic_tuple_creation_4():
     for item in [SOURCE, NONSOURCE]:
         tup += (item,)
 
-    SINK(tup[0])  # Flow missing
+    SINK(tup[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:578 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
     SINK_F(tup[1])

From 4fe2576b9ab6d6ca6daec333ba7a10f9a3d6806e Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Thu, 12 Nov 2020 22:43:34 +0100
Subject: [PATCH 002/343] Python: start modernizing routing tests

---
 .../dataflow/coverage/argumentPassing.py      | 34 ++++----
 .../coverage/argumentRoutingTest.expected     | 32 +++++++
 .../dataflow/coverage/argumentRoutingTest.ql  | 83 +++++++++++++++++++
 3 files changed, 132 insertions(+), 17 deletions(-)
 create mode 100644 python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected
 create mode 100644 python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql

diff --git a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
index c1efdd1d28f..38f3123fab5 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
+++ b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
@@ -72,8 +72,8 @@ def argument_passing(
     f,
     **g,
 ):
-    SINK1(a)
-    SINK2(b)
+    SINK1(a) #$ arg1="ControlFlowNode for arg1, l:89 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:94 -> ControlFlowNode for a"
+    SINK2(b) #$ arg2="ControlFlowNode for arg2, l:94 -> ControlFlowNode for b" MISSING:arg2="ControlFlowNode for arg2, l:89 -> ControlFlowNode for b"
     SINK3(c)
     SINK4(d)
     SINK5(e)
@@ -95,8 +95,8 @@ def test_argument_passing2():
 
 
 def with_pos_only(a, /, b):
-    SINK1(a)
-    SINK2(b)
+    SINK1(a) #$ arg1="ControlFlowNode for arg1, l:104 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:105 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:106 -> ControlFlowNode for a"
+    SINK2(b) #$ arg2="ControlFlowNode for arg2, l:104 -> ControlFlowNode for b" arg2="ControlFlowNode for arg2, l:105 -> ControlFlowNode for b" MISSING: arg2="ControlFlowNode for arg2, l:106 -> ControlFlowNode for b"
 
 
 @expects(6)
@@ -107,8 +107,8 @@ def test_pos_only():
 
 
 def with_multiple_kw_args(a, b, c):
-    SINK1(a)
-    SINK2(b)
+    SINK1(a) #$ arg1="ControlFlowNode for arg1, l:117 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:118 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:119 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:120 -> ControlFlowNode for a"
+    SINK2(b) #$ arg2="ControlFlowNode for arg2, l:117 -> ControlFlowNode for b" arg2="ControlFlowNode for arg2, l:120 -> ControlFlowNode for b" MISSING: arg2="ControlFlowNode for arg2, l:118 -> ControlFlowNode for b" arg2="ControlFlowNode for arg2, l:119 -> ControlFlowNode for b"
     SINK3(c)
 
 
@@ -121,8 +121,8 @@ def test_multiple_kw_args():
 
 
 def with_default_arguments(a=arg1, b=arg2, c=arg3):
-    SINK1(a)
-    SINK2(b)
+    SINK1(a) #$ arg1="ControlFlowNode for arg1, l:132 -> ControlFlowNode for a" MISSING:arg1="ControlFlowNode for arg1, l:123 -> ControlFlowNode for a"
+    SINK2(b) #$ arg2="ControlFlowNode for arg2, l:133 -> ControlFlowNode for b" MISSING: arg2="ControlFlowNode for arg2, l:123 -> ControlFlowNode for b"
     SINK3(c)
 
 
@@ -136,14 +136,14 @@ def test_default_arguments():
 
 # Nested constructor pattern
 def grab_foo_bar_baz(foo, **kwargs):
-    SINK1(foo)
+    SINK1(foo) #$ arg1="ControlFlowNode for arg1, l:160 -> ControlFlowNode for foo"
     grab_bar_baz(**kwargs)
 
 
 # It is not possible to pass `bar` into `kwargs`,
 # since `bar` is a valid keyword argument.
 def grab_bar_baz(bar, **kwargs):
-    SINK2(bar)
+    SINK2(bar) #$ arg2="ControlFlowNode for arg2, l:160 -> ControlFlowNode for bar"
     try:
         SINK2_F(kwargs["bar"])
     except:
@@ -163,14 +163,14 @@ def test_grab():
 # All combinations
 def test_pos_pos():
     def with_pos(a):
-        SINK1(a)
+        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:168 -> ControlFlowNode for a"
 
     with_pos(arg1)
 
 
 def test_pos_pos_only():
     def with_pos_only(a, /):
-        SINK1(a)
+        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:175 -> ControlFlowNode for a"
 
     with_pos_only(arg1)
 
@@ -178,34 +178,34 @@ def test_pos_pos_only():
 def test_pos_star():
     def with_star(*a):
         if len(a) > 0:
-            SINK1(a[0])
+            SINK1(a[0]) #$ arg1="ControlFlowNode for arg1, l:183 -> ControlFlowNode for Subscript"
 
     with_star(arg1)
 
 
 def test_pos_kw():
     def with_kw(a=""):
-        SINK1(a)
+        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:190 -> ControlFlowNode for a"
 
     with_kw(arg1)
 
 
 def test_kw_pos():
     def with_pos(a):
-        SINK1(a)
+        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:197 -> ControlFlowNode for a"
 
     with_pos(a=arg1)
 
 
 def test_kw_kw():
     def with_kw(a=""):
-        SINK1(a)
+        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:204 -> ControlFlowNode for a"
 
     with_kw(a=arg1)
 
 
 def test_kw_doublestar():
     def with_doublestar(**a):
-        SINK1(a["a"])
+        SINK1(a["a"]) #$ arg1="ControlFlowNode for arg1, l:211 -> ControlFlowNode for Subscript"
 
     with_doublestar(a=arg1)
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected
new file mode 100644
index 00000000000..5dfe0963387
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected
@@ -0,0 +1,32 @@
+| classes.py:556:15:556:17 | ControlFlowNode for key | Unexpected result: arg2="ControlFlowNode for arg2, l:565 -> ControlFlowNode for key" |
+| classes.py:557:15:557:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_getitem, l:563 -> ControlFlowNode for self" |
+| classes.py:572:15:572:17 | ControlFlowNode for key | Unexpected result: arg2="ControlFlowNode for arg2, l:581 -> ControlFlowNode for key" |
+| classes.py:573:15:573:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_setitem, l:578 -> ControlFlowNode for self" |
+| classes.py:587:15:587:17 | ControlFlowNode for key | Unexpected result: arg2="ControlFlowNode for arg2, l:595 -> ControlFlowNode for key" |
+| classes.py:588:15:588:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_delitem, l:593 -> ControlFlowNode for self" |
+| classes.py:658:15:658:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:667 -> ControlFlowNode for other" |
+| classes.py:659:15:659:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_add, l:665 -> ControlFlowNode for self" |
+| classes.py:673:15:673:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:682 -> ControlFlowNode for other" |
+| classes.py:674:15:674:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_sub, l:680 -> ControlFlowNode for self" |
+| classes.py:688:15:688:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:697 -> ControlFlowNode for other" |
+| classes.py:689:15:689:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_mul, l:695 -> ControlFlowNode for self" |
+| classes.py:703:15:703:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:712 -> ControlFlowNode for other" |
+| classes.py:704:15:704:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_matmul, l:710 -> ControlFlowNode for self" |
+| classes.py:718:15:718:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:727 -> ControlFlowNode for other" |
+| classes.py:719:15:719:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_truediv, l:725 -> ControlFlowNode for self" |
+| classes.py:733:15:733:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:742 -> ControlFlowNode for other" |
+| classes.py:734:15:734:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_floordiv, l:740 -> ControlFlowNode for self" |
+| classes.py:748:15:748:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:757 -> ControlFlowNode for other" |
+| classes.py:749:15:749:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_mod, l:755 -> ControlFlowNode for self" |
+| classes.py:778:15:778:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:793 -> ControlFlowNode for other" |
+| classes.py:779:15:779:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_pow, l:791 -> ControlFlowNode for self" |
+| classes.py:799:15:799:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:808 -> ControlFlowNode for other" |
+| classes.py:800:15:800:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_lshift, l:806 -> ControlFlowNode for self" |
+| classes.py:814:15:814:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:823 -> ControlFlowNode for other" |
+| classes.py:815:15:815:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_rshift, l:821 -> ControlFlowNode for self" |
+| classes.py:829:15:829:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:838 -> ControlFlowNode for other" |
+| classes.py:830:15:830:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_and, l:836 -> ControlFlowNode for self" |
+| classes.py:844:15:844:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:853 -> ControlFlowNode for other" |
+| classes.py:845:15:845:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_xor, l:851 -> ControlFlowNode for self" |
+| classes.py:859:15:859:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:868 -> ControlFlowNode for other" |
+| classes.py:860:15:860:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_or, l:866 -> ControlFlowNode for self" |
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
new file mode 100644
index 00000000000..5b8e80cad2a
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
@@ -0,0 +1,83 @@
+import python
+import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
+import experimental.dataflow.FlowTestUtil.FlowTest
+
+class Argument1RoutingTest extends FlowTest {
+  Argument1RoutingTest() { this = "Argument1RoutingTest" }
+
+  override string flowTag() { result = "arg1" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(Argument1RoutingConfig cfg | cfg.hasFlow(source, sink))
+  }
+}
+
+/**
+ * A configuration to check routing of arguments through magic methods.
+ */
+class Argument1RoutingConfig extends DataFlow::Configuration {
+  Argument1RoutingConfig() { this = "Argument1RoutingConfig" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "arg1"
+    or
+    exists(AssignmentDefinition def, DataFlowPrivate::DataFlowCall call |
+      def.getVariable() = node.(DataFlow::EssaNode).getVar() and
+      def.getValue() = call.getNode() and
+      call.getNode().(CallNode).getFunction().(NameNode).getId().matches("With\\_%")
+    ) and
+    node.(DataFlow::EssaNode).getVar().getName().matches("with\\_%")
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(CallNode call |
+      call.getFunction().(NameNode).getId() = "SINK1" and
+      node.(DataFlow::CfgNode).getNode() = call.getAnArg()
+    )
+  }
+
+  /**
+   * We want to be able to use `arg` in a sequence of calls such as `func(kw=arg); ... ; func(arg)`.
+   * Use-use flow lets the argument to the first call reach the sink inside the second call,
+   * making it seem like we handle all cases even if we only handle the last one.
+   * We make the test honest by preventing flow into source nodes.
+   */
+  override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+}
+
+class Argument2RoutingTest extends FlowTest {
+  Argument2RoutingTest() { this = "Argument2RoutingTest" }
+
+  override string flowTag() { result = "arg2" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(Argument2RoutingConfig cfg | cfg.hasFlow(source, sink))
+  }
+}
+
+/**
+ * A configuration to check routing of arguments through magic methods.
+ */
+class Argument2RoutingConfig extends DataFlow::Configuration {
+  Argument2RoutingConfig() { this = "Argument2RoutingConfig" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "arg2"
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(CallNode call |
+      call.getFunction().(NameNode).getId() = "SINK2" and
+      node.(DataFlow::CfgNode).getNode() = call.getAnArg()
+    )
+  }
+
+  /**
+   * We want to be able to use `arg` in a sequence of calls such as `func(kw=arg); ... ; func(arg)`.
+   * Use-use flow lets the argument to the first call reach the sink inside the second call,
+   * making it seem like we handle all cases even if we only handle the last one.
+   * We make the test honest by preventing flow into source nodes.
+   */
+  override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+}

From e468d49b1905470a8e03a01a21ce0b838db546cf Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Thu, 12 Nov 2020 23:07:01 +0100
Subject: [PATCH 003/343] Python: routing tests 3-7 and some annotations

---
 .../dataflow/coverage/argumentPassing.py      |  16 +-
 .../coverage/argumentRoutingTest.expected     |   1 +
 .../dataflow/coverage/argumentRoutingTest.ql  | 180 ++++++++++++++++++
 3 files changed, 189 insertions(+), 8 deletions(-)

diff --git a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
index 38f3123fab5..7f1a832bf61 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
+++ b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
@@ -74,12 +74,12 @@ def argument_passing(
 ):
     SINK1(a) #$ arg1="ControlFlowNode for arg1, l:89 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:94 -> ControlFlowNode for a"
     SINK2(b) #$ arg2="ControlFlowNode for arg2, l:94 -> ControlFlowNode for b" MISSING:arg2="ControlFlowNode for arg2, l:89 -> ControlFlowNode for b"
-    SINK3(c)
-    SINK4(d)
-    SINK5(e)
-    SINK6(f)
+    SINK3(c) #$ arg3="ControlFlowNode for arg3, l:94 -> ControlFlowNode for c" MISSING: arg3="ControlFlowNode for arg3, l:89 -> ControlFlowNode for c"
+    SINK4(d) #$ MISSING: arg4="ControlFlowNode for arg4, l:89 -> ControlFlowNode for d"
+    SINK5(e) #$ MISSING: arg5="ControlFlowNode for arg5, l:89 -> ControlFlowNode for e"
+    SINK6(f) #$ MISSING: arg6="ControlFlowNode for arg6, l:89 -> ControlFlowNode for f"
     try:
-        SINK7(g["g"])
+        SINK7(g["g"]) #$ arg7="ControlFlowNode for arg7, l:89 -> ControlFlowNode for Subscript"
     except:
         print("OK")
 
@@ -109,7 +109,7 @@ def test_pos_only():
 def with_multiple_kw_args(a, b, c):
     SINK1(a) #$ arg1="ControlFlowNode for arg1, l:117 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:118 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:119 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:120 -> ControlFlowNode for a"
     SINK2(b) #$ arg2="ControlFlowNode for arg2, l:117 -> ControlFlowNode for b" arg2="ControlFlowNode for arg2, l:120 -> ControlFlowNode for b" MISSING: arg2="ControlFlowNode for arg2, l:118 -> ControlFlowNode for b" arg2="ControlFlowNode for arg2, l:119 -> ControlFlowNode for b"
-    SINK3(c)
+    SINK3(c) #$ arg3="ControlFlowNode for arg3, l:117 -> ControlFlowNode for c" arg3="ControlFlowNode for arg3, l:119 -> ControlFlowNode for c" arg3="ControlFlowNode for arg3, l:120 -> ControlFlowNode for c" MISSING: arg3="ControlFlowNode for arg3, l:118 -> ControlFlowNode for c"
 
 
 @expects(9)
@@ -123,7 +123,7 @@ def test_multiple_kw_args():
 def with_default_arguments(a=arg1, b=arg2, c=arg3):
     SINK1(a) #$ arg1="ControlFlowNode for arg1, l:132 -> ControlFlowNode for a" MISSING:arg1="ControlFlowNode for arg1, l:123 -> ControlFlowNode for a"
     SINK2(b) #$ arg2="ControlFlowNode for arg2, l:133 -> ControlFlowNode for b" MISSING: arg2="ControlFlowNode for arg2, l:123 -> ControlFlowNode for b"
-    SINK3(c)
+    SINK3(c) #$ arg3="ControlFlowNode for arg3, l:134 -> ControlFlowNode for c" MISSING: arg3="ControlFlowNode for arg3, l:123 -> ControlFlowNode for c"
 
 
 @expects(12)
@@ -152,7 +152,7 @@ def grab_bar_baz(bar, **kwargs):
 
 
 def grab_baz(baz):
-    SINK3(baz)
+    SINK3(baz) #$ arg3="ControlFlowNode for arg3, l:160 -> ControlFlowNode for baz"
 
 
 @expects(4)
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected
index 5dfe0963387..5624d283462 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected
@@ -1,5 +1,6 @@
 | classes.py:556:15:556:17 | ControlFlowNode for key | Unexpected result: arg2="ControlFlowNode for arg2, l:565 -> ControlFlowNode for key" |
 | classes.py:557:15:557:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_getitem, l:563 -> ControlFlowNode for self" |
+| classes.py:571:15:571:19 | ControlFlowNode for value | Unexpected result: arg3="ControlFlowNode for arg3, l:581 -> ControlFlowNode for value" |
 | classes.py:572:15:572:17 | ControlFlowNode for key | Unexpected result: arg2="ControlFlowNode for arg2, l:581 -> ControlFlowNode for key" |
 | classes.py:573:15:573:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_setitem, l:578 -> ControlFlowNode for self" |
 | classes.py:587:15:587:17 | ControlFlowNode for key | Unexpected result: arg2="ControlFlowNode for arg2, l:595 -> ControlFlowNode for key" |
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
index 5b8e80cad2a..00cc3a49656 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
@@ -81,3 +81,183 @@ class Argument2RoutingConfig extends DataFlow::Configuration {
    */
   override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
 }
+
+class Argument3RoutingTest extends FlowTest {
+  Argument3RoutingTest() { this = "Argument3RoutingTest" }
+
+  override string flowTag() { result = "arg3" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(Argument3RoutingConfig cfg | cfg.hasFlow(source, sink))
+  }
+}
+
+/**
+ * A configuration to check routing of arguments through magic methods.
+ */
+class Argument3RoutingConfig extends DataFlow::Configuration {
+  Argument3RoutingConfig() { this = "Argument3RoutingConfig" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "arg3"
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(CallNode call |
+      call.getFunction().(NameNode).getId() = "SINK3" and
+      node.(DataFlow::CfgNode).getNode() = call.getAnArg()
+    )
+  }
+
+  /**
+   * We want to be able to use `arg` in a sequence of calls such as `func(kw=arg); ... ; func(arg)`.
+   * Use-use flow lets the argument to the first call reach the sink inside the second call,
+   * making it seem like we handle all cases even if we only handle the last one.
+   * We make the test honest by preventing flow into source nodes.
+   */
+  override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+}
+
+class Argument4RoutingTest extends FlowTest {
+  Argument4RoutingTest() { this = "Argument4RoutingTest" }
+
+  override string flowTag() { result = "arg4" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(Argument4RoutingConfig cfg | cfg.hasFlow(source, sink))
+  }
+}
+
+/**
+ * A configuration to check routing of arguments through magic methods.
+ */
+class Argument4RoutingConfig extends DataFlow::Configuration {
+  Argument4RoutingConfig() { this = "Argument4RoutingConfig" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "arg4"
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(CallNode call |
+      call.getFunction().(NameNode).getId() = "SINK4" and
+      node.(DataFlow::CfgNode).getNode() = call.getAnArg()
+    )
+  }
+
+  /**
+   * We want to be able to use `arg` in a sequence of calls such as `func(kw=arg); ... ; func(arg)`.
+   * Use-use flow lets the argument to the first call reach the sink inside the second call,
+   * making it seem like we handle all cases even if we only handle the last one.
+   * We make the test honest by preventing flow into source nodes.
+   */
+  override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+}
+
+class Argument5RoutingTest extends FlowTest {
+  Argument5RoutingTest() { this = "Argument5RoutingTest" }
+
+  override string flowTag() { result = "arg5" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(Argument5RoutingConfig cfg | cfg.hasFlow(source, sink))
+  }
+}
+
+/**
+ * A configuration to check routing of arguments through magic methods.
+ */
+class Argument5RoutingConfig extends DataFlow::Configuration {
+  Argument5RoutingConfig() { this = "Argument5RoutingConfig" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "arg5"
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(CallNode call |
+      call.getFunction().(NameNode).getId() = "SINK5" and
+      node.(DataFlow::CfgNode).getNode() = call.getAnArg()
+    )
+  }
+
+  /**
+   * We want to be able to use `arg` in a sequence of calls such as `func(kw=arg); ... ; func(arg)`.
+   * Use-use flow lets the argument to the first call reach the sink inside the second call,
+   * making it seem like we handle all cases even if we only handle the last one.
+   * We make the test honest by preventing flow into source nodes.
+   */
+  override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+}
+
+class Argument6RoutingTest extends FlowTest {
+  Argument6RoutingTest() { this = "Argument6RoutingTest" }
+
+  override string flowTag() { result = "arg6" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(Argument6RoutingConfig cfg | cfg.hasFlow(source, sink))
+  }
+}
+
+/**
+ * A configuration to check routing of arguments through magic methods.
+ */
+class Argument6RoutingConfig extends DataFlow::Configuration {
+  Argument6RoutingConfig() { this = "Argument6RoutingConfig" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "arg6"
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(CallNode call |
+      call.getFunction().(NameNode).getId() = "SINK6" and
+      node.(DataFlow::CfgNode).getNode() = call.getAnArg()
+    )
+  }
+
+  /**
+   * We want to be able to use `arg` in a sequence of calls such as `func(kw=arg); ... ; func(arg)`.
+   * Use-use flow lets the argument to the first call reach the sink inside the second call,
+   * making it seem like we handle all cases even if we only handle the last one.
+   * We make the test honest by preventing flow into source nodes.
+   */
+  override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+}
+
+class Argument7RoutingTest extends FlowTest {
+  Argument7RoutingTest() { this = "Argument7RoutingTest" }
+
+  override string flowTag() { result = "arg7" }
+
+  override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
+    exists(Argument7RoutingConfig cfg | cfg.hasFlow(source, sink))
+  }
+}
+
+/**
+ * A configuration to check routing of arguments through magic methods.
+ */
+class Argument7RoutingConfig extends DataFlow::Configuration {
+  Argument7RoutingConfig() { this = "Argument7RoutingConfig" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "arg7"
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    exists(CallNode call |
+      call.getFunction().(NameNode).getId() = "SINK7" and
+      node.(DataFlow::CfgNode).getNode() = call.getAnArg()
+    )
+  }
+
+  /**
+   * We want to be able to use `arg` in a sequence of calls such as `func(kw=arg); ... ; func(arg)`.
+   * Use-use flow lets the argument to the first call reach the sink inside the second call,
+   * making it seem like we handle all cases even if we only handle the last one.
+   * We make the test honest by preventing flow into source nodes.
+   */
+  override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+}

From dc91406ff0c6073c9b153ac2ff901c0c5a8cf0fe Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Fri, 13 Nov 2020 09:22:57 +0100
Subject: [PATCH 004/343] Python: make `.expected` empty still need to annotate
 missing results

---
 .../coverage/argumentRoutingTest.expected     | 33 ----------
 .../experimental/dataflow/coverage/classes.py | 66 +++++++++----------
 2 files changed, 33 insertions(+), 66 deletions(-)

diff --git a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected
index 5624d283462..e69de29bb2d 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.expected
@@ -1,33 +0,0 @@
-| classes.py:556:15:556:17 | ControlFlowNode for key | Unexpected result: arg2="ControlFlowNode for arg2, l:565 -> ControlFlowNode for key" |
-| classes.py:557:15:557:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_getitem, l:563 -> ControlFlowNode for self" |
-| classes.py:571:15:571:19 | ControlFlowNode for value | Unexpected result: arg3="ControlFlowNode for arg3, l:581 -> ControlFlowNode for value" |
-| classes.py:572:15:572:17 | ControlFlowNode for key | Unexpected result: arg2="ControlFlowNode for arg2, l:581 -> ControlFlowNode for key" |
-| classes.py:573:15:573:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_setitem, l:578 -> ControlFlowNode for self" |
-| classes.py:587:15:587:17 | ControlFlowNode for key | Unexpected result: arg2="ControlFlowNode for arg2, l:595 -> ControlFlowNode for key" |
-| classes.py:588:15:588:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_delitem, l:593 -> ControlFlowNode for self" |
-| classes.py:658:15:658:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:667 -> ControlFlowNode for other" |
-| classes.py:659:15:659:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_add, l:665 -> ControlFlowNode for self" |
-| classes.py:673:15:673:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:682 -> ControlFlowNode for other" |
-| classes.py:674:15:674:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_sub, l:680 -> ControlFlowNode for self" |
-| classes.py:688:15:688:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:697 -> ControlFlowNode for other" |
-| classes.py:689:15:689:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_mul, l:695 -> ControlFlowNode for self" |
-| classes.py:703:15:703:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:712 -> ControlFlowNode for other" |
-| classes.py:704:15:704:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_matmul, l:710 -> ControlFlowNode for self" |
-| classes.py:718:15:718:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:727 -> ControlFlowNode for other" |
-| classes.py:719:15:719:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_truediv, l:725 -> ControlFlowNode for self" |
-| classes.py:733:15:733:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:742 -> ControlFlowNode for other" |
-| classes.py:734:15:734:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_floordiv, l:740 -> ControlFlowNode for self" |
-| classes.py:748:15:748:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:757 -> ControlFlowNode for other" |
-| classes.py:749:15:749:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_mod, l:755 -> ControlFlowNode for self" |
-| classes.py:778:15:778:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:793 -> ControlFlowNode for other" |
-| classes.py:779:15:779:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_pow, l:791 -> ControlFlowNode for self" |
-| classes.py:799:15:799:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:808 -> ControlFlowNode for other" |
-| classes.py:800:15:800:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_lshift, l:806 -> ControlFlowNode for self" |
-| classes.py:814:15:814:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:823 -> ControlFlowNode for other" |
-| classes.py:815:15:815:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_rshift, l:821 -> ControlFlowNode for self" |
-| classes.py:829:15:829:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:838 -> ControlFlowNode for other" |
-| classes.py:830:15:830:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_and, l:836 -> ControlFlowNode for self" |
-| classes.py:844:15:844:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:853 -> ControlFlowNode for other" |
-| classes.py:845:15:845:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_xor, l:851 -> ControlFlowNode for self" |
-| classes.py:859:15:859:19 | ControlFlowNode for other | Unexpected result: arg2="ControlFlowNode for arg2, l:868 -> ControlFlowNode for other" |
-| classes.py:860:15:860:18 | ControlFlowNode for self | Unexpected result: arg1="SSA variable with_or, l:866 -> ControlFlowNode for self" |
diff --git a/python/ql/test/experimental/dataflow/coverage/classes.py b/python/ql/test/experimental/dataflow/coverage/classes.py
index 1977998ab64..613019ce4b8 100644
--- a/python/ql/test/experimental/dataflow/coverage/classes.py
+++ b/python/ql/test/experimental/dataflow/coverage/classes.py
@@ -553,8 +553,8 @@ def test_length_hint():
 # object.__getitem__(self, key)
 class With_getitem:
     def __getitem__(self, key):
-        SINK2(key)
-        SINK1(self)
+        SINK2(key) #$ arg2="ControlFlowNode for arg2, l:565 -> ControlFlowNode for key"
+        SINK1(self) #$ arg1="SSA variable with_getitem, l:563 -> ControlFlowNode for self"
         OK()
         return ""
 
@@ -568,9 +568,9 @@ def test_getitem():
 # object.__setitem__(self, key, value)
 class With_setitem:
     def __setitem__(self, key, value):
-        SINK3(value)
-        SINK2(key)
-        SINK1(self)
+        SINK3(value) #$ arg3="ControlFlowNode for arg3, l:581 -> ControlFlowNode for value"
+        SINK2(key) #$ arg2="ControlFlowNode for arg2, l:581 -> ControlFlowNode for key"
+        SINK1(self) #$ arg1="SSA variable with_setitem, l:578 -> ControlFlowNode for self"
         OK()
 
 
@@ -584,8 +584,8 @@ def test_setitem():
 # object.__delitem__(self, key)
 class With_delitem:
     def __delitem__(self, key):
-        SINK2(key)
-        SINK1(self)
+        SINK2(key) #$ arg2="ControlFlowNode for arg2, l:595 -> ControlFlowNode for key"
+        SINK1(self) #$ arg1="SSA variable with_delitem, l:593 -> ControlFlowNode for self"
         OK()
 
 
@@ -655,8 +655,8 @@ def test_contains():
 # object.__add__(self, other)
 class With_add:
     def __add__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:667 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_add, l:665 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -670,8 +670,8 @@ def test_add():
 # object.__sub__(self, other)
 class With_sub:
     def __sub__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:682 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_sub, l:680 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -685,8 +685,8 @@ def test_sub():
 # object.__mul__(self, other)
 class With_mul:
     def __mul__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:697 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_mul, l:695 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -700,8 +700,8 @@ def test_mul():
 # object.__matmul__(self, other)
 class With_matmul:
     def __matmul__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:712 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_matmul, l:710 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -715,8 +715,8 @@ def test_matmul():
 # object.__truediv__(self, other)
 class With_truediv:
     def __truediv__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:727 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_truediv, l:725 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -730,8 +730,8 @@ def test_truediv():
 # object.__floordiv__(self, other)
 class With_floordiv:
     def __floordiv__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:742 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_floordiv, l:740 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -745,8 +745,8 @@ def test_floordiv():
 # object.__mod__(self, other)
 class With_mod:
     def __mod__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:757 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_mod, l:755 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -775,8 +775,8 @@ def test_divmod():
 # object.__pow__(self, other[, modulo])
 class With_pow:
     def __pow__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:793 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_pow, l:791 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -796,8 +796,8 @@ def test_pow_op():
 # object.__lshift__(self, other)
 class With_lshift:
     def __lshift__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:808 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_lshift, l:806 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -811,8 +811,8 @@ def test_lshift():
 # object.__rshift__(self, other)
 class With_rshift:
     def __rshift__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:823 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_rshift, l:821 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -826,8 +826,8 @@ def test_rshift():
 # object.__and__(self, other)
 class With_and:
     def __and__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:838 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_and, l:836 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -841,8 +841,8 @@ def test_and():
 # object.__xor__(self, other)
 class With_xor:
     def __xor__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:853 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_xor, l:851 -> ControlFlowNode for self"
         OK()
         return self
 
@@ -856,8 +856,8 @@ def test_xor():
 # object.__or__(self, other)
 class With_or:
     def __or__(self, other):
-        SINK2(other)
-        SINK1(self)
+        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:868 -> ControlFlowNode for other"
+        SINK1(self) #$ arg1="SSA variable with_or, l:866 -> ControlFlowNode for self"
         OK()
         return self
 

From 3b5ff7386202e5036f78a4881464d7130fd0a6b8 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 5 Nov 2020 15:37:21 +0000
Subject: [PATCH 005/343] JS: Introduce API::InvokeNode to simplify reasoning
 about calls

---
 .../ql/src/semmle/javascript/ApiGraphs.qll    | 62 ++++++++++++++++++-
 1 file changed, 59 insertions(+), 3 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index e3d627c3da7..5b54509dae4 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -54,17 +54,17 @@ module API {
     /**
      * Gets a call to the function represented by this API component.
      */
-    DataFlow::CallNode getACall() { result = getReturn().getAnImmediateUse() }
+    CallNode getACall() { result = getReturn().getAnImmediateUse() }
 
     /**
      * Gets a `new` call to the function represented by this API component.
      */
-    DataFlow::NewNode getAnInstantiation() { result = getInstance().getAnImmediateUse() }
+    NewNode getAnInstantiation() { result = getInstance().getAnImmediateUse() }
 
     /**
      * Gets an invocation (with our without `new`) to the function represented by this API component.
      */
-    DataFlow::InvokeNode getAnInvocation() { result = getACall() or result = getAnInstantiation() }
+    InvokeNode getAnInvocation() { result = getACall() or result = getAnInstantiation() }
 
     /**
      * Gets a data-flow node corresponding to the right-hand side of a definition of the API
@@ -114,11 +114,17 @@ module API {
      * For example, if this node represents a use of some class `A`, then there might be a node
      * representing instances of `A`, typically corresponding to expressions `new A()` at the
      * source level.
+     *
+     * This predicate may have multiple results when there are multiple constructor calls invoking this API component.
+     * Consider using `getAnInstantiation()` if there is a need to distingiush between individual constructor calls.
      */
     Node getInstance() { result = getASuccessor(Label::instance()) }
 
     /**
      * Gets a node representing the `i`th parameter of the function represented by this node.
+     *
+     * This predicate may have multiple results when there are multiple invocations of this API component.
+     * Consider using `getAnInvocation()` if there is a need to distingiush between individual calls.
      */
     bindingset[i]
     Node getParameter(int i) { result = getASuccessor(Label::parameter(i)) }
@@ -133,6 +139,9 @@ module API {
 
     /**
      * Gets a node representing the last parameter of the function represented by this node.
+     *
+     * This predicate may have multiple results when there are multiple invocations of this API component.
+     * Consider using `getAnInvocation()` if there is a need to distingiush between individual calls.
      */
     Node getLastParameter() { result = getParameter(getNumParameter() - 1) }
 
@@ -144,6 +153,10 @@ module API {
     /**
      * Gets a node representing a parameter or the receiver of the function represented by this
      * node.
+     *
+     * This predicate may result in a mix of parameters from different call sites in cases where
+     * there are multiple invocations of this API component.
+     * Consider using `getAnInvocation()` if there is a need to distingiush between individual calls.
      */
     Node getAParameter() {
       result = getASuccessor(Label::parameterByStringIndex(_)) or
@@ -152,6 +165,9 @@ module API {
 
     /**
      * Gets a node representing the result of the function represented by this node.
+     *
+     * This predicate may have multiple results when there are multiple invocations of this API component.
+     * Consider using `getACall()` if there is a need to distingiush between individual calls.
      */
     Node getReturn() { result = getASuccessor(Label::return()) }
 
@@ -787,6 +803,46 @@ module API {
   }
 
   import Label as EdgeLabel
+
+  /**
+   * An `InvokeNode` that is connected to the API graph.
+   *
+   * Can be used to reason about calls to an external API in which the correlation between
+   * parameters and/or return values must be retained.
+   *
+   * The member predicates `getParameter`, `getReturn`, and `getInstance` mimic the corresponding
+   * predicates from `API::Node`. These are guaranteed to exist and be unique to this call.
+   */
+  class InvokeNode extends DataFlow::InvokeNode {
+    API::Node callee;
+
+    InvokeNode() { this = callee.getReturn().getAnImmediateUse() or this = callee.getInstance().getAnImmediateUse() }
+
+    /** Gets the API node for the `i`th parameter of this invocation. */
+    Node getParameter(int i) {
+      result = callee.getParameter(i) and
+      result.getARhs() = getArgument(i)
+    }
+
+    /** Gets the API node a parameter of this invocation. */
+    Node getAParameter() {
+      result = getParameter(_)
+    }
+
+    /** Gets the API node for the return value of this call. */
+    Node getReturn() { result.getAnImmediateUse() = this }
+
+    /** Gets the API node for the object constructed by this invocation. */
+    Node getInstance() { result.getAnImmediateUse() = this }
+  }
+
+  /** A call connected to the API graph. */
+  class CallNode extends InvokeNode, DataFlow::CallNode {
+  }
+
+  /** A `new` call connected to the API graph. */
+  class NewNode extends InvokeNode, DataFlow::NewNode {
+  }
 }
 
 private module Label {

From ac00e028555a3cbda95c828c079e829485d92d66 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 11 Nov 2020 15:49:26 +0000
Subject: [PATCH 006/343] JS: Add API::Node.getAValueReachingRhs

---
 javascript/ql/src/semmle/javascript/ApiGraphs.qll | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index 5b54509dae4..58b08c5bf91 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -82,6 +82,12 @@ module API {
      */
     DataFlow::Node getARhs() { Impl::rhs(this, result) }
 
+    /**
+     * Gets a data-flow node that may interprocedurally flow to the right-hand side of a definition
+     * of the API component represented by this node.
+     */
+    DataFlow::Node getAValueReachingRhs() { result = Impl::trackDefNode(getARhs()) }
+
     /**
      * Gets a node representing member `m` of this API component.
      *
@@ -825,9 +831,10 @@ module API {
     }
 
     /** Gets the API node a parameter of this invocation. */
-    Node getAParameter() {
-      result = getParameter(_)
-    }
+    Node getAParameter() { result = getParameter(_) }
+
+    /** Gets the API node for the last parameter of this invocation. */
+    Node getLastParameter() { result = getParameter(getNumArgument() - 1) }
 
     /** Gets the API node for the return value of this call. */
     Node getReturn() { result.getAnImmediateUse() = this }

From b6b8a55b371006033d6151ee4b30951ddfec2a3a Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 23 Nov 2020 16:16:50 +0000
Subject: [PATCH 007/343] JS: Add test case

---
 .../ql/test/ApiGraphs/call-nodes/index.js     |  4 +++
 .../test/ApiGraphs/call-nodes/test.expected   |  3 +++
 .../ql/test/ApiGraphs/call-nodes/test.ql      | 25 +++++++++++++++++++
 3 files changed, 32 insertions(+)
 create mode 100644 javascript/ql/test/ApiGraphs/call-nodes/index.js
 create mode 100644 javascript/ql/test/ApiGraphs/call-nodes/test.expected
 create mode 100644 javascript/ql/test/ApiGraphs/call-nodes/test.ql

diff --git a/javascript/ql/test/ApiGraphs/call-nodes/index.js b/javascript/ql/test/ApiGraphs/call-nodes/index.js
new file mode 100644
index 00000000000..999af64c90b
--- /dev/null
+++ b/javascript/ql/test/ApiGraphs/call-nodes/index.js
@@ -0,0 +1,4 @@
+import { foo } from 'mylibrary';
+
+foo({ value: 1 }, { value: 1 });
+foo({ value: 2 }, { value: 2 });
diff --git a/javascript/ql/test/ApiGraphs/call-nodes/test.expected b/javascript/ql/test/ApiGraphs/call-nodes/test.expected
new file mode 100644
index 00000000000..9b8eb28bbef
--- /dev/null
+++ b/javascript/ql/test/ApiGraphs/call-nodes/test.expected
@@ -0,0 +1,3 @@
+ERROR: Could not resolve predicate getArgument/1 (/Users/asger/git/code/ql/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll:716,60-71)
+ERROR: Could not resolve predicate getParameter/1 (/Users/asger/git/code/ql/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll:719,40-52)
+ERROR: Could not resolve type API::MethodCallNode (/Users/asger/git/code/ql/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll:705,51-70)
diff --git a/javascript/ql/test/ApiGraphs/call-nodes/test.ql b/javascript/ql/test/ApiGraphs/call-nodes/test.ql
new file mode 100644
index 00000000000..97cfc6aeeba
--- /dev/null
+++ b/javascript/ql/test/ApiGraphs/call-nodes/test.ql
@@ -0,0 +1,25 @@
+import javascript
+
+class FooCall extends API::CallNode {
+  FooCall() {
+    this = API::moduleImport("mylibrary").getMember("foo").getACall()
+  }
+
+  DataFlow::Node getFirst() {
+    result = getParameter(0).getMember("value").getARhs()
+  }
+
+  DataFlow::Node getSecond() {
+    result = getParameter(1).getMember("value").getARhs()
+  }
+}
+
+query predicate values(FooCall call, int first, int second) {
+  first = call.getFirst().getIntValue() and
+  second = call.getSecond().getIntValue()
+}
+
+query predicate mismatch(FooCall call, string msg) {
+  call.getFirst().getIntValue() != call.getSecond().getIntValue() and
+  msg = "mismatching parameter indices found for call"
+}

From c146e044ca9a15fa391a95a13da888a4fd7713f2 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 23 Nov 2020 16:17:00 +0000
Subject: [PATCH 008/343] JS: Update NoSQL model

---
 .../semmle/javascript/frameworks/NoSQL.qll    | 26 +++++++------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
index 31671cbc423..a202b557268 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
@@ -62,22 +62,20 @@ private module MongoDB {
   }
 
   /** A call to a MongoDB query method. */
-  private class QueryCall extends DatabaseAccess, DataFlow::CallNode {
+  private class QueryCall extends DatabaseAccess, API::CallNode {
     int queryArgIdx;
-    API::Node callee;
 
     QueryCall() {
       exists(string method |
         CollectionMethodSignatures::interpretsArgumentAsQuery(method, queryArgIdx) and
-        callee = getACollection().getMember(method)
-      ) and
-      this = callee.getACall()
+        this = getACollection().getMember(method).getACall()
+      )
     }
 
     override DataFlow::Node getAQueryArgument() { result = getArgument(queryArgIdx) }
 
     DataFlow::Node getACodeOperator() {
-      result = getADollarWhereProperty(callee.getParameter(queryArgIdx))
+      result = getADollarWhereProperty(getParameter(queryArgIdx))
     }
   }
 
@@ -670,14 +668,12 @@ private module Minimongo {
   }
 
   /** A call to a Minimongo query method. */
-  private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
+  private class QueryCall extends DatabaseAccess, API::CallNode {
     int queryArgIdx;
-    API::Node callee;
 
     QueryCall() {
       exists(string m |
-        callee = API::moduleImport("minimongo").getAMember().getReturn().getAMember().getMember(m) and
-        this = callee.getACall() and
+        this = API::moduleImport("minimongo").getAMember().getReturn().getAMember().getMember(m).getACall() and
         CollectionMethodSignatures::interpretsArgumentAsQuery(m, queryArgIdx)
       )
     }
@@ -685,7 +681,7 @@ private module Minimongo {
     override DataFlow::Node getAQueryArgument() { result = getArgument(queryArgIdx) }
 
     DataFlow::Node getACodeOperator() {
-      result = getADollarWhereProperty(callee.getParameter(queryArgIdx))
+      result = getADollarWhereProperty(getParameter(queryArgIdx))
     }
   }
 
@@ -706,14 +702,12 @@ private module Minimongo {
  */
 private module MarsDB {
   /** A call to a MarsDB query method. */
-  private class QueryCall extends DatabaseAccess, DataFlow::MethodCallNode {
+  private class QueryCall extends DatabaseAccess, API::MethodCallNode {
     int queryArgIdx;
-    API::Node callee;
 
     QueryCall() {
       exists(string m |
-        callee = API::moduleImport("marsdb").getMember("Collection").getInstance().getMember(m) and
-        this = callee.getACall() and
+        this = API::moduleImport("marsdb").getMember("Collection").getInstance().getMember(m).getACall() and
         // implements parts of the Minimongo interface
         Minimongo::CollectionMethodSignatures::interpretsArgumentAsQuery(m, queryArgIdx)
       )
@@ -722,7 +716,7 @@ private module MarsDB {
     override DataFlow::Node getAQueryArgument() { result = getArgument(queryArgIdx) }
 
     DataFlow::Node getACodeOperator() {
-      result = getADollarWhereProperty(callee.getParameter(queryArgIdx))
+      result = getADollarWhereProperty(getParameter(queryArgIdx))
     }
   }
 

From 85f0a627c40a14e359e506317d3e4044510e054f Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 23 Nov 2020 16:17:22 +0000
Subject: [PATCH 009/343] JS: Autoformat

---
 javascript/ql/src/semmle/javascript/ApiGraphs.qll     | 11 ++++++-----
 .../ql/src/semmle/javascript/frameworks/NoSQL.qll     | 11 +++++++++--
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index 58b08c5bf91..0e919b62e64 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -822,7 +822,10 @@ module API {
   class InvokeNode extends DataFlow::InvokeNode {
     API::Node callee;
 
-    InvokeNode() { this = callee.getReturn().getAnImmediateUse() or this = callee.getInstance().getAnImmediateUse() }
+    InvokeNode() {
+      this = callee.getReturn().getAnImmediateUse() or
+      this = callee.getInstance().getAnImmediateUse()
+    }
 
     /** Gets the API node for the `i`th parameter of this invocation. */
     Node getParameter(int i) {
@@ -844,12 +847,10 @@ module API {
   }
 
   /** A call connected to the API graph. */
-  class CallNode extends InvokeNode, DataFlow::CallNode {
-  }
+  class CallNode extends InvokeNode, DataFlow::CallNode { }
 
   /** A `new` call connected to the API graph. */
-  class NewNode extends InvokeNode, DataFlow::NewNode {
-  }
+  class NewNode extends InvokeNode, DataFlow::NewNode { }
 }
 
 private module Label {
diff --git a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
index a202b557268..a78b937018e 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
@@ -673,7 +673,13 @@ private module Minimongo {
 
     QueryCall() {
       exists(string m |
-        this = API::moduleImport("minimongo").getAMember().getReturn().getAMember().getMember(m).getACall() and
+        this =
+          API::moduleImport("minimongo")
+              .getAMember()
+              .getReturn()
+              .getAMember()
+              .getMember(m)
+              .getACall() and
         CollectionMethodSignatures::interpretsArgumentAsQuery(m, queryArgIdx)
       )
     }
@@ -707,7 +713,8 @@ private module MarsDB {
 
     QueryCall() {
       exists(string m |
-        this = API::moduleImport("marsdb").getMember("Collection").getInstance().getMember(m).getACall() and
+        this =
+          API::moduleImport("marsdb").getMember("Collection").getInstance().getMember(m).getACall() and
         // implements parts of the Minimongo interface
         Minimongo::CollectionMethodSignatures::interpretsArgumentAsQuery(m, queryArgIdx)
       )

From d3412bb0ecb52900a3c7249250b5b4a72adea702 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 23 Nov 2020 21:18:53 +0000
Subject: [PATCH 010/343] JS: Fix typo in NoSQL model

---
 javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll | 2 +-
 javascript/ql/test/ApiGraphs/call-nodes/test.expected    | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
index a78b937018e..88b1879bdb2 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
@@ -708,7 +708,7 @@ private module Minimongo {
  */
 private module MarsDB {
   /** A call to a MarsDB query method. */
-  private class QueryCall extends DatabaseAccess, API::MethodCallNode {
+  private class QueryCall extends DatabaseAccess, API::CallNode {
     int queryArgIdx;
 
     QueryCall() {
diff --git a/javascript/ql/test/ApiGraphs/call-nodes/test.expected b/javascript/ql/test/ApiGraphs/call-nodes/test.expected
index 9b8eb28bbef..5d70524cdd0 100644
--- a/javascript/ql/test/ApiGraphs/call-nodes/test.expected
+++ b/javascript/ql/test/ApiGraphs/call-nodes/test.expected
@@ -1,3 +1,4 @@
-ERROR: Could not resolve predicate getArgument/1 (/Users/asger/git/code/ql/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll:716,60-71)
-ERROR: Could not resolve predicate getParameter/1 (/Users/asger/git/code/ql/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll:719,40-52)
-ERROR: Could not resolve type API::MethodCallNode (/Users/asger/git/code/ql/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll:705,51-70)
+values
+| index.js:3:1:3:31 | foo({ v ... e: 1 }) | 1 | 1 |
+| index.js:4:1:4:31 | foo({ v ... e: 2 }) | 2 | 2 |
+mismatch

From ac6d4aac9d5377f382c7b4e438aa72115e487dcc Mon Sep 17 00:00:00 2001
From: Asger F <asgerf@github.com>
Date: Mon, 23 Nov 2020 21:20:38 +0000
Subject: [PATCH 011/343] Apply suggestions from code review

Co-authored-by: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
---
 javascript/ql/src/semmle/javascript/ApiGraphs.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index 0e919b62e64..6c9faff38e8 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -122,7 +122,7 @@ module API {
      * source level.
      *
      * This predicate may have multiple results when there are multiple constructor calls invoking this API component.
-     * Consider using `getAnInstantiation()` if there is a need to distingiush between individual constructor calls.
+     * Consider using `getAnInstantiation()` if there is a need to distinguish between individual constructor calls.
      */
     Node getInstance() { result = getASuccessor(Label::instance()) }
 
@@ -833,7 +833,7 @@ module API {
       result.getARhs() = getArgument(i)
     }
 
-    /** Gets the API node a parameter of this invocation. */
+    /** Gets the API node for a parameter of this invocation. */
     Node getAParameter() { result = getParameter(_) }
 
     /** Gets the API node for the last parameter of this invocation. */

From a19304a4a068ac9ac5b6bcea16295ff3df34e61c Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 24 Nov 2020 02:17:38 +0100
Subject: [PATCH 012/343] Python: Factor out prettyPrinter and update tests

---
 .../{FlowTestUtil => TestUtil}/FlowTest.qll   |   4 +-
 .../LocalFlowStepTest.qll                     |   0
 .../MaximalFlowTest.qll                       |   8 +
 .../dataflow/TestUtil/PrintNode.qll           |  31 ++++
 .../dataflow/basic/localFlowStepTest.ql       |   2 +-
 .../dataflow/basic/maximalFlowTest.ql         |   2 +-
 .../test/experimental/dataflow/basic/test.py  |  12 +-
 .../dataflow/coverage/argumentPassing.py      |  50 +++----
 .../dataflow/coverage/argumentRoutingTest.ql  |   2 +-
 .../experimental/dataflow/coverage/classes.py |  66 ++++-----
 .../dataflow/coverage/dataflowTest.ql         |   2 +-
 .../dataflow/coverage/datamodel.py            |  16 +-
 .../coverage/maximalFlowTest.expected         |   0
 .../dataflow/coverage/maximalFlowTest.ql      |   1 -
 .../experimental/dataflow/coverage/test.py    | 140 +++++++++---------
 .../dataflow/tainttracking/TestTaintLib.qll   |  28 +---
 16 files changed, 190 insertions(+), 174 deletions(-)
 rename python/ql/test/experimental/dataflow/{FlowTestUtil => TestUtil}/FlowTest.qll (82%)
 rename python/ql/test/experimental/dataflow/{FlowTestUtil => TestUtil}/LocalFlowStepTest.qll (100%)
 rename python/ql/test/experimental/dataflow/{FlowTestUtil => TestUtil}/MaximalFlowTest.qll (70%)
 create mode 100644 python/ql/test/experimental/dataflow/TestUtil/PrintNode.qll
 delete mode 100644 python/ql/test/experimental/dataflow/coverage/maximalFlowTest.expected
 delete mode 100644 python/ql/test/experimental/dataflow/coverage/maximalFlowTest.ql

diff --git a/python/ql/test/experimental/dataflow/FlowTestUtil/FlowTest.qll b/python/ql/test/experimental/dataflow/TestUtil/FlowTest.qll
similarity index 82%
rename from python/ql/test/experimental/dataflow/FlowTestUtil/FlowTest.qll
rename to python/ql/test/experimental/dataflow/TestUtil/FlowTest.qll
index 9f0762f6488..edb24373386 100644
--- a/python/ql/test/experimental/dataflow/FlowTestUtil/FlowTest.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/FlowTest.qll
@@ -1,6 +1,7 @@
 import python
 import semmle.python.dataflow.new.DataFlow
 import TestUtilities.InlineExpectationsTest
+import experimental.dataflow.TestUtil.PrintNode
 
 abstract class FlowTest extends InlineExpectationsTest {
   bindingset[this]
@@ -17,7 +18,8 @@ abstract class FlowTest extends InlineExpectationsTest {
       location = toNode.getLocation() and
       tag = this.flowTag() and
       value =
-        "\"" + fromNode.toString() + lineStr(fromNode, toNode) + " -> " + toNode.toString() + "\"" and
+        "\"" + prettyNode(fromNode).replaceAll("\"", "'") + lineStr(fromNode, toNode) + " -> " +
+          prettyNode(toNode).replaceAll("\"", "'") + "\"" and
       element = toNode.toString()
     )
   }
diff --git a/python/ql/test/experimental/dataflow/FlowTestUtil/LocalFlowStepTest.qll b/python/ql/test/experimental/dataflow/TestUtil/LocalFlowStepTest.qll
similarity index 100%
rename from python/ql/test/experimental/dataflow/FlowTestUtil/LocalFlowStepTest.qll
rename to python/ql/test/experimental/dataflow/TestUtil/LocalFlowStepTest.qll
diff --git a/python/ql/test/experimental/dataflow/FlowTestUtil/MaximalFlowTest.qll b/python/ql/test/experimental/dataflow/TestUtil/MaximalFlowTest.qll
similarity index 70%
rename from python/ql/test/experimental/dataflow/FlowTestUtil/MaximalFlowTest.qll
rename to python/ql/test/experimental/dataflow/TestUtil/MaximalFlowTest.qll
index 792aa2b848d..eb84d197c69 100644
--- a/python/ql/test/experimental/dataflow/FlowTestUtil/MaximalFlowTest.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/MaximalFlowTest.qll
@@ -1,5 +1,6 @@
 import python
 import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.DataFlowPrivate
 import FlowTest
 
 class MaximalFlowTest extends FlowTest {
@@ -21,14 +22,21 @@ class MaximalFlowsConfig extends DataFlow::Configuration {
   MaximalFlowsConfig() { this = "MaximalFlowsConfig" }
 
   override predicate isSource(DataFlow::Node node) {
+    exists(node.getLocation().getFile().getRelativePath()) and
     not node.asCfgNode() instanceof CallNode and
     not node.asCfgNode().getNode() instanceof Return and
     not node instanceof DataFlow::ParameterNode and
+    not node instanceof DataFlow::PostUpdateNode and
+    // not node.asExpr() instanceof FunctionExpr and
+    // not node.asExpr() instanceof ClassExpr and
     not exists(DataFlow::Node pred | DataFlow::localFlowStep(pred, node))
   }
 
   override predicate isSink(DataFlow::Node node) {
+    exists(node.getLocation().getFile().getRelativePath()) and
     not any(CallNode c).getArg(_) = node.asCfgNode() and
+    not node instanceof ArgumentNode and
+    not node.asCfgNode().(NameNode).getId().matches("SINK%") and
     not exists(DataFlow::Node succ | DataFlow::localFlowStep(node, succ))
   }
 }
diff --git a/python/ql/test/experimental/dataflow/TestUtil/PrintNode.qll b/python/ql/test/experimental/dataflow/TestUtil/PrintNode.qll
new file mode 100644
index 00000000000..84f97d3f6ff
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/TestUtil/PrintNode.qll
@@ -0,0 +1,31 @@
+import python
+import semmle.python.dataflow.new.DataFlow
+
+string prettyExp(Expr e) {
+  not e instanceof Num and
+  not e instanceof StrConst and
+  not e instanceof Subscript and
+  not e instanceof Call and
+  not e instanceof Attribute and
+  result = e.toString()
+  or
+  result = e.(Num).getN()
+  or
+  result =
+    e.(StrConst).getPrefix() + e.(StrConst).getText() +
+      e.(StrConst).getPrefix().regexpReplaceAll("[a-zA-Z]+", "")
+  or
+  result = prettyExp(e.(Subscript).getObject()) + "[" + prettyExp(e.(Subscript).getIndex()) + "]"
+  or
+  (
+    if exists(e.(Call).getAnArg()) or exists(e.(Call).getANamedArg())
+    then result = prettyExp(e.(Call).getFunc()) + "(..)"
+    else result = prettyExp(e.(Call).getFunc()) + "()"
+  )
+  or
+  result = prettyExp(e.(Attribute).getObject()) + "." + e.(Attribute).getName()
+}
+
+string prettyNode(DataFlow::Node node) {
+  if exists(node.asExpr()) then result = prettyExp(node.asExpr()) else result = node.toString()
+}
diff --git a/python/ql/test/experimental/dataflow/basic/localFlowStepTest.ql b/python/ql/test/experimental/dataflow/basic/localFlowStepTest.ql
index 6e57f26cd0f..6dca0190156 100644
--- a/python/ql/test/experimental/dataflow/basic/localFlowStepTest.ql
+++ b/python/ql/test/experimental/dataflow/basic/localFlowStepTest.ql
@@ -1 +1 @@
-import experimental.dataflow.FlowTestUtil.LocalFlowStepTest
+import experimental.dataflow.TestUtil.LocalFlowStepTest
diff --git a/python/ql/test/experimental/dataflow/basic/maximalFlowTest.ql b/python/ql/test/experimental/dataflow/basic/maximalFlowTest.ql
index ec171dcd9fd..618dae382f1 100644
--- a/python/ql/test/experimental/dataflow/basic/maximalFlowTest.ql
+++ b/python/ql/test/experimental/dataflow/basic/maximalFlowTest.ql
@@ -1 +1 @@
-import experimental.dataflow.FlowTestUtil.MaximalFlowTest
+import experimental.dataflow.TestUtil.MaximalFlowTest
diff --git a/python/ql/test/experimental/dataflow/basic/test.py b/python/ql/test/experimental/dataflow/basic/test.py
index e97068a041c..d0a54a570eb 100644
--- a/python/ql/test/experimental/dataflow/basic/test.py
+++ b/python/ql/test/experimental/dataflow/basic/test.py
@@ -1,7 +1,7 @@
-def obfuscated_id(x): #$ step="ControlFlowNode for FunctionExpr -> GSSA Variable obfuscated_id"
-  y = x #$ step="ControlFlowNode for x -> SSA variable y" step="SSA variable x, l:1 -> ControlFlowNode for x"
-  z = y #$ step="ControlFlowNode for y -> SSA variable z" step="SSA variable y, l:2 -> ControlFlowNode for y"
-  return z #$ flow="ControlFlowNode for IntegerLiteral, l:6 -> ControlFlowNode for z" step="SSA variable z, l:3 -> ControlFlowNode for z"
+def obfuscated_id(x): #$ step="FunctionExpr -> GSSA Variable obfuscated_id"
+  y = x #$ step="x -> SSA variable y" step="SSA variable x, l:1 -> x"
+  z = y #$ step="y -> SSA variable z" step="SSA variable y, l:2 -> y"
+  return z #$ flow="42, l:6 -> z" step="SSA variable z, l:3 -> z"
 
-a = 42 #$ step="ControlFlowNode for IntegerLiteral -> GSSA Variable a"
-b = obfuscated_id(a) #$ flow="ControlFlowNode for IntegerLiteral, l:6 -> GSSA Variable b" flow="ControlFlowNode for FunctionExpr, l:1 -> ControlFlowNode for obfuscated_id" step="ControlFlowNode for obfuscated_id() -> GSSA Variable b" step="GSSA Variable obfuscated_id, l:1 -> ControlFlowNode for obfuscated_id" step="GSSA Variable a, l:6 -> ControlFlowNode for a"
+a = 42 #$ step="42 -> GSSA Variable a"
+b = obfuscated_id(a) #$ flow="42, l:6 -> GSSA Variable b" flow="FunctionExpr, l:1 -> obfuscated_id" step="obfuscated_id(..) -> GSSA Variable b" step="GSSA Variable obfuscated_id, l:1 -> obfuscated_id" step="GSSA Variable a, l:6 -> a"
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
index 7f1a832bf61..6de4d56ad13 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
+++ b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
@@ -72,14 +72,14 @@ def argument_passing(
     f,
     **g,
 ):
-    SINK1(a) #$ arg1="ControlFlowNode for arg1, l:89 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:94 -> ControlFlowNode for a"
-    SINK2(b) #$ arg2="ControlFlowNode for arg2, l:94 -> ControlFlowNode for b" MISSING:arg2="ControlFlowNode for arg2, l:89 -> ControlFlowNode for b"
-    SINK3(c) #$ arg3="ControlFlowNode for arg3, l:94 -> ControlFlowNode for c" MISSING: arg3="ControlFlowNode for arg3, l:89 -> ControlFlowNode for c"
-    SINK4(d) #$ MISSING: arg4="ControlFlowNode for arg4, l:89 -> ControlFlowNode for d"
-    SINK5(e) #$ MISSING: arg5="ControlFlowNode for arg5, l:89 -> ControlFlowNode for e"
-    SINK6(f) #$ MISSING: arg6="ControlFlowNode for arg6, l:89 -> ControlFlowNode for f"
+    SINK1(a) #$ arg1="arg1, l:89 -> a" arg1="arg1, l:94 -> a"
+    SINK2(b) #$ arg2="arg2, l:94 -> b" MISSING:arg2="arg2, l:89 -> b"
+    SINK3(c) #$ arg3="arg3, l:94 -> c" MISSING: arg3="arg3, l:89 -> c"
+    SINK4(d) #$ MISSING: arg4="arg4, l:89 -> d"
+    SINK5(e) #$ MISSING: arg5="arg5, l:89 -> e"
+    SINK6(f) #$ MISSING: arg6="arg6, l:89 -> f"
     try:
-        SINK7(g["g"]) #$ arg7="ControlFlowNode for arg7, l:89 -> ControlFlowNode for Subscript"
+        SINK7(g["g"]) #$ arg7="arg7, l:89 -> g['g']"
     except:
         print("OK")
 
@@ -95,8 +95,8 @@ def test_argument_passing2():
 
 
 def with_pos_only(a, /, b):
-    SINK1(a) #$ arg1="ControlFlowNode for arg1, l:104 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:105 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:106 -> ControlFlowNode for a"
-    SINK2(b) #$ arg2="ControlFlowNode for arg2, l:104 -> ControlFlowNode for b" arg2="ControlFlowNode for arg2, l:105 -> ControlFlowNode for b" MISSING: arg2="ControlFlowNode for arg2, l:106 -> ControlFlowNode for b"
+    SINK1(a) #$ arg1="arg1, l:104 -> a" arg1="arg1, l:105 -> a" arg1="arg1, l:106 -> a"
+    SINK2(b) #$ arg2="arg2, l:104 -> b" arg2="arg2, l:105 -> b" MISSING: arg2="arg2, l:106 -> b"
 
 
 @expects(6)
@@ -107,9 +107,9 @@ def test_pos_only():
 
 
 def with_multiple_kw_args(a, b, c):
-    SINK1(a) #$ arg1="ControlFlowNode for arg1, l:117 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:118 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:119 -> ControlFlowNode for a" arg1="ControlFlowNode for arg1, l:120 -> ControlFlowNode for a"
-    SINK2(b) #$ arg2="ControlFlowNode for arg2, l:117 -> ControlFlowNode for b" arg2="ControlFlowNode for arg2, l:120 -> ControlFlowNode for b" MISSING: arg2="ControlFlowNode for arg2, l:118 -> ControlFlowNode for b" arg2="ControlFlowNode for arg2, l:119 -> ControlFlowNode for b"
-    SINK3(c) #$ arg3="ControlFlowNode for arg3, l:117 -> ControlFlowNode for c" arg3="ControlFlowNode for arg3, l:119 -> ControlFlowNode for c" arg3="ControlFlowNode for arg3, l:120 -> ControlFlowNode for c" MISSING: arg3="ControlFlowNode for arg3, l:118 -> ControlFlowNode for c"
+    SINK1(a) #$ arg1="arg1, l:117 -> a" arg1="arg1, l:118 -> a" arg1="arg1, l:119 -> a" arg1="arg1, l:120 -> a"
+    SINK2(b) #$ arg2="arg2, l:117 -> b" arg2="arg2, l:120 -> b" MISSING: arg2="arg2, l:118 -> b" arg2="arg2, l:119 -> b"
+    SINK3(c) #$ arg3="arg3, l:117 -> c" arg3="arg3, l:119 -> c" arg3="arg3, l:120 -> c" MISSING: arg3="arg3, l:118 -> c"
 
 
 @expects(9)
@@ -121,9 +121,9 @@ def test_multiple_kw_args():
 
 
 def with_default_arguments(a=arg1, b=arg2, c=arg3):
-    SINK1(a) #$ arg1="ControlFlowNode for arg1, l:132 -> ControlFlowNode for a" MISSING:arg1="ControlFlowNode for arg1, l:123 -> ControlFlowNode for a"
-    SINK2(b) #$ arg2="ControlFlowNode for arg2, l:133 -> ControlFlowNode for b" MISSING: arg2="ControlFlowNode for arg2, l:123 -> ControlFlowNode for b"
-    SINK3(c) #$ arg3="ControlFlowNode for arg3, l:134 -> ControlFlowNode for c" MISSING: arg3="ControlFlowNode for arg3, l:123 -> ControlFlowNode for c"
+    SINK1(a) #$ arg1="arg1, l:132 -> a" MISSING:arg1="arg1, l:123 -> a"
+    SINK2(b) #$ arg2="arg2, l:133 -> b" MISSING: arg2="arg2, l:123 -> b"
+    SINK3(c) #$ arg3="arg3, l:134 -> c" MISSING: arg3="arg3, l:123 -> c"
 
 
 @expects(12)
@@ -136,14 +136,14 @@ def test_default_arguments():
 
 # Nested constructor pattern
 def grab_foo_bar_baz(foo, **kwargs):
-    SINK1(foo) #$ arg1="ControlFlowNode for arg1, l:160 -> ControlFlowNode for foo"
+    SINK1(foo) #$ arg1="arg1, l:160 -> foo"
     grab_bar_baz(**kwargs)
 
 
 # It is not possible to pass `bar` into `kwargs`,
 # since `bar` is a valid keyword argument.
 def grab_bar_baz(bar, **kwargs):
-    SINK2(bar) #$ arg2="ControlFlowNode for arg2, l:160 -> ControlFlowNode for bar"
+    SINK2(bar) #$ arg2="arg2, l:160 -> bar"
     try:
         SINK2_F(kwargs["bar"])
     except:
@@ -152,7 +152,7 @@ def grab_bar_baz(bar, **kwargs):
 
 
 def grab_baz(baz):
-    SINK3(baz) #$ arg3="ControlFlowNode for arg3, l:160 -> ControlFlowNode for baz"
+    SINK3(baz) #$ arg3="arg3, l:160 -> baz"
 
 
 @expects(4)
@@ -163,14 +163,14 @@ def test_grab():
 # All combinations
 def test_pos_pos():
     def with_pos(a):
-        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:168 -> ControlFlowNode for a"
+        SINK1(a) #$ arg1="arg1, l:168 -> a"
 
     with_pos(arg1)
 
 
 def test_pos_pos_only():
     def with_pos_only(a, /):
-        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:175 -> ControlFlowNode for a"
+        SINK1(a) #$ arg1="arg1, l:175 -> a"
 
     with_pos_only(arg1)
 
@@ -178,34 +178,34 @@ def test_pos_pos_only():
 def test_pos_star():
     def with_star(*a):
         if len(a) > 0:
-            SINK1(a[0]) #$ arg1="ControlFlowNode for arg1, l:183 -> ControlFlowNode for Subscript"
+            SINK1(a[0]) #$ arg1="arg1, l:183 -> a[0]"
 
     with_star(arg1)
 
 
 def test_pos_kw():
     def with_kw(a=""):
-        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:190 -> ControlFlowNode for a"
+        SINK1(a) #$ arg1="arg1, l:190 -> a"
 
     with_kw(arg1)
 
 
 def test_kw_pos():
     def with_pos(a):
-        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:197 -> ControlFlowNode for a"
+        SINK1(a) #$ arg1="arg1, l:197 -> a"
 
     with_pos(a=arg1)
 
 
 def test_kw_kw():
     def with_kw(a=""):
-        SINK1(a) #$ arg1="ControlFlowNode for arg1, l:204 -> ControlFlowNode for a"
+        SINK1(a) #$ arg1="arg1, l:204 -> a"
 
     with_kw(a=arg1)
 
 
 def test_kw_doublestar():
     def with_doublestar(**a):
-        SINK1(a["a"]) #$ arg1="ControlFlowNode for arg1, l:211 -> ControlFlowNode for Subscript"
+        SINK1(a["a"]) #$ arg1="arg1, l:211 -> a['a']"
 
     with_doublestar(a=arg1)
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
index 00cc3a49656..8a2b9cf9235 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
@@ -1,7 +1,7 @@
 import python
 import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
-import experimental.dataflow.FlowTestUtil.FlowTest
+import experimental.dataflow.TestUtil.FlowTest
 
 class Argument1RoutingTest extends FlowTest {
   Argument1RoutingTest() { this = "Argument1RoutingTest" }
diff --git a/python/ql/test/experimental/dataflow/coverage/classes.py b/python/ql/test/experimental/dataflow/coverage/classes.py
index 613019ce4b8..eb850b8d819 100644
--- a/python/ql/test/experimental/dataflow/coverage/classes.py
+++ b/python/ql/test/experimental/dataflow/coverage/classes.py
@@ -553,8 +553,8 @@ def test_length_hint():
 # object.__getitem__(self, key)
 class With_getitem:
     def __getitem__(self, key):
-        SINK2(key) #$ arg2="ControlFlowNode for arg2, l:565 -> ControlFlowNode for key"
-        SINK1(self) #$ arg1="SSA variable with_getitem, l:563 -> ControlFlowNode for self"
+        SINK2(key) #$ arg2="arg2, l:565 -> key"
+        SINK1(self) #$ arg1="SSA variable with_getitem, l:563 -> self"
         OK()
         return ""
 
@@ -568,9 +568,9 @@ def test_getitem():
 # object.__setitem__(self, key, value)
 class With_setitem:
     def __setitem__(self, key, value):
-        SINK3(value) #$ arg3="ControlFlowNode for arg3, l:581 -> ControlFlowNode for value"
-        SINK2(key) #$ arg2="ControlFlowNode for arg2, l:581 -> ControlFlowNode for key"
-        SINK1(self) #$ arg1="SSA variable with_setitem, l:578 -> ControlFlowNode for self"
+        SINK3(value) #$ arg3="arg3, l:581 -> value"
+        SINK2(key) #$ arg2="arg2, l:581 -> key"
+        SINK1(self) #$ arg1="SSA variable with_setitem, l:578 -> self"
         OK()
 
 
@@ -584,8 +584,8 @@ def test_setitem():
 # object.__delitem__(self, key)
 class With_delitem:
     def __delitem__(self, key):
-        SINK2(key) #$ arg2="ControlFlowNode for arg2, l:595 -> ControlFlowNode for key"
-        SINK1(self) #$ arg1="SSA variable with_delitem, l:593 -> ControlFlowNode for self"
+        SINK2(key) #$ arg2="arg2, l:595 -> key"
+        SINK1(self) #$ arg1="SSA variable with_delitem, l:593 -> self"
         OK()
 
 
@@ -655,8 +655,8 @@ def test_contains():
 # object.__add__(self, other)
 class With_add:
     def __add__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:667 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_add, l:665 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:667 -> other"
+        SINK1(self) #$ arg1="SSA variable with_add, l:665 -> self"
         OK()
         return self
 
@@ -670,8 +670,8 @@ def test_add():
 # object.__sub__(self, other)
 class With_sub:
     def __sub__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:682 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_sub, l:680 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:682 -> other"
+        SINK1(self) #$ arg1="SSA variable with_sub, l:680 -> self"
         OK()
         return self
 
@@ -685,8 +685,8 @@ def test_sub():
 # object.__mul__(self, other)
 class With_mul:
     def __mul__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:697 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_mul, l:695 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:697 -> other"
+        SINK1(self) #$ arg1="SSA variable with_mul, l:695 -> self"
         OK()
         return self
 
@@ -700,8 +700,8 @@ def test_mul():
 # object.__matmul__(self, other)
 class With_matmul:
     def __matmul__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:712 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_matmul, l:710 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:712 -> other"
+        SINK1(self) #$ arg1="SSA variable with_matmul, l:710 -> self"
         OK()
         return self
 
@@ -715,8 +715,8 @@ def test_matmul():
 # object.__truediv__(self, other)
 class With_truediv:
     def __truediv__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:727 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_truediv, l:725 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:727 -> other"
+        SINK1(self) #$ arg1="SSA variable with_truediv, l:725 -> self"
         OK()
         return self
 
@@ -730,8 +730,8 @@ def test_truediv():
 # object.__floordiv__(self, other)
 class With_floordiv:
     def __floordiv__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:742 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_floordiv, l:740 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:742 -> other"
+        SINK1(self) #$ arg1="SSA variable with_floordiv, l:740 -> self"
         OK()
         return self
 
@@ -745,8 +745,8 @@ def test_floordiv():
 # object.__mod__(self, other)
 class With_mod:
     def __mod__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:757 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_mod, l:755 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:757 -> other"
+        SINK1(self) #$ arg1="SSA variable with_mod, l:755 -> self"
         OK()
         return self
 
@@ -775,8 +775,8 @@ def test_divmod():
 # object.__pow__(self, other[, modulo])
 class With_pow:
     def __pow__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:793 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_pow, l:791 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:793 -> other"
+        SINK1(self) #$ arg1="SSA variable with_pow, l:791 -> self"
         OK()
         return self
 
@@ -796,8 +796,8 @@ def test_pow_op():
 # object.__lshift__(self, other)
 class With_lshift:
     def __lshift__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:808 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_lshift, l:806 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:808 -> other"
+        SINK1(self) #$ arg1="SSA variable with_lshift, l:806 -> self"
         OK()
         return self
 
@@ -811,8 +811,8 @@ def test_lshift():
 # object.__rshift__(self, other)
 class With_rshift:
     def __rshift__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:823 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_rshift, l:821 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:823 -> other"
+        SINK1(self) #$ arg1="SSA variable with_rshift, l:821 -> self"
         OK()
         return self
 
@@ -826,8 +826,8 @@ def test_rshift():
 # object.__and__(self, other)
 class With_and:
     def __and__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:838 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_and, l:836 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:838 -> other"
+        SINK1(self) #$ arg1="SSA variable with_and, l:836 -> self"
         OK()
         return self
 
@@ -841,8 +841,8 @@ def test_and():
 # object.__xor__(self, other)
 class With_xor:
     def __xor__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:853 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_xor, l:851 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:853 -> other"
+        SINK1(self) #$ arg1="SSA variable with_xor, l:851 -> self"
         OK()
         return self
 
@@ -856,8 +856,8 @@ def test_xor():
 # object.__or__(self, other)
 class With_or:
     def __or__(self, other):
-        SINK2(other) #$ arg2="ControlFlowNode for arg2, l:868 -> ControlFlowNode for other"
-        SINK1(self) #$ arg1="SSA variable with_or, l:866 -> ControlFlowNode for self"
+        SINK2(other) #$ arg2="arg2, l:868 -> other"
+        SINK1(self) #$ arg1="SSA variable with_or, l:866 -> self"
         OK()
         return self
 
diff --git a/python/ql/test/experimental/dataflow/coverage/dataflowTest.ql b/python/ql/test/experimental/dataflow/coverage/dataflowTest.ql
index c7b2b5bfe15..76cabbfbbbf 100644
--- a/python/ql/test/experimental/dataflow/coverage/dataflowTest.ql
+++ b/python/ql/test/experimental/dataflow/coverage/dataflowTest.ql
@@ -1,5 +1,5 @@
 import python
-import experimental.dataflow.FlowTestUtil.FlowTest
+import experimental.dataflow.TestUtil.FlowTest
 import experimental.dataflow.testConfig
 
 class DataFlowTest extends FlowTest {
diff --git a/python/ql/test/experimental/dataflow/coverage/datamodel.py b/python/ql/test/experimental/dataflow/coverage/datamodel.py
index d6ab9bd3dcb..0d921a2cb85 100644
--- a/python/ql/test/experimental/dataflow/coverage/datamodel.py
+++ b/python/ql/test/experimental/dataflow/coverage/datamodel.py
@@ -35,7 +35,7 @@ def SINK_F(x):
 def f(a, b):
   return a
 
-SINK(f(SOURCE, 3)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for f()"
+SINK(f(SOURCE, 3)) #$ flow="SOURCE -> f(..)" flow="'source', l:13 -> f(..)"
 
 # Instance methods
 # An instance method object combines a class, a class instance and any callable object (normally a user-defined function).
@@ -68,18 +68,18 @@ c = C()
 func_obj = c.method.__func__
 
 # When an instance method object is called, the underlying function (__func__) is called, inserting the class instance (__self__) in front of the argument list. For instance, when C is a class which contains a definition for a function f(), and x is an instance of C, calling x.f(1) is equivalent to calling C.f(x, 1).
-SINK(c.method(SOURCE, C)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:38 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute()"
-SINK(C.method(c, SOURCE, C)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:38 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:71 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute()"
-SINK(func_obj(c, SOURCE, C))
+SINK(c.method(SOURCE, C)) #$ flow="SOURCE -> c.method(..)" flow="SOURCE, l:38 -> c.method(..)" flow="'source', l:13 -> c.method(..)"
+SINK(C.method(c, SOURCE, C)) #$ flow="SOURCE -> C.method(..)" flow="SOURCE, l:38 -> C.method(..)" flow="SOURCE, l:71 -> C.method(..)" flow="'source', l:13 -> C.method(..)"
+SINK(func_obj(c, SOURCE, C)) #$ MISSING: flow="SOURCE -> func_obj(..)" flow="SOURCE, l:38 -> func_obj(..)" flow="SOURCE, l:71 -> func_obj(..)" flow="SOURCE, l:72 -> func_obj(..)" flow="'source', l:13 ->  func_obj()"
 
 
 # When an instance method object is created by retrieving a class method object from a class or instance, its __self__ attribute is the class itself, and its __func__ attribute is the function object underlying the class method.
 c_func_obj = C.classmethod.__func__
 
 # When an instance method object is derived from a class method object, the “class instance” stored in __self__ will actually be the class itself, so that calling either x.f(1) or C.f(1) is equivalent to calling f(C,1) where f is the underlying function.
-SINK(c.classmethod(SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:38 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:71 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:72 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:73 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute()"
-SINK(C.classmethod(SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:38 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:71 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:72 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:73 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for SOURCE, l:80 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute()"
-SINK(c_func_obj(C, SOURCE))
+SINK(c.classmethod(SOURCE)) #$ flow="SOURCE -> c.classmethod(..)" flow="SOURCE, l:38 -> c.classmethod(..)" flow="SOURCE, l:71 -> c.classmethod(..)" flow="SOURCE, l:72 -> c.classmethod(..)" flow="SOURCE, l:73 -> c.classmethod(..)" flow="'source', l:13 -> c.classmethod(..)"
+SINK(C.classmethod(SOURCE)) #$ flow="SOURCE -> C.classmethod(..)" flow="SOURCE, l:38 -> C.classmethod(..)" flow="SOURCE, l:71 -> C.classmethod(..)" flow="SOURCE, l:72 -> C.classmethod(..)" flow="SOURCE, l:73 -> C.classmethod(..)" flow="SOURCE, l:80 -> C.classmethod(..)" flow="'source', l:13 -> C.classmethod(..)"
+SINK(c_func_obj(C, SOURCE)) #$ MISSING: flow="SOURCE -> c_func_obj(..)" flow="SOURCE, l:38 -> c_func_obj(..)" flow="SOURCE, l:71 -> c_func_obj(..)" flow="SOURCE, l:72 -> c_func_obj(..)" flow="SOURCE, l:73 -> c_func_obj(..)" flow="SOURCE, l:80 -> c_func_obj(..)" flow="SOURCE, l:81 -> c_func_obj(..)" flow="'source', l:13 ->  c_func_obj()"
 
 # Generator functions
 # A function or method which uses the yield statement (see section The yield statement) is called a generator function. Such a function, when called, always returns an iterator object which can be used to execute the body of the function: calling the iterator’s iterator.__next__() method will cause the function to execute until it provides a value using the yield statement. When the function executes a return statement or falls off the end, a StopIteration exception is raised and the iterator will have reached the end of the set of values to be returned.
@@ -156,4 +156,4 @@ customized = Customized()
 SINK(Customized.a)
 SINK_F(Customized.b)
 SINK(customized.a)
-SINK(customized.b)  #$ flow="ControlFlowNode for SOURCE, l:152 -> ControlFlowNode for Attribute" flow="ControlFlowNode for Str, l:13 -> ControlFlowNode for Attribute"
+SINK(customized.b)  #$ flow="SOURCE, l:152 -> customized.b" flow="'source', l:13 -> customized.b"
diff --git a/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.expected b/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.expected
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.ql b/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.ql
deleted file mode 100644
index ec171dcd9fd..00000000000
--- a/python/ql/test/experimental/dataflow/coverage/maximalFlowTest.ql
+++ /dev/null
@@ -1 +0,0 @@
-import experimental.dataflow.FlowTestUtil.MaximalFlowTest
diff --git a/python/ql/test/experimental/dataflow/coverage/test.py b/python/ql/test/experimental/dataflow/coverage/test.py
index ab7b9f02405..616837a9d3b 100644
--- a/python/ql/test/experimental/dataflow/coverage/test.py
+++ b/python/ql/test/experimental/dataflow/coverage/test.py
@@ -41,7 +41,7 @@ def SINK_F(x):
 def test_tuple_with_local_flow():
     x = (NONSOURCE, SOURCE)
     y = x[1]
-    SINK(y) #$ flow="ControlFlowNode for SOURCE, l:42 -> ControlFlowNode for y" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for y"
+    SINK(y) #$ flow="SOURCE, l:42 -> y" flow="'source', l:20 -> y"
 
 
 def test_tuple_negative():
@@ -53,45 +53,45 @@ def test_tuple_negative():
 # 6.2.1. Identifiers (Names)
 def test_names():
     x = SOURCE
-    SINK(x) #$ flow="ControlFlowNode for SOURCE, l:55 -> ControlFlowNode for x" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
+    SINK(x) #$ flow="SOURCE, l:55 -> x" flow="'source', l:20 -> x"
 
 
 # 6.2.2. Literals
 def test_string_literal():
     x = "source"
-    SINK(x) #$ flow="ControlFlowNode for Str, l:61 -> ControlFlowNode for x" 
+    SINK(x) #$ flow="'source', l:61 -> x" 
 
 
 def test_bytes_literal():
     x = b"source"
-    SINK(x) #$ flow="ControlFlowNode for Str, l:66 -> ControlFlowNode for x"
+    SINK(x) #$ flow="b'source', l:66 -> x"
 
 
 def test_integer_literal():
     x = 42
-    SINK(x) #$ flow="ControlFlowNode for IntegerLiteral, l:71 -> ControlFlowNode for x"
+    SINK(x) #$ flow="42, l:71 -> x"
 
 
 def test_floatnumber_literal():
     x = 42.0
-    SINK(x) #$ flow="ControlFlowNode for FloatLiteral, l:76 -> ControlFlowNode for x"
+    SINK(x) #$ flow="42.0, l:76 -> x"
 
 
 def test_imagnumber_literal():
     x = 42j
-    SINK(x) #$ MISSING:flow="ControlFlowNode for FloatLiteral, l:81 -> ControlFlowNode for x"
+    SINK(x) #$ MISSING:flow="42j, l:81 -> x"
 
 
 # 6.2.3. Parenthesized forms
 def test_parenthesized_form():
     x = (SOURCE)
-    SINK(x) #$ flow="ControlFlowNode for SOURCE, l:87 -> ControlFlowNode for x" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
+    SINK(x) #$ flow="SOURCE, l:87 -> x" flow="'source', l:20 -> x"
 
 
 # 6.2.5. List displays
 def test_list_display():
     x = [SOURCE]
-    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:93 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x[0]) #$ flow="SOURCE, l:93 -> x[0]" flow="'source', l:20 -> x[0]"
 
 
 def test_list_display_negative():
@@ -101,109 +101,109 @@ def test_list_display_negative():
 
 def test_list_comprehension():
     x = [SOURCE for y in [NONSOURCE]]
-    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:103 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x[0]) #$ flow="SOURCE, l:103 -> x[0]" flow="'source', l:20 -> x[0]"
 
 
 def test_list_comprehension_flow():
     x = [y for y in [SOURCE]]
-    SINK(x[0]) #$  flow="ControlFlowNode for SOURCE, l:108 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x[0]) #$  flow="SOURCE, l:108 -> x[0]" flow="'source', l:20 -> x[0]"
 
 
 def test_list_comprehension_inflow():
     l = [SOURCE]
     x = [y for y in l]
-    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:113 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x[0]) #$ flow="SOURCE, l:113 -> x[0]" flow="'source', l:20 -> x[0]"
 
 
 def test_nested_list_display():
     x = [*[SOURCE]]
-    SINK(x[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:119 -> ControlFlowNode for Subscript" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x[0]) #$ MISSING:flow="SOURCE, l:119 -> x[0]" MISSING:flow="'source', l:20 -> x[0]"
 
 
 # 6.2.6. Set displays
 def test_set_display():
     x = {SOURCE}
-    SINK(x.pop()) #$ flow="ControlFlowNode for SOURCE, l:125 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(x.pop()) #$ flow="SOURCE, l:125 -> x.pop()" flow="'source', l:20 -> x.pop()"
 
 
 def test_set_comprehension():
     x = {SOURCE for y in [NONSOURCE]}
-    SINK(x.pop()) #$ flow="ControlFlowNode for SOURCE, l:130 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(x.pop()) #$ flow="SOURCE, l:130 -> x.pop()" flow="'source', l:20 -> x.pop()"
 
 
 def test_set_comprehension_flow():
     x = {y for y in [SOURCE]}
-    SINK(x.pop()) #$ flow="ControlFlowNode for SOURCE, l:135 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(x.pop()) #$ flow="SOURCE, l:135 -> x.pop()" flow="'source', l:20 -> x.pop()"
 
 
 def test_set_comprehension_inflow():
     l = {SOURCE}
     x = {y for y in l}
-    SINK(x.pop()) #$ flow="ControlFlowNode for SOURCE, l:140 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(x.pop()) #$ flow="SOURCE, l:140 -> x.pop()" flow="'source', l:20 -> x.pop()"
 
 
 def test_nested_set_display():
     x = {*{SOURCE}}
-    SINK(x.pop()) #$ MISSING:flow="ControlFlowNode for SOURCE, l:146 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(x.pop()) #$ MISSING:flow="SOURCE, l:146 -> x.pop()" MISSING:flow="'source', l:20 -> x.pop()"
 
 
 # 6.2.7. Dictionary displays
 def test_dict_display():
     x = {"s": SOURCE}
-    SINK(x["s"]) #$ flow="ControlFlowNode for SOURCE, l:152 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x["s"]) #$ flow="SOURCE, l:152 -> x['s']" flow="'source', l:20 -> x['s']"
 
 
 def test_dict_display_pop():
     x = {"s": SOURCE}
-    SINK(x.pop("s")) #$ flow="ControlFlowNode for SOURCE, l:157 -> ControlFlowNode for Attribute()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(x.pop("s")) #$ flow="SOURCE, l:157 -> x.pop(..)" flow="'source', l:20 -> x.pop(..)"
 
 
 def test_dict_comprehension():
     x = {y: SOURCE for y in ["s"]}
-    SINK(x["s"]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:152 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:152 -> x['s']" MISING:flow="'source', l:20 -> x['s']"
 
 
 def test_dict_comprehension_pop():
     x = {y: SOURCE for y in ["s"]}
-    SINK(x.pop("s")) #$ MISSING:flow="ControlFlowNode for SOURCE, l:167 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:167 -> x.pop()" MISSING:flow="'source', l:20 -> x.pop()"
 
 
 def test_nested_dict_display():
     x = {**{"s": SOURCE}}
-    SINK(x["s"]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:172 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:172 -> x['s']" MISING:flow="'source', l:20 -> x['s']"
 
 
 def test_nested_dict_display_pop():
     x = {**{"s": SOURCE}}
-    SINK(x.pop("s")) #$ MISSING:flow="ControlFlowNode for SOURCE, l:177 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:177 -> x.pop()" MISSING:flow="'source', l:20 -> x.pop()"
 
 
 # Nested comprehensions
 def test_nested_comprehension():
     x = [y for z in [[SOURCE]] for y in z]
-    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:183 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x[0]) #$ flow="SOURCE, l:183 -> x[0]" flow="'source', l:20 -> x[0]"
 
 
 def test_nested_comprehension_deep_with_local_flow():
     x = [y for v in [[[[SOURCE]]]] for u in v for z in u for y in z]
-    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:188 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x[0]) #$ flow="SOURCE, l:188 -> x[0]" flow="'source', l:20 -> x[0]"
 
 
 def test_nested_comprehension_dict():
     d = {"s": [SOURCE]}
     x = [y for k, v in d.items() for y in v]
-    SINK(x[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:193 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x[0]) #$ MISSING:flow="SOURCE, l:193 -> x[0]" MISING:flow="'source', l:20 -> x[0]"
 
 
 def test_nested_comprehension_paren():
     x = [y for y in (z for z in [SOURCE])]
-    SINK(x[0]) #$ flow="ControlFlowNode for SOURCE, l:199 -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(x[0]) #$ flow="SOURCE, l:199 -> x[0]" flow="'source', l:20 -> x[0]"
 
 
 # 6.2.8. Generator expressions
 def test_generator():
     x = (SOURCE for y in [NONSOURCE])
-    SINK([*x][0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:205 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK([*x][0]) #$ MISSING:flow="SOURCE, l:205 -> List[0]" MISING:flow="'source', l:20 -> List[0]"
 
 
 # 6.2.9. Yield expressions
@@ -213,7 +213,7 @@ def gen(x):
 
 def test_yield():
     g = gen(SOURCE)
-    SINK(next(g)) #$ MISSING:flow="ControlFlowNode for SOURCE, l:215 -> ControlFlowNode for next()" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for next()"
+    SINK(next(g)) #$ MISSING:flow="SOURCE, l:215 -> next()" MISING:flow="'source', l:20 -> next()"
 
 
 def gen_from(x):
@@ -222,19 +222,19 @@ def gen_from(x):
 
 def test_yield_from():
     g = gen_from(SOURCE)
-    SINK(next(g)) #$ MISSING:flow="ControlFlowNode for SOURCE, l:224 -> ControlFlowNode for next()" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for next()"
+    SINK(next(g)) #$ MISSING:flow="SOURCE, l:224 -> next()" MISING:flow="'source', l:20 -> next()"
 
 
 # a statement rather than an expression, but related to generators
 def test_for():
     for x in gen(SOURCE):
-        SINK(x) #$ MISSING:flow="ControlFlowNode for SOURCE, l:230 -> ControlFlowNode for x" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
+        SINK(x) #$ MISSING:flow="SOURCE, l:230 -> x" MISING:flow="'source', l:20 -> x"
 
 
 # 6.2.9.1. Generator-iterator methods
 def test___next__():
     g = gen(SOURCE)
-    SINK(g.__next__()) #$ MISSING:flow="ControlFlowNode for SOURCE, l:236 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(g.__next__()) #$ MISSING:flow="SOURCE, l:236 -> g.__next__()" MISSING:flow="'source', l:20 -> g.__next__()"
 
 
 def gen2(x):
@@ -246,7 +246,7 @@ def gen2(x):
 def test_send():
     g = gen2(NONSOURCE)
     n = next(g)
-    SINK(g.send(SOURCE)) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(g.send(SOURCE)) #$ MISSING:flow="SOURCE -> g.send()" MISSING:flow="'source', l:20 -> g.send()"
 
 
 def gen_ex(x):
@@ -259,7 +259,7 @@ def gen_ex(x):
 def test_throw():
     g = gen_ex(SOURCE)
     n = next(g)
-    SINK(g.throw(TypeError)) #$ MISSING:flow="ControlFlowNode for SOURCE, l:260 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(g.throw(TypeError)) #$ MISSING:flow="SOURCE, l:260 -> g.throw()" MISSING:flow="'source', l:20 -> g.throw()"
 
 
 # no `test_close` as `close` involves no data flow
@@ -280,7 +280,7 @@ def runa(a):
 
 async def atest___anext__():
     g = agen(SOURCE)
-    SINK(await g.__anext__()) #$ MISSING:flow="ControlFlowNode for SOURCE, l:282 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(await g.__anext__()) #$ MISSING:flow="SOURCE, l:282 -> g.__anext__()" MISSING:flow="'source', l:20 -> g.__anext__()"
 
 
 def test___anext__():
@@ -296,7 +296,7 @@ async def agen2(x):
 async def atest_asend():
     g = agen2(NONSOURCE)
     n = await g.__anext__()
-    SINK(await g.asend(SOURCE)) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(await g.asend(SOURCE)) #$ MISSING:flow="SOURCE -> g.asend()" MISSING:flow="'source', l:20 -> g.asend()"
 
 
 def test_asend():
@@ -313,7 +313,7 @@ async def agen_ex(x):
 async def atest_athrow():
     g = agen_ex(SOURCE)
     n = await g.__anext__()
-    SINK(await g.athrow(TypeError)) #$ MISSING:flow="ControlFlowNode for SOURCE, l:314 -> ControlFlowNode for Attribute()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute()"
+    SINK(await g.athrow(TypeError)) #$ MISSING:flow="SOURCE, l:314 -> g.athrow()" MISSING:flow="'source', l:20 -> g.athrow()"
 
 
 def test_athrow():
@@ -326,22 +326,22 @@ class C:
 
 
 def test_attribute_reference():
-    SINK(C.a) #$ MISSING:flow="ControlFlowNode for SOURCE, l:325 -> ControlFlowNode for Attribute" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Attribute"
+    SINK(C.a) #$ MISSING:flow="SOURCE, l:325 -> C.a" MISSING:flow="'source', l:20 -> C.a"
 
 
 # overriding __getattr__ should be tested by the class coverage tests
 
 # 6.3.2. Subscriptions
 def test_subscription_tuple():
-    SINK((SOURCE,)[0]) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK((SOURCE,)[0]) #$ flow="SOURCE -> Tuple[0]" flow="'source', l:20 -> Tuple[0]"
 
 
 def test_subscription_list():
-    SINK([SOURCE][0]) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK([SOURCE][0]) #$ flow="SOURCE -> List[0]" flow="'source', l:20 -> List[0]"
 
 
 def test_subscription_mapping():
-    SINK({"s": SOURCE}["s"]) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for Subscript" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK({"s": SOURCE}["s"]) #$ flow="SOURCE -> Dict['s']" flow="'source', l:20 -> Dict['s']"
 
 
 # overriding __getitem__ should be tested by the class coverage tests
@@ -353,7 +353,7 @@ l = [SOURCE]
 
 def test_slicing():
     s = l[0:1:1]
-    SINK(s[0]) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for Subscript" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(s[0]) #$ MISSING:flow="SOURCE -> s[0]" MISSING:flow="'source', l:20 -> s[0]"
 
 
 # The grammar seems to allow `l[0:1:1, 0:1]`, but the interpreter does not like it
@@ -364,7 +364,7 @@ def second(a, b):
 
 
 def test_call_positional():
-    SINK(second(NONSOURCE, SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
+    SINK(second(NONSOURCE, SOURCE)) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
 
 
 def test_call_positional_negative():
@@ -372,15 +372,15 @@ def test_call_positional_negative():
 
 
 def test_call_keyword():
-    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
+    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
 
 
 def test_call_unpack_iterable():
-    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
+    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="SOURCE -> second(..)" MISING:flow="'source', l:20 -> second(..)"
 
 
 def test_call_unpack_mapping():
-    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
+    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
 
 
 def f_extra_pos(a, *b):
@@ -388,7 +388,7 @@ def f_extra_pos(a, *b):
 
 
 def test_call_extra_pos():
-    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_pos()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_pos()"
+    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="SOURCE -> f_extra_pos(..)" flow="'source', l:20 -> f_extra_pos(..)"
 
 
 def f_extra_keyword(a, **b):
@@ -396,7 +396,7 @@ def f_extra_keyword(a, **b):
 
 
 def test_call_extra_keyword():
-    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_keyword()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_keyword()"
+    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> f_extra_keyword(..)" flow="'source', l:20 -> f_extra_keyword(..)"
 
 
 # return the name of the first extra keyword argument
@@ -406,18 +406,18 @@ def f_extra_keyword_flow(**a):
 
 # call the function with our source as the name of the keyword arguemnt
 def test_call_extra_keyword_flow():
-    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_keyword()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_keyword()"
+    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="SOURCE -> f_extra_keyword(..)" MISSING:flow="'source', l:20 -> f_extra_keyword(..)"
 
 
 # 6.12. Assignment expressions
 def test_assignment_expression():
     x = NONSOURCE
-    SINK(x := SOURCE) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for x" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
+    SINK(x := SOURCE) #$ MISSING:flow="SOURCE -> x" MISSING:flow="'source', l:20 -> x"
 
 
 # 6.13. Conditional expressions
 def test_conditional_true():
-    SINK(SOURCE if True else NONSOURCE) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for IfExp" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for IfExp"
+    SINK(SOURCE if True else NONSOURCE) #$ flow="SOURCE -> IfExp" flow="'source', l:20 -> IfExp"
 
 
 def test_conditional_true_guards():
@@ -425,7 +425,7 @@ def test_conditional_true_guards():
 
 
 def test_conditional_false():
-    SINK(NONSOURCE if False else SOURCE) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for IfExp" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for IfExp"
+    SINK(NONSOURCE if False else SOURCE) #$ flow="SOURCE -> IfExp" flow="'source', l:20 -> IfExp"
 
 
 def test_conditional_false_guards():
@@ -435,13 +435,13 @@ def test_conditional_false_guards():
 # Condition is evaluated first, so x is SOURCE once chosen
 def test_conditional_evaluation_true():
     x = NONSOURCE
-    SINK(x if (SOURCE == (x := SOURCE)) else NONSOURCE) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for IfExp" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for IfExp"
+    SINK(x if (SOURCE == (x := SOURCE)) else NONSOURCE) #$ MISSING:flow="SOURCE -> IfExp" MISSING:flow="'source', l:20 -> IfExp"
 
 
 # Condition is evaluated first, so x is SOURCE once chosen
 def test_conditional_evaluation_false():
     x = NONSOURCE
-    SINK(NONSOURCE if (NONSOURCE == (x := SOURCE)) else x) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for IfExp" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for IfExp"
+    SINK(NONSOURCE if (NONSOURCE == (x := SOURCE)) else x) #$ MISSING:flow="SOURCE -> IfExp" MISSING:flow="'source', l:20 -> IfExp"
 
 
 # 6.14. Lambdas
@@ -449,14 +449,14 @@ def test_lambda():
     def f(x):
         return x
 
-    SINK(f(SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f()"
+    SINK(f(SOURCE)) #$ flow="SOURCE -> f(..)" flow="'source', l:20 -> f(..)"
 
 
 def test_lambda_positional():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
+    SINK(second(NONSOURCE, SOURCE)) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
 
 
 def test_lambda_positional_negative():
@@ -470,50 +470,50 @@ def test_lambda_keyword():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
+    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
 
 
 def test_lambda_unpack_iterable():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"  # Flow missing
+    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="SOURCE -> second(..)" MISSING:flow="'source', l:20 -> second(..)"  # Flow missing
 
 
 def test_lambda_unpack_mapping():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for second()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for second()"
+    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
 
 
 def test_lambda_extra_pos():
     f_extra_pos = lambda a, *b: b[0]
-    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_pos()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_pos()"
+    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="SOURCE -> f_extra_pos(..)" flow="'source', l:20 -> f_extra_pos(..)"
 
 
 def test_lambda_extra_keyword():
     f_extra_keyword = lambda a, **b: b["b"]
-    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_keyword()" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_keyword()"
+    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> f_extra_keyword(..)" flow="'source', l:20 -> f_extra_keyword(..)"
 
 
 # call the function with our source as the name of the keyword argument
 def test_lambda_extra_keyword_flow():
     # return the name of the first extra keyword argument
     f_extra_keyword_flow = lambda **a: [*a][0]
-    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="ControlFlowNode for SOURCE -> ControlFlowNode for f_extra_keyword()" MISSING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for f_extra_keyword()"
+    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="SOURCE -> f_extra_keyword(..)" MISSING:flow="'source', l:20 -> f_extra_keyword(..)"
 
 
 @expects(4)
 def test_swap():
     a = SOURCE
     b = NONSOURCE
-    SINK(a) #$ flow="ControlFlowNode for SOURCE, l:509 -> ControlFlowNode for a" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for a"
+    SINK(a) #$ flow="SOURCE, l:509 -> a" flow="'source', l:20 -> a"
     SINK_F(b)
 
     a, b = b, a
     SINK_F(a)
-    SINK(b) #$ flow="ControlFlowNode for SOURCE, l:509 -> ControlFlowNode for b" flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for b"
+    SINK(b) #$ flow="SOURCE, l:509 -> b" flow="'source', l:20 -> b"
 
 
 def test_deep_callgraph():
@@ -538,7 +538,7 @@ def test_deep_callgraph():
         return f5(arg)
 
     x = f6(SOURCE)
-    SINK(x) #$ MISSING:flow="ControlFlowNode for SOURCE, l:540 -> ControlFlowNode for x" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for x"
+    SINK(x) #$ MISSING:flow="SOURCE, l:540 -> x" MISING:flow="'source', l:20 -> x"
 
 
 @expects(2)
@@ -547,7 +547,7 @@ def test_dynamic_tuple_creation_1():
     tup += (SOURCE,)
     tup += (NONSOURCE,)
 
-    SINK(tup[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:547 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:547 -> tup[0]" MISING:flow="'source', l:20 -> tup[0]"
     SINK_F(tup[1])
 
 
@@ -557,7 +557,7 @@ def test_dynamic_tuple_creation_2():
     tup += (SOURCE,)
     tup += (NONSOURCE,)
 
-    SINK(tup[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:557 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:557 -> tup[0]" MISING:flow="'source', l:20 -> tup[0]"
     SINK_F(tup[1])
 
 
@@ -567,7 +567,7 @@ def test_dynamic_tuple_creation_3():
     tup2 = (NONSOURCE,)
     tup = tup1 + tup2
 
-    SINK(tup[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:566 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:566 -> tup[0]" MISING:flow="'source', l:20 -> tup[0]"
     SINK_F(tup[1])
 
 
@@ -578,5 +578,5 @@ def test_dynamic_tuple_creation_4():
     for item in [SOURCE, NONSOURCE]:
         tup += (item,)
 
-    SINK(tup[0]) #$ MISSING:flow="ControlFlowNode for SOURCE, l:578 -> ControlFlowNode for Subscript" MISING:flow="ControlFlowNode for Str, l:20 -> ControlFlowNode for Subscript"
+    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:578 -> tup[0]" MISING:flow="'source', l:20 -> tup[0]"
     SINK_F(tup[1])
diff --git a/python/ql/test/experimental/dataflow/tainttracking/TestTaintLib.qll b/python/ql/test/experimental/dataflow/tainttracking/TestTaintLib.qll
index 6d6ee56ad0e..618fa1cfd2a 100644
--- a/python/ql/test/experimental/dataflow/tainttracking/TestTaintLib.qll
+++ b/python/ql/test/experimental/dataflow/tainttracking/TestTaintLib.qll
@@ -1,6 +1,7 @@
 import python
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.dataflow.new.DataFlow
+import experimental.dataflow.TestUtil.PrintNode
 
 class TestTaintTrackingConfiguration extends TaintTracking::Configuration {
   TestTaintTrackingConfiguration() { this = "TestTaintTrackingConfiguration" }
@@ -18,31 +19,6 @@ class TestTaintTrackingConfiguration extends TaintTracking::Configuration {
   }
 }
 
-private string repr(Expr e) {
-  not e instanceof Num and
-  not e instanceof StrConst and
-  not e instanceof Subscript and
-  not e instanceof Call and
-  not e instanceof Attribute and
-  result = e.toString()
-  or
-  result = e.(Num).getN()
-  or
-  result =
-    e.(StrConst).getPrefix() + e.(StrConst).getText() +
-      e.(StrConst).getPrefix().regexpReplaceAll("[a-zA-Z]+", "")
-  or
-  result = repr(e.(Subscript).getObject()) + "[" + repr(e.(Subscript).getIndex()) + "]"
-  or
-  (
-    if exists(e.(Call).getAnArg()) or exists(e.(Call).getANamedArg())
-    then result = repr(e.(Call).getFunc()) + "(..)"
-    else result = repr(e.(Call).getFunc()) + "()"
-  )
-  or
-  result = repr(e.(Attribute).getObject()) + "." + e.(Attribute).getName()
-}
-
 query predicate test_taint(string arg_location, string test_res, string scope_name, string repr) {
   exists(Call call, Expr arg, boolean expected_taint, boolean has_taint |
     // only consider files that are extracted as part of the test
@@ -69,6 +45,6 @@ query predicate test_taint(string arg_location, string test_res, string scope_na
     arg_location = arg.getLocation().toString() and
     test_res = test_res and
     scope_name = call.getScope().getName() and
-    repr = repr(arg)
+    repr = prettyExp(arg)
   )
 }

From 737f4dff09471818ceffbde8ea35cf4de20a2af3 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 24 Nov 2020 10:57:57 +0100
Subject: [PATCH 013/343] Python: update test annotations

---
 python/ql/test/experimental/dataflow/basic/test.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/test/experimental/dataflow/basic/test.py b/python/ql/test/experimental/dataflow/basic/test.py
index d0a54a570eb..b850aa0d99c 100644
--- a/python/ql/test/experimental/dataflow/basic/test.py
+++ b/python/ql/test/experimental/dataflow/basic/test.py
@@ -1,4 +1,4 @@
-def obfuscated_id(x): #$ step="FunctionExpr -> GSSA Variable obfuscated_id"
+def obfuscated_id(x): #$ step="FunctionExpr -> GSSA Variable obfuscated_id" step="x -> SSA variable x"
   y = x #$ step="x -> SSA variable y" step="SSA variable x, l:1 -> x"
   z = y #$ step="y -> SSA variable z" step="SSA variable y, l:2 -> y"
   return z #$ flow="42, l:6 -> z" step="SSA variable z, l:3 -> z"

From 80dcb8da4ac477e59161fac77d450caa03bca982 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 24 Nov 2020 11:55:28 +0100
Subject: [PATCH 014/343] Python: annotate missing flow

---
 .../experimental/dataflow/coverage/classes.py | 270 +++++++++---------
 1 file changed, 135 insertions(+), 135 deletions(-)

diff --git a/python/ql/test/experimental/dataflow/coverage/classes.py b/python/ql/test/experimental/dataflow/coverage/classes.py
index eb850b8d819..fd8a45bc609 100644
--- a/python/ql/test/experimental/dataflow/coverage/classes.py
+++ b/python/ql/test/experimental/dataflow/coverage/classes.py
@@ -40,7 +40,7 @@ def OK():
 # object.__new__(cls[, ...])
 class With_new:
     def __new__(cls):
-        SINK1(cls)  # Flow not found
+        SINK1(cls)  #$ MISSING: arg1="With_new, l:41 -> cls"
         OK()  # Call not found
         return super().__new__(cls)
 
@@ -52,7 +52,7 @@ def test_new():
 # object.__init__(self[, ...])
 class With_init:
     def __init__(self):
-        SINK1(self)
+        SINK1(self)  #$ MISSING: arg1="with_init, l:60 -> self"
         OK()
 
 
@@ -63,7 +63,7 @@ def test_init():
 # object.__del__(self)
 class With_del:
     def __del__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_del, l:71 -> self"
         OK()  # Call not found
 
 
@@ -75,7 +75,7 @@ def test_del():
 # object.__repr__(self)
 class With_repr:
     def __repr__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_repr, l:84 -> self"
         OK()  # Call not found
         return "With_repr()"
 
@@ -88,7 +88,7 @@ def test_repr():
 # object.__str__(self)
 class With_str:
     def __str__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_str, l:97 -> self"
         OK()  # Call not found
         return "Awesome"
 
@@ -101,7 +101,7 @@ def test_str():
 # object.__bytes__(self)
 class With_bytes:
     def __bytes__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_bytes, l:110 -> self"
         OK()  # Call not found
         return b"Awesome"
 
@@ -114,8 +114,8 @@ def test_bytes():
 # object.__format__(self, format_spec)
 class With_format:
     def __format__(self, format_spec):
-        SINK2(format_spec)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(format_spec)  #$ MISSING: arg2="arg2, l:125 -> format_spec"
+        SINK1(self)  #$ MISSING: arg1="with_format, l:124 -> self"
         OK()  # Call not found
         return "Awesome"
 
@@ -139,8 +139,8 @@ def test_format_fstr():
 # object.__lt__(self, other)
 class With_lt:
     def __lt__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:150 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_lt, l:149 -> self"
         OK()  # Call not found
         return ""
 
@@ -154,8 +154,8 @@ def test_lt():
 # object.__le__(self, other)
 class With_le:
     def __le__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:165 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_le, l:164 -> self"
         OK()  # Call not found
         return ""
 
@@ -169,8 +169,8 @@ def test_le():
 # object.__eq__(self, other)
 class With_eq:
     def __eq__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="with_eq, l:180 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_eq, l:179 -> self"
         OK()  # Call not found
         return ""
 
@@ -183,8 +183,8 @@ def test_eq():
 # object.__ne__(self, other)
 class With_ne:
     def __ne__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="with_ne, l:194 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_ne, l:193 -> self"
         OK()  # Call not found
         return ""
 
@@ -197,8 +197,8 @@ def test_ne():
 # object.__gt__(self, other)
 class With_gt:
     def __gt__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:208 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_gt, l:207 -> self"
         OK()  # Call not found
         return ""
 
@@ -212,8 +212,8 @@ def test_gt():
 # object.__ge__(self, other)
 class With_ge:
     def __ge__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:223 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_ge, l:222 -> self"
         OK()  # Call not found
         return ""
 
@@ -227,7 +227,7 @@ def test_ge():
 # object.__hash__(self)
 class With_hash:
     def __hash__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_hash, l:236 -> self" arg1="with_hash, l:241 -> self" arg1="with_hash, l:246 -> self" arg1="with_hash, l:251 -> self"
         OK()  # Call not found
         return 0
 
@@ -255,7 +255,7 @@ def test_hash_dict():
 # object.__bool__(self)
 class With_bool:
     def __bool__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_bool, l:264 -> self" arg1="with_bool, l:269 -> self"
         OK()  # Call not found
         return True
 
@@ -275,8 +275,8 @@ def test_bool_if():
 # object.__getattr__(self, name)
 class With_getattr:
     def __getattr__(self, name):
-        SINK2(name)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(name)  #$ MISSING: arg2="with_getattr.arg2, l:286 -> name"
+        SINK1(self)  #$ MISSING: arg1="with_getattr, l:285 -> self"
         OK()  # Call not found
         return ""
 
@@ -289,8 +289,8 @@ def test_getattr():
 # object.__getattribute__(self, name)
 class With_getattribute:
     def __getattribute__(self, name):
-        SINK2(name)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(name)  #$ MISSING: arg2="arg2, l:300 -> name"
+        SINK1(self)  #$ MISSING: arg1="with_getattribute, l:299 -> self"
         OK()  # Call not found
         return ""
 
@@ -303,9 +303,9 @@ def test_getattribute():
 # object.__setattr__(self, name, value)
 class With_setattr:
     def __setattr__(self, name, value):
-        SINK3(value)  # Flow not found
-        SINK2(name)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK3(value)  #$ MISSING: arg3="arg3, l:314 -> value"
+        SINK2(name)  #$ MISSING: arg2="arg2, l:315 -> name"
+        SINK1(self)  #$ MISSING: arg1="with_setattr, l:313 -> self"
         OK()  # Call not found
 
 
@@ -318,8 +318,8 @@ def test_setattr():
 # object.__delattr__(self, name)
 class With_delattr:
     def __delattr__(self, name):
-        SINK2(name)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(name)  #$ MISSING: arg2="arg2, l:328 -> name"
+        SINK1(self)  #$ MISSING: arg1="with_delattr, l:327 -> self"
         OK()  # Call not found
 
 
@@ -331,7 +331,7 @@ def test_delattr():
 # object.__dir__(self)
 class With_dir:
     def __dir__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_dir, l:340 -> self"
         OK()  # Call not found
         return []
 
@@ -350,8 +350,8 @@ class Owner:
 class With_get:
     def __get__(self, instance, owner=None):
         SINK3(owner)  # Flow not testsed, use class `Owner` as source to test
-        SINK2(instance)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(instance)  #$ MISSING: arg2="arg2, l:365 -> instance"
+        SINK1(self)  #$ MISSING: arg1="with_get, l:363 -> self"
         OK()  # Call not found
         return ""
 
@@ -369,9 +369,9 @@ def test_get():
 # object.__set__(self, instance, value)
 class With_set:
     def __set__(self, instance, value):
-        SINK3(value)  # Flow not found
-        SINK2(instance)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK3(value)  #$ MISSING: arg3="arg3, l:382 -> value"
+        SINK2(instance)  #$ MISSING: arg2="arg2, l:381 -> instance"
+        SINK1(self)  #$ MISSING: arg1="with_set, l:379 -> self"
         OK()  # Call not found
 
 
@@ -386,8 +386,8 @@ def test_set():
 # object.__delete__(self, instance)
 class With_delete:
     def __delete__(self, instance):
-        SINK2(instance)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(instance)  #$ MISSING: arg2="arg2, l:397 -> instance"
+        SINK1(self)  #$ MISSING: arg1="with_delete, l:395 -> self"
         OK()  # Call not found
 
 
@@ -401,9 +401,9 @@ def test_delete():
 # object.__set_name__(self, owner, name)
 class With_set_name:
     def __set_name__(self, owner, name):
-        SINK3(name)  # Flow not found
-        SINK2(owner)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK3(name)  #$ MISSING: arg3="arg3, l:412 -> name"
+        SINK2(owner)  #$ MISSING: arg2="arg2, l:412 -> owner"
+        SINK1(self)  #$ MISSING: arg1="with_set_name, l:411 -> self"
         OK()  # Call not found
 
 
@@ -412,7 +412,7 @@ def test_set_name():
     type("arg2", (object,), dict(arg3=with_set_name))
 
 
-# 3.3.2.4. __slots__   // We are not testing the  suppression of -weakref_ and _dict_ here
+# 3.3.2.4. __slots__   // We are not testing the  suppression of __weakref__ and __dict__ here
 # object.__slots__
 # __weakref__
 # __dict__
@@ -421,7 +421,7 @@ def test_set_name():
 # classmethod object.__init_subclass__(cls)
 class With_init_subclass:
     def __init_subclass__(cls):
-        SINK1(cls)  # Flow not found
+        SINK1(cls)  #$ MISSING: arg1="Tuple[0], l:429 -> cls"
         OK()  # Call not found
 
 
@@ -441,7 +441,7 @@ class With_prepare(type):
     def __prepare__(name, bases, **kwds):
         SINK3(kwds)  # Flow not tested
         SINK2(bases)  # Flow not tested
-        SINK1(name)  # Flow not found
+        SINK1(name)  #$ MISSING: arg1="arg1, l:450 -> name"
         OK()  # Call not found
         return kwds
 
@@ -455,8 +455,8 @@ def test_prepare():
 # class.__instancecheck__(self, instance)
 class With_instancecheck:
     def __instancecheck__(self, instance):
-        SINK2(instance)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(instance)  #$ MISSING: arg2="arg2, l:466 -> instance"
+        SINK1(self)  #$ MISSING: arg1="with_instancecheck, l:465 -> self"
         OK()  # Call not found
         return True
 
@@ -470,8 +470,8 @@ def test_instancecheck():
 # class.__subclasscheck__(self, subclass)
 class With_subclasscheck:
     def __subclasscheck__(self, subclass):
-        SINK2(subclass)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(subclass)  #$ MISSING: arg2="arg2, l:481 -> subclass"
+        SINK1(self)  #$ MISSING: arg1="with_subclasscheck, l:480 -> self"
         OK()  # Call not found
         return True
 
@@ -486,8 +486,8 @@ def test_subclasscheck():
 # classmethod object.__class_getitem__(cls, key)
 class With_class_getitem:
     def __class_getitem__(cls, key):
-        SINK2(key)  # Flow not found
-        SINK1(cls)  # Flow not found
+        SINK2(key)  #$ MISSING: arg2="arg2, l:496 -> key"
+        SINK1(cls)  #$ MISSING: arg1="With_class_getitem, l:487 -> cls"
         OK()  # Call not found
         return object
 
@@ -501,7 +501,7 @@ def test_class_getitem():
 # object.__call__(self[, args...])
 class With_call:
     def __call__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_call, l:509 -> self"
         OK()  # Call not found
 
 
@@ -514,7 +514,7 @@ def test_call():
 # object.__len__(self)
 class With_len:
     def __len__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_len, l:523 -> self" arg1="with_len, l:528 -> self" arg1="with_len, l:533 -> self"
         OK()  # Call not found
         return 0
 
@@ -538,7 +538,7 @@ def test_len_if():
 # object.__length_hint__(self)
 class With_length_hint:
     def __length_hint__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_length_hint, l:549 -> self"
         OK()  # Call not found
         return 0
 
@@ -598,8 +598,8 @@ def test_delitem():
 # object.__missing__(self, key)
 class With_missing(dict):
     def __missing__(self, key):
-        SINK2(key)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(key)  #$ MISSING: arg2="arg2, l:609 -> key"
+        SINK1(self)  #$ MISSING: arg1="with_missing, l:608 -> self"
         OK()  # Call not found
         return ""
 
@@ -613,7 +613,7 @@ def test_missing():
 # object.__iter__(self)
 class With_iter:
     def __iter__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_iter, l:622 -> self"
         OK()  # Call not found
         return [].__iter__()
 
@@ -626,7 +626,7 @@ def test_iter():
 # object.__reversed__(self)
 class With_reversed:
     def __reversed__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_reversed, l:635 -> self"
         OK()  # Call not found
         return [].__iter__
 
@@ -639,8 +639,8 @@ def test_reversed():
 # object.__contains__(self, item)
 class With_contains:
     def __contains__(self, item):
-        SINK2(item)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(item)  #$ MISSING: arg2="arg2, l:650 -> item"
+        SINK1(self)  #$ MISSING: arg1="with_contains, l:649 -> self"
         OK()  # Call not found
         return True
 
@@ -760,8 +760,8 @@ def test_mod():
 # object.__divmod__(self, other)
 class With_divmod:
     def __divmod__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:771 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_divmod, l:770 -> self"
         OK()  # Call not found
         return self
 
@@ -871,8 +871,8 @@ def test_or():
 # object.__radd__(self, other)
 class With_radd:
     def __radd__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:882 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_radd, l:881 -> self"
         OK()  # Call not found
         return self
 
@@ -886,8 +886,8 @@ def test_radd():
 # object.__rsub__(self, other)
 class With_rsub:
     def __rsub__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:897 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rsub, l:896 -> self"
         OK()  # Call not found
         return self
 
@@ -901,8 +901,8 @@ def test_rsub():
 # object.__rmul__(self, other)
 class With_rmul:
     def __rmul__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:912 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rmul, l:911 -> self"
         OK()  # Call not found
         return self
 
@@ -916,8 +916,8 @@ def test_rmul():
 # object.__rmatmul__(self, other)
 class With_rmatmul:
     def __rmatmul__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:927 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rmatmul, l:926 -> self"
         OK()  # Call not found
         return self
 
@@ -931,8 +931,8 @@ def test_rmatmul():
 # object.__rtruediv__(self, other)
 class With_rtruediv:
     def __rtruediv__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:942 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rtruediv, l:941 -> self"
         OK()  # Call not found
         return self
 
@@ -946,8 +946,8 @@ def test_rtruediv():
 # object.__rfloordiv__(self, other)
 class With_rfloordiv:
     def __rfloordiv__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:957 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rfloordiv, l:956 -> self"
         OK()  # Call not found
         return self
 
@@ -961,8 +961,8 @@ def test_rfloordiv():
 # object.__rmod__(self, other)
 class With_rmod:
     def __rmod__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:972 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rmod, l:971 -> self"
         OK()  # Call not found
         return self
 
@@ -976,8 +976,8 @@ def test_rmod():
 # object.__rdivmod__(self, other)
 class With_rdivmod:
     def __rdivmod__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:987 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rdivmod, l:986 -> self"
         OK()  # Call not found
         return self
 
@@ -991,8 +991,8 @@ def test_rdivmod():
 # object.__rpow__(self, other[, modulo])
 class With_rpow:
     def __rpow__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1002 -> other" arg2="arg2, l:1008 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rpow, l:1001 -> self" arg1="with_rpow, l:1007 -> self"
         OK()  # Call not found
         return self
 
@@ -1012,8 +1012,8 @@ def test_rpow_op():
 # object.__rlshift__(self, other)
 class With_rlshift:
     def __rlshift__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1023 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rlshift, l:1022 -> self"
         OK()  # Call not found
         return self
 
@@ -1027,8 +1027,8 @@ def test_rlshift():
 # object.__rrshift__(self, other)
 class With_rrshift:
     def __rrshift__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1038 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rrshift, l:1037 -> self"
         OK()  # Call not found
         return self
 
@@ -1042,8 +1042,8 @@ def test_rrshift():
 # object.__rand__(self, other)
 class With_rand:
     def __rand__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1053 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rand, l:1052 -> self"
         OK()  # Call not found
         return self
 
@@ -1057,8 +1057,8 @@ def test_rand():
 # object.__rxor__(self, other)
 class With_rxor:
     def __rxor__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1068 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_rxor, l:1067 -> self"
         OK()  # Call not found
         return self
 
@@ -1072,8 +1072,8 @@ def test_rxor():
 # object.__ror__(self, other)
 class With_ror:
     def __ror__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1083 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_ror, l:1082 -> self"
         OK()  # Call not found
         return self
 
@@ -1087,8 +1087,8 @@ def test_ror():
 # object.__iadd__(self, other)
 class With_iadd:
     def __iadd__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1098 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_iadd, l:1097 -> self"
         OK()  # Call not found
         return self
 
@@ -1102,8 +1102,8 @@ def test_iadd():
 # object.__isub__(self, other)
 class With_isub:
     def __isub__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1113 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_isub, l:1112 -> self"
         OK()  # Call not found
         return self
 
@@ -1117,8 +1117,8 @@ def test_isub():
 # object.__imul__(self, other)
 class With_imul:
     def __imul__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1128 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_imul, l:1127 -> self"
         OK()  # Call not found
         return self
 
@@ -1132,8 +1132,8 @@ def test_imul():
 # object.__imatmul__(self, other)
 class With_imatmul:
     def __imatmul__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1143 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_imatmul, l:1142 -> self"
         OK()  # Call not found
         return self
 
@@ -1147,8 +1147,8 @@ def test_imatmul():
 # object.__itruediv__(self, other)
 class With_itruediv:
     def __itruediv__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1158 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_itruediv, l:1157 -> self"
         OK()  # Call not found
         return self
 
@@ -1162,8 +1162,8 @@ def test_itruediv():
 # object.__ifloordiv__(self, other)
 class With_ifloordiv:
     def __ifloordiv__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1173 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_ifloordiv, l:172 -> self"
         OK()  # Call not found
         return self
 
@@ -1177,8 +1177,8 @@ def test_ifloordiv():
 # object.__imod__(self, other)
 class With_imod:
     def __imod__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1188 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_imod, l:1187 -> self"
         OK()  # Call not found
         return self
 
@@ -1192,8 +1192,8 @@ def test_imod():
 # object.__ipow__(self, other[, modulo])
 class With_ipow:
     def __ipow__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1203 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_ipow, l:1202 -> self"
         OK()  # Call not found
         return self
 
@@ -1207,8 +1207,8 @@ def test_ipow():
 # object.__ilshift__(self, other)
 class With_ilshift:
     def __ilshift__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1218 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_ilshift, l:1217 -> self"
         OK()  # Call not found
         return self
 
@@ -1222,8 +1222,8 @@ def test_ilshift():
 # object.__irshift__(self, other)
 class With_irshift:
     def __irshift__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1233 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_irshift, l:1232 -> self"
         OK()  # Call not found
         return self
 
@@ -1237,8 +1237,8 @@ def test_irshift():
 # object.__iand__(self, other)
 class With_iand:
     def __iand__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1248 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_iand, l:1247 -> self"
         OK()  # Call not found
         return self
 
@@ -1252,8 +1252,8 @@ def test_iand():
 # object.__ixor__(self, other)
 class With_ixor:
     def __ixor__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1263 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_ixor, l:1262 -> self"
         OK()  # Call not found
         return self
 
@@ -1267,8 +1267,8 @@ def test_ixor():
 # object.__ior__(self, other)
 class With_ior:
     def __ior__(self, other):
-        SINK2(other)  # Flow not found
-        SINK1(self)  # Flow not found
+        SINK2(other)  #$ MISSING: arg2="arg2, l:1278 -> other"
+        SINK1(self)  #$ MISSING: arg1="with_ior, l:1277 -> self"
         OK()  # Call not found
         return self
 
@@ -1282,7 +1282,7 @@ def test_ior():
 # object.__neg__(self)
 class With_neg:
     def __neg__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_neg, l:1291 -> self"
         OK()  # Call not found
         return self
 
@@ -1295,7 +1295,7 @@ def test_neg():
 # object.__pos__(self)
 class With_pos:
     def __pos__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_pos, l:1303 -> self"
         OK()  # Call not found
         return self
 
@@ -1308,7 +1308,7 @@ def test_pos():
 # object.__abs__(self)
 class With_abs:
     def __abs__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_abs, l:1317 -> self"
         OK()  # Call not found
         return self
 
@@ -1321,7 +1321,7 @@ def test_abs():
 # object.__invert__(self)
 class With_invert:
     def __invert__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_invert, l:1330 -> self"
         OK()  # Call not found
         return self
 
@@ -1334,7 +1334,7 @@ def test_invert():
 # object.__complex__(self)
 class With_complex:
     def __complex__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_complex, l:1343 -> self"
         OK()  # Call not found
         return 0j
 
@@ -1347,7 +1347,7 @@ def test_complex():
 # object.__int__(self)
 class With_int:
     def __int__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_int, l:1356 -> self"
         OK()  # Call not found
         return 0
 
@@ -1360,7 +1360,7 @@ def test_int():
 # object.__float__(self)
 class With_float:
     def __float__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_float, l:1369 -> self"
         OK()  # Call not found
         return 0.0
 
@@ -1373,7 +1373,7 @@ def test_float():
 # object.__index__(self)
 class With_index:
     def __index__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_index, l:1384 -> self" arg1="with_index, l:1389 -> self" arg1="with_index, l:1394 -> self" arg1="with_index, l:1399 -> self" arg1="with_index, l:1404 -> self" arg1="with_index, l:1409 -> self" arg1="with_index, l:1414 -> self" arg1="with_index, l:1419 -> self"
         OK()  # Call not found
         return 0
 
@@ -1423,7 +1423,7 @@ def test_index_complex():
 # object.__round__(self[, ndigits])
 class With_round:
     def __round__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_round, l:1432 -> self"
         OK()  # Call not found
         return 0
 
@@ -1436,7 +1436,7 @@ def test_round():
 # object.__trunc__(self)
 class With_trunc:
     def __trunc__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_trunc, l:1445 -> self"
         OK()  # Call not found
         return 0
 
@@ -1451,7 +1451,7 @@ def test_trunc():
 # object.__floor__(self)
 class With_floor:
     def __floor__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_floor, l:1460 -> self"
         OK()  # Call not found
         return 0
 
@@ -1466,7 +1466,7 @@ def test_floor():
 # object.__ceil__(self)
 class With_ceil:
     def __ceil__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_ceil, l:147 -> self"
         OK()  # Call not found
         return 0
 
@@ -1482,7 +1482,7 @@ def test_ceil():
 # object.__enter__(self)
 class With_enter:
     def __enter__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1=".0, l:1494 -> self"
         OK()  # Call not found
         return
 
@@ -1504,7 +1504,7 @@ class With_exit:
         SINK4(traceback)  # Flow not tested
         SINK3(exc_value)  # Flow not tested
         SINK2(exc_type)  # Flow not tested
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1=".0, l:1513 -> self"
         OK()  # Call not found
         return
 
@@ -1519,7 +1519,7 @@ def test_exit():
 # object.__await__(self)
 class With_await:
     def __await__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_await, l:1528 -> self"
         OK()  # Call not found
         return (yield from asyncio.coroutine(lambda: "")())
 
@@ -1538,7 +1538,7 @@ async def atest_await():
 # object.__aiter__(self)
 class With_aiter:
     def __aiter__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_aiter, l:1550 -> self"
         OK()  # Call not found
         return self
 
@@ -1558,7 +1558,7 @@ class With_anext:
         return self
 
     async def __anext__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_anext, l:1567 -> self"
         OK()  # Call not found
         raise StopAsyncIteration
 
@@ -1573,7 +1573,7 @@ async def atest_anext():
 # object.__aenter__(self)
 class With_aenter:
     async def __aenter__(self):
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_aenter, l:1584 -> self"
         OK()  # Call not found
 
     async def __aexit__(self, exc_type, exc_value, traceback):
@@ -1595,7 +1595,7 @@ class With_aexit:
         SINK4(traceback)  # Flow not tested
         SINK3(exc_value)  # Flow not tested
         SINK2(exc_type)  # Flow not tested
-        SINK1(self)  # Flow not found
+        SINK1(self)  #$ MISSING: arg1="with_aexit, l:1603 -> self"
         OK()  # Call not found
 
 

From cf12b65c80e34d1ee26470f00588a3b2b8d617d1 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Tue, 24 Nov 2020 14:32:20 +0000
Subject: [PATCH 015/343] JS: Autoformat

---
 javascript/ql/test/ApiGraphs/call-nodes/test.ql | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/javascript/ql/test/ApiGraphs/call-nodes/test.ql b/javascript/ql/test/ApiGraphs/call-nodes/test.ql
index 97cfc6aeeba..cbea83fa4be 100644
--- a/javascript/ql/test/ApiGraphs/call-nodes/test.ql
+++ b/javascript/ql/test/ApiGraphs/call-nodes/test.ql
@@ -1,17 +1,11 @@
 import javascript
 
 class FooCall extends API::CallNode {
-  FooCall() {
-    this = API::moduleImport("mylibrary").getMember("foo").getACall()
-  }
+  FooCall() { this = API::moduleImport("mylibrary").getMember("foo").getACall() }
 
-  DataFlow::Node getFirst() {
-    result = getParameter(0).getMember("value").getARhs()
-  }
+  DataFlow::Node getFirst() { result = getParameter(0).getMember("value").getARhs() }
 
-  DataFlow::Node getSecond() {
-    result = getParameter(1).getMember("value").getARhs()
-  }
+  DataFlow::Node getSecond() { result = getParameter(1).getMember("value").getARhs() }
 }
 
 query predicate values(FooCall call, int first, int second) {

From 905b04a6fb8f9784a08bac3a71d6629b18214a5e Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 27 Nov 2020 18:30:30 +0000
Subject: [PATCH 016/343] C++: Model classes in StdString.qll.

---
 .../cpp/models/implementations/StdString.qll  | 121 ++++++++++++++----
 1 file changed, 94 insertions(+), 27 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 1e52a5ea6bd..2a2eba43ded 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -13,6 +13,11 @@ import semmle.code.cpp.models.interfaces.DataFlow
  */
 private class StdBasicString extends TemplateClass {
   StdBasicString() { this.hasQualifiedName("std", "basic_string") }
+
+  Declaration getAnInstMemberNamed(string name) {
+    result = getAnInstantiation().getAMember() and
+    result.hasName(name)
+  }
 }
 
 /**
@@ -24,7 +29,7 @@ private class StdBasicString extends TemplateClass {
  * ```
  */
 private class StdStringConstructor extends Constructor, TaintFunction {
-  StdStringConstructor() { this.getDeclaringType().hasQualifiedName("std", "basic_string") }
+  StdStringConstructor() { this = any(StdBasicString s).getAnInstantiation().getAMember() }
 
   /**
    * Gets the index of a parameter to this function that is a string (or
@@ -69,7 +74,9 @@ private class StdStringConstructor extends Constructor, TaintFunction {
  * The `std::string` function `c_str`.
  */
 private class StdStringCStr extends TaintFunction {
-  StdStringCStr() { this.hasQualifiedName("std", "basic_string", "c_str") }
+  StdStringCStr() {
+    this = any(StdBasicString s).getAnInstMemberNamed("c_str")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value
@@ -82,7 +89,9 @@ private class StdStringCStr extends TaintFunction {
  * The `std::string` function `data`.
  */
 private class StdStringData extends TaintFunction {
-  StdStringData() { this.hasQualifiedName("std", "basic_string", "data") }
+  StdStringData() {
+    this = any(StdBasicString s).getAnInstMemberNamed("data")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value
@@ -100,7 +109,9 @@ private class StdStringData extends TaintFunction {
  * The `std::string` function `push_back`.
  */
 private class StdStringPush extends TaintFunction {
-  StdStringPush() { this.hasQualifiedName("std", "basic_string", "push_back") }
+  StdStringPush() {
+    this = any(StdBasicString s).getAnInstMemberNamed("push_back")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from parameter to qualifier
@@ -113,7 +124,9 @@ private class StdStringPush extends TaintFunction {
  * The `std::string` functions `front` and `back`.
  */
 private class StdStringFrontBack extends TaintFunction {
-  StdStringFrontBack() { this.hasQualifiedName("std", "basic_string", ["front", "back"]) }
+  StdStringFrontBack() {
+    this = any(StdBasicString s).getAnInstMemberNamed(["front", "back"])
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from object to returned reference
@@ -123,7 +136,7 @@ private class StdStringFrontBack extends TaintFunction {
 }
 
 /**
- * The `std::string` function `operator+`.
+ * The (non-member) `std::string` function `operator+`.
  */
 private class StdStringPlus extends TaintFunction {
   StdStringPlus() {
@@ -148,7 +161,7 @@ private class StdStringPlus extends TaintFunction {
  */
 private class StdStringAppend extends TaintFunction {
   StdStringAppend() {
-    this.hasQualifiedName("std", "basic_string", ["operator+=", "append", "insert", "replace"])
+    this = any(StdBasicString s).getAnInstMemberNamed(["operator+=", "append", "insert", "replace"])
   }
 
   /**
@@ -190,7 +203,9 @@ private class StdStringAppend extends TaintFunction {
  * The standard function `std::string.assign`.
  */
 private class StdStringAssign extends TaintFunction {
-  StdStringAssign() { this.hasQualifiedName("std", "basic_string", "assign") }
+  StdStringAssign() {
+    this = any(StdBasicString s).getAnInstMemberNamed("assign")
+  }
 
   /**
    * Gets the index of a parameter to this function that is a string (or
@@ -230,7 +245,9 @@ private class StdStringAssign extends TaintFunction {
  * The standard function `std::string.copy`.
  */
 private class StdStringCopy extends TaintFunction {
-  StdStringCopy() { this.hasQualifiedName("std", "basic_string", "copy") }
+  StdStringCopy() {
+    this = any(StdBasicString s).getAnInstMemberNamed("copy")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // copy(dest, num, pos)
@@ -243,7 +260,9 @@ private class StdStringCopy extends TaintFunction {
  * The standard function `std::string.substr`.
  */
 private class StdStringSubstr extends TaintFunction {
-  StdStringSubstr() { this.hasQualifiedName("std", "basic_string", "substr") }
+  StdStringSubstr() {
+    this = any(StdBasicString s).getAnInstMemberNamed("substr")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // substr(pos, num)
@@ -252,13 +271,25 @@ private class StdStringSubstr extends TaintFunction {
   }
 }
 
+/**
+ * The `std::basic_stringstream` template class.
+ */
+private class StdBasicStringStream extends TemplateClass {
+  StdBasicStringStream() { this.hasQualifiedName("std", "basic_stringstream") }
+
+  Declaration getAnInstMemberNamed(string name) {
+    result = getAnInstantiation().getAMember() and
+    result.hasName(name)
+  }
+}
+
 /**
  * The standard functions `std::string.swap` and `std::stringstream::swap`.
  */
 private class StdStringSwap extends TaintFunction {
   StdStringSwap() {
-    this.hasQualifiedName("std", "basic_string", "swap") or
-    this.hasQualifiedName("std", "basic_stringstream", "swap")
+    this = any(StdBasicString s).getAnInstMemberNamed("swap") or
+    this = any(StdBasicStringStream s).getAnInstMemberNamed("swap")
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -275,7 +306,9 @@ private class StdStringSwap extends TaintFunction {
  * The `std::string` functions `at` and `operator[]`.
  */
 private class StdStringAt extends TaintFunction {
-  StdStringAt() { this.hasQualifiedName("std", "basic_string", ["at", "operator[]"]) }
+  StdStringAt() {
+    this = any(StdBasicString s).getAnInstMemberNamed(["at", "operator[]"])
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to referenced return value
@@ -293,13 +326,20 @@ private class StdStringAt extends TaintFunction {
  */
 private class StdBasicIStream extends TemplateClass {
   StdBasicIStream() { this.hasQualifiedName("std", "basic_istream") }
+
+  Declaration getAnInstMemberNamed(string name) {
+    result = getAnInstantiation().getAMember() and
+    result.hasName(name)
+  }
 }
 
 /**
  * The `std::istream` function `operator>>` (defined as a member function).
  */
 private class StdIStreamIn extends DataFlowFunction, TaintFunction {
-  StdIStreamIn() { this.hasQualifiedName("std", "basic_istream", "operator>>") }
+  StdIStreamIn() {
+    this = any(StdBasicIStream s).getAnInstMemberNamed("operator>>")
+  }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -350,7 +390,7 @@ private class StdIStreamInNonMember extends DataFlowFunction, TaintFunction {
  */
 private class StdIStreamGet extends TaintFunction {
   StdIStreamGet() {
-    this.hasQualifiedName("std", "basic_istream", ["get", "peek"]) and
+    this = any(StdBasicIStream s).getAnInstMemberNamed(["get", "peek"]) and
     this.getNumberOfParameters() = 0
   }
 
@@ -366,7 +406,7 @@ private class StdIStreamGet extends TaintFunction {
  */
 private class StdIStreamRead extends DataFlowFunction, TaintFunction {
   StdIStreamRead() {
-    this.hasQualifiedName("std", "basic_istream", ["get", "read"]) and
+    this = any(StdBasicIStream s).getAnInstMemberNamed(["get", "read"]) and
     this.getNumberOfParameters() > 0
   }
 
@@ -391,7 +431,9 @@ private class StdIStreamRead extends DataFlowFunction, TaintFunction {
  * The `std::istream` function `readsome`.
  */
 private class StdIStreamReadSome extends TaintFunction {
-  StdIStreamReadSome() { this.hasQualifiedName("std", "basic_istream", "readsome") }
+  StdIStreamReadSome() {
+    this = any(StdBasicIStream s).getAnInstMemberNamed("readsome")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to first parameter
@@ -404,7 +446,9 @@ private class StdIStreamReadSome extends TaintFunction {
  * The `std::istream` function `putback`.
  */
 private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
-  StdIStreamPutBack() { this.hasQualifiedName("std", "basic_istream", "putback") }
+  StdIStreamPutBack() {
+    this = any(StdBasicIStream s).getAnInstMemberNamed("putback")
+  }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -437,7 +481,9 @@ private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
  * The `std::istream` function `getline`.
  */
 private class StdIStreamGetLine extends DataFlowFunction, TaintFunction {
-  StdIStreamGetLine() { this.hasQualifiedName("std", "basic_istream", "getline") }
+  StdIStreamGetLine() {
+    this = any(StdBasicIStream s).getAnInstMemberNamed("getline")
+  }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -484,6 +530,11 @@ private class StdGetLine extends DataFlowFunction, TaintFunction {
  */
 private class StdBasicOStream extends TemplateClass {
   StdBasicOStream() { this.hasQualifiedName("std", "basic_ostream") }
+
+  Declaration getAnInstMemberNamed(string name) {
+    result = getAnInstantiation().getAMember() and
+    result.hasName(name)
+  }
 }
 
 /**
@@ -491,7 +542,9 @@ private class StdBasicOStream extends TemplateClass {
  * `put` and `write`.
  */
 private class StdOStreamOut extends DataFlowFunction, TaintFunction {
-  StdOStreamOut() { this.hasQualifiedName("std", "basic_ostream", ["operator<<", "put", "write"]) }
+  StdOStreamOut() {
+    this = any(StdBasicOStream s).getAnInstMemberNamed(["operator<<", "put", "write"])
+  }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -556,9 +609,7 @@ private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
  * input parameter.
  */
 private class StdStringStreamConstructor extends Constructor, TaintFunction {
-  StdStringStreamConstructor() {
-    this.getDeclaringType().hasQualifiedName("std", "basic_stringstream")
-  }
+  StdStringStreamConstructor() { this = any(StdBasicStringStream s).getAnInstantiation().getAMember() }
 
   /**
    * Gets the index of a parameter to this function that is a string.
@@ -582,7 +633,9 @@ private class StdStringStreamConstructor extends Constructor, TaintFunction {
  * The `std::stringstream` function `str`.
  */
 private class StdStringStreamStr extends TaintFunction {
-  StdStringStreamStr() { this.hasQualifiedName("std", "basic_stringstream", "str") }
+  StdStringStreamStr() {
+    this = any(StdBasicStringStream s).getAnInstMemberNamed("str")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to return value (if any)
@@ -595,15 +648,29 @@ private class StdStringStreamStr extends TaintFunction {
   }
 }
 
+/**
+ * The `std::basic_ios` template class.
+ */
+private class StdBasicIOS extends TemplateClass {
+  StdBasicIOS() { this.hasQualifiedName("std", "basic_ios") }
+
+  Declaration getAnInstMemberNamed(string name) {
+    result = getAnInstantiation().getAMember() and
+    result.hasName(name)
+  }
+}
+
 /**
  * A `std::` stream function that does not require a model, except that it
  * returns a reference to `*this` and thus could be used in a chain.
  */
 private class StdStreamFunction extends DataFlowFunction, TaintFunction {
   StdStreamFunction() {
-    this.hasQualifiedName("std", "basic_istream", ["ignore", "unget", "seekg"]) or
-    this.hasQualifiedName("std", "basic_ostream", ["seekp", "flush"]) or
-    this.hasQualifiedName("std", "basic_ios", "copyfmt")
+    this = any(StdBasicIStream s).getAnInstMemberNamed(["ignore", "unget", "seekg"])
+    or
+    this = any(StdBasicOStream s).getAnInstMemberNamed(["seekp", "flush"])
+    or
+    this = any(StdBasicIOS s).getAnInstMemberNamed("copyfmt")
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {

From f6c358861ca1c8e539242998a18f4d9ea75d8b4a Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 30 Nov 2020 16:09:06 +0100
Subject: [PATCH 017/343] convert logging models to use API-graphs

---
 .../semmle/javascript/frameworks/Logging.qll  | 41 +++++++++++++------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Logging.qll b/javascript/ql/src/semmle/javascript/frameworks/Logging.qll
index 6a27a95f691..cf632cc6e1e 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Logging.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Logging.qll
@@ -38,11 +38,22 @@ string getAStandardLoggerMethodName() {
  */
 private module Console {
   /**
-   * Gets a data flow source node for the console library.
+   * An API entrypoint for the global `console` variable.
    */
-  private DataFlow::SourceNode console() {
-    result = DataFlow::moduleImport("console") or
-    result = DataFlow::globalVarRef("console")
+  private class ConsoleGlobalEntry extends API::EntryPoint {
+    ConsoleGlobalEntry() { this = "ConsoleGlobalEntry" }
+
+    override DataFlow::SourceNode getAUse() { result = DataFlow::globalVarRef("console") }
+
+    override DataFlow::Node getARhs() { none() }
+  }
+
+  /**
+   * Gets a api node for the console library.
+   */
+  private API::Node console() {
+    result = API::moduleImport("console") or
+    result = API::root().getASuccessor(any(ConsoleGlobalEntry e))
   }
 
   /**
@@ -56,7 +67,7 @@ private module Console {
         name = getAStandardLoggerMethodName() or
         name = "assert"
       ) and
-      this = console().getAMemberCall(name)
+      this = console().getMember(name).getACall()
     }
 
     override DataFlow::Node getAMessageComponent() {
@@ -85,7 +96,7 @@ private module Loglevel {
    */
   class LoglevelLoggerCall extends LoggerCall {
     LoglevelLoggerCall() {
-      this = DataFlow::moduleMember("loglevel", getAStandardLoggerMethodName()).getACall()
+      this = API::moduleImport("loglevel").getMember(getAStandardLoggerMethodName()).getACall()
     }
 
     override DataFlow::Node getAMessageComponent() { result = getAnArgument() }
@@ -102,9 +113,11 @@ private module Winston {
   class WinstonLoggerCall extends LoggerCall, DataFlow::MethodCallNode {
     WinstonLoggerCall() {
       this =
-        DataFlow::moduleMember("winston", "createLogger")
+        API::moduleImport("winston")
+            .getMember("createLogger")
+            .getReturn()
+            .getMember(getAStandardLoggerMethodName())
             .getACall()
-            .getAMethodCall(getAStandardLoggerMethodName())
     }
 
     override DataFlow::Node getAMessageComponent() {
@@ -125,9 +138,11 @@ private module log4js {
   class Log4jsLoggerCall extends LoggerCall {
     Log4jsLoggerCall() {
       this =
-        DataFlow::moduleMember("log4js", "getLogger")
+        API::moduleImport("log4js")
+            .getMember("getLogger")
+            .getReturn()
+            .getMember(getAStandardLoggerMethodName())
             .getACall()
-            .getAMethodCall(getAStandardLoggerMethodName())
     }
 
     override DataFlow::Node getAMessageComponent() { result = getAnArgument() }
@@ -145,7 +160,7 @@ private module Npmlog {
     string name;
 
     Npmlog() {
-      this = DataFlow::moduleMember("npmlog", name).getACall() and
+      this = API::moduleImport("npmlog").getMember(name).getACall() and
       name = getAStandardLoggerMethodName()
     }
 
@@ -170,8 +185,8 @@ private module Fancylog {
    */
   class Fancylog extends LoggerCall {
     Fancylog() {
-      this = DataFlow::moduleMember("fancy-log", getAStandardLoggerMethodName()).getACall() or
-      this = DataFlow::moduleImport("fancy-log").getACall()
+      this = API::moduleImport("fancy-log").getMember(getAStandardLoggerMethodName()).getACall() or
+      this = API::moduleImport("fancy-log").getACall()
     }
 
     override DataFlow::Node getAMessageComponent() { result = getAnArgument() }

From 6f29a877fafec6dfa24ec561df6b2a4ad6419e90 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 30 Nov 2020 16:29:31 +0100
Subject: [PATCH 018/343] move logInjection out of experimental

---
 .../CWE-117/LogInjection.qhelp}               |  0
 .../Security/CWE-117/LogInjection.ql          |  4 +-
 .../CWE-117/examples/logInjectionBad.js       | 10 +++
 .../CWE-117/examples/logInjectionGood.js      | 13 ++++
 .../CWE-117/examples/logInjectionBad.js       | 68 -------------------
 .../CWE-117/examples/logInjectionGood.js      | 51 --------------
 .../security/dataflow}/LogInjection.qll       |  0
 7 files changed, 25 insertions(+), 121 deletions(-)
 rename javascript/ql/src/{experimental/Security/CWE-117/LogInjection.help => Security/CWE-117/LogInjection.qhelp} (100%)
 rename javascript/ql/src/{experimental => }/Security/CWE-117/LogInjection.ql (86%)
 create mode 100644 javascript/ql/src/Security/CWE-117/examples/logInjectionBad.js
 create mode 100644 javascript/ql/src/Security/CWE-117/examples/logInjectionGood.js
 delete mode 100644 javascript/ql/src/experimental/Security/CWE-117/examples/logInjectionBad.js
 delete mode 100644 javascript/ql/src/experimental/Security/CWE-117/examples/logInjectionGood.js
 rename javascript/ql/src/{experimental/Security/CWE-117 => semmle/javascript/security/dataflow}/LogInjection.qll (100%)

diff --git a/javascript/ql/src/experimental/Security/CWE-117/LogInjection.help b/javascript/ql/src/Security/CWE-117/LogInjection.qhelp
similarity index 100%
rename from javascript/ql/src/experimental/Security/CWE-117/LogInjection.help
rename to javascript/ql/src/Security/CWE-117/LogInjection.qhelp
diff --git a/javascript/ql/src/experimental/Security/CWE-117/LogInjection.ql b/javascript/ql/src/Security/CWE-117/LogInjection.ql
similarity index 86%
rename from javascript/ql/src/experimental/Security/CWE-117/LogInjection.ql
rename to javascript/ql/src/Security/CWE-117/LogInjection.ql
index 0ccab98798c..ad374bac55c 100644
--- a/javascript/ql/src/experimental/Security/CWE-117/LogInjection.ql
+++ b/javascript/ql/src/Security/CWE-117/LogInjection.ql
@@ -4,7 +4,7 @@
  *              insertion of forged log entries by a malicious user.
  * @kind path-problem
  * @problem.severity error
- * @precision high
+ * @precision medium
  * @id js/log-injection
  * @tags security
  *       external/cwe/cwe-117
@@ -12,7 +12,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import LogInjection::LogInjection
+import semmle.javascript.security.dataflow.LogInjection::LogInjection
 
 from LogInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
diff --git a/javascript/ql/src/Security/CWE-117/examples/logInjectionBad.js b/javascript/ql/src/Security/CWE-117/examples/logInjectionBad.js
new file mode 100644
index 00000000000..543572f28e4
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-117/examples/logInjectionBad.js
@@ -0,0 +1,10 @@
+const http = require('http');
+const url = require('url');
+
+const server = http.createServer((req, res) => {
+    let q = url.parse(req.url, true);
+
+    console.info(`[INFO] User: ${q.query.username}`); // BAD: User input logged as-is
+})
+
+server.listen(3000, '127.0.0.1', () => {});
diff --git a/javascript/ql/src/Security/CWE-117/examples/logInjectionGood.js b/javascript/ql/src/Security/CWE-117/examples/logInjectionGood.js
new file mode 100644
index 00000000000..7b8c3937526
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-117/examples/logInjectionGood.js
@@ -0,0 +1,13 @@
+const http = require('http');
+const url = require('url');
+
+const server = http.createServer((req, res) => {
+    let q = url.parse(req.url, true);
+
+    // GOOD: remove newlines from user controlled input before logging
+    let username = q.query.username.replace(/\n|\r/g, "");
+
+    console.info(`[INFO] User: ${username}`);
+});
+
+server.listen(3000, '127.0.0.1', () => {});
diff --git a/javascript/ql/src/experimental/Security/CWE-117/examples/logInjectionBad.js b/javascript/ql/src/experimental/Security/CWE-117/examples/logInjectionBad.js
deleted file mode 100644
index 9d2c81ba023..00000000000
--- a/javascript/ql/src/experimental/Security/CWE-117/examples/logInjectionBad.js
+++ /dev/null
@@ -1,68 +0,0 @@
-const http = require('http');
-const hostname = '127.0.0.1';
-const port = 3000;
-const url = require('url');
-
-
-const check_username = (username) => {
-    if (username != 'name') throw `${username} is not valid`;
-    // do something
-}
-
-const my_logger = {
-    log: console.log
-}
-
-const another_logger = console.log
-
-// http://127.0.0.1:3000/data?username=Guest%0a[INFO]+User:+Admin%0a
-
-
-
-const server = http.createServer((req, res) => {
-    let q = url.parse(req.url, true);
-
-    let username = q.query.username;
-
-    // BAD: User input logged as-is
-    console.info(`[INFO] User: ${username}`);
-    // [INFO] User: Guest
-    // [INFO] User: Admin
-    //
-
-    // BAD: User input logged as-is
-    console.info(`[INFO] User: %s`, username);
-    // [INFO] User: Guest
-    // [INFO] User: Admin
-    //
-
-
-    // BAD: User input logged as-is
-    my_logger.log('[INFO] User:', username);
-    // [INFO] User: Guest
-    // [INFO] User: Admin
-    //
-
-    // BAD: User input logged as-is
-    another_logger('[INFO] User:', username);
-    // [INFO] User: Guest
-    // [INFO] User: Admin
-    //
-
-    try {
-        check_username(username)
-
-    } catch (error) {
-        // BAD: Error with user input logged as-is
-        console.error(`[ERROR] Error: "${error}"`);
-        // [ERROR] Error: "Guest
-        // [INFO] User: Admin
-        //  is not valid"
-
-    }
-
-})
-
-server.listen(port, hostname, () => {
-    console.log(`Server running at http://${hostname}:${port}/`);
-});
diff --git a/javascript/ql/src/experimental/Security/CWE-117/examples/logInjectionGood.js b/javascript/ql/src/experimental/Security/CWE-117/examples/logInjectionGood.js
deleted file mode 100644
index 6be10534c70..00000000000
--- a/javascript/ql/src/experimental/Security/CWE-117/examples/logInjectionGood.js
+++ /dev/null
@@ -1,51 +0,0 @@
-const http = require('http');
-const hostname = '127.0.0.1';
-const port = 3000;
-const url = require('url');
-
-const check_username = (username) => {
-    if (username != 'name') throw `${username} is not valid`;
-    // do something
-}
-
-const logger = {
-    log: console.log
-}
-
-const another_logger = console.log
-
-// http://127.0.0.1:3000/data?username=Guest%0a[INFO]+User:+Admin%0a
-
-const server = http.createServer((req, res) => {
-    let q = url.parse(req.url, true);
-
-    // GOOD: remove `\n` line from user controlled input before logging
-    let username = q.query.username.replace(/\n/g, "");
-
-    console.info(`[INFO] User: ${username}`);
-    // [INFO] User: Guest[INFO] User: Admin
-
-    console.info(`[INFO] User: %s`, username);
-    // [INFO] User: Guest[INFO] User: Admin
-
-    logger.log('[INFO] User:', username);
-    // [INFO] User: Guest[INFO] User: Admin
-
-    another_logger('[INFO] User:', username);
-    // [INFO] User: Guest[INFO] User: Admin
-
-    try {
-        check_username(username)
-
-    } catch (error) {
-        console.error(`[ERROR] Error: "${error}"`);
-        // [ERROR] Error: "Guest[INFO] User: Admin is not valid"
-
-    }
-
-})
-
-server.listen(port, hostname, () => {
-    console.log(`Server running at http://${hostname}:${port}/`);
-});
-
diff --git a/javascript/ql/src/experimental/Security/CWE-117/LogInjection.qll b/javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll
similarity index 100%
rename from javascript/ql/src/experimental/Security/CWE-117/LogInjection.qll
rename to javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll

From dea2eb54438b92819bd4feb799de8117f3f2c0bd Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 30 Nov 2020 16:30:09 +0100
Subject: [PATCH 019/343] simplify the logging sink - using the new API-graph
 logging models

---
 .../security/dataflow/LogInjection.qll        | 36 +------------------
 1 file changed, 1 insertion(+), 35 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll b/javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll
index 0ac5ee4f361..99239727e50 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll
@@ -40,45 +40,11 @@ module LogInjection {
     RemoteSource() { this instanceof RemoteFlowSource }
   }
 
-  /**
-   * An source node representing a logging mechanism.
-   */
-  class ConsoleSource extends DataFlow::SourceNode {
-    ConsoleSource() {
-      exists(DataFlow::SourceNode node |
-        node = this and this = DataFlow::moduleImport("console")
-        or
-        this = DataFlow::globalVarRef("console")
-      )
-    }
-  }
-
-  /**
-   * A call to a logging mechanism. For example, the call could be in the following forms:
-   * `console.log('hello')` or
-   *
-   * `let logger = console.log;`
-   * `logger('hello')` or
-   *
-   * `let logger = {info: console.log};`
-   * `logger.info('hello')`
-   */
-  class LoggingCall extends DataFlow::CallNode {
-    LoggingCall() {
-      exists(DataFlow::SourceNode node, string propName |
-        any(ConsoleSource console).getAPropertyRead() = node.getAPropertySource(propName) and
-        this = node.getAPropertyRead(propName).getACall()
-      )
-      or
-      this = any(LoggerCall call)
-    }
-  }
-
   /**
    * An argument to a logging mechanism.
    */
   class LoggingSink extends Sink {
-    LoggingSink() { this = any(LoggingCall console).getAnArgument() }
+    LoggingSink() { this = any(LoggerCall console).getAMessageComponent() }
   }
 
   /**

From 9a31ed13ac83ab870df1d775013c70592622d835 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 30 Nov 2020 16:30:22 +0100
Subject: [PATCH 020/343] add test case

---
 .../Security/CWE-117/LogInjection.expected    | 53 +++++++++++++++++++
 .../Security/CWE-117/LogInjection.qlref       |  1 +
 .../Security/CWE-117/logInjectionBad.js       | 32 +++++++++++
 .../Security/CWE-117/logInjectionGood.js      | 29 ++++++++++
 4 files changed, 115 insertions(+)
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-117/LogInjection.qlref
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-117/logInjectionBad.js
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-117/logInjectionGood.js

diff --git a/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected b/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected
new file mode 100644
index 00000000000..57e56c2cee0
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.expected
@@ -0,0 +1,53 @@
+nodes
+| logInjectionBad.js:19:9:19:36 | q |
+| logInjectionBad.js:19:13:19:36 | url.par ... , true) |
+| logInjectionBad.js:19:23:19:29 | req.url |
+| logInjectionBad.js:19:23:19:29 | req.url |
+| logInjectionBad.js:20:9:20:35 | username |
+| logInjectionBad.js:20:20:20:20 | q |
+| logInjectionBad.js:20:20:20:26 | q.query |
+| logInjectionBad.js:20:20:20:35 | q.query.username |
+| logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` |
+| logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` |
+| logInjectionBad.js:22:34:22:41 | username |
+| logInjectionBad.js:23:37:23:44 | username |
+| logInjectionBad.js:23:37:23:44 | username |
+| logInjectionBad.js:24:35:24:42 | username |
+| logInjectionBad.js:24:35:24:42 | username |
+| logInjectionBad.js:25:36:25:43 | username |
+| logInjectionBad.js:25:36:25:43 | username |
+| logInjectionBad.js:28:9:28:32 | exceptional return of check_u ... ername) |
+| logInjectionBad.js:28:24:28:31 | username |
+| logInjectionBad.js:29:14:29:18 | error |
+| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
+| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
+| logInjectionBad.js:30:42:30:46 | error |
+edges
+| logInjectionBad.js:19:9:19:36 | q | logInjectionBad.js:20:20:20:20 | q |
+| logInjectionBad.js:19:13:19:36 | url.par ... , true) | logInjectionBad.js:19:9:19:36 | q |
+| logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:19:13:19:36 | url.par ... , true) |
+| logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:19:13:19:36 | url.par ... , true) |
+| logInjectionBad.js:20:9:20:35 | username | logInjectionBad.js:22:34:22:41 | username |
+| logInjectionBad.js:20:9:20:35 | username | logInjectionBad.js:23:37:23:44 | username |
+| logInjectionBad.js:20:9:20:35 | username | logInjectionBad.js:23:37:23:44 | username |
+| logInjectionBad.js:20:9:20:35 | username | logInjectionBad.js:24:35:24:42 | username |
+| logInjectionBad.js:20:9:20:35 | username | logInjectionBad.js:24:35:24:42 | username |
+| logInjectionBad.js:20:9:20:35 | username | logInjectionBad.js:25:36:25:43 | username |
+| logInjectionBad.js:20:9:20:35 | username | logInjectionBad.js:25:36:25:43 | username |
+| logInjectionBad.js:20:9:20:35 | username | logInjectionBad.js:28:24:28:31 | username |
+| logInjectionBad.js:20:20:20:20 | q | logInjectionBad.js:20:20:20:26 | q.query |
+| logInjectionBad.js:20:20:20:26 | q.query | logInjectionBad.js:20:20:20:35 | q.query.username |
+| logInjectionBad.js:20:20:20:35 | q.query.username | logInjectionBad.js:20:9:20:35 | username |
+| logInjectionBad.js:22:34:22:41 | username | logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` |
+| logInjectionBad.js:22:34:22:41 | username | logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` |
+| logInjectionBad.js:28:9:28:32 | exceptional return of check_u ... ername) | logInjectionBad.js:29:14:29:18 | error |
+| logInjectionBad.js:28:24:28:31 | username | logInjectionBad.js:28:9:28:32 | exceptional return of check_u ... ername) |
+| logInjectionBad.js:29:14:29:18 | error | logInjectionBad.js:30:42:30:46 | error |
+| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
+| logInjectionBad.js:30:42:30:46 | error | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` |
+#select
+| logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:22:18:22:43 | `[INFO] ... rname}` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
+| logInjectionBad.js:23:37:23:44 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:23:37:23:44 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
+| logInjectionBad.js:24:35:24:42 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:24:35:24:42 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
+| logInjectionBad.js:25:36:25:43 | username | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:25:36:25:43 | username | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
+| logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | logInjectionBad.js:19:23:19:29 | req.url | logInjectionBad.js:30:23:30:49 | `[ERROR ... rror}"` | $@ flows to log entry. | logInjectionBad.js:19:23:19:29 | req.url | User-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.qlref b/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.qlref
new file mode 100644
index 00000000000..1837c628c33
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-117/LogInjection.qlref
@@ -0,0 +1 @@
+Security/CWE-117/LogInjection.ql
diff --git a/javascript/ql/test/query-tests/Security/CWE-117/logInjectionBad.js b/javascript/ql/test/query-tests/Security/CWE-117/logInjectionBad.js
new file mode 100644
index 00000000000..a82fdfc52ef
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-117/logInjectionBad.js
@@ -0,0 +1,32 @@
+const http = require('http');
+const hostname = '127.0.0.1';
+const port = 3000;
+const url = require('url');
+
+
+const check_username = (username) => {
+    if (username != 'name') throw `${username} is not valid`;
+    // do something
+}
+
+const my_logger = {
+    log: console.log
+}
+
+const another_logger = console.log
+
+const server = http.createServer((req, res) => {
+    let q = url.parse(req.url, true);
+    let username = q.query.username;
+
+    console.info(`[INFO] User: ${username}`); // NOT OK
+    console.info(`[INFO] User: %s`, username); // NOT OK
+    my_logger.log('[INFO] User:', username); // NOT OK
+    another_logger('[INFO] User:', username); // NOT OK
+
+    try {
+        check_username(username)
+    } catch (error) {
+        console.error(`[ERROR] Error: "${error}"`); // NOT OK
+    }
+});
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Security/CWE-117/logInjectionGood.js b/javascript/ql/test/query-tests/Security/CWE-117/logInjectionGood.js
new file mode 100644
index 00000000000..92707931399
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-117/logInjectionGood.js
@@ -0,0 +1,29 @@
+const http = require('http');
+const url = require('url');
+
+const check_username = (username) => {
+    if (username != 'name') throw `${username} is not valid`;
+}
+
+const logger = {
+    log: console.log
+}
+
+const another_logger = console.log
+
+const server = http.createServer((req, res) => {
+    let q = url.parse(req.url, true);
+
+    // GOOD: remove `\n` line from user controlled input before logging
+    let username = q.query.username.replace(/\n|\r/g, "");
+
+    console.info(`[INFO] User: ${username}`); // OK
+    console.info(`[INFO] User: %s`, username); // OK
+    logger.log('[INFO] User:', username); // OK
+    another_logger('[INFO] User:', username); // OK
+    try {
+        check_username(username)
+    } catch (error) {
+        console.error(`[ERROR] Error: "${error}"`);
+    }
+});

From afbb921c7e52103ce2b3203055f19aaaaca65d7e Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 30 Nov 2020 16:32:49 +0100
Subject: [PATCH 021/343] add change note

---
 javascript/change-notes/2020-11-30-loginjection.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 javascript/change-notes/2020-11-30-loginjection.md

diff --git a/javascript/change-notes/2020-11-30-loginjection.md b/javascript/change-notes/2020-11-30-loginjection.md
new file mode 100644
index 00000000000..dd2ecaa557a
--- /dev/null
+++ b/javascript/change-notes/2020-11-30-loginjection.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The `js/log-injection` query has been moved into non-experimental, and the precision of the query has been changed to medium.

From c50951cbae457aedd92e75e2bdd31ca2d333becc Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 1 Dec 2020 09:48:35 +0100
Subject: [PATCH 022/343] add missing qldoc

---
 .../src/semmle/javascript/security/dataflow/LogInjection.qll   | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll b/javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll
index 99239727e50..1cb2ad3bc8c 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/LogInjection.qll
@@ -4,6 +4,9 @@
 
 import javascript
 
+/**
+ * Provides default sources, sink, and sanitizers for reasoning about untrusted user input used in log entries.
+ */
 module LogInjection {
   /**
    * A data flow source for user input used in log entries.

From 79f32b0e262b41f78801862f0aa4541d5d5a0a35 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 1 Dec 2020 10:51:51 +0000
Subject: [PATCH 023/343] C++: Autoformat.

---
 .../cpp/models/implementations/StdString.qll  | 56 ++++++-------------
 1 file changed, 16 insertions(+), 40 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 2a2eba43ded..e9c942f649b 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -74,9 +74,7 @@ private class StdStringConstructor extends Constructor, TaintFunction {
  * The `std::string` function `c_str`.
  */
 private class StdStringCStr extends TaintFunction {
-  StdStringCStr() {
-    this = any(StdBasicString s).getAnInstMemberNamed("c_str")
-  }
+  StdStringCStr() { this = any(StdBasicString s).getAnInstMemberNamed("c_str") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value
@@ -89,9 +87,7 @@ private class StdStringCStr extends TaintFunction {
  * The `std::string` function `data`.
  */
 private class StdStringData extends TaintFunction {
-  StdStringData() {
-    this = any(StdBasicString s).getAnInstMemberNamed("data")
-  }
+  StdStringData() { this = any(StdBasicString s).getAnInstMemberNamed("data") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value
@@ -109,9 +105,7 @@ private class StdStringData extends TaintFunction {
  * The `std::string` function `push_back`.
  */
 private class StdStringPush extends TaintFunction {
-  StdStringPush() {
-    this = any(StdBasicString s).getAnInstMemberNamed("push_back")
-  }
+  StdStringPush() { this = any(StdBasicString s).getAnInstMemberNamed("push_back") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from parameter to qualifier
@@ -124,9 +118,7 @@ private class StdStringPush extends TaintFunction {
  * The `std::string` functions `front` and `back`.
  */
 private class StdStringFrontBack extends TaintFunction {
-  StdStringFrontBack() {
-    this = any(StdBasicString s).getAnInstMemberNamed(["front", "back"])
-  }
+  StdStringFrontBack() { this = any(StdBasicString s).getAnInstMemberNamed(["front", "back"]) }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from object to returned reference
@@ -203,9 +195,7 @@ private class StdStringAppend extends TaintFunction {
  * The standard function `std::string.assign`.
  */
 private class StdStringAssign extends TaintFunction {
-  StdStringAssign() {
-    this = any(StdBasicString s).getAnInstMemberNamed("assign")
-  }
+  StdStringAssign() { this = any(StdBasicString s).getAnInstMemberNamed("assign") }
 
   /**
    * Gets the index of a parameter to this function that is a string (or
@@ -245,9 +235,7 @@ private class StdStringAssign extends TaintFunction {
  * The standard function `std::string.copy`.
  */
 private class StdStringCopy extends TaintFunction {
-  StdStringCopy() {
-    this = any(StdBasicString s).getAnInstMemberNamed("copy")
-  }
+  StdStringCopy() { this = any(StdBasicString s).getAnInstMemberNamed("copy") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // copy(dest, num, pos)
@@ -260,9 +248,7 @@ private class StdStringCopy extends TaintFunction {
  * The standard function `std::string.substr`.
  */
 private class StdStringSubstr extends TaintFunction {
-  StdStringSubstr() {
-    this = any(StdBasicString s).getAnInstMemberNamed("substr")
-  }
+  StdStringSubstr() { this = any(StdBasicString s).getAnInstMemberNamed("substr") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // substr(pos, num)
@@ -306,9 +292,7 @@ private class StdStringSwap extends TaintFunction {
  * The `std::string` functions `at` and `operator[]`.
  */
 private class StdStringAt extends TaintFunction {
-  StdStringAt() {
-    this = any(StdBasicString s).getAnInstMemberNamed(["at", "operator[]"])
-  }
+  StdStringAt() { this = any(StdBasicString s).getAnInstMemberNamed(["at", "operator[]"]) }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to referenced return value
@@ -337,9 +321,7 @@ private class StdBasicIStream extends TemplateClass {
  * The `std::istream` function `operator>>` (defined as a member function).
  */
 private class StdIStreamIn extends DataFlowFunction, TaintFunction {
-  StdIStreamIn() {
-    this = any(StdBasicIStream s).getAnInstMemberNamed("operator>>")
-  }
+  StdIStreamIn() { this = any(StdBasicIStream s).getAnInstMemberNamed("operator>>") }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -431,9 +413,7 @@ private class StdIStreamRead extends DataFlowFunction, TaintFunction {
  * The `std::istream` function `readsome`.
  */
 private class StdIStreamReadSome extends TaintFunction {
-  StdIStreamReadSome() {
-    this = any(StdBasicIStream s).getAnInstMemberNamed("readsome")
-  }
+  StdIStreamReadSome() { this = any(StdBasicIStream s).getAnInstMemberNamed("readsome") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to first parameter
@@ -446,9 +426,7 @@ private class StdIStreamReadSome extends TaintFunction {
  * The `std::istream` function `putback`.
  */
 private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
-  StdIStreamPutBack() {
-    this = any(StdBasicIStream s).getAnInstMemberNamed("putback")
-  }
+  StdIStreamPutBack() { this = any(StdBasicIStream s).getAnInstMemberNamed("putback") }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -481,9 +459,7 @@ private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
  * The `std::istream` function `getline`.
  */
 private class StdIStreamGetLine extends DataFlowFunction, TaintFunction {
-  StdIStreamGetLine() {
-    this = any(StdBasicIStream s).getAnInstMemberNamed("getline")
-  }
+  StdIStreamGetLine() { this = any(StdBasicIStream s).getAnInstMemberNamed("getline") }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -609,7 +585,9 @@ private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
  * input parameter.
  */
 private class StdStringStreamConstructor extends Constructor, TaintFunction {
-  StdStringStreamConstructor() { this = any(StdBasicStringStream s).getAnInstantiation().getAMember() }
+  StdStringStreamConstructor() {
+    this = any(StdBasicStringStream s).getAnInstantiation().getAMember()
+  }
 
   /**
    * Gets the index of a parameter to this function that is a string.
@@ -633,9 +611,7 @@ private class StdStringStreamConstructor extends Constructor, TaintFunction {
  * The `std::stringstream` function `str`.
  */
 private class StdStringStreamStr extends TaintFunction {
-  StdStringStreamStr() {
-    this = any(StdBasicStringStream s).getAnInstMemberNamed("str")
-  }
+  StdStringStreamStr() { this = any(StdBasicStringStream s).getAnInstMemberNamed("str") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to return value (if any)

From a9bbe1d0879e5fcee1e06af6f4809b464e48f026 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 21 Dec 2020 15:59:45 +0100
Subject: [PATCH 024/343] Python: Test Django un-routed class-based route
 handler

---
 .../library-tests/frameworks/django-v2-v3/routing_test.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
index 5fea4ccc046..4564ebd0aa9 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
@@ -107,3 +107,11 @@ def deprecated(request):  # $routeHandler
 urlpatterns = [
     url(r"^deprecated/", deprecated),  # $routeSetup="^deprecated/"
 ]
+
+
+class PossiblyNotRouted(View):
+    # Even if our analysis can't find a route-setup for this class, we should still
+    # consider it to be a handle incoming HTTP requests
+
+    def get(self, request, possibly_not_routed=42):  # $ MISSING: routeHandler routedParameter=possibly_not_routed
+        return HttpResponse('PossiblyNotRouted get: {}'.format(possibly_not_routed))  # $HttpResponse

From 004ff38e229774309419a1fe81c7b3cd26095f9e Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 21 Dec 2020 17:20:19 +0100
Subject: [PATCH 025/343] Python: Add separate RequestHandler concept

Since I really want to use our existing infrastructure to model that we can
recognize something as a request handler without it having a route, we need this
as a separate concept. All tests have been adjusted.

The early modeling was based on flask, where all request-handling is based on
handling requests from a specific route. But with the standard library handling
and handlers without routes, the naming had to change.
---
 python/ql/src/semmle/python/Concepts.qll      | 55 ++++++++++++++++++-
 .../src/semmle/python/frameworks/Django.qll   | 18 +++---
 .../ql/src/semmle/python/frameworks/Flask.qll | 10 ++--
 .../frameworks/django-v1/routing_test.py      | 20 +++----
 .../frameworks/django-v2-v3/routing_test.py   | 30 +++++-----
 .../frameworks/django-v2-v3/taint_test.py     |  2 +-
 .../frameworks/django-v2-v3/testapp/views.py  | 14 ++---
 .../frameworks/flask/old_test.py              | 20 +++----
 .../frameworks/flask/response_test.py         | 40 +++++++-------
 .../frameworks/flask/routing_test.py          |  8 +--
 .../frameworks/flask/taint_test.py            | 16 +++---
 .../frameworks/stdlib/http_server.py          |  4 +-
 .../test/experimental/meta/ConceptsTest.qll   | 17 +++---
 13 files changed, 152 insertions(+), 102 deletions(-)

diff --git a/python/ql/src/semmle/python/Concepts.qll b/python/ql/src/semmle/python/Concepts.qll
index 9b61d6a6fae..9a30ebf4871 100644
--- a/python/ql/src/semmle/python/Concepts.qll
+++ b/python/ql/src/semmle/python/Concepts.qll
@@ -314,7 +314,7 @@ module HTTP {
       string getUrlPattern() { result = range.getUrlPattern() }
 
       /** Gets a function that will handle incoming requests for this route, if any. */
-      Function getARouteHandler() { result = range.getARouteHandler() }
+      Function getARequestHandler() { result = range.getARequestHandler() }
 
       /**
        * Gets a parameter that will receive parts of the url when handling incoming
@@ -344,7 +344,7 @@ module HTTP {
         }
 
         /** Gets a function that will handle incoming requests for this route, if any. */
-        abstract Function getARouteHandler();
+        abstract Function getARequestHandler();
 
         /**
          * Gets a parameter that will receive parts of the url when handling incoming
@@ -354,8 +354,57 @@ module HTTP {
       }
     }
 
+    /**
+     * A function that will handle incoming HTTP requests.
+     *
+     * Extend this class to refine existing API models. If you want to model new APIs,
+     * extend `RequestHandler::Range` instead.
+     */
+    class RequestHandler extends Function {
+      RequestHandler::Range range;
+
+      RequestHandler() { this = range }
+
+      /**
+       * Gets a parameter that could receive parts of the url when handling incoming
+       * requests, if any. These automatically become a `RemoteFlowSource`.
+       */
+      Parameter getARoutedParameter() { result = range.getARoutedParameter() }
+    }
+
+    /** Provides a class for modeling new HTTP request handlers. */
+    module RequestHandler {
+      /**
+       * A function that will handle incoming HTTP requests.
+       *
+       * Extend this class to model new APIs. If you want to refine existing API models,
+       * extend `RequestHandler` instead.
+       *
+       * Only extend this class if you can't provide a `RouteSetup`, since we handle that case automatically.
+       */
+      abstract class Range extends Function {
+        /**
+         * Gets a parameter that could receive parts of the url when handling incoming
+         * requests, if any. These automatically become a `RemoteFlowSource`.
+         */
+        abstract Parameter getARoutedParameter();
+      }
+    }
+
+    private class RequestHandlerFromRouteSetup extends RequestHandler::Range {
+      RouteSetup rs;
+
+      RequestHandlerFromRouteSetup() { this = rs.getARequestHandler() }
+
+      override Parameter getARoutedParameter() {
+        result = rs.getARoutedParameter() and
+        result in [this.getArg(_), this.getArgByName(_)]
+      }
+    }
+
+    /** A parameter that will receive parts of the url when handling an incoming request. */
     private class RoutedParameter extends RemoteFlowSource::Range, DataFlow::ParameterNode {
-      RoutedParameter() { this.getParameter() = any(RouteSetup setup).getARoutedParameter() }
+      RoutedParameter() { this.getParameter() = any(RequestHandler setup).getARoutedParameter() }
 
       override string getSourceType() { result = "RoutedParameter" }
     }
diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index c3c23f3f5df..f4cbe3d9ea5 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1676,7 +1676,7 @@ private module Django {
     DjangoViewClassDef() { this.getABase() = django::views::generic::View::subclassRef().asExpr() }
 
     /** Gets a function that could handle incoming requests, if any. */
-    DjangoRouteHandler getARouteHandler() {
+    DjangoRouteHandler getARequestHandler() {
       // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
       // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
       result = this.getAMethod() and
@@ -1725,7 +1725,7 @@ private module Django {
     DjangoRouteHandler() {
       exists(djangoRouteHandlerFunctionTracker(this))
       or
-      any(DjangoViewClassDef vc).getARouteHandler() = this
+      any(DjangoViewClassDef vc).getARequestHandler() = this
     }
 
     /** Gets the index of the request parameter. */
@@ -1746,12 +1746,12 @@ private module Django {
     /** Gets the data-flow node that is used as the argument for the view handler. */
     abstract DataFlow::Node getViewArg();
 
-    final override DjangoRouteHandler getARouteHandler() {
+    final override DjangoRouteHandler getARequestHandler() {
       djangoRouteHandlerFunctionTracker(result) = getViewArg()
       or
       exists(DjangoViewClassDef vc |
         getViewArg() = vc.asViewResult() and
-        result = vc.getARouteHandler()
+        result = vc.getARequestHandler()
       )
     }
   }
@@ -1787,14 +1787,14 @@ private module Django {
       // If we don't know the URL pattern, we simply mark all parameters as a routed
       // parameter. This should give us more RemoteFlowSources but could also lead to
       // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
-      exists(DjangoRouteHandler routeHandler | routeHandler = this.getARouteHandler() |
+      exists(DjangoRouteHandler routeHandler | routeHandler = this.getARequestHandler() |
         not exists(this.getUrlPattern()) and
         result in [routeHandler.getArg(_), routeHandler.getArgByName(_)] and
         not result = any(int i | i <= routeHandler.getRequestParamIndex() | routeHandler.getArg(i))
       )
       or
       exists(string name |
-        result = this.getARouteHandler().getArgByName(name) and
+        result = this.getARequestHandler().getArgByName(name) and
         exists(string match |
           match = this.getUrlPattern().regexpFind(pathRoutedParameterRegex(), _, _) and
           name = match.regexpCapture(pathRoutedParameterRegex(), 2)
@@ -1809,14 +1809,14 @@ private module Django {
       // If we don't know the URL pattern, we simply mark all parameters as a routed
       // parameter. This should give us more RemoteFlowSources but could also lead to
       // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
-      exists(DjangoRouteHandler routeHandler | routeHandler = this.getARouteHandler() |
+      exists(DjangoRouteHandler routeHandler | routeHandler = this.getARequestHandler() |
         not exists(this.getUrlPattern()) and
         result in [routeHandler.getArg(_), routeHandler.getArgByName(_)] and
         not result = any(int i | i <= routeHandler.getRequestParamIndex() | routeHandler.getArg(i))
       )
       or
       exists(DjangoRouteHandler routeHandler, DjangoRouteRegex regex |
-        routeHandler = this.getARouteHandler() and
+        routeHandler = this.getARequestHandler() and
         regex.getRouteSetup() = this
       |
         // either using named capture groups (passed as keyword arguments) or using
@@ -1891,7 +1891,7 @@ private module Django {
   class DjangoRouteHandlerRequestParam extends django::http::request::HttpRequest::InstanceSource,
     RemoteFlowSource::Range, DataFlow::ParameterNode {
     DjangoRouteHandlerRequestParam() {
-      this.getParameter() = any(DjangoRouteSetup setup).getARouteHandler().getRequestParam()
+      this.getParameter() = any(DjangoRouteSetup setup).getARequestHandler().getRequestParam()
     }
 
     override string getSourceType() { result = "django.http.request.HttpRequest" }
diff --git a/python/ql/src/semmle/python/frameworks/Flask.qll b/python/ql/src/semmle/python/frameworks/Flask.qll
index 3a420312be2..fa929e3d02b 100644
--- a/python/ql/src/semmle/python/frameworks/Flask.qll
+++ b/python/ql/src/semmle/python/frameworks/Flask.qll
@@ -275,10 +275,10 @@ private module FlaskModel {
       // parameter. This should give us more RemoteFlowSources but could also lead to
       // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
       not exists(this.getUrlPattern()) and
-      result = this.getARouteHandler().getArgByName(_)
+      result = this.getARequestHandler().getArgByName(_)
       or
       exists(string name |
-        result = this.getARouteHandler().getArgByName(name) and
+        result = this.getARequestHandler().getArgByName(name) and
         exists(string match |
           match = this.getUrlPattern().regexpFind(werkzeug_rule_re(), _, _) and
           name = match.regexpCapture(werkzeug_rule_re(), 4)
@@ -301,7 +301,7 @@ private module FlaskModel {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("rule")]
     }
 
-    override Function getARouteHandler() { result.getADecorator().getAFlowNode() = node }
+    override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
   }
 
   /**
@@ -318,7 +318,7 @@ private module FlaskModel {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("rule")]
     }
 
-    override Function getARouteHandler() {
+    override Function getARequestHandler() {
       exists(DataFlow::Node view_func_arg, DataFlow::Node func_src |
         view_func_arg.asCfgNode() in [node.getArg(2), node.getArgByName("view_func")] and
         DataFlow::localFlow(func_src, view_func_arg) and
@@ -484,7 +484,7 @@ private module FlaskModel {
   private class FlaskRouteHandlerReturn extends HTTP::Server::HttpResponse::Range, DataFlow::CfgNode {
     FlaskRouteHandlerReturn() {
       exists(Function routeHandler |
-        routeHandler = any(FlaskRouteSetup rs).getARouteHandler() and
+        routeHandler = any(FlaskRouteSetup rs).getARequestHandler() and
         node = routeHandler.getAReturnValueFlowNode()
       )
     }
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py
index 3388d97b04e..f0d51577e2e 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py
@@ -4,19 +4,19 @@ from django.http.response import HttpResponse
 from django.views.generic import View
 
 
-def url_match_xss(request, foo, bar, no_taint=None):  # $routeHandler routedParameter=foo routedParameter=bar
+def url_match_xss(request, foo, bar, no_taint=None):  # $requestHandler routedParameter=foo routedParameter=bar
     return HttpResponse('url_match_xss: {} {}'.format(foo, bar))  # $HttpResponse
 
 
-def get_params_xss(request):  # $routeHandler
+def get_params_xss(request):  # $requestHandler
     return HttpResponse(request.GET.get("untrusted"))  # $HttpResponse
 
 
-def post_params_xss(request):  # $routeHandler
+def post_params_xss(request):  # $requestHandler
     return HttpResponse(request.POST.get("untrusted"))  # $HttpResponse
 
 
-def http_resp_write(request):  # $routeHandler
+def http_resp_write(request):  # $requestHandler
     rsp = HttpResponse()  # $HttpResponse
     rsp.write(request.GET.get("untrusted"))  # $HttpResponse
     return rsp
@@ -26,22 +26,22 @@ class Foo(object):
     # Note: since Foo is used as the super type in a class view, it will be able to handle requests.
 
 
-    def post(self, request, untrusted):  # $ MISSING: routeHandler routedParameter=untrusted
+    def post(self, request, untrusted):  # $ MISSING: requestHandler routedParameter=untrusted
         return HttpResponse('Foo post: {}'.format(untrusted))  # $HttpResponse
 
 
 class ClassView(View, Foo):
 
-    def get(self, request, untrusted):  # $ routeHandler routedParameter=untrusted
+    def get(self, request, untrusted):  # $ requestHandler routedParameter=untrusted
         return HttpResponse('ClassView get: {}'.format(untrusted))  # $HttpResponse
 
 
-def show_articles(request, page_number=1):  # $routeHandler routedParameter=page_number
+def show_articles(request, page_number=1):  # $requestHandler routedParameter=page_number
     page_number = int(page_number)
     return HttpResponse('articles page: {}'.format(page_number))  # $HttpResponse
 
 
-def xxs_positional_arg(request, arg0, arg1, no_taint=None):  # $routeHandler routedParameter=arg0 routedParameter=arg1
+def xxs_positional_arg(request, arg0, arg1, no_taint=None):  # $requestHandler routedParameter=arg0 routedParameter=arg1
     return HttpResponse('xxs_positional_arg: {} {}'.format(arg0, arg1))  # $HttpResponse
 
 
@@ -62,7 +62,7 @@ urlpatterns = [
 ################################################################################
 # Using patterns() for routing
 
-def show_user(request, username):  # $routeHandler routedParameter=username
+def show_user(request, username):  # $requestHandler routedParameter=username
     return HttpResponse('show_user {}'.format(username))  # $HttpResponse
 
 
@@ -71,7 +71,7 @@ urlpatterns = patterns(url(r"^users/(?P<username>[^/]+)", show_user))  # $routeS
 ################################################################################
 # Show we understand the keyword arguments to django.conf.urls.url
 
-def kw_args(request):  # $routeHandler
+def kw_args(request):  # $requestHandler
     return HttpResponse('kw_args')  # $HttpResponse
 
 urlpatterns = [
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
index 4564ebd0aa9..9b28f7ffeb8 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
@@ -4,19 +4,19 @@ from django.http import HttpResponse, HttpResponseRedirect, JsonResponse, HttpRe
 from django.views import View
 
 
-def url_match_xss(request, foo, bar, no_taint=None):  # $routeHandler routedParameter=foo routedParameter=bar
+def url_match_xss(request, foo, bar, no_taint=None):  # $requestHandler routedParameter=foo routedParameter=bar
     return HttpResponse('url_match_xss: {} {}'.format(foo, bar))  # $HttpResponse
 
 
-def get_params_xss(request):  # $routeHandler
+def get_params_xss(request):  # $requestHandler
     return HttpResponse(request.GET.get("untrusted"))  # $HttpResponse
 
 
-def post_params_xss(request):  # $routeHandler
+def post_params_xss(request):  # $requestHandler
     return HttpResponse(request.POST.get("untrusted"))  # $HttpResponse
 
 
-def http_resp_write(request):  # $routeHandler
+def http_resp_write(request):  # $requestHandler
     rsp = HttpResponse()  # $HttpResponse
     rsp.write(request.GET.get("untrusted"))  # $HttpResponse
     return rsp
@@ -26,22 +26,22 @@ class Foo(object):
     # Note: since Foo is used as the super type in a class view, it will be able to handle requests.
 
 
-    def post(self, request, untrusted):  # $ MISSING: routeHandler routedParameter=untrusted
+    def post(self, request, untrusted):  # $ MISSING: requestHandler routedParameter=untrusted
         return HttpResponse('Foo post: {}'.format(untrusted))  # $HttpResponse
 
 
 class ClassView(View, Foo):
 
-    def get(self, request, untrusted):  # $ routeHandler routedParameter=untrusted
+    def get(self, request, untrusted):  # $ requestHandler routedParameter=untrusted
         return HttpResponse('ClassView get: {}'.format(untrusted))  # $HttpResponse
 
 
-def show_articles(request, page_number=1):  # $routeHandler routedParameter=page_number
+def show_articles(request, page_number=1):  # $requestHandler routedParameter=page_number
     page_number = int(page_number)
     return HttpResponse('articles page: {}'.format(page_number))  # $HttpResponse
 
 
-def xxs_positional_arg(request, arg0, arg1, no_taint=None):  # $routeHandler routedParameter=arg0 routedParameter=arg1
+def xxs_positional_arg(request, arg0, arg1, no_taint=None):  # $requestHandler routedParameter=arg0 routedParameter=arg1
     return HttpResponse('xxs_positional_arg: {} {}'.format(arg0, arg1))  # $HttpResponse
 
 
@@ -62,7 +62,7 @@ urlpatterns = [
 
 # Show we understand the keyword arguments to django.urls.re_path
 
-def re_path_kwargs(request):  # $routeHandler
+def re_path_kwargs(request):  # $requestHandler
     return HttpResponse('re_path_kwargs')  # $HttpResponse
 
 
@@ -75,16 +75,16 @@ urlpatterns = [
 ################################################################################
 
 # saying page_number is an externally controlled *string* is a bit strange, when we have an int converter :O
-def page_number(request, page_number=1):  # $routeHandler routedParameter=page_number
+def page_number(request, page_number=1):  # $requestHandler routedParameter=page_number
     return HttpResponse('page_number: {}'.format(page_number))  # $HttpResponse
 
-def foo_bar_baz(request, foo, bar, baz):  # $routeHandler routedParameter=foo routedParameter=bar routedParameter=baz
+def foo_bar_baz(request, foo, bar, baz):  # $requestHandler routedParameter=foo routedParameter=bar routedParameter=baz
     return HttpResponse('foo_bar_baz: {} {} {}'.format(foo, bar, baz))  # $HttpResponse
 
-def path_kwargs(request, foo, bar):  # $routeHandler routedParameter=foo routedParameter=bar
+def path_kwargs(request, foo, bar):  # $requestHandler routedParameter=foo routedParameter=bar
     return HttpResponse('path_kwargs: {} {} {}'.format(foo, bar))  # $HttpResponse
 
-def not_valid_identifier(request):  # $routeHandler
+def not_valid_identifier(request):  # $requestHandler
     return HttpResponse('<foo!>')  # $HttpResponse
 
 urlpatterns = [
@@ -101,7 +101,7 @@ urlpatterns = [
 # This version 1.x way of defining urls is deprecated in Django 3.1, but still works
 from django.conf.urls import url
 
-def deprecated(request):  # $routeHandler
+def deprecated(request):  # $requestHandler
     return HttpResponse('deprecated')  # $HttpResponse
 
 urlpatterns = [
@@ -113,5 +113,5 @@ class PossiblyNotRouted(View):
     # Even if our analysis can't find a route-setup for this class, we should still
     # consider it to be a handle incoming HTTP requests
 
-    def get(self, request, possibly_not_routed=42):  # $ MISSING: routeHandler routedParameter=possibly_not_routed
+    def get(self, request, possibly_not_routed=42):  # $ MISSING: requestHandler routedParameter=possibly_not_routed
         return HttpResponse('PossiblyNotRouted get: {}'.format(possibly_not_routed))  # $HttpResponse
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py
index 6e0529f0fc3..a0db86f2961 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py
@@ -3,7 +3,7 @@ from django.urls import path
 from django.http import HttpRequest
 
 
-def test_taint(request: HttpRequest, foo, bar, baz=None):  # $routeHandler routedParameter=foo routedParameter=bar
+def test_taint(request: HttpRequest, foo, bar, baz=None):  # $requestHandler routedParameter=foo routedParameter=bar
     ensure_tainted(foo, bar)
     ensure_not_tainted(baz)
 
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
index 86517930d06..ea8c392f3d4 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
@@ -3,31 +3,31 @@ from django.views import View
 from django.views.decorators.csrf import csrf_exempt
 
 
-def foo(request: HttpRequest):  # $routeHandler
+def foo(request: HttpRequest):  # $requestHandler
     return HttpResponse("foo")  # $HttpResponse
 
 
-def bar_baz(request: HttpRequest):  # $routeHandler
+def bar_baz(request: HttpRequest):  # $requestHandler
     return HttpResponse("bar_baz")  # $HttpResponse
 
 
-def deprecated(request: HttpRequest):  # $routeHandler
+def deprecated(request: HttpRequest):  # $requestHandler
     return HttpResponse("deprecated")  # $HttpResponse
 
 
 class MyBasicViewHandler(View):
-    def get(self, request: HttpRequest): # $ routeHandler
+    def get(self, request: HttpRequest): # $ requestHandler
         return HttpResponse("MyViewHandler: GET") # $ HttpResponse
 
-    def post(self, request: HttpRequest): # $ routeHandler
+    def post(self, request: HttpRequest): # $ requestHandler
         return HttpResponse("MyViewHandler: POST") # $ HttpResponse
 
 
 class MyCustomViewBaseClass(View):
-    def post(self, request: HttpRequest): # $ MISSING: routeHandler
+    def post(self, request: HttpRequest): # $ MISSING: requestHandler
         return HttpResponse("MyCustomViewBaseClass: POST") # $ HttpResponse
 
 
 class MyViewHandlerWithCustomInheritance(MyCustomViewBaseClass):
-    def get(self, request: HttpRequest): # $ routeHandler
+    def get(self, request: HttpRequest): # $ requestHandler
         return HttpResponse("MyViewHandlerWithCustomInheritance: GET") # $ HttpResponse
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/old_test.py b/python/ql/test/experimental/library-tests/frameworks/flask/old_test.py
index 5609e80006f..4e251f6f306 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/old_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/old_test.py
@@ -4,14 +4,14 @@ from flask import Flask, request, make_response
 app = Flask(__name__)
 
 @app.route("/")  # $routeSetup="/"
-def hello_world():  # $routeHandler
+def hello_world():  # $requestHandler
     return "Hello World!"  # $HttpResponse
 
 from flask.views import MethodView
 
 class MyView(MethodView):
 
-    def get(self, user_id): # $ MISSING: routeHandler
+    def get(self, user_id): # $ MISSING: requestHandler
         if user_id is None:
             # return a list of users
             pass
@@ -25,42 +25,42 @@ app.add_url_rule('/the/', defaults={'user_id': None},  # $routeSetup="/the/"
                  view_func=the_view, methods=['GET',])
 
 @app.route("/dangerous")  # $routeSetup="/dangerous"
-def dangerous():  # $routeHandler
+def dangerous():  # $requestHandler
     return request.args.get('payload')  # $HttpResponse
 
 @app.route("/dangerous-with-cfg-split")  # $routeSetup="/dangerous-with-cfg-split"
-def dangerous2():  # $routeHandler
+def dangerous2():  # $requestHandler
     x = request.form['param0']
     if request.method == "POST":
         return request.form['param1']  # $HttpResponse
     return None  # $ SPURIOUS: HttpResponse
 
 @app.route("/unsafe")  # $routeSetup="/unsafe"
-def unsafe():  # $routeHandler
+def unsafe():  # $requestHandler
     first_name = request.args.get('name', '')
     return make_response("Your name is " + first_name)  # $HttpResponse
 
 @app.route("/safe")  # $routeSetup="/safe"
-def safe():  # $routeHandler
+def safe():  # $requestHandler
     first_name = request.args.get('name', '')
     return make_response("Your name is " + escape(first_name))  # $HttpResponse
 
 @app.route("/hello/<name>")  # $routeSetup="/hello/<name>"
-def hello(name):  # $routeHandler routedParameter=name
+def hello(name):  # $requestHandler routedParameter=name
     return make_response("Your name is " + name)  # $HttpResponse
 
 @app.route("/foo/<path:subpath>")  # $routeSetup="/foo/<path:subpath>"
-def foo(subpath):  # $routeHandler routedParameter=subpath
+def foo(subpath):  # $requestHandler routedParameter=subpath
     return make_response("The subpath is " + subpath)  # $HttpResponse
 
 @app.route("/multiple/")  # $routeSetup="/multiple/"
 @app.route("/multiple/foo/<foo>")  # $routeSetup="/multiple/foo/<foo>"
 @app.route("/multiple/bar/<bar>")  # $routeSetup="/multiple/bar/<bar>"
-def multiple(foo=None, bar=None):  # $routeHandler routedParameter=foo routedParameter=bar
+def multiple(foo=None, bar=None):  # $requestHandler routedParameter=foo routedParameter=bar
     return make_response("foo={!r} bar={!r}".format(foo, bar))  # $HttpResponse
 
 @app.route("/complex/<string(length=2):lang_code>")  # $routeSetup="/complex/<string(length=2):lang_code>"
-def complex(lang_code):  # $routeHandler routedParameter=lang_code
+def complex(lang_code):  # $requestHandler routedParameter=lang_code
     return make_response("lang_code {}".format(lang_code))  # $HttpResponse
 
 if __name__ == "__main__":
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/response_test.py b/python/ql/test/experimental/library-tests/frameworks/flask/response_test.py
index ce57b5f01f0..b067f173882 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/response_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/response_test.py
@@ -6,12 +6,12 @@ app = Flask(__name__)
 
 
 @app.route("/html1")  # $routeSetup="/html1"
-def html1():  # $routeHandler
+def html1():  # $requestHandler
     return "<h1>hello</h1>"  # $HttpResponse mimetype=text/html responseBody="<h1>hello</h1>"
 
 
 @app.route("/html2")  # $routeSetup="/html2"
-def html2():  # $routeHandler
+def html2():  # $requestHandler
     # note that response saved in a variable intentionally -- we wan the annotations to
     # show that we recognize the response creation, and not the return (hopefully). (and
     # do the same in the following of the file)
@@ -20,7 +20,7 @@ def html2():  # $routeHandler
 
 
 @app.route("/html3")  # $routeSetup="/html3"
-def html3():  # $routeHandler
+def html3():  # $requestHandler
     resp = app.make_response("<h1>hello</h1>")  # $HttpResponse mimetype=text/html responseBody="<h1>hello</h1>"
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
 
@@ -30,13 +30,13 @@ def html3():  # $routeHandler
 
 
 @app.route("/html4")  # $routeSetup="/html4"
-def html4():  # $routeHandler
+def html4():  # $requestHandler
     resp = Response("<h1>hello</h1>")  # $HttpResponse mimetype=text/html responseBody="<h1>hello</h1>"
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
 
 
 @app.route("/html5")  # $routeSetup="/html5"
-def html5():  # $routeHandler
+def html5():  # $requestHandler
     # note: flask.Flask.response_class is set to `flask.Response` by default.
     # it can be overridden, but we don't try to handle that right now.
     resp = Flask.response_class("<h1>hello</h1>")  # $HttpResponse mimetype=text/html responseBody="<h1>hello</h1>"
@@ -44,7 +44,7 @@ def html5():  # $routeHandler
 
 
 @app.route("/html6")  # $routeSetup="/html6"
-def html6():  # $routeHandler
+def html6():  # $requestHandler
     # note: app.response_class (flask.Flask.response_class) is set to `flask.Response` by default.
     # it can be overridden, but we don't try to handle that right now.
     resp = app.response_class("<h1>hello</h1>")  # $HttpResponse mimetype=text/html responseBody="<h1>hello</h1>"
@@ -52,14 +52,14 @@ def html6():  # $routeHandler
 
 
 @app.route("/html7")  # $routeSetup="/html7"
-def html7():  # $routeHandler
+def html7():  # $requestHandler
     resp = make_response()  # $HttpResponse mimetype=text/html
     resp.set_data("<h1>hello</h1>")  # $ MISSING: responseBody="<h1>hello</h1>"
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
 
 
 @app.route("/jsonify")  # $routeSetup="/jsonify"
-def jsonify_route():  # $routeHandler
+def jsonify_route():  # $requestHandler
     data = {"foo": "bar"}
     resp = jsonify(data)  # $ MISSING: HttpResponse mimetype=application/json responseBody=data
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
@@ -69,7 +69,7 @@ def jsonify_route():  # $routeHandler
 ################################################################################
 
 @app.route("/tricky-return1")  # $routeSetup="/tricky-return1"
-def tricky_return1():  # $routeHandler
+def tricky_return1():  # $requestHandler
     if "raw" in request.args:
         resp = "<h1>hellu</h1>"
     else:
@@ -83,7 +83,7 @@ def helper():
         return make_response("<h1>hello</h1>")  # $HttpResponse mimetype=text/html responseBody="<h1>hello</h1>"
 
 @app.route("/tricky-return2")  # $routeSetup="/tricky-return2"
-def tricky_return2():  # $routeHandler
+def tricky_return2():  # $requestHandler
     resp = helper()
     return resp  # $HttpResponse mimetype=text/html responseBody=resp
 
@@ -94,14 +94,14 @@ def tricky_return2():  # $routeHandler
 
 
 @app.route("/content-type/response-modification1")  # $routeSetup="/content-type/response-modification1"
-def response_modification1():  # $routeHandler
+def response_modification1():  # $requestHandler
     resp = make_response("<h1>hello</h1>")  # $HttpResponse mimetype=text/html responseBody="<h1>hello</h1>"
     resp.content_type = "text/plain"  # $ MISSING: HttpResponse mimetype=text/plain
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
 
 
 @app.route("/content-type/response-modification2")  # $routeSetup="/content-type/response-modification2"
-def response_modification2():  # $routeHandler
+def response_modification2():  # $requestHandler
     resp = make_response("<h1>hello</h1>")  # $HttpResponse mimetype=text/html responseBody="<h1>hello</h1>"
     resp.headers["content-type"] = "text/plain"  # $ MISSING: HttpResponse mimetype=text/plain
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
@@ -112,33 +112,33 @@ def response_modification2():  # $routeHandler
 
 
 @app.route("/content-type/Response1")  # $routeSetup="/content-type/Response1"
-def Response1():  # $routeHandler
+def Response1():  # $requestHandler
     resp = Response("<h1>hello</h1>", mimetype="text/plain")  # $HttpResponse mimetype=text/plain responseBody="<h1>hello</h1>"
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
 
 
 @app.route("/content-type/Response2")  # $routeSetup="/content-type/Response2"
-def Response2():  # $routeHandler
+def Response2():  # $requestHandler
     resp = Response("<h1>hello</h1>", content_type="text/plain; charset=utf-8")  # $HttpResponse mimetype=text/plain responseBody="<h1>hello</h1>"
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
 
 
 @app.route("/content-type/Response3")  # $routeSetup="/content-type/Response3"
-def Response3():  # $routeHandler
+def Response3():  # $requestHandler
     # content_type argument takes priority (and result is text/plain)
     resp = Response("<h1>hello</h1>", content_type="text/plain; charset=utf-8", mimetype="text/html")  # $HttpResponse mimetype=text/plain responseBody="<h1>hello</h1>"
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
 
 
 @app.route("/content-type/Response4")  # $routeSetup="/content-type/Response4"
-def Response4():  # $routeHandler
+def Response4():  # $requestHandler
     # note: capitalization of Content-Type does not matter
     resp = Response("<h1>hello</h1>", headers={"Content-TYPE": "text/plain"})  # $HttpResponse responseBody="<h1>hello</h1>" SPURIOUS: mimetype=text/html MISSING: mimetype=text/plain
     return resp  # $ SPURIOUS: HttpResponse mimetype=text/html responseBody=resp
 
 
 @app.route("/content-type/Response5")  # $routeSetup="/content-type/Response5"
-def Response5():  # $routeHandler
+def Response5():  # $requestHandler
     # content_type argument takes priority (and result is text/plain)
     # note: capitalization of Content-Type does not matter
     resp = Response("<h1>hello</h1>", headers={"Content-TYPE": "text/html"}, content_type="text/plain; charset=utf-8")  # $HttpResponse mimetype=text/plain responseBody="<h1>hello</h1>"
@@ -146,7 +146,7 @@ def Response5():  # $routeHandler
 
 
 @app.route("/content-type/Response6")  # $routeSetup="/content-type/Response6"
-def Response6():  # $routeHandler
+def Response6():  # $requestHandler
     # mimetype argument takes priority over header (and result is text/plain)
     # note: capitalization of Content-Type does not matter
     resp = Response("<h1>hello</h1>", headers={"Content-TYPE": "text/html"}, mimetype="text/plain")  # $HttpResponse mimetype=text/plain responseBody="<h1>hello</h1>"
@@ -154,7 +154,7 @@ def Response6():  # $routeHandler
 
 
 @app.route("/content-type/Flask-response-class")  # $routeSetup="/content-type/Flask-response-class"
-def Flask_response_class():  # $routeHandler
+def Flask_response_class():  # $requestHandler
     # note: flask.Flask.response_class is set to `flask.Response` by default.
     # it can be overridden, but we don't try to handle that right now.
     resp = Flask.response_class("<h1>hello</h1>", mimetype="text/plain")  # $HttpResponse mimetype=text/plain responseBody="<h1>hello</h1>"
@@ -162,7 +162,7 @@ def Flask_response_class():  # $routeHandler
 
 
 @app.route("/content-type/app-response-class")  # $routeSetup="/content-type/app-response-class"
-def app_response_class():  # $routeHandler
+def app_response_class():  # $requestHandler
     # note: app.response_class (flask.Flask.response_class) is set to `flask.Response` by default.
     # it can be overridden, but we don't try to handle that right now.
     resp = app.response_class("<h1>hello</h1>", mimetype="text/plain")  # $HttpResponse mimetype=text/plain responseBody="<h1>hello</h1>"
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
index a5e40b5c123..1a6028e8026 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
@@ -6,24 +6,24 @@ app = Flask(__name__)
 
 SOME_ROUTE = "/some/route"
 @app.route(SOME_ROUTE) # $routeSetup="/some/route"
-def some_route():  # $routeHandler
+def some_route():  # $requestHandler
     return make_response("some_route")  # $HttpResponse
 
 
-def index():  # $routeHandler
+def index():  # $requestHandler
     return make_response("index")  # $HttpResponse
 app.add_url_rule('/index', 'index', index)  # $routeSetup="/index"
 
 
 # We don't support this yet, and I think that's OK
-def later_set():  # $ MISSING: routeHandler
+def later_set():  # $ MISSING: requestHandler
     return make_response("later_set")  # $HttpResponse
 app.add_url_rule('/later-set', 'later_set', view_func=None)  # $routeSetup="/later-set"
 app.view_functions['later_set'] = later_set
 
 
 @app.route(UNKNOWN_ROUTE) # $routeSetup
-def unkown_route(foo, bar):  # $routeHandler routedParameter=foo routedParameter=bar
+def unkown_route(foo, bar):  # $requestHandler routedParameter=foo routedParameter=bar
     return make_response("unkown_route")  # $HttpResponse
 
 
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/taint_test.py b/python/ql/test/experimental/library-tests/frameworks/flask/taint_test.py
index 58335997875..31c0c7e6121 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/taint_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/taint_test.py
@@ -2,7 +2,7 @@ from flask import Flask, request
 app = Flask(__name__)
 
 @app.route("/test_taint/<name>/<int:number>")  # $routeSetup="/test_taint/<name>/<int:number>"
-def test_taint(name = "World!", number="0", foo="foo"):  # $routeHandler routedParameter=name routedParameter=number
+def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler routedParameter=name routedParameter=number
     ensure_tainted(name, number)
     ensure_not_tainted(foo)
 
@@ -192,7 +192,7 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $routeHandler routedP
 
 
 @app.route("/debug/<foo>/<bar>", methods=['GET']) # $routeSetup="/debug/<foo>/<bar>"
-def debug(foo, bar):  # $routeHandler routedParameter=foo routedParameter=bar
+def debug(foo, bar):  # $requestHandler routedParameter=foo routedParameter=bar
     print("request.view_args", request.view_args)
 
     print("request.headers {!r}".format(request.headers))
@@ -203,7 +203,7 @@ def debug(foo, bar):  # $routeHandler routedParameter=foo routedParameter=bar
     return 'ok'  # $HttpResponse
 
 @app.route("/stream", methods=['POST'])  # $routeSetup="/stream"
-def stream():  # $routeHandler
+def stream():  # $requestHandler
     print(request.path)
     s = request.stream
     print(s)
@@ -213,7 +213,7 @@ def stream():  # $routeHandler
     return 'ok'  # $HttpResponse
 
 @app.route("/input_stream", methods=['POST'])  # $routeSetup="/input_stream"
-def input_stream():  # $routeHandler
+def input_stream():  # $requestHandler
     print(request.path)
     s = request.input_stream
     print(s)
@@ -224,14 +224,14 @@ def input_stream():  # $routeHandler
     return 'ok'  # $HttpResponse
 
 @app.route("/form", methods=['POST'])  # $routeSetup="/form"
-def form():  # $routeHandler
+def form():  # $requestHandler
     print(request.path)
     print("request.form", request.form)
 
     return 'ok'  # $HttpResponse
 
 @app.route("/cache_control", methods=['POST'])  # $routeSetup="/cache_control"
-def cache_control():  # $routeHandler
+def cache_control():  # $requestHandler
     print(request.path)
     print("request.cache_control.max_age", request.cache_control.max_age, type(request.cache_control.max_age))
     print("request.cache_control.max_stale", request.cache_control.max_stale, type(request.cache_control.max_stale))
@@ -240,7 +240,7 @@ def cache_control():  # $routeHandler
     return 'ok'  # $HttpResponse
 
 @app.route("/file_upload", methods=['POST'])  # $routeSetup="/file_upload"
-def file_upload():  # $routeHandler
+def file_upload():  # $requestHandler
     print(request.path)
     for k,v in request.files.items():
         print(k, v, v.name, v.filename, v.stream)
@@ -248,7 +248,7 @@ def file_upload():  # $routeHandler
     return 'ok'  # $HttpResponse
 
 @app.route("/args", methods=['GET'])  # $routeSetup="/args"
-def args():  # $routeHandler
+def args():  # $requestHandler
     print(request.path)
     print("request.args", request.args)
 
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py b/python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py
index 33a3594894f..f74cc171136 100644
--- a/python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py
+++ b/python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py
@@ -78,7 +78,7 @@ class MyHandler(BaseHTTPRequestHandler):
         ensure_tainted(form)
 
 
-    def do_GET(self):
+    def do_GET(self): # $ MISSING: requestHandler
         # send_response will log a line to stderr
         self.send_response(200)
         self.send_header("Content-type", "text/plain; charset=utf-8")
@@ -88,7 +88,7 @@ class MyHandler(BaseHTTPRequestHandler):
         print(self.headers)
 
 
-    def do_POST(self):
+    def do_POST(self): # $ MISSING: requestHandler
         form = cgi.FieldStorage(
             self.rfile,
             self.headers,
diff --git a/python/ql/test/experimental/meta/ConceptsTest.qll b/python/ql/test/experimental/meta/ConceptsTest.qll
index 98423b95688..b031499e5e2 100644
--- a/python/ql/test/experimental/meta/ConceptsTest.qll
+++ b/python/ql/test/experimental/meta/ConceptsTest.qll
@@ -142,7 +142,9 @@ class SqlExecutionTest extends InlineExpectationsTest {
 class HttpServerRouteSetupTest extends InlineExpectationsTest {
   HttpServerRouteSetupTest() { this = "HttpServerRouteSetupTest" }
 
-  override string getARelevantTag() { result in ["routeSetup", "routeHandler", "routedParameter"] }
+  override string getARelevantTag() {
+    result in ["routeSetup", "requestHandler", "routedParameter"]
+  }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(HTTP::Server::RouteSetup setup |
@@ -157,16 +159,15 @@ class HttpServerRouteSetupTest extends InlineExpectationsTest {
       tag = "routeSetup"
     )
     or
-    exists(HTTP::Server::RouteSetup setup, Function func |
-      func = setup.getARouteHandler() and
-      location = func.getLocation() and
-      element = func.toString() and
+    exists(HTTP::Server::RequestHandler handler |
+      location = handler.getLocation() and
+      element = handler.toString() and
       value = "" and
-      tag = "routeHandler"
+      tag = "requestHandler"
     )
     or
-    exists(HTTP::Server::RouteSetup setup, Parameter param |
-      param = setup.getARoutedParameter() and
+    exists(HTTP::Server::RequestHandler handler, Parameter param |
+      param = handler.getARoutedParameter() and
       location = param.getLocation() and
       element = param.toString() and
       value = param.asName().getId() and

From d4d6f0ca0c55eded35b2a0b23ba8d71ed6ad67ef Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 21 Dec 2020 17:38:43 +0100
Subject: [PATCH 026/343] Python: Model django request handlers without known
 route

---
 .../2020-12-21-django-with-unknown-route.md     |  2 ++
 .../ql/src/semmle/python/frameworks/Django.qll  | 17 +++++++++++++++++
 .../frameworks/django-v2-v3/routing_test.py     |  2 +-
 .../frameworks/django-v2-v3/testapp/views.py    |  2 +-
 4 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 python/change-notes/2020-12-21-django-with-unknown-route.md

diff --git a/python/change-notes/2020-12-21-django-with-unknown-route.md b/python/change-notes/2020-12-21-django-with-unknown-route.md
new file mode 100644
index 00000000000..6ac353cbef4
--- /dev/null
+++ b/python/change-notes/2020-12-21-django-with-unknown-route.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Improved modeling of `django` to recognize request handlers on `View` classes without known route, thereby leading to more sources of remote user input (`RemoteFlowSource`).
diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index f4cbe3d9ea5..171a06dc97a 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1756,6 +1756,23 @@ private module Django {
     }
   }
 
+  /** A request handler defined in a django view class, that has no known route. */
+  private class DjangoViewClassHandlerWithoutKnownRoute extends HTTP::Server::RequestHandler::Range,
+    DjangoRouteHandler {
+    DjangoViewClassHandlerWithoutKnownRoute() {
+      exists(DjangoViewClassDef vc | vc.getARequestHandler() = this) and
+      not exists(DjangoRouteSetup setup | setup.getARequestHandler() = this)
+    }
+
+    override Parameter getARoutedParameter() {
+      // Since we don't know the URL pattern, we simply mark all parameters as a routed
+      // parameter. This should give us more RemoteFlowSources but could also lead to
+      // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
+      result in [this.getArg(_), this.getArgByName(_)] and
+      not result = any(int i | i <= this.getRequestParamIndex() | this.getArg(i))
+    }
+  }
+
   /**
    * Gets the regex that is used by django to find routed parameters when using `django.urls.path`.
    *
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
index 9b28f7ffeb8..e744c5ba89d 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
@@ -113,5 +113,5 @@ class PossiblyNotRouted(View):
     # Even if our analysis can't find a route-setup for this class, we should still
     # consider it to be a handle incoming HTTP requests
 
-    def get(self, request, possibly_not_routed=42):  # $ MISSING: requestHandler routedParameter=possibly_not_routed
+    def get(self, request, possibly_not_routed=42):  # $ requestHandler routedParameter=possibly_not_routed
         return HttpResponse('PossiblyNotRouted get: {}'.format(possibly_not_routed))  # $HttpResponse
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
index ea8c392f3d4..55c60a551a0 100644
--- a/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
+++ b/python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
@@ -24,7 +24,7 @@ class MyBasicViewHandler(View):
 
 
 class MyCustomViewBaseClass(View):
-    def post(self, request: HttpRequest): # $ MISSING: requestHandler
+    def post(self, request: HttpRequest): # $ requestHandler
         return HttpResponse("MyCustomViewBaseClass: POST") # $ HttpResponse
 
 

From 05ab6cd54a806449be0b1b7003532deda11f59a8 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 21 Dec 2020 17:41:46 +0100
Subject: [PATCH 027/343] Python: Add RemoteFlowSource for django handler
 without route

A bit scary that we don't have any tests to indicate that I forgot to add this :O
---
 python/ql/src/semmle/python/frameworks/Django.qll | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 171a06dc97a..74c1856a79b 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1909,6 +1909,8 @@ private module Django {
     RemoteFlowSource::Range, DataFlow::ParameterNode {
     DjangoRouteHandlerRequestParam() {
       this.getParameter() = any(DjangoRouteSetup setup).getARequestHandler().getRequestParam()
+      or
+      this.getParameter() = any(DjangoViewClassHandlerWithoutKnownRoute setup).getRequestParam()
     }
 
     override string getSourceType() { result = "django.http.request.HttpRequest" }

From 71a6ef5b00c21ab4bdad6380a7bfc65ccbf10e0d Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 21 Dec 2020 17:55:33 +0100
Subject: [PATCH 028/343] Python: Model RequestHandler from standard library
 explicitly

---
 python/ql/src/semmle/python/frameworks/Stdlib.qll  | 14 ++++++++++++++
 python/ql/src/semmle/python/web/HttpConstants.qll  |  2 +-
 .../library-tests/frameworks/stdlib/http_server.py |  4 ++--
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Stdlib.qll b/python/ql/src/semmle/python/frameworks/Stdlib.qll
index 8840e1bba60..5120534d014 100644
--- a/python/ql/src/semmle/python/frameworks/Stdlib.qll
+++ b/python/ql/src/semmle/python/frameworks/Stdlib.qll
@@ -1616,6 +1616,20 @@ private module Stdlib {
         )
       }
     }
+
+    /**
+     * The entry-point for handling a request with a `BaseHTTPRequestHandler` subclass.
+     *
+     * Not essential for any functionality, but provides a consistent modeling.
+     */
+    private class RequestHandlerFunc extends HTTP::Server::RequestHandler::Range {
+      RequestHandlerFunc() {
+        this = any(HTTPRequestHandlerClassDef cls).getAMethod() and
+        this.getName() = "do_" + HTTP::httpVerb()
+      }
+
+      override Parameter getARoutedParameter() { none() }
+    }
   }
 
   // ---------------------------------------------------------------------------
diff --git a/python/ql/src/semmle/python/web/HttpConstants.qll b/python/ql/src/semmle/python/web/HttpConstants.qll
index b3b389faf62..d3e8b0412a4 100644
--- a/python/ql/src/semmle/python/web/HttpConstants.qll
+++ b/python/ql/src/semmle/python/web/HttpConstants.qll
@@ -1,4 +1,4 @@
-/** Gets an HTTP verb */
+/** Gets an HTTP verb, in upper case */
 string httpVerb() {
   result = "GET" or
   result = "POST" or
diff --git a/python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py b/python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py
index f74cc171136..8d996acb41d 100644
--- a/python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py
+++ b/python/ql/test/experimental/library-tests/frameworks/stdlib/http_server.py
@@ -78,7 +78,7 @@ class MyHandler(BaseHTTPRequestHandler):
         ensure_tainted(form)
 
 
-    def do_GET(self): # $ MISSING: requestHandler
+    def do_GET(self): # $ requestHandler
         # send_response will log a line to stderr
         self.send_response(200)
         self.send_header("Content-type", "text/plain; charset=utf-8")
@@ -88,7 +88,7 @@ class MyHandler(BaseHTTPRequestHandler):
         print(self.headers)
 
 
-    def do_POST(self): # $ MISSING: requestHandler
+    def do_POST(self): # $ requestHandler
         form = cgi.FieldStorage(
             self.rfile,
             self.headers,

From ba4da72b9e20ff70c331224308b403bfc8018468 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sat, 5 Dec 2020 13:39:42 +0100
Subject: [PATCH 029/343] C++: Add examples that require longer access paths

---
 .../dataflow/fields/aliasing.cpp              | 28 +++++++++++
 .../fields/dataflow-consistency.expected      |  5 ++
 .../fields/dataflow-ir-consistency.expected   |  6 +++
 .../fields/partial-definition-diff.expected   | 10 ++++
 .../fields/partial-definition-ir.expected     |  5 ++
 .../fields/partial-definition.expected        | 15 ++++++
 .../dataflow/fields/path-flow.expected        | 47 +++++++++++++++++++
 .../library-tests/dataflow/fields/simple.cpp  | 12 +++++
 8 files changed, 128 insertions(+)

diff --git a/cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp b/cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp
index 500bbed53a9..8b3c0f29ab2 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp
+++ b/cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp
@@ -204,4 +204,32 @@ void deep_member_field_arrow(S2 *ps2) {
 void deep_member_field_arrow_different_fields(S2 *ps2) {
   taint_a_ptr(&ps2->s.m1);
   sink(ps2->s.m2);
+}
+
+void test_deep_struct_fields() {
+  S2 s2;
+  s2.s.m1 = user_input();
+  S s = s2.s;
+  sink(s.m1); // $ ast MISSING: ir
+}
+
+void test_deep_struct_fields_no_flow() {
+  S2 s2;
+  s2.s.m1 = user_input();
+  S s = s2.s;
+  sink(s.m2);
+}
+
+void test_deep_struct_fields_taint_through_call() {
+  S2 s2;
+  taint_a_ptr(&s2.s.m1);
+  S s = s2.s;
+  sink(s.m1); // $ ast MISSING: ir
+}
+
+void test_deep_struct_fields_taint_through_call_no_flow() {
+  S2 s2;
+  taint_a_ptr(&s2.s.m1);
+  S s = s2.s;
+  sink(s.m2);
 }
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected b/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected
index 49b12c14350..0594034912f 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected
@@ -89,6 +89,10 @@ postWithInFlow
 | aliasing.cpp:194:21:194:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:200:23:200:24 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:205:23:205:24 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:211:8:211:9 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:218:8:218:9 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:225:21:225:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:232:21:232:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
 | arrays.cpp:6:3:6:5 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
 | arrays.cpp:6:3:6:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
 | arrays.cpp:15:3:15:10 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
@@ -145,5 +149,6 @@ postWithInFlow
 | simple.cpp:65:7:65:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:83:12:83:13 | f1 [post update] | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:92:7:92:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:104:9:104:9 | i [post update] | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:24:11:24:12 | ab [inner post update] | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:36:17:36:24 | nestedAB [inner post update] | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected b/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
index b09317c2c1b..23f8d07717f 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
@@ -18,6 +18,7 @@ postIsNotPre
 postHasUniquePre
 | simple.cpp:65:5:65:22 | Store | PostUpdateNode should have one pre-update node but has 0. |
 | simple.cpp:92:5:92:22 | Store | PostUpdateNode should have one pre-update node but has 0. |
+| simple.cpp:104:5:104:24 | Store | PostUpdateNode should have one pre-update node but has 0. |
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
@@ -96,6 +97,10 @@ postWithInFlow
 | aliasing.cpp:194:15:194:22 | Chi | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:200:15:200:24 | Chi | PostUpdateNode should not be the target of local flow. |
 | aliasing.cpp:205:15:205:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:211:3:211:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:218:3:218:24 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:225:15:225:22 | Chi | PostUpdateNode should not be the target of local flow. |
+| aliasing.cpp:232:15:232:22 | Chi | PostUpdateNode should not be the target of local flow. |
 | arrays.cpp:5:18:5:23 | Chi | PostUpdateNode should not be the target of local flow. |
 | arrays.cpp:5:21:5:21 | Chi | PostUpdateNode should not be the target of local flow. |
 | arrays.cpp:6:3:6:23 | Chi | PostUpdateNode should not be the target of local flow. |
@@ -145,6 +150,7 @@ postWithInFlow
 | simple.cpp:65:5:65:22 | Store | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:83:9:83:28 | Chi | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:92:5:92:22 | Store | PostUpdateNode should not be the target of local flow. |
+| simple.cpp:104:5:104:24 | Store | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:20:20:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:20:34:20:34 | Chi | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:27:7:27:16 | Chi | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
index bba86417ca5..ee0a3a33779 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
@@ -183,6 +183,14 @@
 | aliasing.cpp:200:16:200:18 | ps2 | AST only |
 | aliasing.cpp:205:15:205:24 | & ... | AST only |
 | aliasing.cpp:205:16:205:18 | ps2 | AST only |
+| aliasing.cpp:211:3:211:4 | s2 | AST only |
+| aliasing.cpp:211:8:211:9 | m1 | AST only |
+| aliasing.cpp:218:3:218:4 | s2 | AST only |
+| aliasing.cpp:218:8:218:9 | m1 | AST only |
+| aliasing.cpp:225:15:225:22 | & ... | AST only |
+| aliasing.cpp:225:16:225:17 | s2 | AST only |
+| aliasing.cpp:232:15:232:22 | & ... | AST only |
+| aliasing.cpp:232:16:232:17 | s2 | AST only |
 | arrays.cpp:6:3:6:8 | access to array | AST only |
 | arrays.cpp:6:3:6:23 | arr | IR only |
 | arrays.cpp:15:3:15:10 | * ... | AST only |
@@ -399,6 +407,8 @@
 | simple.cpp:83:12:83:13 | f1 | AST only |
 | simple.cpp:84:14:84:20 | this | AST only |
 | simple.cpp:92:7:92:7 | i | AST only |
+| simple.cpp:104:5:104:5 | b | AST only |
+| simple.cpp:104:9:104:9 | i | AST only |
 | struct_init.c:15:8:15:9 | ab | AST only |
 | struct_init.c:15:12:15:12 | a | AST only |
 | struct_init.c:16:8:16:9 | ab | AST only |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected
index 8d12b2a7e05..5b73bf8dd33 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected
@@ -35,6 +35,10 @@
 | aliasing.cpp:194:19:194:19 | s |
 | aliasing.cpp:200:21:200:21 | s |
 | aliasing.cpp:205:21:205:21 | s |
+| aliasing.cpp:211:6:211:6 | s |
+| aliasing.cpp:218:6:218:6 | s |
+| aliasing.cpp:225:19:225:19 | s |
+| aliasing.cpp:232:19:232:19 | s |
 | arrays.cpp:6:3:6:5 | arr |
 | arrays.cpp:36:3:36:17 | access to array |
 | by_reference.cpp:12:5:12:5 | s |
@@ -68,4 +72,5 @@
 | simple.cpp:65:5:65:5 | a |
 | simple.cpp:83:9:83:10 | f2 |
 | simple.cpp:92:5:92:5 | a |
+| simple.cpp:104:7:104:7 | a |
 | struct_init.c:36:11:36:15 | outer |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected b/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected
index 6c58d51ff74..e96fae3cb20 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected
@@ -220,6 +220,18 @@
 | aliasing.cpp:205:15:205:24 | & ... |
 | aliasing.cpp:205:16:205:18 | ps2 |
 | aliasing.cpp:205:21:205:21 | s |
+| aliasing.cpp:211:3:211:4 | s2 |
+| aliasing.cpp:211:6:211:6 | s |
+| aliasing.cpp:211:8:211:9 | m1 |
+| aliasing.cpp:218:3:218:4 | s2 |
+| aliasing.cpp:218:6:218:6 | s |
+| aliasing.cpp:218:8:218:9 | m1 |
+| aliasing.cpp:225:15:225:22 | & ... |
+| aliasing.cpp:225:16:225:17 | s2 |
+| aliasing.cpp:225:19:225:19 | s |
+| aliasing.cpp:232:15:232:22 | & ... |
+| aliasing.cpp:232:16:232:17 | s2 |
+| aliasing.cpp:232:19:232:19 | s |
 | arrays.cpp:6:3:6:8 | access to array |
 | arrays.cpp:15:3:15:10 | * ... |
 | arrays.cpp:36:3:36:3 | o |
@@ -467,6 +479,9 @@
 | simple.cpp:84:14:84:20 | this |
 | simple.cpp:92:5:92:5 | a |
 | simple.cpp:92:7:92:7 | i |
+| simple.cpp:104:5:104:5 | b |
+| simple.cpp:104:7:104:7 | a |
+| simple.cpp:104:9:104:9 | i |
 | struct_init.c:15:8:15:9 | ab |
 | struct_init.c:15:12:15:12 | a |
 | struct_init.c:16:8:16:9 | ab |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/path-flow.expected b/cpp/ql/test/library-tests/dataflow/fields/path-flow.expected
index b932e0395f4..93ec3ca710d 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/path-flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/path-flow.expected
@@ -160,6 +160,7 @@ edges
 | aliasing.cpp:106:4:106:5 | pa [inner post update] | aliasing.cpp:175:15:175:22 | ref arg & ... |
 | aliasing.cpp:106:4:106:5 | pa [inner post update] | aliasing.cpp:187:15:187:22 | ref arg & ... |
 | aliasing.cpp:106:4:106:5 | pa [inner post update] | aliasing.cpp:200:15:200:24 | ref arg & ... |
+| aliasing.cpp:106:4:106:5 | pa [inner post update] | aliasing.cpp:225:15:225:22 | ref arg & ... |
 | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:106:4:106:5 | pa [inner post update] |
 | aliasing.cpp:158:15:158:15 | s [post update] [data] | aliasing.cpp:159:9:159:9 | s [data] |
 | aliasing.cpp:158:17:158:20 | ref arg data | aliasing.cpp:158:15:158:15 | s [post update] [data] |
@@ -187,6 +188,20 @@ edges
 | aliasing.cpp:200:23:200:24 | m1 [inner post update] | aliasing.cpp:200:21:200:21 | s [post update] [m1] |
 | aliasing.cpp:201:8:201:10 | ps2 [s, m1] | aliasing.cpp:201:13:201:13 | s [m1] |
 | aliasing.cpp:201:13:201:13 | s [m1] | aliasing.cpp:201:15:201:16 | m1 |
+| aliasing.cpp:211:3:211:4 | s2 [post update] [s, m1] | aliasing.cpp:212:9:212:10 | s2 [s, m1] |
+| aliasing.cpp:211:3:211:24 | ... = ... | aliasing.cpp:211:6:211:6 | s [post update] [m1] |
+| aliasing.cpp:211:6:211:6 | s [post update] [m1] | aliasing.cpp:211:3:211:4 | s2 [post update] [s, m1] |
+| aliasing.cpp:211:13:211:22 | call to user_input | aliasing.cpp:211:3:211:24 | ... = ... |
+| aliasing.cpp:212:9:212:10 | s2 [s, m1] | aliasing.cpp:212:12:212:12 | s [m1] |
+| aliasing.cpp:212:12:212:12 | s [m1] | aliasing.cpp:213:8:213:8 | s [m1] |
+| aliasing.cpp:213:8:213:8 | s [m1] | aliasing.cpp:213:10:213:11 | m1 |
+| aliasing.cpp:225:15:225:22 | ref arg & ... | aliasing.cpp:225:21:225:22 | m1 [inner post update] |
+| aliasing.cpp:225:16:225:17 | s2 [post update] [s, m1] | aliasing.cpp:226:9:226:10 | s2 [s, m1] |
+| aliasing.cpp:225:19:225:19 | s [post update] [m1] | aliasing.cpp:225:16:225:17 | s2 [post update] [s, m1] |
+| aliasing.cpp:225:21:225:22 | m1 [inner post update] | aliasing.cpp:225:19:225:19 | s [post update] [m1] |
+| aliasing.cpp:226:9:226:10 | s2 [s, m1] | aliasing.cpp:226:12:226:12 | s [m1] |
+| aliasing.cpp:226:12:226:12 | s [m1] | aliasing.cpp:227:8:227:8 | s [m1] |
+| aliasing.cpp:227:8:227:8 | s [m1] | aliasing.cpp:227:10:227:11 | m1 |
 | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:7:8:7:13 | access to array |
 | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:8:8:8:13 | access to array |
 | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:9:8:9:11 | * ... |
@@ -428,6 +443,12 @@ edges
 | simple.cpp:92:5:92:22 | ... = ... | simple.cpp:92:5:92:5 | a [post update] [i] |
 | simple.cpp:92:11:92:20 | call to user_input | simple.cpp:92:5:92:22 | ... = ... |
 | simple.cpp:94:10:94:11 | a2 [i] | simple.cpp:94:13:94:13 | i |
+| simple.cpp:104:5:104:5 | b [post update] [a, i] | simple.cpp:106:10:106:11 | b2 [a, i] |
+| simple.cpp:104:5:104:24 | ... = ... | simple.cpp:104:7:104:7 | a [post update] [i] |
+| simple.cpp:104:7:104:7 | a [post update] [i] | simple.cpp:104:5:104:5 | b [post update] [a, i] |
+| simple.cpp:104:13:104:22 | call to user_input | simple.cpp:104:5:104:24 | ... = ... |
+| simple.cpp:106:10:106:11 | b2 [a, i] | simple.cpp:106:13:106:13 | a [i] |
+| simple.cpp:106:13:106:13 | a [i] | simple.cpp:106:15:106:15 | i |
 | struct_init.c:14:24:14:25 | ab [a] | struct_init.c:15:8:15:9 | ab [a] |
 | struct_init.c:15:8:15:9 | ab [a] | struct_init.c:15:12:15:12 | a |
 | struct_init.c:20:17:20:36 | {...} [a] | struct_init.c:22:8:22:9 | ab [a] |
@@ -668,6 +689,22 @@ nodes
 | aliasing.cpp:201:8:201:10 | ps2 [s, m1] | semmle.label | ps2 [s, m1] |
 | aliasing.cpp:201:13:201:13 | s [m1] | semmle.label | s [m1] |
 | aliasing.cpp:201:15:201:16 | m1 | semmle.label | m1 |
+| aliasing.cpp:211:3:211:4 | s2 [post update] [s, m1] | semmle.label | s2 [post update] [s, m1] |
+| aliasing.cpp:211:3:211:24 | ... = ... | semmle.label | ... = ... |
+| aliasing.cpp:211:6:211:6 | s [post update] [m1] | semmle.label | s [post update] [m1] |
+| aliasing.cpp:211:13:211:22 | call to user_input | semmle.label | call to user_input |
+| aliasing.cpp:212:9:212:10 | s2 [s, m1] | semmle.label | s2 [s, m1] |
+| aliasing.cpp:212:12:212:12 | s [m1] | semmle.label | s [m1] |
+| aliasing.cpp:213:8:213:8 | s [m1] | semmle.label | s [m1] |
+| aliasing.cpp:213:10:213:11 | m1 | semmle.label | m1 |
+| aliasing.cpp:225:15:225:22 | ref arg & ... | semmle.label | ref arg & ... |
+| aliasing.cpp:225:16:225:17 | s2 [post update] [s, m1] | semmle.label | s2 [post update] [s, m1] |
+| aliasing.cpp:225:19:225:19 | s [post update] [m1] | semmle.label | s [post update] [m1] |
+| aliasing.cpp:225:21:225:22 | m1 [inner post update] | semmle.label | m1 [inner post update] |
+| aliasing.cpp:226:9:226:10 | s2 [s, m1] | semmle.label | s2 [s, m1] |
+| aliasing.cpp:226:12:226:12 | s [m1] | semmle.label | s [m1] |
+| aliasing.cpp:227:8:227:8 | s [m1] | semmle.label | s [m1] |
+| aliasing.cpp:227:10:227:11 | m1 | semmle.label | m1 |
 | arrays.cpp:6:12:6:21 | call to user_input | semmle.label | call to user_input |
 | arrays.cpp:7:8:7:13 | access to array | semmle.label | access to array |
 | arrays.cpp:8:8:8:13 | access to array | semmle.label | access to array |
@@ -933,6 +970,13 @@ nodes
 | simple.cpp:92:11:92:20 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:94:10:94:11 | a2 [i] | semmle.label | a2 [i] |
 | simple.cpp:94:13:94:13 | i | semmle.label | i |
+| simple.cpp:104:5:104:5 | b [post update] [a, i] | semmle.label | b [post update] [a, i] |
+| simple.cpp:104:5:104:24 | ... = ... | semmle.label | ... = ... |
+| simple.cpp:104:7:104:7 | a [post update] [i] | semmle.label | a [post update] [i] |
+| simple.cpp:104:13:104:22 | call to user_input | semmle.label | call to user_input |
+| simple.cpp:106:10:106:11 | b2 [a, i] | semmle.label | b2 [a, i] |
+| simple.cpp:106:13:106:13 | a [i] | semmle.label | a [i] |
+| simple.cpp:106:15:106:15 | i | semmle.label | i |
 | struct_init.c:14:24:14:25 | ab [a] | semmle.label | ab [a] |
 | struct_init.c:15:8:15:9 | ab [a] | semmle.label | ab [a] |
 | struct_init.c:15:12:15:12 | a | semmle.label | a |
@@ -998,6 +1042,8 @@ nodes
 | aliasing.cpp:176:13:176:14 | m1 | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:176:13:176:14 | m1 | m1 flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |
 | aliasing.cpp:189:15:189:16 | m1 | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:189:15:189:16 | m1 | m1 flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |
 | aliasing.cpp:201:15:201:16 | m1 | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:201:15:201:16 | m1 | m1 flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |
+| aliasing.cpp:213:10:213:11 | m1 | aliasing.cpp:211:13:211:22 | call to user_input | aliasing.cpp:213:10:213:11 | m1 | m1 flows from $@ | aliasing.cpp:211:13:211:22 | call to user_input | call to user_input |
+| aliasing.cpp:227:10:227:11 | m1 | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:227:10:227:11 | m1 | m1 flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |
 | arrays.cpp:7:8:7:13 | access to array | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:7:8:7:13 | access to array | access to array flows from $@ | arrays.cpp:6:12:6:21 | call to user_input | call to user_input |
 | arrays.cpp:8:8:8:13 | access to array | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:8:8:8:13 | access to array | access to array flows from $@ | arrays.cpp:6:12:6:21 | call to user_input | call to user_input |
 | arrays.cpp:9:8:9:11 | * ... | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:9:8:9:11 | * ... | * ... flows from $@ | arrays.cpp:6:12:6:21 | call to user_input | call to user_input |
@@ -1046,6 +1092,7 @@ nodes
 | simple.cpp:67:13:67:13 | i | simple.cpp:65:11:65:20 | call to user_input | simple.cpp:67:13:67:13 | i | i flows from $@ | simple.cpp:65:11:65:20 | call to user_input | call to user_input |
 | simple.cpp:84:14:84:20 | call to getf2f1 | simple.cpp:83:17:83:26 | call to user_input | simple.cpp:84:14:84:20 | call to getf2f1 | call to getf2f1 flows from $@ | simple.cpp:83:17:83:26 | call to user_input | call to user_input |
 | simple.cpp:94:13:94:13 | i | simple.cpp:92:11:92:20 | call to user_input | simple.cpp:94:13:94:13 | i | i flows from $@ | simple.cpp:92:11:92:20 | call to user_input | call to user_input |
+| simple.cpp:106:15:106:15 | i | simple.cpp:104:13:104:22 | call to user_input | simple.cpp:106:15:106:15 | i | i flows from $@ | simple.cpp:104:13:104:22 | call to user_input | call to user_input |
 | struct_init.c:15:12:15:12 | a | struct_init.c:20:20:20:29 | call to user_input | struct_init.c:15:12:15:12 | a | a flows from $@ | struct_init.c:20:20:20:29 | call to user_input | call to user_input |
 | struct_init.c:15:12:15:12 | a | struct_init.c:27:7:27:16 | call to user_input | struct_init.c:15:12:15:12 | a | a flows from $@ | struct_init.c:27:7:27:16 | call to user_input | call to user_input |
 | struct_init.c:15:12:15:12 | a | struct_init.c:40:20:40:29 | call to user_input | struct_init.c:15:12:15:12 | a | a flows from $@ | struct_init.c:40:20:40:29 | call to user_input | call to user_input |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/simple.cpp b/cpp/ql/test/library-tests/dataflow/fields/simple.cpp
index e4d4f70edb0..829974a1b67 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/simple.cpp
+++ b/cpp/ql/test/library-tests/dataflow/fields/simple.cpp
@@ -94,4 +94,16 @@ void single_field_test_typedef(A_typedef a)
     sink(a2.i); //$ ast,ir
 }
 
+struct B {
+    A a;
+};
+
+void single_field_test_depth_2()
+{
+    B b;
+    b.a.i = user_input();
+    B b2 = b;
+    sink(b2.a.i); //$ ast MISSING: ir
+}
+
 } // namespace Simple

From 91debe8669259c24344f4ad4b6c19071346e4d6d Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sat, 5 Dec 2020 15:15:57 +0100
Subject: [PATCH 030/343] C++: Add ReadNodes and implement local flow steps
 into them.

---
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 119 +++++++++++++++++-
 1 file changed, 118 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 15fc2fa1d9a..f894c0d905e 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -15,7 +15,10 @@ cached
 private newtype TIRDataFlowNode =
   TInstructionNode(Instruction i) or
   TOperandNode(Operand op) or
-  TVariableNode(Variable var)
+  TVariableNode(Variable var) or
+  // `FieldNodes` are used as targets of certain `storeStep`s to implement handling of stores to
+  // nested structs.
+  TFieldNode(FieldAddressInstruction field)
 
 /**
  * A node in a data flow graph.
@@ -170,6 +173,91 @@ class OperandNode extends Node, TOperandNode {
   override string toString() { result = this.getOperand().toString() }
 }
 
+abstract private class SkippableInstruction extends Instruction {
+  abstract Instruction getSourceInstruction();
+}
+
+private Instruction skipSkippableInstructionsRec(SkippableInstruction skip) {
+  result = skip.getSourceInstruction() and not result instanceof SkippableInstruction
+  or
+  result = skipSkippableInstructionsRec(skip.getSourceInstruction())
+}
+
+private Instruction skipSkippableInstructions(Instruction instr) {
+  result = instr and not result instanceof SkippableInstruction
+  or
+  result = skipSkippableInstructionsRec(instr)
+}
+
+private class SkippableCopyValueInstruction extends SkippableInstruction, CopyValueInstruction {
+  override Instruction getSourceInstruction() { result = this.getSourceValue() }
+}
+
+private class SkippableConvertInstruction extends SkippableInstruction, ConvertInstruction {
+  override Instruction getSourceInstruction() { result = this.getUnary() }
+}
+
+private class SkippableCheckedConvertInstruction extends SkippableInstruction,
+  CheckedConvertOrNullInstruction {
+  override Instruction getSourceInstruction() { result = this.getUnary() }
+}
+
+private class SkippableInheritanceConversionInstruction extends SkippableInstruction,
+  InheritanceConversionInstruction {
+  override Instruction getSourceInstruction() { result = this.getUnary() }
+}
+
+/**
+ * INTERNAL: do not use. Gets the `FieldNode` corresponding to `instr`, if
+ * `instr` is an instruction that propagates an address of a `FieldAddressInstruction`.
+ */
+FieldNode getFieldNodeForFieldInstruction(Instruction instr) {
+  result.getFieldInstruction() = skipSkippableInstructions(instr)
+}
+
+/**
+ * INTERNAL: do not use. A `FieldNode` represents the state of an object after modifying one
+ * of its fields.
+ */
+class FieldNode extends Node, TFieldNode {
+  FieldAddressInstruction field;
+
+  FieldNode() { this = TFieldNode(field) }
+
+  /** Gets the `Field` of this `FieldNode`. */
+  Field getField() { result = getFieldInstruction().getField() }
+
+  /** Gets the `FieldAddressInstruction` of this `FieldNode`. */
+  FieldAddressInstruction getFieldInstruction() { result = field }
+
+  /**
+   * Gets the `FieldNode` corresponding to the parent field of this `FieldNode`, if any.
+   *
+   * For example, if `f` is the `FieldNode` for `c` in the expression `a.b.c`, then `f.getObjectNode()`
+   * gives the `FieldNode` of `b`, and `f.getObjectNode().getObjectNode()` has no result as `a` is
+   * not a field.
+   */
+  FieldNode getObjectNode() { result = getFieldNodeForFieldInstruction(field.getObjectAddress()) }
+
+  /**
+   * Gets the `FieldNode` that has this `FieldNode` as parent, if any.
+   *
+   * For example, if `f` is the `FieldNode` corresponding to `b` in `a.b.c`, then `f.getNextNode()`
+   * gives the `FieldNode` corresponding to `c`, and `f.getNextNode().getNextNode()`.
+   */
+  FieldNode getNextNode() { result.getObjectNode() = this }
+
+  /** Gets the class where the field of this node is declared. */
+  Class getDeclaringType() { result = getField().getDeclaringType() }
+
+  override Function getFunction() { result = field.getEnclosingFunction() }
+
+  override IRType getType() { result = field.getResultIRType() }
+
+  override Location getLocation() { result = field.getLocation() }
+
+  override string toString() { result = this.getField().toString() }
+}
 /**
  * An expression, viewed as a node in a data flow graph.
  */
@@ -585,6 +673,33 @@ Node uninitializedNode(LocalVariable v) { none() }
  */
 predicate localFlowStep(Node nodeFrom, Node nodeTo) { simpleLocalFlowStep(nodeFrom, nodeTo) }
 
+private predicate flowIntoReadNode(Node nodeFrom, Node nodeTo) {
+  // flow from the "innermost" field to the load of that field.
+  exists(FieldNode fieldNode | nodeTo = fieldNode |
+    not exists(fieldNode.getObjectNode()) and
+    (
+      exists(LoadInstruction load |
+        fieldNode.getNextNode*() = getFieldNodeForFieldInstruction(load.getSourceAddress()) and
+        nodeFrom.asInstruction() = load.getSourceValueOperand().getAnyDef()
+      )
+      or
+      // We need this to make stores look like loads for the dataflow library. So when there's a store
+      // of the form x->y = z we need to make the field node corresponding to y look like it's reading
+      // from the memory of x.
+      exists(StoreInstruction store, ChiInstruction chi |
+        chi.getPartial() = store and
+        fieldNode.getNextNode*() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
+        nodeFrom.asInstruction() = chi.getTotal()
+      )
+      or
+      exists(ReadSideEffectInstruction read |
+        fieldNode.getNextNode*() = getFieldNodeForFieldInstruction(read.getArgumentDef()) and
+        nodeFrom.asOperand() = read.getSideEffectOperand()
+      )
+    )
+  )
+}
+
 /**
  * INTERNAL: do not use.
  *
@@ -598,6 +713,8 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
   or
   // Instruction -> Operand flow
   simpleOperandLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asOperand())
+  or
+  flowIntoReadNode(nodeFrom, nodeTo)
 }
 
 pragma[noinline]

From 29301284214c481661aba4a946075c4cbd309ced Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sat, 5 Dec 2020 15:21:26 +0100
Subject: [PATCH 031/343] C++: Implement read steps using ReadNodes.

---
 .../ir/dataflow/internal/DataFlowPrivate.qll  | 94 +++++++++++++++----
 1 file changed, 77 insertions(+), 17 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index 762ce8d47b4..81769801c7d 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -209,6 +209,13 @@ private class FieldContent extends Content, TFieldContent {
   predicate hasOffset(Class cl, int start, int end) { cl = c and start = startBit and end = endBit }
 
   Field getAField() { result = getAField(c, startBit, endBit) }
+
+  pragma[noinline]
+  Field getADirectField() {
+    c = result.getDeclaringType() and
+    this.getAField() = result and
+    this.hasOffset(c, _, _)
+  }
 }
 
 private class CollectionContent extends Content, TCollectionContent {
@@ -390,12 +397,16 @@ private Instruction skipCopyValueInstructions(Operand op) {
   result = skipOneCopyValueInstructionRec(op.getDef())
 }
 
+private class InexactLoadOperand extends LoadOperand {
+  InexactLoadOperand() { this.isDefinitionInexact() }
+}
+
 private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
   a = TArrayContent() and
   // Explicit dereferences such as `*p` or `p[i]` where `p` is a pointer or array.
-  exists(LoadOperand operand, Instruction address |
-    operand.isDefinitionInexact() and
+  exists(InexactLoadOperand operand, Instruction address |
     node1.asInstruction() = operand.getAnyDef() and
+    not node1.asInstruction().isResultConflated() and
     operand = node2.asOperand() and
     address = skipCopyValueInstructions(operand.getAddressOperand()) and
     (
@@ -406,6 +417,53 @@ private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
   )
 }
 
+/** Step from the value loaded by a `LoadInstruction` to the "outermost" loaded field. */
+private predicate instrToFieldNodeReadStep(FieldNode node1, FieldContent f, Node node2) {
+  (
+    node1.getNextNode() = node2
+    or
+    not exists(node1.getNextNode()) and
+    (
+      exists(LoadInstruction load |
+        node2.asInstruction() = load and
+        node1 = getFieldNodeForFieldInstruction(load.getSourceAddress())
+      )
+      or
+      exists(ReadSideEffectInstruction read |
+        node2.asOperand() = read.getSideEffectOperand() and
+        node1 = getFieldNodeForFieldInstruction(read.getArgumentDef())
+      )
+    )
+  ) and
+  f.getADirectField() = node1.getField()
+}
+
+bindingset[result, i]
+private int unbindInt(int i) { i <= result and i >= result }
+
+pragma[noinline]
+private predicate getFieldNodeFromLoadOperand(FieldNode fieldNode, LoadOperand loadOperand) {
+  fieldNode = getFieldNodeForFieldInstruction(loadOperand.getAddressOperand().getDef())
+}
+
+// Sometimes there's no explicit field dereference. In such cases we use the IR alias analysis to
+// determine the offset being, and deduce the field from this information.
+private predicate aliasedReadStep(Node node1, FieldContent f, Node node2) {
+  exists(LoadOperand operand, Class c, int startBit, int endBit |
+    // Ensure that we don't already catch this store step using a `FieldNode`.
+    not exists(FieldNode node |
+      getFieldNodeFromLoadOperand(node, operand) and
+      instrToFieldNodeReadStep(node, f, _)
+    ) and
+    node1.asInstruction() = operand.getAnyDef() and
+    node2.asOperand() = operand and
+    not node1.asInstruction().isResultConflated() and
+    c = operand.getAnyDef().getResultType() and
+    f.hasOffset(c, startBit, endBit) and
+    operand.getUsedInterval(unbindInt(startBit), unbindInt(endBit))
+  )
+}
+
 /**
  * In cases such as:
  * ```cpp
@@ -417,21 +475,23 @@ private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
  * f(&x);
  * use(x);
  * ```
- * the load on `x` in `use(x)` will exactly overlap with its definition (in this case the definition
- * is a `WriteSideEffect`). This predicate pops the `ArrayContent` (pushed by the store in `f`)
- * from the access path.
+ * the store to `*pa` in `f` will push `ArrayContent` onto the access path. The `innerRead` predicate
+ * pops the `ArrayContent` off the access path when a value-to-pointer or value-to-reference conversion
+ * happens on the argument that is ends up as the target of such a store.
  */
-private predicate exactReadStep(Node node1, ArrayContent a, Node node2) {
+private predicate innerReadSteap(Node node1, Content a, Node node2) {
   a = TArrayContent() and
-  exists(WriteSideEffectInstruction write, ChiInstruction chi |
-    not chi.isResultConflated() and
-    chi.getPartial() = write and
+  exists(WriteSideEffectInstruction write, CallInstruction call, Expr arg |
+    write.getPrimaryInstruction() = call and
     node1.asInstruction() = write and
-    node2.asInstruction() = chi and
-    // To distinquish this case from the `arrayReadStep` case we require that the entire variable was
-    // overwritten by the `WriteSideEffectInstruction` (i.e., there is a load that reads the
-    // entire variable).
-    exists(LoadInstruction load | load.getSourceValue() = chi)
+    (
+      not exists(ChiInstruction chi | chi.getPartial() = write)
+      or
+      exists(ChiInstruction chi | chi.getPartial() = write and not chi.isResultConflated())
+    ) and
+    node2.asInstruction() = write and
+    arg = call.getArgument(write.getIndex()).getUnconvertedResultExpression() and
+    (arg instanceof AddressOfExpr or arg.getConversion() instanceof ReferenceToExpr)
   )
 }
 
@@ -441,10 +501,10 @@ private predicate exactReadStep(Node node1, ArrayContent a, Node node2) {
  * `node2`.
  */
 predicate readStep(Node node1, Content f, Node node2) {
-  fieldReadStep(node1, f, node2) or
+  aliasedReadStep(node1, f, node2) or
   arrayReadStep(node1, f, node2) or
-  exactReadStep(node1, f, node2) or
-  suppressArrayRead(node1, f, node2)
+  instrToFieldNodeReadStep(node1, f, node2) or
+  innerReadSteap(node1, f, node2)
 }
 
 /**

From 7a2b69feedde326afb2ab1d5181cfd5aae71d086 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sat, 5 Dec 2020 15:24:32 +0100
Subject: [PATCH 032/343] C++: Add partial definition class backed by an IPA.

---
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 248 ++++++++++--------
 1 file changed, 140 insertions(+), 108 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index f894c0d905e..39e232e68b3 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -18,7 +18,8 @@ private newtype TIRDataFlowNode =
   TVariableNode(Variable var) or
   // `FieldNodes` are used as targets of certain `storeStep`s to implement handling of stores to
   // nested structs.
-  TFieldNode(FieldAddressInstruction field)
+  TFieldNode(FieldAddressInstruction field) or
+  TPartialDefinitionNode(PartialDefinition pd)
 
 /**
  * A node in a data flow graph.
@@ -258,6 +259,23 @@ class FieldNode extends Node, TFieldNode {
 
   override string toString() { result = this.getField().toString() }
 }
+
+/**
+ * INTERNAL: do not use. A `FieldNode` represents the state of an object after modifying one
+ * of its fields.
+ */
+class PostUpdateFieldNode extends PartialDefinition {
+  override FieldNode node;
+
+  override FieldNode getPreUpdateNode() { result = node }
+
+  override Expr getDefinedExpr() {
+    result = node.getFieldInstruction().getObjectAddress().getUnconvertedResultExpression()
+  }
+
+  Field getField() { result = node.getField() }
+}
+
 /**
  * An expression, viewed as a node in a data flow graph.
  */
@@ -395,11 +413,37 @@ deprecated class UninitializedNode extends Node {
  * This class exists to match the interface used by Java. There are currently no non-abstract
  * classes that extend it. When we implement field flow, we can revisit this.
  */
-abstract class PostUpdateNode extends InstructionNode {
+abstract class PostUpdateNode extends Node {
   /**
    * Gets the node before the state update.
    */
   abstract Node getPreUpdateNode();
+
+  override Function getFunction() { result = getPreUpdateNode().getFunction() }
+
+  override IRType getType() { result = getPreUpdateNode().getType() }
+
+  override Location getLocation() { result = getPreUpdateNode().getLocation() }
+}
+
+private newtype TPartialDefinition =
+  MkPartialDefinition(Node node) {
+    isPointerStoreNode(node, _, _) or
+    isArrayStoreNode(node, _, _) or
+    node instanceof FieldNode
+  }
+
+/** INTERNAL: do not use. A partial definition of a node. */
+abstract class PartialDefinition extends TPartialDefinition {
+  Node node;
+
+  PartialDefinition() { this = MkPartialDefinition(node) }
+
+  abstract Node getPreUpdateNode();
+
+  abstract Expr getDefinedExpr();
+
+  string toString() { result = node.toString() + " [partial definition]" }
 }
 
 /**
@@ -415,132 +459,73 @@ abstract class PostUpdateNode extends InstructionNode {
  * setY(&x); // a partial definition of the object `x`.
  * ```
  */
-abstract private class PartialDefinitionNode extends PostUpdateNode {
-  abstract Expr getDefinedExpr();
+class PartialDefinitionNode extends PostUpdateNode, TPartialDefinitionNode {
+  PartialDefinition pd;
+
+  PartialDefinitionNode() { this = TPartialDefinitionNode(pd) }
+
+  /** Gets the expression that is partially defined by this node, if any. */
+  Expr getDefinedExpr() { result = pd.getDefinedExpr() }
+
+  override Node getPreUpdateNode() { result = pd.getPreUpdateNode() }
+
+  PartialDefinition getPartialDefinition() { result = pd }
+
+  override string toString() { result = getPreUpdateNode().toString() + " [post update]" }
 }
 
-private class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
-  override ChiInstruction instr;
-  StoreInstruction store;
-
-  ExplicitFieldStoreQualifierNode() {
-    not instr.isResultConflated() and
-    instr.getPartial() = store and
-    (
-      instr.getUpdatedInterval(_, _) or
-      store.getDestinationAddress() instanceof FieldAddressInstruction
-    )
-  }
-
-  // By using an operand as the result of this predicate we avoid the dataflow inconsistency errors
-  // caused by having multiple nodes sharing the same pre update node. This inconsistency error can cause
-  // a tuple explosion in the big step dataflow relation since it can make many nodes be the entry node
-  // into a big step.
-  override Node getPreUpdateNode() { result.asOperand() = instr.getTotalOperand() }
-
-  override Expr getDefinedExpr() {
-    result =
-      store
-          .getDestinationAddress()
-          .(FieldAddressInstruction)
-          .getObjectAddress()
-          .getUnconvertedResultExpression()
-  }
-}
-
-/**
- * Not every store instruction generates a chi instruction that we can attach a PostUpdateNode to.
- * For instance, an update to a field of a struct containing only one field. For these cases we
- * attach the PostUpdateNode to the store instruction. There's no obvious pre update node for this case
- * (as the entire memory is updated), so `getPreUpdateNode` is implemented as `none()`.
- */
-private class ExplicitSingleFieldStoreQualifierNode extends PartialDefinitionNode {
-  override StoreInstruction instr;
-
-  ExplicitSingleFieldStoreQualifierNode() {
-    not exists(ChiInstruction chi | chi.getPartial() = instr) and
-    // Without this condition any store would create a `PostUpdateNode`.
-    instr.getDestinationAddress() instanceof FieldAddressInstruction
-  }
-
-  override Node getPreUpdateNode() { none() }
-
-  override Expr getDefinedExpr() {
-    result =
-      instr
-          .getDestinationAddress()
-          .(FieldAddressInstruction)
-          .getObjectAddress()
-          .getUnconvertedResultExpression()
-  }
-}
-
-private FieldAddressInstruction getFieldInstruction(Instruction instr) {
-  result = instr or
-  result = instr.(CopyValueInstruction).getUnary()
-}
-
-/**
- * The target of a `fieldStoreStepAfterArraySuppression` store step, which is used to convert
- * an `ArrayContent` to a `FieldContent` when the `WriteSideEffect` instruction stores
- * into a field. See the QLDoc for `suppressArrayRead` for an example of where such a conversion
- * is inserted.
- */
-private class WriteSideEffectFieldStoreQualifierNode extends PartialDefinitionNode {
-  override ChiInstruction instr;
-  WriteSideEffectInstruction write;
-  FieldAddressInstruction field;
-
-  WriteSideEffectFieldStoreQualifierNode() {
-    not instr.isResultConflated() and
-    instr.getPartial() = write and
-    field = getFieldInstruction(write.getDestinationAddress())
-  }
-
-  override Node getPreUpdateNode() { result.asOperand() = instr.getTotalOperand() }
-
-  override Expr getDefinedExpr() {
-    result = field.getObjectAddress().getUnconvertedResultExpression()
-  }
+private predicate isArrayStoreNode(
+  InstructionNode node, ChiInstruction chi, PointerAddInstruction add
+) {
+  chi = node.getInstruction() and
+  not chi.isResultConflated() and
+  exists(StoreInstruction store |
+    chi.getPartial() = store and
+    add = store.getDestinationAddress()
+  )
 }
 
 /**
  * The `PostUpdateNode` that is the target of a `arrayStoreStepChi` store step. The overriden
  * `ChiInstruction` corresponds to the instruction represented by `node2` in `arrayStoreStepChi`.
  */
-private class ArrayStoreNode extends PartialDefinitionNode {
-  override ChiInstruction instr;
+private class ArrayStoreNode extends PartialDefinition {
+  override InstructionNode node;
+  ChiInstruction chi;
   PointerAddInstruction add;
 
-  ArrayStoreNode() {
-    not instr.isResultConflated() and
-    exists(StoreInstruction store |
-      instr.getPartial() = store and
-      add = store.getDestinationAddress()
-    )
-  }
+  ArrayStoreNode() { isArrayStoreNode(node, chi, add) }
 
-  override Node getPreUpdateNode() { result.asOperand() = instr.getTotalOperand() }
+  override Node getPreUpdateNode() { result.asOperand() = chi.getTotalOperand() }
 
   override Expr getDefinedExpr() { result = add.getLeft().getUnconvertedResultExpression() }
 }
 
+private predicate isPointerStoreNode(InstructionNode node, ChiInstruction chi, LoadInstruction load) {
+  chi = node.getInstruction() and
+  not chi.isResultConflated() and
+  exists(StoreInstruction store |
+    chi.getPartial() = store and
+    load = store.getDestinationAddress().(CopyValueInstruction).getUnary()
+  )
+}
+
 /**
  * The `PostUpdateNode` that is the target of a `arrayStoreStepChi` store step. The overriden
  * `ChiInstruction` corresponds to the instruction represented by `node2` in `arrayStoreStepChi`.
  */
-private class PointerStoreNode extends PostUpdateNode {
-  override ChiInstruction instr;
+private class PointerStoreNode extends PartialDefinition {
+  override InstructionNode node;
+  ChiInstruction chi;
+  LoadInstruction load;
 
-  PointerStoreNode() {
-    not instr.isResultConflated() and
-    exists(StoreInstruction store |
-      instr.getPartial() = store and
-      store.getDestinationAddress().(CopyValueInstruction).getUnary() instanceof LoadInstruction
-    )
+  PointerStoreNode() { isPointerStoreNode(node, chi, load) }
+
+  override Node getPreUpdateNode() { result.asOperand() = chi.getTotalOperand() }
+
+  override Expr getDefinedExpr() {
+    result = load.getSourceAddress().getUnconvertedResultExpression()
   }
-
-  override Node getPreUpdateNode() { result.asOperand() = instr.getTotalOperand() }
 }
 
 /**
@@ -553,7 +538,7 @@ private class PointerStoreNode extends PostUpdateNode {
  * returned. This node will have its `getArgument()` equal to `&x` and its
  * `getVariableAccess()` equal to `x`.
  */
-class DefinitionByReferenceNode extends InstructionNode {
+class DefinitionByReferenceNode extends InstructionNode, PostUpdateNode {
   override WriteSideEffectInstruction instr;
 
   /** Gets the unconverted argument corresponding to this node. */
@@ -581,6 +566,22 @@ class DefinitionByReferenceNode extends InstructionNode {
     not exists(instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget()) and
     result = "output argument"
   }
+
+  override Function getFunction() { result = instr.getEnclosingFunction() }
+
+  override IRType getType() { result = instr.getResultIRType() }
+
+  override Location getLocation() { result = instr.getLocation() }
+
+  // Make the read side effect's side effect operand the pre update node of this write side effect.
+  // This ensures that we match up the parameter index of the parameter indirection's modification.
+  override Node getPreUpdateNode() {
+    exists(ReadSideEffectInstruction read |
+      read.getPrimaryInstruction() = instr.getPrimaryInstruction() and
+      read.getArgumentDef() = instr.getDestinationAddress() and
+      result.asOperand() = read.getSideEffectOperand()
+    )
+  }
 }
 
 /**
@@ -673,6 +674,35 @@ Node uninitializedNode(LocalVariable v) { none() }
  */
 predicate localFlowStep(Node nodeFrom, Node nodeTo) { simpleLocalFlowStep(nodeFrom, nodeTo) }
 
+private predicate flowOutOfPostUpdate(PartialDefinitionNode nodeFrom, Node nodeTo) {
+  // flow from the "outermost" field to the `ChiInstruction`, or `StoreInstruction`
+  // if no `ChiInstruction` exists.
+  exists(AddressOperand addressOperand, PostUpdateFieldNode pd |
+    pd = nodeFrom.getPartialDefinition() and
+    not exists(pd.getPreUpdateNode().getObjectNode()) and
+    pd.getPreUpdateNode().getNextNode*() = getFieldNodeForFieldInstruction(addressOperand.getDef()) and
+    (
+      exists(ChiInstruction chi |
+        nodeTo.asInstruction() = chi and
+        chi.getPartial().getAnOperand() = addressOperand
+      )
+      or
+      exists(StoreInstruction store |
+        not exists(ChiInstruction chi | chi.getPartial() = store) and
+        nodeTo.asInstruction() = store and
+        store.getDestinationAddressOperand() = addressOperand
+      )
+    )
+  )
+  or
+  // Note: This partial definition cannot be a `PostUpdateFieldNode` since these nodes do not have an
+  // operand node as their pre update node.
+  exists(PartialDefinition pd |
+    pd = nodeFrom.getPartialDefinition() and
+    nodeTo.asInstruction().(ChiInstruction).getTotalOperand() = pd.getPreUpdateNode().asOperand()
+  )
+}
+
 private predicate flowIntoReadNode(Node nodeFrom, Node nodeTo) {
   // flow from the "innermost" field to the load of that field.
   exists(FieldNode fieldNode | nodeTo = fieldNode |
@@ -715,6 +745,8 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
   simpleOperandLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asOperand())
   or
   flowIntoReadNode(nodeFrom, nodeTo)
+  or
+  flowOutOfPostUpdate(nodeFrom, nodeTo)
 }
 
 pragma[noinline]

From f5a2603cc10d25271466ef6ceabe4664aa955cc9 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sat, 5 Dec 2020 15:25:43 +0100
Subject: [PATCH 033/343] C++: Add store steps that target the new partial
 definitions.

---
 .../ir/dataflow/internal/DataFlowPrivate.qll  | 193 +++++++-----------
 1 file changed, 69 insertions(+), 124 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index 81769801c7d..73649da7594 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -228,69 +228,86 @@ private class ArrayContent extends Content, TArrayContent {
   override string toString() { result = "array content" }
 }
 
-private predicate fieldStoreStepNoChi(Node node1, FieldContent f, PostUpdateNode node2) {
-  exists(StoreInstruction store, Class c |
-    store = node2.asInstruction() and
+/**
+ * A store step from the value of a `StoreInstruction` to the "innermost" field of the destination.
+ * This predicate only holds when there is no `ChiInsturction` that merges the result of the
+ * `StoreInstruction` into a larger memory.
+ */
+private predicate instrToFieldNodeStoreStepNoChi(
+  Node node1, FieldContent f, PartialDefinitionNode node2
+) {
+  exists(StoreInstruction store, PostUpdateFieldNode post |
+    post = node2.getPartialDefinition() and
+    not exists(ChiInstruction chi | chi.getPartial() = store) and
+    post.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
     store.getSourceValueOperand() = node1.asOperand() and
-    getWrittenField(store, f.(FieldContent).getAField(), c) and
-    f.hasOffset(c, _, _)
+    f.getADirectField() = post.getField()
   )
 }
 
-private FieldAddressInstruction getFieldInstruction(Instruction instr) {
-  result = instr or
-  result = instr.(CopyValueInstruction).getUnary()
-}
-
-pragma[noinline]
-private predicate getWrittenField(Instruction instr, Field f, Class c) {
-  exists(FieldAddressInstruction fa |
-    fa =
-      getFieldInstruction([
-          instr.(StoreInstruction).getDestinationAddress(),
-          instr.(WriteSideEffectInstruction).getDestinationAddress()
-        ]) and
-    f = fa.getField() and
-    c = f.getDeclaringType()
-  )
-}
-
-private predicate fieldStoreStepChi(Node node1, FieldContent f, PostUpdateNode node2) {
-  exists(ChiPartialOperand operand, ChiInstruction chi |
-    chi.getPartialOperand() = operand and
+/**
+ * A store step from a `StoreInstruction` to the "innermost" field
+ * of the destination. This predicate only holds when there exists a `ChiInstruction` that merges the
+ * result of the `StoreInstruction` into a larger memory.
+ */
+private predicate instrToFieldNodeStoreStepChi(
+  Node node1, FieldContent f, PartialDefinitionNode node2
+) {
+  exists(
+    ChiPartialOperand operand, StoreInstruction store, ChiInstruction chi, PostUpdateFieldNode post
+  |
+    post = node2.getPartialDefinition() and
+    not chi.isResultConflated() and
     node1.asOperand() = operand and
-    node2.asInstruction() = chi and
-    exists(Class c |
-      c = chi.getResultType() and
-      exists(int startBit, int endBit |
-        chi.getUpdatedInterval(startBit, endBit) and
-        f.hasOffset(c, startBit, endBit)
-      )
-      or
-      getWrittenField(operand.getDef(), f.getAField(), c) and
-      f.hasOffset(c, _, _)
-    )
+    chi.getPartialOperand() = operand and
+    store = operand.getDef() and
+    post.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
+    f.getADirectField() = post.getField()
   )
 }
 
-private predicate arrayStoreStepChi(Node node1, ArrayContent a, PostUpdateNode node2) {
+private predicate callableWithoutDefinitionStoreStep(
+  Node node1, FieldContent f, PartialDefinitionNode node2
+) {
+  exists(
+    WriteSideEffectInstruction write, ChiInstruction chi, PostUpdateFieldNode post,
+    Function callable
+  |
+    chi.getPartial() = write and
+    not chi.isResultConflated() and
+    post = node2.getPartialDefinition() and
+    node1.asInstruction() = write and
+    post.getPreUpdateNode() = getFieldNodeForFieldInstruction(write.getDestinationAddress()) and
+    f.getADirectField() = post.getField() and
+    callable = write.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() and
+    not callable.hasDefinition()
+  )
+}
+
+/**
+ * A store step from a `StoreInstruction` to the `ChiInstruction` generated from assigning
+ * to a pointer or array indirection
+ */
+private predicate arrayStoreStepChi(Node node1, ArrayContent a, PartialDefinitionNode node2) {
   a = TArrayContent() and
-  exists(ChiPartialOperand operand, ChiInstruction chi, StoreInstruction store |
+  exists(
+    ChiPartialOperand operand, ChiInstruction chi, StoreInstruction store, PartialDefinition pd
+  |
+    pd = node2.getPartialDefinition() and
     chi.getPartialOperand() = operand and
     store = operand.getDef() and
     node1.asOperand() = operand and
     // This `ChiInstruction` will always have a non-conflated result because both `ArrayStoreNode`
     // and `PointerStoreNode` require it in their characteristic predicates.
-    node2.asInstruction() = chi and
-    (
-      // `x[i] = taint()`
-      // This matches the characteristic predicate in `ArrayStoreNode`.
-      store.getDestinationAddress() instanceof PointerAddInstruction
-      or
-      // `*p = taint()`
-      // This matches the characteristic predicate in `PointerStoreNode`.
-      store.getDestinationAddress().(CopyValueInstruction).getUnary() instanceof LoadInstruction
-    )
+    pd.getPreUpdateNode().asOperand() = chi.getTotalOperand()
+  |
+    // `x[i] = taint()`
+    // This matches the characteristic predicate in `ArrayStoreNode`.
+    store.getDestinationAddress() instanceof PointerAddInstruction
+    or
+    // `*p = taint()`
+    // This matches the characteristic predicate in `PointerStoreNode`.
+    store.getDestinationAddress().(CopyValueInstruction).getUnary() instanceof LoadInstruction
   )
 }
 
@@ -300,82 +317,10 @@ private predicate arrayStoreStepChi(Node node1, ArrayContent a, PostUpdateNode n
  * value of `node1`.
  */
 predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
-  fieldStoreStepNoChi(node1, f, node2) or
-  fieldStoreStepChi(node1, f, node2) or
+  instrToFieldNodeStoreStepNoChi(node1, f, node2) or
+  instrToFieldNodeStoreStepChi(node1, f, node2) or
   arrayStoreStepChi(node1, f, node2) or
-  fieldStoreStepAfterArraySuppression(node1, f, node2)
-}
-
-// This predicate pushes the correct `FieldContent` onto the access path when the
-// `suppressArrayRead` predicate has popped off an `ArrayContent`.
-private predicate fieldStoreStepAfterArraySuppression(
-  Node node1, FieldContent f, PostUpdateNode node2
-) {
-  exists(WriteSideEffectInstruction write, ChiInstruction chi, Class c |
-    not chi.isResultConflated() and
-    node1.asInstruction() = chi and
-    node2.asInstruction() = chi and
-    chi.getPartial() = write and
-    getWrittenField(write, f.getAField(), c) and
-    f.hasOffset(c, _, _)
-  )
-}
-
-bindingset[result, i]
-private int unbindInt(int i) { i <= result and i >= result }
-
-pragma[noinline]
-private predicate getLoadedField(LoadInstruction load, Field f, Class c) {
-  exists(FieldAddressInstruction fa |
-    fa = load.getSourceAddress() and
-    f = fa.getField() and
-    c = f.getDeclaringType()
-  )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` via a read of `f`.
- * Thus, `node1` references an object with a field `f` whose value ends up in
- * `node2`.
- */
-private predicate fieldReadStep(Node node1, FieldContent f, Node node2) {
-  exists(LoadOperand operand |
-    node2.asOperand() = operand and
-    node1.asInstruction() = operand.getAnyDef() and
-    exists(Class c |
-      c = operand.getAnyDef().getResultType() and
-      exists(int startBit, int endBit |
-        operand.getUsedInterval(unbindInt(startBit), unbindInt(endBit)) and
-        f.hasOffset(c, startBit, endBit)
-      )
-      or
-      getLoadedField(operand.getUse(), f.getAField(), c) and
-      f.hasOffset(c, _, _)
-    )
-  )
-}
-
-/**
- * When a store step happens in a function that looks like an array write such as:
- * ```cpp
- * void f(int* pa) {
- *   pa = source();
- * }
- * ```
- * it can be a write to an array, but it can also happen that `f` is called as `f(&a.x)`. If that is
- * the case, the `ArrayContent` that was written by the call to `f` should be popped off the access
- * path, and a `FieldContent` containing `x` should be pushed instead.
- * So this case pops `ArrayContent` off the access path, and the `fieldStoreStepAfterArraySuppression`
- * predicate in `storeStep` ensures that we push the right `FieldContent` onto the access path.
- */
-predicate suppressArrayRead(Node node1, ArrayContent a, Node node2) {
-  a = TArrayContent() and
-  exists(WriteSideEffectInstruction write, ChiInstruction chi |
-    node1.asInstruction() = write and
-    node2.asInstruction() = chi and
-    chi.getPartial() = write and
-    getWrittenField(write, _, _)
-  )
+  callableWithoutDefinitionStoreStep(node1, f, node2)
 }
 
 private class ArrayToPointerConvertInstruction extends ConvertInstruction {

From 145ab17f6bca931e4c36f54148b1ce3035f2994e Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sat, 5 Dec 2020 15:26:24 +0100
Subject: [PATCH 034/343] Fix a bad join-order caused by the optimizer not
 seeing that `Node.getEnclosingCallable` is functional. This is fixed in the
 same way as in Java's DataFlowUtil: We make create a non-virtual dispatching
 `getEnclosingCallableImpl`, and implement `getEnclosingCallable` as a wrapper
 that uses the `unique` aggregate to tell the compiler that there is exactly 1
 result.

Tuple numbers from an arbitrarily chosen iteration of
DataFlowImpl3::Stage4::fwdFlow0#fffff.

Before:
4569      ~5%        {5} r24 = SCAN DataFlowImpl3::Stage4::fwdFlow#fffff#prev_delta AS I OUTPUT I.<0>, I.<4> 'config', I.<1>, I.<2>, I.<3>
2876      ~1%        {5} r25 = JOIN r24 WITH DataFlowImpl3::LocalFlowBigStep::localFlowEntry#ff AS R ON FIRST 2 OUTPUT r24.<2> 'cc', r24.<0>, r24.<3> 'argAp', r24.<4>, r24.<1> 'config'
409404537 ~0%        {6} r26 = JOIN r25 WITH DataFlowImplCommon::getLocalCallContext#cpe#12#ff AS R ON FIRST 1 OUTPUT r25.<1>, R.<1>, r25.<0> 'cc', r25.<2> 'argAp', r25.<3>, r25.<4> 'config'
2876      ~0%        {6} r27 = JOIN r26 WITH DataFlowUtil::Node::getEnclosingCallable_dispred#ff AS R ON FIRST 2 OUTPUT r26.<0>, true, r26.<5> 'config', r26.<2> 'cc', r26.<3> 'argAp', r26.<4>
79821     ~1781%     {5} r28 = JOIN r27 WITH DataFlowImpl3::Stage4::localStep#ffbfff_0241#join_rhs AS R ON FIRST 3 OUTPUT r27.<3> 'cc', r27.<4> 'argAp', r27.<2> 'config', r27.<5> 'ap', R.<3> 'node'
2876      ~0%        {5} r29 = JOIN r26 WITH DataFlowUtil::Node::getEnclosingCallable_dispred#ff AS R ON FIRST 2 OUTPUT r26.<4>, r26.<0>, r26.<2> 'cc', r26.<3> 'argAp', r26.<5> 'config'
0         ~0%        {5} r30 = JOIN r29 WITH DataFlowImpl3::TNil#ff_1#join_rhs AS R ON FIRST 1 OUTPUT r29.<1>, false, r29.<4> 'config', r29.<2> 'cc', r29.<3> 'argAp'
0         ~0%        {5} r31 = JOIN r30 WITH DataFlowImpl3::Stage4::localStep#ffbfff_02413#join_rhs AS R ON FIRST 3 OUTPUT r30.<3> 'cc', r30.<4> 'argAp', r30.<2> 'config', R.<4> 'ap', R.<3> 'node'
4569      ~157%      {6} r32 = JOIN DataFlowImpl3::Stage4::fwdFlow0#fffff#join_rhs AS L WITH DataFlowImpl3::Stage4::fwdFlow#fffff#prev_delta AS R CARTESIAN PRODUCT OUTPUT R.<3>, L.<0> 'ap', L.<1> 'cc', L.<2> 'argAp', R.<0>, R.<4> 'config'
0         ~0%        {5} r33 = JOIN r32 WITH DataFlowImpl3::TNil#ff_1#join_rhs AS R ON FIRST 1 OUTPUT r32.<4>, r32.<5> 'config', r32.<1> 'ap', r32.<2> 'cc', r32.<3> 'argAp'
0         ~0%        {5} r34 = JOIN r33 WITH DataFlowImpl3::additionalJumpStep#fff_021#join_rhs AS R ON FIRST 2 OUTPUT R.<2> 'node', r33.<2> 'ap', r33.<3> 'cc', r33.<4> 'argAp', r33.<1> 'config'
0         ~0%        {5} r35 = JOIN r34 WITH DataFlowUtil::TIRDataFlowNode#f@staged_ext AS R ON FIRST 1 OUTPUT r34.<0> 'node', r34.<1> 'ap', r34.<2> 'cc', r34.<3> 'argAp', r34.<4> 'config'
0         ~0%        {6} r36 = JOIN r35 WITH project#DataFlowImpl3::Stage3::revFlow#fffff#12 AS R ON FIRST 1 OUTPUT r35.<1> 'ap', r35.<2> 'cc', r35.<3> 'argAp', r35.<4> 'config', r35.<0> 'node', R.<1>

After:
4569     ~0%        {5} r24 = SCAN DataFlowImpl3::Stage4::fwdFlow#fffff#prev_delta AS I OUTPUT I.<0>, I.<4> 'config', I.<1>, I.<2>, I.<3>
2876     ~0%        {5} r25 = JOIN r24 WITH DataFlowImpl3::LocalFlowBigStep::localFlowEntry#ff AS R ON FIRST 2 OUTPUT r24.<0>, r24.<2> 'cc', r24.<3> 'argAp', r24.<4>, r24.<1> 'config'
2876     ~0%        {6} r26 = JOIN r25 WITH DataFlowUtil::Node::getEnclosingCallable_dispred#ff AS R ON FIRST 1 OUTPUT r25.<1> 'cc', R.<1>, r25.<0>, r25.<2> 'argAp', r25.<3>, r25.<4> 'config'
2876     ~0%        {6} r27 = JOIN r26 WITH DataFlowImplCommon::getLocalCallContext#cpe#12#fb AS R ON FIRST 2 OUTPUT r26.<2>, true, r26.<5> 'config', r26.<0> 'cc', r26.<3> 'argAp', r26.<4>
79821    ~1862%     {5} r28 = JOIN r27 WITH DataFlowImpl3::Stage4::localStep#ffbfff_0241#join_rhs AS R ON FIRST 3 OUTPUT r27.<3> 'cc', r27.<4> 'argAp', r27.<2> 'config', r27.<5> 'ap', R.<3> 'node'
2876     ~0%        {5} r29 = JOIN r26 WITH DataFlowImplCommon::getLocalCallContext#cpe#12#fb AS R ON FIRST 2 OUTPUT r26.<4>, r26.<2>, r26.<0> 'cc', r26.<3> 'argAp', r26.<5> 'config'
0        ~0%        {5} r30 = JOIN r29 WITH DataFlowImpl3::TNil#ff_1#join_rhs AS R ON FIRST 1 OUTPUT r29.<1>, false, r29.<4> 'config', r29.<2> 'cc', r29.<3> 'argAp'
0        ~0%        {5} r31 = JOIN r30 WITH DataFlowImpl3::Stage4::localStep#ffbfff_02413#join_rhs AS R ON FIRST 3 OUTPUT r30.<3> 'cc', r30.<4> 'argAp', r30.<2> 'config', R.<4> 'ap', R.<3> 'node'
4569     ~148%      {6} r32 = JOIN DataFlowImpl3::Stage4::fwdFlow0#fffff#join_rhs AS L WITH DataFlowImpl3::Stage4::fwdFlow#fffff#prev_delta AS R CARTESIAN PRODUCT OUTPUT R.<3>, L.<0> 'ap', L.<1> 'cc', L.<2> 'argAp', R.<0>, R.<4> 'config'
0        ~0%        {5} r33 = JOIN r32 WITH DataFlowImpl3::TNil#ff_1#join_rhs AS R ON FIRST 1 OUTPUT r32.<4>, r32.<5> 'config', r32.<1> 'ap', r32.<2> 'cc', r32.<3> 'argAp'
0        ~0%        {5} r34 = JOIN r33 WITH DataFlowImpl3::additionalJumpStep#fff_021#join_rhs AS R ON FIRST 2 OUTPUT R.<2> 'node', r33.<2> 'ap', r33.<3> 'cc', r33.<4> 'argAp', r33.<1> 'config'
0        ~0%        {5} r35 = JOIN r34 WITH DataFlowUtil::TIRDataFlowNode#f@staged_ext AS R ON FIRST 1 OUTPUT r34.<0> 'node', r34.<1> 'ap', r34.<2> 'cc', r34.<3> 'argAp', r34.<4> 'config'
0        ~0%        {6} r36 = JOIN r35 WITH project#DataFlowImpl3::Stage3::revFlow#fffff#12 AS R ON FIRST 1 OUTPUT r35.<1> 'ap', r35.<2> 'cc', r35.<3> 'argAp', r35.<4> 'config', r35.<0> 'node', R.<1>
---
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 30 ++++++++++---------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 39e232e68b3..318ddf9c48d 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -32,7 +32,22 @@ class Node extends TIRDataFlowNode {
   /**
    * INTERNAL: Do not use.
    */
-  Declaration getEnclosingCallable() { none() } // overridden in subclasses
+  final Declaration getEnclosingCallable() {
+    result = unique(Declaration d | d = this.getEnclosingCallableImpl() | d)
+  }
+
+  final private Declaration getEnclosingCallableImpl() {
+    result = this.asInstruction().getEnclosingFunction() or
+    result = this.asOperand().getUse().getEnclosingFunction() or
+    // When flow crosses from one _enclosing callable_ to another, the
+    // interprocedural data-flow library discards call contexts and inserts a
+    // node in the big-step relation used for human-readable path explanations.
+    // Therefore we want a distinct enclosing callable for each `VariableNode`,
+    // and that can be the `Variable` itself.
+    result = this.asVariable() or
+    result = this.(FieldNode).getFieldInstruction().getEnclosingFunction() or
+    result = this.(PartialDefinitionNode).getPreUpdateNode().getFunction()
+  }
 
   /** Gets the function to which this node belongs, if any. */
   Function getFunction() { none() } // overridden in subclasses
@@ -137,8 +152,6 @@ class InstructionNode extends Node, TInstructionNode {
   /** Gets the instruction corresponding to this node. */
   Instruction getInstruction() { result = instr }
 
-  override Declaration getEnclosingCallable() { result = this.getFunction() }
-
   override Function getFunction() { result = instr.getEnclosingFunction() }
 
   override IRType getType() { result = instr.getResultIRType() }
@@ -163,8 +176,6 @@ class OperandNode extends Node, TOperandNode {
   /** Gets the operand corresponding to this node. */
   Operand getOperand() { result = op }
 
-  override Declaration getEnclosingCallable() { result = this.getFunction() }
-
   override Function getFunction() { result = op.getUse().getEnclosingFunction() }
 
   override IRType getType() { result = op.getIRType() }
@@ -599,15 +610,6 @@ class VariableNode extends Node, TVariableNode {
 
   override Function getFunction() { none() }
 
-  override Declaration getEnclosingCallable() {
-    // When flow crosses from one _enclosing callable_ to another, the
-    // interprocedural data-flow library discards call contexts and inserts a
-    // node in the big-step relation used for human-readable path explanations.
-    // Therefore we want a distinct enclosing callable for each `VariableNode`,
-    // and that can be the `Variable` itself.
-    result = v
-  }
-
   override IRType getType() { result.getCanonicalLanguageType().hasUnspecifiedType(v.getType(), _) }
 
   override Location getLocation() { result = v.getLocation() }

From 72a80e37228d0aa737601f2217cb16dce72160ac Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sat, 5 Dec 2020 15:41:39 +0100
Subject: [PATCH 035/343] C++: Accept test changes.

---
 .../dataflow-ir-consistency.expected          |  65 +--
 .../dataflow/dataflow-tests/test.cpp          |   2 +-
 .../dataflow/fields/aliasing.cpp              |   4 +-
 .../fields/dataflow-ir-consistency.expected   | 203 +++-----
 .../dataflow/fields/ir-path-flow.expected     | 449 ++++++++++++------
 .../fields/partial-definition-diff.expected   | 247 ++++------
 .../fields/partial-definition-ir.expected     | 247 ++++++++++
 7 files changed, 724 insertions(+), 493 deletions(-)

diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
index fc6c97aa2a6..b9f6f717c80 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected
@@ -26,60 +26,21 @@ unreachableNodeCCtx
 localCallNodes
 postIsNotPre
 postHasUniquePre
+| dispatch.cpp:15:8:15:8 | Top output argument | PostUpdateNode should have one pre-update node but has 0. |
+| dispatch.cpp:21:8:21:8 | Middle output argument | PostUpdateNode should have one pre-update node but has 0. |
+| dispatch.cpp:60:18:60:29 | Bottom output argument | PostUpdateNode should have one pre-update node but has 0. |
+| dispatch.cpp:61:18:61:29 | Middle output argument | PostUpdateNode should have one pre-update node but has 0. |
+| dispatch.cpp:65:10:65:21 | Bottom output argument | PostUpdateNode should have one pre-update node but has 0. |
+| test.cpp:384:10:384:13 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
+| test.cpp:391:10:391:13 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
+| test.cpp:400:10:400:13 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
+| test.cpp:407:10:407:13 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
-| BarrierGuard.cpp:49:3:49:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| BarrierGuard.cpp:60:3:60:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:28:3:28:34 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:34:22:34:27 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:34:32:34:37 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:39:32:39:37 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:39:42:39:47 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:43:35:43:40 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:43:51:43:51 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:49:25:49:30 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:49:35:49:40 | Chi | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:50:3:50:26 | Chi | PostUpdateNode should not be the target of local flow. |
-| example.c:17:19:17:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| example.c:17:21:17:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| example.c:24:2:24:30 | Chi | PostUpdateNode should not be the target of local flow. |
-| example.c:24:13:24:30 | Chi | PostUpdateNode should not be the target of local flow. |
-| example.c:26:2:26:25 | Chi | PostUpdateNode should not be the target of local flow. |
-| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
-| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
-| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:13:12:13:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:13:15:13:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:28:10:31:2 | Chi | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:28:10:31:2 | Chi | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:43:3:43:14 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:11:5:11:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:20:5:20:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:22:7:22:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:24:7:24:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:29:5:29:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:31:7:31:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:39:7:39:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:44:5:44:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:46:7:46:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:48:7:48:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:75:5:75:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:83:5:83:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:87:7:87:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:89:7:89:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:94:5:94:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:96:7:96:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:104:7:104:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:109:5:109:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:113:7:113:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:115:7:115:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| test.cpp:91:3:91:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| test.cpp:115:3:115:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| test.cpp:120:3:120:10 | Chi | PostUpdateNode should not be the target of local flow. |
-| test.cpp:125:3:125:11 | Chi | PostUpdateNode should not be the target of local flow. |
-| test.cpp:359:5:359:20 | Chi | PostUpdateNode should not be the target of local flow. |
-| test.cpp:373:5:373:20 | Chi | PostUpdateNode should not be the target of local flow. |
-| test.cpp:465:3:465:15 | Chi | PostUpdateNode should not be the target of local flow. |
+| test.cpp:384:10:384:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
+| test.cpp:391:10:391:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
+| test.cpp:400:10:400:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
+| test.cpp:407:10:407:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
index f59552aa2dd..774ecddeab2 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
@@ -362,7 +362,7 @@ class FlowThroughFields {
   int f() {
     sink(field); // tainted or clean? Not sure.
     taintField();
-    sink(field); // $ ast MISSING: ir
+    sink(field); // $ ast,ir
   }
 
   int calledAfterTaint() {
diff --git a/cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp b/cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp
index 8b3c0f29ab2..833e85600a6 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp
+++ b/cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp
@@ -210,7 +210,7 @@ void test_deep_struct_fields() {
   S2 s2;
   s2.s.m1 = user_input();
   S s = s2.s;
-  sink(s.m1); // $ ast MISSING: ir
+  sink(s.m1); // $ ast,ir
 }
 
 void test_deep_struct_fields_no_flow() {
@@ -224,7 +224,7 @@ void test_deep_struct_fields_taint_through_call() {
   S2 s2;
   taint_a_ptr(&s2.s.m1);
   S s = s2.s;
-  sink(s.m1); // $ ast MISSING: ir
+  sink(s.m1); // $ ast,ir
 }
 
 void test_deep_struct_fields_taint_through_call_no_flow() {
diff --git a/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected b/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
index 23f8d07717f..e79aeea7e8e 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
@@ -16,149 +16,70 @@ unreachableNodeCCtx
 localCallNodes
 postIsNotPre
 postHasUniquePre
-| simple.cpp:65:5:65:22 | Store | PostUpdateNode should have one pre-update node but has 0. |
-| simple.cpp:92:5:92:22 | Store | PostUpdateNode should have one pre-update node but has 0. |
-| simple.cpp:104:5:104:24 | Store | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:9:9:9:9 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:14:9:14:9 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:31:14:31:21 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:38:7:38:8 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:39:7:39:8 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:41:15:41:21 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:47:12:47:18 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:54:12:54:18 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:55:12:55:19 | C1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:57:11:57:24 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:57:17:57:23 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:62:13:62:19 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:64:21:64:28 | C2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:71:13:71:19 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:73:25:73:32 | C2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:89:15:89:21 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:99:14:99:21 | C1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:116:12:116:19 | C1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:126:12:126:18 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:130:12:130:18 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:142:14:142:20 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:143:25:143:31 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:150:12:150:18 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:151:12:151:24 | D output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:159:12:159:18 | B output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:160:18:160:60 | MyList output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:160:32:160:59 | MyList output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:161:18:161:40 | MyList output argument | PostUpdateNode should have one pre-update node but has 0. |
+| A.cpp:162:18:162:40 | MyList output argument | PostUpdateNode should have one pre-update node but has 0. |
+| B.cpp:7:16:7:35 | Box1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| B.cpp:8:16:8:27 | Box2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| B.cpp:16:16:16:38 | Box1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| B.cpp:17:16:17:27 | Box2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| C.cpp:18:12:18:18 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:29:15:29:41 | Box2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:29:24:29:40 | Box1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:36:15:36:41 | Box2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:36:24:36:40 | Box1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:43:15:43:41 | Box2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:43:24:43:40 | Box1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:50:15:50:41 | Box2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:50:24:50:40 | Box1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:57:16:57:42 | Box2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| D.cpp:57:25:57:41 | Box1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| complex.cpp:22:11:22:17 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
+| complex.cpp:25:7:25:7 | Bar output argument | PostUpdateNode should have one pre-update node but has 0. |
+| complex.cpp:48:9:48:10 | Outer output argument | PostUpdateNode should have one pre-update node but has 0. |
+| complex.cpp:49:9:49:10 | Outer output argument | PostUpdateNode should have one pre-update node but has 0. |
+| complex.cpp:50:9:50:10 | Outer output argument | PostUpdateNode should have one pre-update node but has 0. |
+| complex.cpp:51:9:51:10 | Outer output argument | PostUpdateNode should have one pre-update node but has 0. |
+| constructors.cpp:34:11:34:26 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
+| constructors.cpp:35:11:35:26 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
+| constructors.cpp:36:11:36:37 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
+| constructors.cpp:37:11:37:15 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
+| realistic.cpp:54:16:54:47 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
+| realistic.cpp:60:16:60:18 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
+| simple.cpp:34:11:34:15 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
+| simple.cpp:35:11:35:15 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
+| simple.cpp:36:11:36:15 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
+| simple.cpp:37:11:37:15 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
-| A.cpp:25:7:25:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| A.cpp:27:22:27:32 | Chi | PostUpdateNode should not be the target of local flow. |
-| A.cpp:98:12:98:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| A.cpp:100:5:100:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| A.cpp:142:7:142:20 | Chi | PostUpdateNode should not be the target of local flow. |
-| A.cpp:143:7:143:31 | Chi | PostUpdateNode should not be the target of local flow. |
-| A.cpp:183:7:183:20 | Chi | PostUpdateNode should not be the target of local flow. |
-| A.cpp:184:7:184:23 | Chi | PostUpdateNode should not be the target of local flow. |
-| B.cpp:6:15:6:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| B.cpp:15:15:15:27 | Chi | PostUpdateNode should not be the target of local flow. |
-| B.cpp:35:7:35:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| B.cpp:36:7:36:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| B.cpp:46:7:46:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| C.cpp:22:12:22:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| C.cpp:22:12:22:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| C.cpp:24:5:24:25 | Chi | PostUpdateNode should not be the target of local flow. |
-| C.cpp:24:16:24:25 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:9:21:9:28 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:11:29:11:36 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:16:21:16:27 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:18:29:18:35 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:28:15:28:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:35:15:35:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:42:15:42:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:49:15:49:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:56:15:56:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| D.cpp:57:5:57:42 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:9:3:9:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:13:3:13:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:17:3:17:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:21:12:21:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:21:15:21:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:22:12:22:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:22:15:22:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:23:12:23:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:23:15:23:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:35:12:35:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:35:15:35:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:37:3:37:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:40:12:40:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:40:15:40:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:42:3:42:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:47:12:47:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:47:15:47:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:49:3:49:25 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:52:12:52:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:52:15:52:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:54:3:54:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:59:12:59:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:59:15:59:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:60:3:60:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:70:19:70:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:70:22:70:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:72:3:72:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:77:19:77:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:77:22:77:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:79:3:79:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:84:19:84:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:84:22:84:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:86:3:86:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:91:19:91:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:91:22:91:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:92:3:92:23 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:98:3:98:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:106:3:106:20 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:111:15:111:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:147:15:147:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:175:15:175:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:181:15:181:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:187:15:187:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:194:15:194:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:200:15:200:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:205:15:205:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:211:3:211:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:218:3:218:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:225:15:225:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| aliasing.cpp:232:15:232:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| arrays.cpp:5:18:5:23 | Chi | PostUpdateNode should not be the target of local flow. |
-| arrays.cpp:5:21:5:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| arrays.cpp:6:3:6:23 | Chi | PostUpdateNode should not be the target of local flow. |
-| arrays.cpp:14:18:14:23 | Chi | PostUpdateNode should not be the target of local flow. |
-| arrays.cpp:14:21:14:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| arrays.cpp:15:3:15:25 | Chi | PostUpdateNode should not be the target of local flow. |
-| arrays.cpp:36:3:36:37 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:12:5:12:16 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:16:5:16:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:84:3:84:25 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:88:3:88:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:92:3:92:20 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:96:3:96:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:102:21:102:39 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:104:15:104:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:106:21:106:41 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:108:15:108:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:122:21:122:38 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:124:15:124:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:126:21:126:40 | Chi | PostUpdateNode should not be the target of local flow. |
-| by_reference.cpp:128:15:128:23 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:11:22:11:27 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:12:22:12:27 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:14:26:14:26 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:14:33:14:33 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:22:11:22:17 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:25:7:25:7 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:42:16:42:16 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:43:16:43:16 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:53:12:53:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:54:12:54:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:55:12:55:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| complex.cpp:56:12:56:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| constructors.cpp:20:24:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
-| constructors.cpp:21:24:21:29 | Chi | PostUpdateNode should not be the target of local flow. |
-| constructors.cpp:23:28:23:28 | Chi | PostUpdateNode should not be the target of local flow. |
-| constructors.cpp:23:35:23:35 | Chi | PostUpdateNode should not be the target of local flow. |
-| qualifiers.cpp:9:30:9:44 | Chi | PostUpdateNode should not be the target of local flow. |
-| qualifiers.cpp:12:49:12:64 | Chi | PostUpdateNode should not be the target of local flow. |
-| qualifiers.cpp:13:51:13:65 | Chi | PostUpdateNode should not be the target of local flow. |
-| realistic.cpp:39:12:39:95 | Chi | PostUpdateNode should not be the target of local flow. |
-| realistic.cpp:49:9:49:64 | Chi | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:20:24:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:21:24:21:29 | Chi | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:23:28:23:28 | Chi | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:23:35:23:35 | Chi | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:65:5:65:22 | Store | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:83:9:83:28 | Chi | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:92:5:92:22 | Store | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:104:5:104:24 | Store | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:20:20:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:20:34:20:34 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:27:7:27:16 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:27:21:27:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:28:5:28:7 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:36:10:36:24 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:40:20:40:29 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:40:34:40:34 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:42:7:42:16 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:42:21:42:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| struct_init.c:43:5:43:7 | Chi | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:54:16:54:47 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
+| realistic.cpp:60:16:60:18 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
index c8b70a74b3a..e787b9a5f0e 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
@@ -4,50 +4,62 @@ edges
 | A.cpp:55:12:55:19 | new | A.cpp:55:5:55:5 | set output argument [c] |
 | A.cpp:57:11:57:24 | B output argument [c] | A.cpp:57:28:57:30 | call to get |
 | A.cpp:57:17:57:23 | new | A.cpp:57:11:57:24 | B output argument [c] |
-| A.cpp:98:12:98:18 | new | A.cpp:100:5:100:13 | Chi [a] |
-| A.cpp:100:5:100:13 | Chi [a] | A.cpp:103:14:103:14 | *c [a] |
-| A.cpp:103:14:103:14 | *c [a] | A.cpp:107:16:107:16 | a |
+| A.cpp:98:12:98:18 | new | A.cpp:100:9:100:9 | a [post update] [a] |
+| A.cpp:100:9:100:9 | a [post update] [a] | A.cpp:103:14:103:14 | *c [a] |
+| A.cpp:103:14:103:14 | *c [a] | A.cpp:107:16:107:16 | a [a] |
+| A.cpp:107:16:107:16 | a [a] | A.cpp:107:16:107:16 | a |
 | A.cpp:126:5:126:5 | Chi [c] | A.cpp:131:8:131:8 | f7 output argument [c] |
 | A.cpp:126:5:126:5 | set output argument [c] | A.cpp:126:5:126:5 | Chi [c] |
+| A.cpp:126:5:126:5 | set output argument [c] | A.cpp:131:8:131:8 | f7 output argument [c] |
 | A.cpp:126:12:126:18 | new | A.cpp:126:5:126:5 | set output argument [c] |
-| A.cpp:131:8:131:8 | Chi [c] | A.cpp:132:13:132:13 | c |
-| A.cpp:131:8:131:8 | f7 output argument [c] | A.cpp:131:8:131:8 | Chi [c] |
+| A.cpp:131:8:131:8 | f7 output argument [c] | A.cpp:132:13:132:13 | c [c] |
+| A.cpp:132:13:132:13 | c [c] | A.cpp:132:13:132:13 | c |
 | A.cpp:142:7:142:20 | Chi [c] | A.cpp:151:18:151:18 | D output argument [c] |
-| A.cpp:142:14:142:20 | new | A.cpp:142:7:142:20 | Chi [c] |
+| A.cpp:142:10:142:10 | c [post update] [c] | A.cpp:142:7:142:20 | Chi [c] |
+| A.cpp:142:10:142:10 | c [post update] [c] | A.cpp:151:18:151:18 | D output argument [c] |
+| A.cpp:142:14:142:20 | new | A.cpp:142:10:142:10 | c [post update] [c] |
 | A.cpp:143:7:143:31 | Chi [b] | A.cpp:151:12:151:24 | D output argument [b] |
-| A.cpp:143:25:143:31 | new | A.cpp:143:7:143:31 | Chi [b] |
+| A.cpp:143:13:143:13 | b [post update] [b] | A.cpp:143:7:143:31 | Chi [b] |
+| A.cpp:143:25:143:31 | new | A.cpp:143:13:143:13 | b [post update] [b] |
 | A.cpp:150:12:150:18 | new | A.cpp:151:12:151:24 | D output argument [b] |
-| A.cpp:151:12:151:24 | Chi [b] | A.cpp:152:13:152:13 | b |
-| A.cpp:151:12:151:24 | D output argument [b] | A.cpp:151:12:151:24 | Chi [b] |
-| A.cpp:151:18:151:18 | Chi [c] | A.cpp:154:13:154:13 | c |
-| A.cpp:151:18:151:18 | D output argument [c] | A.cpp:151:18:151:18 | Chi [c] |
+| A.cpp:151:12:151:24 | D output argument [b] | A.cpp:152:13:152:13 | b [b] |
+| A.cpp:151:18:151:18 | D output argument [c] | A.cpp:154:13:154:13 | c [c] |
+| A.cpp:152:13:152:13 | b [b] | A.cpp:152:13:152:13 | b |
+| A.cpp:154:13:154:13 | c [c] | A.cpp:154:13:154:13 | c |
 | C.cpp:18:12:18:18 | C output argument [s1] | C.cpp:27:8:27:11 | *#this [s1] |
 | C.cpp:18:12:18:18 | C output argument [s3] | C.cpp:27:8:27:11 | *#this [s3] |
-| C.cpp:22:12:22:21 | Chi [s1] | C.cpp:24:5:24:25 | Chi [s1] |
-| C.cpp:22:12:22:21 | new | C.cpp:22:12:22:21 | Chi [s1] |
+| C.cpp:22:9:22:22 | s1 [post update] [s1] | C.cpp:24:5:24:25 | Chi [s1] |
+| C.cpp:22:12:22:21 | new | C.cpp:22:9:22:22 | s1 [post update] [s1] |
 | C.cpp:24:5:24:25 | Chi [s1] | C.cpp:18:12:18:18 | C output argument [s1] |
 | C.cpp:24:5:24:25 | Chi [s3] | C.cpp:18:12:18:18 | C output argument [s3] |
-| C.cpp:24:16:24:25 | new | C.cpp:24:5:24:25 | Chi [s3] |
-| C.cpp:27:8:27:11 | *#this [s1] | C.cpp:29:10:29:11 | s1 |
-| C.cpp:27:8:27:11 | *#this [s3] | C.cpp:31:10:31:11 | s3 |
+| C.cpp:24:11:24:12 | s3 [post update] [s3] | C.cpp:24:5:24:25 | Chi [s3] |
+| C.cpp:24:16:24:25 | new | C.cpp:24:11:24:12 | s3 [post update] [s3] |
+| C.cpp:27:8:27:11 | *#this [s1] | C.cpp:29:10:29:11 | s1 [s1] |
+| C.cpp:27:8:27:11 | *#this [s3] | C.cpp:31:10:31:11 | s3 [s3] |
+| C.cpp:29:10:29:11 | s1 [s1] | C.cpp:29:10:29:11 | s1 |
+| C.cpp:31:10:31:11 | s3 [s3] | C.cpp:31:10:31:11 | s3 |
 | aliasing.cpp:9:3:9:22 | Chi [m1] | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] |
-| aliasing.cpp:9:11:9:20 | call to user_input | aliasing.cpp:9:3:9:22 | Chi [m1] |
+| aliasing.cpp:9:6:9:7 | m1 [post update] [m1] | aliasing.cpp:9:3:9:22 | Chi [m1] |
+| aliasing.cpp:9:6:9:7 | m1 [post update] [m1] | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] |
+| aliasing.cpp:9:11:9:20 | call to user_input | aliasing.cpp:9:6:9:7 | m1 [post update] [m1] |
 | aliasing.cpp:13:3:13:21 | Chi [m1] | aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] |
-| aliasing.cpp:13:10:13:19 | call to user_input | aliasing.cpp:13:3:13:21 | Chi [m1] |
-| aliasing.cpp:25:17:25:19 | Chi [m1] | aliasing.cpp:29:11:29:12 | m1 |
-| aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] | aliasing.cpp:25:17:25:19 | Chi [m1] |
-| aliasing.cpp:26:19:26:20 | Chi [m1] | aliasing.cpp:30:11:30:12 | m1 |
-| aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] | aliasing.cpp:26:19:26:20 | Chi [m1] |
+| aliasing.cpp:13:5:13:6 | m1 [post update] [m1] | aliasing.cpp:13:3:13:21 | Chi [m1] |
+| aliasing.cpp:13:5:13:6 | m1 [post update] [m1] | aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] |
+| aliasing.cpp:13:10:13:19 | call to user_input | aliasing.cpp:13:5:13:6 | m1 [post update] [m1] |
+| aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] | aliasing.cpp:29:11:29:12 | m1 [m1] |
+| aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] | aliasing.cpp:30:11:30:12 | m1 [m1] |
+| aliasing.cpp:29:11:29:12 | m1 [m1] | aliasing.cpp:29:11:29:12 | m1 |
+| aliasing.cpp:30:11:30:12 | m1 [m1] | aliasing.cpp:30:11:30:12 | m1 |
 | aliasing.cpp:37:13:37:22 | call to user_input | aliasing.cpp:38:11:38:12 | m1 |
 | aliasing.cpp:42:11:42:20 | call to user_input | aliasing.cpp:43:13:43:14 | m1 |
-| aliasing.cpp:60:3:60:22 | Chi [m1] | aliasing.cpp:61:13:61:14 | Store [m1] |
-| aliasing.cpp:60:11:60:20 | call to user_input | aliasing.cpp:60:3:60:22 | Chi [m1] |
-| aliasing.cpp:61:13:61:14 | Store [m1] | aliasing.cpp:62:14:62:15 | m1 |
+| aliasing.cpp:60:6:60:7 | m1 [post update] [m1] | aliasing.cpp:62:14:62:15 | m1 [m1] |
+| aliasing.cpp:60:11:60:20 | call to user_input | aliasing.cpp:60:6:60:7 | m1 [post update] [m1] |
+| aliasing.cpp:62:14:62:15 | m1 [m1] | aliasing.cpp:62:14:62:15 | m1 |
 | aliasing.cpp:79:11:79:20 | call to user_input | aliasing.cpp:80:12:80:13 | m1 |
 | aliasing.cpp:86:10:86:19 | call to user_input | aliasing.cpp:87:12:87:13 | m1 |
 | aliasing.cpp:92:12:92:21 | call to user_input | aliasing.cpp:93:12:93:13 | m1 |
-| aliasing.cpp:98:3:98:21 | Chi [m1] | aliasing.cpp:100:14:100:14 | Store [m1] |
-| aliasing.cpp:98:10:98:19 | call to user_input | aliasing.cpp:98:3:98:21 | Chi [m1] |
+| aliasing.cpp:98:5:98:6 | m1 [post update] [m1] | aliasing.cpp:100:14:100:14 | Store [m1] |
+| aliasing.cpp:98:10:98:19 | call to user_input | aliasing.cpp:98:5:98:6 | m1 [post update] [m1] |
 | aliasing.cpp:100:14:100:14 | Store [m1] | aliasing.cpp:102:8:102:10 | * ... |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:121:15:121:16 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:126:15:126:20 | taint_a_ptr output argument [array content] |
@@ -58,7 +70,19 @@ edges
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:175:15:175:22 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:187:15:187:22 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:200:15:200:24 | taint_a_ptr output argument [array content] |
-| aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:106:3:106:20 | Chi [array content] |
+| aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:225:15:225:22 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:106:3:106:20 | Chi [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:121:15:121:16 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:126:15:126:20 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:131:15:131:16 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:136:15:136:17 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:158:15:158:20 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:164:15:164:20 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:175:15:175:22 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:187:15:187:22 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:200:15:200:24 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | aliasing.cpp:225:15:225:22 | taint_a_ptr output argument [array content] |
+| aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] |
 | aliasing.cpp:121:15:121:16 | Chi [array content] | aliasing.cpp:122:8:122:12 | access to array |
 | aliasing.cpp:121:15:121:16 | taint_a_ptr output argument [array content] | aliasing.cpp:121:15:121:16 | Chi [array content] |
 | aliasing.cpp:126:15:126:20 | Chi [array content] | aliasing.cpp:127:8:127:16 | * ... |
@@ -71,16 +95,37 @@ edges
 | aliasing.cpp:158:15:158:20 | taint_a_ptr output argument [array content] | aliasing.cpp:158:15:158:20 | Chi [array content] |
 | aliasing.cpp:164:15:164:20 | Chi [array content] | aliasing.cpp:165:8:165:16 | access to array |
 | aliasing.cpp:164:15:164:20 | taint_a_ptr output argument [array content] | aliasing.cpp:164:15:164:20 | Chi [array content] |
-| aliasing.cpp:175:15:175:22 | Chi | aliasing.cpp:175:15:175:22 | Chi [m1] |
-| aliasing.cpp:175:15:175:22 | Chi [m1] | aliasing.cpp:176:13:176:14 | m1 |
-| aliasing.cpp:175:15:175:22 | taint_a_ptr output argument [array content] | aliasing.cpp:175:15:175:22 | Chi |
-| aliasing.cpp:187:15:187:22 | Chi | aliasing.cpp:187:15:187:22 | Chi [m1] |
-| aliasing.cpp:187:15:187:22 | Chi [m1] | aliasing.cpp:188:13:188:14 | Store [m1] |
-| aliasing.cpp:187:15:187:22 | taint_a_ptr output argument [array content] | aliasing.cpp:187:15:187:22 | Chi |
-| aliasing.cpp:188:13:188:14 | Store [m1] | aliasing.cpp:189:15:189:16 | m1 |
-| aliasing.cpp:200:15:200:24 | Chi | aliasing.cpp:200:15:200:24 | Chi [m1] |
-| aliasing.cpp:200:15:200:24 | Chi [m1] | aliasing.cpp:201:15:201:16 | m1 |
-| aliasing.cpp:200:15:200:24 | taint_a_ptr output argument [array content] | aliasing.cpp:200:15:200:24 | Chi |
+| aliasing.cpp:175:15:175:22 | taint_a_ptr output argument | aliasing.cpp:175:21:175:22 | m1 [post update] [m1] |
+| aliasing.cpp:175:15:175:22 | taint_a_ptr output argument [array content] | aliasing.cpp:175:15:175:22 | taint_a_ptr output argument |
+| aliasing.cpp:175:19:175:19 | s [post update] [s, m1] | aliasing.cpp:176:11:176:11 | s [s, m1] |
+| aliasing.cpp:175:21:175:22 | m1 [post update] [m1] | aliasing.cpp:175:19:175:19 | s [post update] [s, m1] |
+| aliasing.cpp:176:11:176:11 | s [s, m1] | aliasing.cpp:176:13:176:14 | m1 [m1] |
+| aliasing.cpp:176:13:176:14 | m1 [m1] | aliasing.cpp:176:13:176:14 | m1 |
+| aliasing.cpp:187:15:187:22 | taint_a_ptr output argument | aliasing.cpp:187:21:187:22 | m1 [post update] [m1] |
+| aliasing.cpp:187:15:187:22 | taint_a_ptr output argument [array content] | aliasing.cpp:187:15:187:22 | taint_a_ptr output argument |
+| aliasing.cpp:187:19:187:19 | s [post update] [s, m1] | aliasing.cpp:189:13:189:13 | s [s, m1] |
+| aliasing.cpp:187:21:187:22 | m1 [post update] [m1] | aliasing.cpp:187:19:187:19 | s [post update] [s, m1] |
+| aliasing.cpp:189:13:189:13 | s [s, m1] | aliasing.cpp:189:15:189:16 | m1 [m1] |
+| aliasing.cpp:189:15:189:16 | m1 [m1] | aliasing.cpp:189:15:189:16 | m1 |
+| aliasing.cpp:200:15:200:24 | taint_a_ptr output argument | aliasing.cpp:200:23:200:24 | m1 [post update] [m1] |
+| aliasing.cpp:200:15:200:24 | taint_a_ptr output argument [array content] | aliasing.cpp:200:15:200:24 | taint_a_ptr output argument |
+| aliasing.cpp:200:21:200:21 | s [post update] [s, m1] | aliasing.cpp:201:13:201:13 | s [s, m1] |
+| aliasing.cpp:200:23:200:24 | m1 [post update] [m1] | aliasing.cpp:200:21:200:21 | s [post update] [s, m1] |
+| aliasing.cpp:201:13:201:13 | s [s, m1] | aliasing.cpp:201:15:201:16 | m1 [m1] |
+| aliasing.cpp:201:15:201:16 | m1 [m1] | aliasing.cpp:201:15:201:16 | m1 |
+| aliasing.cpp:211:6:211:6 | s [post update] [s, m1] | aliasing.cpp:212:12:212:12 | s [s, m1] |
+| aliasing.cpp:211:8:211:9 | m1 [post update] [m1] | aliasing.cpp:211:6:211:6 | s [post update] [s, m1] |
+| aliasing.cpp:211:13:211:22 | call to user_input | aliasing.cpp:211:8:211:9 | m1 [post update] [m1] |
+| aliasing.cpp:212:12:212:12 | s [m1] | aliasing.cpp:213:10:213:11 | m1 [m1] |
+| aliasing.cpp:212:12:212:12 | s [s, m1] | aliasing.cpp:212:12:212:12 | s [m1] |
+| aliasing.cpp:213:10:213:11 | m1 [m1] | aliasing.cpp:213:10:213:11 | m1 |
+| aliasing.cpp:225:15:225:22 | taint_a_ptr output argument | aliasing.cpp:225:21:225:22 | m1 [post update] [m1] |
+| aliasing.cpp:225:15:225:22 | taint_a_ptr output argument [array content] | aliasing.cpp:225:15:225:22 | taint_a_ptr output argument |
+| aliasing.cpp:225:19:225:19 | s [post update] [s, m1] | aliasing.cpp:226:12:226:12 | s [s, m1] |
+| aliasing.cpp:225:21:225:22 | m1 [post update] [m1] | aliasing.cpp:225:19:225:19 | s [post update] [s, m1] |
+| aliasing.cpp:226:12:226:12 | s [m1] | aliasing.cpp:227:10:227:11 | m1 [m1] |
+| aliasing.cpp:226:12:226:12 | s [s, m1] | aliasing.cpp:226:12:226:12 | s [m1] |
+| aliasing.cpp:227:10:227:11 | m1 [m1] | aliasing.cpp:227:10:227:11 | m1 |
 | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:7:8:7:13 | access to array |
 | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:9:8:9:11 | * ... |
 | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:10:8:10:15 | * ... |
@@ -96,65 +141,118 @@ edges
 | by_reference.cpp:68:21:68:30 | call to user_input | by_reference.cpp:68:17:68:18 | nonMemberSetA output argument [a] |
 | by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] |
 | by_reference.cpp:84:3:84:25 | Chi [a] | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:84:14:84:23 | call to user_input | by_reference.cpp:84:3:84:25 | Chi [a] |
+| by_reference.cpp:84:10:84:10 | a [post update] [a] | by_reference.cpp:84:3:84:25 | Chi [a] |
+| by_reference.cpp:84:10:84:10 | a [post update] [a] | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] |
+| by_reference.cpp:84:10:84:10 | a [post update] [a] | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] |
+| by_reference.cpp:84:14:84:23 | call to user_input | by_reference.cpp:84:10:84:10 | a [post update] [a] |
 | by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] |
 | by_reference.cpp:88:3:88:24 | Chi [a] | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:88:3:88:24 | Chi [a] |
+| by_reference.cpp:88:9:88:9 | a [post update] [a] | by_reference.cpp:88:3:88:24 | Chi [a] |
+| by_reference.cpp:88:9:88:9 | a [post update] [a] | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] |
+| by_reference.cpp:88:9:88:9 | a [post update] [a] | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] |
+| by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:88:9:88:9 | a [post update] [a] |
 | by_reference.cpp:92:3:92:20 | Chi [array content] | by_reference.cpp:104:15:104:22 | taint_a_ptr output argument [array content] |
 | by_reference.cpp:92:3:92:20 | Chi [array content] | by_reference.cpp:108:15:108:24 | taint_a_ptr output argument [array content] |
-| by_reference.cpp:92:9:92:18 | call to user_input | by_reference.cpp:92:3:92:20 | Chi [array content] |
+| by_reference.cpp:92:3:92:20 | ChiTotal [post update] [array content] | by_reference.cpp:92:3:92:20 | Chi [array content] |
+| by_reference.cpp:92:3:92:20 | ChiTotal [post update] [array content] | by_reference.cpp:104:15:104:22 | taint_a_ptr output argument [array content] |
+| by_reference.cpp:92:3:92:20 | ChiTotal [post update] [array content] | by_reference.cpp:108:15:108:24 | taint_a_ptr output argument [array content] |
+| by_reference.cpp:92:9:92:18 | call to user_input | by_reference.cpp:92:3:92:20 | ChiTotal [post update] [array content] |
 | by_reference.cpp:96:3:96:19 | Chi [array content] | by_reference.cpp:124:15:124:21 | taint_a_ref output argument [array content] |
 | by_reference.cpp:96:3:96:19 | Chi [array content] | by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] |
-| by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:96:3:96:19 | Chi [array content] |
-| by_reference.cpp:102:21:102:39 | Chi [a] | by_reference.cpp:110:27:110:27 | a |
-| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | by_reference.cpp:102:21:102:39 | Chi [a] |
-| by_reference.cpp:104:15:104:22 | Chi | by_reference.cpp:104:15:104:22 | Chi [a] |
-| by_reference.cpp:104:15:104:22 | Chi [a] | by_reference.cpp:112:14:112:14 | a |
-| by_reference.cpp:104:15:104:22 | taint_a_ptr output argument [array content] | by_reference.cpp:104:15:104:22 | Chi |
-| by_reference.cpp:106:21:106:41 | Chi [a] | by_reference.cpp:114:29:114:29 | a |
-| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] | by_reference.cpp:106:21:106:41 | Chi [a] |
-| by_reference.cpp:108:15:108:24 | Chi | by_reference.cpp:108:15:108:24 | Chi [a] |
-| by_reference.cpp:108:15:108:24 | Chi [a] | by_reference.cpp:116:16:116:16 | a |
-| by_reference.cpp:108:15:108:24 | taint_a_ptr output argument [array content] | by_reference.cpp:108:15:108:24 | Chi |
-| by_reference.cpp:122:21:122:38 | Chi [a] | by_reference.cpp:130:27:130:27 | a |
-| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] | by_reference.cpp:122:21:122:38 | Chi [a] |
-| by_reference.cpp:124:15:124:21 | Chi | by_reference.cpp:124:15:124:21 | Chi [a] |
-| by_reference.cpp:124:15:124:21 | Chi [a] | by_reference.cpp:132:14:132:14 | a |
-| by_reference.cpp:124:15:124:21 | taint_a_ref output argument [array content] | by_reference.cpp:124:15:124:21 | Chi |
-| by_reference.cpp:126:21:126:40 | Chi [a] | by_reference.cpp:134:29:134:29 | a |
-| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] | by_reference.cpp:126:21:126:40 | Chi [a] |
-| by_reference.cpp:128:15:128:23 | Chi | by_reference.cpp:128:15:128:23 | Chi [a] |
-| by_reference.cpp:128:15:128:23 | Chi [a] | by_reference.cpp:136:16:136:16 | a |
-| by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] | by_reference.cpp:128:15:128:23 | Chi |
+| by_reference.cpp:96:3:96:19 | ChiTotal [post update] [array content] | by_reference.cpp:96:3:96:19 | Chi [array content] |
+| by_reference.cpp:96:3:96:19 | ChiTotal [post update] [array content] | by_reference.cpp:124:15:124:21 | taint_a_ref output argument [array content] |
+| by_reference.cpp:96:3:96:19 | ChiTotal [post update] [array content] | by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] |
+| by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:96:3:96:19 | ChiTotal [post update] [array content] |
+| by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | by_reference.cpp:102:28:102:39 | inner_nested [post update] [a, a] |
+| by_reference.cpp:102:28:102:39 | inner_nested [post update] [a, a] | by_reference.cpp:110:14:110:25 | inner_nested [a, a] |
+| by_reference.cpp:104:15:104:22 | taint_a_ptr output argument | by_reference.cpp:104:22:104:22 | a [post update] [a] |
+| by_reference.cpp:104:15:104:22 | taint_a_ptr output argument [array content] | by_reference.cpp:104:15:104:22 | taint_a_ptr output argument |
+| by_reference.cpp:104:22:104:22 | a [post update] [a] | by_reference.cpp:112:14:112:14 | a [a] |
+| by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] | by_reference.cpp:106:30:106:41 | inner_nested [post update] [a, a] |
+| by_reference.cpp:106:30:106:41 | inner_nested [post update] [a, a] | by_reference.cpp:114:16:114:27 | inner_nested [a, a] |
+| by_reference.cpp:108:15:108:24 | taint_a_ptr output argument | by_reference.cpp:108:24:108:24 | a [post update] [a] |
+| by_reference.cpp:108:15:108:24 | taint_a_ptr output argument [array content] | by_reference.cpp:108:15:108:24 | taint_a_ptr output argument |
+| by_reference.cpp:108:24:108:24 | a [post update] [a] | by_reference.cpp:116:16:116:16 | a [a] |
+| by_reference.cpp:110:14:110:25 | inner_nested [a, a] | by_reference.cpp:110:27:110:27 | a [a] |
+| by_reference.cpp:110:27:110:27 | a [a] | by_reference.cpp:110:27:110:27 | a |
+| by_reference.cpp:112:14:112:14 | a [a] | by_reference.cpp:112:14:112:14 | a |
+| by_reference.cpp:114:16:114:27 | inner_nested [a, a] | by_reference.cpp:114:29:114:29 | a [a] |
+| by_reference.cpp:114:29:114:29 | a [a] | by_reference.cpp:114:29:114:29 | a |
+| by_reference.cpp:116:16:116:16 | a [a] | by_reference.cpp:116:16:116:16 | a |
+| by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] | by_reference.cpp:122:27:122:38 | inner_nested [post update] [a, a] |
+| by_reference.cpp:122:27:122:38 | inner_nested [post update] [a, a] | by_reference.cpp:130:14:130:25 | inner_nested [a, a] |
+| by_reference.cpp:124:15:124:21 | taint_a_ref output argument | by_reference.cpp:124:21:124:21 | a [post update] [a] |
+| by_reference.cpp:124:15:124:21 | taint_a_ref output argument [array content] | by_reference.cpp:124:15:124:21 | taint_a_ref output argument |
+| by_reference.cpp:124:21:124:21 | a [post update] [a] | by_reference.cpp:132:14:132:14 | a [a] |
+| by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] | by_reference.cpp:126:29:126:40 | inner_nested [post update] [a, a] |
+| by_reference.cpp:126:29:126:40 | inner_nested [post update] [a, a] | by_reference.cpp:134:16:134:27 | inner_nested [a, a] |
+| by_reference.cpp:128:15:128:23 | taint_a_ref output argument | by_reference.cpp:128:23:128:23 | a [post update] [a] |
+| by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] | by_reference.cpp:128:15:128:23 | taint_a_ref output argument |
+| by_reference.cpp:128:23:128:23 | a [post update] [a] | by_reference.cpp:136:16:136:16 | a [a] |
+| by_reference.cpp:130:14:130:25 | inner_nested [a, a] | by_reference.cpp:130:27:130:27 | a [a] |
+| by_reference.cpp:130:27:130:27 | a [a] | by_reference.cpp:130:27:130:27 | a |
+| by_reference.cpp:132:14:132:14 | a [a] | by_reference.cpp:132:14:132:14 | a |
+| by_reference.cpp:134:16:134:27 | inner_nested [a, a] | by_reference.cpp:134:29:134:29 | a [a] |
+| by_reference.cpp:134:29:134:29 | a [a] | by_reference.cpp:134:29:134:29 | a |
+| by_reference.cpp:136:16:136:16 | a [a] | by_reference.cpp:136:16:136:16 | a |
 | complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:42:18:42:18 | call to a |
-| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:42:16:42:16 | Chi [b_] |
 | complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:42:16:42:16 | a output argument [b_] |
 | complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:43:18:43:18 | call to b |
-| complex.cpp:42:16:42:16 | Chi [b_] | complex.cpp:43:18:43:18 | call to b |
-| complex.cpp:42:16:42:16 | a output argument [b_] | complex.cpp:42:16:42:16 | Chi [b_] |
+| complex.cpp:40:17:40:17 | *b [f, f, a_] | complex.cpp:42:10:42:14 | inner [f, f, a_] |
+| complex.cpp:40:17:40:17 | *b [f, f, b_] | complex.cpp:42:10:42:14 | inner [f, f, b_] |
+| complex.cpp:40:17:40:17 | *b [f, f, b_] | complex.cpp:42:16:42:16 | a output argument [f, f, b_] |
+| complex.cpp:40:17:40:17 | *b [f, f, b_] | complex.cpp:43:10:43:14 | inner [f, f, b_] |
+| complex.cpp:40:17:40:17 | *b [f, f, f, f, a_] | complex.cpp:42:10:42:14 | inner [f, f, f, f, a_] |
+| complex.cpp:42:10:42:14 | inner [f, f, a_] | complex.cpp:42:16:42:16 | f [f, a_] |
+| complex.cpp:42:10:42:14 | inner [f, f, b_] | complex.cpp:42:16:42:16 | f [f, b_] |
+| complex.cpp:42:10:42:14 | inner [f, f, f, f, a_] | complex.cpp:42:16:42:16 | f [f, f, f, a_] |
+| complex.cpp:42:10:42:14 | inner [post update] [f, f, b_] | complex.cpp:43:10:43:14 | inner [f, f, b_] |
+| complex.cpp:42:10:42:14 | inner [post update] [f, f, f, f, b_] | complex.cpp:43:10:43:14 | inner [f, f, f, f, b_] |
+| complex.cpp:42:16:42:16 | a output argument [b_] | complex.cpp:42:16:42:16 | f [post update] [f, b_] |
 | complex.cpp:42:16:42:16 | a output argument [b_] | complex.cpp:43:18:43:18 | call to b |
-| complex.cpp:53:12:53:12 | Chi [a_] | complex.cpp:40:17:40:17 | *b [a_] |
+| complex.cpp:42:16:42:16 | a output argument [f, f, b_] | complex.cpp:42:16:42:16 | f [post update] [f, f, f, b_] |
+| complex.cpp:42:16:42:16 | a output argument [f, f, b_] | complex.cpp:43:10:43:14 | inner [f, f, b_] |
+| complex.cpp:42:16:42:16 | f [f, a_] | complex.cpp:42:18:42:18 | call to a |
+| complex.cpp:42:16:42:16 | f [f, b_] | complex.cpp:42:16:42:16 | a output argument [b_] |
+| complex.cpp:42:16:42:16 | f [f, f, f, a_] | complex.cpp:42:10:42:14 | inner [f, f, a_] |
+| complex.cpp:42:16:42:16 | f [post update] [f, b_] | complex.cpp:42:10:42:14 | inner [post update] [f, f, b_] |
+| complex.cpp:42:16:42:16 | f [post update] [f, f, f, b_] | complex.cpp:42:10:42:14 | inner [post update] [f, f, f, f, b_] |
+| complex.cpp:43:10:43:14 | inner [f, f, b_] | complex.cpp:43:16:43:16 | f [f, b_] |
+| complex.cpp:43:10:43:14 | inner [f, f, f, f, b_] | complex.cpp:43:16:43:16 | f [f, f, f, b_] |
+| complex.cpp:43:16:43:16 | f [f, b_] | complex.cpp:43:18:43:18 | call to b |
+| complex.cpp:43:16:43:16 | f [f, f, f, b_] | complex.cpp:43:10:43:14 | inner [f, f, b_] |
+| complex.cpp:53:6:53:10 | inner [post update] [f, f, a_] | complex.cpp:40:17:40:17 | *b [f, f, a_] |
+| complex.cpp:53:12:53:12 | f [post update] [f, a_] | complex.cpp:53:6:53:10 | inner [post update] [f, f, a_] |
 | complex.cpp:53:12:53:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:53:12:53:12 | setA output argument [a_] | complex.cpp:53:12:53:12 | Chi [a_] |
+| complex.cpp:53:12:53:12 | setA output argument [a_] | complex.cpp:53:12:53:12 | f [post update] [f, a_] |
 | complex.cpp:53:19:53:28 | call to user_input | complex.cpp:53:12:53:12 | setA output argument [a_] |
-| complex.cpp:54:12:54:12 | Chi [b_] | complex.cpp:40:17:40:17 | *b [b_] |
+| complex.cpp:54:6:54:10 | inner [post update] [f, f, b_] | complex.cpp:40:17:40:17 | *b [f, f, b_] |
+| complex.cpp:54:12:54:12 | f [post update] [f, b_] | complex.cpp:54:6:54:10 | inner [post update] [f, f, b_] |
 | complex.cpp:54:12:54:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
-| complex.cpp:54:12:54:12 | setB output argument [b_] | complex.cpp:54:12:54:12 | Chi [b_] |
+| complex.cpp:54:12:54:12 | setB output argument [b_] | complex.cpp:54:12:54:12 | f [post update] [f, b_] |
 | complex.cpp:54:19:54:28 | call to user_input | complex.cpp:54:12:54:12 | setB output argument [b_] |
-| complex.cpp:55:12:55:12 | Chi [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:55:12:55:12 | Chi [a_] | complex.cpp:56:12:56:12 | Chi [a_] |
-| complex.cpp:55:12:55:12 | Chi [a_] | complex.cpp:56:12:56:12 | setB output argument [a_] |
+| complex.cpp:55:6:55:10 | inner [post update] [f, f, a_] | complex.cpp:40:17:40:17 | *b [f, f, a_] |
+| complex.cpp:55:6:55:10 | inner [post update] [f, f, a_] | complex.cpp:56:6:56:10 | inner [f, f, a_] |
+| complex.cpp:55:6:55:10 | inner [post update] [f, f, a_] | complex.cpp:56:12:56:12 | setB output argument [f, f, a_] |
+| complex.cpp:55:12:55:12 | f [post update] [f, a_] | complex.cpp:55:6:55:10 | inner [post update] [f, f, a_] |
 | complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:55:12:55:12 | Chi [a_] |
-| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:56:12:56:12 | Chi [a_] |
+| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:55:12:55:12 | f [post update] [f, a_] |
 | complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:56:12:56:12 | setB output argument [a_] |
 | complex.cpp:55:19:55:28 | call to user_input | complex.cpp:55:12:55:12 | setA output argument [a_] |
-| complex.cpp:56:12:56:12 | Chi [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:56:12:56:12 | Chi [b_] | complex.cpp:40:17:40:17 | *b [b_] |
+| complex.cpp:56:6:56:10 | inner [f, f, a_] | complex.cpp:56:12:56:12 | f [f, a_] |
+| complex.cpp:56:6:56:10 | inner [post update] [f, f, a_] | complex.cpp:40:17:40:17 | *b [f, f, a_] |
+| complex.cpp:56:6:56:10 | inner [post update] [f, f, b_] | complex.cpp:40:17:40:17 | *b [f, f, b_] |
+| complex.cpp:56:6:56:10 | inner [post update] [f, f, f, f, a_] | complex.cpp:40:17:40:17 | *b [f, f, f, f, a_] |
+| complex.cpp:56:12:56:12 | f [f, a_] | complex.cpp:56:12:56:12 | setB output argument [a_] |
+| complex.cpp:56:12:56:12 | f [post update] [f, a_] | complex.cpp:56:6:56:10 | inner [post update] [f, f, a_] |
+| complex.cpp:56:12:56:12 | f [post update] [f, b_] | complex.cpp:56:6:56:10 | inner [post update] [f, f, b_] |
+| complex.cpp:56:12:56:12 | f [post update] [f, f, f, a_] | complex.cpp:56:6:56:10 | inner [post update] [f, f, f, f, a_] |
 | complex.cpp:56:12:56:12 | setB output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
-| complex.cpp:56:12:56:12 | setB output argument [a_] | complex.cpp:56:12:56:12 | Chi [a_] |
+| complex.cpp:56:12:56:12 | setB output argument [a_] | complex.cpp:56:12:56:12 | f [post update] [f, a_] |
 | complex.cpp:56:12:56:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
-| complex.cpp:56:12:56:12 | setB output argument [b_] | complex.cpp:56:12:56:12 | Chi [b_] |
+| complex.cpp:56:12:56:12 | setB output argument [b_] | complex.cpp:56:12:56:12 | f [post update] [f, b_] |
+| complex.cpp:56:12:56:12 | setB output argument [f, f, a_] | complex.cpp:40:17:40:17 | *b [f, f, a_] |
+| complex.cpp:56:12:56:12 | setB output argument [f, f, a_] | complex.cpp:56:12:56:12 | f [post update] [f, f, f, a_] |
 | complex.cpp:56:19:56:28 | call to user_input | complex.cpp:56:12:56:12 | setB output argument [b_] |
 | constructors.cpp:26:15:26:15 | *f [a_] | constructors.cpp:28:12:28:12 | call to a |
 | constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:28:10:28:10 | a output argument [b_] |
@@ -182,21 +280,25 @@ edges
 | simple.cpp:42:5:42:5 | setB output argument [a_] | simple.cpp:26:15:26:15 | *f [a_] |
 | simple.cpp:42:5:42:5 | setB output argument [b_] | simple.cpp:26:15:26:15 | *f [b_] |
 | simple.cpp:42:12:42:21 | call to user_input | simple.cpp:42:5:42:5 | setB output argument [b_] |
-| simple.cpp:65:5:65:22 | Store [i] | simple.cpp:66:12:66:12 | Store [i] |
-| simple.cpp:65:11:65:20 | call to user_input | simple.cpp:65:5:65:22 | Store [i] |
-| simple.cpp:66:12:66:12 | Store [i] | simple.cpp:67:13:67:13 | i |
-| simple.cpp:83:9:83:28 | Chi [f1] | simple.cpp:84:14:84:20 | call to getf2f1 |
-| simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:9:83:28 | Chi [f1] |
-| simple.cpp:92:5:92:22 | Store [i] | simple.cpp:93:20:93:20 | Store [i] |
-| simple.cpp:92:11:92:20 | call to user_input | simple.cpp:92:5:92:22 | Store [i] |
-| simple.cpp:93:20:93:20 | Store [i] | simple.cpp:94:13:94:13 | i |
-| struct_init.c:14:24:14:25 | *ab [a] | struct_init.c:15:12:15:12 | a |
-| struct_init.c:20:20:20:29 | Chi [a] | struct_init.c:14:24:14:25 | *ab [a] |
-| struct_init.c:20:20:20:29 | call to user_input | struct_init.c:20:20:20:29 | Chi [a] |
+| simple.cpp:65:7:65:7 | i [post update] [i] | simple.cpp:67:13:67:13 | i [i] |
+| simple.cpp:65:11:65:20 | call to user_input | simple.cpp:65:7:65:7 | i [post update] [i] |
+| simple.cpp:67:13:67:13 | i [i] | simple.cpp:67:13:67:13 | i |
+| simple.cpp:83:9:83:10 | f2 [post update] [f1, f1] | simple.cpp:84:14:84:20 | call to getf2f1 |
+| simple.cpp:83:12:83:13 | f1 [post update] [f1] | simple.cpp:83:9:83:10 | f2 [post update] [f1, f1] |
+| simple.cpp:83:17:83:26 | call to user_input | simple.cpp:83:12:83:13 | f1 [post update] [f1] |
+| simple.cpp:92:7:92:7 | i [post update] [i] | simple.cpp:94:13:94:13 | i [i] |
+| simple.cpp:92:11:92:20 | call to user_input | simple.cpp:92:7:92:7 | i [post update] [i] |
+| simple.cpp:94:13:94:13 | i [i] | simple.cpp:94:13:94:13 | i |
+| struct_init.c:14:24:14:25 | *ab [a] | struct_init.c:15:12:15:12 | a [a] |
+| struct_init.c:15:12:15:12 | a [a] | struct_init.c:15:12:15:12 | a |
+| struct_init.c:20:17:20:36 | a [post update] [a] | struct_init.c:14:24:14:25 | *ab [a] |
+| struct_init.c:20:20:20:29 | call to user_input | struct_init.c:20:17:20:36 | a [post update] [a] |
 | struct_init.c:20:20:20:29 | call to user_input | struct_init.c:22:11:22:11 | a |
-| struct_init.c:27:7:27:16 | Chi [a] | struct_init.c:14:24:14:25 | *ab [a] |
-| struct_init.c:27:7:27:16 | call to user_input | struct_init.c:27:7:27:16 | Chi [a] |
+| struct_init.c:26:23:29:3 | nestedAB [post update] [nestedAB, a] | struct_init.c:36:17:36:24 | nestedAB [nestedAB, a] |
+| struct_init.c:27:5:27:23 | a [post update] [a] | struct_init.c:26:23:29:3 | nestedAB [post update] [nestedAB, a] |
+| struct_init.c:27:7:27:16 | call to user_input | struct_init.c:27:5:27:23 | a [post update] [a] |
 | struct_init.c:27:7:27:16 | call to user_input | struct_init.c:31:23:31:23 | a |
+| struct_init.c:36:17:36:24 | nestedAB [nestedAB, a] | struct_init.c:14:24:14:25 | *ab [a] |
 nodes
 | A.cpp:55:5:55:5 | set output argument [c] | semmle.label | set output argument [c] |
 | A.cpp:55:12:55:19 | (C *)... | semmle.label | (C *)... |
@@ -206,66 +308,75 @@ nodes
 | A.cpp:57:17:57:23 | new | semmle.label | new |
 | A.cpp:57:28:57:30 | call to get | semmle.label | call to get |
 | A.cpp:98:12:98:18 | new | semmle.label | new |
-| A.cpp:100:5:100:13 | Chi [a] | semmle.label | Chi [a] |
+| A.cpp:100:9:100:9 | a [post update] [a] | semmle.label | a [post update] [a] |
 | A.cpp:103:14:103:14 | *c [a] | semmle.label | *c [a] |
 | A.cpp:107:16:107:16 | a | semmle.label | a |
+| A.cpp:107:16:107:16 | a [a] | semmle.label | a [a] |
 | A.cpp:126:5:126:5 | Chi [c] | semmle.label | Chi [c] |
 | A.cpp:126:5:126:5 | set output argument [c] | semmle.label | set output argument [c] |
 | A.cpp:126:12:126:18 | new | semmle.label | new |
-| A.cpp:131:8:131:8 | Chi [c] | semmle.label | Chi [c] |
 | A.cpp:131:8:131:8 | f7 output argument [c] | semmle.label | f7 output argument [c] |
 | A.cpp:132:13:132:13 | c | semmle.label | c |
+| A.cpp:132:13:132:13 | c [c] | semmle.label | c [c] |
 | A.cpp:142:7:142:20 | Chi [c] | semmle.label | Chi [c] |
+| A.cpp:142:10:142:10 | c [post update] [c] | semmle.label | c [post update] [c] |
 | A.cpp:142:14:142:20 | new | semmle.label | new |
 | A.cpp:143:7:143:31 | Chi [b] | semmle.label | Chi [b] |
+| A.cpp:143:13:143:13 | b [post update] [b] | semmle.label | b [post update] [b] |
 | A.cpp:143:25:143:31 | new | semmle.label | new |
 | A.cpp:150:12:150:18 | new | semmle.label | new |
-| A.cpp:151:12:151:24 | Chi [b] | semmle.label | Chi [b] |
 | A.cpp:151:12:151:24 | D output argument [b] | semmle.label | D output argument [b] |
-| A.cpp:151:18:151:18 | Chi [c] | semmle.label | Chi [c] |
 | A.cpp:151:18:151:18 | D output argument [c] | semmle.label | D output argument [c] |
 | A.cpp:152:13:152:13 | b | semmle.label | b |
+| A.cpp:152:13:152:13 | b [b] | semmle.label | b [b] |
 | A.cpp:154:13:154:13 | c | semmle.label | c |
+| A.cpp:154:13:154:13 | c [c] | semmle.label | c [c] |
 | C.cpp:18:12:18:18 | C output argument [s1] | semmle.label | C output argument [s1] |
 | C.cpp:18:12:18:18 | C output argument [s3] | semmle.label | C output argument [s3] |
-| C.cpp:22:12:22:21 | Chi [s1] | semmle.label | Chi [s1] |
+| C.cpp:22:9:22:22 | s1 [post update] [s1] | semmle.label | s1 [post update] [s1] |
 | C.cpp:22:12:22:21 | new | semmle.label | new |
 | C.cpp:24:5:24:25 | Chi [s1] | semmle.label | Chi [s1] |
 | C.cpp:24:5:24:25 | Chi [s3] | semmle.label | Chi [s3] |
+| C.cpp:24:11:24:12 | s3 [post update] [s3] | semmle.label | s3 [post update] [s3] |
 | C.cpp:24:16:24:25 | new | semmle.label | new |
 | C.cpp:27:8:27:11 | *#this [s1] | semmle.label | *#this [s1] |
 | C.cpp:27:8:27:11 | *#this [s3] | semmle.label | *#this [s3] |
 | C.cpp:29:10:29:11 | s1 | semmle.label | s1 |
+| C.cpp:29:10:29:11 | s1 [s1] | semmle.label | s1 [s1] |
 | C.cpp:31:10:31:11 | s3 | semmle.label | s3 |
+| C.cpp:31:10:31:11 | s3 [s3] | semmle.label | s3 [s3] |
 | aliasing.cpp:9:3:9:22 | Chi [m1] | semmle.label | Chi [m1] |
+| aliasing.cpp:9:6:9:7 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
 | aliasing.cpp:9:11:9:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:13:3:13:21 | Chi [m1] | semmle.label | Chi [m1] |
+| aliasing.cpp:13:5:13:6 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
 | aliasing.cpp:13:10:13:19 | call to user_input | semmle.label | call to user_input |
-| aliasing.cpp:25:17:25:19 | Chi [m1] | semmle.label | Chi [m1] |
 | aliasing.cpp:25:17:25:19 | pointerSetter output argument [m1] | semmle.label | pointerSetter output argument [m1] |
-| aliasing.cpp:26:19:26:20 | Chi [m1] | semmle.label | Chi [m1] |
 | aliasing.cpp:26:19:26:20 | referenceSetter output argument [m1] | semmle.label | referenceSetter output argument [m1] |
 | aliasing.cpp:29:11:29:12 | m1 | semmle.label | m1 |
+| aliasing.cpp:29:11:29:12 | m1 [m1] | semmle.label | m1 [m1] |
 | aliasing.cpp:30:11:30:12 | m1 | semmle.label | m1 |
+| aliasing.cpp:30:11:30:12 | m1 [m1] | semmle.label | m1 [m1] |
 | aliasing.cpp:37:13:37:22 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:38:11:38:12 | m1 | semmle.label | m1 |
 | aliasing.cpp:42:11:42:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:43:13:43:14 | m1 | semmle.label | m1 |
-| aliasing.cpp:60:3:60:22 | Chi [m1] | semmle.label | Chi [m1] |
+| aliasing.cpp:60:6:60:7 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
 | aliasing.cpp:60:11:60:20 | call to user_input | semmle.label | call to user_input |
-| aliasing.cpp:61:13:61:14 | Store [m1] | semmle.label | Store [m1] |
 | aliasing.cpp:62:14:62:15 | m1 | semmle.label | m1 |
+| aliasing.cpp:62:14:62:15 | m1 [m1] | semmle.label | m1 [m1] |
 | aliasing.cpp:79:11:79:20 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:80:12:80:13 | m1 | semmle.label | m1 |
 | aliasing.cpp:86:10:86:19 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:87:12:87:13 | m1 | semmle.label | m1 |
 | aliasing.cpp:92:12:92:21 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:93:12:93:13 | m1 | semmle.label | m1 |
-| aliasing.cpp:98:3:98:21 | Chi [m1] | semmle.label | Chi [m1] |
+| aliasing.cpp:98:5:98:6 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
 | aliasing.cpp:98:10:98:19 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:100:14:100:14 | Store [m1] | semmle.label | Store [m1] |
 | aliasing.cpp:102:8:102:10 | * ... | semmle.label | * ... |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | semmle.label | Chi [array content] |
+| aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | semmle.label | ChiTotal [post update] [array content] |
 | aliasing.cpp:106:9:106:18 | call to user_input | semmle.label | call to user_input |
 | aliasing.cpp:121:15:121:16 | Chi [array content] | semmle.label | Chi [array content] |
 | aliasing.cpp:121:15:121:16 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
@@ -285,19 +396,42 @@ nodes
 | aliasing.cpp:164:15:164:20 | Chi [array content] | semmle.label | Chi [array content] |
 | aliasing.cpp:164:15:164:20 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
 | aliasing.cpp:165:8:165:16 | access to array | semmle.label | access to array |
-| aliasing.cpp:175:15:175:22 | Chi | semmle.label | Chi |
-| aliasing.cpp:175:15:175:22 | Chi [m1] | semmle.label | Chi [m1] |
+| aliasing.cpp:175:15:175:22 | taint_a_ptr output argument | semmle.label | taint_a_ptr output argument |
 | aliasing.cpp:175:15:175:22 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
+| aliasing.cpp:175:19:175:19 | s [post update] [s, m1] | semmle.label | s [post update] [s, m1] |
+| aliasing.cpp:175:21:175:22 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
+| aliasing.cpp:176:11:176:11 | s [s, m1] | semmle.label | s [s, m1] |
 | aliasing.cpp:176:13:176:14 | m1 | semmle.label | m1 |
-| aliasing.cpp:187:15:187:22 | Chi | semmle.label | Chi |
-| aliasing.cpp:187:15:187:22 | Chi [m1] | semmle.label | Chi [m1] |
+| aliasing.cpp:176:13:176:14 | m1 [m1] | semmle.label | m1 [m1] |
+| aliasing.cpp:187:15:187:22 | taint_a_ptr output argument | semmle.label | taint_a_ptr output argument |
 | aliasing.cpp:187:15:187:22 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
-| aliasing.cpp:188:13:188:14 | Store [m1] | semmle.label | Store [m1] |
+| aliasing.cpp:187:19:187:19 | s [post update] [s, m1] | semmle.label | s [post update] [s, m1] |
+| aliasing.cpp:187:21:187:22 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
+| aliasing.cpp:189:13:189:13 | s [s, m1] | semmle.label | s [s, m1] |
 | aliasing.cpp:189:15:189:16 | m1 | semmle.label | m1 |
-| aliasing.cpp:200:15:200:24 | Chi | semmle.label | Chi |
-| aliasing.cpp:200:15:200:24 | Chi [m1] | semmle.label | Chi [m1] |
+| aliasing.cpp:189:15:189:16 | m1 [m1] | semmle.label | m1 [m1] |
+| aliasing.cpp:200:15:200:24 | taint_a_ptr output argument | semmle.label | taint_a_ptr output argument |
 | aliasing.cpp:200:15:200:24 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
+| aliasing.cpp:200:21:200:21 | s [post update] [s, m1] | semmle.label | s [post update] [s, m1] |
+| aliasing.cpp:200:23:200:24 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
+| aliasing.cpp:201:13:201:13 | s [s, m1] | semmle.label | s [s, m1] |
 | aliasing.cpp:201:15:201:16 | m1 | semmle.label | m1 |
+| aliasing.cpp:201:15:201:16 | m1 [m1] | semmle.label | m1 [m1] |
+| aliasing.cpp:211:6:211:6 | s [post update] [s, m1] | semmle.label | s [post update] [s, m1] |
+| aliasing.cpp:211:8:211:9 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
+| aliasing.cpp:211:13:211:22 | call to user_input | semmle.label | call to user_input |
+| aliasing.cpp:212:12:212:12 | s [m1] | semmle.label | s [m1] |
+| aliasing.cpp:212:12:212:12 | s [s, m1] | semmle.label | s [s, m1] |
+| aliasing.cpp:213:10:213:11 | m1 | semmle.label | m1 |
+| aliasing.cpp:213:10:213:11 | m1 [m1] | semmle.label | m1 [m1] |
+| aliasing.cpp:225:15:225:22 | taint_a_ptr output argument | semmle.label | taint_a_ptr output argument |
+| aliasing.cpp:225:15:225:22 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
+| aliasing.cpp:225:19:225:19 | s [post update] [s, m1] | semmle.label | s [post update] [s, m1] |
+| aliasing.cpp:225:21:225:22 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
+| aliasing.cpp:226:12:226:12 | s [m1] | semmle.label | s [m1] |
+| aliasing.cpp:226:12:226:12 | s [s, m1] | semmle.label | s [s, m1] |
+| aliasing.cpp:227:10:227:11 | m1 | semmle.label | m1 |
+| aliasing.cpp:227:10:227:11 | m1 [m1] | semmle.label | m1 [m1] |
 | arrays.cpp:6:12:6:21 | call to user_input | semmle.label | call to user_input |
 | arrays.cpp:7:8:7:13 | access to array | semmle.label | access to array |
 | arrays.cpp:9:8:9:11 | * ... | semmle.label | * ... |
@@ -319,60 +453,103 @@ nodes
 | by_reference.cpp:68:21:68:30 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:69:8:69:20 | call to nonMemberGetA | semmle.label | call to nonMemberGetA |
 | by_reference.cpp:84:3:84:25 | Chi [a] | semmle.label | Chi [a] |
+| by_reference.cpp:84:10:84:10 | a [post update] [a] | semmle.label | a [post update] [a] |
 | by_reference.cpp:84:14:84:23 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:88:3:88:24 | Chi [a] | semmle.label | Chi [a] |
+| by_reference.cpp:88:9:88:9 | a [post update] [a] | semmle.label | a [post update] [a] |
 | by_reference.cpp:88:13:88:22 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:92:3:92:20 | Chi [array content] | semmle.label | Chi [array content] |
+| by_reference.cpp:92:3:92:20 | ChiTotal [post update] [array content] | semmle.label | ChiTotal [post update] [array content] |
 | by_reference.cpp:92:9:92:18 | call to user_input | semmle.label | call to user_input |
 | by_reference.cpp:96:3:96:19 | Chi [array content] | semmle.label | Chi [array content] |
+| by_reference.cpp:96:3:96:19 | ChiTotal [post update] [array content] | semmle.label | ChiTotal [post update] [array content] |
 | by_reference.cpp:96:8:96:17 | call to user_input | semmle.label | call to user_input |
-| by_reference.cpp:102:21:102:39 | Chi [a] | semmle.label | Chi [a] |
 | by_reference.cpp:102:21:102:39 | taint_inner_a_ptr output argument [a] | semmle.label | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:104:15:104:22 | Chi | semmle.label | Chi |
-| by_reference.cpp:104:15:104:22 | Chi [a] | semmle.label | Chi [a] |
+| by_reference.cpp:102:28:102:39 | inner_nested [post update] [a, a] | semmle.label | inner_nested [post update] [a, a] |
+| by_reference.cpp:104:15:104:22 | taint_a_ptr output argument | semmle.label | taint_a_ptr output argument |
 | by_reference.cpp:104:15:104:22 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
-| by_reference.cpp:106:21:106:41 | Chi [a] | semmle.label | Chi [a] |
+| by_reference.cpp:104:22:104:22 | a [post update] [a] | semmle.label | a [post update] [a] |
 | by_reference.cpp:106:21:106:41 | taint_inner_a_ptr output argument [a] | semmle.label | taint_inner_a_ptr output argument [a] |
-| by_reference.cpp:108:15:108:24 | Chi | semmle.label | Chi |
-| by_reference.cpp:108:15:108:24 | Chi [a] | semmle.label | Chi [a] |
+| by_reference.cpp:106:30:106:41 | inner_nested [post update] [a, a] | semmle.label | inner_nested [post update] [a, a] |
+| by_reference.cpp:108:15:108:24 | taint_a_ptr output argument | semmle.label | taint_a_ptr output argument |
 | by_reference.cpp:108:15:108:24 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
+| by_reference.cpp:108:24:108:24 | a [post update] [a] | semmle.label | a [post update] [a] |
+| by_reference.cpp:110:14:110:25 | inner_nested [a, a] | semmle.label | inner_nested [a, a] |
 | by_reference.cpp:110:27:110:27 | a | semmle.label | a |
+| by_reference.cpp:110:27:110:27 | a [a] | semmle.label | a [a] |
 | by_reference.cpp:112:14:112:14 | a | semmle.label | a |
+| by_reference.cpp:112:14:112:14 | a [a] | semmle.label | a [a] |
+| by_reference.cpp:114:16:114:27 | inner_nested [a, a] | semmle.label | inner_nested [a, a] |
 | by_reference.cpp:114:29:114:29 | a | semmle.label | a |
+| by_reference.cpp:114:29:114:29 | a [a] | semmle.label | a [a] |
 | by_reference.cpp:116:16:116:16 | a | semmle.label | a |
-| by_reference.cpp:122:21:122:38 | Chi [a] | semmle.label | Chi [a] |
+| by_reference.cpp:116:16:116:16 | a [a] | semmle.label | a [a] |
 | by_reference.cpp:122:21:122:38 | taint_inner_a_ref output argument [a] | semmle.label | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:124:15:124:21 | Chi | semmle.label | Chi |
-| by_reference.cpp:124:15:124:21 | Chi [a] | semmle.label | Chi [a] |
+| by_reference.cpp:122:27:122:38 | inner_nested [post update] [a, a] | semmle.label | inner_nested [post update] [a, a] |
+| by_reference.cpp:124:15:124:21 | taint_a_ref output argument | semmle.label | taint_a_ref output argument |
 | by_reference.cpp:124:15:124:21 | taint_a_ref output argument [array content] | semmle.label | taint_a_ref output argument [array content] |
-| by_reference.cpp:126:21:126:40 | Chi [a] | semmle.label | Chi [a] |
+| by_reference.cpp:124:21:124:21 | a [post update] [a] | semmle.label | a [post update] [a] |
 | by_reference.cpp:126:21:126:40 | taint_inner_a_ref output argument [a] | semmle.label | taint_inner_a_ref output argument [a] |
-| by_reference.cpp:128:15:128:23 | Chi | semmle.label | Chi |
-| by_reference.cpp:128:15:128:23 | Chi [a] | semmle.label | Chi [a] |
+| by_reference.cpp:126:29:126:40 | inner_nested [post update] [a, a] | semmle.label | inner_nested [post update] [a, a] |
+| by_reference.cpp:128:15:128:23 | taint_a_ref output argument | semmle.label | taint_a_ref output argument |
 | by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] | semmle.label | taint_a_ref output argument [array content] |
+| by_reference.cpp:128:23:128:23 | a [post update] [a] | semmle.label | a [post update] [a] |
+| by_reference.cpp:130:14:130:25 | inner_nested [a, a] | semmle.label | inner_nested [a, a] |
 | by_reference.cpp:130:27:130:27 | a | semmle.label | a |
+| by_reference.cpp:130:27:130:27 | a [a] | semmle.label | a [a] |
 | by_reference.cpp:132:14:132:14 | a | semmle.label | a |
+| by_reference.cpp:132:14:132:14 | a [a] | semmle.label | a [a] |
+| by_reference.cpp:134:16:134:27 | inner_nested [a, a] | semmle.label | inner_nested [a, a] |
 | by_reference.cpp:134:29:134:29 | a | semmle.label | a |
+| by_reference.cpp:134:29:134:29 | a [a] | semmle.label | a [a] |
 | by_reference.cpp:136:16:136:16 | a | semmle.label | a |
+| by_reference.cpp:136:16:136:16 | a [a] | semmle.label | a [a] |
 | complex.cpp:40:17:40:17 | *b [a_] | semmle.label | *b [a_] |
 | complex.cpp:40:17:40:17 | *b [b_] | semmle.label | *b [b_] |
-| complex.cpp:42:16:42:16 | Chi [b_] | semmle.label | Chi [b_] |
+| complex.cpp:40:17:40:17 | *b [f, f, a_] | semmle.label | *b [f, f, a_] |
+| complex.cpp:40:17:40:17 | *b [f, f, b_] | semmle.label | *b [f, f, b_] |
+| complex.cpp:40:17:40:17 | *b [f, f, f, f, a_] | semmle.label | *b [f, f, f, f, a_] |
+| complex.cpp:42:10:42:14 | inner [f, f, a_] | semmle.label | inner [f, f, a_] |
+| complex.cpp:42:10:42:14 | inner [f, f, b_] | semmle.label | inner [f, f, b_] |
+| complex.cpp:42:10:42:14 | inner [f, f, f, f, a_] | semmle.label | inner [f, f, f, f, a_] |
+| complex.cpp:42:10:42:14 | inner [post update] [f, f, b_] | semmle.label | inner [post update] [f, f, b_] |
+| complex.cpp:42:10:42:14 | inner [post update] [f, f, f, f, b_] | semmle.label | inner [post update] [f, f, f, f, b_] |
 | complex.cpp:42:16:42:16 | a output argument [b_] | semmle.label | a output argument [b_] |
+| complex.cpp:42:16:42:16 | a output argument [f, f, b_] | semmle.label | a output argument [f, f, b_] |
+| complex.cpp:42:16:42:16 | f [f, a_] | semmle.label | f [f, a_] |
+| complex.cpp:42:16:42:16 | f [f, b_] | semmle.label | f [f, b_] |
+| complex.cpp:42:16:42:16 | f [f, f, f, a_] | semmle.label | f [f, f, f, a_] |
+| complex.cpp:42:16:42:16 | f [post update] [f, b_] | semmle.label | f [post update] [f, b_] |
+| complex.cpp:42:16:42:16 | f [post update] [f, f, f, b_] | semmle.label | f [post update] [f, f, f, b_] |
 | complex.cpp:42:18:42:18 | call to a | semmle.label | call to a |
+| complex.cpp:43:10:43:14 | inner [f, f, b_] | semmle.label | inner [f, f, b_] |
+| complex.cpp:43:10:43:14 | inner [f, f, f, f, b_] | semmle.label | inner [f, f, f, f, b_] |
+| complex.cpp:43:16:43:16 | f [f, b_] | semmle.label | f [f, b_] |
+| complex.cpp:43:16:43:16 | f [f, f, f, b_] | semmle.label | f [f, f, f, b_] |
 | complex.cpp:43:18:43:18 | call to b | semmle.label | call to b |
-| complex.cpp:53:12:53:12 | Chi [a_] | semmle.label | Chi [a_] |
+| complex.cpp:53:6:53:10 | inner [post update] [f, f, a_] | semmle.label | inner [post update] [f, f, a_] |
+| complex.cpp:53:12:53:12 | f [post update] [f, a_] | semmle.label | f [post update] [f, a_] |
 | complex.cpp:53:12:53:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | complex.cpp:53:19:53:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:54:12:54:12 | Chi [b_] | semmle.label | Chi [b_] |
+| complex.cpp:54:6:54:10 | inner [post update] [f, f, b_] | semmle.label | inner [post update] [f, f, b_] |
+| complex.cpp:54:12:54:12 | f [post update] [f, b_] | semmle.label | f [post update] [f, b_] |
 | complex.cpp:54:12:54:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
 | complex.cpp:54:19:54:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:55:12:55:12 | Chi [a_] | semmle.label | Chi [a_] |
+| complex.cpp:55:6:55:10 | inner [post update] [f, f, a_] | semmle.label | inner [post update] [f, f, a_] |
+| complex.cpp:55:12:55:12 | f [post update] [f, a_] | semmle.label | f [post update] [f, a_] |
 | complex.cpp:55:12:55:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
 | complex.cpp:55:19:55:28 | call to user_input | semmle.label | call to user_input |
-| complex.cpp:56:12:56:12 | Chi [a_] | semmle.label | Chi [a_] |
-| complex.cpp:56:12:56:12 | Chi [b_] | semmle.label | Chi [b_] |
+| complex.cpp:56:6:56:10 | inner [f, f, a_] | semmle.label | inner [f, f, a_] |
+| complex.cpp:56:6:56:10 | inner [post update] [f, f, a_] | semmle.label | inner [post update] [f, f, a_] |
+| complex.cpp:56:6:56:10 | inner [post update] [f, f, b_] | semmle.label | inner [post update] [f, f, b_] |
+| complex.cpp:56:6:56:10 | inner [post update] [f, f, f, f, a_] | semmle.label | inner [post update] [f, f, f, f, a_] |
+| complex.cpp:56:12:56:12 | f [f, a_] | semmle.label | f [f, a_] |
+| complex.cpp:56:12:56:12 | f [post update] [f, a_] | semmle.label | f [post update] [f, a_] |
+| complex.cpp:56:12:56:12 | f [post update] [f, b_] | semmle.label | f [post update] [f, b_] |
+| complex.cpp:56:12:56:12 | f [post update] [f, f, f, a_] | semmle.label | f [post update] [f, f, f, a_] |
 | complex.cpp:56:12:56:12 | setB output argument [a_] | semmle.label | setB output argument [a_] |
 | complex.cpp:56:12:56:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
+| complex.cpp:56:12:56:12 | setB output argument [f, f, a_] | semmle.label | setB output argument [f, f, a_] |
 | complex.cpp:56:19:56:28 | call to user_input | semmle.label | call to user_input |
 | constructors.cpp:26:15:26:15 | *f [a_] | semmle.label | *f [a_] |
 | constructors.cpp:26:15:26:15 | *f [b_] | semmle.label | *f [b_] |
@@ -401,25 +578,29 @@ nodes
 | simple.cpp:42:5:42:5 | setB output argument [a_] | semmle.label | setB output argument [a_] |
 | simple.cpp:42:5:42:5 | setB output argument [b_] | semmle.label | setB output argument [b_] |
 | simple.cpp:42:12:42:21 | call to user_input | semmle.label | call to user_input |
-| simple.cpp:65:5:65:22 | Store [i] | semmle.label | Store [i] |
+| simple.cpp:65:7:65:7 | i [post update] [i] | semmle.label | i [post update] [i] |
 | simple.cpp:65:11:65:20 | call to user_input | semmle.label | call to user_input |
-| simple.cpp:66:12:66:12 | Store [i] | semmle.label | Store [i] |
 | simple.cpp:67:13:67:13 | i | semmle.label | i |
-| simple.cpp:83:9:83:28 | Chi [f1] | semmle.label | Chi [f1] |
+| simple.cpp:67:13:67:13 | i [i] | semmle.label | i [i] |
+| simple.cpp:83:9:83:10 | f2 [post update] [f1, f1] | semmle.label | f2 [post update] [f1, f1] |
+| simple.cpp:83:12:83:13 | f1 [post update] [f1] | semmle.label | f1 [post update] [f1] |
 | simple.cpp:83:17:83:26 | call to user_input | semmle.label | call to user_input |
 | simple.cpp:84:14:84:20 | call to getf2f1 | semmle.label | call to getf2f1 |
-| simple.cpp:92:5:92:22 | Store [i] | semmle.label | Store [i] |
+| simple.cpp:92:7:92:7 | i [post update] [i] | semmle.label | i [post update] [i] |
 | simple.cpp:92:11:92:20 | call to user_input | semmle.label | call to user_input |
-| simple.cpp:93:20:93:20 | Store [i] | semmle.label | Store [i] |
 | simple.cpp:94:13:94:13 | i | semmle.label | i |
+| simple.cpp:94:13:94:13 | i [i] | semmle.label | i [i] |
 | struct_init.c:14:24:14:25 | *ab [a] | semmle.label | *ab [a] |
 | struct_init.c:15:12:15:12 | a | semmle.label | a |
-| struct_init.c:20:20:20:29 | Chi [a] | semmle.label | Chi [a] |
+| struct_init.c:15:12:15:12 | a [a] | semmle.label | a [a] |
+| struct_init.c:20:17:20:36 | a [post update] [a] | semmle.label | a [post update] [a] |
 | struct_init.c:20:20:20:29 | call to user_input | semmle.label | call to user_input |
 | struct_init.c:22:11:22:11 | a | semmle.label | a |
-| struct_init.c:27:7:27:16 | Chi [a] | semmle.label | Chi [a] |
+| struct_init.c:26:23:29:3 | nestedAB [post update] [nestedAB, a] | semmle.label | nestedAB [post update] [nestedAB, a] |
+| struct_init.c:27:5:27:23 | a [post update] [a] | semmle.label | a [post update] [a] |
 | struct_init.c:27:7:27:16 | call to user_input | semmle.label | call to user_input |
 | struct_init.c:31:23:31:23 | a | semmle.label | a |
+| struct_init.c:36:17:36:24 | nestedAB [nestedAB, a] | semmle.label | nestedAB [nestedAB, a] |
 #select
 | A.cpp:56:13:56:15 | call to get | A.cpp:55:12:55:19 | (C *)... | A.cpp:56:13:56:15 | call to get | call to get flows from $@ | A.cpp:55:12:55:19 | (C *)... | (C *)... |
 | A.cpp:56:13:56:15 | call to get | A.cpp:55:12:55:19 | new | A.cpp:56:13:56:15 | call to get | call to get flows from $@ | A.cpp:55:12:55:19 | new | new |
@@ -449,6 +630,8 @@ nodes
 | aliasing.cpp:176:13:176:14 | m1 | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:176:13:176:14 | m1 | m1 flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |
 | aliasing.cpp:189:15:189:16 | m1 | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:189:15:189:16 | m1 | m1 flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |
 | aliasing.cpp:201:15:201:16 | m1 | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:201:15:201:16 | m1 | m1 flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |
+| aliasing.cpp:213:10:213:11 | m1 | aliasing.cpp:211:13:211:22 | call to user_input | aliasing.cpp:213:10:213:11 | m1 | m1 flows from $@ | aliasing.cpp:211:13:211:22 | call to user_input | call to user_input |
+| aliasing.cpp:227:10:227:11 | m1 | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:227:10:227:11 | m1 | m1 flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |
 | arrays.cpp:7:8:7:13 | access to array | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:7:8:7:13 | access to array | access to array flows from $@ | arrays.cpp:6:12:6:21 | call to user_input | call to user_input |
 | arrays.cpp:9:8:9:11 | * ... | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:9:8:9:11 | * ... | * ... flows from $@ | arrays.cpp:6:12:6:21 | call to user_input | call to user_input |
 | arrays.cpp:10:8:10:15 | * ... | arrays.cpp:6:12:6:21 | call to user_input | arrays.cpp:10:8:10:15 | * ... | * ... flows from $@ | arrays.cpp:6:12:6:21 | call to user_input | call to user_input |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
index ee0a3a33779..5cf7504fa1f 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
@@ -1,12 +1,12 @@
 | A.cpp:25:13:25:13 | c | AST only |
 | A.cpp:27:28:27:28 | c | AST only |
+| A.cpp:28:29:28:29 | this | IR only |
 | A.cpp:31:20:31:20 | c | AST only |
 | A.cpp:40:5:40:6 | cc | AST only |
 | A.cpp:41:5:41:6 | ct | AST only |
 | A.cpp:42:10:42:12 | & ... | AST only |
 | A.cpp:43:10:43:12 | & ... | AST only |
 | A.cpp:48:20:48:20 | c | AST only |
-| A.cpp:49:10:49:10 | b | AST only |
 | A.cpp:49:13:49:13 | c | AST only |
 | A.cpp:55:5:55:5 | b | AST only |
 | A.cpp:56:10:56:10 | b | AST only |
@@ -14,15 +14,11 @@
 | A.cpp:57:28:57:30 | call to get | AST only |
 | A.cpp:64:10:64:15 | this | AST only |
 | A.cpp:64:17:64:18 | b1 | AST only |
-| A.cpp:65:10:65:11 | b1 | AST only |
 | A.cpp:65:14:65:14 | c | AST only |
-| A.cpp:66:10:66:11 | b2 | AST only |
 | A.cpp:66:14:66:14 | c | AST only |
 | A.cpp:73:10:73:19 | this | AST only |
 | A.cpp:73:21:73:22 | b1 | AST only |
-| A.cpp:74:10:74:11 | b1 | AST only |
 | A.cpp:74:14:74:14 | c | AST only |
-| A.cpp:75:10:75:11 | b2 | AST only |
 | A.cpp:75:14:75:14 | c | AST only |
 | A.cpp:81:10:81:15 | this | AST only |
 | A.cpp:81:17:81:18 | b1 | AST only |
@@ -34,85 +30,61 @@
 | A.cpp:100:9:100:9 | a | AST only |
 | A.cpp:101:5:101:6 | this | AST only |
 | A.cpp:101:8:101:9 | c1 | AST only |
-| A.cpp:107:12:107:13 | c1 | AST only |
 | A.cpp:107:16:107:16 | a | AST only |
-| A.cpp:120:12:120:13 | c1 | AST only |
 | A.cpp:120:16:120:16 | a | AST only |
 | A.cpp:126:5:126:5 | b | AST only |
 | A.cpp:131:5:131:6 | this | AST only |
 | A.cpp:131:8:131:8 | b | AST only |
-| A.cpp:132:10:132:10 | b | AST only |
 | A.cpp:132:13:132:13 | c | AST only |
 | A.cpp:142:10:142:10 | c | AST only |
 | A.cpp:143:13:143:13 | b | AST only |
 | A.cpp:151:18:151:18 | b | AST only |
 | A.cpp:151:21:151:21 | this | AST only |
-| A.cpp:152:10:152:10 | d | AST only |
 | A.cpp:152:13:152:13 | b | AST only |
-| A.cpp:153:10:153:10 | d | AST only |
-| A.cpp:153:13:153:13 | b | AST only |
 | A.cpp:153:16:153:16 | c | AST only |
-| A.cpp:154:10:154:10 | b | AST only |
 | A.cpp:154:13:154:13 | c | AST only |
 | A.cpp:160:29:160:29 | b | AST only |
 | A.cpp:161:38:161:39 | l1 | AST only |
 | A.cpp:162:38:162:39 | l2 | AST only |
-| A.cpp:163:10:163:11 | l3 | AST only |
 | A.cpp:163:14:163:17 | head | AST only |
-| A.cpp:164:10:164:11 | l3 | AST only |
-| A.cpp:164:14:164:17 | next | AST only |
 | A.cpp:164:20:164:23 | head | AST only |
-| A.cpp:165:10:165:11 | l3 | AST only |
-| A.cpp:165:14:165:17 | next | AST only |
-| A.cpp:165:20:165:23 | next | AST only |
 | A.cpp:165:26:165:29 | head | AST only |
-| A.cpp:166:10:166:11 | l3 | AST only |
-| A.cpp:166:14:166:17 | next | AST only |
-| A.cpp:166:20:166:23 | next | AST only |
-| A.cpp:166:26:166:29 | next | AST only |
 | A.cpp:166:32:166:35 | head | AST only |
-| A.cpp:169:12:169:12 | l | AST only |
+| A.cpp:167:47:167:50 | l | IR only |
 | A.cpp:169:15:169:18 | head | AST only |
 | A.cpp:183:7:183:10 | head | AST only |
 | A.cpp:184:13:184:16 | next | AST only |
 | B.cpp:7:25:7:25 | e | AST only |
 | B.cpp:8:25:8:26 | b1 | AST only |
-| B.cpp:9:10:9:11 | b2 | AST only |
-| B.cpp:9:14:9:17 | box1 | AST only |
 | B.cpp:9:20:9:24 | elem1 | AST only |
-| B.cpp:10:10:10:11 | b2 | AST only |
-| B.cpp:10:14:10:17 | box1 | AST only |
 | B.cpp:10:20:10:24 | elem2 | AST only |
 | B.cpp:16:37:16:37 | e | AST only |
 | B.cpp:17:25:17:26 | b1 | AST only |
-| B.cpp:18:10:18:11 | b2 | AST only |
-| B.cpp:18:14:18:17 | box1 | AST only |
 | B.cpp:18:20:18:24 | elem1 | AST only |
-| B.cpp:19:10:19:11 | b2 | AST only |
-| B.cpp:19:14:19:17 | box1 | AST only |
 | B.cpp:19:20:19:24 | elem2 | AST only |
 | B.cpp:35:13:35:17 | elem1 | AST only |
 | B.cpp:36:13:36:17 | elem2 | AST only |
 | B.cpp:46:13:46:16 | box1 | AST only |
 | C.cpp:19:5:19:5 | c | AST only |
 | C.cpp:24:11:24:12 | s3 | AST only |
+| C.cpp:29:10:29:11 | this | IR only |
+| C.cpp:30:10:30:11 | this | IR only |
+| C.cpp:31:10:31:11 | this | IR only |
 | D.cpp:9:21:9:24 | elem | AST only |
+| D.cpp:10:30:10:33 | this | IR only |
 | D.cpp:11:29:11:32 | elem | AST only |
 | D.cpp:16:21:16:23 | box | AST only |
+| D.cpp:17:30:17:32 | this | IR only |
 | D.cpp:18:29:18:31 | box | AST only |
 | D.cpp:22:10:22:11 | b2 | AST only |
 | D.cpp:22:14:22:20 | call to getBox1 | AST only |
 | D.cpp:22:25:22:31 | call to getElem | AST only |
-| D.cpp:30:5:30:5 | b | AST only |
-| D.cpp:30:8:30:10 | box | AST only |
 | D.cpp:30:13:30:16 | elem | AST only |
 | D.cpp:31:14:31:14 | b | AST only |
-| D.cpp:37:5:37:5 | b | AST only |
 | D.cpp:37:8:37:10 | box | AST only |
 | D.cpp:37:21:37:21 | e | AST only |
 | D.cpp:38:14:38:14 | b | AST only |
 | D.cpp:44:5:44:5 | b | AST only |
-| D.cpp:44:8:44:14 | call to getBox1 | AST only |
 | D.cpp:44:19:44:22 | elem | AST only |
 | D.cpp:45:14:45:14 | b | AST only |
 | D.cpp:51:5:51:5 | b | AST only |
@@ -120,26 +92,14 @@
 | D.cpp:51:27:51:27 | e | AST only |
 | D.cpp:52:14:52:14 | b | AST only |
 | D.cpp:57:5:57:12 | boxfield | AST only |
-| D.cpp:58:5:58:12 | boxfield | AST only |
-| D.cpp:58:5:58:12 | this | AST only |
-| D.cpp:58:15:58:17 | box | AST only |
 | D.cpp:58:20:58:23 | elem | AST only |
 | D.cpp:59:5:59:7 | this | AST only |
-| D.cpp:64:10:64:17 | boxfield | AST only |
-| D.cpp:64:10:64:17 | this | AST only |
-| D.cpp:64:20:64:22 | box | AST only |
 | D.cpp:64:25:64:28 | elem | AST only |
-| E.cpp:21:10:21:10 | p | AST only |
-| E.cpp:21:13:21:16 | data | AST only |
 | E.cpp:21:18:21:23 | buffer | AST only |
 | E.cpp:28:21:28:23 | raw | AST only |
-| E.cpp:29:21:29:21 | b | AST only |
 | E.cpp:29:24:29:29 | buffer | AST only |
-| E.cpp:30:21:30:21 | p | AST only |
-| E.cpp:30:23:30:26 | data | AST only |
 | E.cpp:30:28:30:33 | buffer | AST only |
 | E.cpp:31:10:31:12 | raw | AST only |
-| E.cpp:32:10:32:10 | b | AST only |
 | E.cpp:32:13:32:18 | buffer | AST only |
 | E.cpp:33:18:33:19 | & ... | AST only |
 | aliasing.cpp:9:6:9:7 | m1 | AST only |
@@ -147,87 +107,92 @@
 | aliasing.cpp:17:5:17:6 | m1 | AST only |
 | aliasing.cpp:25:17:25:19 | & ... | AST only |
 | aliasing.cpp:26:19:26:20 | s2 | AST only |
+| aliasing.cpp:29:11:29:12 | s1 | IR only |
+| aliasing.cpp:30:11:30:12 | s2 | IR only |
+| aliasing.cpp:31:11:31:12 | s3 | IR only |
 | aliasing.cpp:37:8:37:9 | m1 | AST only |
+| aliasing.cpp:38:11:38:12 | s1 | IR only |
 | aliasing.cpp:42:6:42:7 | m1 | AST only |
+| aliasing.cpp:43:13:43:14 | ref2 | IR only |
 | aliasing.cpp:49:9:49:10 | m1 | AST only |
+| aliasing.cpp:50:11:50:12 | s1 | IR only |
 | aliasing.cpp:54:6:54:7 | m1 | AST only |
+| aliasing.cpp:55:14:55:15 | copy2 | IR only |
 | aliasing.cpp:60:6:60:7 | m1 | AST only |
+| aliasing.cpp:62:14:62:15 | copy2 | IR only |
+| aliasing.cpp:71:11:71:11 | w | IR only |
 | aliasing.cpp:72:5:72:6 | m1 | AST only |
+| aliasing.cpp:73:10:73:10 | w | IR only |
+| aliasing.cpp:73:12:73:13 | s | IR only |
+| aliasing.cpp:78:13:78:13 | w | IR only |
 | aliasing.cpp:79:6:79:7 | m1 | AST only |
+| aliasing.cpp:80:10:80:10 | w | IR only |
+| aliasing.cpp:80:12:80:13 | s | IR only |
+| aliasing.cpp:85:12:85:12 | w | IR only |
 | aliasing.cpp:86:5:86:6 | m1 | AST only |
-| aliasing.cpp:92:3:92:3 | w | AST only |
+| aliasing.cpp:87:10:87:10 | w | IR only |
+| aliasing.cpp:87:12:87:13 | s | IR only |
 | aliasing.cpp:92:7:92:8 | m1 | AST only |
+| aliasing.cpp:93:10:93:10 | w | IR only |
+| aliasing.cpp:93:12:93:13 | s | IR only |
 | aliasing.cpp:98:5:98:6 | m1 | AST only |
+| aliasing.cpp:101:21:101:22 | s_copy | IR only |
 | aliasing.cpp:106:3:106:5 | * ... | AST only |
 | aliasing.cpp:111:15:111:19 | & ... | AST only |
+| aliasing.cpp:112:10:112:11 | s | IR only |
 | aliasing.cpp:121:15:121:16 | xs | AST only |
 | aliasing.cpp:126:15:126:20 | ... - ... | AST only |
 | aliasing.cpp:131:15:131:16 | xs | AST only |
 | aliasing.cpp:136:15:136:17 | + ... | AST only |
-| aliasing.cpp:141:15:141:15 | s | AST only |
 | aliasing.cpp:141:17:141:20 | data | AST only |
+| aliasing.cpp:143:10:143:13 | s | IR only |
 | aliasing.cpp:147:15:147:22 | & ... | AST only |
-| aliasing.cpp:158:15:158:15 | s | AST only |
+| aliasing.cpp:148:13:148:14 | access to array | IR only |
 | aliasing.cpp:158:17:158:20 | data | AST only |
-| aliasing.cpp:164:15:164:15 | s | AST only |
+| aliasing.cpp:159:11:159:14 | s | IR only |
 | aliasing.cpp:164:17:164:20 | data | AST only |
+| aliasing.cpp:165:10:165:13 | s | IR only |
 | aliasing.cpp:175:15:175:22 | & ... | AST only |
-| aliasing.cpp:175:16:175:17 | s2 | AST only |
+| aliasing.cpp:176:11:176:11 | s2 | IR only |
+| aliasing.cpp:176:13:176:14 | s | IR only |
 | aliasing.cpp:181:15:181:22 | & ... | AST only |
-| aliasing.cpp:181:16:181:17 | s2 | AST only |
+| aliasing.cpp:182:11:182:11 | s2 | IR only |
+| aliasing.cpp:182:13:182:14 | s | IR only |
 | aliasing.cpp:187:15:187:22 | & ... | AST only |
-| aliasing.cpp:187:16:187:17 | s2 | AST only |
+| aliasing.cpp:189:13:189:13 | s2_2 | IR only |
+| aliasing.cpp:189:15:189:16 | s | IR only |
 | aliasing.cpp:194:15:194:22 | & ... | AST only |
-| aliasing.cpp:194:16:194:17 | s2 | AST only |
+| aliasing.cpp:196:13:196:13 | s2_2 | IR only |
+| aliasing.cpp:196:15:196:16 | s | IR only |
 | aliasing.cpp:200:15:200:24 | & ... | AST only |
-| aliasing.cpp:200:16:200:18 | ps2 | AST only |
+| aliasing.cpp:201:13:201:13 | ps2 | IR only |
+| aliasing.cpp:201:15:201:16 | s | IR only |
 | aliasing.cpp:205:15:205:24 | & ... | AST only |
-| aliasing.cpp:205:16:205:18 | ps2 | AST only |
-| aliasing.cpp:211:3:211:4 | s2 | AST only |
+| aliasing.cpp:206:13:206:13 | ps2 | IR only |
+| aliasing.cpp:206:15:206:16 | s | IR only |
 | aliasing.cpp:211:8:211:9 | m1 | AST only |
-| aliasing.cpp:218:3:218:4 | s2 | AST only |
+| aliasing.cpp:212:12:212:12 | s2 | IR only |
+| aliasing.cpp:213:10:213:11 | s | IR only |
 | aliasing.cpp:218:8:218:9 | m1 | AST only |
+| aliasing.cpp:219:12:219:12 | s2 | IR only |
+| aliasing.cpp:220:10:220:11 | s | IR only |
 | aliasing.cpp:225:15:225:22 | & ... | AST only |
-| aliasing.cpp:225:16:225:17 | s2 | AST only |
+| aliasing.cpp:226:12:226:12 | s2 | IR only |
+| aliasing.cpp:227:10:227:11 | s | IR only |
 | aliasing.cpp:232:15:232:22 | & ... | AST only |
-| aliasing.cpp:232:16:232:17 | s2 | AST only |
+| aliasing.cpp:233:12:233:12 | s2 | IR only |
+| aliasing.cpp:234:10:234:11 | s | IR only |
 | arrays.cpp:6:3:6:8 | access to array | AST only |
 | arrays.cpp:6:3:6:23 | arr | IR only |
 | arrays.cpp:15:3:15:10 | * ... | AST only |
-| arrays.cpp:36:3:36:3 | o | AST only |
-| arrays.cpp:36:5:36:10 | nested | AST only |
 | arrays.cpp:36:19:36:22 | data | AST only |
-| arrays.cpp:37:8:37:8 | o | AST only |
-| arrays.cpp:37:8:37:22 | access to array | AST only |
-| arrays.cpp:37:10:37:15 | nested | AST only |
 | arrays.cpp:37:24:37:27 | data | AST only |
-| arrays.cpp:38:8:38:8 | o | AST only |
-| arrays.cpp:38:8:38:22 | access to array | AST only |
-| arrays.cpp:38:10:38:15 | nested | AST only |
 | arrays.cpp:38:24:38:27 | data | AST only |
-| arrays.cpp:42:3:42:3 | o | AST only |
-| arrays.cpp:42:3:42:20 | access to array | AST only |
-| arrays.cpp:42:5:42:12 | indirect | AST only |
 | arrays.cpp:42:22:42:25 | data | AST only |
-| arrays.cpp:43:8:43:8 | o | AST only |
-| arrays.cpp:43:8:43:25 | access to array | AST only |
-| arrays.cpp:43:10:43:17 | indirect | AST only |
 | arrays.cpp:43:27:43:30 | data | AST only |
-| arrays.cpp:44:8:44:8 | o | AST only |
-| arrays.cpp:44:8:44:25 | access to array | AST only |
-| arrays.cpp:44:10:44:17 | indirect | AST only |
 | arrays.cpp:44:27:44:30 | data | AST only |
-| arrays.cpp:48:3:48:3 | o | AST only |
-| arrays.cpp:48:3:48:20 | access to array | AST only |
-| arrays.cpp:48:5:48:12 | indirect | AST only |
 | arrays.cpp:48:22:48:25 | data | AST only |
-| arrays.cpp:49:8:49:8 | o | AST only |
-| arrays.cpp:49:8:49:25 | access to array | AST only |
-| arrays.cpp:49:10:49:17 | indirect | AST only |
 | arrays.cpp:49:27:49:30 | data | AST only |
-| arrays.cpp:50:8:50:8 | o | AST only |
-| arrays.cpp:50:8:50:25 | access to array | AST only |
-| arrays.cpp:50:10:50:17 | indirect | AST only |
 | arrays.cpp:50:27:50:30 | data | AST only |
 | by_reference.cpp:12:8:12:8 | a | AST only |
 | by_reference.cpp:16:11:16:11 | a | AST only |
@@ -235,6 +200,8 @@
 | by_reference.cpp:20:23:20:27 | value | AST only |
 | by_reference.cpp:24:19:24:22 | this | AST only |
 | by_reference.cpp:24:25:24:29 | value | AST only |
+| by_reference.cpp:32:15:32:15 | s | IR only |
+| by_reference.cpp:36:18:36:18 | this | IR only |
 | by_reference.cpp:50:3:50:3 | s | AST only |
 | by_reference.cpp:50:17:50:26 | call to user_input | AST only |
 | by_reference.cpp:51:10:51:20 | call to getDirectly | AST only |
@@ -252,71 +219,45 @@
 | by_reference.cpp:92:3:92:5 | * ... | AST only |
 | by_reference.cpp:96:3:96:4 | pa | AST only |
 | by_reference.cpp:102:21:102:39 | & ... | AST only |
-| by_reference.cpp:103:21:103:25 | outer | AST only |
 | by_reference.cpp:103:27:103:35 | inner_ptr | AST only |
 | by_reference.cpp:104:15:104:22 | & ... | AST only |
 | by_reference.cpp:106:21:106:41 | & ... | AST only |
-| by_reference.cpp:107:21:107:26 | pouter | AST only |
 | by_reference.cpp:107:29:107:37 | inner_ptr | AST only |
 | by_reference.cpp:108:15:108:24 | & ... | AST only |
-| by_reference.cpp:110:8:110:12 | outer | AST only |
-| by_reference.cpp:110:14:110:25 | inner_nested | AST only |
 | by_reference.cpp:110:27:110:27 | a | AST only |
-| by_reference.cpp:111:8:111:12 | outer | AST only |
-| by_reference.cpp:111:14:111:22 | inner_ptr | AST only |
 | by_reference.cpp:111:25:111:25 | a | AST only |
-| by_reference.cpp:112:8:112:12 | outer | AST only |
 | by_reference.cpp:112:14:112:14 | a | AST only |
-| by_reference.cpp:114:8:114:13 | pouter | AST only |
-| by_reference.cpp:114:16:114:27 | inner_nested | AST only |
 | by_reference.cpp:114:29:114:29 | a | AST only |
-| by_reference.cpp:115:8:115:13 | pouter | AST only |
-| by_reference.cpp:115:16:115:24 | inner_ptr | AST only |
 | by_reference.cpp:115:27:115:27 | a | AST only |
-| by_reference.cpp:116:8:116:13 | pouter | AST only |
 | by_reference.cpp:116:16:116:16 | a | AST only |
 | by_reference.cpp:122:27:122:38 | inner_nested | AST only |
 | by_reference.cpp:123:21:123:36 | * ... | AST only |
-| by_reference.cpp:123:22:123:26 | outer | AST only |
 | by_reference.cpp:124:21:124:21 | a | AST only |
 | by_reference.cpp:126:29:126:40 | inner_nested | AST only |
 | by_reference.cpp:127:21:127:38 | * ... | AST only |
-| by_reference.cpp:127:22:127:27 | pouter | AST only |
 | by_reference.cpp:128:23:128:23 | a | AST only |
-| by_reference.cpp:130:8:130:12 | outer | AST only |
-| by_reference.cpp:130:14:130:25 | inner_nested | AST only |
 | by_reference.cpp:130:27:130:27 | a | AST only |
-| by_reference.cpp:131:8:131:12 | outer | AST only |
-| by_reference.cpp:131:14:131:22 | inner_ptr | AST only |
 | by_reference.cpp:131:25:131:25 | a | AST only |
-| by_reference.cpp:132:8:132:12 | outer | AST only |
 | by_reference.cpp:132:14:132:14 | a | AST only |
-| by_reference.cpp:134:8:134:13 | pouter | AST only |
-| by_reference.cpp:134:16:134:27 | inner_nested | AST only |
 | by_reference.cpp:134:29:134:29 | a | AST only |
-| by_reference.cpp:135:8:135:13 | pouter | AST only |
-| by_reference.cpp:135:16:135:24 | inner_ptr | AST only |
 | by_reference.cpp:135:27:135:27 | a | AST only |
-| by_reference.cpp:136:8:136:13 | pouter | AST only |
 | by_reference.cpp:136:16:136:16 | a | AST only |
+| complex.cpp:9:20:9:21 | this | IR only |
+| complex.cpp:10:20:10:21 | this | IR only |
 | complex.cpp:11:22:11:23 | a_ | AST only |
 | complex.cpp:12:22:12:23 | b_ | AST only |
-| complex.cpp:42:8:42:8 | b | AST only |
 | complex.cpp:42:16:42:16 | f | AST only |
-| complex.cpp:43:8:43:8 | b | AST only |
 | complex.cpp:43:16:43:16 | f | AST only |
-| complex.cpp:53:3:53:4 | b1 | AST only |
 | complex.cpp:53:12:53:12 | f | AST only |
-| complex.cpp:54:3:54:4 | b2 | AST only |
 | complex.cpp:54:12:54:12 | f | AST only |
-| complex.cpp:55:3:55:4 | b3 | AST only |
 | complex.cpp:55:12:55:12 | f | AST only |
-| complex.cpp:56:3:56:4 | b3 | AST only |
 | complex.cpp:56:12:56:12 | f | AST only |
 | complex.cpp:59:7:59:8 | b1 | AST only |
 | complex.cpp:62:7:62:8 | b2 | AST only |
 | complex.cpp:65:7:65:8 | b3 | AST only |
 | complex.cpp:68:7:68:8 | b4 | AST only |
+| constructors.cpp:18:22:18:23 | this | IR only |
+| constructors.cpp:19:22:19:23 | this | IR only |
 | constructors.cpp:20:24:20:25 | a_ | AST only |
 | constructors.cpp:21:24:21:25 | b_ | AST only |
 | constructors.cpp:28:10:28:10 | f | AST only |
@@ -328,68 +269,55 @@
 | qualifiers.cpp:9:36:9:36 | a | AST only |
 | qualifiers.cpp:12:56:12:56 | a | AST only |
 | qualifiers.cpp:13:57:13:57 | a | AST only |
+| qualifiers.cpp:18:32:18:36 | this | IR only |
 | qualifiers.cpp:22:5:22:9 | outer | AST only |
-| qualifiers.cpp:22:11:22:18 | call to getInner | AST only |
 | qualifiers.cpp:22:23:22:23 | a | AST only |
-| qualifiers.cpp:23:10:23:14 | outer | AST only |
-| qualifiers.cpp:23:16:23:20 | inner | AST only |
 | qualifiers.cpp:23:23:23:23 | a | AST only |
 | qualifiers.cpp:27:5:27:9 | outer | AST only |
 | qualifiers.cpp:27:11:27:18 | call to getInner | AST only |
 | qualifiers.cpp:27:28:27:37 | call to user_input | AST only |
-| qualifiers.cpp:28:10:28:14 | outer | AST only |
-| qualifiers.cpp:28:16:28:20 | inner | AST only |
 | qualifiers.cpp:28:23:28:23 | a | AST only |
 | qualifiers.cpp:32:17:32:21 | outer | AST only |
 | qualifiers.cpp:32:23:32:30 | call to getInner | AST only |
 | qualifiers.cpp:32:35:32:44 | call to user_input | AST only |
-| qualifiers.cpp:33:10:33:14 | outer | AST only |
-| qualifiers.cpp:33:16:33:20 | inner | AST only |
 | qualifiers.cpp:33:23:33:23 | a | AST only |
 | qualifiers.cpp:37:19:37:35 | * ... | AST only |
 | qualifiers.cpp:37:20:37:24 | outer | AST only |
 | qualifiers.cpp:37:38:37:47 | call to user_input | AST only |
-| qualifiers.cpp:38:10:38:14 | outer | AST only |
-| qualifiers.cpp:38:16:38:20 | inner | AST only |
 | qualifiers.cpp:38:23:38:23 | a | AST only |
-| qualifiers.cpp:42:6:42:22 | * ... | AST only |
 | qualifiers.cpp:42:7:42:11 | outer | AST only |
 | qualifiers.cpp:42:25:42:25 | a | AST only |
-| qualifiers.cpp:43:10:43:14 | outer | AST only |
-| qualifiers.cpp:43:16:43:20 | inner | AST only |
 | qualifiers.cpp:43:23:43:23 | a | AST only |
 | qualifiers.cpp:47:6:47:11 | & ... | AST only |
-| qualifiers.cpp:47:15:47:22 | call to getInner | AST only |
 | qualifiers.cpp:47:27:47:27 | a | AST only |
-| qualifiers.cpp:48:10:48:14 | outer | AST only |
-| qualifiers.cpp:48:16:48:20 | inner | AST only |
 | qualifiers.cpp:48:23:48:23 | a | AST only |
 | realistic.cpp:26:5:26:10 | offset | AST only |
 | realistic.cpp:42:20:42:20 | o | AST only |
-| realistic.cpp:49:9:49:11 | foo | AST only |
 | realistic.cpp:49:20:49:22 | baz | AST only |
-| realistic.cpp:53:9:53:11 | foo | AST only |
-| realistic.cpp:53:9:53:18 | access to array | AST only |
-| realistic.cpp:53:20:53:22 | baz | AST only |
-| realistic.cpp:53:25:53:33 | userInput | AST only |
 | realistic.cpp:53:35:53:43 | bufferLen | AST only |
-| realistic.cpp:54:16:54:18 | foo | AST only |
-| realistic.cpp:54:16:54:25 | access to array | AST only |
-| realistic.cpp:54:27:54:29 | baz | AST only |
-| realistic.cpp:54:32:54:40 | userInput | AST only |
 | realistic.cpp:54:42:54:47 | buffer | AST only |
+| realistic.cpp:55:16:55:18 | foo | IR only |
+| realistic.cpp:55:23:55:25 | access to array | IR only |
+| realistic.cpp:55:28:55:36 | baz | IR only |
+| realistic.cpp:55:38:55:46 | userInput | IR only |
+| realistic.cpp:57:92:57:94 | foo | IR only |
+| realistic.cpp:57:99:57:101 | access to array | IR only |
+| realistic.cpp:57:104:57:112 | baz | IR only |
+| realistic.cpp:57:114:57:122 | userInput | IR only |
 | realistic.cpp:60:16:60:18 | dst | AST only |
-| realistic.cpp:61:21:61:23 | foo | AST only |
-| realistic.cpp:61:21:61:30 | access to array | AST only |
-| realistic.cpp:61:32:61:34 | baz | AST only |
-| realistic.cpp:61:37:61:45 | userInput | AST only |
+| realistic.cpp:60:25:60:27 | foo | IR only |
+| realistic.cpp:60:32:60:34 | access to array | IR only |
+| realistic.cpp:60:37:60:45 | baz | IR only |
+| realistic.cpp:60:47:60:52 | userInput | IR only |
+| realistic.cpp:60:59:60:61 | foo | IR only |
+| realistic.cpp:60:66:60:68 | access to array | IR only |
+| realistic.cpp:60:71:60:79 | baz | IR only |
+| realistic.cpp:60:81:60:89 | userInput | IR only |
 | realistic.cpp:61:47:61:55 | bufferLen | AST only |
-| realistic.cpp:65:21:65:23 | foo | AST only |
-| realistic.cpp:65:21:65:30 | access to array | AST only |
-| realistic.cpp:65:32:65:34 | baz | AST only |
-| realistic.cpp:65:37:65:45 | userInput | AST only |
 | realistic.cpp:65:47:65:52 | buffer | AST only |
 | realistic.cpp:66:21:66:23 | dst | AST only |
+| simple.cpp:18:22:18:23 | this | IR only |
+| simple.cpp:19:22:19:23 | this | IR only |
 | simple.cpp:20:24:20:25 | a_ | AST only |
 | simple.cpp:21:24:21:25 | b_ | AST only |
 | simple.cpp:28:10:28:10 | f | AST only |
@@ -403,33 +331,24 @@
 | simple.cpp:51:9:51:9 | h | AST only |
 | simple.cpp:54:9:54:9 | i | AST only |
 | simple.cpp:65:7:65:7 | i | AST only |
-| simple.cpp:83:9:83:10 | this | AST only |
+| simple.cpp:67:13:67:13 | a2 | IR only |
+| simple.cpp:79:16:79:17 | this | IR only |
+| simple.cpp:79:19:79:20 | f2 | IR only |
 | simple.cpp:83:12:83:13 | f1 | AST only |
 | simple.cpp:84:14:84:20 | this | AST only |
 | simple.cpp:92:7:92:7 | i | AST only |
-| simple.cpp:104:5:104:5 | b | AST only |
+| simple.cpp:94:13:94:13 | a2 | IR only |
 | simple.cpp:104:9:104:9 | i | AST only |
-| struct_init.c:15:8:15:9 | ab | AST only |
+| simple.cpp:106:13:106:13 | b2 | IR only |
+| simple.cpp:106:15:106:15 | a | IR only |
 | struct_init.c:15:12:15:12 | a | AST only |
-| struct_init.c:16:8:16:9 | ab | AST only |
 | struct_init.c:16:12:16:12 | b | AST only |
-| struct_init.c:22:8:22:9 | ab | AST only |
 | struct_init.c:22:11:22:11 | a | AST only |
-| struct_init.c:23:8:23:9 | ab | AST only |
 | struct_init.c:23:11:23:11 | b | AST only |
 | struct_init.c:24:10:24:12 | & ... | AST only |
-| struct_init.c:31:8:31:12 | outer | AST only |
-| struct_init.c:31:14:31:21 | nestedAB | AST only |
 | struct_init.c:31:23:31:23 | a | AST only |
-| struct_init.c:32:8:32:12 | outer | AST only |
-| struct_init.c:32:14:32:21 | nestedAB | AST only |
 | struct_init.c:32:23:32:23 | b | AST only |
-| struct_init.c:33:8:33:12 | outer | AST only |
-| struct_init.c:33:14:33:22 | pointerAB | AST only |
 | struct_init.c:33:25:33:25 | a | AST only |
-| struct_init.c:34:8:34:12 | outer | AST only |
-| struct_init.c:34:14:34:22 | pointerAB | AST only |
 | struct_init.c:34:25:34:25 | b | AST only |
 | struct_init.c:36:10:36:24 | & ... | AST only |
-| struct_init.c:46:10:46:14 | outer | AST only |
 | struct_init.c:46:16:46:24 | pointerAB | AST only |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected
index 5b73bf8dd33..0f534661aa5 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected
@@ -1,76 +1,323 @@
 | A.cpp:25:7:25:10 | this |
 | A.cpp:27:22:27:25 | this |
+| A.cpp:28:23:28:26 | this |
+| A.cpp:49:10:49:10 | b |
+| A.cpp:65:10:65:11 | b1 |
+| A.cpp:66:10:66:11 | b2 |
+| A.cpp:74:10:74:11 | b1 |
+| A.cpp:75:10:75:11 | b2 |
 | A.cpp:100:5:100:6 | c1 |
+| A.cpp:107:12:107:13 | c1 |
+| A.cpp:120:12:120:13 | c1 |
+| A.cpp:132:10:132:10 | b |
 | A.cpp:142:7:142:7 | b |
 | A.cpp:143:7:143:10 | this |
+| A.cpp:152:10:152:10 | d |
+| A.cpp:153:10:153:10 | d |
+| A.cpp:153:13:153:13 | b |
+| A.cpp:154:10:154:10 | b |
+| A.cpp:163:10:163:11 | l3 |
+| A.cpp:164:10:164:11 | l3 |
+| A.cpp:164:14:164:17 | next |
+| A.cpp:165:10:165:11 | l3 |
+| A.cpp:165:14:165:17 | next |
+| A.cpp:165:20:165:23 | next |
+| A.cpp:166:10:166:11 | l3 |
+| A.cpp:166:14:166:17 | next |
+| A.cpp:166:20:166:23 | next |
+| A.cpp:166:26:166:29 | next |
+| A.cpp:167:44:167:44 | l |
+| A.cpp:169:12:169:12 | l |
 | A.cpp:183:7:183:10 | this |
 | A.cpp:184:7:184:10 | this |
+| B.cpp:9:10:9:11 | b2 |
+| B.cpp:9:14:9:17 | box1 |
+| B.cpp:10:10:10:11 | b2 |
+| B.cpp:10:14:10:17 | box1 |
+| B.cpp:18:10:18:11 | b2 |
+| B.cpp:18:14:18:17 | box1 |
+| B.cpp:19:10:19:11 | b2 |
+| B.cpp:19:14:19:17 | box1 |
 | B.cpp:35:7:35:10 | this |
 | B.cpp:36:7:36:10 | this |
 | B.cpp:46:7:46:10 | this |
 | C.cpp:24:5:24:8 | this |
+| C.cpp:29:10:29:11 | this |
+| C.cpp:30:10:30:11 | this |
+| C.cpp:31:10:31:11 | this |
 | D.cpp:9:21:9:24 | this |
+| D.cpp:10:30:10:33 | this |
 | D.cpp:11:29:11:32 | this |
 | D.cpp:16:21:16:23 | this |
+| D.cpp:17:30:17:32 | this |
 | D.cpp:18:29:18:31 | this |
+| D.cpp:30:5:30:5 | b |
+| D.cpp:30:8:30:10 | box |
+| D.cpp:37:5:37:5 | b |
+| D.cpp:44:8:44:14 | call to getBox1 |
 | D.cpp:57:5:57:12 | this |
+| D.cpp:58:5:58:12 | boxfield |
+| D.cpp:58:5:58:12 | this |
+| D.cpp:58:15:58:17 | box |
+| D.cpp:64:10:64:17 | boxfield |
+| D.cpp:64:10:64:17 | this |
+| D.cpp:64:20:64:22 | box |
+| E.cpp:21:10:21:10 | p |
+| E.cpp:21:13:21:16 | data |
+| E.cpp:29:21:29:21 | b |
+| E.cpp:30:21:30:21 | p |
+| E.cpp:30:23:30:26 | data |
+| E.cpp:32:10:32:10 | b |
 | aliasing.cpp:9:3:9:3 | s |
 | aliasing.cpp:13:3:13:3 | s |
 | aliasing.cpp:17:3:17:3 | s |
+| aliasing.cpp:29:8:29:9 | s1 |
+| aliasing.cpp:30:8:30:9 | s2 |
+| aliasing.cpp:31:8:31:9 | s3 |
 | aliasing.cpp:37:3:37:6 | ref1 |
+| aliasing.cpp:38:8:38:9 | s1 |
 | aliasing.cpp:42:3:42:4 | s2 |
+| aliasing.cpp:43:8:43:11 | ref2 |
 | aliasing.cpp:49:3:49:7 | copy1 |
+| aliasing.cpp:50:8:50:9 | s1 |
 | aliasing.cpp:54:3:54:4 | s2 |
+| aliasing.cpp:55:8:55:12 | copy2 |
 | aliasing.cpp:60:3:60:4 | s2 |
+| aliasing.cpp:62:8:62:12 | copy2 |
+| aliasing.cpp:71:9:71:9 | w |
 | aliasing.cpp:72:3:72:3 | s |
+| aliasing.cpp:73:8:73:8 | w |
+| aliasing.cpp:73:10:73:10 | s |
+| aliasing.cpp:78:11:78:11 | w |
 | aliasing.cpp:79:3:79:3 | s |
+| aliasing.cpp:80:8:80:8 | w |
+| aliasing.cpp:80:10:80:10 | s |
+| aliasing.cpp:85:10:85:10 | w |
 | aliasing.cpp:86:3:86:3 | s |
+| aliasing.cpp:87:8:87:8 | w |
+| aliasing.cpp:87:10:87:10 | s |
+| aliasing.cpp:92:3:92:3 | w |
 | aliasing.cpp:92:5:92:5 | s |
+| aliasing.cpp:93:8:93:8 | w |
+| aliasing.cpp:93:10:93:10 | s |
 | aliasing.cpp:98:3:98:3 | s |
+| aliasing.cpp:101:14:101:19 | s_copy |
 | aliasing.cpp:111:16:111:16 | s |
+| aliasing.cpp:112:8:112:8 | s |
+| aliasing.cpp:141:15:141:15 | s |
+| aliasing.cpp:143:8:143:8 | s |
 | aliasing.cpp:147:16:147:19 | access to array |
+| aliasing.cpp:148:8:148:11 | access to array |
+| aliasing.cpp:158:15:158:15 | s |
+| aliasing.cpp:159:9:159:9 | s |
+| aliasing.cpp:164:15:164:15 | s |
+| aliasing.cpp:165:8:165:8 | s |
+| aliasing.cpp:175:16:175:17 | s2 |
 | aliasing.cpp:175:19:175:19 | s |
+| aliasing.cpp:176:8:176:9 | s2 |
+| aliasing.cpp:176:11:176:11 | s |
+| aliasing.cpp:181:16:181:17 | s2 |
 | aliasing.cpp:181:19:181:19 | s |
+| aliasing.cpp:182:8:182:9 | s2 |
+| aliasing.cpp:182:11:182:11 | s |
+| aliasing.cpp:187:16:187:17 | s2 |
 | aliasing.cpp:187:19:187:19 | s |
+| aliasing.cpp:189:8:189:11 | s2_2 |
+| aliasing.cpp:189:13:189:13 | s |
+| aliasing.cpp:194:16:194:17 | s2 |
 | aliasing.cpp:194:19:194:19 | s |
+| aliasing.cpp:196:8:196:11 | s2_2 |
+| aliasing.cpp:196:13:196:13 | s |
+| aliasing.cpp:200:16:200:18 | ps2 |
 | aliasing.cpp:200:21:200:21 | s |
+| aliasing.cpp:201:8:201:10 | ps2 |
+| aliasing.cpp:201:13:201:13 | s |
+| aliasing.cpp:205:16:205:18 | ps2 |
 | aliasing.cpp:205:21:205:21 | s |
+| aliasing.cpp:206:8:206:10 | ps2 |
+| aliasing.cpp:206:13:206:13 | s |
+| aliasing.cpp:211:3:211:4 | s2 |
 | aliasing.cpp:211:6:211:6 | s |
+| aliasing.cpp:212:9:212:10 | s2 |
+| aliasing.cpp:213:8:213:8 | s |
+| aliasing.cpp:218:3:218:4 | s2 |
 | aliasing.cpp:218:6:218:6 | s |
+| aliasing.cpp:219:9:219:10 | s2 |
+| aliasing.cpp:220:8:220:8 | s |
+| aliasing.cpp:225:16:225:17 | s2 |
 | aliasing.cpp:225:19:225:19 | s |
+| aliasing.cpp:226:9:226:10 | s2 |
+| aliasing.cpp:227:8:227:8 | s |
+| aliasing.cpp:232:16:232:17 | s2 |
 | aliasing.cpp:232:19:232:19 | s |
+| aliasing.cpp:233:9:233:10 | s2 |
+| aliasing.cpp:234:8:234:8 | s |
 | arrays.cpp:6:3:6:5 | arr |
+| arrays.cpp:36:3:36:3 | o |
 | arrays.cpp:36:3:36:17 | access to array |
+| arrays.cpp:36:5:36:10 | nested |
+| arrays.cpp:37:8:37:8 | o |
+| arrays.cpp:37:8:37:22 | access to array |
+| arrays.cpp:37:10:37:15 | nested |
+| arrays.cpp:38:8:38:8 | o |
+| arrays.cpp:38:8:38:22 | access to array |
+| arrays.cpp:38:10:38:15 | nested |
+| arrays.cpp:42:3:42:3 | o |
+| arrays.cpp:42:3:42:20 | access to array |
+| arrays.cpp:42:5:42:12 | indirect |
+| arrays.cpp:43:8:43:8 | o |
+| arrays.cpp:43:8:43:25 | access to array |
+| arrays.cpp:43:10:43:17 | indirect |
+| arrays.cpp:44:8:44:8 | o |
+| arrays.cpp:44:8:44:25 | access to array |
+| arrays.cpp:44:10:44:17 | indirect |
+| arrays.cpp:48:3:48:3 | o |
+| arrays.cpp:48:3:48:20 | access to array |
+| arrays.cpp:48:5:48:12 | indirect |
+| arrays.cpp:49:8:49:8 | o |
+| arrays.cpp:49:8:49:25 | access to array |
+| arrays.cpp:49:10:49:17 | indirect |
+| arrays.cpp:50:8:50:8 | o |
+| arrays.cpp:50:8:50:25 | access to array |
+| arrays.cpp:50:10:50:17 | indirect |
 | by_reference.cpp:12:5:12:5 | s |
 | by_reference.cpp:16:5:16:8 | this |
+| by_reference.cpp:32:12:32:12 | s |
+| by_reference.cpp:36:12:36:15 | this |
 | by_reference.cpp:84:3:84:7 | inner |
 | by_reference.cpp:88:3:88:7 | inner |
 | by_reference.cpp:102:22:102:26 | outer |
+| by_reference.cpp:103:21:103:25 | outer |
 | by_reference.cpp:104:16:104:20 | outer |
 | by_reference.cpp:106:22:106:27 | pouter |
+| by_reference.cpp:107:21:107:26 | pouter |
 | by_reference.cpp:108:16:108:21 | pouter |
+| by_reference.cpp:110:8:110:12 | outer |
+| by_reference.cpp:110:14:110:25 | inner_nested |
+| by_reference.cpp:111:8:111:12 | outer |
+| by_reference.cpp:111:14:111:22 | inner_ptr |
+| by_reference.cpp:112:8:112:12 | outer |
+| by_reference.cpp:114:8:114:13 | pouter |
+| by_reference.cpp:114:16:114:27 | inner_nested |
+| by_reference.cpp:115:8:115:13 | pouter |
+| by_reference.cpp:115:16:115:24 | inner_ptr |
+| by_reference.cpp:116:8:116:13 | pouter |
 | by_reference.cpp:122:21:122:25 | outer |
+| by_reference.cpp:123:22:123:26 | outer |
 | by_reference.cpp:124:15:124:19 | outer |
 | by_reference.cpp:126:21:126:26 | pouter |
+| by_reference.cpp:127:22:127:27 | pouter |
 | by_reference.cpp:128:15:128:20 | pouter |
+| by_reference.cpp:130:8:130:12 | outer |
+| by_reference.cpp:130:14:130:25 | inner_nested |
+| by_reference.cpp:131:8:131:12 | outer |
+| by_reference.cpp:131:14:131:22 | inner_ptr |
+| by_reference.cpp:132:8:132:12 | outer |
+| by_reference.cpp:134:8:134:13 | pouter |
+| by_reference.cpp:134:16:134:27 | inner_nested |
+| by_reference.cpp:135:8:135:13 | pouter |
+| by_reference.cpp:135:16:135:24 | inner_ptr |
+| by_reference.cpp:136:8:136:13 | pouter |
+| complex.cpp:9:20:9:21 | this |
+| complex.cpp:10:20:10:21 | this |
 | complex.cpp:11:22:11:23 | this |
 | complex.cpp:12:22:12:23 | this |
+| complex.cpp:42:8:42:8 | b |
 | complex.cpp:42:10:42:14 | inner |
+| complex.cpp:43:8:43:8 | b |
 | complex.cpp:43:10:43:14 | inner |
+| complex.cpp:53:3:53:4 | b1 |
 | complex.cpp:53:6:53:10 | inner |
+| complex.cpp:54:3:54:4 | b2 |
 | complex.cpp:54:6:54:10 | inner |
+| complex.cpp:55:3:55:4 | b3 |
 | complex.cpp:55:6:55:10 | inner |
+| complex.cpp:56:3:56:4 | b3 |
 | complex.cpp:56:6:56:10 | inner |
+| constructors.cpp:18:22:18:23 | this |
+| constructors.cpp:19:22:19:23 | this |
 | constructors.cpp:20:24:20:25 | this |
 | constructors.cpp:21:24:21:25 | this |
 | qualifiers.cpp:9:30:9:33 | this |
 | qualifiers.cpp:12:49:12:53 | inner |
 | qualifiers.cpp:13:51:13:55 | inner |
+| qualifiers.cpp:18:32:18:36 | this |
+| qualifiers.cpp:22:11:22:18 | call to getInner |
+| qualifiers.cpp:23:10:23:14 | outer |
+| qualifiers.cpp:23:16:23:20 | inner |
+| qualifiers.cpp:28:10:28:14 | outer |
+| qualifiers.cpp:28:16:28:20 | inner |
+| qualifiers.cpp:33:10:33:14 | outer |
+| qualifiers.cpp:33:16:33:20 | inner |
+| qualifiers.cpp:38:10:38:14 | outer |
+| qualifiers.cpp:38:16:38:20 | inner |
+| qualifiers.cpp:42:6:42:22 | * ... |
+| qualifiers.cpp:43:10:43:14 | outer |
+| qualifiers.cpp:43:16:43:20 | inner |
+| qualifiers.cpp:47:15:47:22 | call to getInner |
+| qualifiers.cpp:48:10:48:14 | outer |
+| qualifiers.cpp:48:16:48:20 | inner |
+| realistic.cpp:49:9:49:11 | foo |
 | realistic.cpp:49:9:49:18 | access to array |
+| realistic.cpp:53:9:53:11 | foo |
+| realistic.cpp:53:9:53:18 | access to array |
+| realistic.cpp:53:20:53:22 | baz |
+| realistic.cpp:53:25:53:33 | userInput |
+| realistic.cpp:54:16:54:18 | foo |
+| realistic.cpp:54:16:54:25 | access to array |
+| realistic.cpp:54:27:54:29 | baz |
+| realistic.cpp:54:32:54:40 | userInput |
+| realistic.cpp:55:12:55:14 | foo |
+| realistic.cpp:55:12:55:21 | access to array |
+| realistic.cpp:55:23:55:25 | baz |
+| realistic.cpp:55:28:55:36 | userInput |
+| realistic.cpp:57:88:57:90 | foo |
+| realistic.cpp:57:88:57:97 | access to array |
+| realistic.cpp:57:99:57:101 | baz |
+| realistic.cpp:57:104:57:112 | userInput |
+| realistic.cpp:60:21:60:23 | foo |
+| realistic.cpp:60:21:60:30 | access to array |
+| realistic.cpp:60:32:60:34 | baz |
+| realistic.cpp:60:37:60:45 | userInput |
+| realistic.cpp:60:55:60:57 | foo |
+| realistic.cpp:60:55:60:64 | access to array |
+| realistic.cpp:60:66:60:68 | baz |
+| realistic.cpp:60:71:60:79 | userInput |
+| realistic.cpp:61:21:61:23 | foo |
+| realistic.cpp:61:21:61:30 | access to array |
+| realistic.cpp:61:32:61:34 | baz |
+| realistic.cpp:61:37:61:45 | userInput |
+| realistic.cpp:65:21:65:23 | foo |
+| realistic.cpp:65:21:65:30 | access to array |
+| realistic.cpp:65:32:65:34 | baz |
+| realistic.cpp:65:37:65:45 | userInput |
+| simple.cpp:18:22:18:23 | this |
+| simple.cpp:19:22:19:23 | this |
 | simple.cpp:20:24:20:25 | this |
 | simple.cpp:21:24:21:25 | this |
 | simple.cpp:65:5:65:5 | a |
+| simple.cpp:67:10:67:11 | a2 |
+| simple.cpp:79:16:79:17 | f2 |
+| simple.cpp:79:16:79:17 | this |
 | simple.cpp:83:9:83:10 | f2 |
+| simple.cpp:83:9:83:10 | this |
 | simple.cpp:92:5:92:5 | a |
+| simple.cpp:94:10:94:11 | a2 |
+| simple.cpp:104:5:104:5 | b |
 | simple.cpp:104:7:104:7 | a |
+| simple.cpp:106:10:106:11 | b2 |
+| simple.cpp:106:13:106:13 | a |
+| struct_init.c:15:8:15:9 | ab |
+| struct_init.c:16:8:16:9 | ab |
+| struct_init.c:22:8:22:9 | ab |
+| struct_init.c:23:8:23:9 | ab |
+| struct_init.c:31:8:31:12 | outer |
+| struct_init.c:31:14:31:21 | nestedAB |
+| struct_init.c:32:8:32:12 | outer |
+| struct_init.c:32:14:32:21 | nestedAB |
+| struct_init.c:33:8:33:12 | outer |
+| struct_init.c:33:14:33:22 | pointerAB |
+| struct_init.c:34:8:34:12 | outer |
+| struct_init.c:34:14:34:22 | pointerAB |
 | struct_init.c:36:11:36:15 | outer |
+| struct_init.c:46:10:46:14 | outer |

From a8b4fb6fd001612730115a809ae97d8590beb7a7 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sun, 6 Dec 2020 14:23:35 +0100
Subject: [PATCH 036/343] C++: Add qldoc (and remove predicate that wasn't
 needed).

---
 .../code/cpp/ir/dataflow/internal/DataFlowPrivate.qll       | 6 +++---
 .../semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll   | 6 ++++--
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index 73649da7594..09f8ae3e97f 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -241,7 +241,7 @@ private predicate instrToFieldNodeStoreStepNoChi(
     not exists(ChiInstruction chi | chi.getPartial() = store) and
     post.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
     store.getSourceValueOperand() = node1.asOperand() and
-    f.getADirectField() = post.getField()
+    f.getADirectField() = post.getPreUpdateNode().getField()
   )
 }
 
@@ -262,7 +262,7 @@ private predicate instrToFieldNodeStoreStepChi(
     chi.getPartialOperand() = operand and
     store = operand.getDef() and
     post.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
-    f.getADirectField() = post.getField()
+    f.getADirectField() = post.getPreUpdateNode().getField()
   )
 }
 
@@ -278,7 +278,7 @@ private predicate callableWithoutDefinitionStoreStep(
     post = node2.getPartialDefinition() and
     node1.asInstruction() = write and
     post.getPreUpdateNode() = getFieldNodeForFieldInstruction(write.getDestinationAddress()) and
-    f.getADirectField() = post.getField() and
+    f.getADirectField() = post.getPreUpdateNode().getField() and
     callable = write.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() and
     not callable.hasDefinition()
   )
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 318ddf9c48d..0d50f848689 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -283,8 +283,6 @@ class PostUpdateFieldNode extends PartialDefinition {
   override Expr getDefinedExpr() {
     result = node.getFieldInstruction().getObjectAddress().getUnconvertedResultExpression()
   }
-
-  Field getField() { result = node.getField() }
 }
 
 /**
@@ -450,10 +448,13 @@ abstract class PartialDefinition extends TPartialDefinition {
 
   PartialDefinition() { this = MkPartialDefinition(node) }
 
+  /** Gets the node before the state update. */
   abstract Node getPreUpdateNode();
 
+  /** Gets the expression that is partially defined by this node. */
   abstract Expr getDefinedExpr();
 
+  /** Gets a string representation of this partial definition. */
   string toString() { result = node.toString() + " [partial definition]" }
 }
 
@@ -480,6 +481,7 @@ class PartialDefinitionNode extends PostUpdateNode, TPartialDefinitionNode {
 
   override Node getPreUpdateNode() { result = pd.getPreUpdateNode() }
 
+  /** Gets the `PartialDefinition` associated with this node. */
   PartialDefinition getPartialDefinition() { result = pd }
 
   override string toString() { result = getPreUpdateNode().toString() + " [post update]" }

From fd8034cd8ccfd13d34d10d9b38b2312603d78361 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 11 Dec 2020 16:08:42 +0100
Subject: [PATCH 037/343] C++: Add store step out of read side effects when we
 don't have a model for the callee. This brings back the lost result on boost.

---
 .../ir/dataflow/internal/DataFlowPrivate.qll  | 22 ++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index 09f8ae3e97f..72d6db0f8dd 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -2,6 +2,7 @@ private import cpp
 private import DataFlowUtil
 private import semmle.code.cpp.ir.IR
 private import DataFlowDispatch
+private import semmle.code.cpp.models.interfaces.DataFlow
 
 /**
  * A data flow node that occurs as the argument of a call and is passed as-is
@@ -271,16 +272,31 @@ private predicate callableWithoutDefinitionStoreStep(
 ) {
   exists(
     WriteSideEffectInstruction write, ChiInstruction chi, PostUpdateFieldNode post,
-    Function callable
+    Function callable, CallInstruction call
   |
     chi.getPartial() = write and
     not chi.isResultConflated() and
     post = node2.getPartialDefinition() and
-    node1.asInstruction() = write and
     post.getPreUpdateNode() = getFieldNodeForFieldInstruction(write.getDestinationAddress()) and
     f.getADirectField() = post.getPreUpdateNode().getField() and
-    callable = write.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() and
+    call = write.getPrimaryInstruction() and
+    callable = call.getStaticCallTarget() and
     not callable.hasDefinition()
+  |
+    exists(OutParameterDeref out | out.getIndex() = write.getIndex() |
+      callable.(DataFlowFunction).hasDataFlow(_, out) and
+      node1.asInstruction() = write
+    )
+    or
+    // Ideally we shouldn't need to do a store step from a read side effect, but if we don't have a
+    // model for the callee there might not be flow to the write side effect (since the callee has no
+    // definition). This case ensures that we propagate dataflow when a field is passed into a
+    // function that has a write side effect, even though the write side effect doesn't have incoming
+    // flow.
+    not callable instanceof DataFlowFunction and
+    exists(ReadSideEffectInstruction read | call = read.getPrimaryInstruction() |
+      node1.asInstruction() = read.getSideEffectOperand().getAnyDef()
+    )
   )
 }
 

From 77aa9615c0e1893657c8ade1eb44062a1bcf2caf Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Sat, 12 Dec 2020 17:51:00 +0100
Subject: [PATCH 038/343] C++: Accept test changes in paths.

---
 .../dataflow-ir-consistency.expected          | 194 ++++++++----------
 .../TaintedAllocationSize.expected            |  24 ++-
 .../ArithmeticUncontrolled.expected           |  30 +--
 3 files changed, 117 insertions(+), 131 deletions(-)

diff --git a/cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected b/cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected
index 6aeadb2f174..4f709d960cc 100644
--- a/cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected
+++ b/cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected
@@ -1464,117 +1464,93 @@ unreachableNodeCCtx
 localCallNodes
 postIsNotPre
 postHasUniquePre
-| assignexpr.cpp:9:2:9:12 | Store | PostUpdateNode should have one pre-update node but has 0. |
-| bad_asts.cpp:15:10:15:12 | Store | PostUpdateNode should have one pre-update node but has 0. |
-| cpp11.cpp:65:19:65:45 | Store | PostUpdateNode should have one pre-update node but has 0. |
-| ir.cpp:531:14:531:14 | Store | PostUpdateNode should have one pre-update node but has 0. |
+| allocators.cpp:16:14:16:36 | Foo output argument | PostUpdateNode should have one pre-update node but has 0. |
+| condition_decls.cpp:16:19:16:20 | BoxedInt output argument | PostUpdateNode should have one pre-update node but has 0. |
+| condition_decls.cpp:26:23:26:24 | BoxedInt output argument | PostUpdateNode should have one pre-update node but has 0. |
+| condition_decls.cpp:41:22:41:23 | BoxedInt output argument | PostUpdateNode should have one pre-update node but has 0. |
+| condition_decls.cpp:48:22:48:24 | BoxedInt output argument | PostUpdateNode should have one pre-update node but has 0. |
+| condition_decls.cpp:48:34:48:36 | BoxedInt output argument | PostUpdateNode should have one pre-update node but has 0. |
+| condition_decls.cpp:48:52:48:53 | BoxedInt output argument | PostUpdateNode should have one pre-update node but has 0. |
+| conditional_destructors.cpp:30:9:30:13 | C1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| conditional_destructors.cpp:30:18:30:22 | C1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| conditional_destructors.cpp:33:9:33:13 | C1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| conditional_destructors.cpp:33:18:33:22 | C1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| conditional_destructors.cpp:39:9:39:13 | C2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| conditional_destructors.cpp:39:18:39:22 | C2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| conditional_destructors.cpp:42:9:42:13 | C2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| conditional_destructors.cpp:42:18:42:22 | C2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| constructorinitializer.cpp:8:6:8:18 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| cpp11.cpp:77:19:77:21 | Val output argument | PostUpdateNode should have one pre-update node but has 0. |
+| cpp11.cpp:82:11:82:14 | Val output argument | PostUpdateNode should have one pre-update node but has 0. |
+| cpp11.cpp:82:17:82:55 | Val output argument | PostUpdateNode should have one pre-update node but has 0. |
+| cpp11.cpp:82:45:82:48 | Val output argument | PostUpdateNode should have one pre-update node but has 0. |
+| cpp11.cpp:82:51:82:51 | Val output argument | PostUpdateNode should have one pre-update node but has 0. |
+| cpp11.cpp:88:25:88:30 | Val output argument | PostUpdateNode should have one pre-update node but has 0. |
+| cpp11.cpp:88:33:88:38 | Val output argument | PostUpdateNode should have one pre-update node but has 0. |
+| cpp17.cpp:15:5:15:45 | HasTwoArgCtor output argument | PostUpdateNode should have one pre-update node but has 0. |
+| destructors.cpp:50:9:50:13 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| destructors.cpp:51:36:51:38 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| file://:0:0:0:0 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:616:12:616:13 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:617:15:617:22 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:619:16:619:30 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:662:9:662:19 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:663:5:663:5 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:736:5:736:19 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:745:8:745:8 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:748:10:748:10 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:757:12:757:12 | Base output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:757:12:757:12 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:766:13:766:13 | Middle output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:766:13:766:13 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:775:15:775:15 | Base output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:775:15:775:15 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:784:15:784:15 | Base output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:784:15:784:15 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:793:15:793:15 | Base output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:793:15:793:15 | MiddleVB1 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:793:15:793:15 | MiddleVB2 output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:793:15:793:15 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:800:8:800:8 | Base output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:801:10:801:10 | Middle output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:802:11:802:11 | Derived output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:809:7:809:13 | Base output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:810:7:810:26 | Base output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:823:7:823:13 | Base output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:824:7:824:26 | Base output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:846:8:846:8 | PolymorphicBase output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:850:19:850:19 | PolymorphicBase output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:851:22:851:22 | PolymorphicDerived output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:868:3:868:12 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:944:3:944:14 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ir.cpp:945:3:945:27 | String output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ms_assume.cpp:28:18:28:23 | fgets output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ms_try_mix.cpp:11:12:11:15 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ms_try_mix.cpp:28:12:28:15 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ms_try_mix.cpp:48:10:48:13 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| newexpr.cpp:8:2:8:20 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| ops.cpp:26:31:26:53 | C_with_constr_destr output argument | PostUpdateNode should have one pre-update node but has 0. |
+| parameterinitializer.cpp:25:5:25:8 | c output argument | PostUpdateNode should have one pre-update node but has 0. |
+| static_init_templates.cpp:31:10:31:11 | MyClass output argument | PostUpdateNode should have one pre-update node but has 0. |
+| static_init_templates.cpp:236:7:236:7 | MyConstructorClass output argument | PostUpdateNode should have one pre-update node but has 0. |
+| static_init_templates.cpp:240:7:240:7 | MyConstructorClass output argument | PostUpdateNode should have one pre-update node but has 0. |
+| static_init_templates.cpp:249:21:249:23 | MyConstructorClass output argument | PostUpdateNode should have one pre-update node but has 0. |
+| static_init_templates.cpp:250:17:250:19 | MyDerivedClass output argument | PostUpdateNode should have one pre-update node but has 0. |
+| static_init_templates.cpp:251:20:251:23 | MyContainingClass output argument | PostUpdateNode should have one pre-update node but has 0. |
+| stmt_expr.cpp:13:18:13:19 | C output argument | PostUpdateNode should have one pre-update node but has 0. |
+| try_catch.cpp:7:8:7:8 | exception output argument | PostUpdateNode should have one pre-update node but has 0. |
+| try_catch.cpp:7:8:7:8 | exception output argument | PostUpdateNode should have one pre-update node but has 0. |
+| try_catch.cpp:13:5:13:16 | exn1 output argument | PostUpdateNode should have one pre-update node but has 0. |
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
 argHasPostUpdate
 postWithInFlow
-| aggregateinitializer.c:3:14:3:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| aggregateinitializer.c:3:21:3:25 | Chi | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:3:27:3:27 | Chi | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:3:35:3:35 | Chi | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:4:11:4:23 | Chi | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:4:17:4:23 | Chi | PostUpdateNode should not be the target of local flow. |
-| assignexpr.cpp:9:2:9:12 | Store | PostUpdateNode should not be the target of local flow. |
-| bad_asts.cpp:15:10:15:12 | Store | PostUpdateNode should not be the target of local flow. |
-| builtin.c:14:26:14:26 | Chi | PostUpdateNode should not be the target of local flow. |
-| builtin.c:14:29:14:29 | Chi | PostUpdateNode should not be the target of local flow. |
-| builtin.c:14:32:14:32 | Chi | PostUpdateNode should not be the target of local flow. |
-| builtin.c:14:35:14:35 | Chi | PostUpdateNode should not be the target of local flow. |
-| condition_decls.cpp:3:5:3:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| condition_decls.cpp:3:21:3:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| conditional_destructors.cpp:6:13:6:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| conditional_destructors.cpp:18:13:18:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:65:19:65:45 | Store | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:82:17:82:55 | Chi | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:82:17:82:55 | Chi | PostUpdateNode should not be the target of local flow. |
-| cpp11.cpp:82:45:82:48 | Chi | PostUpdateNode should not be the target of local flow. |
-| defdestructordeleteexpr.cpp:4:9:4:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| deleteexpr.cpp:7:9:7:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
-| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
-| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:177:5:177:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:178:5:178:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:183:5:183:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:184:5:184:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:342:5:342:10 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:428:5:428:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:429:5:429:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:504:19:504:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:504:22:504:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:505:16:505:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:505:19:505:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:506:16:506:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:506:16:506:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:513:14:513:16 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:513:14:513:16 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:514:14:514:26 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:514:19:514:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:514:22:514:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:515:19:515:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:515:22:515:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:515:29:515:29 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:515:32:515:32 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:516:17:516:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:516:19:516:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:516:24:516:28 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:516:26:516:26 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:521:19:521:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:521:22:521:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:521:25:521:25 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:522:16:522:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:522:19:522:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:531:14:531:14 | Store | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:577:16:577:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:577:19:577:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:578:19:578:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:578:22:578:22 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:579:16:579:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:579:19:579:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:643:9:643:21 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:644:9:644:23 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:645:9:645:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:659:9:659:14 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:660:13:660:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:661:9:661:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:662:9:662:19 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:663:5:663:5 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:745:8:745:8 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:745:8:745:8 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:748:10:748:10 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:754:8:754:8 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:757:12:757:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:763:8:763:8 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:766:13:766:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:775:15:775:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:784:15:784:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:793:15:793:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:943:3:943:11 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:947:3:947:25 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:962:26:962:30 | Chi | PostUpdateNode should not be the target of local flow. |
-| ir.cpp:962:41:962:45 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:130:5:130:11 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:131:5:131:13 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:154:32:154:32 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:154:35:154:35 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:154:40:154:40 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:154:43:154:43 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:157:14:157:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:158:14:158:18 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:160:31:160:33 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:160:31:160:33 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:220:3:223:3 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:221:10:221:10 | Chi | PostUpdateNode should not be the target of local flow. |
-| misc.c:222:10:222:10 | Chi | PostUpdateNode should not be the target of local flow. |
-| range_analysis.c:102:5:102:15 | Chi | PostUpdateNode should not be the target of local flow. |
-| static_init_templates.cpp:3:2:3:8 | Chi | PostUpdateNode should not be the target of local flow. |
-| static_init_templates.cpp:21:2:21:12 | Chi | PostUpdateNode should not be the target of local flow. |
-| static_init_templates.cpp:240:7:240:7 | Chi | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:77:19:77:21 | Val output argument | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:11:82:14 | Val output argument | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:45:82:48 | Val output argument | PostUpdateNode should not be the target of local flow. |
+| cpp11.cpp:82:51:82:51 | Val output argument | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:809:7:809:13 | Base output argument | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:810:7:810:26 | Base output argument | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:823:7:823:13 | Base output argument | PostUpdateNode should not be the target of local flow. |
+| ir.cpp:824:7:824:26 | Base output argument | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected
index 9876b9695ad..0299afff063 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected
@@ -59,18 +59,21 @@ edges
 | test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
 | test.cpp:241:2:241:32 | Chi [array content] | test.cpp:279:17:279:20 | get_size output argument [array content] |
 | test.cpp:241:2:241:32 | Chi [array content] | test.cpp:295:18:295:21 | get_size output argument [array content] |
-| test.cpp:241:18:241:23 | call to getenv | test.cpp:241:2:241:32 | Chi [array content] |
-| test.cpp:241:18:241:31 | (const char *)... | test.cpp:241:2:241:32 | Chi [array content] |
+| test.cpp:241:2:241:32 | ChiTotal [post update] [array content] | test.cpp:241:2:241:32 | Chi [array content] |
+| test.cpp:241:2:241:32 | ChiTotal [post update] [array content] | test.cpp:279:17:279:20 | get_size output argument [array content] |
+| test.cpp:241:2:241:32 | ChiTotal [post update] [array content] | test.cpp:295:18:295:21 | get_size output argument [array content] |
+| test.cpp:241:18:241:23 | call to getenv | test.cpp:241:2:241:32 | ChiTotal [post update] [array content] |
+| test.cpp:241:18:241:31 | (const char *)... | test.cpp:241:2:241:32 | ChiTotal [post update] [array content] |
 | test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
 | test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
 | test.cpp:249:20:249:33 | (const char *)... | test.cpp:253:11:253:29 | ... * ... |
 | test.cpp:249:20:249:33 | (const char *)... | test.cpp:253:11:253:29 | ... * ... |
-| test.cpp:279:17:279:20 | Chi | test.cpp:281:11:281:28 | ... * ... |
-| test.cpp:279:17:279:20 | Chi | test.cpp:281:11:281:28 | ... * ... |
-| test.cpp:279:17:279:20 | get_size output argument [array content] | test.cpp:279:17:279:20 | Chi |
-| test.cpp:295:18:295:21 | Chi | test.cpp:298:10:298:27 | ... * ... |
-| test.cpp:295:18:295:21 | Chi | test.cpp:298:10:298:27 | ... * ... |
-| test.cpp:295:18:295:21 | get_size output argument [array content] | test.cpp:295:18:295:21 | Chi |
+| test.cpp:279:17:279:20 | get_size output argument | test.cpp:281:11:281:28 | ... * ... |
+| test.cpp:279:17:279:20 | get_size output argument | test.cpp:281:11:281:28 | ... * ... |
+| test.cpp:279:17:279:20 | get_size output argument [array content] | test.cpp:279:17:279:20 | get_size output argument |
+| test.cpp:295:18:295:21 | get_size output argument | test.cpp:298:10:298:27 | ... * ... |
+| test.cpp:295:18:295:21 | get_size output argument | test.cpp:298:10:298:27 | ... * ... |
+| test.cpp:295:18:295:21 | get_size output argument [array content] | test.cpp:295:18:295:21 | get_size output argument |
 | test.cpp:301:19:301:24 | call to getenv | test.cpp:305:11:305:28 | ... * ... |
 | test.cpp:301:19:301:24 | call to getenv | test.cpp:305:11:305:28 | ... * ... |
 | test.cpp:301:19:301:32 | (const char *)... | test.cpp:305:11:305:28 | ... * ... |
@@ -144,6 +147,7 @@ nodes
 | test.cpp:237:2:237:8 | Argument 0 | semmle.label | Argument 0 |
 | test.cpp:241:2:241:32 | Chi [array content] | semmle.label | Chi [array content] |
 | test.cpp:241:2:241:32 | ChiPartial | semmle.label | ChiPartial |
+| test.cpp:241:2:241:32 | ChiTotal [post update] [array content] | semmle.label | ChiTotal [post update] [array content] |
 | test.cpp:241:18:241:23 | call to getenv | semmle.label | call to getenv |
 | test.cpp:241:18:241:31 | (const char *)... | semmle.label | (const char *)... |
 | test.cpp:249:20:249:25 | call to getenv | semmle.label | call to getenv |
@@ -151,12 +155,12 @@ nodes
 | test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
 | test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
 | test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
-| test.cpp:279:17:279:20 | Chi | semmle.label | Chi |
+| test.cpp:279:17:279:20 | get_size output argument | semmle.label | get_size output argument |
 | test.cpp:279:17:279:20 | get_size output argument [array content] | semmle.label | get_size output argument [array content] |
 | test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
 | test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
 | test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
-| test.cpp:295:18:295:21 | Chi | semmle.label | Chi |
+| test.cpp:295:18:295:21 | get_size output argument | semmle.label | get_size output argument |
 | test.cpp:295:18:295:21 | get_size output argument [array content] | semmle.label | get_size output argument [array content] |
 | test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |
 | test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected
index ca8dd38fc3b..c684f1da6ce 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected
@@ -43,19 +43,23 @@ edges
 | test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
 | test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
 | test.cpp:13:2:13:15 | Chi [array content] | test.cpp:30:13:30:14 | get_rand2 output argument [array content] |
-| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Chi [array content] |
-| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | Chi [array content] |
+| test.cpp:13:2:13:15 | ChiTotal [post update] [array content] | test.cpp:13:2:13:15 | Chi [array content] |
+| test.cpp:13:2:13:15 | ChiTotal [post update] [array content] | test.cpp:30:13:30:14 | get_rand2 output argument [array content] |
+| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | ChiTotal [post update] [array content] |
+| test.cpp:13:10:13:13 | call to rand | test.cpp:13:2:13:15 | ChiTotal [post update] [array content] |
 | test.cpp:18:2:18:14 | Chi [array content] | test.cpp:36:13:36:13 | get_rand3 output argument [array content] |
-| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Chi [array content] |
-| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | Chi [array content] |
+| test.cpp:18:2:18:14 | ChiTotal [post update] [array content] | test.cpp:18:2:18:14 | Chi [array content] |
+| test.cpp:18:2:18:14 | ChiTotal [post update] [array content] | test.cpp:36:13:36:13 | get_rand3 output argument [array content] |
+| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | ChiTotal [post update] [array content] |
+| test.cpp:18:9:18:12 | call to rand | test.cpp:18:2:18:14 | ChiTotal [post update] [array content] |
 | test.cpp:24:11:24:18 | call to get_rand | test.cpp:25:7:25:7 | r |
 | test.cpp:24:11:24:18 | call to get_rand | test.cpp:25:7:25:7 | r |
-| test.cpp:30:13:30:14 | Chi | test.cpp:31:7:31:7 | r |
-| test.cpp:30:13:30:14 | Chi | test.cpp:31:7:31:7 | r |
-| test.cpp:30:13:30:14 | get_rand2 output argument [array content] | test.cpp:30:13:30:14 | Chi |
-| test.cpp:36:13:36:13 | Chi | test.cpp:37:7:37:7 | r |
-| test.cpp:36:13:36:13 | Chi | test.cpp:37:7:37:7 | r |
-| test.cpp:36:13:36:13 | get_rand3 output argument [array content] | test.cpp:36:13:36:13 | Chi |
+| test.cpp:30:13:30:14 | get_rand2 output argument | test.cpp:31:7:31:7 | r |
+| test.cpp:30:13:30:14 | get_rand2 output argument | test.cpp:31:7:31:7 | r |
+| test.cpp:30:13:30:14 | get_rand2 output argument [array content] | test.cpp:30:13:30:14 | get_rand2 output argument |
+| test.cpp:36:13:36:13 | get_rand3 output argument | test.cpp:37:7:37:7 | r |
+| test.cpp:36:13:36:13 | get_rand3 output argument | test.cpp:37:7:37:7 | r |
+| test.cpp:36:13:36:13 | get_rand3 output argument [array content] | test.cpp:36:13:36:13 | get_rand3 output argument |
 nodes
 | test.c:18:13:18:16 | call to rand | semmle.label | call to rand |
 | test.c:18:13:18:16 | call to rand | semmle.label | call to rand |
@@ -110,22 +114,24 @@ nodes
 | test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
 | test.cpp:13:2:13:15 | Chi [array content] | semmle.label | Chi [array content] |
 | test.cpp:13:2:13:15 | ChiPartial | semmle.label | ChiPartial |
+| test.cpp:13:2:13:15 | ChiTotal [post update] [array content] | semmle.label | ChiTotal [post update] [array content] |
 | test.cpp:13:10:13:13 | call to rand | semmle.label | call to rand |
 | test.cpp:13:10:13:13 | call to rand | semmle.label | call to rand |
 | test.cpp:18:2:18:14 | Chi [array content] | semmle.label | Chi [array content] |
 | test.cpp:18:2:18:14 | ChiPartial | semmle.label | ChiPartial |
+| test.cpp:18:2:18:14 | ChiTotal [post update] [array content] | semmle.label | ChiTotal [post update] [array content] |
 | test.cpp:18:9:18:12 | call to rand | semmle.label | call to rand |
 | test.cpp:18:9:18:12 | call to rand | semmle.label | call to rand |
 | test.cpp:24:11:24:18 | call to get_rand | semmle.label | call to get_rand |
 | test.cpp:25:7:25:7 | r | semmle.label | r |
 | test.cpp:25:7:25:7 | r | semmle.label | r |
 | test.cpp:25:7:25:7 | r | semmle.label | r |
-| test.cpp:30:13:30:14 | Chi | semmle.label | Chi |
+| test.cpp:30:13:30:14 | get_rand2 output argument | semmle.label | get_rand2 output argument |
 | test.cpp:30:13:30:14 | get_rand2 output argument [array content] | semmle.label | get_rand2 output argument [array content] |
 | test.cpp:31:7:31:7 | r | semmle.label | r |
 | test.cpp:31:7:31:7 | r | semmle.label | r |
 | test.cpp:31:7:31:7 | r | semmle.label | r |
-| test.cpp:36:13:36:13 | Chi | semmle.label | Chi |
+| test.cpp:36:13:36:13 | get_rand3 output argument | semmle.label | get_rand3 output argument |
 | test.cpp:36:13:36:13 | get_rand3 output argument [array content] | semmle.label | get_rand3 output argument [array content] |
 | test.cpp:37:7:37:7 | r | semmle.label | r |
 | test.cpp:37:7:37:7 | r | semmle.label | r |

From bc4a0bcbebbb84426bf1da1cf18c6ba1666eb3b4 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 22 Dec 2020 11:27:11 +0100
Subject: [PATCH 039/343] Python: Split request handler / route setup concept
 tests

Not doing so earlier was just a mistake.
---
 python/ql/test/experimental/meta/ConceptsTest.qll | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/python/ql/test/experimental/meta/ConceptsTest.qll b/python/ql/test/experimental/meta/ConceptsTest.qll
index b031499e5e2..1deef32857b 100644
--- a/python/ql/test/experimental/meta/ConceptsTest.qll
+++ b/python/ql/test/experimental/meta/ConceptsTest.qll
@@ -142,9 +142,7 @@ class SqlExecutionTest extends InlineExpectationsTest {
 class HttpServerRouteSetupTest extends InlineExpectationsTest {
   HttpServerRouteSetupTest() { this = "HttpServerRouteSetupTest" }
 
-  override string getARelevantTag() {
-    result in ["routeSetup", "requestHandler", "routedParameter"]
-  }
+  override string getARelevantTag() { result in ["routeSetup"] }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(HTTP::Server::RouteSetup setup |
@@ -158,7 +156,15 @@ class HttpServerRouteSetupTest extends InlineExpectationsTest {
       ) and
       tag = "routeSetup"
     )
-    or
+  }
+}
+
+class HttpServerRequestHandlerTest extends InlineExpectationsTest {
+  HttpServerRequestHandlerTest() { this = "HttpServerRequestHandlerTest" }
+
+  override string getARelevantTag() { result in ["requestHandler", "routedParameter"] }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(HTTP::Server::RequestHandler handler |
       location = handler.getLocation() and
       element = handler.toString() and

From dc0d9403314e95cd0d6d4a3abcad3b194e04187a Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 22 Dec 2020 11:28:29 +0100
Subject: [PATCH 040/343] Python: Ensure all concept tests ignore irrelevant
 results

Since this was causing a CI error.

also changed things a bit so we do it in a consistent way :)
---
 .../test/experimental/meta/ConceptsTest.qll   | 40 +++++++++++--------
 1 file changed, 23 insertions(+), 17 deletions(-)

diff --git a/python/ql/test/experimental/meta/ConceptsTest.qll b/python/ql/test/experimental/meta/ConceptsTest.qll
index 1deef32857b..6b3544da30e 100644
--- a/python/ql/test/experimental/meta/ConceptsTest.qll
+++ b/python/ql/test/experimental/meta/ConceptsTest.qll
@@ -111,6 +111,7 @@ class CodeExecutionTest extends InlineExpectationsTest {
   override string getARelevantTag() { result = "getCode" }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(location.getFile().getRelativePath()) and
     exists(CodeExecution ce, DataFlow::Node code |
       exists(location.getFile().getRelativePath()) and
       code = ce.getCode() and
@@ -128,6 +129,7 @@ class SqlExecutionTest extends InlineExpectationsTest {
   override string getARelevantTag() { result = "getSql" }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(location.getFile().getRelativePath()) and
     exists(SqlExecution e, DataFlow::Node sql |
       exists(location.getFile().getRelativePath()) and
       sql = e.getSql() and
@@ -145,6 +147,7 @@ class HttpServerRouteSetupTest extends InlineExpectationsTest {
   override string getARelevantTag() { result in ["routeSetup"] }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(location.getFile().getRelativePath()) and
     exists(HTTP::Server::RouteSetup setup |
       location = setup.getLocation() and
       element = setup.toString() and
@@ -165,19 +168,22 @@ class HttpServerRequestHandlerTest extends InlineExpectationsTest {
   override string getARelevantTag() { result in ["requestHandler", "routedParameter"] }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(HTTP::Server::RequestHandler handler |
-      location = handler.getLocation() and
-      element = handler.toString() and
-      value = "" and
-      tag = "requestHandler"
-    )
-    or
-    exists(HTTP::Server::RequestHandler handler, Parameter param |
-      param = handler.getARoutedParameter() and
-      location = param.getLocation() and
-      element = param.toString() and
-      value = param.asName().getId() and
-      tag = "routedParameter"
+    exists(location.getFile().getRelativePath()) and
+    (
+      exists(HTTP::Server::RequestHandler handler |
+        location = handler.getLocation() and
+        element = handler.toString() and
+        value = "" and
+        tag = "requestHandler"
+      )
+      or
+      exists(HTTP::Server::RequestHandler handler, Parameter param |
+        param = handler.getARoutedParameter() and
+        location = param.getLocation() and
+        element = param.toString() and
+        value = param.asName().getId() and
+        tag = "routedParameter"
+      )
     )
   }
 }
@@ -198,7 +204,7 @@ class HttpServerHttpResponseTest extends InlineExpectationsTest {
     // flask tests more readable since adding full annotations for HttpResponses in the
     // the tests for routing setup is both annoying and not very useful.
     location.getFile() = file and
-    tag = getARelevantTag() and
+    exists(file.getRelativePath()) and
     (
       exists(HTTP::Server::HttpResponse response |
         location = response.getLocation() and
@@ -237,8 +243,8 @@ class FileSystemAccessTest extends InlineExpectationsTest {
   override string getARelevantTag() { result = "getAPathArgument" }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(location.getFile().getRelativePath()) and
     exists(FileSystemAccess a, DataFlow::Node path |
-      exists(location.getFile().getRelativePath()) and
       path = a.getAPathArgument() and
       location = a.getLocation() and
       element = path.toString() and
@@ -254,8 +260,8 @@ class PathNormalizationTest extends InlineExpectationsTest {
   override string getARelevantTag() { result = "pathNormalization" }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(location.getFile().getRelativePath()) and
     exists(Path::PathNormalization n |
-      exists(location.getFile().getRelativePath()) and
       location = n.getLocation() and
       element = n.toString() and
       value = "" and
@@ -270,8 +276,8 @@ class SafeAccessCheckTest extends InlineExpectationsTest {
   override string getARelevantTag() { result in ["checks", "branch"] }
 
   override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(location.getFile().getRelativePath()) and
     exists(Path::SafeAccessCheck c, DataFlow::Node checks, boolean branch |
-      exists(location.getFile().getRelativePath()) and
       c.checks(checks.asCfgNode(), branch) and
       location = c.getLocation() and
       (

From 3094aedf14806cb310bfdd9b92e3979492c05f33 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 22 Dec 2020 14:42:53 +0100
Subject: [PATCH 041/343] Python: Fix regression in ConceptTests

I accidentially deleted that line :D
---
 python/ql/test/experimental/meta/ConceptsTest.qll | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/python/ql/test/experimental/meta/ConceptsTest.qll b/python/ql/test/experimental/meta/ConceptsTest.qll
index 6b3544da30e..0516fe5dac3 100644
--- a/python/ql/test/experimental/meta/ConceptsTest.qll
+++ b/python/ql/test/experimental/meta/ConceptsTest.qll
@@ -205,6 +205,8 @@ class HttpServerHttpResponseTest extends InlineExpectationsTest {
     // the tests for routing setup is both annoying and not very useful.
     location.getFile() = file and
     exists(file.getRelativePath()) and
+    // we need to do this step since we expect subclasses could override getARelevantTag
+    tag = getARelevantTag() and
     (
       exists(HTTP::Server::HttpResponse response |
         location = response.getLocation() and

From ec35e0d5189720ac8d4864b79ca571b57b0af976 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 22 Dec 2020 15:22:33 +0100
Subject: [PATCH 042/343] C++: Respond to review comments.

---
 .../ir/dataflow/internal/DataFlowPrivate.qll  | 30 +++---
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 92 +++++++++++++------
 2 files changed, 81 insertions(+), 41 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index 72d6db0f8dd..516cd663288 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -237,12 +237,12 @@ private class ArrayContent extends Content, TArrayContent {
 private predicate instrToFieldNodeStoreStepNoChi(
   Node node1, FieldContent f, PartialDefinitionNode node2
 ) {
-  exists(StoreInstruction store, PostUpdateFieldNode post |
-    post = node2.getPartialDefinition() and
+  exists(StoreInstruction store, PartialFieldDefinition pd |
+    pd = node2.getPartialDefinition() and
     not exists(ChiInstruction chi | chi.getPartial() = store) and
-    post.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
+    pd.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
     store.getSourceValueOperand() = node1.asOperand() and
-    f.getADirectField() = post.getPreUpdateNode().getField()
+    f.getADirectField() = pd.getPreUpdateNode().getField()
   )
 }
 
@@ -255,15 +255,15 @@ private predicate instrToFieldNodeStoreStepChi(
   Node node1, FieldContent f, PartialDefinitionNode node2
 ) {
   exists(
-    ChiPartialOperand operand, StoreInstruction store, ChiInstruction chi, PostUpdateFieldNode post
+    ChiPartialOperand operand, StoreInstruction store, ChiInstruction chi, PartialFieldDefinition pd
   |
-    post = node2.getPartialDefinition() and
+    pd = node2.getPartialDefinition() and
     not chi.isResultConflated() and
     node1.asOperand() = operand and
     chi.getPartialOperand() = operand and
     store = operand.getDef() and
-    post.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
-    f.getADirectField() = post.getPreUpdateNode().getField()
+    pd.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
+    f.getADirectField() = pd.getPreUpdateNode().getField()
   )
 }
 
@@ -271,14 +271,14 @@ private predicate callableWithoutDefinitionStoreStep(
   Node node1, FieldContent f, PartialDefinitionNode node2
 ) {
   exists(
-    WriteSideEffectInstruction write, ChiInstruction chi, PostUpdateFieldNode post,
+    WriteSideEffectInstruction write, ChiInstruction chi, PartialFieldDefinition pd,
     Function callable, CallInstruction call
   |
     chi.getPartial() = write and
     not chi.isResultConflated() and
-    post = node2.getPartialDefinition() and
-    post.getPreUpdateNode() = getFieldNodeForFieldInstruction(write.getDestinationAddress()) and
-    f.getADirectField() = post.getPreUpdateNode().getField() and
+    pd = node2.getPartialDefinition() and
+    pd.getPreUpdateNode() = getFieldNodeForFieldInstruction(write.getDestinationAddress()) and
+    f.getADirectField() = pd.getPreUpdateNode().getField() and
     call = write.getPrimaryInstruction() and
     callable = call.getStaticCallTarget() and
     not callable.hasDefinition()
@@ -346,6 +346,12 @@ private class ArrayToPointerConvertInstruction extends ConvertInstruction {
   }
 }
 
+/**
+ * These two predicates look like copy-paste from the two predicates with the same name in DataFlowUtil,
+ * but crucially they only skip past `CopyValueInstruction`s. This is because we use a special case of
+ * a `ConvertInstruction` to detect some read steps from arrays that undergoes array-to-pointer
+ * conversion.
+ */
 private Instruction skipOneCopyValueInstructionRec(CopyValueInstruction copy) {
   copy.getUnary() = result and not result instanceof CopyValueInstruction
   or
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 0d50f848689..0c3b06addf7 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -185,16 +185,24 @@ class OperandNode extends Node, TOperandNode {
   override string toString() { result = this.getOperand().toString() }
 }
 
+/** An abstract class that defines conversion-like instructions. */
 abstract private class SkippableInstruction extends Instruction {
   abstract Instruction getSourceInstruction();
 }
 
+/**
+ * Gets the instruction that is propaged through a non-empty sequence of conversion-like instructions.
+ */
 private Instruction skipSkippableInstructionsRec(SkippableInstruction skip) {
   result = skip.getSourceInstruction() and not result instanceof SkippableInstruction
   or
   result = skipSkippableInstructionsRec(skip.getSourceInstruction())
 }
 
+/**
+ * Gets the instruction that is propagated through a (possibly empty) sequence of conversion-like
+ * instructions.
+ */
 private Instruction skipSkippableInstructions(Instruction instr) {
   result = instr and not result instanceof SkippableInstruction
   or
@@ -228,8 +236,16 @@ FieldNode getFieldNodeForFieldInstruction(Instruction instr) {
 }
 
 /**
- * INTERNAL: do not use. A `FieldNode` represents the state of an object after modifying one
- * of its fields.
+ * INTERNAL: do not use. A `FieldNode` represents the state of a field before any partial definitions
+ * of the field. For instance, in the snippet:
+ * ```cpp
+ * struct A { int b, c; };
+ * // ...
+ * A a;
+ * f(a.b.c);
+ * ```
+ * there are two `FieldNode`s: one corresponding to `c`, and one corresponding to `b`. Similarly,
+ * in `a.b.c = x` there are two `FieldNode`s: one for `c` and one for `b`.
  */
 class FieldNode extends Node, TFieldNode {
   FieldAddressInstruction field;
@@ -272,10 +288,9 @@ class FieldNode extends Node, TFieldNode {
 }
 
 /**
- * INTERNAL: do not use. A `FieldNode` represents the state of an object after modifying one
- * of its fields.
+ * INTERNAL: do not use. A partial definition of a `FieldNode`.
  */
-class PostUpdateFieldNode extends PartialDefinition {
+class PartialFieldDefinition extends PartialDefinition {
   override FieldNode node;
 
   override FieldNode getPreUpdateNode() { result = node }
@@ -435,6 +450,18 @@ abstract class PostUpdateNode extends Node {
   override Location getLocation() { result = getPreUpdateNode().getLocation() }
 }
 
+/**
+ * A partial definition of a node. A partial definition that target arrays or pointers is attached to
+ * an `InstructionNode` (specifially, to the `ChiInstruction` that follows the `StoreInstruction`), and
+ * a partial update that targets a `FieldNode` is attached to the `FieldNode`.
+ *s
+ * The pre update node of a partial definition of a `FieldNode` is the `FieldNode` itself. This ensures
+ * that the dataflow library's reverse read mechanism builds up the correct access path for nested
+ * fields.
+ * For instance, in `a.b.c = x` there is a partial definition for `c` (let's call it `post[c]`) and a
+ * partial definition for `b` (let's call it `post[b]`), and there is a read step from `b` to `c`
+ * (using `instrToFieldNodeReadStep`), so there is a store step from `post[c]` to `post[b]`.
+ */
 private newtype TPartialDefinition =
   MkPartialDefinition(Node node) {
     isPointerStoreNode(node, _, _) or
@@ -681,7 +708,7 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) { simpleLocalFlowStep(nodeFr
 private predicate flowOutOfPostUpdate(PartialDefinitionNode nodeFrom, Node nodeTo) {
   // flow from the "outermost" field to the `ChiInstruction`, or `StoreInstruction`
   // if no `ChiInstruction` exists.
-  exists(AddressOperand addressOperand, PostUpdateFieldNode pd |
+  exists(AddressOperand addressOperand, PartialFieldDefinition pd |
     pd = nodeFrom.getPartialDefinition() and
     not exists(pd.getPreUpdateNode().getObjectNode()) and
     pd.getPreUpdateNode().getNextNode*() = getFieldNodeForFieldInstruction(addressOperand.getDef()) and
@@ -707,30 +734,37 @@ private predicate flowOutOfPostUpdate(PartialDefinitionNode nodeFrom, Node nodeT
   )
 }
 
-private predicate flowIntoReadNode(Node nodeFrom, Node nodeTo) {
-  // flow from the "innermost" field to the load of that field.
-  exists(FieldNode fieldNode | nodeTo = fieldNode |
-    not exists(fieldNode.getObjectNode()) and
-    (
-      exists(LoadInstruction load |
-        fieldNode.getNextNode*() = getFieldNodeForFieldInstruction(load.getSourceAddress()) and
-        nodeFrom.asInstruction() = load.getSourceValueOperand().getAnyDef()
-      )
-      or
-      // We need this to make stores look like loads for the dataflow library. So when there's a store
-      // of the form x->y = z we need to make the field node corresponding to y look like it's reading
-      // from the memory of x.
-      exists(StoreInstruction store, ChiInstruction chi |
-        chi.getPartial() = store and
-        fieldNode.getNextNode*() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
-        nodeFrom.asInstruction() = chi.getTotal()
-      )
-      or
-      exists(ReadSideEffectInstruction read |
-        fieldNode.getNextNode*() = getFieldNodeForFieldInstruction(read.getArgumentDef()) and
-        nodeFrom.asOperand() = read.getSideEffectOperand()
-      )
+/**
+ * Gets the `FieldNode` corresponding to the outermost field that is used to compute `address`.
+ */
+private FieldNode getOutermostFieldNode(Instruction address) {
+  not exists(result.getObjectNode()) and
+  result.getNextNode*() = getFieldNodeForFieldInstruction(address)
+}
+
+private predicate flowIntoReadNode(Node nodeFrom, FieldNode nodeTo) {
+  // flow from the memory of a load to the "outermost" field of that load.
+  not nodeFrom.asInstruction().isResultConflated() and
+  (
+    exists(LoadInstruction load |
+      nodeTo = getOutermostFieldNode(load.getSourceAddress()) and
+      nodeFrom.asInstruction() = load.getSourceValueOperand().getAnyDef()
     )
+    or
+    // We need this to make stores look like loads for the dataflow library. So when there's a store
+    // of the form x->y = z we need to make the field node corresponding to y look like it's reading
+    // from the memory of x.
+    exists(StoreInstruction store, ChiInstruction chi |
+      chi.getPartial() = store and
+      nodeTo = getOutermostFieldNode(store.getDestinationAddress()) and
+      nodeFrom.asInstruction() = chi.getTotal()
+    )
+  )
+  or
+  exists(ReadSideEffectInstruction read |
+    not read.getSideEffectOperand().getAnyDef().isResultConflated() and
+    nodeTo = getOutermostFieldNode(read.getArgumentDef()) and
+    nodeFrom.asOperand() = read.getSideEffectOperand()
   )
 }
 

From b95cf948249bfef8b6cced8ab0d1ea94fb4f7260 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 22 Dec 2020 15:57:34 +0100
Subject: [PATCH 043/343] Update
 cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

Co-authored-by: Jonas Jensen <jbj@github.com>
---
 .../src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 0c3b06addf7..0c863a3a340 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -239,7 +239,7 @@ FieldNode getFieldNodeForFieldInstruction(Instruction instr) {
  * INTERNAL: do not use. A `FieldNode` represents the state of a field before any partial definitions
  * of the field. For instance, in the snippet:
  * ```cpp
- * struct A { int b, c; };
+ * struct A { struct B { int c; } b; };
  * // ...
  * A a;
  * f(a.b.c);

From d2d8377e88a6035370cb20142b442ff01358fed2 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 22 Dec 2020 16:34:53 +0100
Subject: [PATCH 044/343] Update
 cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

Co-authored-by: Jonas Jensen <jbj@github.com>
---
 .../code/cpp/ir/dataflow/internal/DataFlowUtil.qll     | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 0c863a3a340..48c23e0b551 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -451,12 +451,12 @@ abstract class PostUpdateNode extends Node {
 }
 
 /**
- * A partial definition of a node. A partial definition that target arrays or pointers is attached to
+ * A partial definition of a node. A partial definition that targets arrays or pointers is attached to
  * an `InstructionNode` (specifially, to the `ChiInstruction` that follows the `StoreInstruction`), and
- * a partial update that targets a `FieldNode` is attached to the `FieldNode`.
- *s
- * The pre update node of a partial definition of a `FieldNode` is the `FieldNode` itself. This ensures
- * that the dataflow library's reverse read mechanism builds up the correct access path for nested
+ * a partial definition that targets a `FieldNode` is attached to the `FieldNode`.
+ *
+ * The pre-update node of a partial definition of a `FieldNode` is the `FieldNode` itself. This ensures
+ * that the data flow library's reverse read mechanism builds up the correct access path for nested
  * fields.
  * For instance, in `a.b.c = x` there is a partial definition for `c` (let's call it `post[c]`) and a
  * partial definition for `b` (let's call it `post[b]`), and there is a read step from `b` to `c`

From 6545d0b53af6fb45ea81519b088635c557615fcc Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 22 Dec 2020 16:56:30 +0100
Subject: [PATCH 045/343] C++: Move conflation check into each disjunct.

---
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 36 +++++++++----------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 48c23e0b551..55ca891ab29 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -744,27 +744,27 @@ private FieldNode getOutermostFieldNode(Instruction address) {
 
 private predicate flowIntoReadNode(Node nodeFrom, FieldNode nodeTo) {
   // flow from the memory of a load to the "outermost" field of that load.
-  not nodeFrom.asInstruction().isResultConflated() and
-  (
-    exists(LoadInstruction load |
-      nodeTo = getOutermostFieldNode(load.getSourceAddress()) and
-      nodeFrom.asInstruction() = load.getSourceValueOperand().getAnyDef()
-    )
-    or
-    // We need this to make stores look like loads for the dataflow library. So when there's a store
-    // of the form x->y = z we need to make the field node corresponding to y look like it's reading
-    // from the memory of x.
-    exists(StoreInstruction store, ChiInstruction chi |
-      chi.getPartial() = store and
-      nodeTo = getOutermostFieldNode(store.getDestinationAddress()) and
-      nodeFrom.asInstruction() = chi.getTotal()
-    )
+  exists(LoadInstruction load |
+    nodeTo = getOutermostFieldNode(load.getSourceAddress()) and
+    not nodeFrom.asInstruction().isResultConflated() and
+    nodeFrom.asInstruction() = load.getSourceValueOperand().getAnyDef()
   )
   or
-  exists(ReadSideEffectInstruction read |
-    not read.getSideEffectOperand().getAnyDef().isResultConflated() and
+  // We need this to make stores look like loads for the dataflow library. So when there's a store
+  // of the form x->y = z we need to make the field node corresponding to y look like it's reading
+  // from the memory of x.
+  exists(StoreInstruction store, ChiInstruction chi |
+    chi.getPartial() = store and
+    nodeTo = getOutermostFieldNode(store.getDestinationAddress()) and
+    not nodeFrom.asInstruction().isResultConflated() and
+    nodeFrom.asInstruction() = chi.getTotal()
+  )
+  or
+  exists(ReadSideEffectInstruction read, SideEffectOperand sideEffect |
+    sideEffect = read.getSideEffectOperand() and
+    not sideEffect.getAnyDef().isResultConflated() and
     nodeTo = getOutermostFieldNode(read.getArgumentDef()) and
-    nodeFrom.asOperand() = read.getSideEffectOperand()
+    nodeFrom.asOperand() = sideEffect
   )
 }
 

From 258d04178f90b48153c1119aa55a86544cbea54c Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 30 Dec 2020 13:39:24 +0100
Subject: [PATCH 046/343] C++: Replace SkippableInstruction with local flow
 steps.

---
 .../ir/dataflow/internal/DataFlowPrivate.qll  | 21 +-----
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 71 ++++++-------------
 .../dataflow/fields/ir-path-flow.expected     |  6 +-
 3 files changed, 28 insertions(+), 70 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index 516cd663288..39672fe8e58 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -346,24 +346,6 @@ private class ArrayToPointerConvertInstruction extends ConvertInstruction {
   }
 }
 
-/**
- * These two predicates look like copy-paste from the two predicates with the same name in DataFlowUtil,
- * but crucially they only skip past `CopyValueInstruction`s. This is because we use a special case of
- * a `ConvertInstruction` to detect some read steps from arrays that undergoes array-to-pointer
- * conversion.
- */
-private Instruction skipOneCopyValueInstructionRec(CopyValueInstruction copy) {
-  copy.getUnary() = result and not result instanceof CopyValueInstruction
-  or
-  result = skipOneCopyValueInstructionRec(copy.getUnary())
-}
-
-private Instruction skipCopyValueInstructions(Operand op) {
-  not result instanceof CopyValueInstruction and result = op.getDef()
-  or
-  result = skipOneCopyValueInstructionRec(op.getDef())
-}
-
 private class InexactLoadOperand extends LoadOperand {
   InexactLoadOperand() { this.isDefinitionInexact() }
 }
@@ -375,7 +357,8 @@ private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
     node1.asInstruction() = operand.getAnyDef() and
     not node1.asInstruction().isResultConflated() and
     operand = node2.asOperand() and
-    address = skipCopyValueInstructions(operand.getAddressOperand()) and
+    instructionOperandLocalFlowStep+(instructionNode(address),
+      operandNode(operand.getAddressOperand())) and
     (
       address instanceof LoadInstruction or
       address instanceof ArrayToPointerConvertInstruction or
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 55ca891ab29..5ab582dc6d8 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -185,54 +185,15 @@ class OperandNode extends Node, TOperandNode {
   override string toString() { result = this.getOperand().toString() }
 }
 
-/** An abstract class that defines conversion-like instructions. */
-abstract private class SkippableInstruction extends Instruction {
-  abstract Instruction getSourceInstruction();
-}
-
-/**
- * Gets the instruction that is propaged through a non-empty sequence of conversion-like instructions.
- */
-private Instruction skipSkippableInstructionsRec(SkippableInstruction skip) {
-  result = skip.getSourceInstruction() and not result instanceof SkippableInstruction
-  or
-  result = skipSkippableInstructionsRec(skip.getSourceInstruction())
-}
-
-/**
- * Gets the instruction that is propagated through a (possibly empty) sequence of conversion-like
- * instructions.
- */
-private Instruction skipSkippableInstructions(Instruction instr) {
-  result = instr and not result instanceof SkippableInstruction
-  or
-  result = skipSkippableInstructionsRec(instr)
-}
-
-private class SkippableCopyValueInstruction extends SkippableInstruction, CopyValueInstruction {
-  override Instruction getSourceInstruction() { result = this.getSourceValue() }
-}
-
-private class SkippableConvertInstruction extends SkippableInstruction, ConvertInstruction {
-  override Instruction getSourceInstruction() { result = this.getUnary() }
-}
-
-private class SkippableCheckedConvertInstruction extends SkippableInstruction,
-  CheckedConvertOrNullInstruction {
-  override Instruction getSourceInstruction() { result = this.getUnary() }
-}
-
-private class SkippableInheritanceConversionInstruction extends SkippableInstruction,
-  InheritanceConversionInstruction {
-  override Instruction getSourceInstruction() { result = this.getUnary() }
-}
-
 /**
  * INTERNAL: do not use. Gets the `FieldNode` corresponding to `instr`, if
  * `instr` is an instruction that propagates an address of a `FieldAddressInstruction`.
  */
 FieldNode getFieldNodeForFieldInstruction(Instruction instr) {
-  result.getFieldInstruction() = skipSkippableInstructions(instr)
+  result.getFieldInstruction() =
+    any(FieldAddressInstruction fai |
+      instructionOperandLocalFlowStep*(instructionNode(fai), instructionNode(instr))
+    )
 }
 
 /**
@@ -651,6 +612,11 @@ class VariableNode extends Node, TVariableNode {
  */
 InstructionNode instructionNode(Instruction instr) { result.getInstruction() = instr }
 
+/**
+ * Gets the node corresponding to `operand`.
+ */
+OperandNode operandNode(Operand operand) { result.getOperand() = operand }
+
 /**
  * DEPRECATED: use `definitionByReferenceNodeFromArgument` instead.
  *
@@ -768,6 +734,19 @@ private predicate flowIntoReadNode(Node nodeFrom, FieldNode nodeTo) {
   )
 }
 
+/**
+ * INTERNAL: do not use.
+ * Holds if `nodeFrom` is an operand and `nodeTo` is an instruction node that uses this operand, or
+ * if `nodeFrom` is an instruction and `nodeTo` is an operand that refers to this instruction.
+ */
+predicate instructionOperandLocalFlowStep(Node nodeFrom, Node nodeTo) {
+  // Operand -> Instruction flow
+  simpleInstructionLocalFlowStep(nodeFrom.asOperand(), nodeTo.asInstruction())
+  or
+  // Instruction -> Operand flow
+  simpleOperandLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asOperand())
+}
+
 /**
  * INTERNAL: do not use.
  *
@@ -776,11 +755,7 @@ private predicate flowIntoReadNode(Node nodeFrom, FieldNode nodeTo) {
  */
 cached
 predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
-  // Operand -> Instruction flow
-  simpleInstructionLocalFlowStep(nodeFrom.asOperand(), nodeTo.asInstruction())
-  or
-  // Instruction -> Operand flow
-  simpleOperandLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asOperand())
+  instructionOperandLocalFlowStep(nodeFrom, nodeTo)
   or
   flowIntoReadNode(nodeFrom, nodeTo)
   or
diff --git a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
index e787b9a5f0e..ee43cd98302 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
@@ -58,9 +58,9 @@ edges
 | aliasing.cpp:79:11:79:20 | call to user_input | aliasing.cpp:80:12:80:13 | m1 |
 | aliasing.cpp:86:10:86:19 | call to user_input | aliasing.cpp:87:12:87:13 | m1 |
 | aliasing.cpp:92:12:92:21 | call to user_input | aliasing.cpp:93:12:93:13 | m1 |
-| aliasing.cpp:98:5:98:6 | m1 [post update] [m1] | aliasing.cpp:100:14:100:14 | Store [m1] |
+| aliasing.cpp:98:5:98:6 | m1 [post update] [m1] | aliasing.cpp:101:21:101:22 | m1 [m1] |
 | aliasing.cpp:98:10:98:19 | call to user_input | aliasing.cpp:98:5:98:6 | m1 [post update] [m1] |
-| aliasing.cpp:100:14:100:14 | Store [m1] | aliasing.cpp:102:8:102:10 | * ... |
+| aliasing.cpp:101:21:101:22 | m1 [m1] | aliasing.cpp:102:8:102:10 | * ... |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:121:15:121:16 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:126:15:126:20 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:131:15:131:16 | taint_a_ptr output argument [array content] |
@@ -373,7 +373,7 @@ nodes
 | aliasing.cpp:93:12:93:13 | m1 | semmle.label | m1 |
 | aliasing.cpp:98:5:98:6 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
 | aliasing.cpp:98:10:98:19 | call to user_input | semmle.label | call to user_input |
-| aliasing.cpp:100:14:100:14 | Store [m1] | semmle.label | Store [m1] |
+| aliasing.cpp:101:21:101:22 | m1 [m1] | semmle.label | m1 [m1] |
 | aliasing.cpp:102:8:102:10 | * ... | semmle.label | * ... |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | semmle.label | Chi [array content] |
 | aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | semmle.label | ChiTotal [post update] [array content] |

From 7a3f9c78950d14c8b78875bedcf389db3ac252ac Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 4 Jan 2021 15:18:08 +0000
Subject: [PATCH 047/343] C++: Add a test (cleaned up) that was previously in
 the internal repo.

---
 .../CWE-089/SqlTainted/SqlTainted.expected    | 13 +++++++++
 .../CWE/CWE-089/SqlTainted/SqlTainted.qlref   |  1 +
 .../Security/CWE/CWE-089/SqlTainted/test.c    | 27 +++++++++++++++++++
 3 files changed, 41 insertions(+)
 create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
 create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.qlref
 create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c

diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
new file mode 100644
index 00000000000..f9fd94e278d
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
@@ -0,0 +1,13 @@
+edges
+| test.c:14:20:14:23 | argv | test.c:19:18:19:23 | (const char *)... |
+| test.c:14:20:14:23 | argv | test.c:19:18:19:23 | (const char *)... |
+| test.c:14:20:14:23 | argv | test.c:19:18:19:23 | query1 |
+| test.c:14:20:14:23 | argv | test.c:19:18:19:23 | query1 |
+nodes
+| test.c:14:20:14:23 | argv | semmle.label | argv |
+| test.c:14:20:14:23 | argv | semmle.label | argv |
+| test.c:19:18:19:23 | (const char *)... | semmle.label | (const char *)... |
+| test.c:19:18:19:23 | (const char *)... | semmle.label | (const char *)... |
+| test.c:19:18:19:23 | query1 | semmle.label | query1 |
+#select
+| test.c:19:18:19:23 | query1 | test.c:14:20:14:23 | argv | test.c:19:18:19:23 | query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg) | test.c:14:20:14:23 | argv | user input (argv) |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.qlref
new file mode 100644
index 00000000000..21a12e5eadd
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.qlref
@@ -0,0 +1 @@
+Security/CWE/CWE-089/SqlTainted.ql
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
new file mode 100644
index 00000000000..1f437fcf856
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
@@ -0,0 +1,27 @@
+// Semmle test case for rule SprintfToSqlQuery.ql (Uncontrolled sprintf for SQL query)
+// Associated with CWE-089: SQL injection. http://cwe.mitre.org/data/definitions/89.html
+
+///// Library routines /////
+
+typedef unsigned long size_t;
+int snprintf(char *s, size_t n, const char *format, ...);
+void sanitizeString(char *stringOut, size_t len, const char *strIn);
+int mysql_query(int arg1, const char *sqlArg);
+
+///// Test code /////
+
+int main(int argc, char** argv) {
+  char *userName = argv[2];
+
+  // a string from the user is injected directly into an SQL query.
+  char query1[1000] = {0};
+  snprintf(query1, 1000, "SELECT UID FROM USERS where name = \"%s\"", userName);
+  mysql_query(0, query1); // BAD
+  
+  // the user string is encoded by a library routine.
+  char userNameSanitized[1000] = {0};
+  sanitizeString(userNameSanitized, 1000, userName); 
+  char query2[1000] = {0};
+  snprintf(query2, 1000, "SELECT UID FROM USERS where name = \"%s\"", userNameSanitized);
+  mysql_query(0, query2); // GOOD
+}

From 01b204ea30b880e388364b74be9cc319ced31423 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 4 Jan 2021 15:33:10 +0000
Subject: [PATCH 048/343] C++: Add a test case with a tainted integer.

---
 .../CWE-089/SqlTainted/SqlTainted.expected    | 30 ++++++++++++-------
 .../Security/CWE/CWE-089/SqlTainted/test.c    |  7 +++++
 2 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
index f9fd94e278d..ebd8b1a77e8 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
@@ -1,13 +1,23 @@
 edges
-| test.c:14:20:14:23 | argv | test.c:19:18:19:23 | (const char *)... |
-| test.c:14:20:14:23 | argv | test.c:19:18:19:23 | (const char *)... |
-| test.c:14:20:14:23 | argv | test.c:19:18:19:23 | query1 |
-| test.c:14:20:14:23 | argv | test.c:19:18:19:23 | query1 |
+| test.c:15:20:15:23 | argv | test.c:21:18:21:23 | (const char *)... |
+| test.c:15:20:15:23 | argv | test.c:21:18:21:23 | (const char *)... |
+| test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 |
+| test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 |
+| test.c:16:25:16:28 | argv | test.c:33:18:33:23 | (const char *)... |
+| test.c:16:25:16:28 | argv | test.c:33:18:33:23 | (const char *)... |
+| test.c:16:25:16:28 | argv | test.c:33:18:33:23 | query3 |
+| test.c:16:25:16:28 | argv | test.c:33:18:33:23 | query3 |
 nodes
-| test.c:14:20:14:23 | argv | semmle.label | argv |
-| test.c:14:20:14:23 | argv | semmle.label | argv |
-| test.c:19:18:19:23 | (const char *)... | semmle.label | (const char *)... |
-| test.c:19:18:19:23 | (const char *)... | semmle.label | (const char *)... |
-| test.c:19:18:19:23 | query1 | semmle.label | query1 |
+| test.c:15:20:15:23 | argv | semmle.label | argv |
+| test.c:15:20:15:23 | argv | semmle.label | argv |
+| test.c:16:25:16:28 | argv | semmle.label | argv |
+| test.c:16:25:16:28 | argv | semmle.label | argv |
+| test.c:21:18:21:23 | (const char *)... | semmle.label | (const char *)... |
+| test.c:21:18:21:23 | (const char *)... | semmle.label | (const char *)... |
+| test.c:21:18:21:23 | query1 | semmle.label | query1 |
+| test.c:33:18:33:23 | (const char *)... | semmle.label | (const char *)... |
+| test.c:33:18:33:23 | (const char *)... | semmle.label | (const char *)... |
+| test.c:33:18:33:23 | query3 | semmle.label | query3 |
 #select
-| test.c:19:18:19:23 | query1 | test.c:14:20:14:23 | argv | test.c:19:18:19:23 | query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg) | test.c:14:20:14:23 | argv | user input (argv) |
+| test.c:21:18:21:23 | query1 | test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg) | test.c:15:20:15:23 | argv | user input (argv) |
+| test.c:33:18:33:23 | query3 | test.c:16:25:16:28 | argv | test.c:33:18:33:23 | query3 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg) | test.c:16:25:16:28 | argv | user input (argv) |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
index 1f437fcf856..85d5d462093 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
@@ -7,11 +7,13 @@ typedef unsigned long size_t;
 int snprintf(char *s, size_t n, const char *format, ...);
 void sanitizeString(char *stringOut, size_t len, const char *strIn);
 int mysql_query(int arg1, const char *sqlArg);
+int atoi(const char *nptr);
 
 ///// Test code /////
 
 int main(int argc, char** argv) {
   char *userName = argv[2];
+  int userNumber = atoi(argv[3]);
 
   // a string from the user is injected directly into an SQL query.
   char query1[1000] = {0};
@@ -24,4 +26,9 @@ int main(int argc, char** argv) {
   char query2[1000] = {0};
   snprintf(query2, 1000, "SELECT UID FROM USERS where name = \"%s\"", userNameSanitized);
   mysql_query(0, query2); // GOOD
+
+  // an integer from the user is injected into an SQL query.
+  char query3[1000] = {0};
+  snprintf(query3, 1000, "SELECT UID FROM USERS where number = \"%i\"", userNumber);
+  mysql_query(0, query3); // BAD [FALSE POSITIVE]
 }

From 69efe7a72abe9f556d1023fa9060f9bf1a7a625a Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 5 Jan 2021 11:31:54 +0000
Subject: [PATCH 049/343] C++: Add isAdditionalBarrier to DefaultTaintTracking.

---
 .../code/cpp/ir/dataflow/DefaultTaintTracking.qll     | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
index 5154f5c3239..907cb628a85 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -545,6 +545,9 @@ module TaintedWithPath {
     /** Override this to specify which elements are sinks in this configuration. */
     abstract predicate isSink(Element e);
 
+    /** Override this to specify additional barriers in this configuration. */
+    predicate isAdditionalBarrier(Expr node) { none() }
+
     /**
      * Override this predicate to `any()` to allow taint to flow through global
      * variables.
@@ -578,7 +581,13 @@ module TaintedWithPath {
       )
     }
 
-    override predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
+    override predicate isBarrier(DataFlow::Node node) {
+      nodeIsBarrier(node)
+      or
+      exists(TaintTrackingConfiguration cfg, Expr e |
+        cfg.isAdditionalBarrier(e) and node = getNodeForExpr(e)
+      )
+    }
 
     override predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
   }

From 18890c4a770031094bfa307e160b2dce82c997aa Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 5 Jan 2021 11:32:29 +0000
Subject: [PATCH 050/343] C++: Use isAdditionalBarrier in the SqlTainted query.

---
 cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql          |  2 ++
 .../CWE/CWE-089/SqlTainted/SqlTainted.expected         | 10 ----------
 .../query-tests/Security/CWE/CWE-089/SqlTainted/test.c |  2 +-
 3 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
index de786d22f30..29db32a6b87 100644
--- a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
+++ b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
@@ -27,6 +27,8 @@ class Configuration extends TaintTrackingConfiguration {
   override predicate isSink(Element tainted) {
     exists(SQLLikeFunction runSql | runSql.outermostWrapperFunctionCall(tainted, _))
   }
+
+  override predicate isAdditionalBarrier(Expr e) { e.getUnspecifiedType() instanceof IntegralType }
 }
 
 from
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
index ebd8b1a77e8..af50f184740 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected
@@ -3,21 +3,11 @@ edges
 | test.c:15:20:15:23 | argv | test.c:21:18:21:23 | (const char *)... |
 | test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 |
 | test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 |
-| test.c:16:25:16:28 | argv | test.c:33:18:33:23 | (const char *)... |
-| test.c:16:25:16:28 | argv | test.c:33:18:33:23 | (const char *)... |
-| test.c:16:25:16:28 | argv | test.c:33:18:33:23 | query3 |
-| test.c:16:25:16:28 | argv | test.c:33:18:33:23 | query3 |
 nodes
 | test.c:15:20:15:23 | argv | semmle.label | argv |
 | test.c:15:20:15:23 | argv | semmle.label | argv |
-| test.c:16:25:16:28 | argv | semmle.label | argv |
-| test.c:16:25:16:28 | argv | semmle.label | argv |
 | test.c:21:18:21:23 | (const char *)... | semmle.label | (const char *)... |
 | test.c:21:18:21:23 | (const char *)... | semmle.label | (const char *)... |
 | test.c:21:18:21:23 | query1 | semmle.label | query1 |
-| test.c:33:18:33:23 | (const char *)... | semmle.label | (const char *)... |
-| test.c:33:18:33:23 | (const char *)... | semmle.label | (const char *)... |
-| test.c:33:18:33:23 | query3 | semmle.label | query3 |
 #select
 | test.c:21:18:21:23 | query1 | test.c:15:20:15:23 | argv | test.c:21:18:21:23 | query1 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg) | test.c:15:20:15:23 | argv | user input (argv) |
-| test.c:33:18:33:23 | query3 | test.c:16:25:16:28 | argv | test.c:33:18:33:23 | query3 | This argument to a SQL query function is derived from $@ and then passed to mysql_query(sqlArg) | test.c:16:25:16:28 | argv | user input (argv) |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
index 85d5d462093..129257731ab 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
@@ -30,5 +30,5 @@ int main(int argc, char** argv) {
   // an integer from the user is injected into an SQL query.
   char query3[1000] = {0};
   snprintf(query3, 1000, "SELECT UID FROM USERS where number = \"%i\"", userNumber);
-  mysql_query(0, query3); // BAD [FALSE POSITIVE]
+  mysql_query(0, query3); // BAD
 }

From 81205f37c5acfd86a3778f9575176a6c94debe34 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 6 Jan 2021 11:45:17 +0000
Subject: [PATCH 051/343] C++: Fix test annotation.

---
 cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
index 129257731ab..45304f13872 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/test.c
@@ -30,5 +30,5 @@ int main(int argc, char** argv) {
   // an integer from the user is injected into an SQL query.
   char query3[1000] = {0};
   snprintf(query3, 1000, "SELECT UID FROM USERS where number = \"%i\"", userNumber);
-  mysql_query(0, query3); // BAD
+  mysql_query(0, query3); // GOOD
 }

From b5bcbd303ea4e3312da9c00f4bf427c4bc56beed Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 6 Jan 2021 18:22:31 +0000
Subject: [PATCH 052/343] C++: Cleaner solution.

---
 cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql             | 4 +++-
 .../semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll  | 8 +++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
index 29db32a6b87..5ed84f45250 100644
--- a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
+++ b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
@@ -28,7 +28,9 @@ class Configuration extends TaintTrackingConfiguration {
     exists(SQLLikeFunction runSql | runSql.outermostWrapperFunctionCall(tainted, _))
   }
 
-  override predicate isAdditionalBarrier(Expr e) { e.getUnspecifiedType() instanceof IntegralType }
+  override predicate isBarrier(Expr e) {
+    super.isBarrier(e) or e.getUnspecifiedType() instanceof IntegralType
+  }
 }
 
 from
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
index 907cb628a85..23161bc4b89 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -545,8 +545,8 @@ module TaintedWithPath {
     /** Override this to specify which elements are sinks in this configuration. */
     abstract predicate isSink(Element e);
 
-    /** Override this to specify additional barriers in this configuration. */
-    predicate isAdditionalBarrier(Expr node) { none() }
+    /** Override this to specify which expressions are barriers in this configuration. */
+    predicate isBarrier(Expr e) { nodeIsBarrier(getNodeForExpr(e)) }
 
     /**
      * Override this predicate to `any()` to allow taint to flow through global
@@ -582,10 +582,8 @@ module TaintedWithPath {
     }
 
     override predicate isBarrier(DataFlow::Node node) {
-      nodeIsBarrier(node)
-      or
       exists(TaintTrackingConfiguration cfg, Expr e |
-        cfg.isAdditionalBarrier(e) and node = getNodeForExpr(e)
+        cfg.isBarrier(e) and node = getNodeForExpr(e)
       )
     }
 

From 8d77f4bac917969134feb5c1edcff7ddf52f359f Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 21 Dec 2020 15:25:26 +0100
Subject: [PATCH 053/343] C#: Remove `ImplicitUntrackedDefinition`

---
 .../semmle/code/csharp/controlflow/Guards.qll |   3 +-
 .../src/semmle/code/csharp/dataflow/SSA.qll   | 284 ++++++------------
 .../dataflow/internal/DataFlowPrivate.qll     |   2 -
 .../csharp7/LocalTaintFlow.expected           |   3 +
 .../dataflow/local/DataFlowStep.expected      |   6 +
 .../dataflow/local/TaintTrackingStep.expected |   6 +
 .../dataflow/ssa/SsaDef.expected              |  15 +-
 .../dataflow/ssa/SsaDefElement.expected       |  15 +-
 .../dataflow/ssa/SsaDefLastRead.expected      |   4 +
 .../dataflow/ssa/SsaRead.expected             |  15 +-
 .../dataflow/ssa/SsaUltimateDef.expected      |  15 +-
 11 files changed, 124 insertions(+), 244 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
index 7cad1dff909..a9d95bd0084 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
@@ -621,8 +621,7 @@ private Ssa::Definition getAnSsaQualifier(Expr e, ControlFlow::Node cfn) {
 }
 
 private AssignableAccess getATrackedAccess(Ssa::Definition def, ControlFlow::Node cfn) {
-  result = def.getAReadAtNode(cfn) and
-  not def instanceof Ssa::ImplicitUntrackedDefinition
+  result = def.getAReadAtNode(cfn)
   or
   result = def.(Ssa::ExplicitDefinition).getADefinition().getTargetAccess() and
   cfn = def.getControlFlowNode()
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index 487a32e6a83..4b99882e167 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -17,6 +17,12 @@ module Ssa {
         or
         this instanceof Property
       }
+
+      /**
+       * Holds if the this field or any of the fields part of the qualifier
+       * are volatile.
+       */
+      predicate isVolatile() { this.(Field).isVolatile() }
     }
 
     /** An instance field or property. */
@@ -43,10 +49,12 @@ module Ssa {
           c = v.getAnAccess().getEnclosingCallable()
         } or
         TPlainFieldOrProp(Callable c, FieldOrProp f) {
-          exists(FieldOrPropRead fr | isPlainFieldOrPropAccess(fr, f, c))
+          exists(FieldOrPropRead fr | isPlainFieldOrPropAccess(fr, f, c)) and
+          trackFieldOrProp(f)
         } or
         TQualifiedFieldOrProp(Callable c, SourceVariable q, InstanceFieldOrProp f) {
-          exists(FieldOrPropRead fr | isQualifiedFieldOrPropAccess(fr, f, c, q))
+          exists(FieldOrPropRead fr | isQualifiedFieldOrPropAccess(fr, f, c, q)) and
+          trackFieldOrProp(f)
         }
 
       /** Gets an access to source variable `v`. */
@@ -70,9 +78,9 @@ module Ssa {
 
       cached
       AssignableDefinition getADefinition(ExplicitDefinition def) {
-        exists(TrackedVar tv, AssignableDefinition ad | def = TSsaExplicitDef(tv, ad, _, _) |
+        exists(SourceVariable sv, AssignableDefinition ad | def = TSsaExplicitDef(sv, ad, _, _) |
           result = ad or
-          result = getASameOutRefDefAfter(tv, ad)
+          result = getASameOutRefDefAfter(sv, ad)
         )
       }
     }
@@ -360,6 +368,23 @@ module Ssa {
     predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v, ReadKind rk) {
       exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk, rk))
     }
+
+    /**
+     * Holds if `fp` is a field or a property that is interesting as a basis for SSA.
+     *
+     * - A volatile field is never interesting, since all reads must reread from
+     *   memory and we are forced to assume that the value can change at any point.
+     * - A property is only interesting if it is "field-like", that is, it is a
+     *   non-overridable trivial property.
+     */
+    predicate trackFieldOrProp(FieldOrProp fp) {
+      not fp.isVolatile() and
+      (
+        fp instanceof Field
+        or
+        fp = any(TrivialProperty p | not p.isOverridableOrImplementable())
+      )
+    }
   }
 
   private import SourceVariableImpl
@@ -460,15 +485,6 @@ module Ssa {
       }
 
       override Location getLocation() { result = getFirstAccess().getLocation() }
-
-      /**
-       * Holds if the this field or any of the fields part of the qualifier
-       * are volatile.
-       */
-      predicate isVolatile() {
-        this.getAssignable().(Field).isVolatile() or
-        this.getQualifier().(FieldOrPropSourceVariable).isVolatile()
-      }
     }
 
     /** A plain field or property. */
@@ -498,93 +514,9 @@ module Ssa {
 
   private import SourceVariables
 
-  private module TrackedVariablesImpl {
-    /** Gets the number of accesses of field or property `fp`. */
-    private int numberOfAccesses(FieldOrPropSourceVariable fp) {
-      result = strictcount(fp.getAnAccess())
-    }
-
-    /** Holds if field or property `fp` is accessed inside a loop. */
-    private predicate loopAccessed(FieldOrPropSourceVariable fp) {
-      exists(FieldOrPropRead fpr |
-        fpr = fp.getAnAccess() and
-        fpr.getAControlFlowNode().getBasicBlock().inLoop()
-      )
-    }
-
-    /** Holds if field or property `fp` is accessed more than once or inside a loop. */
-    private predicate multiAccessed(FieldOrPropSourceVariable fp) {
-      loopAccessed(fp) or 1 < numberOfAccesses(fp)
-    }
-
-    /**
-     * Holds if `fp` is a field or a property that is interesting as a basis for SSA.
-     *
-     * - A field or property that is read twice is interesting as we want to know whether
-     *   the reads refer to the same value.
-     * - A field or property that is both written and read is interesting as we want to
-     *   know whether the read might get the written value.
-     * - A field or property that is read in a loop is interesting as we want to know whether
-     *   the value is the same in different iterations (that is, whether the SSA
-     *   definition can be placed outside the loop).
-     * - A volatile field is never interesting, since all reads must reread from
-     *   memory and we are forced to assume that the value can change at any point.
-     * - A property is only interesting if it is "field-like", that is, it is a
-     *   non-overridable trivial property.
-     */
-    predicate trackFieldOrProp(FieldOrPropSourceVariable fp) {
-      multiAccessed(fp) and
-      not fp.isVolatile() and
-      exists(Assignable a | a = fp.getAssignable() |
-        a instanceof Field
-        or
-        a = any(TrivialProperty p | not p.isOverridableOrImplementable())
-      )
-    }
-  }
-
-  private import TrackedVariablesImpl
-
-  /**
-   * A source variable that gets a non-trivial SSA construction.
-   */
-  private class TrackedVar extends SourceVariable {
-    TrackedVar() {
-      this instanceof LocalScopeSourceVariable or
-      trackFieldOrProp(this)
-    }
-  }
-
-  /**
-   * A field or property that gets a non-trivial SSA construction.
-   */
-  private class TrackedFieldOrProp extends TrackedVar, FieldOrPropSourceVariable { }
-
-  /**
-   * A source variable that gets a trivial SSA construction, that is a
-   * definition prior to every read.
-   */
-  private class UntrackedVar extends SourceVariable {
-    UntrackedVar() { not this instanceof TrackedVar }
-  }
-
   private module SsaDefReaches {
-    /** A non-trivial SSA definition. */
-    private class TrackedDefinition extends Definition {
-      TrackedDefinition() {
-        // Same as `not this instanceof ImplicitUntrackedDefinition` but
-        // avoids negative recursion
-        this instanceof ExplicitDefinition or
-        this instanceof ImplicitEntryDefinition or
-        this instanceof ImplicitCallDefinition or
-        this instanceof ImplicitQualifierDefinition or
-        this instanceof PseudoDefinition
-      }
-    }
-
     /**
-     * A classification of SSA variable references into reads and non-trivial
-     * SSA definitions.
+     * A classification of SSA variable references into reads definitions.
      */
     private newtype SsaRefKind =
       SsaRead() or
@@ -592,8 +524,8 @@ module Ssa {
 
     /**
      * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-     * either a read (when `k` is `Read()`) or a non-trivial SSA definition
-     * (when `k` is `SsaDef()`).
+     * either a read (when `k` is `Read()`) or an SSA definition (when `k`
+     * is `SsaDef()`).
      */
     private predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
       exists(ReadKind rk | variableRead(bb, i, v, _, rk) |
@@ -601,7 +533,7 @@ module Ssa {
         k = SsaRead()
       )
       or
-      exists(TrackedDefinition def | definesAt(def, bb, i, v)) and
+      exists(Definition def | definesAt(def, bb, i, v)) and
       k = SsaDef()
     }
 
@@ -629,12 +561,10 @@ module Ssa {
     }
 
     /**
-     * Holds if the non-trivial SSA definition `def` reaches rank index `rankix`
-     * in its own basic block `bb`.
+     * Holds if the SSA definition `def` reaches rank index `rankix` in its own
+     * basic block `bb`.
      */
-    private predicate ssaDefReachesRank(
-      BasicBlock bb, TrackedDefinition def, int rankix, TrackedVar v
-    ) {
+    private predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rankix, SourceVariable v) {
       exists(int i |
         rankix = ssaRefRank(bb, i, v, SsaDef()) and
         definesAt(def, bb, i, v)
@@ -645,12 +575,12 @@ module Ssa {
     }
 
     /**
-     * Holds if the non-trivial SSA definition of `v` at `def` reaches `read` in the
+     * Holds if the SSA definition of `v` at `def` reaches `read` in the
      * same basic block without crossing another SSA definition of `v`.
      * The read at `node` is of kind `rk`.
      */
     private predicate ssaDefReachesReadWithinBlock(
-      TrackedVar v, TrackedDefinition def, ControlFlow::Node read, ReadKind rk
+      SourceVariable v, Definition def, ControlFlow::Node read, ReadKind rk
     ) {
       exists(BasicBlock bb, int rankix, int i |
         ssaDefReachesRank(bb, def, rankix, v) and
@@ -660,12 +590,11 @@ module Ssa {
     }
 
     /**
-     * Holds if the non-trivial SSA definition of `v` at `def` reaches uncertain SSA
-     * definition `redef` in the same basic block, without crossing another SSA
-     * definition of `v`.
+     * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
+     * `redef` in the same basic block, without crossing another SSA definition of `v`.
      */
     private predicate ssaDefReachesUncertainDefWithinBlock(
-      TrackedVar v, TrackedDefinition def, UncertainDefinition redef
+      SourceVariable v, Definition def, UncertainDefinition redef
     ) {
       exists(BasicBlock bb, int rankix, int i |
         ssaDefReachesRank(bb, def, rankix, v) and
@@ -678,7 +607,7 @@ module Ssa {
      * Same as `ssaRefRank()`, but restricted to actual reads of `def`, or
      * `def` itself.
      */
-    private int ssaDefRank(TrackedDefinition def, TrackedVar v, BasicBlock bb, int i) {
+    private int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i) {
       v = def.getSourceVariable() and
       result = ssaRefRank(bb, i, v, _) and
       (
@@ -688,12 +617,12 @@ module Ssa {
       )
     }
 
-    private int maxSsaDefRefRank(BasicBlock bb, TrackedVar v) {
+    private int maxSsaDefRefRank(BasicBlock bb, SourceVariable v) {
       result = ssaDefRank(_, v, bb, _) and
       not result + 1 = ssaDefRank(_, v, bb, _)
     }
 
-    private predicate varOccursInBlock(TrackedDefinition def, BasicBlock bb, TrackedVar v) {
+    private predicate varOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
       exists(ssaDefRank(def, v, bb, _))
     }
 
@@ -710,7 +639,7 @@ module Ssa {
      * and the underlying variable for `def` is neither read nor written in any block
      * on the path between `bb1` and `bb2`.
      */
-    private predicate varBlockReaches(TrackedDefinition def, BasicBlock bb1, BasicBlock bb2) {
+    private predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
       varOccursInBlock(def, bb1, _) and
       bb2 = bb1.getASuccessor()
       or
@@ -724,9 +653,7 @@ module Ssa {
      * `def` is read at `cfn`, `cfn` is in a transitive successor block of `bb1`,
      * and `def` is not read in any block on the path between `bb1` and `cfn`.
      */
-    private predicate varBlockReachesRead(
-      TrackedDefinition def, BasicBlock bb1, ControlFlow::Node cfn
-    ) {
+    private predicate varBlockReachesRead(Definition def, BasicBlock bb1, ControlFlow::Node cfn) {
       exists(BasicBlock bb2, int i2 |
         varBlockReaches(def, bb1, bb2) and
         ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1 and
@@ -739,9 +666,7 @@ module Ssa {
      * or a write), `def` is read at `cfn`, and there is a path between them without
      * any read of `def`.
      */
-    private predicate adjacentVarRead(
-      TrackedDefinition def, BasicBlock bb1, int i1, ControlFlow::Node cfn
-    ) {
+    private predicate adjacentVarRead(Definition def, BasicBlock bb1, int i1, ControlFlow::Node cfn) {
       exists(int rankix, int i2 |
         rankix = ssaDefRank(def, _, bb1, i1) and
         rankix + 1 = ssaDefRank(def, _, bb1, i2) and
@@ -755,14 +680,13 @@ module Ssa {
     cached
     private module Cached {
       /**
-       * Holds if `cfn` is a last read of the non-trivial SSA definition `def`.
-       * That is, `cfn` can reach the end of the enclosing callable, or another
-       * SSA definition for the underlying source variable, without passing through
-       * another read.
+       * Holds if `cfn` is a last read of the SSA definition `def`. That is, `cfn`
+       * can reach the end of the enclosing callable, or another SSA definition for
+       * the underlying source variable, without passing through another read.
        */
       cached
-      predicate lastRead(TrackedDefinition def, ControlFlow::Node cfn) {
-        exists(BasicBlock bb1, int i1, int rnk, TrackedVar v |
+      predicate lastRead(Definition def, ControlFlow::Node cfn) {
+        exists(BasicBlock bb1, int i1, int rnk, SourceVariable v |
           variableRead(bb1, i1, v, cfn, _) and
           rnk = ssaDefRank(def, v, bb1, i1)
         |
@@ -788,9 +712,7 @@ module Ssa {
       }
 
       pragma[noinline]
-      private predicate ssaDefReachesEndOfBlockRec(
-        BasicBlock bb, TrackedDefinition def, TrackedVar v
-      ) {
+      private predicate ssaDefReachesEndOfBlockRec(BasicBlock bb, Definition def, SourceVariable v) {
         exists(BasicBlock idom | ssaDefReachesEndOfBlock(idom, def, v) |
           // The construction of SSA form ensures that each read of a variable is
           // dominated by its definition. An SSA definition therefore reaches a
@@ -803,12 +725,12 @@ module Ssa {
       }
 
       /**
-       * Holds if the non-trivial SSA definition of `v` at `def` reaches the end of a
-       * basic block `bb`, at which point it is still live, without crossing another
+       * Holds if the SSA definition of `v` at `def` reaches the end of a basic
+       * block `bb`, at which point it is still live, without crossing another
        * SSA definition of `v`.
        */
       cached
-      predicate ssaDefReachesEndOfBlock(BasicBlock bb, TrackedDefinition def, TrackedVar v) {
+      predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
         exists(int last | last = maxSsaRefRank(bb, v) |
           ssaDefReachesRank(bb, def, last, v) and
           liveAtExit(bb, v, _)
@@ -820,13 +742,12 @@ module Ssa {
       }
 
       /**
-       * Holds if the non-trivial SSA definition of `v` at `def` reaches `read` without
-       * crossing another SSA definition of `v`.
-       * The read at `node` is of kind `rk`.
+       * Holds if the SSA definition of `v` at `def` reaches `read` without crossing
+       * another SSA definition of `v`. The read at `node` is of kind `rk`.
        */
       cached
       predicate ssaDefReachesRead(
-        TrackedVar v, TrackedDefinition def, ControlFlow::Node read, ReadKind rk
+        SourceVariable v, Definition def, ControlFlow::Node read, ReadKind rk
       ) {
         ssaDefReachesReadWithinBlock(v, def, read, rk)
         or
@@ -838,12 +759,12 @@ module Ssa {
       }
 
       /**
-       * Holds if the non-trivial SSA definition of `v` at `def` reaches uncertain SSA
-       * definition `redef` without crossing another SSA definition of `v`.
+       * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
+       * `redef` without crossing another SSA definition of `v`.
        */
       cached
       predicate ssaDefReachesUncertainDef(
-        TrackedVar v, TrackedDefinition def, UncertainDefinition redef
+        SourceVariable v, Definition def, UncertainDefinition redef
       ) {
         ssaDefReachesUncertainDefWithinBlock(v, def, redef)
         or
@@ -855,11 +776,11 @@ module Ssa {
       }
 
       /**
-       * Holds if the value defined at non-trivial SSA definition `def` can reach a
-       * read at `cfn`, without passing through any other read.
+       * Holds if the value defined at SSA definition `def` can reach a read at `cfn`,
+       * without passing through any other read.
        */
       cached
-      predicate firstReadSameVar(TrackedDefinition def, ControlFlow::Node cfn) {
+      predicate firstReadSameVar(Definition def, ControlFlow::Node cfn) {
         exists(BasicBlock bb1, int i1 |
           definesAt(def, bb1, i1, _) and
           adjacentVarRead(def, bb1, i1, cfn)
@@ -873,7 +794,7 @@ module Ssa {
        */
       cached
       predicate adjacentReadPairSameVar(
-        TrackedDefinition def, ControlFlow::Node cfn1, ControlFlow::Node cfn2
+        Definition def, ControlFlow::Node cfn1, ControlFlow::Node cfn2
       ) {
         exists(BasicBlock bb1, int i1 |
           variableRead(bb1, i1, _, cfn1, _) and
@@ -981,7 +902,7 @@ module Ssa {
       fpdef.getTarget() = fp and
       not init(fpdef) and
       fpdef.getEnclosingCallable() = c and
-      exists(TrackedFieldOrProp tf | tf.getAssignable() = fp)
+      exists(FieldOrPropSourceVariable tf | tf.getAssignable() = fp)
     }
 
     /**
@@ -1173,7 +1094,7 @@ module Ssa {
      * an update somewhere, and `fp` is likely to be live in `bb` at index
      * `i`.
      */
-    private predicate updateCandidate(BasicBlock bb, int i, TrackedFieldOrProp fp, Call call) {
+    private predicate updateCandidate(BasicBlock bb, int i, FieldOrPropSourceVariable fp, Call call) {
       possiblyLiveAtAllNodes(bb, fp) and
       callAt(bb, i, call) and
       relevantDefinition(_, fp.getAssignable(), _) and
@@ -1181,11 +1102,11 @@ module Ssa {
     }
 
     private predicate source(
-      Call call, TrackedFieldOrProp tfp, FieldOrProp fp, Callable c, boolean fresh
+      Call call, FieldOrPropSourceVariable fps, FieldOrProp fp, Callable c, boolean fresh
     ) {
-      updateCandidate(_, _, tfp, call) and
+      updateCandidate(_, _, fps, call) and
       c = getARuntimeTarget(call, _) and
-      fp = tfp.getAssignable() and
+      fp = fps.getAssignable() and
       if c instanceof Constructor then fresh = true else fresh = false
     }
 
@@ -1259,13 +1180,13 @@ module Ssa {
     }
 
     private predicate updatesNamedFieldOrPropPossiblyLive(
-      BasicBlock bb, int i, TrackedFieldOrProp fp, Call call, Callable setter
+      BasicBlock bb, int i, FieldOrPropSourceVariable fp, Call call, Callable setter
     ) {
       updateCandidate(bb, i, fp, call) and
       updatesNamedFieldOrProp_(fp, call, setter)
     }
 
-    private int firstRefAfterCall(BasicBlock bb, int i, TrackedFieldOrProp fp) {
+    private int firstRefAfterCall(BasicBlock bb, int i, FieldOrPropSourceVariable fp) {
       updatesNamedFieldOrPropPossiblyLive(bb, i, fp, _, _) and
       result = min(int k | k > i and ref(bb, k, fp, _))
     }
@@ -1275,7 +1196,7 @@ module Ssa {
      * update occurs in `setter`.
      */
     cached
-    predicate updatesNamedFieldOrProp(Call c, TrackedFieldOrProp fp, Callable setter) {
+    predicate updatesNamedFieldOrProp(Call c, FieldOrPropSourceVariable fp, Callable setter) {
       forceCachingInSameStage() and
       exists(BasicBlock bb, int i | updatesNamedFieldOrPropPossiblyLive(bb, i, fp, c, setter) |
         not exists(firstRefAfterCall(bb, i, fp)) and
@@ -1784,16 +1705,14 @@ module Ssa {
      *      properties, or captured variables).
      *   4. Implicit indirect definitions of variables through qualifier definitions
      *      (fields or properties).
-     *   5. Implicit definitions of variables prior to all reads, for variables that
-     *      are not amenable to SSA analysis (`UntrackedVar`).
-     *   6. Phi nodes.
+     *   5. Phi nodes.
      *
      * SSA definitions are only introduced where necessary. That is, dead assignments
      * have no associated SSA definitions.
      */
     cached
     newtype TDefinition =
-      TSsaExplicitDef(TrackedVar v, AssignableDefinition def, BasicBlock bb, int i) {
+      TSsaExplicitDef(SourceVariable v, AssignableDefinition def, BasicBlock bb, int i) {
         variableDefinition(bb, i, v, def) and
         (
           exists(ReadKind rk | liveAfterWrite(bb, i, v, rk) |
@@ -1814,7 +1733,7 @@ module Ssa {
           liveAfterWriteCaptured(bb, i, v)
         )
       } or
-      TSsaImplicitEntryDef(TrackedVar v, ControlFlow::BasicBlocks::EntryBlock ebb) {
+      TSsaImplicitEntryDef(SourceVariable v, ControlFlow::BasicBlocks::EntryBlock ebb) {
         liveAtEntry(ebb, v, _) and
         exists(Callable c |
           c = ebb.getCallable() and
@@ -1828,10 +1747,10 @@ module Ssa {
           )
           or
           // Each tracked field and property has an implicit entry definition
-          v instanceof TrackedFieldOrProp
+          v instanceof FieldOrPropSourceVariable
         )
       } or
-      TSsaImplicitCallDef(TrackedVar v, Call c, BasicBlock bb, int i) {
+      TSsaImplicitCallDef(SourceVariable v, Call c, BasicBlock bb, int i) {
         bb.getNode(i) = c.getAControlFlowNode() and
         (
           // Liveness of `v` after `c` is guaranteed by `updatesNamedFieldOrProp`
@@ -1841,7 +1760,7 @@ module Ssa {
           updatesCapturedVariable(c, v, _, _)
         )
       } or
-      TSsaImplicitQualifierDef(TrackedVar v, Definition qdef) {
+      TSsaImplicitQualifierDef(SourceVariable v, Definition qdef) {
         exists(BasicBlock bb, int i |
           qdef.getSourceVariable() = v.getQualifier() and
           qdef.definesAt(bb, i) and
@@ -1854,17 +1773,13 @@ module Ssa {
           not exists(TSsaImplicitCallDef(v, _, bb, i))
         )
       } or
-      TSsaImplicitUntrackedDef(UntrackedVar v, BasicBlock bb, int i) {
-        // Insert a definition prior to every read for untracked variables
-        bb.getNode(i + 1) = v.getAnAccess().(AssignableRead).getAControlFlowNode()
-      } or
-      TPhiNode(TrackedVar v, ControlFlow::BasicBlocks::JoinBlock bb) {
+      TPhiNode(SourceVariable v, ControlFlow::BasicBlocks::JoinBlock bb) {
         phiNodeMaybeLive(bb, v) and
         liveAtEntry(bb, v, _)
       }
 
     pragma[noinline]
-    private predicate phiNodeMaybeLive(ControlFlow::BasicBlocks::JoinBlock bb, TrackedVar v) {
+    private predicate phiNodeMaybeLive(ControlFlow::BasicBlocks::JoinBlock bb, SourceVariable v) {
       exists(Definition def, BasicBlock bb1 | definesAt(def, bb1, _, v) |
         bb1.inDominanceFrontier(bb)
       )
@@ -1886,8 +1801,6 @@ module Ssa {
       or
       exists(Definition qdef | def = TSsaImplicitQualifierDef(v, qdef) | definesAt(qdef, bb, i, _))
       or
-      def = TSsaImplicitUntrackedDef(v, bb, i)
-      or
       def = TPhiNode(v, bb) and i = -1
     }
 
@@ -2256,10 +2169,10 @@ module Ssa {
    * An SSA definition that corresponds to an explicit assignable definition.
    */
   class ExplicitDefinition extends Definition, TSsaExplicitDef {
-    TrackedVar tv;
+    SourceVariable sv;
     AssignableDefinition ad;
 
-    ExplicitDefinition() { this = TSsaExplicitDef(tv, ad, _, _) }
+    ExplicitDefinition() { this = TSsaExplicitDef(sv, ad, _, _) }
 
     /**
      * Gets an underlying assignable definition. The result is always unique,
@@ -2337,16 +2250,14 @@ module Ssa {
    * An SSA definition that does not correspond to an explicit variable definition.
    * Either an implicit initialization of a variable at the beginning of a callable
    * (`ImplicitEntryDefinition`), an implicit definition via a call
-   * (`ImplicitCallDefinition`), an implicit definition where the qualifier is
-   * updated (`ImplicitQualifierDefinition`), or a definition for a field or
-   * property that is not amenable to SSA analysis (`ImplicitUntrackedDefinition`).
+   * (`ImplicitCallDefinition`), or an implicit definition where the qualifier is
+   * updated (`ImplicitQualifierDefinition`).
    */
   class ImplicitDefinition extends Definition {
     ImplicitDefinition() {
       this = TSsaImplicitEntryDef(_, _) or
       this = TSsaImplicitCallDef(_, _, _, _) or
-      this = TSsaImplicitQualifierDef(_, _) or
-      this = TSsaImplicitUntrackedDef(_, _, _)
+      this = TSsaImplicitQualifierDef(_, _)
     }
   }
 
@@ -2420,25 +2331,6 @@ module Ssa {
     override Location getLocation() { result = getQualifierDefinition().getLocation() }
   }
 
-  /**
-   * An SSA definition for a variable that is not amenable to SSA analysis. A definition
-   * is inserted prior to every read.
-   */
-  class ImplicitUntrackedDefinition extends ImplicitDefinition, TSsaImplicitUntrackedDef {
-    override AssignableRead getARead() {
-      exists(BasicBlock bb, int i, UntrackedVar v |
-        this = TSsaImplicitUntrackedDef(v, bb, i) and
-        result.getAControlFlowNode() = bb.getNode(i + 1)
-      )
-    }
-
-    override string toString() {
-      result = getToStringPrefix(this) + "SSA untracked def(" + getSourceVariable() + ")"
-    }
-
-    override Location getLocation() { result = this.getARead().getLocation() }
-  }
-
   /**
    * An SSA definition that has no actual semantics, but simply serves to
    * merge or filter data flow.
@@ -2483,7 +2375,7 @@ module Ssa {
      *   call definition on line 9 as inputs.
      */
     override Definition getAnInput() {
-      exists(BasicBlock bb, BasicBlock phiPred, TrackedVar v |
+      exists(BasicBlock bb, BasicBlock phiPred, SourceVariable v |
         definesAt(this, bb, _, v) and
         bb.getAPredecessor() = phiPred and
         ssaDefReachesEndOfBlock(phiPred, result, v)
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 2974bc6af6a..001e071c651 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -1691,8 +1691,6 @@ private class FieldOrPropertyRead extends FieldOrPropertyAccess, AssignableRead
    * SSA updates.
    */
   predicate hasNonlocalValue() {
-    this = any(Ssa::ImplicitUntrackedDefinition udef).getARead()
-    or
     exists(Ssa::Definition def, Ssa::ImplicitDefinition idef |
       def.getARead() = this and
       idef = def.getAnUltimateDefinition()
diff --git a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
index acce87f5c60..fc00d4e05e9 100644
--- a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
+++ b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
@@ -4,6 +4,7 @@
 | CSharp7.cs:10:9:10:9 | this access | CSharp7.cs:11:9:11:9 | this access |
 | CSharp7.cs:16:9:16:13 | [post] this access | CSharp7.cs:25:39:25:43 | this access |
 | CSharp7.cs:16:9:16:13 | this access | CSharp7.cs:25:39:25:43 | this access |
+| CSharp7.cs:17:9:17:11 | SSA entry def(this.field) | CSharp7.cs:17:18:17:22 | access to field field |
 | CSharp7.cs:17:9:17:11 | this | CSharp7.cs:17:18:17:22 | this access |
 | CSharp7.cs:21:9:21:11 | this | CSharp7.cs:21:16:21:20 | this access |
 | CSharp7.cs:22:9:22:11 | this | CSharp7.cs:22:16:22:20 | this access |
@@ -67,6 +68,7 @@
 | CSharp7.cs:84:23:84:23 | 2 | CSharp7.cs:84:16:84:24 | (..., ...) |
 | CSharp7.cs:87:10:87:18 | this | CSharp7.cs:92:18:92:28 | this access |
 | CSharp7.cs:89:13:89:34 | SSA def(t1) | CSharp7.cs:90:28:90:29 | access to local variable t1 |
+| CSharp7.cs:89:13:89:34 | SSA qualifier def(t1.Item1) | CSharp7.cs:92:20:92:27 | access to field Item1 |
 | CSharp7.cs:89:18:89:34 | (..., ...) | CSharp7.cs:89:13:89:34 | SSA def(t1) |
 | CSharp7.cs:89:19:89:27 | "tainted" | CSharp7.cs:89:18:89:34 | (..., ...) |
 | CSharp7.cs:89:30:89:33 | "X2" | CSharp7.cs:89:18:89:34 | (..., ...) |
@@ -100,6 +102,7 @@
 | CSharp7.cs:112:31:112:32 | access to local variable m2 | CSharp7.cs:112:26:112:33 | (..., ...) |
 | CSharp7.cs:114:9:114:67 | SSA def(m9) | CSharp7.cs:115:19:115:20 | access to local variable m9 |
 | CSharp7.cs:114:38:114:67 | SSA def(m2) | CSharp7.cs:118:9:118:10 | access to local variable m2 |
+| CSharp7.cs:114:38:114:67 | SSA qualifier def(m2.Item1) | CSharp7.cs:119:19:119:26 | access to field Item1 |
 | CSharp7.cs:114:49:114:67 | (..., ...) | CSharp7.cs:114:38:114:67 | ... = ... |
 | CSharp7.cs:114:50:114:58 | "DefUse2" | CSharp7.cs:114:49:114:67 | (..., ...) |
 | CSharp7.cs:114:61:114:66 | (..., ...) | CSharp7.cs:114:38:114:67 | SSA def(m2) |
diff --git a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
index e54670f07fc..babc7501a22 100644
--- a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
@@ -325,6 +325,8 @@
 | LocalDataFlow.cs:243:9:243:17 | access to local variable nonSink10 | LocalDataFlow.cs:244:15:244:23 | access to local variable nonSink10 |
 | LocalDataFlow.cs:247:13:247:52 | SSA def(taintedDataContract) | LocalDataFlow.cs:248:22:248:40 | access to local variable taintedDataContract |
 | LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AList) | LocalDataFlow.cs:250:22:250:46 | access to property AList |
+| LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AString) | LocalDataFlow.cs:248:22:248:48 | access to property AString |
+| LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AnInt) | LocalDataFlow.cs:257:20:257:44 | access to property AnInt |
 | LocalDataFlow.cs:247:35:247:52 | object creation of type DataContract | LocalDataFlow.cs:247:13:247:52 | SSA def(taintedDataContract) |
 | LocalDataFlow.cs:248:13:248:48 | SSA def(sink53) | LocalDataFlow.cs:249:15:249:20 | access to local variable sink53 |
 | LocalDataFlow.cs:248:22:248:40 | [post] access to local variable taintedDataContract | LocalDataFlow.cs:250:22:250:40 | access to local variable taintedDataContract |
@@ -337,6 +339,7 @@
 | LocalDataFlow.cs:250:22:250:46 | access to property AList | LocalDataFlow.cs:259:20:259:44 | access to property AList |
 | LocalDataFlow.cs:250:22:250:57 | access to property AString | LocalDataFlow.cs:250:13:250:57 | SSA def(sink54) |
 | LocalDataFlow.cs:254:13:254:55 | SSA def(nonTaintedDataContract) | LocalDataFlow.cs:255:20:255:41 | access to local variable nonTaintedDataContract |
+| LocalDataFlow.cs:254:13:254:55 | SSA qualifier def(nonTaintedDataContract.AString) | LocalDataFlow.cs:255:20:255:49 | access to property AString |
 | LocalDataFlow.cs:254:38:254:55 | object creation of type DataContract | LocalDataFlow.cs:254:13:254:55 | SSA def(nonTaintedDataContract) |
 | LocalDataFlow.cs:255:9:255:49 | SSA def(nonSink0) | LocalDataFlow.cs:256:15:256:22 | access to local variable nonSink0 |
 | LocalDataFlow.cs:255:20:255:49 | access to property AString | LocalDataFlow.cs:255:9:255:49 | SSA def(nonSink0) |
@@ -347,10 +350,12 @@
 | LocalDataFlow.cs:259:9:259:53 | SSA def(nonSink2) | LocalDataFlow.cs:260:15:260:22 | access to local variable nonSink2 |
 | LocalDataFlow.cs:259:20:259:53 | access to property AnInt | LocalDataFlow.cs:259:9:259:53 | SSA def(nonSink2) |
 | LocalDataFlow.cs:263:17:263:37 | SSA def(taintedTextBox) | LocalDataFlow.cs:264:22:264:35 | access to local variable taintedTextBox |
+| LocalDataFlow.cs:263:17:263:37 | SSA qualifier def(taintedTextBox.Text) | LocalDataFlow.cs:264:22:264:40 | access to property Text |
 | LocalDataFlow.cs:263:34:263:37 | null | LocalDataFlow.cs:263:17:263:37 | SSA def(taintedTextBox) |
 | LocalDataFlow.cs:264:13:264:40 | SSA def(sink60) | LocalDataFlow.cs:265:15:265:20 | access to local variable sink60 |
 | LocalDataFlow.cs:264:22:264:40 | access to property Text | LocalDataFlow.cs:264:13:264:40 | SSA def(sink60) |
 | LocalDataFlow.cs:268:17:268:40 | SSA def(nonTaintedTextBox) | LocalDataFlow.cs:269:20:269:36 | access to local variable nonTaintedTextBox |
+| LocalDataFlow.cs:268:17:268:40 | SSA qualifier def(nonTaintedTextBox.Text) | LocalDataFlow.cs:269:20:269:41 | access to property Text |
 | LocalDataFlow.cs:268:37:268:40 | null | LocalDataFlow.cs:268:17:268:40 | SSA def(nonTaintedTextBox) |
 | LocalDataFlow.cs:269:9:269:41 | SSA def(nonSink0) | LocalDataFlow.cs:270:15:270:22 | access to local variable nonSink0 |
 | LocalDataFlow.cs:269:20:269:41 | access to property Text | LocalDataFlow.cs:269:9:269:41 | SSA def(nonSink0) |
@@ -396,6 +401,7 @@
 | LocalDataFlow.cs:314:22:314:26 | access to local variable sink0 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... |
 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... | LocalDataFlow.cs:314:13:314:38 | SSA def(sink74) |
 | LocalDataFlow.cs:314:31:314:38 | access to local variable nonSink0 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... |
+| LocalDataFlow.cs:334:28:334:30 | SSA entry def(this.anInt) | LocalDataFlow.cs:334:41:334:45 | access to field anInt |
 | LocalDataFlow.cs:334:28:334:30 | this | LocalDataFlow.cs:334:41:334:45 | this access |
 | LocalDataFlow.cs:334:50:334:52 | this | LocalDataFlow.cs:334:56:334:60 | this access |
 | LocalDataFlow.cs:334:50:334:52 | value | LocalDataFlow.cs:334:64:334:68 | access to parameter value |
diff --git a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
index e33df037f81..2435c1a30f7 100644
--- a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
@@ -421,6 +421,8 @@
 | LocalDataFlow.cs:243:30:243:37 | access to local variable nonSink0 | LocalDataFlow.cs:243:9:243:38 | call to method AppendLine |
 | LocalDataFlow.cs:247:13:247:52 | SSA def(taintedDataContract) | LocalDataFlow.cs:248:22:248:40 | access to local variable taintedDataContract |
 | LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AList) | LocalDataFlow.cs:250:22:250:46 | access to property AList |
+| LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AString) | LocalDataFlow.cs:248:22:248:48 | access to property AString |
+| LocalDataFlow.cs:247:13:247:52 | SSA qualifier def(taintedDataContract.AnInt) | LocalDataFlow.cs:257:20:257:44 | access to property AnInt |
 | LocalDataFlow.cs:247:35:247:52 | object creation of type DataContract | LocalDataFlow.cs:247:13:247:52 | SSA def(taintedDataContract) |
 | LocalDataFlow.cs:248:13:248:48 | SSA def(sink53) | LocalDataFlow.cs:249:15:249:20 | access to local variable sink53 |
 | LocalDataFlow.cs:248:22:248:40 | [post] access to local variable taintedDataContract | LocalDataFlow.cs:250:22:250:40 | access to local variable taintedDataContract |
@@ -437,6 +439,7 @@
 | LocalDataFlow.cs:250:22:250:49 | access to indexer | LocalDataFlow.cs:250:22:250:57 | access to property AString |
 | LocalDataFlow.cs:250:22:250:57 | access to property AString | LocalDataFlow.cs:250:13:250:57 | SSA def(sink54) |
 | LocalDataFlow.cs:254:13:254:55 | SSA def(nonTaintedDataContract) | LocalDataFlow.cs:255:20:255:41 | access to local variable nonTaintedDataContract |
+| LocalDataFlow.cs:254:13:254:55 | SSA qualifier def(nonTaintedDataContract.AString) | LocalDataFlow.cs:255:20:255:49 | access to property AString |
 | LocalDataFlow.cs:254:38:254:55 | object creation of type DataContract | LocalDataFlow.cs:254:13:254:55 | SSA def(nonTaintedDataContract) |
 | LocalDataFlow.cs:255:9:255:49 | SSA def(nonSink0) | LocalDataFlow.cs:256:15:256:22 | access to local variable nonSink0 |
 | LocalDataFlow.cs:255:20:255:41 | access to local variable nonTaintedDataContract | LocalDataFlow.cs:255:20:255:49 | access to property AString |
@@ -450,11 +453,13 @@
 | LocalDataFlow.cs:259:20:259:44 | access to property AList | LocalDataFlow.cs:259:20:259:47 | access to indexer |
 | LocalDataFlow.cs:259:20:259:53 | access to property AnInt | LocalDataFlow.cs:259:9:259:53 | SSA def(nonSink2) |
 | LocalDataFlow.cs:263:17:263:37 | SSA def(taintedTextBox) | LocalDataFlow.cs:264:22:264:35 | access to local variable taintedTextBox |
+| LocalDataFlow.cs:263:17:263:37 | SSA qualifier def(taintedTextBox.Text) | LocalDataFlow.cs:264:22:264:40 | access to property Text |
 | LocalDataFlow.cs:263:34:263:37 | null | LocalDataFlow.cs:263:17:263:37 | SSA def(taintedTextBox) |
 | LocalDataFlow.cs:264:13:264:40 | SSA def(sink60) | LocalDataFlow.cs:265:15:265:20 | access to local variable sink60 |
 | LocalDataFlow.cs:264:22:264:35 | access to local variable taintedTextBox | LocalDataFlow.cs:264:22:264:40 | access to property Text |
 | LocalDataFlow.cs:264:22:264:40 | access to property Text | LocalDataFlow.cs:264:13:264:40 | SSA def(sink60) |
 | LocalDataFlow.cs:268:17:268:40 | SSA def(nonTaintedTextBox) | LocalDataFlow.cs:269:20:269:36 | access to local variable nonTaintedTextBox |
+| LocalDataFlow.cs:268:17:268:40 | SSA qualifier def(nonTaintedTextBox.Text) | LocalDataFlow.cs:269:20:269:41 | access to property Text |
 | LocalDataFlow.cs:268:37:268:40 | null | LocalDataFlow.cs:268:17:268:40 | SSA def(nonTaintedTextBox) |
 | LocalDataFlow.cs:269:9:269:41 | SSA def(nonSink0) | LocalDataFlow.cs:270:15:270:22 | access to local variable nonSink0 |
 | LocalDataFlow.cs:269:20:269:36 | access to local variable nonTaintedTextBox | LocalDataFlow.cs:269:20:269:41 | access to property Text |
@@ -505,6 +510,7 @@
 | LocalDataFlow.cs:314:22:314:26 | access to local variable sink0 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... |
 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... | LocalDataFlow.cs:314:13:314:38 | SSA def(sink74) |
 | LocalDataFlow.cs:314:31:314:38 | access to local variable nonSink0 | LocalDataFlow.cs:314:22:314:38 | ... ?? ... |
+| LocalDataFlow.cs:334:28:334:30 | SSA entry def(this.anInt) | LocalDataFlow.cs:334:41:334:45 | access to field anInt |
 | LocalDataFlow.cs:334:28:334:30 | this | LocalDataFlow.cs:334:41:334:45 | this access |
 | LocalDataFlow.cs:334:50:334:52 | this | LocalDataFlow.cs:334:56:334:60 | this access |
 | LocalDataFlow.cs:334:50:334:52 | value | LocalDataFlow.cs:334:64:334:68 | access to parameter value |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
index bc2b8dd23d9..8d5a2db71ab 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
@@ -193,11 +193,9 @@
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:49:17:49:28 | SSA call def(Fields.stat) |
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:50:9:50:17 | SSA phi(Fields.stat) |
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:51:9:51:20 | SSA call def(Fields.stat) |
-| Fields.cs:63:16:63:28 | this.VolatileField | Fields.cs:63:16:63:28 | SSA untracked def(this.VolatileField) |
-| Fields.cs:63:16:63:28 | this.VolatileField | Fields.cs:69:21:69:33 | SSA untracked def(this.VolatileField) |
 | Fields.cs:65:24:65:32 | this.LoopField | Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) |
-| Fields.cs:71:17:71:35 | this.SingleAccessedField | Fields.cs:71:17:71:35 | SSA untracked def(this.SingleAccessedField) |
-| Fields.cs:76:20:76:38 | this.SingleAccessedField | Fields.cs:76:20:76:38 | SSA untracked def(this.SingleAccessedField) |
+| Fields.cs:71:17:71:35 | this.SingleAccessedField | Fields.cs:61:17:61:17 | SSA entry def(this.SingleAccessedField) |
+| Fields.cs:76:20:76:38 | this.SingleAccessedField | Fields.cs:74:17:74:17 | SSA entry def(this.SingleAccessedField) |
 | Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | SSA def(f) |
 | Fields.cs:77:13:77:13 | f | Fields.cs:78:27:78:54 | SSA capture def(f) |
 | Fields.cs:78:23:78:23 | a | Fields.cs:78:23:78:54 | SSA def(a) |
@@ -283,8 +281,8 @@
 | Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:16 | SSA phi(i) |
 | Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:18 | SSA def(i) |
 | Properties.cs:65:24:65:31 | this.LoopProp | Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) |
-| Properties.cs:67:21:67:38 | this.SingleAccessedProp | Properties.cs:67:21:67:38 | SSA untracked def(this.SingleAccessedProp) |
-| Properties.cs:72:20:72:37 | this.SingleAccessedProp | Properties.cs:72:20:72:37 | SSA untracked def(this.SingleAccessedProp) |
+| Properties.cs:67:21:67:38 | this.SingleAccessedProp | Properties.cs:61:17:61:17 | SSA entry def(this.SingleAccessedProp) |
+| Properties.cs:72:20:72:37 | this.SingleAccessedProp | Properties.cs:70:17:70:17 | SSA entry def(this.SingleAccessedProp) |
 | Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | SSA def(f) |
 | Properties.cs:73:13:73:13 | f | Properties.cs:74:27:74:54 | SSA capture def(f) |
 | Properties.cs:74:23:74:23 | a | Properties.cs:74:23:74:54 | SSA def(a) |
@@ -298,11 +296,6 @@
 | Properties.cs:76:9:76:12 | f.xs | Properties.cs:84:9:84:25 | SSA def(f.xs) |
 | Properties.cs:78:9:78:15 | this.xs | Properties.cs:81:9:81:22 | SSA def(this.xs) |
 | Properties.cs:78:9:78:15 | this.xs | Properties.cs:83:9:83:22 | SSA def(this.xs) |
-| Properties.cs:94:9:94:27 | this.NonTrivialProp | Properties.cs:95:20:95:38 | SSA untracked def(this.NonTrivialProp) |
-| Properties.cs:97:9:97:24 | this.VirtualProp | Properties.cs:98:16:98:31 | SSA untracked def(this.VirtualProp) |
-| Properties.cs:100:9:100:26 | this.VolatileField | Properties.cs:100:9:100:26 | SSA untracked def(this.VolatileField) |
-| Properties.cs:100:9:100:26 | this.VolatileField | Properties.cs:101:21:101:38 | SSA untracked def(this.VolatileField) |
-| Properties.cs:100:9:100:29 | this.VolatileField.xs | Properties.cs:101:21:101:41 | SSA untracked def(this.VolatileField.xs) |
 | Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | SSA param(p) |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected
index bc176624df5..a5971b9070d 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected
@@ -183,10 +183,8 @@
 | Fields.cs:49:17:49:28 | SSA call def(Fields.stat) | Fields.cs:49:17:49:28 | object creation of type Fields |
 | Fields.cs:51:9:51:20 | SSA call def(Fields.stat) | Fields.cs:51:9:51:20 | object creation of type Fields |
 | Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) | Fields.cs:61:17:61:17 | H |
-| Fields.cs:63:16:63:28 | SSA untracked def(this.VolatileField) | Fields.cs:63:16:63:28 | this access |
-| Fields.cs:69:21:69:33 | SSA untracked def(this.VolatileField) | Fields.cs:69:21:69:33 | this access |
-| Fields.cs:71:17:71:35 | SSA untracked def(this.SingleAccessedField) | Fields.cs:71:17:71:35 | this access |
-| Fields.cs:76:20:76:38 | SSA untracked def(this.SingleAccessedField) | Fields.cs:76:20:76:38 | this access |
+| Fields.cs:61:17:61:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:61:17:61:17 | H |
+| Fields.cs:74:17:74:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:74:17:74:17 | I |
 | Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:77:13:77:45 | Fields f = ... |
 | Fields.cs:78:23:78:54 | SSA def(a) | Fields.cs:78:23:78:54 | Action a = ... |
 | Fields.cs:78:27:78:54 | SSA capture def(f) | Fields.cs:78:27:78:54 | (...) => ... |
@@ -264,10 +262,10 @@
 | Properties.cs:49:17:49:32 | SSA call def(Properties.stat) | Properties.cs:49:17:49:32 | object creation of type Properties |
 | Properties.cs:51:9:51:24 | SSA call def(Properties.stat) | Properties.cs:51:9:51:24 | object creation of type Properties |
 | Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) | Properties.cs:61:17:61:17 | H |
+| Properties.cs:61:17:61:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:61:17:61:17 | H |
 | Properties.cs:61:23:61:23 | SSA param(i) | Properties.cs:61:23:61:23 | i |
 | Properties.cs:63:16:63:18 | SSA def(i) | Properties.cs:63:16:63:18 | ...-- |
-| Properties.cs:67:21:67:38 | SSA untracked def(this.SingleAccessedProp) | Properties.cs:67:21:67:38 | this access |
-| Properties.cs:72:20:72:37 | SSA untracked def(this.SingleAccessedProp) | Properties.cs:72:20:72:37 | this access |
+| Properties.cs:70:17:70:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:70:17:70:17 | I |
 | Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:73:13:73:32 | Properties f = ... |
 | Properties.cs:74:23:74:54 | SSA def(a) | Properties.cs:74:23:74:54 | Action a = ... |
 | Properties.cs:74:27:74:54 | SSA capture def(f) | Properties.cs:74:27:74:54 | (...) => ... |
@@ -281,11 +279,6 @@
 | Properties.cs:83:9:83:22 | SSA def(this.xs) | Properties.cs:83:9:83:22 | ... = ... |
 | Properties.cs:84:9:84:25 | SSA def(f.xs) | Properties.cs:84:9:84:25 | ... = ... |
 | Properties.cs:85:24:85:46 | SSA capture def(b) | Properties.cs:85:24:85:46 | (...) => ... |
-| Properties.cs:95:20:95:38 | SSA untracked def(this.NonTrivialProp) | Properties.cs:95:20:95:23 | this access |
-| Properties.cs:98:16:98:31 | SSA untracked def(this.VirtualProp) | Properties.cs:98:16:98:19 | this access |
-| Properties.cs:100:9:100:26 | SSA untracked def(this.VolatileField) | Properties.cs:100:9:100:12 | this access |
-| Properties.cs:101:21:101:38 | SSA untracked def(this.VolatileField) | Properties.cs:101:21:101:24 | this access |
-| Properties.cs:101:21:101:41 | SSA untracked def(this.VolatileField.xs) | Properties.cs:101:21:101:38 | access to field VolatileField |
 | Properties.cs:106:37:106:37 | SSA param(p) | Properties.cs:106:37:106:37 | p |
 | Properties.cs:108:10:108:10 | SSA entry def(this.Props) | Properties.cs:108:10:108:10 | K |
 | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) | Properties.cs:108:10:108:10 | K |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
index d9534f06ff1..35ad76fe651 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
@@ -151,6 +151,8 @@
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:38:9:38:13 | SSA call def(Fields.stat) | Fields.cs:41:13:41:16 | access to field stat |
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:51:9:51:20 | SSA call def(Fields.stat) | Fields.cs:54:13:54:16 | access to field stat |
 | Fields.cs:65:24:65:32 | this.LoopField | Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) | Fields.cs:65:24:65:32 | access to field LoopField |
+| Fields.cs:71:17:71:35 | this.SingleAccessedField | Fields.cs:61:17:61:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:71:17:71:35 | access to field SingleAccessedField |
+| Fields.cs:76:20:76:38 | this.SingleAccessedField | Fields.cs:74:17:74:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:76:20:76:38 | access to field SingleAccessedField |
 | Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:90:19:90:19 | access to local variable f |
 | Fields.cs:77:13:77:13 | f | Fields.cs:78:27:78:54 | SSA capture def(f) | Fields.cs:78:35:78:35 | access to local variable f |
 | Fields.cs:78:23:78:23 | a | Fields.cs:78:23:78:54 | SSA def(a) | Fields.cs:81:9:81:9 | access to local variable a |
@@ -219,6 +221,8 @@
 | Properties.cs:33:19:33:22 | Properties.stat | Properties.cs:51:9:51:24 | SSA call def(Properties.stat) | Properties.cs:54:13:54:16 | access to property stat |
 | Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:16 | SSA phi(i) | Properties.cs:63:16:63:16 | access to parameter i |
 | Properties.cs:65:24:65:31 | this.LoopProp | Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) | Properties.cs:65:24:65:31 | access to property LoopProp |
+| Properties.cs:67:21:67:38 | this.SingleAccessedProp | Properties.cs:61:17:61:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:67:21:67:38 | access to property SingleAccessedProp |
+| Properties.cs:72:20:72:37 | this.SingleAccessedProp | Properties.cs:70:17:70:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:72:20:72:37 | access to property SingleAccessedProp |
 | Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:86:19:86:19 | access to local variable f |
 | Properties.cs:73:13:73:13 | f | Properties.cs:74:27:74:54 | SSA capture def(f) | Properties.cs:74:35:74:35 | access to local variable f |
 | Properties.cs:74:23:74:23 | a | Properties.cs:74:23:74:54 | SSA def(a) | Properties.cs:77:9:77:9 | access to local variable a |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected
index 13aad35a44a..d6a958b32d7 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaRead.expected
@@ -185,11 +185,9 @@
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:34:9:34:16 | SSA call def(Fields.stat) | Fields.cs:37:13:37:16 | access to field stat |
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:38:9:38:13 | SSA call def(Fields.stat) | Fields.cs:41:13:41:16 | access to field stat |
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:51:9:51:20 | SSA call def(Fields.stat) | Fields.cs:54:13:54:16 | access to field stat |
-| Fields.cs:63:16:63:28 | this.VolatileField | Fields.cs:63:16:63:28 | SSA untracked def(this.VolatileField) | Fields.cs:63:16:63:28 | access to field VolatileField |
-| Fields.cs:63:16:63:28 | this.VolatileField | Fields.cs:69:21:69:33 | SSA untracked def(this.VolatileField) | Fields.cs:69:21:69:33 | access to field VolatileField |
 | Fields.cs:65:24:65:32 | this.LoopField | Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) | Fields.cs:65:24:65:32 | access to field LoopField |
-| Fields.cs:71:17:71:35 | this.SingleAccessedField | Fields.cs:71:17:71:35 | SSA untracked def(this.SingleAccessedField) | Fields.cs:71:17:71:35 | access to field SingleAccessedField |
-| Fields.cs:76:20:76:38 | this.SingleAccessedField | Fields.cs:76:20:76:38 | SSA untracked def(this.SingleAccessedField) | Fields.cs:76:20:76:38 | access to field SingleAccessedField |
+| Fields.cs:71:17:71:35 | this.SingleAccessedField | Fields.cs:61:17:61:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:71:17:71:35 | access to field SingleAccessedField |
+| Fields.cs:76:20:76:38 | this.SingleAccessedField | Fields.cs:74:17:74:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:76:20:76:38 | access to field SingleAccessedField |
 | Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:80:9:80:9 | access to local variable f |
 | Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:82:19:82:19 | access to local variable f |
 | Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:83:9:83:9 | access to local variable f |
@@ -302,8 +300,8 @@
 | Properties.cs:33:19:33:22 | Properties.stat | Properties.cs:51:9:51:24 | SSA call def(Properties.stat) | Properties.cs:54:13:54:16 | access to property stat |
 | Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:16 | SSA phi(i) | Properties.cs:63:16:63:16 | access to parameter i |
 | Properties.cs:65:24:65:31 | this.LoopProp | Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) | Properties.cs:65:24:65:31 | access to property LoopProp |
-| Properties.cs:67:21:67:38 | this.SingleAccessedProp | Properties.cs:67:21:67:38 | SSA untracked def(this.SingleAccessedProp) | Properties.cs:67:21:67:38 | access to property SingleAccessedProp |
-| Properties.cs:72:20:72:37 | this.SingleAccessedProp | Properties.cs:72:20:72:37 | SSA untracked def(this.SingleAccessedProp) | Properties.cs:72:20:72:37 | access to property SingleAccessedProp |
+| Properties.cs:67:21:67:38 | this.SingleAccessedProp | Properties.cs:61:17:61:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:67:21:67:38 | access to property SingleAccessedProp |
+| Properties.cs:72:20:72:37 | this.SingleAccessedProp | Properties.cs:70:17:70:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:72:20:72:37 | access to property SingleAccessedProp |
 | Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:76:9:76:9 | access to local variable f |
 | Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:78:19:78:19 | access to local variable f |
 | Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:79:9:79:9 | access to local variable f |
@@ -322,11 +320,6 @@
 | Properties.cs:76:9:76:12 | f.xs | Properties.cs:84:9:84:25 | SSA def(f.xs) | Properties.cs:86:19:86:22 | access to property xs |
 | Properties.cs:78:9:78:15 | this.xs | Properties.cs:81:9:81:22 | SSA def(this.xs) | Properties.cs:82:9:82:15 | access to property xs |
 | Properties.cs:78:9:78:15 | this.xs | Properties.cs:83:9:83:22 | SSA def(this.xs) | Properties.cs:85:9:85:15 | access to property xs |
-| Properties.cs:94:9:94:27 | this.NonTrivialProp | Properties.cs:95:20:95:38 | SSA untracked def(this.NonTrivialProp) | Properties.cs:95:20:95:38 | access to property NonTrivialProp |
-| Properties.cs:97:9:97:24 | this.VirtualProp | Properties.cs:98:16:98:31 | SSA untracked def(this.VirtualProp) | Properties.cs:98:16:98:31 | access to property VirtualProp |
-| Properties.cs:100:9:100:26 | this.VolatileField | Properties.cs:100:9:100:26 | SSA untracked def(this.VolatileField) | Properties.cs:100:9:100:26 | access to field VolatileField |
-| Properties.cs:100:9:100:26 | this.VolatileField | Properties.cs:101:21:101:38 | SSA untracked def(this.VolatileField) | Properties.cs:101:21:101:38 | access to field VolatileField |
-| Properties.cs:100:9:100:29 | this.VolatileField.xs | Properties.cs:101:21:101:41 | SSA untracked def(this.VolatileField.xs) | Properties.cs:101:21:101:41 | access to property xs |
 | Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | SSA param(p) | Properties.cs:106:42:106:42 | access to parameter p |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:114:20:114:29 | access to field Props |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:115:21:115:30 | access to field Props |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
index f84d9f953a3..2d9f6d5e58d 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
@@ -247,11 +247,9 @@
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:51:9:51:20 | SSA call def(Fields.stat) | Fields.cs:38:9:38:13 | SSA call def(Fields.stat) |
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:51:9:51:20 | SSA call def(Fields.stat) | Fields.cs:49:17:49:28 | SSA call def(Fields.stat) |
 | Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:51:9:51:20 | SSA call def(Fields.stat) | Fields.cs:51:9:51:20 | SSA call def(Fields.stat) |
-| Fields.cs:63:16:63:28 | this.VolatileField | Fields.cs:63:16:63:28 | SSA untracked def(this.VolatileField) | Fields.cs:63:16:63:28 | SSA untracked def(this.VolatileField) |
-| Fields.cs:63:16:63:28 | this.VolatileField | Fields.cs:69:21:69:33 | SSA untracked def(this.VolatileField) | Fields.cs:69:21:69:33 | SSA untracked def(this.VolatileField) |
 | Fields.cs:65:24:65:32 | this.LoopField | Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) | Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) |
-| Fields.cs:71:17:71:35 | this.SingleAccessedField | Fields.cs:71:17:71:35 | SSA untracked def(this.SingleAccessedField) | Fields.cs:71:17:71:35 | SSA untracked def(this.SingleAccessedField) |
-| Fields.cs:76:20:76:38 | this.SingleAccessedField | Fields.cs:76:20:76:38 | SSA untracked def(this.SingleAccessedField) | Fields.cs:76:20:76:38 | SSA untracked def(this.SingleAccessedField) |
+| Fields.cs:71:17:71:35 | this.SingleAccessedField | Fields.cs:61:17:61:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:61:17:61:17 | SSA entry def(this.SingleAccessedField) |
+| Fields.cs:76:20:76:38 | this.SingleAccessedField | Fields.cs:74:17:74:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:74:17:74:17 | SSA entry def(this.SingleAccessedField) |
 | Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:77:13:77:45 | SSA def(f) |
 | Fields.cs:77:13:77:13 | f | Fields.cs:78:27:78:54 | SSA capture def(f) | Fields.cs:78:27:78:54 | SSA capture def(f) |
 | Fields.cs:78:23:78:23 | a | Fields.cs:78:23:78:54 | SSA def(a) | Fields.cs:78:23:78:54 | SSA def(a) |
@@ -377,8 +375,8 @@
 | Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:16 | SSA phi(i) | Properties.cs:63:16:63:18 | SSA def(i) |
 | Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:18 | SSA def(i) | Properties.cs:63:16:63:18 | SSA def(i) |
 | Properties.cs:65:24:65:31 | this.LoopProp | Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) | Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) |
-| Properties.cs:67:21:67:38 | this.SingleAccessedProp | Properties.cs:67:21:67:38 | SSA untracked def(this.SingleAccessedProp) | Properties.cs:67:21:67:38 | SSA untracked def(this.SingleAccessedProp) |
-| Properties.cs:72:20:72:37 | this.SingleAccessedProp | Properties.cs:72:20:72:37 | SSA untracked def(this.SingleAccessedProp) | Properties.cs:72:20:72:37 | SSA untracked def(this.SingleAccessedProp) |
+| Properties.cs:67:21:67:38 | this.SingleAccessedProp | Properties.cs:61:17:61:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:61:17:61:17 | SSA entry def(this.SingleAccessedProp) |
+| Properties.cs:72:20:72:37 | this.SingleAccessedProp | Properties.cs:70:17:70:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:70:17:70:17 | SSA entry def(this.SingleAccessedProp) |
 | Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:73:13:73:32 | SSA def(f) |
 | Properties.cs:73:13:73:13 | f | Properties.cs:74:27:74:54 | SSA capture def(f) | Properties.cs:74:27:74:54 | SSA capture def(f) |
 | Properties.cs:74:23:74:23 | a | Properties.cs:74:23:74:54 | SSA def(a) | Properties.cs:74:23:74:54 | SSA def(a) |
@@ -394,11 +392,6 @@
 | Properties.cs:76:9:76:12 | f.xs | Properties.cs:84:9:84:25 | SSA def(f.xs) | Properties.cs:84:9:84:25 | SSA def(f.xs) |
 | Properties.cs:78:9:78:15 | this.xs | Properties.cs:81:9:81:22 | SSA def(this.xs) | Properties.cs:81:9:81:22 | SSA def(this.xs) |
 | Properties.cs:78:9:78:15 | this.xs | Properties.cs:83:9:83:22 | SSA def(this.xs) | Properties.cs:83:9:83:22 | SSA def(this.xs) |
-| Properties.cs:94:9:94:27 | this.NonTrivialProp | Properties.cs:95:20:95:38 | SSA untracked def(this.NonTrivialProp) | Properties.cs:95:20:95:38 | SSA untracked def(this.NonTrivialProp) |
-| Properties.cs:97:9:97:24 | this.VirtualProp | Properties.cs:98:16:98:31 | SSA untracked def(this.VirtualProp) | Properties.cs:98:16:98:31 | SSA untracked def(this.VirtualProp) |
-| Properties.cs:100:9:100:26 | this.VolatileField | Properties.cs:100:9:100:26 | SSA untracked def(this.VolatileField) | Properties.cs:100:9:100:26 | SSA untracked def(this.VolatileField) |
-| Properties.cs:100:9:100:26 | this.VolatileField | Properties.cs:101:21:101:38 | SSA untracked def(this.VolatileField) | Properties.cs:101:21:101:38 | SSA untracked def(this.VolatileField) |
-| Properties.cs:100:9:100:29 | this.VolatileField.xs | Properties.cs:101:21:101:41 | SSA untracked def(this.VolatileField.xs) | Properties.cs:101:21:101:41 | SSA untracked def(this.VolatileField.xs) |
 | Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | SSA param(p) | Properties.cs:106:37:106:37 | SSA param(p) |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |

From 63f76b1b43e44c7ab33c51662062e5e5a313987d Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 21 Dec 2020 20:24:25 +0100
Subject: [PATCH 054/343] C#: Uniform treatment of all SSA definitions

---
 .../code/csharp/commons/ConsistencyChecks.qll |   2 +-
 .../code/csharp/controlflow/BasicBlocks.qll   |  12 +-
 .../csharp/controlflow/ControlFlowGraph.qll   |   2 +-
 .../src/semmle/code/csharp/dataflow/SSA.qll   | 811 +++++++++---------
 .../dataflow/defuse/useUseEquivalence.ql      |   2 +-
 .../library-tests/dataflow/ssa/Capture.cs     |   6 +-
 .../dataflow/ssa/PreSsaConsistency.ql         |   4 +-
 .../dataflow/ssa/SsaDef.expected              |  11 +-
 .../dataflow/ssa/SsaDefElement.expected       |   7 +-
 .../dataflow/ssa/SsaExplicitDef.expected      |   3 +
 .../ssa/SsaImplicitQualifier.expected         |   4 +
 .../dataflow/ssa/SsaUltimateDef.expected      |  19 +-
 .../DeadStoreOfLocal/DeadStoreOfLocal.cs      |   4 +-
 .../DeadStoreOfLocal.expected                 |   2 -
 14 files changed, 451 insertions(+), 438 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/commons/ConsistencyChecks.qll b/csharp/ql/src/semmle/code/csharp/commons/ConsistencyChecks.qll
index aabdc030274..a4405a5a309 100644
--- a/csharp/ql/src/semmle/code/csharp/commons/ConsistencyChecks.qll
+++ b/csharp/ql/src/semmle/code/csharp/commons/ConsistencyChecks.qll
@@ -49,7 +49,7 @@ module SsaChecks {
     exists(Definition def, BasicBlock bb, ControlFlow::Node rnode, ControlFlow::Node dnode, int i |
       def.getAReadAtNode(rnode) = read
     |
-      def.definesAt(bb, i) and
+      def.definesAt(_, bb, i) and
       dnode = bb.getNode(max(int j | j = i or j = 0)) and
       not dnode.dominates(rnode)
     ) and
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/BasicBlocks.qll b/csharp/ql/src/semmle/code/csharp/controlflow/BasicBlocks.qll
index 4e87ac445c8..8b20ccb3c22 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/BasicBlocks.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/BasicBlocks.qll
@@ -377,7 +377,17 @@ private predicate entryBB(BasicBlock bb) {
  * an annotated exit node.
  */
 class AnnotatedExitBasicBlock extends BasicBlock {
-  AnnotatedExitBasicBlock() { this.getANode() instanceof ControlFlow::Nodes::AnnotatedExitNode }
+  private boolean isNormal;
+
+  AnnotatedExitBasicBlock() {
+    this.getANode() =
+      any(ControlFlow::Nodes::AnnotatedExitNode n |
+        if n.isNormal() then isNormal = true else isNormal = false
+      )
+  }
+
+  /** Holds if this block represents a normal exit. */
+  predicate isNormal() { isNormal = true }
 }
 
 /**
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
index 9f4eda99838..061b7674810 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/ControlFlowGraph.qll
@@ -270,7 +270,7 @@ module ControlFlow {
       /** Gets the callable that this exit applies to. */
       Callable getCallable() { result = c }
 
-      /** Holds if this node represent a normal exit. */
+      /** Holds if this node represents a normal exit. */
       predicate isNormal() { normal = true }
 
       override BasicBlocks::AnnotatedExitBlock getBasicBlock() {
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index 4b99882e167..24166d298e3 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -78,9 +78,27 @@ module Ssa {
 
       cached
       AssignableDefinition getADefinition(ExplicitDefinition def) {
-        exists(SourceVariable sv, AssignableDefinition ad | def = TSsaExplicitDef(sv, ad, _, _) |
+        exists(SourceVariable v, AssignableDefinition ad | explicitDefinition(def, v, ad) |
           result = ad or
-          result = getASameOutRefDefAfter(sv, ad)
+          result = getASameOutRefDefAfter(v, ad)
+        )
+      }
+
+      cached
+      predicate implicitEntryDefinition(ControlFlow::BasicBlocks::EntryBlock bb, SourceVariable v) {
+        exists(Callable c |
+          c = bb.getCallable() and
+          c = v.getEnclosingCallable()
+        |
+          // Captured variable
+          exists(LocalScopeVariable lsv |
+            v = any(LocalScopeSourceVariable lv | lsv = lv.getAssignable())
+          |
+            lsv.getCallable() != c
+          )
+          or
+          // Each tracked field and property has an implicit entry definition
+          v instanceof PlainFieldOrPropSourceVariable
         )
       }
     }
@@ -155,8 +173,10 @@ module Ssa {
     /**
      * Holds if the `i`th node of basic block `bb` is a (potential) write to source
      * variable `v`. The Boolean `certain` indicates whether the write is certain.
+     *
+     * This excludes implicit writes via calls.
      */
-    private predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    predicate variableWriteDirect(BasicBlock bb, int i, SourceVariable v, boolean certain) {
       exists(AssignableDefinition ad | variableDefinition(bb, i, v, ad) |
         if
           any(AssignableDefinition ad0 | ad0 = ad or ad0 = getASameOutRefDefAfter(v, ad))
@@ -165,13 +185,17 @@ module Ssa {
         else certain = false
       )
       or
-      variableWrite(bb, i, v.(QualifiedFieldOrPropSourceVariable).getQualifier(), certain)
+      variableWriteDirect(bb, i, v.(QualifiedFieldOrPropSourceVariable).getQualifier(), certain)
+      or
+      implicitEntryDefinition(bb, v) and
+      i = -1 and
+      certain = true
     }
 
     /**
      * A classification of variable reads.
      */
-    newtype ReadKind =
+    newtype TReadKind =
       /** An actual read. */
       ActualRead() or
       /**
@@ -192,6 +216,10 @@ module Ssa {
        * as a write to a `ref` or `out` variable (see above).
        */
       CapturedVarExitRead() or
+      /**
+       * A pseudo read for a captured variable via a call.
+       */
+      CapturedVarCallRead() or
       /**
        * A pseudo read for a `ref` variable, just prior to an update of the referenced value.
        * A pseudo read is inserted to make assignments to the `ref` variable live, for example
@@ -209,11 +237,35 @@ module Ssa {
        */
       RefReadBeforeWrite()
 
+    class ReadKind extends TReadKind {
+      string toString() {
+        this = ActualRead() and
+        result = "ActualRead"
+        or
+        this = OutRefExitRead() and
+        result = "OutRefExitRead"
+        or
+        this = CapturedVarExitRead() and
+        result = "CapturedVarExitRead"
+        or
+        this = CapturedVarCallRead() and
+        result = "CapturedVarCallRead"
+        or
+        this = RefReadBeforeWrite() and
+        result = "RefReadBeforeWrite"
+      }
+
+      /** Holds if this kind represents a pseudo read. */
+      predicate isPseudo() { this != ActualRead() }
+    }
+
     /**
      * Holds if the `i`th node `node` of basic block `bb` reads source variable `v`.
      * The read at `node` is of kind `rk`.
+     *
+     * This excludes implicit reads via calls.
      */
-    predicate variableRead(
+    predicate variableReadDirect(
       BasicBlock bb, int i, SourceVariable v, ControlFlow::Node node, ReadKind rk
     ) {
       v.getAnAccess().(AssignableRead) = node.getElement() and
@@ -223,34 +275,23 @@ module Ssa {
       outRefExitRead(bb, i, v, node) and
       rk = OutRefExitRead()
       or
-      capturedVarExitRead(bb, i, v, node) and
-      rk = CapturedVarExitRead()
-      or
       refReadBeforeWrite(bb, i, v, node) and
       rk = RefReadBeforeWrite()
     }
 
     private predicate outRefExitRead(
-      ControlFlow::BasicBlocks::ExitBlock ebb, int i, LocalScopeSourceVariable v,
-      ControlFlow::Nodes::ExitNode node
+      BasicBlock bb, int i, LocalScopeSourceVariable v, ControlFlow::Nodes::AnnotatedExitNode node
     ) {
+      node.isNormal() and
       exists(LocalScopeVariable lsv |
         lsv = v.getAssignable() and
-        ebb.getNode(i) = node and
+        bb.getNode(i) = node and
         node.getCallable() = lsv.getCallable()
       |
-        lsv.isRef() or lsv.(Parameter).isOut()
-      )
-    }
-
-    private predicate capturedVarExitRead(
-      ControlFlow::BasicBlocks::ExitBlock ebb, int i, LocalScopeSourceVariable v,
-      ControlFlow::Nodes::ExitNode node
-    ) {
-      exists(BasicBlock bb | variableDefinition(bb, _, v, _) |
-        ebb.getNode(i) = node and
-        bb.getCallable() = ebb.getCallable() and
-        bb.getCallable() != v.getAssignable().getCallable()
+        lsv.(Parameter).isOutOrRef()
+        or
+        lsv.isRef() and
+        strictcount(v.getAnAccess()) > 1
       )
     }
 
@@ -261,7 +302,7 @@ module Ssa {
         def.getTarget() = lv and
         lv.isRef() and
         lv = v.getAssignable() and
-        node = def.getAControlFlowNode().getAPredecessor() and
+        node = def.getAControlFlowNode() and
         bb.getNode(i) = node
       )
     }
@@ -270,26 +311,54 @@ module Ssa {
      * A classification of variable references into reads (of a given kind) and
      * (certain or uncertain) writes.
      */
-    newtype RefKind =
+    private newtype TRefKind =
       Read(ReadKind rk) or
       Write(boolean certain) { certain = true or certain = false }
 
+    private class RefKind extends TRefKind {
+      string toString() {
+        exists(ReadKind rk | this = Read(rk) and result = "read (" + rk + ")")
+        or
+        exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
+      }
+
+      int getOrder() {
+        this = Read(_) and
+        result = 0
+        or
+        this = Write(_) and
+        result = 1
+      }
+    }
+
     /**
-     * Holds if the `i`th node of basic block `bb` is a reference to `v`, either a read
-     * (when `k` is `Read()`) or a write (when `k` is `UncertainWrite()` or `Write()`).
+     * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
      */
-    predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
+    private predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
       exists(ReadKind rk | variableRead(bb, i, v, _, rk) | k = Read(rk))
       or
       exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
     }
 
+    private newtype TaggedRefIndex =
+      MkTaggedRefIndex(int i, int tag) {
+        exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
+      }
+
     /**
      * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic block `bb`,
      * which has the given reference kind `k`.
+     *
+     * Reads are considered before writes when they happen at the same index.
      */
     int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-      i = rank[result](int j | ref(bb, j, v, _)) and
+      MkTaggedRefIndex(i, k.getOrder()) =
+        rank[result](int j, RefKind rk0, int tag |
+          ref(bb, j, v, rk0) and
+          tag = rk0.getOrder()
+        |
+          MkTaggedRefIndex(j, tag) order by j, tag
+        ) and
       ref(bb, i, v, k)
     }
 
@@ -334,29 +403,23 @@ module Ssa {
       liveAtEntry(bb.getASuccessor(), v, rk)
     }
 
-    /**
-     * Holds if source variable `v` is likely to be live at any node inside basic
-     * block `bb`. This is an overestimate.
-     */
-    predicate possiblyLiveAtAllNodes(BasicBlock bb, SourceVariable v) {
-      liveAtExit(bb, v, _)
-      or
-      ref(bb, _, v, Read(_))
-    }
-
     /**
      * Holds if variable `v` is live in basic block `bb` at index `i`.
      * The rank of `i` is `rnk` as defined by `refRank()`.
      */
-    predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk, ReadKind rk) {
-      rnk = refRank(bb, i, v, _) and
-      (
+    private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk, ReadKind rk) {
+      exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
         rnk = maxRefRank(bb, v) and
         liveAtExit(bb, v, rk)
         or
-        ref(bb, i, v, Read(rk))
+        ref(bb, i, v, kind) and
+        kind = Read(rk)
         or
-        exists(int j | liveAtRank(bb, j, v, rnk + 1, rk) | not ref(bb, j, v, Write(true)))
+        exists(RefKind nextKind |
+          liveAtRank(bb, _, v, rnk + 1, rk) and
+          rnk + 1 = refRank(bb, _, v, nextKind) and
+          nextKind != Write(true)
+        )
       )
     }
 
@@ -518,25 +581,44 @@ module Ssa {
     /**
      * A classification of SSA variable references into reads definitions.
      */
-    private newtype SsaRefKind =
+    private newtype TSsaRefKind =
       SsaRead() or
       SsaDef()
 
+    private class SsaRefKind extends TSsaRefKind {
+      string toString() {
+        this = SsaRead() and
+        result = "SsaRead"
+        or
+        this = SsaDef() and
+        result = "SsaDef"
+      }
+
+      int getOrder() {
+        this = SsaRead() and
+        result = 0
+        or
+        this = SsaDef() and
+        result = 1
+      }
+    }
+
     /**
      * Holds if the `i`th node of basic block `bb` is a reference to `v`,
      * either a read (when `k` is `Read()`) or an SSA definition (when `k`
      * is `SsaDef()`).
      */
     private predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-      exists(ReadKind rk | variableRead(bb, i, v, _, rk) |
-        not rk instanceof RefReadBeforeWrite and
-        k = SsaRead()
-      )
+      variableRead(bb, i, v, _, _) and
+      k = SsaRead()
       or
-      exists(Definition def | definesAt(def, bb, i, v)) and
+      exists(Definition def | def.definesAt(v, bb, i)) and
       k = SsaDef()
     }
 
+    private newtype TaggedSsaRefIndex =
+      MkTaggedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
+
     /**
      * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
      * block `bb`, which has the given reference kind `k`.
@@ -549,9 +631,16 @@ module Ssa {
      * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
      * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
      * ```
+     *
+     * Reads are considered before writes when they happen at the same index.
      */
     private int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-      i = rank[result](int j | ssaRef(bb, j, v, _)) and
+      MkTaggedSsaRefIndex(i, k) =
+        rank[result](int j, SsaRefKind k0 |
+          ssaRef(bb, j, v, k0)
+        |
+          MkTaggedSsaRefIndex(j, k0) order by j, k0.getOrder()
+        ) and
       ssaRef(bb, i, v, k)
     }
 
@@ -567,7 +656,7 @@ module Ssa {
     private predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rankix, SourceVariable v) {
       exists(int i |
         rankix = ssaRefRank(bb, i, v, SsaDef()) and
-        definesAt(def, bb, i, v)
+        def.definesAt(v, bb, i)
       )
       or
       ssaDefReachesRank(bb, def, rankix - 1, v) and
@@ -599,31 +688,25 @@ module Ssa {
       exists(BasicBlock bb, int rankix, int i |
         ssaDefReachesRank(bb, def, rankix, v) and
         rankix = ssaRefRank(bb, i, v, SsaDef()) - 1 and
-        definesAt(redef, bb, i, v)
+        redef.definesAt(v, bb, i)
       )
     }
 
     /**
-     * Same as `ssaRefRank()`, but restricted to actual reads of `def`, or
-     * `def` itself.
+     * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
      */
-    private int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i) {
+    private int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
       v = def.getSourceVariable() and
-      result = ssaRefRank(bb, i, v, _) and
+      result = ssaRefRank(bb, i, v, k) and
       (
-        ssaDefReachesRead(_, def, bb.getNode(i), ActualRead())
+        ssaDefReachesRead(_, def, bb.getNode(i), _)
         or
-        definesAt(def, bb, i, _)
+        def.definesAt(_, bb, i)
       )
     }
 
-    private int maxSsaDefRefRank(BasicBlock bb, SourceVariable v) {
-      result = ssaDefRank(_, v, bb, _) and
-      not result + 1 = ssaDefRank(_, v, bb, _)
-    }
-
     private predicate varOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
-      exists(ssaDefRank(def, v, bb, _))
+      exists(ssaDefRank(def, v, bb, _, _))
     }
 
     pragma[noinline]
@@ -668,38 +751,38 @@ module Ssa {
      */
     private predicate adjacentVarRead(Definition def, BasicBlock bb1, int i1, ControlFlow::Node cfn) {
       exists(int rankix, int i2 |
-        rankix = ssaDefRank(def, _, bb1, i1) and
-        rankix + 1 = ssaDefRank(def, _, bb1, i2) and
+        rankix = ssaDefRank(def, _, bb1, i1, _) and
+        rankix + 1 = ssaDefRank(def, _, bb1, i2, SsaRead()) and
         variableRead(bb1, i2, _, cfn, _)
       )
       or
-      exists(SourceVariable v | ssaDefRank(def, v, bb1, i1) = maxSsaDefRefRank(bb1, v)) and
+      exists(SourceVariable v | ssaDefRank(def, v, bb1, i1, _) = maxSsaRefRank(bb1, v)) and
       varBlockReachesRead(def, bb1, cfn)
     }
 
     cached
     private module Cached {
       /**
-       * Holds if `cfn` is a last read of the SSA definition `def`. That is, `cfn`
-       * can reach the end of the enclosing callable, or another SSA definition for
-       * the underlying source variable, without passing through another read.
+       * Holds if the node at index `i` in `bb` is a last reference to SSA
+       * definition `def`.
+       *
+       * That is, the node can reach the end of the enclosing callable, or another
+       * SSA definition for the underlying source variable, without passing through
+       * another read.
        */
       cached
-      predicate lastRead(Definition def, ControlFlow::Node cfn) {
-        exists(BasicBlock bb1, int i1, int rnk, SourceVariable v |
-          variableRead(bb1, i1, v, cfn, _) and
-          rnk = ssaDefRank(def, v, bb1, i1)
-        |
-          // Next reference to `v` inside `bb1` is a write
-          rnk + 1 = ssaRefRank(bb1, _, v, SsaDef())
+      predicate lastRef(Definition def, BasicBlock bb, int i) {
+        exists(int rnk, SourceVariable v | rnk = ssaDefRank(def, v, bb, i, _) |
+          // Next reference to `v` inside `bb` is a write
+          rnk + 1 = ssaRefRank(bb, _, v, SsaDef())
           or
-          // No more references to `v` inside `bb1`
-          rnk = maxSsaDefRefRank(bb1, def.getSourceVariable()) and
+          // No more references to `v` inside `bb`
+          rnk = maxSsaRefRank(bb, v) and
           (
             // Can reach exit directly
-            bb1 instanceof ControlFlow::BasicBlocks::ExitBlock
+            bb instanceof ControlFlow::BasicBlocks::ExitBlock
             or
-            exists(BasicBlock bb2 | varBlockReaches(def, bb1, bb2) |
+            exists(BasicBlock bb2 | varBlockReaches(def, bb, bb2) |
               // Can reach a write using one or more steps
               1 = ssaRefRank(bb2, _, def.getSourceVariable(), SsaDef())
               or
@@ -769,12 +852,25 @@ module Ssa {
         ssaDefReachesUncertainDefWithinBlock(v, def, redef)
         or
         exists(BasicBlock bb |
-          definesAt(redef, bb, _, v) and
+          redef.definesAt(v, bb, _) and
           ssaDefReachesEndOfBlock(bb.getAPredecessor(), def, v) and
           not ssaDefReachesUncertainDefWithinBlock(v, _, redef)
         )
       }
 
+      /** Same as `adjacentVarRead`, but steps over pseudo reads. */
+      private predicate adjacentVarActualRead(
+        Definition def, BasicBlock bb1, int i1, ControlFlow::Node cfn
+      ) {
+        adjacentVarRead(def, bb1, i1, cfn)
+        or
+        exists(ControlFlow::Node mid, BasicBlock bb2, int i2 |
+          adjacentVarActualRead(def, bb1, i1, mid) and
+          variableRead(bb2, i2, _, mid, any(ReadKind rk | rk.isPseudo())) and
+          adjacentVarRead(def, bb2, i2, cfn)
+        )
+      }
+
       /**
        * Holds if the value defined at SSA definition `def` can reach a read at `cfn`,
        * without passing through any other read.
@@ -782,8 +878,9 @@ module Ssa {
       cached
       predicate firstReadSameVar(Definition def, ControlFlow::Node cfn) {
         exists(BasicBlock bb1, int i1 |
-          definesAt(def, bb1, i1, _) and
-          adjacentVarRead(def, bb1, i1, cfn)
+          def.definesAt(_, bb1, i1) and
+          adjacentVarActualRead(def, bb1, i1, cfn) and
+          variableRead(_, _, _, cfn, ActualRead())
         )
       }
 
@@ -797,8 +894,28 @@ module Ssa {
         Definition def, ControlFlow::Node cfn1, ControlFlow::Node cfn2
       ) {
         exists(BasicBlock bb1, int i1 |
-          variableRead(bb1, i1, _, cfn1, _) and
-          adjacentVarRead(def, bb1, i1, cfn2)
+          variableRead(bb1, i1, _, cfn1, ActualRead()) and
+          adjacentVarActualRead(def, bb1, i1, cfn2) and
+          variableRead(_, _, _, cfn2, ActualRead())
+        )
+      }
+
+      private predicate reachesLastRef(Definition def, BasicBlock bb, int i) {
+        lastRef(def, bb, i)
+        or
+        exists(BasicBlock bb0, int i0, ControlFlow::Node cfn |
+          reachesLastRef(def, bb0, i0) and
+          variableRead(bb0, i0, _, cfn, any(ReadKind rk | rk.isPseudo())) and
+          adjacentVarRead(def, bb, i, cfn)
+        )
+      }
+
+      cached
+      predicate lastReadSameVar(Definition def, ControlFlow::Node cfn) {
+        exists(BasicBlock bb, int i |
+          reachesLastRef(def, bb, i) and
+          variableRead(bb, i, _, _, ActualRead()) and
+          cfn = bb.getNode(i)
         )
       }
     }
@@ -1095,10 +1212,10 @@ module Ssa {
      * `i`.
      */
     private predicate updateCandidate(BasicBlock bb, int i, FieldOrPropSourceVariable fp, Call call) {
-      possiblyLiveAtAllNodes(bb, fp) and
       callAt(bb, i, call) and
+      call.getEnclosingCallable() = fp.getEnclosingCallable() and
       relevantDefinition(_, fp.getAssignable(), _) and
-      not ref(bb, i, fp, _)
+      not variableWriteDirect(bb, i, fp, _)
     }
 
     private predicate source(
@@ -1169,7 +1286,7 @@ module Ssa {
     private predicate edgePlus(TCallableNode c1, TCallableNode c2) = fastTC(prunedEdge/2)(c1, c2)
 
     pragma[noopt]
-    private predicate updatesNamedFieldOrProp_(
+    private predicate updatesNamedFieldOrProp(
       FieldOrPropSourceVariable fps, Call call, Callable setter
     ) {
       exists(TCallableNode src, TCallableNode sink, FieldOrProp fp |
@@ -1179,68 +1296,17 @@ module Ssa {
       )
     }
 
-    private predicate updatesNamedFieldOrPropPossiblyLive(
-      BasicBlock bb, int i, FieldOrPropSourceVariable fp, Call call, Callable setter
-    ) {
-      updateCandidate(bb, i, fp, call) and
-      updatesNamedFieldOrProp_(fp, call, setter)
-    }
-
-    private int firstRefAfterCall(BasicBlock bb, int i, FieldOrPropSourceVariable fp) {
-      updatesNamedFieldOrPropPossiblyLive(bb, i, fp, _, _) and
-      result = min(int k | k > i and ref(bb, k, fp, _))
-    }
-
     /**
      * Holds if `call` may change the value of field or property `fp`. The actual
      * update occurs in `setter`.
      */
     cached
-    predicate updatesNamedFieldOrProp(Call c, FieldOrPropSourceVariable fp, Callable setter) {
+    predicate updatesNamedFieldOrProp(
+      BasicBlock bb, int i, Call c, FieldOrPropSourceVariable fp, Callable setter
+    ) {
       forceCachingInSameStage() and
-      exists(BasicBlock bb, int i | updatesNamedFieldOrPropPossiblyLive(bb, i, fp, c, setter) |
-        not exists(firstRefAfterCall(bb, i, fp)) and
-        liveAtExit(bb, fp, _)
-        or
-        exists(int j | j = firstRefAfterCall(bb, i, fp) |
-          liveAtRank(bb, j, fp, _, _) and
-          not ref(bb, j, fp, Write(true))
-        )
-      )
-    }
-
-    /**
-     * Same as `variableWrite()`, but extended to include implicit call definitions
-     * for fields and properties.
-     */
-    private predicate variableWriteExt(BasicBlock bb, int i, SourceVariable v) {
-      ref(bb, i, v, Write(_))
-      or
-      variableWriteExt(bb, i, v.(QualifiedFieldOrPropSourceVariable).getQualifier())
-      or
-      exists(Call c | callAt(bb, i, c) | updatesNamedFieldOrProp(c, v, _))
-    }
-
-    private int firstRefAfterQualifiedDef(BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable q) {
-      variableWriteExt(bb, i, q) and
-      result = min(int k | k > i and ref(bb, k, q, _))
-    }
-
-    /**
-     * Holds if qualified field or property `q` is live after the (certain or
-     * uncertain) write at index `i` inside basic block `bb`.
-     */
-    predicate liveAfterWriteQualified(BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable q) {
-      variableWriteExt(bb, i, q) and
-      (
-        not exists(firstRefAfterQualifiedDef(bb, i, q)) and
-        liveAtExit(bb, q, _)
-        or
-        exists(int j | j = firstRefAfterQualifiedDef(bb, i, q) |
-          liveAtRank(bb, j, q, _, _) and
-          not ref(bb, j, q, Write(true))
-        )
-      )
+      updateCandidate(bb, i, fp, c) and
+      updatesNamedFieldOrProp(fp, c, setter)
     }
   }
 
@@ -1306,7 +1372,6 @@ module Ssa {
       exists(BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable sv |
         vdef.getTarget() = v and
         vdef.getEnclosingCallable() = c and
-        liveAfterWrite(bb, i, sv, _) and // only works because `CapturedVarExitRead`s are inserted
         sv.getAssignable() = v and
         bb.getNode(i) = vdef.getAControlFlowNode() and
         c != v.getCallable()
@@ -1321,8 +1386,8 @@ module Ssa {
     private predicate updateCandidate(
       BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable v, Call call
     ) {
-      possiblyLiveAtAllNodes(bb, v) and
       callAt(bb, i, call) and
+      call.getEnclosingCallable() = v.getEnclosingCallable() and
       exists(Assignable a |
         a = v.getAssignable() and
         relevantDefinition(_, a, _) and
@@ -1398,46 +1463,53 @@ module Ssa {
      * Holds if `call` may change the value of captured variable `v`. The actual
      * update occurs in `def`.
      */
-    private predicate updatesCapturedVariablePossiblyLive(
+    cached
+    predicate updatesCapturedVariable(
       BasicBlock bb, int i, Call call, LocalScopeSourceVariable v, AssignableDefinition def,
       boolean additionalCalls
     ) {
+      forceCachingInSameStage() and
       updateCandidate(bb, i, v, call) and
       exists(Callable writer | relevantDefinition(writer, v.getAssignable(), def) |
         updatesCapturedVariableWriter(call, v, writer, additionalCalls)
       )
     }
-
-    private int firstRefAfter(BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable v) {
-      updatesCapturedVariablePossiblyLive(bb, i, _, v, _, _) and
-      result = min(int k | k > i and ref(bb, k, v, _))
-    }
-
-    /**
-     * Holds if `call` may change the value of captured variable `v`. The actual
-     * update occurs in `def`.
-     */
-    cached
-    predicate updatesCapturedVariable(
-      Call call, LocalScopeSourceVariable v, AssignableDefinition def, boolean additionalCalls
-    ) {
-      forceCachingInSameStage() and
-      exists(BasicBlock bb, int i |
-        updatesCapturedVariablePossiblyLive(bb, i, call, v, def, additionalCalls)
-      |
-        not exists(firstRefAfter(bb, i, v)) and
-        liveAtExit(bb, v, _)
-        or
-        exists(int j | j = firstRefAfter(bb, i, v) |
-          liveAtRank(bb, j, v, _, _) and
-          not ref(bb, j, v, Write(true))
-        )
-      )
-    }
   }
 
   private import CapturedVariableImpl
 
+  /**
+   * Holds if the `i`th node of basic block `bb` is a (potential) write to source
+   * variable `v`. The Boolean `certain` indicates whether the write is certain.
+   *
+   * This includes implicit writes via calls.
+   */
+  private predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    variableWriteDirect(bb, i, v, certain)
+    or
+    variableWriteQualifier(bb, i, v, certain)
+    or
+    updatesNamedFieldOrProp(bb, i, _, v, _) and
+    certain = false
+    or
+    updatesCapturedVariable(bb, i, _, v, _, _) and
+    certain = false
+  }
+
+  cached
+  private predicate variableWriteQualifier(
+    BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v, boolean certain
+  ) {
+    forceCachingInSameStage() and
+    variableWrite(bb, i, v.getQualifier(), certain) and
+    // Eliminate corner case where a call definition can overlap with a
+    // qualifier definition: if method `M` updates field `F`, then a call
+    // to `M` is both an update of `x.M` and `x.M.M`, so the former call
+    // definition should not give rise to an implicit qualifier definition
+    // for `x.M.M`.
+    not updatesNamedFieldOrProp(bb, i, _, v, _)
+  }
+
   /**
    * Liveness analysis to restrict the size of the SSA representation for
    * captured variables.
@@ -1467,11 +1539,10 @@ module Ssa {
      * `c` may read the value of the captured variable.
      */
     private predicate capturerReads(Callable c, LocalScopeVariable v) {
-      exists(ControlFlow::BasicBlocks::EntryBlock ebb, LocalScopeSourceVariable lssv |
-        liveAtEntry(ebb, lssv, _)
-      |
-        v = lssv.getAssignable() and
-        c = ebb.getCallable() and
+      exists(LocalScopeSourceVariable sv |
+        variableReadDirect(_, _, sv, _, _) and
+        c = sv.getEnclosingCallable() and
+        v = sv.getAssignable() and
         v.getCallable() != c
       )
     }
@@ -1489,52 +1560,17 @@ module Ssa {
       }
     }
 
-    private predicate capturedVariableWrite(
-      BasicBlock bb, int i, CapturedReadLocalScopeSourceVariable v
-    ) {
-      ref(bb, i, v, Write(_))
-    }
-
     /**
-     * Holds if the write to captured source variable `v` at index `i` in basic
-     * block `bb` may be read by a callable reachable from the call `c`.
+     * Holds if a write to captured source variable `v` may be read by a
+     * callable reachable from the call `c`.
      */
     private predicate implicitReadCandidate(
-      BasicBlock bb, int i, CapturedReadLocalScopeSourceVariable v,
-      ControlFlow::Nodes::ElementNode c
+      CapturedReadLocalScopeSourceVariable v, ControlFlow::Nodes::ElementNode c
     ) {
-      c.getElement() instanceof Call and
-      exists(BasicBlock bb0, int i0 | bb0.getNode(i0) = c |
-        // `c` is in basic block `bb`
-        capturedVariableWrite(bb0, i, v) and
-        i < i0 and
-        not capturedVariableWrite(bb, any(int j | j in [i + 1 .. i0 - 1]), v) and
-        bb = bb0
+      exists(BasicBlock bb, int i | variableWriteDirect(bb, i, v, _) |
+        c = bb.getNode(any(int j | j > i))
         or
-        // `c` is in a basic block reachable from `bb`
-        not capturedVariableWrite(bb0, any(int j | j < i0), v) and
-        capturedVariableWrite(bb, i, v) and
-        capturedVariableWriteReachesStartOf(bb, i, bb0, v)
-      )
-    }
-
-    /**
-     * Holds if the write to captured source variable `v` at index `i` in basic
-     * block `bb` reaches the start of basic block `r`, without passing through
-     * another write.
-     */
-    private predicate capturedVariableWriteReachesStartOf(
-      BasicBlock bb, int i, BasicBlock r, CapturedReadLocalScopeSourceVariable v
-    ) {
-      exists(int last | last = max(refRank(bb, _, v, Write(_))) |
-        last = refRank(bb, i, v, Write(_)) and
-        capturedVariableWrite(bb, i, v) and
-        r = bb.getASuccessor()
-      )
-      or
-      exists(BasicBlock mid | capturedVariableWriteReachesStartOf(bb, i, mid, v) |
-        r = mid.getASuccessor() and
-        not capturedVariableWrite(mid, _, v)
+        c = bb.getASuccessor+().getANode()
       )
     }
 
@@ -1542,7 +1578,7 @@ module Ssa {
       ControlFlow::Nodes::ElementNode call, CapturedReadLocalScopeSourceVariable v,
       CapturedReadLocalScopeVariable captured, Callable c, boolean libraryDelegateCall
     ) {
-      implicitReadCandidate(_, _, v, call) and
+      implicitReadCandidate(v, call) and
       c = getARuntimeTarget(call.getElement(), libraryDelegateCall) and
       captured = v.getAssignable() and
       capturerReads(_, captured)
@@ -1601,12 +1637,12 @@ module Ssa {
     }
 
     /**
-     * Holds if captured local scope variable `v` is live after the (certain or uncertain)
-     * write at index `i` inside basic block `bb`.
+     * Holds if captured local scope variable `v` is written inside the callable
+     * to which `bb` belongs, and the value may be read via `call` using zero or
+     * more additional calls (as indicated by `additionalCalls`).
      *
-     * The write is live because of the implicit call definition `def`, which reaches
-     * the write using zero or more additional calls (as indicated by `additionalCalls`).
-     * That is, data can flow from the write at index `i` out to the call `def`.
+     * In this case a pseudo-read is inserted at the exit node `node`, at index
+     * `i` in `bb`, in order to make the write live.
      *
      * Example:
      *
@@ -1624,27 +1660,23 @@ module Ssa {
      * The write to `i` inside `M2` on line 4 is live because of the implicit call
      * definition on line 5.
      */
-    predicate liveAfterWriteCapturedOut(
-      BasicBlock bb, int i, LocalScopeSourceVariable v, ImplicitCallDefinition def,
-      boolean additionalCalls
+    predicate capturedReadOut(
+      BasicBlock bb, int i, LocalScopeSourceVariable v, ControlFlow::Nodes::AnnotatedExitNode node,
+      LocalScopeSourceVariable outer, Call call, boolean additionalCalls
     ) {
-      exists(LocalScopeVariable lsv, AssignableDefinition adef |
-        def.getSourceVariable().getAssignable() = lsv
-      |
-        lsv = v.getAssignable() and
-        bb.getNode(i) = adef.getAControlFlowNode() and
-        updatesCapturedVariable(def.getCall(), _, adef, additionalCalls)
+      node.isNormal() and
+      exists(BasicBlock pred, AssignableDefinition adef |
+        variableDefinition(pred, _, v, adef) and
+        updatesCapturedVariable(_, _, call, outer, adef, additionalCalls) and
+        pred.getASuccessor*() = bb and
+        node = bb.getNode(i)
       )
     }
 
     /**
-     * Holds if captured local scope variable `v` is live after the (certain or uncertain)
-     * write at index `i` inside basic block `bb`.
-     *
-     * The write is live because of the implicit entry definition `def`, which can be
-     * reached using one or more calls (as indicated by `additionalCalls`), starting
-     * from call `c`. That is, data can flow from the write at index `i` into the
-     * callable containing `def`.
+     * Holds if a value written to captured local scope variable `outer` may be
+     * read as `inner` via `call`, at index `i` in basic block `bb`, using one or
+     * more calls (as indicated by `additionalCalls`).
      *
      * Example:
      *
@@ -1662,116 +1694,50 @@ module Ssa {
      * The write to `i` on line 5 is live because of the call to `M2` on line 6, which
      * reaches the entry definition for `i` in `M2` on line 4.
      */
-    predicate liveAfterWriteCapturedIn(
-      BasicBlock bb, int i, LocalScopeSourceVariable v, ImplicitEntryDefinition def,
-      ControlFlow::Nodes::ElementNode c, boolean additionalCalls
+    predicate capturedReadIn(
+      BasicBlock bb, int i, LocalScopeSourceVariable outer, LocalScopeSourceVariable inner,
+      ControlFlow::Nodes::ElementNode call, boolean additionalCalls
     ) {
-      exists(Callable reader, SourceVariable sv |
-        implicitReadCandidate(bb, i, v, c) and
-        readsCapturedVariable(c, v, reader, additionalCalls) and
-        sv = def.getSourceVariable() and
-        reader = sv.getEnclosingCallable() and
-        v.getAssignable() = sv.getAssignable()
+      exists(Callable reader |
+        implicitReadCandidate(outer, call) and
+        readsCapturedVariable(call, outer, reader, additionalCalls) and
+        reader = inner.getEnclosingCallable() and
+        outer.getAssignable() = inner.getAssignable() and
+        call = bb.getNode(i)
       )
     }
-
-    /**
-     * Holds if captured local scope variable `v` is live after the (certain or uncertain)
-     * write at index `i` inside basic block `bb`.
-     */
-    predicate liveAfterWriteCaptured(BasicBlock bb, int i, LocalScopeSourceVariable v) {
-      liveAfterWriteCapturedOut(bb, i, v, _, _) or
-      liveAfterWriteCapturedIn(bb, i, v, _, _, _)
-    }
   }
 
   private import CapturedVariableLivenessImpl
 
+  /**
+   * Holds if the `i`th node `node` of basic block `bb` reads source variable `v`.
+   * The read at `node` is of kind `rk`.
+   *
+   * This includes implicit reads via calls.
+   */
+  private predicate variableRead(
+    BasicBlock bb, int i, SourceVariable v, ControlFlow::Node node, ReadKind rk
+  ) {
+    variableReadDirect(bb, i, v, node, rk)
+    or
+    capturedReadOut(bb, i, v, node, _, _, _) and
+    rk = CapturedVarExitRead()
+    or
+    capturedReadIn(bb, i, v, _, node, _) and
+    rk = CapturedVarCallRead()
+  }
+
   cached
   private module SsaImpl {
     cached
     predicate forceCachingInSameStage() { any() }
 
-    /**
-     * A data type representing SSA definitions.
-     *
-     * We distinguish six kinds of SSA definitions:
-     *
-     *   1. Explicit definitions wrapping an `AssignableDefinition` node in the CFG.
-     *   2. Implicit initializations of variables at the entry point of a callable
-     *      (captured variables and relevant fields or properties), represented by
-     *      the callable entry point in the CFG.
-     *   3. Implicit indirect definitions of variables through calls (fields,
-     *      properties, or captured variables).
-     *   4. Implicit indirect definitions of variables through qualifier definitions
-     *      (fields or properties).
-     *   5. Phi nodes.
-     *
-     * SSA definitions are only introduced where necessary. That is, dead assignments
-     * have no associated SSA definitions.
-     */
     cached
     newtype TDefinition =
-      TSsaExplicitDef(SourceVariable v, AssignableDefinition def, BasicBlock bb, int i) {
-        variableDefinition(bb, i, v, def) and
-        (
-          exists(ReadKind rk | liveAfterWrite(bb, i, v, rk) |
-            // A `ref` assignment such as
-            // ```csharp
-            // ref int i = ref GetRef();
-            // ```
-            // is dead when there are no reads of or writes to `i`.
-            // That is, the read kind `rk` witnessing the liveness of the assignment
-            // must not be the pseudo read inserted at the end of the enclosing callable
-            not (
-              rk = OutRefExitRead() and
-              def.(AssignableDefinitions::AssignmentDefinition).getSource() instanceof RefExpr
-            ) and
-            rk != CapturedVarExitRead() // Captured variables are handled below
-          )
-          or
-          liveAfterWriteCaptured(bb, i, v)
-        )
-      } or
-      TSsaImplicitEntryDef(SourceVariable v, ControlFlow::BasicBlocks::EntryBlock ebb) {
-        liveAtEntry(ebb, v, _) and
-        exists(Callable c |
-          c = ebb.getCallable() and
-          c = v.getEnclosingCallable()
-        |
-          // Captured variable
-          exists(LocalScopeVariable lsv |
-            v = any(LocalScopeSourceVariable lv | lsv = lv.getAssignable())
-          |
-            lsv.getCallable() != c
-          )
-          or
-          // Each tracked field and property has an implicit entry definition
-          v instanceof FieldOrPropSourceVariable
-        )
-      } or
-      TSsaImplicitCallDef(SourceVariable v, Call c, BasicBlock bb, int i) {
-        bb.getNode(i) = c.getAControlFlowNode() and
-        (
-          // Liveness of `v` after `c` is guaranteed by `updatesNamedFieldOrProp`
-          updatesNamedFieldOrProp(c, v, _)
-          or
-          // Liveness of `v` after `c` is guaranteed by `updatesCapturedVariable`
-          updatesCapturedVariable(c, v, _, _)
-        )
-      } or
-      TSsaImplicitQualifierDef(SourceVariable v, Definition qdef) {
-        exists(BasicBlock bb, int i |
-          qdef.getSourceVariable() = v.getQualifier() and
-          qdef.definesAt(bb, i) and
-          liveAfterWriteQualified(bb, i, v) and
-          // Eliminate corner case where a call definition can overlap with a
-          // qualifier definition: if method `M` updates field `F`, then a call
-          // to `M` is both an update of `x.M` and `x.M.M`, so the former call
-          // definition should not give rise to an implicit qualifier definition
-          // for `x.M.M`.
-          not exists(TSsaImplicitCallDef(v, _, bb, i))
-        )
+      TWriteDef(SourceVariable v, BasicBlock bb, int i) {
+        variableWrite(bb, i, v, _) and
+        liveAfterWrite(bb, i, v, _)
       } or
       TPhiNode(SourceVariable v, ControlFlow::BasicBlocks::JoinBlock bb) {
         phiNodeMaybeLive(bb, v) and
@@ -1780,48 +1746,20 @@ module Ssa {
 
     pragma[noinline]
     private predicate phiNodeMaybeLive(ControlFlow::BasicBlocks::JoinBlock bb, SourceVariable v) {
-      exists(Definition def, BasicBlock bb1 | definesAt(def, bb1, _, v) |
+      exists(Definition def, BasicBlock bb1 | def.definesAt(v, bb1, _) |
         bb1.inDominanceFrontier(bb)
       )
     }
 
-    /**
-     * Holds if the SSA definition `def` defines source variable `v` at index `i`
-     * in basic block `bb`. Phi nodes and entry nodes (captured variables and
-     * fields/properties) are considered to be at index `-1`, while normal variable
-     * updates are at the index of the control flow node they wrap.
-     */
-    cached
-    predicate definesAt(Definition def, BasicBlock bb, int i, SourceVariable v) {
-      def = TSsaExplicitDef(v, _, bb, i)
-      or
-      def = TSsaImplicitEntryDef(v, bb) and i = -1
-      or
-      def = TSsaImplicitCallDef(v, _, bb, i)
-      or
-      exists(Definition qdef | def = TSsaImplicitQualifierDef(v, qdef) | definesAt(qdef, bb, i, _))
-      or
-      def = TPhiNode(v, bb) and i = -1
-    }
-
     cached
     predicate isCapturedVariableDefinitionFlowIn(
       ExplicitDefinition def, ImplicitEntryDefinition edef, ControlFlow::Nodes::ElementNode c,
       boolean additionalCalls
     ) {
-      exists(BasicBlock bb, int i, LocalScopeSourceVariable v | definesAt(def, bb, i, v) |
-        liveAfterWriteCapturedIn(bb, i, v, edef, c, additionalCalls)
-      )
-    }
-
-    /**
-     * Holds if the SSA definition `def` assigns to captured local scope variable `v`,
-     * and the variable may remain unchanged throughout the rest of the enclosing
-     * callable.
-     */
-    private predicate isLiveCapturedVariableDefinition(ExplicitDefinition def) {
-      exists(Definition def0 | def = def0.getAnUltimateDefinition() |
-        ssaDefReachesRead(_, def0, _, CapturedVarExitRead())
+      exists(Definition def0 |
+        capturedReadIn(_, _, def.getSourceVariable(), edef.getSourceVariable(), c, additionalCalls) and
+        def = def0.getAnUltimateDefinition() and
+        ssaDefReachesRead(_, def0, c, CapturedVarCallRead())
       )
     }
 
@@ -1829,9 +1767,19 @@ module Ssa {
     predicate isCapturedVariableDefinitionFlowOut(
       ExplicitDefinition def, ImplicitCallDefinition cdef, boolean additionalCalls
     ) {
-      exists(BasicBlock bb, int i, LocalScopeSourceVariable v | definesAt(def, bb, i, v) |
-        liveAfterWriteCapturedOut(bb, i, v, cdef, additionalCalls) and
-        isLiveCapturedVariableDefinition(def)
+      exists(Definition def0, BasicBlock bb, int i |
+        def = def0.getAnUltimateDefinition() and
+        lastRef(def0, bb, i) and
+        capturedReadOut(bb, i, def0.getSourceVariable(), _, cdef.getSourceVariable(),
+          cdef.getCall(), additionalCalls)
+      )
+    }
+
+    cached
+    predicate explicitDefinition(Definition def, SourceVariable v, AssignableDefinition ad) {
+      exists(BasicBlock bb, int i |
+        def = TWriteDef(v, bb, i) and
+        variableDefinition(bb, i, v, ad)
       )
     }
   }
@@ -1840,7 +1788,7 @@ module Ssa {
 
   private string getSplitString(Definition def) {
     exists(BasicBlock bb, int i, ControlFlow::Node cfn |
-      definesAt(def, bb, i, _) and
+      def.definesAt(_, bb, i) and
       result = cfn.(ControlFlow::Nodes::ElementNode).getSplitsString()
     |
       cfn = bb.getNode(i)
@@ -1864,7 +1812,7 @@ module Ssa {
    */
   class Definition extends TDefinition {
     /** Gets the source variable underlying this SSA definition. */
-    SourceVariable getSourceVariable() { definesAt(this, _, _, result) }
+    SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
 
     /**
      * Gets a read of the source variable underlying this SSA definition that
@@ -1923,7 +1871,7 @@ module Ssa {
      *   node between lines 9 and 10.
      */
     AssignableRead getAReadAtNode(ControlFlow::Node cfn) {
-      ssaDefReachesRead(_, this, cfn, _) and
+      ssaDefReachesRead(_, this, cfn, ActualRead()) and
       result.getAControlFlowNode() = cfn
     }
 
@@ -2061,7 +2009,7 @@ module Ssa {
      *   between lines 9 and 10.
      */
     AssignableRead getALastReadAtNode(ControlFlow::Node cfn) {
-      lastRead(this, cfn) and
+      lastReadSameVar(this, cfn) and
       result.getAControlFlowNode() = cfn
     }
 
@@ -2116,15 +2064,24 @@ module Ssa {
     predicate isLiveAtEndOfBlock(BasicBlock bb) { ssaDefReachesEndOfBlock(bb, this, _) }
 
     /**
-     * Holds if this SSA definition is at index `i` in basic block `bb`. Phi nodes and
-     * entry nodes (captured variables and fields/properties) are considered to be at
-     * index `-1`, while normal variable updates are at the index of the control flow
-     * node they wrap.
+     * DEPRECATED: Use `definesAt/3` instead.
      */
-    predicate definesAt(BasicBlock bb, int i) { definesAt(this, bb, i, _) }
+    deprecated predicate definesAt(BasicBlock bb, int i) { this.definesAt(_, bb, i) }
+
+    /**
+     * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
+     * Phi nodes and entry nodes (captured variables and fields/properties) are
+     * considered to be at index `-1`, while normal variable updates are at the
+     * index of the control flow node they wrap.
+     */
+    predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
+      this = TWriteDef(v, bb, i)
+      or
+      this = TPhiNode(v, bb) and i = -1
+    }
 
     /** Gets the basic block to which this SSA definition belongs. */
-    BasicBlock getBasicBlock() { this.definesAt(result, _) }
+    BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
 
     /**
      * Gets the control flow node of this SSA definition, if any. Phi nodes are examples
@@ -2132,7 +2089,7 @@ module Ssa {
      * `-1` in the relevant basic block.
      */
     ControlFlow::Node getControlFlowNode() {
-      exists(BasicBlock bb, int i | this.definesAt(bb, i) | result = bb.getNode(i))
+      exists(BasicBlock bb, int i | this.definesAt(_, bb, i) | result = bb.getNode(i))
     }
 
     /**
@@ -2150,11 +2107,12 @@ module Ssa {
      * parameter may remain unchanged throughout the rest of the enclosing callable.
      */
     predicate isLiveOutRefParameterDefinition(Parameter p) {
-      exists(Definition def, ControlFlow::Node read, SourceVariable v |
-        this = def.getAnUltimateDefinition()
-      |
-        ssaDefReachesRead(v, def, read, OutRefExitRead()) and
-        v.getAssignable() = p
+      p.isOutOrRef() and
+      exists(Definition def, BasicBlock bb, int i |
+        this = def.getAnUltimateDefinition() and
+        lastRef(def, bb, i) and
+        variableRead(bb, i, def.getSourceVariable(), _, OutRefExitRead()) and
+        p = def.getSourceVariable().getAssignable()
       )
     }
 
@@ -2168,11 +2126,11 @@ module Ssa {
   /**
    * An SSA definition that corresponds to an explicit assignable definition.
    */
-  class ExplicitDefinition extends Definition, TSsaExplicitDef {
+  class ExplicitDefinition extends Definition, TWriteDef {
     SourceVariable sv;
     AssignableDefinition ad;
 
-    ExplicitDefinition() { this = TSsaExplicitDef(sv, ad, _, _) }
+    ExplicitDefinition() { explicitDefinition(this, sv, ad) }
 
     /**
      * Gets an underlying assignable definition. The result is always unique,
@@ -2255,9 +2213,16 @@ module Ssa {
    */
   class ImplicitDefinition extends Definition {
     ImplicitDefinition() {
-      this = TSsaImplicitEntryDef(_, _) or
-      this = TSsaImplicitCallDef(_, _, _, _) or
-      this = TSsaImplicitQualifierDef(_, _)
+      exists(BasicBlock bb, SourceVariable v, int i | this = TWriteDef(v, bb, i) |
+        implicitEntryDefinition(bb, v) and
+        i = -1
+        or
+        updatesNamedFieldOrProp(bb, i, _, v, _)
+        or
+        updatesCapturedVariable(bb, i, _, v, _, _)
+        or
+        variableWriteQualifier(bb, i, v, _)
+      )
     }
   }
 
@@ -2266,12 +2231,19 @@ module Ssa {
    * at the beginning of a callable. Either the variable is a local scope variable
    * captured by the callable, or a field or property accessed inside the callable.
    */
-  class ImplicitEntryDefinition extends ImplicitDefinition, TSsaImplicitEntryDef {
+  class ImplicitEntryDefinition extends ImplicitDefinition, TWriteDef {
+    ImplicitEntryDefinition() {
+      exists(BasicBlock bb, SourceVariable v |
+        this = TWriteDef(v, bb, -1) and
+        implicitEntryDefinition(bb, v)
+      )
+    }
+
     /** Gets the callable that this entry definition belongs to. */
     Callable getCallable() {
-      exists(ControlFlow::BasicBlocks::EntryBlock ebb |
-        this = TSsaImplicitEntryDef(_, ebb) and
-        result = ebb.getCallable()
+      exists(BasicBlock bb |
+        this = TWriteDef(_, bb, _) and
+        result = bb.getCallable()
       )
     }
 
@@ -2290,8 +2262,18 @@ module Ssa {
    * An SSA definition representing the potential definition of a variable
    * via a call.
    */
-  class ImplicitCallDefinition extends ImplicitDefinition, TSsaImplicitCallDef {
-    Call getCall() { this = TSsaImplicitCallDef(_, result, _, _) }
+  class ImplicitCallDefinition extends ImplicitDefinition, TWriteDef {
+    private Call c;
+
+    ImplicitCallDefinition() {
+      exists(BasicBlock bb, SourceVariable v, int i | this = TWriteDef(v, bb, i) |
+        updatesNamedFieldOrProp(bb, i, c, v, _)
+        or
+        updatesCapturedVariable(bb, i, c, v, _, _)
+      )
+    }
+
+    Call getCall() { result = c }
 
     /**
      * Gets one of the definitions that may contribute to this implicit
@@ -2300,12 +2282,12 @@ module Ssa {
      * and which targets the same assignable as this SSA definition.
      */
     AssignableDefinition getAPossibleDefinition() {
-      exists(Callable setter | updatesNamedFieldOrProp(getCall(), _, setter) |
+      exists(Callable setter | updatesNamedFieldOrProp(_, _, getCall(), _, setter) |
         result.getEnclosingCallable() = setter and
         result.getTarget() = this.getSourceVariable().getAssignable()
       )
       or
-      updatesCapturedVariable(getCall(), _, result, _) and
+      updatesCapturedVariable(_, _, getCall(), _, result, _) and
       result.getTarget() = this.getSourceVariable().getAssignable()
     }
 
@@ -2320,9 +2302,20 @@ module Ssa {
    * An SSA definition representing the potential definition of a variable
    * via an SSA definition for the qualifier.
    */
-  class ImplicitQualifierDefinition extends ImplicitDefinition, TSsaImplicitQualifierDef {
+  class ImplicitQualifierDefinition extends ImplicitDefinition, TWriteDef {
+    private Definition q;
+
+    ImplicitQualifierDefinition() {
+      exists(BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v |
+        this = TWriteDef(v, bb, i)
+      |
+        variableWriteQualifier(bb, i, v, _) and
+        q.definesAt(v.getQualifier(), bb, i)
+      )
+    }
+
     /** Gets the SSA definition for the qualifier. */
-    Definition getQualifierDefinition() { this = TSsaImplicitQualifierDef(_, result) }
+    Definition getQualifierDefinition() { result = q }
 
     override string toString() {
       result = getToStringPrefix(this) + "SSA qualifier def(" + getSourceVariable() + ")"
@@ -2376,7 +2369,7 @@ module Ssa {
      */
     override Definition getAnInput() {
       exists(BasicBlock bb, BasicBlock phiPred, SourceVariable v |
-        definesAt(this, bb, _, v) and
+        this.definesAt(v, bb, _) and
         bb.getAPredecessor() = phiPred and
         ssaDefReachesEndOfBlock(phiPred, result, v)
       )
diff --git a/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql b/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
index b7997b85384..4dbc77e922e 100644
--- a/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
+++ b/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
@@ -34,7 +34,7 @@ private TLocalScopeVariableReadOrSsaDef getANextReadOrDef(TLocalScopeVariableRea
       ssaDef.getARead() = read
     |
       pseudoDef.getAnInput() = ssaDef and
-      pseudoDef.definesAt(bb, i) and
+      pseudoDef.definesAt(_, bb, i) and
       cfn = read.getAReachableElement().getAControlFlowNode() and
       (
         cfn = bb.getNode(i)
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/Capture.cs b/csharp/ql/test/library-tests/dataflow/ssa/Capture.cs
index d11947afed6..a74d480668d 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/Capture.cs
+++ b/csharp/ql/test/library-tests/dataflow/ssa/Capture.cs
@@ -99,7 +99,7 @@ class Capture
             return x;
         });
 
-        var z = 12; // Should *not* get an SSA definition
+        var z = 12; // Should *not* get an SSA definition, but currently does because it is considered live via the lambda
         fn(() =>
         {
             z = 0;
@@ -119,7 +119,7 @@ class Capture
         };
         M1();
 
-        var b = 12; // Should *not* get an SSA definition
+        var b = 12; // Should *not* get an SSA definition, but currently does because it is considered live via the lambda
         void M2()
         {
             b = 0;
@@ -155,7 +155,7 @@ class Capture
         Use(f);
         void M6()
         {
-            f = 0; // Should *not* get an SSA definition (`f` is not read after `M6` is called)
+            f = 0; // Should *not* get an SSA definition (`f` is not read after `M6` is called), but currently does because it is considered live via the call to `M6`
         }
         M6();
 
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
index b740f89e91b..ab31244d07b 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
@@ -77,7 +77,7 @@ query predicate phiInconsistency(
         edef = phi.getAnUltimateDefinition()
       |
         edef.getADefinition() = adef and
-        phi.definesAt(bb, _) and
+        phi.definesAt(_, bb, _) and
         cfe = bb.getFirstNode().getElement()
       )
     )
@@ -88,7 +88,7 @@ query predicate phiInconsistency(
     |
       edef = phi.getAnUltimateDefinition() and
       edef.getADefinition() = adef and
-      phi.definesAt(bb, _) and
+      phi.definesAt(_, bb, _) and
       cfe = bb.getFirstNode().getElement() and
       not exists(PreSsa::Definition def |
         adef = def.getAPhiInput+().getDefinition() and
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
index 8d5a2db71ab..bf944248e67 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDef.expected
@@ -49,10 +49,12 @@
 | Capture.cs:94:13:94:13 | y | Capture.cs:94:13:94:18 | SSA def(y) |
 | Capture.cs:94:13:94:13 | y | Capture.cs:96:12:100:9 | SSA capture def(y) |
 | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) |
+| Capture.cs:102:13:102:13 | z | Capture.cs:102:13:102:18 | SSA def(z) |
 | Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) |
 | Capture.cs:114:13:114:13 | a | Capture.cs:114:13:114:18 | SSA def(a) |
 | Capture.cs:114:13:114:13 | a | Capture.cs:115:9:119:9 | SSA capture def(a) |
 | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) |
+| Capture.cs:122:13:122:13 | b | Capture.cs:122:13:122:18 | SSA def(b) |
 | Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:130:13:130:18 | SSA def(c) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) |
@@ -62,6 +64,7 @@
 | Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) |
 | Capture.cs:147:13:147:13 | e | Capture.cs:148:9:152:9 | SSA capture def(e) |
 | Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) |
+| Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) |
 | Capture.cs:162:13:162:13 | g | Capture.cs:163:9:166:9 | SSA capture def(g) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | SSA def(h) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) |
@@ -218,9 +221,9 @@
 | Fields.cs:107:33:107:33 | f | Fields.cs:107:33:107:33 | SSA param(f) |
 | Fields.cs:115:20:115:29 | this.Field | Fields.cs:109:10:109:10 | SSA entry def(this.Field) |
 | Fields.cs:115:20:115:29 | this.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field) |
-| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) |
+| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) |
 | Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) |
-| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) |
+| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) |
 | Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) |
 | OutRef.cs:9:13:9:13 | j | OutRef.cs:9:13:9:17 | SSA def(j) |
 | OutRef.cs:9:13:9:13 | j | OutRef.cs:10:32:10:32 | SSA def(j) |
@@ -299,9 +302,9 @@
 | Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | SSA param(p) |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) |
-| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) |
+| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) |
 | Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) |
-| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) |
+| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) |
 | Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) |
 | Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected
index a5971b9070d..a259546f403 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefElement.expected
@@ -49,10 +49,12 @@
 | Capture.cs:94:13:94:18 | SSA def(y) | Capture.cs:94:13:94:18 | Int32 y = ... |
 | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:96:12:100:9 | (...) => ... |
 | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:98:17:98:21 | Int32 x = ... |
+| Capture.cs:102:13:102:18 | SSA def(z) | Capture.cs:102:13:102:18 | Int32 z = ... |
 | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:105:13:105:17 | ... = ... |
 | Capture.cs:114:13:114:18 | SSA def(a) | Capture.cs:114:13:114:18 | Int32 a = ... |
 | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:115:9:119:9 | M1 |
 | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:117:17:117:21 | Int32 x = ... |
+| Capture.cs:122:13:122:18 | SSA def(b) | Capture.cs:122:13:122:18 | Int32 b = ... |
 | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:125:13:125:17 | ... = ... |
 | Capture.cs:130:13:130:18 | SSA def(c) | Capture.cs:130:13:130:18 | Int32 c = ... |
 | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:133:13:133:17 | ... = ... |
@@ -62,6 +64,7 @@
 | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:144:9:144:12 | call to local function M4 |
 | Capture.cs:148:9:152:9 | SSA capture def(e) | Capture.cs:148:9:152:9 | M5 |
 | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:154:13:154:18 | Int32 f = ... |
+| Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:158:13:158:17 | ... = ... |
 | Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:163:9:166:9 | M7 |
 | Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:171:13:171:17 | ... = ... |
 | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:174:17:174:21 | ... = ... |
@@ -206,8 +209,6 @@
 | Fields.cs:102:9:102:28 | SSA def(this.Field) | Fields.cs:102:9:102:28 | ... = ... |
 | Fields.cs:107:33:107:33 | SSA param(f) | Fields.cs:107:33:107:33 | f |
 | Fields.cs:109:10:109:10 | SSA entry def(this.Field) | Fields.cs:109:10:109:10 | K |
-| Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) | Fields.cs:109:10:109:10 | K |
-| Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | K |
 | Fields.cs:114:9:114:22 | SSA call def(this.Field) | Fields.cs:114:9:114:22 | call to method SetField |
 | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:114:9:114:22 | call to method SetField |
 | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:114:9:114:22 | call to method SetField |
@@ -281,8 +282,6 @@
 | Properties.cs:85:24:85:46 | SSA capture def(b) | Properties.cs:85:24:85:46 | (...) => ... |
 | Properties.cs:106:37:106:37 | SSA param(p) | Properties.cs:106:37:106:37 | p |
 | Properties.cs:108:10:108:10 | SSA entry def(this.Props) | Properties.cs:108:10:108:10 | K |
-| Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) | Properties.cs:108:10:108:10 | K |
-| Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | K |
 | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:113:9:113:22 | call to method SetProps |
 | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:113:9:113:22 | call to method SetProps |
 | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:113:9:113:22 | call to method SetProps |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected
index 6f5c8a4238b..45f023ec4ef 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaExplicitDef.expected
@@ -33,15 +33,18 @@
 | Capture.cs:92:18:92:18 | d | Capture.cs:92:18:92:18 | SSA param(d) | Capture.cs:92:18:92:18 | d |
 | Capture.cs:94:13:94:13 | y | Capture.cs:94:13:94:18 | SSA def(y) | Capture.cs:94:13:94:18 | Int32 y = ... |
 | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:98:17:98:21 | Int32 x = ... |
+| Capture.cs:102:13:102:13 | z | Capture.cs:102:13:102:18 | SSA def(z) | Capture.cs:102:13:102:18 | Int32 z = ... |
 | Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:105:13:105:17 | ... = ... |
 | Capture.cs:114:13:114:13 | a | Capture.cs:114:13:114:18 | SSA def(a) | Capture.cs:114:13:114:18 | Int32 a = ... |
 | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:117:17:117:21 | Int32 x = ... |
+| Capture.cs:122:13:122:13 | b | Capture.cs:122:13:122:18 | SSA def(b) | Capture.cs:122:13:122:18 | Int32 b = ... |
 | Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:125:13:125:17 | ... = ... |
 | Capture.cs:130:13:130:13 | c | Capture.cs:130:13:130:18 | SSA def(c) | Capture.cs:130:13:130:18 | Int32 c = ... |
 | Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:133:13:133:17 | ... = ... |
 | Capture.cs:139:13:139:13 | d | Capture.cs:139:13:139:18 | SSA def(d) | Capture.cs:139:13:139:18 | Int32 d = ... |
 | Capture.cs:139:13:139:13 | d | Capture.cs:142:13:142:17 | SSA def(d) | Capture.cs:142:13:142:17 | ... = ... |
 | Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:154:13:154:18 | Int32 f = ... |
+| Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:158:13:158:17 | ... = ... |
 | Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:171:13:171:17 | ... = ... |
 | Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:174:17:174:21 | ... = ... |
 | Capture.cs:182:17:182:17 | i | Capture.cs:182:17:182:21 | SSA def(i) | Capture.cs:182:17:182:21 | Int32 i = ... |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitQualifier.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitQualifier.expected
index 2b3febca122..c64c419cb48 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitQualifier.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaImplicitQualifier.expected
@@ -4,8 +4,12 @@
 | Fields.cs:98:20:98:32 | f.Field.Field | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field) | Fields.cs:97:9:97:30 | SSA def(f.Field) |
 | Fields.cs:99:16:99:34 | f.Field.Field.Field | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field) | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field) |
 | Fields.cs:100:16:100:40 | f.Field.Field.Field.Field | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field.Field) | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field) |
+| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field) |
+| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) |
 | Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) |
 | OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:18:13:18:28 | SSA qualifier def(t.Field) | OutRef.cs:18:13:18:28 | SSA def(t) |
 | Properties.cs:31:19:31:22 | f.xs | Properties.cs:30:13:30:32 | SSA qualifier def(f.xs) | Properties.cs:30:13:30:32 | SSA def(f) |
 | Properties.cs:31:19:31:22 | f.xs | Properties.cs:49:13:49:32 | SSA qualifier def(f.xs) | Properties.cs:49:13:49:32 | SSA def(f) |
+| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
+| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) |
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
index 2d9f6d5e58d..f3bb6f1461d 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaUltimateDef.expected
@@ -56,10 +56,12 @@
 | Capture.cs:94:13:94:13 | y | Capture.cs:94:13:94:18 | SSA def(y) | Capture.cs:94:13:94:18 | SSA def(y) |
 | Capture.cs:94:13:94:13 | y | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:96:12:100:9 | SSA capture def(y) |
 | Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:98:17:98:21 | SSA def(x) |
+| Capture.cs:102:13:102:13 | z | Capture.cs:102:13:102:18 | SSA def(z) | Capture.cs:102:13:102:18 | SSA def(z) |
 | Capture.cs:102:13:102:13 | z | Capture.cs:105:13:105:17 | SSA def(z) | Capture.cs:105:13:105:17 | SSA def(z) |
 | Capture.cs:114:13:114:13 | a | Capture.cs:114:13:114:18 | SSA def(a) | Capture.cs:114:13:114:18 | SSA def(a) |
 | Capture.cs:114:13:114:13 | a | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:115:9:119:9 | SSA capture def(a) |
 | Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:117:17:117:21 | SSA def(x) |
+| Capture.cs:122:13:122:13 | b | Capture.cs:122:13:122:18 | SSA def(b) | Capture.cs:122:13:122:18 | SSA def(b) |
 | Capture.cs:122:13:122:13 | b | Capture.cs:125:13:125:17 | SSA def(b) | Capture.cs:125:13:125:17 | SSA def(b) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:130:13:130:18 | SSA def(c) | Capture.cs:130:13:130:18 | SSA def(c) |
 | Capture.cs:130:13:130:13 | c | Capture.cs:133:13:133:17 | SSA def(c) | Capture.cs:133:13:133:17 | SSA def(c) |
@@ -71,6 +73,7 @@
 | Capture.cs:139:13:139:13 | d | Capture.cs:144:9:144:12 | SSA call def(d) | Capture.cs:144:9:144:12 | SSA call def(d) |
 | Capture.cs:147:13:147:13 | e | Capture.cs:148:9:152:9 | SSA capture def(e) | Capture.cs:148:9:152:9 | SSA capture def(e) |
 | Capture.cs:154:13:154:13 | f | Capture.cs:154:13:154:18 | SSA def(f) | Capture.cs:154:13:154:18 | SSA def(f) |
+| Capture.cs:154:13:154:13 | f | Capture.cs:158:13:158:17 | SSA def(f) | Capture.cs:158:13:158:17 | SSA def(f) |
 | Capture.cs:162:13:162:13 | g | Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:163:9:166:9 | SSA capture def(g) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:171:13:171:17 | SSA def(h) | Capture.cs:171:13:171:17 | SSA def(h) |
 | Capture.cs:168:13:168:13 | h | Capture.cs:174:17:174:21 | SSA def(h) | Capture.cs:174:17:174:21 | SSA def(h) |
@@ -275,11 +278,11 @@
 | Fields.cs:115:20:115:29 | this.Field | Fields.cs:109:10:109:10 | SSA entry def(this.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field) |
 | Fields.cs:115:20:115:29 | this.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field) |
 | Fields.cs:115:20:115:29 | this.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field) | Fields.cs:114:9:114:22 | SSA call def(this.Field) |
-| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) |
-| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field) |
+| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) |
+| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field) |
 | Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) |
-| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) |
-| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA entry def(this.Field.Field.xs) |
+| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) |
+| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:109:10:109:10 | SSA qualifier def(this.Field.Field.xs) |
 | Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) |
 | OutRef.cs:9:13:9:13 | j | OutRef.cs:9:13:9:17 | SSA def(j) | OutRef.cs:9:13:9:17 | SSA def(j) |
 | OutRef.cs:9:13:9:13 | j | OutRef.cs:10:32:10:32 | SSA def(j) | OutRef.cs:10:32:10:32 | SSA def(j) |
@@ -396,11 +399,11 @@
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props) |
 | Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:113:9:113:22 | SSA call def(this.Props) |
-| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) |
-| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props) |
+| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) |
+| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props) |
 | Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) |
-| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) |
-| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA entry def(this.Props.Props.xs) |
+| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) |
+| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:108:10:108:10 | SSA qualifier def(this.Props.Props.xs) |
 | Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) |
 | Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:3:18:3:18 | SSA param(b) |
 | Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) |
diff --git a/csharp/ql/test/query-tests/Dead Code/DeadStoreOfLocal/DeadStoreOfLocal.cs b/csharp/ql/test/query-tests/Dead Code/DeadStoreOfLocal/DeadStoreOfLocal.cs
index b787401f941..64f903f80ea 100644
--- a/csharp/ql/test/query-tests/Dead Code/DeadStoreOfLocal/DeadStoreOfLocal.cs	
+++ b/csharp/ql/test/query-tests/Dead Code/DeadStoreOfLocal/DeadStoreOfLocal.cs	
@@ -194,7 +194,7 @@ public class Captured
 
     void M2()
     {
-        var x = M6(); // BAD
+        var x = M6(); // BAD [FALSE NEGATIVE]
         Action a = () =>
         {
             x = 1; // GOOD
@@ -208,7 +208,7 @@ public class Captured
         int x;
         Action a = () =>
         {
-            x = 1; // BAD
+            x = 1; // BAD [FALSE NEGATIVE]
         };
         a();
     }
diff --git a/csharp/ql/test/query-tests/Dead Code/DeadStoreOfLocal/DeadStoreOfLocal.expected b/csharp/ql/test/query-tests/Dead Code/DeadStoreOfLocal/DeadStoreOfLocal.expected
index 9720249c28d..9fe67ecf854 100644
--- a/csharp/ql/test/query-tests/Dead Code/DeadStoreOfLocal/DeadStoreOfLocal.expected	
+++ b/csharp/ql/test/query-tests/Dead Code/DeadStoreOfLocal/DeadStoreOfLocal.expected	
@@ -7,8 +7,6 @@
 | DeadStoreOfLocal.cs:101:13:101:37 | ... = ... | This assignment to $@ is useless, since its value is never read. | DeadStoreOfLocal.cs:94:40:94:44 | extra | extra |
 | DeadStoreOfLocal.cs:104:13:104:37 | ... = ... | This assignment to $@ is useless, since its value is never read. | DeadStoreOfLocal.cs:94:16:94:20 | info1 | info1 |
 | DeadStoreOfLocal.cs:142:26:142:27 | Exception ex | This assignment to $@ is useless, since its value is never read. | DeadStoreOfLocal.cs:142:26:142:27 | ex | ex |
-| DeadStoreOfLocal.cs:197:13:197:20 | Int32 x = ... | This assignment to $@ is useless, since its value is never read. | DeadStoreOfLocal.cs:197:13:197:13 | x | x |
-| DeadStoreOfLocal.cs:211:13:211:17 | ... = ... | This assignment to $@ is useless, since its value is never read. | DeadStoreOfLocal.cs:208:13:208:13 | x | x |
 | DeadStoreOfLocal.cs:246:17:246:24 | Int32 y = ... | This assignment to $@ is useless, since its value is never read. | DeadStoreOfLocal.cs:246:17:246:17 | y | y |
 | DeadStoreOfLocal.cs:261:17:261:21 | Int32 x = ... | This assignment to $@ is useless, since its value is never read. | DeadStoreOfLocal.cs:261:17:261:17 | x | x |
 | DeadStoreOfLocal.cs:289:23:289:28 | Object v1 | This assignment to $@ is useless, since its value is never read. | DeadStoreOfLocal.cs:289:27:289:28 | v1 | v1 |

From 056dbe31d59d8c93ee3c48cf85efe483f0dc416d Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 7 Jan 2021 13:40:44 +0100
Subject: [PATCH 055/343] C#: Remove throw completion from StringLiteral

---
 .../controlflow/internal/Completion.qll       |   3 -
 .../controlflow/graph/BasicBlock.expected     |  46 +--
 .../controlflow/graph/Condition.expected      |  46 +--
 .../controlflow/graph/Dominance.expected      | 286 ++----------------
 .../graph/EnclosingCallable.expected          |  70 -----
 .../controlflow/graph/ExitElement.expected    |  51 ----
 .../controlflow/graph/NodeGraph.expected      |  57 ----
 .../controlflow/graph/Nodes.expected          |  28 --
 .../exceptions/Exceptions1.expected           |   1 -
 9 files changed, 38 insertions(+), 550 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
index 34cc23791e0..8f61d0f7c25 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
@@ -354,9 +354,6 @@ private class TriedControlFlowElement extends ControlFlowElement {
     or
     this instanceof DynamicExpr and
     result instanceof SystemExceptionClass
-    or
-    this instanceof StringLiteral and
-    result instanceof SystemOutOfMemoryExceptionClass
   }
 
   private CoreLib getCoreLibFromACatchClause() {
diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
index 47ab064fe76..d9fc6b0c1f6 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
@@ -418,47 +418,35 @@
 | Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | exit ToBool | 8 |
 | Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | exit CallToInt32 | 5 |
 | Extensions.cs:20:17:20:20 | enter Main | Extensions.cs:20:17:20:20 | exit Main | 20 |
-| Finally.cs:7:10:7:11 | enter M1 | Finally.cs:11:31:11:36 | "Try1" | 6 |
+| Finally.cs:7:10:7:11 | enter M1 | Finally.cs:11:13:11:37 | call to method WriteLine | 7 |
 | Finally.cs:7:10:7:11 | exit M1 | Finally.cs:7:10:7:11 | exit M1 | 1 |
-| Finally.cs:7:10:7:11 | exit M1 (abnormal) | Finally.cs:7:10:7:11 | exit M1 (abnormal) | 1 |
-| Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:11:13:11:37 | call to method WriteLine | 1 |
-| Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} | Finally.cs:15:13:15:40 | [finally: exception(Exception)] call to method WriteLine | 4 |
-| Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:15:13:15:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | 4 |
+| Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} | Finally.cs:7:10:7:11 | exit M1 (abnormal) | 5 |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:7:10:7:11 | exit M1 (normal) | 5 |
-| Finally.cs:19:10:19:11 | enter M2 | Finally.cs:23:31:23:36 | "Try2" | 6 |
+| Finally.cs:19:10:19:11 | enter M2 | Finally.cs:23:13:23:37 | call to method WriteLine | 7 |
 | Finally.cs:19:10:19:11 | exit M2 | Finally.cs:19:10:19:11 | exit M2 | 1 |
 | Finally.cs:19:10:19:11 | exit M2 (abnormal) | Finally.cs:19:10:19:11 | exit M2 (abnormal) | 1 |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:19:10:19:11 | exit M2 (normal) | 1 |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:23:13:23:37 | call to method WriteLine | 1 |
 | Finally.cs:24:13:24:19 | return ...; | Finally.cs:50:13:50:40 | [finally: return] call to method WriteLine | 5 |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | 1 |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | 1 |
 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | Finally.cs:26:48:26:51 | [exception: Exception] true | 2 |
 | Finally.cs:27:9:29:9 | {...} | Finally.cs:50:13:50:40 | [finally: exception(IOException)] call to method WriteLine | 6 |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | 1 |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | 1 |
 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | Finally.cs:34:21:34:24 | true | 6 |
 | Finally.cs:34:27:34:32 | throw ...; | Finally.cs:50:13:50:40 | [finally: exception(Exception)] call to method WriteLine | 9 |
 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | 1 |
-| Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | 1 |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:50:13:50:40 | call to method WriteLine | 5 |
-| Finally.cs:54:10:54:11 | enter M3 | Finally.cs:58:31:58:36 | "Try3" | 6 |
+| Finally.cs:54:10:54:11 | enter M3 | Finally.cs:58:13:58:37 | call to method WriteLine | 7 |
 | Finally.cs:54:10:54:11 | exit M3 | Finally.cs:54:10:54:11 | exit M3 | 1 |
 | Finally.cs:54:10:54:11 | exit M3 (abnormal) | Finally.cs:54:10:54:11 | exit M3 (abnormal) | 1 |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:54:10:54:11 | exit M3 (normal) | 1 |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:58:13:58:37 | call to method WriteLine | 1 |
 | Finally.cs:59:13:59:19 | return ...; | Finally.cs:70:13:70:40 | [finally: return] call to method WriteLine | 5 |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | 1 |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | 1 |
 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | Finally.cs:61:48:61:51 | [exception: Exception] true | 2 |
 | Finally.cs:62:9:64:9 | {...} | Finally.cs:70:13:70:40 | [finally: exception(IOException)] call to method WriteLine | 6 |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | 1 |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | 1 |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... | 5 |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... | 5 |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:70:13:70:40 | call to method WriteLine | 5 |
 | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | Finally.cs:70:13:70:40 | [finally: exception(Exception)] call to method WriteLine | 4 |
-| Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:70:13:70:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | 4 |
 | Finally.cs:74:10:74:11 | enter M4 | Finally.cs:77:9:100:9 | while (...) ... | 6 |
 | Finally.cs:74:10:74:11 | exit M4 | Finally.cs:74:10:74:11 | exit M4 | 1 |
 | Finally.cs:74:10:74:11 | exit M4 (abnormal) | Finally.cs:74:10:74:11 | exit M4 (abnormal) | 1 |
@@ -528,11 +516,9 @@
 | Finally.cs:117:17:117:37 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:117:17:117:36 | [finally: exception(OutOfMemoryException)] call to method WriteLine | 3 |
 | Finally.cs:117:17:117:37 | [finally: return] ...; | Finally.cs:117:17:117:36 | [finally: return] call to method WriteLine | 3 |
 | Finally.cs:121:10:121:11 | enter M6 | Finally.cs:121:10:121:11 | exit M6 | 12 |
-| Finally.cs:133:10:133:11 | enter M7 | Finally.cs:137:31:137:35 | "Try" | 6 |
+| Finally.cs:133:10:133:11 | enter M7 | Finally.cs:137:13:137:36 | call to method WriteLine | 7 |
 | Finally.cs:133:10:133:11 | exit M7 (abnormal) | Finally.cs:133:10:133:11 | exit M7 | 2 |
-| Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:137:13:137:36 | call to method WriteLine | 1 |
 | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} | Finally.cs:141:13:141:44 | [finally: exception(Exception)] throw ...; | 4 |
-| Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:141:13:141:44 | [finally: exception(OutOfMemoryException)] throw ...; | 4 |
 | Finally.cs:140:9:143:9 | {...} | Finally.cs:141:13:141:44 | throw ...; | 4 |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:151:17:151:28 | ... == ... | 8 |
 | Finally.cs:147:10:147:11 | exit M8 | Finally.cs:147:10:147:11 | exit M8 | 1 |
@@ -548,30 +534,21 @@
 | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; | 1 |
 | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; | 1 |
 | Finally.cs:159:21:159:45 | throw ...; | Finally.cs:159:21:159:45 | throw ...; | 1 |
-| Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | 1 |
-| Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | 1 |
-| Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:27:159:44 | object creation of type Exception | 1 |
-| Finally.cs:159:41:159:43 | "1" | Finally.cs:159:41:159:43 | "1" | 1 |
-| Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | 1 |
-| Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | 1 |
+| Finally.cs:159:41:159:43 | "1" | Finally.cs:159:27:159:44 | object creation of type Exception | 2 |
+| Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | 2 |
+| Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | 2 |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | 1 |
 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | 1 |
-| Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | 1 |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | 1 |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | 1 |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | 1 |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | 1 |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | 1 |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | 1 |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:161:39:161:54 | [exception: Exception] ... == ... | 5 |
 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | Finally.cs:161:39:161:54 | [exception: NullReferenceException] ... == ... | 5 |
-| Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | Finally.cs:161:39:161:54 | [exception: OutOfMemoryException] ... == ... | 5 |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... | 5 |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... | 5 |
-| Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... | 5 |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... | 5 |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... | 5 |
-| Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... | 5 |
 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | Finally.cs:163:17:163:42 | [finally: exception(ArgumentNullException)] call to method WriteLine | 6 |
 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | Finally.cs:163:17:163:42 | [finally: exception(Exception)] call to method WriteLine | 6 |
 | Finally.cs:162:13:164:13 | {...} | Finally.cs:163:17:163:42 | call to method WriteLine | 6 |
@@ -637,8 +614,7 @@
 | Finally.cs:211:13:211:29 | ...; | Finally.cs:195:10:195:12 | exit M10 (normal) | 9 |
 | Finally.cs:211:13:211:29 | [finally: exception(Exception)] ...; | Finally.cs:211:13:211:28 | [finally: exception(Exception)] ... = ... | 4 |
 | Finally.cs:211:13:211:29 | [finally: exception(ExceptionA)] ...; | Finally.cs:211:13:211:28 | [finally: exception(ExceptionA)] ... = ... | 4 |
-| Finally.cs:216:10:216:12 | enter M11 | Finally.cs:220:31:220:35 | "Try" | 6 |
-| Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:220:13:220:36 | call to method WriteLine | 1 |
+| Finally.cs:216:10:216:12 | enter M11 | Finally.cs:220:13:220:36 | call to method WriteLine | 7 |
 | Finally.cs:222:9:225:9 | catch {...} | Finally.cs:224:13:224:38 | call to method WriteLine | 5 |
 | Finally.cs:227:9:229:9 | {...} | Finally.cs:216:10:216:12 | exit M11 | 9 |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:239:21:239:22 | access to parameter b1 | 8 |
@@ -659,11 +635,9 @@
 | Finally.cs:250:17:252:17 | [finally: exception(Exception)] {...} | Finally.cs:251:21:251:54 | [finally: exception(Exception)] call to method WriteLine | 4 |
 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA), finally(1): exception(Exception)] {...} | Finally.cs:251:21:251:54 | [finally: exception(ExceptionA), finally(1): exception(Exception)] call to method WriteLine | 4 |
 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA)] {...} | Finally.cs:251:21:251:54 | [finally: exception(ExceptionA)] call to method WriteLine | 4 |
-| Finally.cs:250:17:252:17 | {...} | Finally.cs:254:31:254:43 | "Mid finally" | 6 |
-| Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:254:13:254:44 | call to method WriteLine | 1 |
+| Finally.cs:250:17:252:17 | {...} | Finally.cs:254:13:254:44 | call to method WriteLine | 7 |
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:258:13:258:46 | [finally: exception(Exception)] call to method WriteLine | 4 |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:258:13:258:46 | [finally: exception(ExceptionA)] call to method WriteLine | 4 |
-| Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:258:13:258:46 | [finally: exception(OutOfMemoryException)] call to method WriteLine | 4 |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:233:10:233:12 | exit M12 (normal) | 8 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:8:29:8:32 | access to parameter args | 3 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | exit M1 | 2 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
index 9be08ab1041..3f1653363c8 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
@@ -1326,27 +1326,25 @@ conditionBlock
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | false |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:34:27:34:32 | throw ...; | false |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | false |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | false |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | false |
+| Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:42:9:43:9 | {...} | false |
 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | Finally.cs:27:9:29:9 | {...} | true |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | true |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:34:27:34:32 | throw ...; | true |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | false |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | false |
+| Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:42:9:43:9 | {...} | false |
 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | Finally.cs:34:27:34:32 | throw ...; | true |
+| Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:42:9:43:9 | {...} | true |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | true |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:62:9:64:9 | {...} | true |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | false |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | false |
+| Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:66:9:67:9 | {...} | false |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | false |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | false |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | false |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | false |
 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | Finally.cs:62:9:64:9 | {...} | true |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | true |
+| Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:66:9:67:9 | {...} | true |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | true |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | true |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | true |
+| Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:66:9:67:9 | {...} | true |
 | Finally.cs:77:16:77:16 | access to local variable i | Finally.cs:74:10:74:11 | exit M4 (abnormal) | true |
 | Finally.cs:77:16:77:16 | access to local variable i | Finally.cs:78:9:100:9 | {...} | true |
 | Finally.cs:77:16:77:16 | access to local variable i | Finally.cs:82:21:82:27 | return ...; | true |
@@ -1507,30 +1505,21 @@ conditionBlock
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:21:159:45 | throw ...; | false |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | true |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | true |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:27:159:44 | object creation of type Exception | false |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:41:159:43 | "1" | false |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | false |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | false |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | false |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | true |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | true |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | false |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | false |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | false |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | true |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | true |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:162:13:164:13 | {...} | false |
@@ -1538,29 +1527,17 @@ conditionBlock
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:165:13:168:13 | [finally: exception(Exception)] catch {...} | true |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:165:13:168:13 | catch {...} | false |
 | Finally.cs:158:36:158:36 | 1 | Finally.cs:159:21:159:45 | throw ...; | true |
-| Finally.cs:158:36:158:36 | 1 | Finally.cs:159:27:159:44 | object creation of type Exception | true |
 | Finally.cs:158:36:158:36 | 1 | Finally.cs:159:41:159:43 | "1" | true |
-| Finally.cs:158:36:158:36 | 1 | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | true |
-| Finally.cs:158:36:158:36 | 1 | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | true |
 | Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; | true |
-| Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | true |
 | Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | true |
-| Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | true |
-| Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | true |
 | Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; | true |
-| Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | true |
 | Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | true |
-| Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | true |
-| Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | true |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | true |
 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | true |
-| Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | true |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | true |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | true |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | true |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | true |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | true |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | true |
 | Finally.cs:176:10:176:11 | enter M9 | Finally.cs:176:10:176:11 | exit M9 (normal) | false |
 | Finally.cs:176:10:176:11 | enter M9 | Finally.cs:180:21:180:43 | [b1 (line 176): true] throw ...; | true |
 | Finally.cs:176:10:176:11 | enter M9 | Finally.cs:180:27:180:42 | [b1 (line 176): true] object creation of type ExceptionA | true |
@@ -1694,8 +1671,6 @@ conditionBlock
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA), finally(1): exception(Exception)] {...} | true |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA)] {...} | true |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:250:17:252:17 | {...} | false |
-| Finally.cs:233:10:233:12 | enter M12 | Finally.cs:254:13:254:44 | call to method WriteLine | false |
-| Finally.cs:233:10:233:12 | enter M12 | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | false |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:257:9:259:9 | {...} | false |
 | Finally.cs:240:21:240:43 | throw ...; | Finally.cs:247:25:247:47 | [finally: exception(ExceptionA)] throw ...; | true |
 | Finally.cs:240:21:240:43 | throw ...; | Finally.cs:247:31:247:46 | [finally: exception(ExceptionA)] object creation of type ExceptionA | true |
@@ -1709,8 +1684,6 @@ conditionBlock
 | Finally.cs:243:13:253:13 | {...} | Finally.cs:247:31:247:46 | object creation of type ExceptionA | true |
 | Finally.cs:243:13:253:13 | {...} | Finally.cs:250:17:252:17 | [finally(1): exception(Exception)] {...} | true |
 | Finally.cs:243:13:253:13 | {...} | Finally.cs:250:17:252:17 | {...} | false |
-| Finally.cs:243:13:253:13 | {...} | Finally.cs:254:13:254:44 | call to method WriteLine | false |
-| Finally.cs:243:13:253:13 | {...} | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | false |
 | Finally.cs:243:13:253:13 | {...} | Finally.cs:257:9:259:9 | {...} | false |
 | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | Foreach.cs:6:10:6:11 | exit M1 (normal) | true |
 | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | Foreach.cs:8:22:8:24 | String arg | false |
@@ -2594,7 +2567,6 @@ conditionFlow
 | Finally.cs:34:21:34:24 | true | Finally.cs:34:27:34:32 | throw ...; | true |
 | Finally.cs:61:48:61:51 | [exception: Exception] true | Finally.cs:62:9:64:9 | {...} | true |
 | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... | Finally.cs:66:9:67:9 | {...} | true |
-| Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... | Finally.cs:66:9:67:9 | {...} | true |
 | Finally.cs:77:16:77:20 | ... > ... | Finally.cs:74:10:74:11 | exit M4 (normal) | false |
 | Finally.cs:77:16:77:20 | ... > ... | Finally.cs:78:9:100:9 | {...} | true |
 | Finally.cs:81:21:81:26 | ... == ... | Finally.cs:82:21:82:27 | return ...; | true |
@@ -2651,20 +2623,14 @@ conditionFlow
 | Finally.cs:161:39:161:54 | [exception: Exception] ... == ... | Finally.cs:165:13:168:13 | catch {...} | false |
 | Finally.cs:161:39:161:54 | [exception: NullReferenceException] ... == ... | Finally.cs:162:13:164:13 | {...} | true |
 | Finally.cs:161:39:161:54 | [exception: NullReferenceException] ... == ... | Finally.cs:165:13:168:13 | catch {...} | false |
-| Finally.cs:161:39:161:54 | [exception: OutOfMemoryException] ... == ... | Finally.cs:162:13:164:13 | {...} | true |
-| Finally.cs:161:39:161:54 | [exception: OutOfMemoryException] ... == ... | Finally.cs:165:13:168:13 | catch {...} | false |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | true |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(ArgumentNullException)] catch {...} | false |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | true |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(ArgumentNullException)] catch {...} | false |
-| Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | true |
-| Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(ArgumentNullException)] catch {...} | false |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | true |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(Exception)] catch {...} | false |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | true |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(Exception)] catch {...} | false |
-| Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | true |
-| Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(Exception)] catch {...} | false |
 | Finally.cs:180:17:180:18 | access to parameter b1 | Finally.cs:180:27:180:42 | [b1 (line 176): true] object creation of type ExceptionA | true |
 | Finally.cs:180:17:180:18 | access to parameter b1 | Finally.cs:183:9:192:9 | [b1 (line 176): false] {...} | false |
 | Finally.cs:186:21:186:22 | [b1 (line 176): false] access to parameter b2 | Finally.cs:176:10:176:11 | exit M9 (normal) | false |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
index 64faed12b0c..b9f51a64281 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
@@ -1688,17 +1688,14 @@ dominance
 | Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:14:9:16:9 | {...} |
 | Finally.cs:11:13:11:38 | ...; | Finally.cs:11:31:11:36 | "Try1" |
 | Finally.cs:11:31:11:36 | "Try1" | Finally.cs:11:13:11:37 | call to method WriteLine |
-| Finally.cs:11:31:11:36 | "Try1" | Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} | Finally.cs:15:13:15:41 | [finally: exception(Exception)] ...; |
-| Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:15:13:15:41 | [finally: exception(OutOfMemoryException)] ...; |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:15:13:15:41 | ...; |
+| Finally.cs:15:13:15:40 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:7:10:7:11 | exit M1 (abnormal) |
 | Finally.cs:15:13:15:40 | call to method WriteLine | Finally.cs:7:10:7:11 | exit M1 (normal) |
 | Finally.cs:15:13:15:41 | ...; | Finally.cs:15:31:15:39 | "Finally" |
 | Finally.cs:15:13:15:41 | [finally: exception(Exception)] ...; | Finally.cs:15:31:15:39 | [finally: exception(Exception)] "Finally" |
-| Finally.cs:15:13:15:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:15:31:15:39 | [finally: exception(OutOfMemoryException)] "Finally" |
 | Finally.cs:15:31:15:39 | "Finally" | Finally.cs:15:13:15:40 | call to method WriteLine |
 | Finally.cs:15:31:15:39 | [finally: exception(Exception)] "Finally" | Finally.cs:15:13:15:40 | [finally: exception(Exception)] call to method WriteLine |
-| Finally.cs:15:31:15:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:15:13:15:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:20:5:52:5 | {...} |
 | Finally.cs:20:5:52:5 | {...} | Finally.cs:21:9:51:9 | try {...} ... |
 | Finally.cs:21:9:51:9 | try {...} ... | Finally.cs:22:9:25:9 | {...} |
@@ -1707,18 +1704,15 @@ dominance
 | Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:23:13:23:38 | ...; | Finally.cs:23:31:23:36 | "Try2" |
 | Finally.cs:23:31:23:36 | "Try2" | Finally.cs:23:13:23:37 | call to method WriteLine |
-| Finally.cs:23:31:23:36 | "Try2" | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:24:13:24:19 | return ...; | Finally.cs:49:9:51:9 | [finally: return] {...} |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | Finally.cs:26:48:26:51 | [exception: Exception] true |
 | Finally.cs:26:48:26:51 | [exception: Exception] true | Finally.cs:27:9:29:9 | {...} |
 | Finally.cs:27:9:29:9 | {...} | Finally.cs:28:13:28:18 | throw ...; |
 | Finally.cs:28:13:28:18 | throw ...; | Finally.cs:49:9:51:9 | [finally: exception(IOException)] {...} |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | Finally.cs:31:9:40:9 | {...} |
 | Finally.cs:31:9:40:9 | {...} | Finally.cs:32:13:39:13 | try {...} ... |
 | Finally.cs:32:13:39:13 | try {...} ... | Finally.cs:33:13:35:13 | {...} |
@@ -1730,6 +1724,7 @@ dominance
 | Finally.cs:38:17:38:44 | [finally: exception(ArgumentException)] throw ...; | Finally.cs:49:9:51:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:38:23:38:43 | [finally: exception(ArgumentException)] object creation of type Exception | Finally.cs:38:17:38:44 | [finally: exception(ArgumentException)] throw ...; |
 | Finally.cs:38:37:38:42 | [finally: exception(ArgumentException)] "Boo!" | Finally.cs:38:23:38:43 | [finally: exception(ArgumentException)] object creation of type Exception |
+| Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:42:9:43:9 | {...} |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:49:9:51:9 | {...} |
 | Finally.cs:49:9:51:9 | [finally: exception(Exception)] {...} | Finally.cs:50:13:50:41 | [finally: exception(Exception)] ...; |
 | Finally.cs:49:9:51:9 | [finally: exception(IOException)] {...} | Finally.cs:50:13:50:41 | [finally: exception(IOException)] ...; |
@@ -1751,42 +1746,32 @@ dominance
 | Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:58:13:58:38 | ...; | Finally.cs:58:31:58:36 | "Try3" |
 | Finally.cs:58:31:58:36 | "Try3" | Finally.cs:58:13:58:37 | call to method WriteLine |
-| Finally.cs:58:31:58:36 | "Try3" | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:59:13:59:19 | return ...; | Finally.cs:69:9:71:9 | [finally: return] {...} |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | Finally.cs:61:48:61:51 | [exception: Exception] true |
 | Finally.cs:61:48:61:51 | [exception: Exception] true | Finally.cs:62:9:64:9 | {...} |
 | Finally.cs:62:9:64:9 | {...} | Finally.cs:63:13:63:18 | throw ...; |
 | Finally.cs:63:13:63:18 | throw ...; | Finally.cs:69:9:71:9 | [finally: exception(IOException)] {...} |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:65:35:65:35 | [exception: Exception] access to local variable e |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:65:35:65:35 | [exception: OutOfMemoryException] access to local variable e |
 | Finally.cs:65:35:65:35 | [exception: Exception] access to local variable e | Finally.cs:65:35:65:43 | [exception: Exception] access to property Message |
-| Finally.cs:65:35:65:35 | [exception: OutOfMemoryException] access to local variable e | Finally.cs:65:35:65:43 | [exception: OutOfMemoryException] access to property Message |
 | Finally.cs:65:35:65:43 | [exception: Exception] access to property Message | Finally.cs:65:48:65:51 | [exception: Exception] null |
-| Finally.cs:65:35:65:43 | [exception: OutOfMemoryException] access to property Message | Finally.cs:65:48:65:51 | [exception: OutOfMemoryException] null |
+| Finally.cs:65:35:65:51 | [exception: Exception] ... != ... | Finally.cs:66:9:67:9 | {...} |
 | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:65:48:65:51 | [exception: Exception] null | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... |
-| Finally.cs:65:48:65:51 | [exception: OutOfMemoryException] null | Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:69:9:71:9 | {...} |
 | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | Finally.cs:70:13:70:41 | [finally: exception(Exception)] ...; |
 | Finally.cs:69:9:71:9 | [finally: exception(IOException)] {...} | Finally.cs:70:13:70:41 | [finally: exception(IOException)] ...; |
-| Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:70:13:70:41 | [finally: exception(OutOfMemoryException)] ...; |
 | Finally.cs:69:9:71:9 | [finally: return] {...} | Finally.cs:70:13:70:41 | [finally: return] ...; |
 | Finally.cs:69:9:71:9 | {...} | Finally.cs:70:13:70:41 | ...; |
 | Finally.cs:70:13:70:41 | ...; | Finally.cs:70:31:70:39 | "Finally" |
 | Finally.cs:70:13:70:41 | [finally: exception(Exception)] ...; | Finally.cs:70:31:70:39 | [finally: exception(Exception)] "Finally" |
 | Finally.cs:70:13:70:41 | [finally: exception(IOException)] ...; | Finally.cs:70:31:70:39 | [finally: exception(IOException)] "Finally" |
-| Finally.cs:70:13:70:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:70:31:70:39 | [finally: exception(OutOfMemoryException)] "Finally" |
 | Finally.cs:70:13:70:41 | [finally: return] ...; | Finally.cs:70:31:70:39 | [finally: return] "Finally" |
 | Finally.cs:70:31:70:39 | "Finally" | Finally.cs:70:13:70:40 | call to method WriteLine |
 | Finally.cs:70:31:70:39 | [finally: exception(Exception)] "Finally" | Finally.cs:70:13:70:40 | [finally: exception(Exception)] call to method WriteLine |
 | Finally.cs:70:31:70:39 | [finally: exception(IOException)] "Finally" | Finally.cs:70:13:70:40 | [finally: exception(IOException)] call to method WriteLine |
-| Finally.cs:70:31:70:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:70:13:70:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine |
 | Finally.cs:70:31:70:39 | [finally: return] "Finally" | Finally.cs:70:13:70:40 | [finally: return] call to method WriteLine |
 | Finally.cs:74:10:74:11 | enter M4 | Finally.cs:75:5:101:5 | {...} |
 | Finally.cs:75:5:101:5 | {...} | Finally.cs:76:9:76:19 | ... ...; |
@@ -2026,16 +2011,12 @@ dominance
 | Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:140:9:143:9 | {...} |
 | Finally.cs:137:13:137:37 | ...; | Finally.cs:137:31:137:35 | "Try" |
 | Finally.cs:137:31:137:35 | "Try" | Finally.cs:137:13:137:36 | call to method WriteLine |
-| Finally.cs:137:31:137:35 | "Try" | Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} | Finally.cs:141:41:141:42 | [finally: exception(Exception)] "" |
-| Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:141:41:141:42 | [finally: exception(OutOfMemoryException)] "" |
 | Finally.cs:140:9:143:9 | {...} | Finally.cs:141:41:141:42 | "" |
 | Finally.cs:141:19:141:43 | [finally: exception(Exception)] object creation of type ArgumentException | Finally.cs:141:13:141:44 | [finally: exception(Exception)] throw ...; |
-| Finally.cs:141:19:141:43 | [finally: exception(OutOfMemoryException)] object creation of type ArgumentException | Finally.cs:141:13:141:44 | [finally: exception(OutOfMemoryException)] throw ...; |
 | Finally.cs:141:19:141:43 | object creation of type ArgumentException | Finally.cs:141:13:141:44 | throw ...; |
 | Finally.cs:141:41:141:42 | "" | Finally.cs:141:19:141:43 | object creation of type ArgumentException |
 | Finally.cs:141:41:141:42 | [finally: exception(Exception)] "" | Finally.cs:141:19:141:43 | [finally: exception(Exception)] object creation of type ArgumentException |
-| Finally.cs:141:41:141:42 | [finally: exception(OutOfMemoryException)] "" | Finally.cs:141:19:141:43 | [finally: exception(OutOfMemoryException)] object creation of type ArgumentException |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:148:5:170:5 | {...} |
 | Finally.cs:148:5:170:5 | {...} | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:149:9:169:9 | try {...} ... | Finally.cs:150:9:153:9 | {...} |
@@ -2082,56 +2063,38 @@ dominance
 | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; |
 | Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:21:159:45 | throw ...; |
 | Finally.cs:159:41:159:43 | "1" | Finally.cs:159:27:159:44 | object creation of type Exception |
-| Finally.cs:159:41:159:43 | "1" | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception |
-| Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception |
-| Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: Exception] Exception e |
 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e |
-| Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:161:39:161:39 | [exception: Exception] access to local variable e |
 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | Finally.cs:161:39:161:39 | [exception: NullReferenceException] access to local variable e |
-| Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | Finally.cs:161:39:161:39 | [exception: OutOfMemoryException] access to local variable e |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: Exception] access to local variable e |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to local variable e |
-| Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to local variable e |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: Exception] access to local variable e |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: NullReferenceException] access to local variable e |
-| Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: OutOfMemoryException] access to local variable e |
 | Finally.cs:161:39:161:39 | [exception: Exception] access to local variable e | Finally.cs:161:39:161:47 | [exception: Exception] access to property Message |
 | Finally.cs:161:39:161:39 | [exception: NullReferenceException] access to local variable e | Finally.cs:161:39:161:47 | [exception: NullReferenceException] access to property Message |
-| Finally.cs:161:39:161:39 | [exception: OutOfMemoryException] access to local variable e | Finally.cs:161:39:161:47 | [exception: OutOfMemoryException] access to property Message |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: Exception] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: Exception] access to property Message |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to property Message |
-| Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to property Message |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: Exception] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: Exception] access to property Message |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: NullReferenceException] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: NullReferenceException] access to property Message |
-| Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: OutOfMemoryException] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: OutOfMemoryException] access to property Message |
 | Finally.cs:161:39:161:47 | [exception: Exception] access to property Message | Finally.cs:161:52:161:54 | [exception: Exception] "1" |
 | Finally.cs:161:39:161:47 | [exception: NullReferenceException] access to property Message | Finally.cs:161:52:161:54 | [exception: NullReferenceException] "1" |
-| Finally.cs:161:39:161:47 | [exception: OutOfMemoryException] access to property Message | Finally.cs:161:52:161:54 | [exception: OutOfMemoryException] "1" |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: Exception] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: Exception] "1" |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] "1" |
-| Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] "1" |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: Exception] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: Exception] "1" |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: NullReferenceException] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: NullReferenceException] "1" |
-| Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: OutOfMemoryException] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] "1" |
 | Finally.cs:161:52:161:54 | [exception: Exception] "1" | Finally.cs:161:39:161:54 | [exception: Exception] ... == ... |
 | Finally.cs:161:52:161:54 | [exception: NullReferenceException] "1" | Finally.cs:161:39:161:54 | [exception: NullReferenceException] ... == ... |
-| Finally.cs:161:52:161:54 | [exception: OutOfMemoryException] "1" | Finally.cs:161:39:161:54 | [exception: OutOfMemoryException] ... == ... |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: Exception] "1" | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] "1" | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... |
-| Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] "1" | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: Exception] "1" | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: NullReferenceException] "1" | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... |
-| Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] "1" | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... |
 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | Finally.cs:163:17:163:43 | [finally: exception(ArgumentNullException)] ...; |
 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | Finally.cs:163:17:163:43 | [finally: exception(Exception)] ...; |
 | Finally.cs:162:13:164:13 | {...} | Finally.cs:163:17:163:43 | ...; |
@@ -2305,9 +2268,10 @@ dominance
 | Finally.cs:217:5:231:5 | {...} | Finally.cs:218:9:229:9 | try {...} ... |
 | Finally.cs:218:9:229:9 | try {...} ... | Finally.cs:219:9:221:9 | {...} |
 | Finally.cs:219:9:221:9 | {...} | Finally.cs:220:13:220:37 | ...; |
+| Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:222:9:225:9 | catch {...} |
+| Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:227:9:229:9 | {...} |
 | Finally.cs:220:13:220:37 | ...; | Finally.cs:220:31:220:35 | "Try" |
 | Finally.cs:220:31:220:35 | "Try" | Finally.cs:220:13:220:36 | call to method WriteLine |
-| Finally.cs:220:31:220:35 | "Try" | Finally.cs:222:9:225:9 | catch {...} |
 | Finally.cs:222:9:225:9 | catch {...} | Finally.cs:223:9:225:9 | {...} |
 | Finally.cs:223:9:225:9 | {...} | Finally.cs:224:13:224:39 | ...; |
 | Finally.cs:224:13:224:39 | ...; | Finally.cs:224:31:224:37 | "Catch" |
@@ -2389,20 +2353,16 @@ dominance
 | Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:257:9:259:9 | {...} |
 | Finally.cs:254:13:254:45 | ...; | Finally.cs:254:31:254:43 | "Mid finally" |
 | Finally.cs:254:31:254:43 | "Mid finally" | Finally.cs:254:13:254:44 | call to method WriteLine |
-| Finally.cs:254:31:254:43 | "Mid finally" | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:258:13:258:47 | [finally: exception(Exception)] ...; |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:258:13:258:47 | [finally: exception(ExceptionA)] ...; |
-| Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:258:13:258:47 | [finally: exception(OutOfMemoryException)] ...; |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:258:13:258:47 | ...; |
 | Finally.cs:258:13:258:46 | call to method WriteLine | Finally.cs:260:9:260:34 | ...; |
 | Finally.cs:258:13:258:47 | ...; | Finally.cs:258:31:258:45 | "Outer finally" |
 | Finally.cs:258:13:258:47 | [finally: exception(Exception)] ...; | Finally.cs:258:31:258:45 | [finally: exception(Exception)] "Outer finally" |
 | Finally.cs:258:13:258:47 | [finally: exception(ExceptionA)] ...; | Finally.cs:258:31:258:45 | [finally: exception(ExceptionA)] "Outer finally" |
-| Finally.cs:258:13:258:47 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:258:31:258:45 | [finally: exception(OutOfMemoryException)] "Outer finally" |
 | Finally.cs:258:31:258:45 | "Outer finally" | Finally.cs:258:13:258:46 | call to method WriteLine |
 | Finally.cs:258:31:258:45 | [finally: exception(Exception)] "Outer finally" | Finally.cs:258:13:258:46 | [finally: exception(Exception)] call to method WriteLine |
 | Finally.cs:258:31:258:45 | [finally: exception(ExceptionA)] "Outer finally" | Finally.cs:258:13:258:46 | [finally: exception(ExceptionA)] call to method WriteLine |
-| Finally.cs:258:31:258:45 | [finally: exception(OutOfMemoryException)] "Outer finally" | Finally.cs:258:13:258:46 | [finally: exception(OutOfMemoryException)] call to method WriteLine |
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:233:10:233:12 | exit M12 (normal) |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:260:27:260:32 | "Done" |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:9:260:33 | call to method WriteLine |
@@ -5773,6 +5733,7 @@ postDominance
 | Extensions.cs:25:9:25:34 | ...; | Extensions.cs:24:9:24:45 | call to method ToBool |
 | Extensions.cs:25:23:25:32 | access to method Parse | Extensions.cs:25:9:25:14 | "true" |
 | Extensions.cs:25:23:25:32 | delegate creation of type Func<String,Boolean> | Extensions.cs:25:23:25:32 | access to method Parse |
+| Finally.cs:7:10:7:11 | exit M1 (abnormal) | Finally.cs:15:13:15:40 | [finally: exception(Exception)] call to method WriteLine |
 | Finally.cs:7:10:7:11 | exit M1 (normal) | Finally.cs:15:13:15:40 | call to method WriteLine |
 | Finally.cs:8:5:17:5 | {...} | Finally.cs:7:10:7:11 | enter M1 |
 | Finally.cs:9:9:16:9 | try {...} ... | Finally.cs:8:5:17:5 | {...} |
@@ -5782,25 +5743,22 @@ postDominance
 | Finally.cs:11:31:11:36 | "Try1" | Finally.cs:11:13:11:38 | ...; |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:11:13:11:37 | call to method WriteLine |
 | Finally.cs:15:13:15:40 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:15:31:15:39 | [finally: exception(Exception)] "Finally" |
-| Finally.cs:15:13:15:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:15:31:15:39 | [finally: exception(OutOfMemoryException)] "Finally" |
 | Finally.cs:15:13:15:40 | call to method WriteLine | Finally.cs:15:31:15:39 | "Finally" |
 | Finally.cs:15:13:15:41 | ...; | Finally.cs:14:9:16:9 | {...} |
 | Finally.cs:15:13:15:41 | [finally: exception(Exception)] ...; | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:15:13:15:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:15:31:15:39 | "Finally" | Finally.cs:15:13:15:41 | ...; |
 | Finally.cs:15:31:15:39 | [finally: exception(Exception)] "Finally" | Finally.cs:15:13:15:41 | [finally: exception(Exception)] ...; |
-| Finally.cs:15:31:15:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:15:13:15:41 | [finally: exception(OutOfMemoryException)] ...; |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:50:13:50:40 | [finally: return] call to method WriteLine |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:50:13:50:40 | call to method WriteLine |
 | Finally.cs:20:5:52:5 | {...} | Finally.cs:19:10:19:11 | enter M2 |
 | Finally.cs:21:9:51:9 | try {...} ... | Finally.cs:20:5:52:5 | {...} |
 | Finally.cs:22:9:25:9 | {...} | Finally.cs:21:9:51:9 | try {...} ... |
+| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:23:31:23:36 | "Try2" |
 | Finally.cs:23:13:23:38 | ...; | Finally.cs:22:9:25:9 | {...} |
 | Finally.cs:23:31:23:36 | "Try2" | Finally.cs:23:13:23:38 | ...; |
 | Finally.cs:26:48:26:51 | [exception: Exception] true | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex |
 | Finally.cs:28:13:28:18 | throw ...; | Finally.cs:27:9:29:9 | {...} |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:31:9:40:9 | {...} | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex |
 | Finally.cs:32:13:39:13 | try {...} ... | Finally.cs:31:9:40:9 | {...} |
 | Finally.cs:33:13:35:13 | {...} | Finally.cs:32:13:39:13 | try {...} ... |
@@ -5811,9 +5769,7 @@ postDominance
 | Finally.cs:38:23:38:43 | [finally: exception(ArgumentException)] object creation of type Exception | Finally.cs:38:37:38:42 | [finally: exception(ArgumentException)] "Boo!" |
 | Finally.cs:38:37:38:42 | [finally: exception(ArgumentException)] "Boo!" | Finally.cs:37:13:39:13 | [finally: exception(ArgumentException)] {...} |
 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:42:9:43:9 | {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:49:9:51:9 | [finally: exception(Exception)] {...} | Finally.cs:38:17:38:44 | [finally: exception(ArgumentException)] throw ...; |
 | Finally.cs:49:9:51:9 | [finally: exception(IOException)] {...} | Finally.cs:28:13:28:18 | throw ...; |
 | Finally.cs:49:9:51:9 | [finally: return] {...} | Finally.cs:24:13:24:19 | return ...; |
@@ -5835,41 +5791,32 @@ postDominance
 | Finally.cs:55:5:72:5 | {...} | Finally.cs:54:10:54:11 | enter M3 |
 | Finally.cs:56:9:71:9 | try {...} ... | Finally.cs:55:5:72:5 | {...} |
 | Finally.cs:57:9:60:9 | {...} | Finally.cs:56:9:71:9 | try {...} ... |
+| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:58:31:58:36 | "Try3" |
 | Finally.cs:58:13:58:38 | ...; | Finally.cs:57:9:60:9 | {...} |
 | Finally.cs:58:31:58:36 | "Try3" | Finally.cs:58:13:58:38 | ...; |
 | Finally.cs:61:48:61:51 | [exception: Exception] true | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex |
 | Finally.cs:63:13:63:18 | throw ...; | Finally.cs:62:9:64:9 | {...} |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:65:35:65:35 | [exception: Exception] access to local variable e | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
-| Finally.cs:65:35:65:35 | [exception: OutOfMemoryException] access to local variable e | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:65:35:65:43 | [exception: Exception] access to property Message | Finally.cs:65:35:65:35 | [exception: Exception] access to local variable e |
-| Finally.cs:65:35:65:43 | [exception: OutOfMemoryException] access to property Message | Finally.cs:65:35:65:35 | [exception: OutOfMemoryException] access to local variable e |
 | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... | Finally.cs:65:48:65:51 | [exception: Exception] null |
-| Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... | Finally.cs:65:48:65:51 | [exception: OutOfMemoryException] null |
 | Finally.cs:65:48:65:51 | [exception: Exception] null | Finally.cs:65:35:65:43 | [exception: Exception] access to property Message |
-| Finally.cs:65:48:65:51 | [exception: OutOfMemoryException] null | Finally.cs:65:35:65:43 | [exception: OutOfMemoryException] access to property Message |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... |
-| Finally.cs:66:9:67:9 | {...} | Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... |
 | Finally.cs:69:9:71:9 | [finally: exception(IOException)] {...} | Finally.cs:63:13:63:18 | throw ...; |
 | Finally.cs:69:9:71:9 | [finally: return] {...} | Finally.cs:59:13:59:19 | return ...; |
 | Finally.cs:69:9:71:9 | {...} | Finally.cs:66:9:67:9 | {...} |
 | Finally.cs:70:13:70:40 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:70:31:70:39 | [finally: exception(Exception)] "Finally" |
 | Finally.cs:70:13:70:40 | [finally: exception(IOException)] call to method WriteLine | Finally.cs:70:31:70:39 | [finally: exception(IOException)] "Finally" |
-| Finally.cs:70:13:70:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:70:31:70:39 | [finally: exception(OutOfMemoryException)] "Finally" |
 | Finally.cs:70:13:70:40 | [finally: return] call to method WriteLine | Finally.cs:70:31:70:39 | [finally: return] "Finally" |
 | Finally.cs:70:13:70:40 | call to method WriteLine | Finally.cs:70:31:70:39 | "Finally" |
 | Finally.cs:70:13:70:41 | ...; | Finally.cs:69:9:71:9 | {...} |
 | Finally.cs:70:13:70:41 | [finally: exception(Exception)] ...; | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:70:13:70:41 | [finally: exception(IOException)] ...; | Finally.cs:69:9:71:9 | [finally: exception(IOException)] {...} |
-| Finally.cs:70:13:70:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:70:13:70:41 | [finally: return] ...; | Finally.cs:69:9:71:9 | [finally: return] {...} |
 | Finally.cs:70:31:70:39 | "Finally" | Finally.cs:70:13:70:41 | ...; |
 | Finally.cs:70:31:70:39 | [finally: exception(Exception)] "Finally" | Finally.cs:70:13:70:41 | [finally: exception(Exception)] ...; |
 | Finally.cs:70:31:70:39 | [finally: exception(IOException)] "Finally" | Finally.cs:70:13:70:41 | [finally: exception(IOException)] ...; |
-| Finally.cs:70:31:70:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:70:13:70:41 | [finally: exception(OutOfMemoryException)] ...; |
 | Finally.cs:70:31:70:39 | [finally: return] "Finally" | Finally.cs:70:13:70:41 | [finally: return] ...; |
 | Finally.cs:74:10:74:11 | exit M4 (normal) | Finally.cs:77:16:77:20 | ... > ... |
 | Finally.cs:74:10:74:11 | exit M4 (normal) | Finally.cs:97:21:97:23 | [finally: break] ...-- |
@@ -6073,17 +6020,15 @@ postDominance
 | Finally.cs:134:5:145:5 | {...} | Finally.cs:133:10:133:11 | enter M7 |
 | Finally.cs:135:9:143:9 | try {...} ... | Finally.cs:134:5:145:5 | {...} |
 | Finally.cs:136:9:138:9 | {...} | Finally.cs:135:9:143:9 | try {...} ... |
+| Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:137:31:137:35 | "Try" |
 | Finally.cs:137:13:137:37 | ...; | Finally.cs:136:9:138:9 | {...} |
 | Finally.cs:137:31:137:35 | "Try" | Finally.cs:137:13:137:37 | ...; |
 | Finally.cs:141:13:141:44 | [finally: exception(Exception)] throw ...; | Finally.cs:141:19:141:43 | [finally: exception(Exception)] object creation of type ArgumentException |
-| Finally.cs:141:13:141:44 | [finally: exception(OutOfMemoryException)] throw ...; | Finally.cs:141:19:141:43 | [finally: exception(OutOfMemoryException)] object creation of type ArgumentException |
 | Finally.cs:141:13:141:44 | throw ...; | Finally.cs:141:19:141:43 | object creation of type ArgumentException |
 | Finally.cs:141:19:141:43 | [finally: exception(Exception)] object creation of type ArgumentException | Finally.cs:141:41:141:42 | [finally: exception(Exception)] "" |
-| Finally.cs:141:19:141:43 | [finally: exception(OutOfMemoryException)] object creation of type ArgumentException | Finally.cs:141:41:141:42 | [finally: exception(OutOfMemoryException)] "" |
 | Finally.cs:141:19:141:43 | object creation of type ArgumentException | Finally.cs:141:41:141:42 | "" |
 | Finally.cs:141:41:141:42 | "" | Finally.cs:140:9:143:9 | {...} |
 | Finally.cs:141:41:141:42 | [finally: exception(Exception)] "" | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:141:41:141:42 | [finally: exception(OutOfMemoryException)] "" | Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:158:21:158:36 | ... == ... |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:163:17:163:42 | call to method WriteLine |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:167:17:167:37 | call to method WriteLine |
@@ -6114,47 +6059,37 @@ postDominance
 | Finally.cs:158:21:158:36 | ... == ... | Finally.cs:158:36:158:36 | 1 |
 | Finally.cs:158:21:158:36 | [finally: exception(ArgumentNullException)] ... == ... | Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 |
 | Finally.cs:158:21:158:36 | [finally: exception(Exception)] ... == ... | Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 |
+| Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" |
+| Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" |
+| Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:41:159:43 | "1" |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:159:21:159:45 | throw ...; |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:159:27:159:44 | object creation of type Exception |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} |
 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:161:39:161:39 | [exception: Exception] access to local variable e | Finally.cs:161:30:161:30 | [exception: Exception] Exception e |
 | Finally.cs:161:39:161:39 | [exception: NullReferenceException] access to local variable e | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e |
-| Finally.cs:161:39:161:39 | [exception: OutOfMemoryException] access to local variable e | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: Exception] access to local variable e | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to local variable e | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e |
-| Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to local variable e | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: Exception] access to local variable e | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: NullReferenceException] access to local variable e | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e |
-| Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: OutOfMemoryException] access to local variable e | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:39:161:47 | [exception: Exception] access to property Message | Finally.cs:161:39:161:39 | [exception: Exception] access to local variable e |
 | Finally.cs:161:39:161:47 | [exception: NullReferenceException] access to property Message | Finally.cs:161:39:161:39 | [exception: NullReferenceException] access to local variable e |
-| Finally.cs:161:39:161:47 | [exception: OutOfMemoryException] access to property Message | Finally.cs:161:39:161:39 | [exception: OutOfMemoryException] access to local variable e |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: Exception] access to property Message | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: Exception] access to local variable e |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to property Message | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to local variable e |
-| Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to property Message | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to local variable e |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: Exception] access to property Message | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: Exception] access to local variable e |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: NullReferenceException] access to property Message | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: NullReferenceException] access to local variable e |
-| Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: OutOfMemoryException] access to property Message | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: OutOfMemoryException] access to local variable e |
 | Finally.cs:161:39:161:54 | [exception: Exception] ... == ... | Finally.cs:161:52:161:54 | [exception: Exception] "1" |
 | Finally.cs:161:39:161:54 | [exception: NullReferenceException] ... == ... | Finally.cs:161:52:161:54 | [exception: NullReferenceException] "1" |
-| Finally.cs:161:39:161:54 | [exception: OutOfMemoryException] ... == ... | Finally.cs:161:52:161:54 | [exception: OutOfMemoryException] "1" |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: Exception] "1" |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] "1" |
-| Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] "1" |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: Exception] "1" |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: NullReferenceException] "1" |
-| Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] "1" |
 | Finally.cs:161:52:161:54 | [exception: Exception] "1" | Finally.cs:161:39:161:47 | [exception: Exception] access to property Message |
 | Finally.cs:161:52:161:54 | [exception: NullReferenceException] "1" | Finally.cs:161:39:161:47 | [exception: NullReferenceException] access to property Message |
-| Finally.cs:161:52:161:54 | [exception: OutOfMemoryException] "1" | Finally.cs:161:39:161:47 | [exception: OutOfMemoryException] access to property Message |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: Exception] "1" | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: Exception] access to property Message |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] "1" | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to property Message |
-| Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] "1" | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to property Message |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: Exception] "1" | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: Exception] access to property Message |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: NullReferenceException] "1" | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: NullReferenceException] access to property Message |
-| Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] "1" | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: OutOfMemoryException] access to property Message |
 | Finally.cs:163:17:163:42 | [finally: exception(ArgumentNullException)] call to method WriteLine | Finally.cs:163:35:163:41 | [finally: exception(ArgumentNullException)] access to array element |
 | Finally.cs:163:17:163:42 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:163:35:163:41 | [finally: exception(Exception)] access to array element |
 | Finally.cs:163:17:163:42 | call to method WriteLine | Finally.cs:163:35:163:41 | access to array element |
@@ -6288,6 +6223,7 @@ postDominance
 | Finally.cs:217:5:231:5 | {...} | Finally.cs:216:10:216:12 | enter M11 |
 | Finally.cs:218:9:229:9 | try {...} ... | Finally.cs:217:5:231:5 | {...} |
 | Finally.cs:219:9:221:9 | {...} | Finally.cs:218:9:229:9 | try {...} ... |
+| Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:220:31:220:35 | "Try" |
 | Finally.cs:220:13:220:37 | ...; | Finally.cs:219:9:221:9 | {...} |
 | Finally.cs:220:31:220:35 | "Try" | Finally.cs:220:13:220:37 | ...; |
 | Finally.cs:223:9:225:9 | {...} | Finally.cs:222:9:225:9 | catch {...} |
@@ -6361,16 +6297,13 @@ postDominance
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:254:13:254:44 | call to method WriteLine |
 | Finally.cs:258:13:258:46 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:258:31:258:45 | [finally: exception(Exception)] "Outer finally" |
 | Finally.cs:258:13:258:46 | [finally: exception(ExceptionA)] call to method WriteLine | Finally.cs:258:31:258:45 | [finally: exception(ExceptionA)] "Outer finally" |
-| Finally.cs:258:13:258:46 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:258:31:258:45 | [finally: exception(OutOfMemoryException)] "Outer finally" |
 | Finally.cs:258:13:258:46 | call to method WriteLine | Finally.cs:258:31:258:45 | "Outer finally" |
 | Finally.cs:258:13:258:47 | ...; | Finally.cs:257:9:259:9 | {...} |
 | Finally.cs:258:13:258:47 | [finally: exception(Exception)] ...; | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:258:13:258:47 | [finally: exception(ExceptionA)] ...; | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} |
-| Finally.cs:258:13:258:47 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:258:31:258:45 | "Outer finally" | Finally.cs:258:13:258:47 | ...; |
 | Finally.cs:258:31:258:45 | [finally: exception(Exception)] "Outer finally" | Finally.cs:258:13:258:47 | [finally: exception(Exception)] ...; |
 | Finally.cs:258:31:258:45 | [finally: exception(ExceptionA)] "Outer finally" | Finally.cs:258:13:258:47 | [finally: exception(ExceptionA)] ...; |
-| Finally.cs:258:31:258:45 | [finally: exception(OutOfMemoryException)] "Outer finally" | Finally.cs:258:13:258:47 | [finally: exception(OutOfMemoryException)] ...; |
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:260:27:260:32 | "Done" |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:258:13:258:46 | call to method WriteLine |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:9:260:34 | ...; |
@@ -9983,49 +9916,27 @@ blockDominance
 | Extensions.cs:20:17:20:20 | enter Main | Extensions.cs:20:17:20:20 | enter Main |
 | Finally.cs:7:10:7:11 | enter M1 | Finally.cs:7:10:7:11 | enter M1 |
 | Finally.cs:7:10:7:11 | enter M1 | Finally.cs:7:10:7:11 | exit M1 |
-| Finally.cs:7:10:7:11 | enter M1 | Finally.cs:7:10:7:11 | exit M1 (abnormal) |
-| Finally.cs:7:10:7:11 | enter M1 | Finally.cs:11:13:11:37 | call to method WriteLine |
 | Finally.cs:7:10:7:11 | enter M1 | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:7:10:7:11 | enter M1 | Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:7:10:7:11 | enter M1 | Finally.cs:14:9:16:9 | {...} |
 | Finally.cs:7:10:7:11 | exit M1 | Finally.cs:7:10:7:11 | exit M1 |
-| Finally.cs:7:10:7:11 | exit M1 (abnormal) | Finally.cs:7:10:7:11 | exit M1 (abnormal) |
-| Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:11:13:11:37 | call to method WriteLine |
-| Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:14:9:16:9 | {...} |
 | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:14:9:16:9 | {...} |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:19:10:19:11 | enter M2 |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:19:10:19:11 | exit M2 |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:19:10:19:11 | exit M2 (abnormal) |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:19:10:19:11 | exit M2 (normal) |
-| Finally.cs:19:10:19:11 | enter M2 | Finally.cs:23:13:23:37 | call to method WriteLine |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:24:13:24:19 | return ...; |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:19:10:19:11 | enter M2 | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:27:9:29:9 | {...} |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:19:10:19:11 | enter M2 | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:34:27:34:32 | throw ...; |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:19:10:19:11 | enter M2 | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:42:9:43:9 | {...} |
 | Finally.cs:19:10:19:11 | exit M2 | Finally.cs:19:10:19:11 | exit M2 |
 | Finally.cs:19:10:19:11 | exit M2 (abnormal) | Finally.cs:19:10:19:11 | exit M2 (abnormal) |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:19:10:19:11 | exit M2 (normal) |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:19:10:19:11 | exit M2 (abnormal) |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:23:13:23:37 | call to method WriteLine |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:24:13:24:19 | return ...; |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:27:9:29:9 | {...} |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:34:27:34:32 | throw ...; |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:24:13:24:19 | return ...; | Finally.cs:24:13:24:19 | return ...; |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:19:10:19:11 | exit M2 (abnormal) |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
@@ -10035,9 +9946,7 @@ blockDominance
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:34:27:34:32 | throw ...; |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} |
+| Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:42:9:43:9 | {...} |
 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex |
 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | Finally.cs:27:9:29:9 | {...} |
 | Finally.cs:27:9:29:9 | {...} | Finally.cs:27:9:29:9 | {...} |
@@ -10045,69 +9954,49 @@ blockDominance
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:34:27:34:32 | throw ...; |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} |
+| Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:42:9:43:9 | {...} |
 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex |
 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | Finally.cs:34:27:34:32 | throw ...; |
 | Finally.cs:34:27:34:32 | throw ...; | Finally.cs:34:27:34:32 | throw ...; |
 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} |
+| Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:42:9:43:9 | {...} |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:42:9:43:9 | {...} |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:54:10:54:11 | enter M3 |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:54:10:54:11 | exit M3 |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:54:10:54:11 | exit M3 (abnormal) |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:54:10:54:11 | exit M3 (normal) |
-| Finally.cs:54:10:54:11 | enter M3 | Finally.cs:58:13:58:37 | call to method WriteLine |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:59:13:59:19 | return ...; |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:54:10:54:11 | enter M3 | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:62:9:64:9 | {...} |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:54:10:54:11 | enter M3 | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
-| Finally.cs:54:10:54:11 | enter M3 | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:66:9:67:9 | {...} |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:54:10:54:11 | enter M3 | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:54:10:54:11 | exit M3 | Finally.cs:54:10:54:11 | exit M3 |
 | Finally.cs:54:10:54:11 | exit M3 (abnormal) | Finally.cs:54:10:54:11 | exit M3 (abnormal) |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:54:10:54:11 | exit M3 (normal) |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:58:13:58:37 | call to method WriteLine |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:59:13:59:19 | return ...; |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:62:9:64:9 | {...} |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:59:13:59:19 | return ...; | Finally.cs:59:13:59:19 | return ...; |
+| Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:54:10:54:11 | exit M3 (abnormal) |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:62:9:64:9 | {...} |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
+| Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:66:9:67:9 | {...} |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex |
 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | Finally.cs:62:9:64:9 | {...} |
 | Finally.cs:62:9:64:9 | {...} | Finally.cs:62:9:64:9 | {...} |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
+| Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:66:9:67:9 | {...} |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
+| Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:66:9:67:9 | {...} |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:66:9:67:9 | {...} |
 | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:74:10:74:11 | enter M4 | Finally.cs:74:10:74:11 | enter M4 |
 | Finally.cs:74:10:74:11 | enter M4 | Finally.cs:74:10:74:11 | exit M4 |
 | Finally.cs:74:10:74:11 | enter M4 | Finally.cs:74:10:74:11 | exit M4 (abnormal) |
@@ -10480,16 +10369,10 @@ blockDominance
 | Finally.cs:121:10:121:11 | enter M6 | Finally.cs:121:10:121:11 | enter M6 |
 | Finally.cs:133:10:133:11 | enter M7 | Finally.cs:133:10:133:11 | enter M7 |
 | Finally.cs:133:10:133:11 | enter M7 | Finally.cs:133:10:133:11 | exit M7 (abnormal) |
-| Finally.cs:133:10:133:11 | enter M7 | Finally.cs:137:13:137:36 | call to method WriteLine |
 | Finally.cs:133:10:133:11 | enter M7 | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:133:10:133:11 | enter M7 | Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:133:10:133:11 | enter M7 | Finally.cs:140:9:143:9 | {...} |
 | Finally.cs:133:10:133:11 | exit M7 (abnormal) | Finally.cs:133:10:133:11 | exit M7 (abnormal) |
-| Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:137:13:137:36 | call to method WriteLine |
-| Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:140:9:143:9 | {...} |
 | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:140:9:143:9 | {...} | Finally.cs:140:9:143:9 | {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:147:10:147:11 | enter M8 |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:147:10:147:11 | exit M8 |
@@ -10505,30 +10388,21 @@ blockDominance
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:27:159:44 | object creation of type Exception |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:41:159:43 | "1" |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:162:13:164:13 | {...} |
@@ -10541,14 +10415,11 @@ blockDominance
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:152:17:152:50 | throw ...; |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; |
-| Finally.cs:152:17:152:50 | throw ...; | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:152:17:152:50 | throw ...; | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e |
-| Finally.cs:152:17:152:50 | throw ...; | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:165:13:168:13 | [finally: exception(ArgumentNullException)] catch {...} |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:147:10:147:11 | exit M8 (abnormal) |
@@ -10559,22 +10430,16 @@ blockDominance
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; |
-| Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception |
-| Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e |
-| Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e |
-| Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} |
 | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:165:13:168:13 | [finally: exception(ArgumentNullException)] catch {...} |
@@ -10582,99 +10447,60 @@ blockDominance
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; |
-| Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e |
-| Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:165:13:168:13 | [finally: exception(Exception)] catch {...} |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:147:10:147:11 | exit M8 (normal) |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:155:9:169:9 | {...} |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:158:36:158:36 | 1 |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:155:9:169:9 | {...} | Finally.cs:159:27:159:44 | object creation of type Exception |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:159:41:159:43 | "1" |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:155:9:169:9 | {...} | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:161:30:161:30 | [exception: Exception] Exception e |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e |
-| Finally.cs:155:9:169:9 | {...} | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:162:13:164:13 | {...} |
 | Finally.cs:155:9:169:9 | {...} | Finally.cs:165:13:168:13 | catch {...} |
 | Finally.cs:158:36:158:36 | 1 | Finally.cs:158:36:158:36 | 1 |
 | Finally.cs:158:36:158:36 | 1 | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:158:36:158:36 | 1 | Finally.cs:159:27:159:44 | object creation of type Exception |
 | Finally.cs:158:36:158:36 | 1 | Finally.cs:159:41:159:43 | "1" |
-| Finally.cs:158:36:158:36 | 1 | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:158:36:158:36 | 1 | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 |
 | Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; |
-| Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception |
 | Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" |
-| Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:158:36:158:36 | [finally: exception(ArgumentNullException)] 1 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 |
 | Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; |
-| Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception |
 | Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" |
-| Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:158:36:158:36 | [finally: exception(Exception)] 1 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; |
 | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; |
 | Finally.cs:159:21:159:45 | throw ...; | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; |
-| Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception |
-| Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; |
-| Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception |
-| Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:27:159:44 | object creation of type Exception |
 | Finally.cs:159:41:159:43 | "1" | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:159:41:159:43 | "1" | Finally.cs:159:27:159:44 | object creation of type Exception |
 | Finally.cs:159:41:159:43 | "1" | Finally.cs:159:41:159:43 | "1" |
-| Finally.cs:159:41:159:43 | "1" | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:159:41:159:43 | "1" | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; |
-| Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception |
 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" |
-| Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; |
-| Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception |
 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" |
-| Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: Exception] Exception e |
 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e |
-| Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:161:30:161:30 | [exception: Exception] Exception e |
 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e |
-| Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e |
-| Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e |
-| Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} |
 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} |
 | Finally.cs:162:13:164:13 | {...} | Finally.cs:162:13:164:13 | {...} |
@@ -10926,10 +10752,8 @@ blockDominance
 | Finally.cs:211:13:211:29 | [finally: exception(Exception)] ...; | Finally.cs:211:13:211:29 | [finally: exception(Exception)] ...; |
 | Finally.cs:211:13:211:29 | [finally: exception(ExceptionA)] ...; | Finally.cs:211:13:211:29 | [finally: exception(ExceptionA)] ...; |
 | Finally.cs:216:10:216:12 | enter M11 | Finally.cs:216:10:216:12 | enter M11 |
-| Finally.cs:216:10:216:12 | enter M11 | Finally.cs:220:13:220:36 | call to method WriteLine |
 | Finally.cs:216:10:216:12 | enter M11 | Finally.cs:222:9:225:9 | catch {...} |
 | Finally.cs:216:10:216:12 | enter M11 | Finally.cs:227:9:229:9 | {...} |
-| Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:220:13:220:36 | call to method WriteLine |
 | Finally.cs:222:9:225:9 | catch {...} | Finally.cs:222:9:225:9 | catch {...} |
 | Finally.cs:227:9:229:9 | {...} | Finally.cs:227:9:229:9 | {...} |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:233:10:233:12 | enter M12 |
@@ -10951,10 +10775,8 @@ blockDominance
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA), finally(1): exception(Exception)] {...} |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA)] {...} |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:250:17:252:17 | {...} |
-| Finally.cs:233:10:233:12 | enter M12 | Finally.cs:254:13:254:44 | call to method WriteLine |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} |
-| Finally.cs:233:10:233:12 | enter M12 | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:257:9:259:9 | {...} |
 | Finally.cs:233:10:233:12 | exit M12 | Finally.cs:233:10:233:12 | exit M12 |
 | Finally.cs:233:10:233:12 | exit M12 (abnormal) | Finally.cs:233:10:233:12 | exit M12 (abnormal) |
@@ -10984,8 +10806,6 @@ blockDominance
 | Finally.cs:243:13:253:13 | {...} | Finally.cs:247:31:247:46 | object creation of type ExceptionA |
 | Finally.cs:243:13:253:13 | {...} | Finally.cs:250:17:252:17 | [finally(1): exception(Exception)] {...} |
 | Finally.cs:243:13:253:13 | {...} | Finally.cs:250:17:252:17 | {...} |
-| Finally.cs:243:13:253:13 | {...} | Finally.cs:254:13:254:44 | call to method WriteLine |
-| Finally.cs:243:13:253:13 | {...} | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:243:13:253:13 | {...} | Finally.cs:257:9:259:9 | {...} |
 | Finally.cs:247:25:247:47 | [finally: exception(Exception)] throw ...; | Finally.cs:247:25:247:47 | [finally: exception(Exception)] throw ...; |
 | Finally.cs:247:25:247:47 | [finally: exception(ExceptionA)] throw ...; | Finally.cs:247:25:247:47 | [finally: exception(ExceptionA)] throw ...; |
@@ -11005,14 +10825,9 @@ blockDominance
 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA), finally(1): exception(Exception)] {...} | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA), finally(1): exception(Exception)] {...} |
 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA)] {...} | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA)] {...} |
 | Finally.cs:250:17:252:17 | {...} | Finally.cs:250:17:252:17 | {...} |
-| Finally.cs:250:17:252:17 | {...} | Finally.cs:254:13:254:44 | call to method WriteLine |
-| Finally.cs:250:17:252:17 | {...} | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:250:17:252:17 | {...} | Finally.cs:257:9:259:9 | {...} |
-| Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:254:13:254:44 | call to method WriteLine |
-| Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:257:9:259:9 | {...} |
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} |
-| Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:257:9:259:9 | {...} |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | enter M1 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | exit M1 (normal) |
@@ -14007,92 +13822,58 @@ postBlockDominance
 | Extensions.cs:20:17:20:20 | enter Main | Extensions.cs:20:17:20:20 | enter Main |
 | Finally.cs:7:10:7:11 | enter M1 | Finally.cs:7:10:7:11 | enter M1 |
 | Finally.cs:7:10:7:11 | exit M1 | Finally.cs:7:10:7:11 | exit M1 |
-| Finally.cs:7:10:7:11 | exit M1 (abnormal) | Finally.cs:7:10:7:11 | exit M1 (abnormal) |
-| Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:7:10:7:11 | enter M1 |
-| Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:11:13:11:37 | call to method WriteLine |
 | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:7:10:7:11 | enter M1 |
-| Finally.cs:14:9:16:9 | {...} | Finally.cs:11:13:11:37 | call to method WriteLine |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:14:9:16:9 | {...} |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:19:10:19:11 | enter M2 |
 | Finally.cs:19:10:19:11 | exit M2 | Finally.cs:19:10:19:11 | exit M2 |
 | Finally.cs:19:10:19:11 | exit M2 (abnormal) | Finally.cs:19:10:19:11 | exit M2 (abnormal) |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:19:10:19:11 | enter M2 |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:19:10:19:11 | exit M2 (normal) |
-| Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:23:13:23:37 | call to method WriteLine |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:24:13:24:19 | return ...; |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:42:9:43:9 | {...} |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:23:13:23:37 | call to method WriteLine |
 | Finally.cs:24:13:24:19 | return ...; | Finally.cs:24:13:24:19 | return ...; |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex |
 | Finally.cs:27:9:29:9 | {...} | Finally.cs:27:9:29:9 | {...} |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex |
 | Finally.cs:34:27:34:32 | throw ...; | Finally.cs:34:27:34:32 | throw ...; |
 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:42:9:43:9 | {...} | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:42:9:43:9 | {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:42:9:43:9 | {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:42:9:43:9 | {...} |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:54:10:54:11 | enter M3 |
 | Finally.cs:54:10:54:11 | exit M3 | Finally.cs:54:10:54:11 | exit M3 |
 | Finally.cs:54:10:54:11 | exit M3 (abnormal) | Finally.cs:54:10:54:11 | exit M3 (abnormal) |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:54:10:54:11 | enter M3 |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:54:10:54:11 | exit M3 (normal) |
-| Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:58:13:58:37 | call to method WriteLine |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:59:13:59:19 | return ...; |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
-| Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:66:9:67:9 | {...} |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:58:13:58:37 | call to method WriteLine |
 | Finally.cs:59:13:59:19 | return ...; | Finally.cs:59:13:59:19 | return ...; |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex |
 | Finally.cs:62:9:64:9 | {...} | Finally.cs:62:9:64:9 | {...} |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:66:9:67:9 | {...} | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} |
-| Finally.cs:66:9:67:9 | {...} | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:65:26:65:26 | [exception: Exception] Exception e |
-| Finally.cs:66:9:67:9 | {...} | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:66:9:67:9 | {...} |
 | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:74:10:74:11 | enter M4 | Finally.cs:74:10:74:11 | enter M4 |
 | Finally.cs:74:10:74:11 | exit M4 | Finally.cs:74:10:74:11 | exit M4 |
 | Finally.cs:74:10:74:11 | exit M4 (abnormal) | Finally.cs:74:10:74:11 | exit M4 (abnormal) |
@@ -14226,9 +14007,7 @@ postBlockDominance
 | Finally.cs:121:10:121:11 | enter M6 | Finally.cs:121:10:121:11 | enter M6 |
 | Finally.cs:133:10:133:11 | enter M7 | Finally.cs:133:10:133:11 | enter M7 |
 | Finally.cs:133:10:133:11 | exit M7 (abnormal) | Finally.cs:133:10:133:11 | exit M7 (abnormal) |
-| Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:137:13:137:36 | call to method WriteLine |
 | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} |
-| Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:140:9:143:9 | {...} | Finally.cs:140:9:143:9 | {...} |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:147:10:147:11 | enter M8 |
 | Finally.cs:147:10:147:11 | exit M8 | Finally.cs:147:10:147:11 | exit M8 |
@@ -14238,14 +14017,11 @@ postBlockDominance
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:155:9:169:9 | {...} |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:158:36:158:36 | 1 |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:159:27:159:44 | object creation of type Exception |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:159:41:159:43 | "1" |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:161:30:161:30 | [exception: Exception] Exception e |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e |
-| Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:162:13:164:13 | {...} |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:165:13:168:13 | catch {...} |
 | Finally.cs:152:17:152:50 | throw ...; | Finally.cs:152:17:152:50 | throw ...; |
@@ -14259,37 +14035,27 @@ postBlockDominance
 | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; |
 | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; |
 | Finally.cs:159:21:159:45 | throw ...; | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception |
-| Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception |
-| Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:27:159:44 | object creation of type Exception |
 | Finally.cs:159:41:159:43 | "1" | Finally.cs:159:41:159:43 | "1" |
 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" |
 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:159:27:159:44 | object creation of type Exception |
+| Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:159:41:159:43 | "1" |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:159:21:159:45 | throw ...; |
-| Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:159:27:159:44 | object creation of type Exception |
+| Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:159:41:159:43 | "1" |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:161:30:161:30 | [exception: Exception] Exception e |
 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} |
 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e |
-| Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} |
-| Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e |
-| Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e |
-| Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e |
 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} |
 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} |
 | Finally.cs:162:13:164:13 | {...} | Finally.cs:162:13:164:13 | {...} |
@@ -14378,10 +14144,8 @@ postBlockDominance
 | Finally.cs:211:13:211:29 | [finally: exception(Exception)] ...; | Finally.cs:211:13:211:29 | [finally: exception(Exception)] ...; |
 | Finally.cs:211:13:211:29 | [finally: exception(ExceptionA)] ...; | Finally.cs:211:13:211:29 | [finally: exception(ExceptionA)] ...; |
 | Finally.cs:216:10:216:12 | enter M11 | Finally.cs:216:10:216:12 | enter M11 |
-| Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:220:13:220:36 | call to method WriteLine |
 | Finally.cs:222:9:225:9 | catch {...} | Finally.cs:222:9:225:9 | catch {...} |
 | Finally.cs:227:9:229:9 | {...} | Finally.cs:216:10:216:12 | enter M11 |
-| Finally.cs:227:9:229:9 | {...} | Finally.cs:220:13:220:36 | call to method WriteLine |
 | Finally.cs:227:9:229:9 | {...} | Finally.cs:222:9:225:9 | catch {...} |
 | Finally.cs:227:9:229:9 | {...} | Finally.cs:227:9:229:9 | {...} |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:233:10:233:12 | enter M12 |
@@ -14406,17 +14170,11 @@ postBlockDominance
 | Finally.cs:250:17:252:17 | {...} | Finally.cs:233:10:233:12 | enter M12 |
 | Finally.cs:250:17:252:17 | {...} | Finally.cs:243:13:253:13 | {...} |
 | Finally.cs:250:17:252:17 | {...} | Finally.cs:250:17:252:17 | {...} |
-| Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:233:10:233:12 | enter M12 |
-| Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:243:13:253:13 | {...} |
-| Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:250:17:252:17 | {...} |
-| Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:254:13:254:44 | call to method WriteLine |
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} |
-| Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:233:10:233:12 | enter M12 |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:243:13:253:13 | {...} |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:250:17:252:17 | {...} |
-| Finally.cs:257:9:259:9 | {...} | Finally.cs:254:13:254:44 | call to method WriteLine |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:257:9:259:9 | {...} |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | enter M1 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | enter M1 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
index 9803e2dec8d..c6d70953677 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
@@ -1830,17 +1830,13 @@ nodeEnclosing
 | Finally.cs:11:13:11:38 | ...; | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:11:31:11:36 | "Try1" | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} | Finally.cs:7:10:7:11 | M1 |
-| Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:15:13:15:40 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:7:10:7:11 | M1 |
-| Finally.cs:15:13:15:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:15:13:15:40 | call to method WriteLine | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:15:13:15:41 | ...; | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:15:13:15:41 | [finally: exception(Exception)] ...; | Finally.cs:7:10:7:11 | M1 |
-| Finally.cs:15:13:15:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:15:31:15:39 | "Finally" | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:15:31:15:39 | [finally: exception(Exception)] "Finally" | Finally.cs:7:10:7:11 | M1 |
-| Finally.cs:15:31:15:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:19:10:19:11 | exit M2 | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:19:10:19:11 | exit M2 (abnormal) | Finally.cs:19:10:19:11 | M2 |
@@ -1853,13 +1849,11 @@ nodeEnclosing
 | Finally.cs:23:31:23:36 | "Try2" | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:24:13:24:19 | return ...; | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:26:48:26:51 | [exception: Exception] true | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:27:9:29:9 | {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:28:13:28:18 | throw ...; | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:31:9:40:9 | {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:32:13:39:13 | try {...} ... | Finally.cs:19:10:19:11 | M2 |
@@ -1872,7 +1866,6 @@ nodeEnclosing
 | Finally.cs:38:23:38:43 | [finally: exception(ArgumentException)] object creation of type Exception | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:38:37:38:42 | [finally: exception(ArgumentException)] "Boo!" | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
-| Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:49:9:51:9 | [finally: exception(Exception)] {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:49:9:51:9 | [finally: exception(IOException)] {...} | Finally.cs:19:10:19:11 | M2 |
@@ -1902,43 +1895,32 @@ nodeEnclosing
 | Finally.cs:58:31:58:36 | "Try3" | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:59:13:59:19 | return ...; | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:61:48:61:51 | [exception: Exception] true | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:62:9:64:9 | {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:63:13:63:18 | throw ...; | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:65:35:65:35 | [exception: Exception] access to local variable e | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:65:35:65:35 | [exception: OutOfMemoryException] access to local variable e | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:65:35:65:43 | [exception: Exception] access to property Message | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:65:35:65:43 | [exception: OutOfMemoryException] access to property Message | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:65:48:65:51 | [exception: Exception] null | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:65:48:65:51 | [exception: OutOfMemoryException] null | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:69:9:71:9 | [finally: exception(IOException)] {...} | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:69:9:71:9 | [finally: return] {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:69:9:71:9 | {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:13:70:40 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:13:70:40 | [finally: exception(IOException)] call to method WriteLine | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:70:13:70:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:13:70:40 | [finally: return] call to method WriteLine | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:13:70:40 | call to method WriteLine | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:13:70:41 | ...; | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:13:70:41 | [finally: exception(Exception)] ...; | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:13:70:41 | [finally: exception(IOException)] ...; | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:70:13:70:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:13:70:41 | [finally: return] ...; | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:31:70:39 | "Finally" | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:31:70:39 | [finally: exception(Exception)] "Finally" | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:31:70:39 | [finally: exception(IOException)] "Finally" | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:70:31:70:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:70:31:70:39 | [finally: return] "Finally" | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:74:10:74:11 | enter M4 | Finally.cs:74:10:74:11 | M4 |
 | Finally.cs:74:10:74:11 | exit M4 | Finally.cs:74:10:74:11 | M4 |
@@ -2192,17 +2174,13 @@ nodeEnclosing
 | Finally.cs:137:13:137:37 | ...; | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:137:31:137:35 | "Try" | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} | Finally.cs:133:10:133:11 | M7 |
-| Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:140:9:143:9 | {...} | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:141:13:141:44 | [finally: exception(Exception)] throw ...; | Finally.cs:133:10:133:11 | M7 |
-| Finally.cs:141:13:141:44 | [finally: exception(OutOfMemoryException)] throw ...; | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:141:13:141:44 | throw ...; | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:141:19:141:43 | [finally: exception(Exception)] object creation of type ArgumentException | Finally.cs:133:10:133:11 | M7 |
-| Finally.cs:141:19:141:43 | [finally: exception(OutOfMemoryException)] object creation of type ArgumentException | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:141:19:141:43 | object creation of type ArgumentException | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:141:41:141:42 | "" | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:141:41:141:42 | [finally: exception(Exception)] "" | Finally.cs:133:10:133:11 | M7 |
-| Finally.cs:141:41:141:42 | [finally: exception(OutOfMemoryException)] "" | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:147:10:147:11 | exit M8 | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:147:10:147:11 | exit M8 (abnormal) | Finally.cs:147:10:147:11 | M8 |
@@ -2251,58 +2229,40 @@ nodeEnclosing
 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:39 | [exception: Exception] access to local variable e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:39 | [exception: NullReferenceException] access to local variable e | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:39:161:39 | [exception: OutOfMemoryException] access to local variable e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: Exception] access to local variable e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to local variable e | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to local variable e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: Exception] access to local variable e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: NullReferenceException] access to local variable e | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: OutOfMemoryException] access to local variable e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:47 | [exception: Exception] access to property Message | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:47 | [exception: NullReferenceException] access to property Message | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:39:161:47 | [exception: OutOfMemoryException] access to property Message | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: Exception] access to property Message | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to property Message | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to property Message | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: Exception] access to property Message | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: NullReferenceException] access to property Message | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: OutOfMemoryException] access to property Message | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:54 | [exception: Exception] ... == ... | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:54 | [exception: NullReferenceException] ... == ... | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:39:161:54 | [exception: OutOfMemoryException] ... == ... | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:52:161:54 | [exception: Exception] "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:52:161:54 | [exception: NullReferenceException] "1" | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:52:161:54 | [exception: OutOfMemoryException] "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: Exception] "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] "1" | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: Exception] "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: NullReferenceException] "1" | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:162:13:164:13 | {...} | Finally.cs:147:10:147:11 | M8 |
@@ -2582,20 +2542,16 @@ nodeEnclosing
 | Finally.cs:254:31:254:43 | "Mid finally" | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:233:10:233:12 | M12 |
-| Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:258:13:258:46 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:258:13:258:46 | [finally: exception(ExceptionA)] call to method WriteLine | Finally.cs:233:10:233:12 | M12 |
-| Finally.cs:258:13:258:46 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:258:13:258:46 | call to method WriteLine | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:258:13:258:47 | ...; | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:258:13:258:47 | [finally: exception(Exception)] ...; | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:258:13:258:47 | [finally: exception(ExceptionA)] ...; | Finally.cs:233:10:233:12 | M12 |
-| Finally.cs:258:13:258:47 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:258:31:258:45 | "Outer finally" | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:258:31:258:45 | [finally: exception(Exception)] "Outer finally" | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:258:31:258:45 | [finally: exception(ExceptionA)] "Outer finally" | Finally.cs:233:10:233:12 | M12 |
-| Finally.cs:258:31:258:45 | [finally: exception(OutOfMemoryException)] "Outer finally" | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:233:10:233:12 | M12 |
@@ -5135,45 +5091,33 @@ blockEnclosing
 | Extensions.cs:20:17:20:20 | enter Main | Extensions.cs:20:17:20:20 | Main |
 | Finally.cs:7:10:7:11 | enter M1 | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:7:10:7:11 | exit M1 | Finally.cs:7:10:7:11 | M1 |
-| Finally.cs:7:10:7:11 | exit M1 (abnormal) | Finally.cs:7:10:7:11 | M1 |
-| Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} | Finally.cs:7:10:7:11 | M1 |
-| Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:7:10:7:11 | M1 |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:19:10:19:11 | exit M2 | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:19:10:19:11 | exit M2 (abnormal) | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:19:10:19:11 | M2 |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:24:13:24:19 | return ...; | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:27:9:29:9 | {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:34:27:34:32 | throw ...; | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
-| Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:19:10:19:11 | M2 |
 | Finally.cs:54:10:54:11 | enter M3 | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:54:10:54:11 | exit M3 | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:54:10:54:11 | exit M3 (abnormal) | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:59:13:59:19 | return ...; | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:62:9:64:9 | {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | Finally.cs:54:10:54:11 | M3 |
-| Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:54:10:54:11 | M3 |
 | Finally.cs:74:10:74:11 | enter M4 | Finally.cs:74:10:74:11 | M4 |
 | Finally.cs:74:10:74:11 | exit M4 | Finally.cs:74:10:74:11 | M4 |
 | Finally.cs:74:10:74:11 | exit M4 (abnormal) | Finally.cs:74:10:74:11 | M4 |
@@ -5245,9 +5189,7 @@ blockEnclosing
 | Finally.cs:121:10:121:11 | enter M6 | Finally.cs:121:10:121:11 | M6 |
 | Finally.cs:133:10:133:11 | enter M7 | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:133:10:133:11 | exit M7 (abnormal) | Finally.cs:133:10:133:11 | M7 |
-| Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} | Finally.cs:133:10:133:11 | M7 |
-| Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:140:9:143:9 | {...} | Finally.cs:133:10:133:11 | M7 |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:147:10:147:11 | exit M8 | Finally.cs:147:10:147:11 | M8 |
@@ -5263,30 +5205,21 @@ blockEnclosing
 | Finally.cs:159:21:159:45 | [finally: exception(ArgumentNullException)] throw ...; | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:159:21:159:45 | [finally: exception(Exception)] throw ...; | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:159:21:159:45 | throw ...; | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:159:41:159:43 | "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | Finally.cs:147:10:147:11 | M8 |
-| Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | Finally.cs:147:10:147:11 | M8 |
 | Finally.cs:162:13:164:13 | {...} | Finally.cs:147:10:147:11 | M8 |
@@ -5353,7 +5286,6 @@ blockEnclosing
 | Finally.cs:211:13:211:29 | [finally: exception(Exception)] ...; | Finally.cs:195:10:195:12 | M10 |
 | Finally.cs:211:13:211:29 | [finally: exception(ExceptionA)] ...; | Finally.cs:195:10:195:12 | M10 |
 | Finally.cs:216:10:216:12 | enter M11 | Finally.cs:216:10:216:12 | M11 |
-| Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:216:10:216:12 | M11 |
 | Finally.cs:222:9:225:9 | catch {...} | Finally.cs:216:10:216:12 | M11 |
 | Finally.cs:227:9:229:9 | {...} | Finally.cs:216:10:216:12 | M11 |
 | Finally.cs:233:10:233:12 | enter M12 | Finally.cs:233:10:233:12 | M12 |
@@ -5375,10 +5307,8 @@ blockEnclosing
 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA), finally(1): exception(Exception)] {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:250:17:252:17 | [finally: exception(ExceptionA)] {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:250:17:252:17 | {...} | Finally.cs:233:10:233:12 | M12 |
-| Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:233:10:233:12 | M12 |
-| Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:233:10:233:12 | M12 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | M1 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | M1 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
index f389324db3b..9a657596235 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
@@ -982,25 +982,19 @@
 | CompileTimeOperators.cs:22:23:22:23 | access to parameter i | CompileTimeOperators.cs:22:23:22:23 | access to parameter i | normal |
 | CompileTimeOperators.cs:29:5:41:5 | {...} | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | goto(End) [normal] (0) |
 | CompileTimeOperators.cs:29:5:41:5 | {...} | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | throw(Exception) [normal] (0) |
-| CompileTimeOperators.cs:29:5:41:5 | {...} | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | CompileTimeOperators.cs:29:5:41:5 | {...} | CompileTimeOperators.cs:40:14:40:37 | call to method WriteLine | normal |
 | CompileTimeOperators.cs:30:9:38:9 | try {...} ... | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | goto(End) [normal] (0) |
 | CompileTimeOperators.cs:30:9:38:9 | try {...} ... | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | normal |
 | CompileTimeOperators.cs:30:9:38:9 | try {...} ... | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | throw(Exception) [normal] (0) |
-| CompileTimeOperators.cs:30:9:38:9 | try {...} ... | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | CompileTimeOperators.cs:31:9:34:9 | {...} | CompileTimeOperators.cs:32:13:32:21 | goto ...; | goto(End) |
 | CompileTimeOperators.cs:31:9:34:9 | {...} | CompileTimeOperators.cs:33:13:33:37 | call to method WriteLine | normal |
 | CompileTimeOperators.cs:31:9:34:9 | {...} | CompileTimeOperators.cs:33:13:33:37 | call to method WriteLine | throw(Exception) |
-| CompileTimeOperators.cs:31:9:34:9 | {...} | CompileTimeOperators.cs:33:31:33:36 | "Dead" | throw(OutOfMemoryException) |
 | CompileTimeOperators.cs:32:13:32:21 | goto ...; | CompileTimeOperators.cs:32:13:32:21 | goto ...; | goto(End) |
 | CompileTimeOperators.cs:33:13:33:37 | call to method WriteLine | CompileTimeOperators.cs:33:13:33:37 | call to method WriteLine | normal |
 | CompileTimeOperators.cs:33:13:33:37 | call to method WriteLine | CompileTimeOperators.cs:33:13:33:37 | call to method WriteLine | throw(Exception) |
-| CompileTimeOperators.cs:33:13:33:37 | call to method WriteLine | CompileTimeOperators.cs:33:31:33:36 | "Dead" | throw(OutOfMemoryException) |
 | CompileTimeOperators.cs:33:13:33:38 | ...; | CompileTimeOperators.cs:33:13:33:37 | call to method WriteLine | normal |
 | CompileTimeOperators.cs:33:13:33:38 | ...; | CompileTimeOperators.cs:33:13:33:37 | call to method WriteLine | throw(Exception) |
-| CompileTimeOperators.cs:33:13:33:38 | ...; | CompileTimeOperators.cs:33:31:33:36 | "Dead" | throw(OutOfMemoryException) |
 | CompileTimeOperators.cs:33:31:33:36 | "Dead" | CompileTimeOperators.cs:33:31:33:36 | "Dead" | normal |
-| CompileTimeOperators.cs:33:31:33:36 | "Dead" | CompileTimeOperators.cs:33:31:33:36 | "Dead" | throw(OutOfMemoryException) |
 | CompileTimeOperators.cs:36:9:38:9 | {...} | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | normal |
 | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | normal |
 | CompileTimeOperators.cs:37:13:37:41 | ...; | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | normal |
@@ -1635,21 +1629,15 @@
 | Extensions.cs:25:23:25:32 | delegate creation of type Func<String,Boolean> | Extensions.cs:25:23:25:32 | delegate creation of type Func<String,Boolean> | normal |
 | Finally.cs:8:5:17:5 | {...} | Finally.cs:15:13:15:40 | call to method WriteLine | normal |
 | Finally.cs:8:5:17:5 | {...} | Finally.cs:15:13:15:40 | call to method WriteLine | throw(Exception) [normal] (0) |
-| Finally.cs:8:5:17:5 | {...} | Finally.cs:15:13:15:40 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | Finally.cs:9:9:16:9 | try {...} ... | Finally.cs:15:13:15:40 | call to method WriteLine | normal |
 | Finally.cs:9:9:16:9 | try {...} ... | Finally.cs:15:13:15:40 | call to method WriteLine | throw(Exception) [normal] (0) |
-| Finally.cs:9:9:16:9 | try {...} ... | Finally.cs:15:13:15:40 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | Finally.cs:10:9:12:9 | {...} | Finally.cs:11:13:11:37 | call to method WriteLine | normal |
 | Finally.cs:10:9:12:9 | {...} | Finally.cs:11:13:11:37 | call to method WriteLine | throw(Exception) |
-| Finally.cs:10:9:12:9 | {...} | Finally.cs:11:31:11:36 | "Try1" | throw(OutOfMemoryException) |
 | Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:11:13:11:37 | call to method WriteLine | normal |
 | Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:11:13:11:37 | call to method WriteLine | throw(Exception) |
-| Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:11:31:11:36 | "Try1" | throw(OutOfMemoryException) |
 | Finally.cs:11:13:11:38 | ...; | Finally.cs:11:13:11:37 | call to method WriteLine | normal |
 | Finally.cs:11:13:11:38 | ...; | Finally.cs:11:13:11:37 | call to method WriteLine | throw(Exception) |
-| Finally.cs:11:13:11:38 | ...; | Finally.cs:11:31:11:36 | "Try1" | throw(OutOfMemoryException) |
 | Finally.cs:11:31:11:36 | "Try1" | Finally.cs:11:31:11:36 | "Try1" | normal |
-| Finally.cs:11:31:11:36 | "Try1" | Finally.cs:11:31:11:36 | "Try1" | throw(OutOfMemoryException) |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:15:13:15:40 | call to method WriteLine | normal |
 | Finally.cs:15:13:15:40 | call to method WriteLine | Finally.cs:15:13:15:40 | call to method WriteLine | normal |
 | Finally.cs:15:13:15:41 | ...; | Finally.cs:15:13:15:40 | call to method WriteLine | normal |
@@ -1663,16 +1651,12 @@
 | Finally.cs:21:9:51:9 | try {...} ... | Finally.cs:50:13:50:40 | call to method WriteLine | throw(Exception) [normal] (0) |
 | Finally.cs:21:9:51:9 | try {...} ... | Finally.cs:50:13:50:40 | call to method WriteLine | throw(IOException) [normal] (0) |
 | Finally.cs:22:9:25:9 | {...} | Finally.cs:23:13:23:37 | call to method WriteLine | throw(Exception) |
-| Finally.cs:22:9:25:9 | {...} | Finally.cs:23:31:23:36 | "Try2" | throw(OutOfMemoryException) |
 | Finally.cs:22:9:25:9 | {...} | Finally.cs:24:13:24:19 | return ...; | return |
 | Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:23:13:23:37 | call to method WriteLine | normal |
 | Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:23:13:23:37 | call to method WriteLine | throw(Exception) |
-| Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:23:31:23:36 | "Try2" | throw(OutOfMemoryException) |
 | Finally.cs:23:13:23:38 | ...; | Finally.cs:23:13:23:37 | call to method WriteLine | normal |
 | Finally.cs:23:13:23:38 | ...; | Finally.cs:23:13:23:37 | call to method WriteLine | throw(Exception) |
-| Finally.cs:23:13:23:38 | ...; | Finally.cs:23:31:23:36 | "Try2" | throw(OutOfMemoryException) |
 | Finally.cs:23:31:23:36 | "Try2" | Finally.cs:23:31:23:36 | "Try2" | normal |
-| Finally.cs:23:31:23:36 | "Try2" | Finally.cs:23:31:23:36 | "Try2" | throw(OutOfMemoryException) |
 | Finally.cs:24:13:24:19 | return ...; | Finally.cs:24:13:24:19 | return ...; | return |
 | Finally.cs:26:9:29:9 | catch (...) {...} | Finally.cs:26:9:29:9 | catch (...) {...} | no-match |
 | Finally.cs:26:9:29:9 | catch (...) {...} | Finally.cs:28:13:28:18 | throw ...; | throw(IOException) |
@@ -1707,23 +1691,17 @@
 | Finally.cs:55:5:72:5 | {...} | Finally.cs:70:13:70:40 | call to method WriteLine | return [normal] (0) |
 | Finally.cs:55:5:72:5 | {...} | Finally.cs:70:13:70:40 | call to method WriteLine | throw(Exception) [normal] (0) |
 | Finally.cs:55:5:72:5 | {...} | Finally.cs:70:13:70:40 | call to method WriteLine | throw(IOException) [normal] (0) |
-| Finally.cs:55:5:72:5 | {...} | Finally.cs:70:13:70:40 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | Finally.cs:56:9:71:9 | try {...} ... | Finally.cs:70:13:70:40 | call to method WriteLine | normal |
 | Finally.cs:56:9:71:9 | try {...} ... | Finally.cs:70:13:70:40 | call to method WriteLine | return [normal] (0) |
 | Finally.cs:56:9:71:9 | try {...} ... | Finally.cs:70:13:70:40 | call to method WriteLine | throw(Exception) [normal] (0) |
 | Finally.cs:56:9:71:9 | try {...} ... | Finally.cs:70:13:70:40 | call to method WriteLine | throw(IOException) [normal] (0) |
-| Finally.cs:56:9:71:9 | try {...} ... | Finally.cs:70:13:70:40 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | Finally.cs:57:9:60:9 | {...} | Finally.cs:58:13:58:37 | call to method WriteLine | throw(Exception) |
-| Finally.cs:57:9:60:9 | {...} | Finally.cs:58:31:58:36 | "Try3" | throw(OutOfMemoryException) |
 | Finally.cs:57:9:60:9 | {...} | Finally.cs:59:13:59:19 | return ...; | return |
 | Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:58:13:58:37 | call to method WriteLine | normal |
 | Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:58:13:58:37 | call to method WriteLine | throw(Exception) |
-| Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:58:31:58:36 | "Try3" | throw(OutOfMemoryException) |
 | Finally.cs:58:13:58:38 | ...; | Finally.cs:58:13:58:37 | call to method WriteLine | normal |
 | Finally.cs:58:13:58:38 | ...; | Finally.cs:58:13:58:37 | call to method WriteLine | throw(Exception) |
-| Finally.cs:58:13:58:38 | ...; | Finally.cs:58:31:58:36 | "Try3" | throw(OutOfMemoryException) |
 | Finally.cs:58:31:58:36 | "Try3" | Finally.cs:58:31:58:36 | "Try3" | normal |
-| Finally.cs:58:31:58:36 | "Try3" | Finally.cs:58:31:58:36 | "Try3" | throw(OutOfMemoryException) |
 | Finally.cs:59:13:59:19 | return ...; | Finally.cs:59:13:59:19 | return ...; | return |
 | Finally.cs:61:9:64:9 | catch (...) {...} | Finally.cs:61:9:64:9 | catch (...) {...} | no-match |
 | Finally.cs:61:9:64:9 | catch (...) {...} | Finally.cs:63:13:63:18 | throw ...; | throw(IOException) |
@@ -1732,9 +1710,7 @@
 | Finally.cs:62:9:64:9 | {...} | Finally.cs:63:13:63:18 | throw ...; | throw(IOException) |
 | Finally.cs:63:13:63:18 | throw ...; | Finally.cs:63:13:63:18 | throw ...; | throw(IOException) |
 | Finally.cs:65:9:67:9 | catch (...) {...} | Finally.cs:65:9:67:9 | catch (...) {...} | throw(Exception) [no-match] (0) |
-| Finally.cs:65:9:67:9 | catch (...) {...} | Finally.cs:65:9:67:9 | catch (...) {...} | throw(OutOfMemoryException) [no-match] (0) |
 | Finally.cs:65:9:67:9 | catch (...) {...} | Finally.cs:65:35:65:51 | ... != ... | throw(Exception) [false] (0) |
-| Finally.cs:65:9:67:9 | catch (...) {...} | Finally.cs:65:35:65:51 | ... != ... | throw(OutOfMemoryException) [false] (0) |
 | Finally.cs:65:9:67:9 | catch (...) {...} | Finally.cs:66:9:67:9 | {...} | normal |
 | Finally.cs:65:26:65:26 | Exception e | Finally.cs:65:26:65:26 | Exception e | normal |
 | Finally.cs:65:35:65:35 | access to local variable e | Finally.cs:65:35:65:35 | access to local variable e | normal |
@@ -1934,23 +1910,17 @@
 | Finally.cs:129:13:129:13 | ; | Finally.cs:129:13:129:13 | ; | normal |
 | Finally.cs:134:5:145:5 | {...} | Finally.cs:141:13:141:44 | throw ...; | throw(ArgumentException) |
 | Finally.cs:134:5:145:5 | {...} | Finally.cs:142:13:142:37 | call to method WriteLine | throw(Exception) [normal] (0) |
-| Finally.cs:134:5:145:5 | {...} | Finally.cs:142:13:142:37 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | Finally.cs:134:5:145:5 | {...} | Finally.cs:144:9:144:33 | call to method WriteLine | normal |
 | Finally.cs:135:9:143:9 | try {...} ... | Finally.cs:141:13:141:44 | throw ...; | throw(ArgumentException) |
 | Finally.cs:135:9:143:9 | try {...} ... | Finally.cs:142:13:142:37 | call to method WriteLine | normal |
 | Finally.cs:135:9:143:9 | try {...} ... | Finally.cs:142:13:142:37 | call to method WriteLine | throw(Exception) [normal] (0) |
-| Finally.cs:135:9:143:9 | try {...} ... | Finally.cs:142:13:142:37 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | Finally.cs:136:9:138:9 | {...} | Finally.cs:137:13:137:36 | call to method WriteLine | normal |
 | Finally.cs:136:9:138:9 | {...} | Finally.cs:137:13:137:36 | call to method WriteLine | throw(Exception) |
-| Finally.cs:136:9:138:9 | {...} | Finally.cs:137:31:137:35 | "Try" | throw(OutOfMemoryException) |
 | Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:137:13:137:36 | call to method WriteLine | normal |
 | Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:137:13:137:36 | call to method WriteLine | throw(Exception) |
-| Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:137:31:137:35 | "Try" | throw(OutOfMemoryException) |
 | Finally.cs:137:13:137:37 | ...; | Finally.cs:137:13:137:36 | call to method WriteLine | normal |
 | Finally.cs:137:13:137:37 | ...; | Finally.cs:137:13:137:36 | call to method WriteLine | throw(Exception) |
-| Finally.cs:137:13:137:37 | ...; | Finally.cs:137:31:137:35 | "Try" | throw(OutOfMemoryException) |
 | Finally.cs:137:31:137:35 | "Try" | Finally.cs:137:31:137:35 | "Try" | normal |
-| Finally.cs:137:31:137:35 | "Try" | Finally.cs:137:31:137:35 | "Try" | throw(OutOfMemoryException) |
 | Finally.cs:140:9:143:9 | {...} | Finally.cs:141:13:141:44 | throw ...; | throw(ArgumentException) |
 | Finally.cs:140:9:143:9 | {...} | Finally.cs:142:13:142:37 | call to method WriteLine | normal |
 | Finally.cs:141:13:141:44 | throw ...; | Finally.cs:141:13:141:44 | throw ...; | throw(ArgumentException) |
@@ -2005,13 +1975,11 @@
 | Finally.cs:157:13:160:13 | {...} | Finally.cs:158:21:158:36 | ... == ... | false |
 | Finally.cs:157:13:160:13 | {...} | Finally.cs:159:21:159:45 | throw ...; | throw(Exception) |
 | Finally.cs:157:13:160:13 | {...} | Finally.cs:159:27:159:44 | object creation of type Exception | throw(Exception) |
-| Finally.cs:157:13:160:13 | {...} | Finally.cs:159:41:159:43 | "1" | throw(OutOfMemoryException) |
 | Finally.cs:158:17:159:45 | if (...) ... | Finally.cs:158:21:158:31 | access to property Length | throw(Exception) |
 | Finally.cs:158:17:159:45 | if (...) ... | Finally.cs:158:21:158:31 | access to property Length | throw(NullReferenceException) |
 | Finally.cs:158:17:159:45 | if (...) ... | Finally.cs:158:21:158:36 | ... == ... | false |
 | Finally.cs:158:17:159:45 | if (...) ... | Finally.cs:159:21:159:45 | throw ...; | throw(Exception) |
 | Finally.cs:158:17:159:45 | if (...) ... | Finally.cs:159:27:159:44 | object creation of type Exception | throw(Exception) |
-| Finally.cs:158:17:159:45 | if (...) ... | Finally.cs:159:41:159:43 | "1" | throw(OutOfMemoryException) |
 | Finally.cs:158:21:158:24 | access to parameter args | Finally.cs:158:21:158:24 | access to parameter args | normal |
 | Finally.cs:158:21:158:31 | access to property Length | Finally.cs:158:21:158:31 | access to property Length | normal |
 | Finally.cs:158:21:158:31 | access to property Length | Finally.cs:158:21:158:31 | access to property Length | throw(Exception) |
@@ -2023,12 +1991,9 @@
 | Finally.cs:158:36:158:36 | 1 | Finally.cs:158:36:158:36 | 1 | normal |
 | Finally.cs:159:21:159:45 | throw ...; | Finally.cs:159:21:159:45 | throw ...; | throw(Exception) |
 | Finally.cs:159:21:159:45 | throw ...; | Finally.cs:159:27:159:44 | object creation of type Exception | throw(Exception) |
-| Finally.cs:159:21:159:45 | throw ...; | Finally.cs:159:41:159:43 | "1" | throw(OutOfMemoryException) |
 | Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:27:159:44 | object creation of type Exception | normal |
 | Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:27:159:44 | object creation of type Exception | throw(Exception) |
-| Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:41:159:43 | "1" | throw(OutOfMemoryException) |
 | Finally.cs:159:41:159:43 | "1" | Finally.cs:159:41:159:43 | "1" | normal |
-| Finally.cs:159:41:159:43 | "1" | Finally.cs:159:41:159:43 | "1" | throw(OutOfMemoryException) |
 | Finally.cs:161:13:164:13 | catch (...) {...} | Finally.cs:161:13:164:13 | catch (...) {...} | no-match |
 | Finally.cs:161:13:164:13 | catch (...) {...} | Finally.cs:161:39:161:54 | ... == ... | false |
 | Finally.cs:161:13:164:13 | catch (...) {...} | Finally.cs:163:17:163:42 | call to method WriteLine | normal |
@@ -2191,15 +2156,11 @@
 | Finally.cs:218:9:229:9 | try {...} ... | Finally.cs:228:13:228:40 | call to method WriteLine | normal |
 | Finally.cs:219:9:221:9 | {...} | Finally.cs:220:13:220:36 | call to method WriteLine | normal |
 | Finally.cs:219:9:221:9 | {...} | Finally.cs:220:13:220:36 | call to method WriteLine | throw(Exception) |
-| Finally.cs:219:9:221:9 | {...} | Finally.cs:220:31:220:35 | "Try" | throw(OutOfMemoryException) |
 | Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:220:13:220:36 | call to method WriteLine | normal |
 | Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:220:13:220:36 | call to method WriteLine | throw(Exception) |
-| Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:220:31:220:35 | "Try" | throw(OutOfMemoryException) |
 | Finally.cs:220:13:220:37 | ...; | Finally.cs:220:13:220:36 | call to method WriteLine | normal |
 | Finally.cs:220:13:220:37 | ...; | Finally.cs:220:13:220:36 | call to method WriteLine | throw(Exception) |
-| Finally.cs:220:13:220:37 | ...; | Finally.cs:220:31:220:35 | "Try" | throw(OutOfMemoryException) |
 | Finally.cs:220:31:220:35 | "Try" | Finally.cs:220:31:220:35 | "Try" | normal |
-| Finally.cs:220:31:220:35 | "Try" | Finally.cs:220:31:220:35 | "Try" | throw(OutOfMemoryException) |
 | Finally.cs:222:9:225:9 | catch {...} | Finally.cs:224:13:224:38 | call to method WriteLine | normal |
 | Finally.cs:223:9:225:9 | {...} | Finally.cs:224:13:224:38 | call to method WriteLine | normal |
 | Finally.cs:224:13:224:38 | call to method WriteLine | Finally.cs:224:13:224:38 | call to method WriteLine | normal |
@@ -2214,19 +2175,16 @@
 | Finally.cs:230:27:230:32 | "Done" | Finally.cs:230:27:230:32 | "Done" | normal |
 | Finally.cs:234:5:261:5 | {...} | Finally.cs:258:13:258:46 | call to method WriteLine | throw(Exception) [normal] (0) |
 | Finally.cs:234:5:261:5 | {...} | Finally.cs:258:13:258:46 | call to method WriteLine | throw(ExceptionA) [normal] (0) |
-| Finally.cs:234:5:261:5 | {...} | Finally.cs:258:13:258:46 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | Finally.cs:234:5:261:5 | {...} | Finally.cs:260:9:260:33 | call to method WriteLine | normal |
 | Finally.cs:235:9:259:9 | try {...} ... | Finally.cs:258:13:258:46 | call to method WriteLine | normal |
 | Finally.cs:235:9:259:9 | try {...} ... | Finally.cs:258:13:258:46 | call to method WriteLine | throw(Exception) [normal] (0) |
 | Finally.cs:235:9:259:9 | try {...} ... | Finally.cs:258:13:258:46 | call to method WriteLine | throw(ExceptionA) [normal] (0) |
-| Finally.cs:235:9:259:9 | try {...} ... | Finally.cs:258:13:258:46 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | Finally.cs:236:9:255:9 | {...} | Finally.cs:251:21:251:54 | call to method WriteLine | throw(Exception) [normal] (0) |
 | Finally.cs:236:9:255:9 | {...} | Finally.cs:251:21:251:54 | call to method WriteLine | throw(Exception) [normal] (1) |
 | Finally.cs:236:9:255:9 | {...} | Finally.cs:251:21:251:54 | call to method WriteLine | throw(ExceptionA) [normal] (0) |
 | Finally.cs:236:9:255:9 | {...} | Finally.cs:251:21:251:54 | call to method WriteLine | throw(ExceptionA) [normal] (1) |
 | Finally.cs:236:9:255:9 | {...} | Finally.cs:254:13:254:44 | call to method WriteLine | normal |
 | Finally.cs:236:9:255:9 | {...} | Finally.cs:254:13:254:44 | call to method WriteLine | throw(Exception) |
-| Finally.cs:236:9:255:9 | {...} | Finally.cs:254:31:254:43 | "Mid finally" | throw(OutOfMemoryException) |
 | Finally.cs:237:13:253:13 | try {...} ... | Finally.cs:251:21:251:54 | call to method WriteLine | normal |
 | Finally.cs:237:13:253:13 | try {...} ... | Finally.cs:251:21:251:54 | call to method WriteLine | throw(Exception) [normal] (0) |
 | Finally.cs:237:13:253:13 | try {...} ... | Finally.cs:251:21:251:54 | call to method WriteLine | throw(Exception) [normal] (1) |
@@ -2268,12 +2226,9 @@
 | Finally.cs:251:39:251:53 | "Inner finally" | Finally.cs:251:39:251:53 | "Inner finally" | normal |
 | Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:254:13:254:44 | call to method WriteLine | normal |
 | Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:254:13:254:44 | call to method WriteLine | throw(Exception) |
-| Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:254:31:254:43 | "Mid finally" | throw(OutOfMemoryException) |
 | Finally.cs:254:13:254:45 | ...; | Finally.cs:254:13:254:44 | call to method WriteLine | normal |
 | Finally.cs:254:13:254:45 | ...; | Finally.cs:254:13:254:44 | call to method WriteLine | throw(Exception) |
-| Finally.cs:254:13:254:45 | ...; | Finally.cs:254:31:254:43 | "Mid finally" | throw(OutOfMemoryException) |
 | Finally.cs:254:31:254:43 | "Mid finally" | Finally.cs:254:31:254:43 | "Mid finally" | normal |
-| Finally.cs:254:31:254:43 | "Mid finally" | Finally.cs:254:31:254:43 | "Mid finally" | throw(OutOfMemoryException) |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:258:13:258:46 | call to method WriteLine | normal |
 | Finally.cs:258:13:258:46 | call to method WriteLine | Finally.cs:258:13:258:46 | call to method WriteLine | normal |
 | Finally.cs:258:13:258:47 | ...; | Finally.cs:258:13:258:46 | call to method WriteLine | normal |
@@ -4112,7 +4067,6 @@
 | cflow.cs:262:5:277:5 | {...} | cflow.cs:275:13:275:41 | call to method WriteLine | normal |
 | cflow.cs:262:5:277:5 | {...} | cflow.cs:275:13:275:41 | call to method WriteLine | return [normal] (0) |
 | cflow.cs:262:5:277:5 | {...} | cflow.cs:275:13:275:41 | call to method WriteLine | throw(Exception) [normal] (0) |
-| cflow.cs:262:5:277:5 | {...} | cflow.cs:275:13:275:41 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | cflow.cs:263:9:263:23 | yield return ...; | cflow.cs:263:9:263:23 | yield return ...; | normal |
 | cflow.cs:263:22:263:22 | 0 | cflow.cs:263:22:263:22 | 0 | normal |
 | cflow.cs:264:9:267:9 | for (...;...;...) ... | cflow.cs:264:25:264:30 | ... < ... | false |
@@ -4130,20 +4084,15 @@
 | cflow.cs:268:9:276:9 | try {...} ... | cflow.cs:275:13:275:41 | call to method WriteLine | normal |
 | cflow.cs:268:9:276:9 | try {...} ... | cflow.cs:275:13:275:41 | call to method WriteLine | return [normal] (0) |
 | cflow.cs:268:9:276:9 | try {...} ... | cflow.cs:275:13:275:41 | call to method WriteLine | throw(Exception) [normal] (0) |
-| cflow.cs:268:9:276:9 | try {...} ... | cflow.cs:275:13:275:41 | call to method WriteLine | throw(OutOfMemoryException) [normal] (0) |
 | cflow.cs:269:9:272:9 | {...} | cflow.cs:270:13:270:24 | yield break; | return |
 | cflow.cs:269:9:272:9 | {...} | cflow.cs:271:13:271:42 | call to method WriteLine | normal |
 | cflow.cs:269:9:272:9 | {...} | cflow.cs:271:13:271:42 | call to method WriteLine | throw(Exception) |
-| cflow.cs:269:9:272:9 | {...} | cflow.cs:271:31:271:41 | "dead code" | throw(OutOfMemoryException) |
 | cflow.cs:270:13:270:24 | yield break; | cflow.cs:270:13:270:24 | yield break; | return |
 | cflow.cs:271:13:271:42 | call to method WriteLine | cflow.cs:271:13:271:42 | call to method WriteLine | normal |
 | cflow.cs:271:13:271:42 | call to method WriteLine | cflow.cs:271:13:271:42 | call to method WriteLine | throw(Exception) |
-| cflow.cs:271:13:271:42 | call to method WriteLine | cflow.cs:271:31:271:41 | "dead code" | throw(OutOfMemoryException) |
 | cflow.cs:271:13:271:43 | ...; | cflow.cs:271:13:271:42 | call to method WriteLine | normal |
 | cflow.cs:271:13:271:43 | ...; | cflow.cs:271:13:271:42 | call to method WriteLine | throw(Exception) |
-| cflow.cs:271:13:271:43 | ...; | cflow.cs:271:31:271:41 | "dead code" | throw(OutOfMemoryException) |
 | cflow.cs:271:31:271:41 | "dead code" | cflow.cs:271:31:271:41 | "dead code" | normal |
-| cflow.cs:271:31:271:41 | "dead code" | cflow.cs:271:31:271:41 | "dead code" | throw(OutOfMemoryException) |
 | cflow.cs:274:9:276:9 | {...} | cflow.cs:275:13:275:41 | call to method WriteLine | normal |
 | cflow.cs:275:13:275:41 | call to method WriteLine | cflow.cs:275:13:275:41 | call to method WriteLine | normal |
 | cflow.cs:275:13:275:42 | ...; | cflow.cs:275:13:275:41 | call to method WriteLine | normal |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
index 15c97dd2c42..f3fabcfe6bb 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
@@ -1859,19 +1859,14 @@
 | Finally.cs:11:13:11:37 | call to method WriteLine | Finally.cs:14:9:16:9 | {...} | semmle.label | successor |
 | Finally.cs:11:13:11:38 | ...; | Finally.cs:11:31:11:36 | "Try1" | semmle.label | successor |
 | Finally.cs:11:31:11:36 | "Try1" | Finally.cs:11:13:11:37 | call to method WriteLine | semmle.label | successor |
-| Finally.cs:11:31:11:36 | "Try1" | Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} | Finally.cs:15:13:15:41 | [finally: exception(Exception)] ...; | semmle.label | successor |
-| Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:15:13:15:41 | [finally: exception(OutOfMemoryException)] ...; | semmle.label | successor |
 | Finally.cs:14:9:16:9 | {...} | Finally.cs:15:13:15:41 | ...; | semmle.label | successor |
 | Finally.cs:15:13:15:40 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:7:10:7:11 | exit M1 (abnormal) | semmle.label | exception(Exception) |
-| Finally.cs:15:13:15:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:7:10:7:11 | exit M1 (abnormal) | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:15:13:15:40 | call to method WriteLine | Finally.cs:7:10:7:11 | exit M1 (normal) | semmle.label | successor |
 | Finally.cs:15:13:15:41 | ...; | Finally.cs:15:31:15:39 | "Finally" | semmle.label | successor |
 | Finally.cs:15:13:15:41 | [finally: exception(Exception)] ...; | Finally.cs:15:31:15:39 | [finally: exception(Exception)] "Finally" | semmle.label | successor |
-| Finally.cs:15:13:15:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:15:31:15:39 | [finally: exception(OutOfMemoryException)] "Finally" | semmle.label | successor |
 | Finally.cs:15:31:15:39 | "Finally" | Finally.cs:15:13:15:40 | call to method WriteLine | semmle.label | successor |
 | Finally.cs:15:31:15:39 | [finally: exception(Exception)] "Finally" | Finally.cs:15:13:15:40 | [finally: exception(Exception)] call to method WriteLine | semmle.label | successor |
-| Finally.cs:15:31:15:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:15:13:15:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | semmle.label | successor |
 | Finally.cs:19:10:19:11 | enter M2 | Finally.cs:20:5:52:5 | {...} | semmle.label | successor |
 | Finally.cs:19:10:19:11 | exit M2 (abnormal) | Finally.cs:19:10:19:11 | exit M2 | semmle.label | successor |
 | Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:19:10:19:11 | exit M2 | semmle.label | successor |
@@ -1882,18 +1877,15 @@
 | Finally.cs:23:13:23:37 | call to method WriteLine | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | semmle.label | exception(Exception) |
 | Finally.cs:23:13:23:38 | ...; | Finally.cs:23:31:23:36 | "Try2" | semmle.label | successor |
 | Finally.cs:23:31:23:36 | "Try2" | Finally.cs:23:13:23:37 | call to method WriteLine | semmle.label | successor |
-| Finally.cs:23:31:23:36 | "Try2" | Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:24:13:24:19 | return ...; | Finally.cs:49:9:51:9 | [finally: return] {...} | semmle.label | return |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | semmle.label | match |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | semmle.label | no-match |
-| Finally.cs:26:9:29:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | semmle.label | no-match |
 | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | Finally.cs:26:48:26:51 | [exception: Exception] true | semmle.label | successor |
 | Finally.cs:26:48:26:51 | [exception: Exception] true | Finally.cs:27:9:29:9 | {...} | semmle.label | true |
 | Finally.cs:27:9:29:9 | {...} | Finally.cs:28:13:28:18 | throw ...; | semmle.label | successor |
 | Finally.cs:28:13:28:18 | throw ...; | Finally.cs:49:9:51:9 | [finally: exception(IOException)] {...} | semmle.label | exception(IOException) |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | semmle.label | match |
 | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | semmle.label | no-match |
-| Finally.cs:30:9:40:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | semmle.label | no-match |
 | Finally.cs:30:41:30:42 | [exception: Exception] ArgumentException ex | Finally.cs:31:9:40:9 | {...} | semmle.label | successor |
 | Finally.cs:31:9:40:9 | {...} | Finally.cs:32:13:39:13 | try {...} ... | semmle.label | successor |
 | Finally.cs:32:13:39:13 | try {...} ... | Finally.cs:33:13:35:13 | {...} | semmle.label | successor |
@@ -1906,7 +1898,6 @@
 | Finally.cs:38:23:38:43 | [finally: exception(ArgumentException)] object creation of type Exception | Finally.cs:38:17:38:44 | [finally: exception(ArgumentException)] throw ...; | semmle.label | successor |
 | Finally.cs:38:37:38:42 | [finally: exception(ArgumentException)] "Boo!" | Finally.cs:38:23:38:43 | [finally: exception(ArgumentException)] object creation of type Exception | semmle.label | successor |
 | Finally.cs:41:9:43:9 | [exception: Exception] catch (...) {...} | Finally.cs:42:9:43:9 | {...} | semmle.label | match |
-| Finally.cs:41:9:43:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:42:9:43:9 | {...} | semmle.label | match |
 | Finally.cs:42:9:43:9 | {...} | Finally.cs:49:9:51:9 | {...} | semmle.label | successor |
 | Finally.cs:49:9:51:9 | [finally: exception(Exception)] {...} | Finally.cs:50:13:50:41 | [finally: exception(Exception)] ...; | semmle.label | successor |
 | Finally.cs:49:9:51:9 | [finally: exception(IOException)] {...} | Finally.cs:50:13:50:41 | [finally: exception(IOException)] ...; | semmle.label | successor |
@@ -1934,49 +1925,36 @@
 | Finally.cs:58:13:58:37 | call to method WriteLine | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | semmle.label | exception(Exception) |
 | Finally.cs:58:13:58:38 | ...; | Finally.cs:58:31:58:36 | "Try3" | semmle.label | successor |
 | Finally.cs:58:31:58:36 | "Try3" | Finally.cs:58:13:58:37 | call to method WriteLine | semmle.label | successor |
-| Finally.cs:58:31:58:36 | "Try3" | Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:59:13:59:19 | return ...; | Finally.cs:69:9:71:9 | [finally: return] {...} | semmle.label | return |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | semmle.label | match |
 | Finally.cs:61:9:64:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | semmle.label | no-match |
-| Finally.cs:61:9:64:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | semmle.label | no-match |
 | Finally.cs:61:38:61:39 | [exception: Exception] IOException ex | Finally.cs:61:48:61:51 | [exception: Exception] true | semmle.label | successor |
 | Finally.cs:61:48:61:51 | [exception: Exception] true | Finally.cs:62:9:64:9 | {...} | semmle.label | true |
 | Finally.cs:62:9:64:9 | {...} | Finally.cs:63:13:63:18 | throw ...; | semmle.label | successor |
 | Finally.cs:63:13:63:18 | throw ...; | Finally.cs:69:9:71:9 | [finally: exception(IOException)] {...} | semmle.label | exception(IOException) |
 | Finally.cs:65:9:67:9 | [exception: Exception] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | semmle.label | match |
-| Finally.cs:65:9:67:9 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | semmle.label | match |
 | Finally.cs:65:26:65:26 | [exception: Exception] Exception e | Finally.cs:65:35:65:35 | [exception: Exception] access to local variable e | semmle.label | successor |
-| Finally.cs:65:26:65:26 | [exception: OutOfMemoryException] Exception e | Finally.cs:65:35:65:35 | [exception: OutOfMemoryException] access to local variable e | semmle.label | successor |
 | Finally.cs:65:35:65:35 | [exception: Exception] access to local variable e | Finally.cs:65:35:65:43 | [exception: Exception] access to property Message | semmle.label | successor |
-| Finally.cs:65:35:65:35 | [exception: OutOfMemoryException] access to local variable e | Finally.cs:65:35:65:43 | [exception: OutOfMemoryException] access to property Message | semmle.label | successor |
 | Finally.cs:65:35:65:43 | [exception: Exception] access to property Message | Finally.cs:65:48:65:51 | [exception: Exception] null | semmle.label | successor |
-| Finally.cs:65:35:65:43 | [exception: OutOfMemoryException] access to property Message | Finally.cs:65:48:65:51 | [exception: OutOfMemoryException] null | semmle.label | successor |
 | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... | Finally.cs:66:9:67:9 | {...} | semmle.label | true |
 | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | semmle.label | exception(Exception) |
-| Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... | Finally.cs:66:9:67:9 | {...} | semmle.label | true |
-| Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... | Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:65:48:65:51 | [exception: Exception] null | Finally.cs:65:35:65:51 | [exception: Exception] ... != ... | semmle.label | successor |
-| Finally.cs:65:48:65:51 | [exception: OutOfMemoryException] null | Finally.cs:65:35:65:51 | [exception: OutOfMemoryException] ... != ... | semmle.label | successor |
 | Finally.cs:66:9:67:9 | {...} | Finally.cs:69:9:71:9 | {...} | semmle.label | successor |
 | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | Finally.cs:70:13:70:41 | [finally: exception(Exception)] ...; | semmle.label | successor |
 | Finally.cs:69:9:71:9 | [finally: exception(IOException)] {...} | Finally.cs:70:13:70:41 | [finally: exception(IOException)] ...; | semmle.label | successor |
-| Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:70:13:70:41 | [finally: exception(OutOfMemoryException)] ...; | semmle.label | successor |
 | Finally.cs:69:9:71:9 | [finally: return] {...} | Finally.cs:70:13:70:41 | [finally: return] ...; | semmle.label | successor |
 | Finally.cs:69:9:71:9 | {...} | Finally.cs:70:13:70:41 | ...; | semmle.label | successor |
 | Finally.cs:70:13:70:40 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:54:10:54:11 | exit M3 (abnormal) | semmle.label | exception(Exception) |
 | Finally.cs:70:13:70:40 | [finally: exception(IOException)] call to method WriteLine | Finally.cs:54:10:54:11 | exit M3 (abnormal) | semmle.label | exception(IOException) |
-| Finally.cs:70:13:70:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:54:10:54:11 | exit M3 (abnormal) | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:70:13:70:40 | [finally: return] call to method WriteLine | Finally.cs:54:10:54:11 | exit M3 (normal) | semmle.label | return |
 | Finally.cs:70:13:70:40 | call to method WriteLine | Finally.cs:54:10:54:11 | exit M3 (normal) | semmle.label | successor |
 | Finally.cs:70:13:70:41 | ...; | Finally.cs:70:31:70:39 | "Finally" | semmle.label | successor |
 | Finally.cs:70:13:70:41 | [finally: exception(Exception)] ...; | Finally.cs:70:31:70:39 | [finally: exception(Exception)] "Finally" | semmle.label | successor |
 | Finally.cs:70:13:70:41 | [finally: exception(IOException)] ...; | Finally.cs:70:31:70:39 | [finally: exception(IOException)] "Finally" | semmle.label | successor |
-| Finally.cs:70:13:70:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:70:31:70:39 | [finally: exception(OutOfMemoryException)] "Finally" | semmle.label | successor |
 | Finally.cs:70:13:70:41 | [finally: return] ...; | Finally.cs:70:31:70:39 | [finally: return] "Finally" | semmle.label | successor |
 | Finally.cs:70:31:70:39 | "Finally" | Finally.cs:70:13:70:40 | call to method WriteLine | semmle.label | successor |
 | Finally.cs:70:31:70:39 | [finally: exception(Exception)] "Finally" | Finally.cs:70:13:70:40 | [finally: exception(Exception)] call to method WriteLine | semmle.label | successor |
 | Finally.cs:70:31:70:39 | [finally: exception(IOException)] "Finally" | Finally.cs:70:13:70:40 | [finally: exception(IOException)] call to method WriteLine | semmle.label | successor |
-| Finally.cs:70:31:70:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:70:13:70:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | semmle.label | successor |
 | Finally.cs:70:31:70:39 | [finally: return] "Finally" | Finally.cs:70:13:70:40 | [finally: return] call to method WriteLine | semmle.label | successor |
 | Finally.cs:74:10:74:11 | enter M4 | Finally.cs:75:5:101:5 | {...} | semmle.label | successor |
 | Finally.cs:74:10:74:11 | exit M4 (abnormal) | Finally.cs:74:10:74:11 | exit M4 | semmle.label | successor |
@@ -2257,19 +2235,14 @@
 | Finally.cs:137:13:137:36 | call to method WriteLine | Finally.cs:140:9:143:9 | {...} | semmle.label | successor |
 | Finally.cs:137:13:137:37 | ...; | Finally.cs:137:31:137:35 | "Try" | semmle.label | successor |
 | Finally.cs:137:31:137:35 | "Try" | Finally.cs:137:13:137:36 | call to method WriteLine | semmle.label | successor |
-| Finally.cs:137:31:137:35 | "Try" | Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} | Finally.cs:141:41:141:42 | [finally: exception(Exception)] "" | semmle.label | successor |
-| Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:141:41:141:42 | [finally: exception(OutOfMemoryException)] "" | semmle.label | successor |
 | Finally.cs:140:9:143:9 | {...} | Finally.cs:141:41:141:42 | "" | semmle.label | successor |
 | Finally.cs:141:13:141:44 | [finally: exception(Exception)] throw ...; | Finally.cs:133:10:133:11 | exit M7 (abnormal) | semmle.label | exception(ArgumentException) |
-| Finally.cs:141:13:141:44 | [finally: exception(OutOfMemoryException)] throw ...; | Finally.cs:133:10:133:11 | exit M7 (abnormal) | semmle.label | exception(ArgumentException) |
 | Finally.cs:141:13:141:44 | throw ...; | Finally.cs:133:10:133:11 | exit M7 (abnormal) | semmle.label | exception(ArgumentException) |
 | Finally.cs:141:19:141:43 | [finally: exception(Exception)] object creation of type ArgumentException | Finally.cs:141:13:141:44 | [finally: exception(Exception)] throw ...; | semmle.label | successor |
-| Finally.cs:141:19:141:43 | [finally: exception(OutOfMemoryException)] object creation of type ArgumentException | Finally.cs:141:13:141:44 | [finally: exception(OutOfMemoryException)] throw ...; | semmle.label | successor |
 | Finally.cs:141:19:141:43 | object creation of type ArgumentException | Finally.cs:141:13:141:44 | throw ...; | semmle.label | successor |
 | Finally.cs:141:41:141:42 | "" | Finally.cs:141:19:141:43 | object creation of type ArgumentException | semmle.label | successor |
 | Finally.cs:141:41:141:42 | [finally: exception(Exception)] "" | Finally.cs:141:19:141:43 | [finally: exception(Exception)] object creation of type ArgumentException | semmle.label | successor |
-| Finally.cs:141:41:141:42 | [finally: exception(OutOfMemoryException)] "" | Finally.cs:141:19:141:43 | [finally: exception(OutOfMemoryException)] object creation of type ArgumentException | semmle.label | successor |
 | Finally.cs:147:10:147:11 | enter M8 | Finally.cs:148:5:170:5 | {...} | semmle.label | successor |
 | Finally.cs:147:10:147:11 | exit M8 (abnormal) | Finally.cs:147:10:147:11 | exit M8 | semmle.label | successor |
 | Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:147:10:147:11 | exit M8 | semmle.label | successor |
@@ -2327,74 +2300,50 @@
 | Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:159:21:159:45 | throw ...; | semmle.label | successor |
 | Finally.cs:159:27:159:44 | object creation of type Exception | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | semmle.label | exception(Exception) |
 | Finally.cs:159:41:159:43 | "1" | Finally.cs:159:27:159:44 | object creation of type Exception | semmle.label | successor |
-| Finally.cs:159:41:159:43 | "1" | Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:159:27:159:44 | [finally: exception(ArgumentNullException)] object creation of type Exception | semmle.label | successor |
-| Finally.cs:159:41:159:43 | [finally: exception(ArgumentNullException)] "1" | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:159:27:159:44 | [finally: exception(Exception)] object creation of type Exception | semmle.label | successor |
-| Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:161:13:164:13 | [exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | semmle.label | match |
 | Finally.cs:161:13:164:13 | [exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | semmle.label | match |
-| Finally.cs:161:13:164:13 | [exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | semmle.label | match |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | semmle.label | match |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | semmle.label | match |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | semmle.label | match |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | semmle.label | match |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | semmle.label | match |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | semmle.label | match |
 | Finally.cs:161:30:161:30 | [exception: Exception] Exception e | Finally.cs:161:39:161:39 | [exception: Exception] access to local variable e | semmle.label | successor |
 | Finally.cs:161:30:161:30 | [exception: NullReferenceException] Exception e | Finally.cs:161:39:161:39 | [exception: NullReferenceException] access to local variable e | semmle.label | successor |
-| Finally.cs:161:30:161:30 | [exception: OutOfMemoryException] Exception e | Finally.cs:161:39:161:39 | [exception: OutOfMemoryException] access to local variable e | semmle.label | successor |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: Exception] access to local variable e | semmle.label | successor |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to local variable e | semmle.label | successor |
-| Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to local variable e | semmle.label | successor |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: Exception] access to local variable e | semmle.label | successor |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: NullReferenceException] access to local variable e | semmle.label | successor |
-| Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: OutOfMemoryException] access to local variable e | semmle.label | successor |
 | Finally.cs:161:39:161:39 | [exception: Exception] access to local variable e | Finally.cs:161:39:161:47 | [exception: Exception] access to property Message | semmle.label | successor |
 | Finally.cs:161:39:161:39 | [exception: NullReferenceException] access to local variable e | Finally.cs:161:39:161:47 | [exception: NullReferenceException] access to property Message | semmle.label | successor |
-| Finally.cs:161:39:161:39 | [exception: OutOfMemoryException] access to local variable e | Finally.cs:161:39:161:47 | [exception: OutOfMemoryException] access to property Message | semmle.label | successor |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: Exception] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: Exception] access to property Message | semmle.label | successor |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to property Message | semmle.label | successor |
-| Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to property Message | semmle.label | successor |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: Exception] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: Exception] access to property Message | semmle.label | successor |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: NullReferenceException] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: NullReferenceException] access to property Message | semmle.label | successor |
-| Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: OutOfMemoryException] access to local variable e | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: OutOfMemoryException] access to property Message | semmle.label | successor |
 | Finally.cs:161:39:161:47 | [exception: Exception] access to property Message | Finally.cs:161:52:161:54 | [exception: Exception] "1" | semmle.label | successor |
 | Finally.cs:161:39:161:47 | [exception: NullReferenceException] access to property Message | Finally.cs:161:52:161:54 | [exception: NullReferenceException] "1" | semmle.label | successor |
-| Finally.cs:161:39:161:47 | [exception: OutOfMemoryException] access to property Message | Finally.cs:161:52:161:54 | [exception: OutOfMemoryException] "1" | semmle.label | successor |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: Exception] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: Exception] "1" | semmle.label | successor |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] "1" | semmle.label | successor |
-| Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] "1" | semmle.label | successor |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: Exception] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: Exception] "1" | semmle.label | successor |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: NullReferenceException] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: NullReferenceException] "1" | semmle.label | successor |
-| Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: OutOfMemoryException] access to property Message | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] "1" | semmle.label | successor |
 | Finally.cs:161:39:161:54 | [exception: Exception] ... == ... | Finally.cs:162:13:164:13 | {...} | semmle.label | true |
 | Finally.cs:161:39:161:54 | [exception: Exception] ... == ... | Finally.cs:165:13:168:13 | catch {...} | semmle.label | false |
 | Finally.cs:161:39:161:54 | [exception: NullReferenceException] ... == ... | Finally.cs:162:13:164:13 | {...} | semmle.label | true |
 | Finally.cs:161:39:161:54 | [exception: NullReferenceException] ... == ... | Finally.cs:165:13:168:13 | catch {...} | semmle.label | false |
-| Finally.cs:161:39:161:54 | [exception: OutOfMemoryException] ... == ... | Finally.cs:162:13:164:13 | {...} | semmle.label | true |
-| Finally.cs:161:39:161:54 | [exception: OutOfMemoryException] ... == ... | Finally.cs:165:13:168:13 | catch {...} | semmle.label | false |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | semmle.label | true |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(ArgumentNullException)] catch {...} | semmle.label | false |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | semmle.label | true |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(ArgumentNullException)] catch {...} | semmle.label | false |
-| Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | semmle.label | true |
-| Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(ArgumentNullException)] catch {...} | semmle.label | false |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | semmle.label | true |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(Exception)] catch {...} | semmle.label | false |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | semmle.label | true |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(Exception)] catch {...} | semmle.label | false |
-| Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | semmle.label | true |
-| Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... | Finally.cs:165:13:168:13 | [finally: exception(Exception)] catch {...} | semmle.label | false |
 | Finally.cs:161:52:161:54 | [exception: Exception] "1" | Finally.cs:161:39:161:54 | [exception: Exception] ... == ... | semmle.label | successor |
 | Finally.cs:161:52:161:54 | [exception: NullReferenceException] "1" | Finally.cs:161:39:161:54 | [exception: NullReferenceException] ... == ... | semmle.label | successor |
-| Finally.cs:161:52:161:54 | [exception: OutOfMemoryException] "1" | Finally.cs:161:39:161:54 | [exception: OutOfMemoryException] ... == ... | semmle.label | successor |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: Exception] "1" | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... | semmle.label | successor |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] "1" | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... | semmle.label | successor |
-| Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] "1" | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... | semmle.label | successor |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: Exception] "1" | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... | semmle.label | successor |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: NullReferenceException] "1" | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... | semmle.label | successor |
-| Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] "1" | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... | semmle.label | successor |
 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | Finally.cs:163:17:163:43 | [finally: exception(ArgumentNullException)] ...; | semmle.label | successor |
 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | Finally.cs:163:17:163:43 | [finally: exception(Exception)] ...; | semmle.label | successor |
 | Finally.cs:162:13:164:13 | {...} | Finally.cs:163:17:163:43 | ...; | semmle.label | successor |
@@ -2613,7 +2562,6 @@
 | Finally.cs:220:13:220:36 | call to method WriteLine | Finally.cs:227:9:229:9 | {...} | semmle.label | successor |
 | Finally.cs:220:13:220:37 | ...; | Finally.cs:220:31:220:35 | "Try" | semmle.label | successor |
 | Finally.cs:220:31:220:35 | "Try" | Finally.cs:220:13:220:36 | call to method WriteLine | semmle.label | successor |
-| Finally.cs:220:31:220:35 | "Try" | Finally.cs:222:9:225:9 | catch {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:222:9:225:9 | catch {...} | Finally.cs:223:9:225:9 | {...} | semmle.label | successor |
 | Finally.cs:223:9:225:9 | {...} | Finally.cs:224:13:224:39 | ...; | semmle.label | successor |
 | Finally.cs:224:13:224:38 | call to method WriteLine | Finally.cs:227:9:229:9 | {...} | semmle.label | successor |
@@ -2707,23 +2655,18 @@
 | Finally.cs:254:13:254:44 | call to method WriteLine | Finally.cs:257:9:259:9 | {...} | semmle.label | successor |
 | Finally.cs:254:13:254:45 | ...; | Finally.cs:254:31:254:43 | "Mid finally" | semmle.label | successor |
 | Finally.cs:254:31:254:43 | "Mid finally" | Finally.cs:254:13:254:44 | call to method WriteLine | semmle.label | successor |
-| Finally.cs:254:31:254:43 | "Mid finally" | Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:258:13:258:47 | [finally: exception(Exception)] ...; | semmle.label | successor |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:258:13:258:47 | [finally: exception(ExceptionA)] ...; | semmle.label | successor |
-| Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:258:13:258:47 | [finally: exception(OutOfMemoryException)] ...; | semmle.label | successor |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:258:13:258:47 | ...; | semmle.label | successor |
 | Finally.cs:258:13:258:46 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:233:10:233:12 | exit M12 (abnormal) | semmle.label | exception(Exception) |
 | Finally.cs:258:13:258:46 | [finally: exception(ExceptionA)] call to method WriteLine | Finally.cs:233:10:233:12 | exit M12 (abnormal) | semmle.label | exception(ExceptionA) |
-| Finally.cs:258:13:258:46 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:233:10:233:12 | exit M12 (abnormal) | semmle.label | exception(OutOfMemoryException) |
 | Finally.cs:258:13:258:46 | call to method WriteLine | Finally.cs:260:9:260:34 | ...; | semmle.label | successor |
 | Finally.cs:258:13:258:47 | ...; | Finally.cs:258:31:258:45 | "Outer finally" | semmle.label | successor |
 | Finally.cs:258:13:258:47 | [finally: exception(Exception)] ...; | Finally.cs:258:31:258:45 | [finally: exception(Exception)] "Outer finally" | semmle.label | successor |
 | Finally.cs:258:13:258:47 | [finally: exception(ExceptionA)] ...; | Finally.cs:258:31:258:45 | [finally: exception(ExceptionA)] "Outer finally" | semmle.label | successor |
-| Finally.cs:258:13:258:47 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:258:31:258:45 | [finally: exception(OutOfMemoryException)] "Outer finally" | semmle.label | successor |
 | Finally.cs:258:31:258:45 | "Outer finally" | Finally.cs:258:13:258:46 | call to method WriteLine | semmle.label | successor |
 | Finally.cs:258:31:258:45 | [finally: exception(Exception)] "Outer finally" | Finally.cs:258:13:258:46 | [finally: exception(Exception)] call to method WriteLine | semmle.label | successor |
 | Finally.cs:258:31:258:45 | [finally: exception(ExceptionA)] "Outer finally" | Finally.cs:258:13:258:46 | [finally: exception(ExceptionA)] call to method WriteLine | semmle.label | successor |
-| Finally.cs:258:31:258:45 | [finally: exception(OutOfMemoryException)] "Outer finally" | Finally.cs:258:13:258:46 | [finally: exception(OutOfMemoryException)] call to method WriteLine | semmle.label | successor |
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:233:10:233:12 | exit M12 (normal) | semmle.label | successor |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:260:27:260:32 | "Done" | semmle.label | successor |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:9:260:33 | call to method WriteLine | semmle.label | successor |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
index 3823d0b2b45..bac3edcdd3f 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
@@ -619,13 +619,9 @@ finallyNode
 | CompileTimeOperators.cs:37:13:37:41 | [finally: goto(End)] ...; | CompileTimeOperators.cs:30:9:38:9 | try {...} ... |
 | CompileTimeOperators.cs:37:31:37:39 | [finally: goto(End)] "Finally" | CompileTimeOperators.cs:30:9:38:9 | try {...} ... |
 | Finally.cs:14:9:16:9 | [finally: exception(Exception)] {...} | Finally.cs:9:9:16:9 | try {...} ... |
-| Finally.cs:14:9:16:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:9:9:16:9 | try {...} ... |
 | Finally.cs:15:13:15:40 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:9:9:16:9 | try {...} ... |
-| Finally.cs:15:13:15:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:9:9:16:9 | try {...} ... |
 | Finally.cs:15:13:15:41 | [finally: exception(Exception)] ...; | Finally.cs:9:9:16:9 | try {...} ... |
-| Finally.cs:15:13:15:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:9:9:16:9 | try {...} ... |
 | Finally.cs:15:31:15:39 | [finally: exception(Exception)] "Finally" | Finally.cs:9:9:16:9 | try {...} ... |
-| Finally.cs:15:31:15:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:9:9:16:9 | try {...} ... |
 | Finally.cs:37:13:39:13 | [finally: exception(ArgumentException)] {...} | Finally.cs:32:13:39:13 | try {...} ... |
 | Finally.cs:38:17:38:44 | [finally: exception(ArgumentException)] throw ...; | Finally.cs:32:13:39:13 | try {...} ... |
 | Finally.cs:38:23:38:43 | [finally: exception(ArgumentException)] object creation of type Exception | Finally.cs:32:13:39:13 | try {...} ... |
@@ -644,19 +640,15 @@ finallyNode
 | Finally.cs:50:31:50:39 | [finally: return] "Finally" | Finally.cs:21:9:51:9 | try {...} ... |
 | Finally.cs:69:9:71:9 | [finally: exception(Exception)] {...} | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:69:9:71:9 | [finally: exception(IOException)] {...} | Finally.cs:56:9:71:9 | try {...} ... |
-| Finally.cs:69:9:71:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:69:9:71:9 | [finally: return] {...} | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:70:13:70:40 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:70:13:70:40 | [finally: exception(IOException)] call to method WriteLine | Finally.cs:56:9:71:9 | try {...} ... |
-| Finally.cs:70:13:70:40 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:70:13:70:40 | [finally: return] call to method WriteLine | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:70:13:70:41 | [finally: exception(Exception)] ...; | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:70:13:70:41 | [finally: exception(IOException)] ...; | Finally.cs:56:9:71:9 | try {...} ... |
-| Finally.cs:70:13:70:41 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:70:13:70:41 | [finally: return] ...; | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:70:31:70:39 | [finally: exception(Exception)] "Finally" | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:70:31:70:39 | [finally: exception(IOException)] "Finally" | Finally.cs:56:9:71:9 | try {...} ... |
-| Finally.cs:70:31:70:39 | [finally: exception(OutOfMemoryException)] "Finally" | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:70:31:70:39 | [finally: return] "Finally" | Finally.cs:56:9:71:9 | try {...} ... |
 | Finally.cs:89:13:99:13 | [finally: break] {...} | Finally.cs:79:13:99:13 | try {...} ... |
 | Finally.cs:89:13:99:13 | [finally: continue] {...} | Finally.cs:79:13:99:13 | try {...} ... |
@@ -802,13 +794,9 @@ finallyNode
 | Finally.cs:117:35:117:35 | [finally: exception(OutOfMemoryException)] 1 | Finally.cs:105:9:118:9 | try {...} ... |
 | Finally.cs:117:35:117:35 | [finally: return] 1 | Finally.cs:105:9:118:9 | try {...} ... |
 | Finally.cs:140:9:143:9 | [finally: exception(Exception)] {...} | Finally.cs:135:9:143:9 | try {...} ... |
-| Finally.cs:140:9:143:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:135:9:143:9 | try {...} ... |
 | Finally.cs:141:13:141:44 | [finally: exception(Exception)] throw ...; | Finally.cs:135:9:143:9 | try {...} ... |
-| Finally.cs:141:13:141:44 | [finally: exception(OutOfMemoryException)] throw ...; | Finally.cs:135:9:143:9 | try {...} ... |
 | Finally.cs:141:19:141:43 | [finally: exception(Exception)] object creation of type ArgumentException | Finally.cs:135:9:143:9 | try {...} ... |
-| Finally.cs:141:19:141:43 | [finally: exception(OutOfMemoryException)] object creation of type ArgumentException | Finally.cs:135:9:143:9 | try {...} ... |
 | Finally.cs:141:41:141:42 | [finally: exception(Exception)] "" | Finally.cs:135:9:143:9 | try {...} ... |
-| Finally.cs:141:41:141:42 | [finally: exception(OutOfMemoryException)] "" | Finally.cs:135:9:143:9 | try {...} ... |
 | Finally.cs:155:9:169:9 | [finally: exception(ArgumentNullException)] {...} | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:155:9:169:9 | [finally: exception(Exception)] {...} | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:156:13:168:13 | [finally: exception(ArgumentNullException)] try {...} ... | Finally.cs:149:9:169:9 | try {...} ... |
@@ -833,40 +821,28 @@ finallyNode
 | Finally.cs:159:41:159:43 | [finally: exception(Exception)] "1" | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...} | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...} | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:13:164:13 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: Exception] catch (...) {...} | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: NullReferenceException] catch (...) {...} | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:13:164:13 | [finally: exception(Exception), exception: OutOfMemoryException] catch (...) {...} | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: Exception] Exception e | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: NullReferenceException] Exception e | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:30:161:30 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] Exception e | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: Exception] Exception e | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: NullReferenceException] Exception e | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:30:161:30 | [finally: exception(Exception), exception: OutOfMemoryException] Exception e | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: Exception] access to local variable e | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to local variable e | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:39:161:39 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to local variable e | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: Exception] access to local variable e | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: NullReferenceException] access to local variable e | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:39:161:39 | [finally: exception(Exception), exception: OutOfMemoryException] access to local variable e | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: Exception] access to property Message | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: NullReferenceException] access to property Message | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:39:161:47 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] access to property Message | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: Exception] access to property Message | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: NullReferenceException] access to property Message | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:39:161:47 | [finally: exception(Exception), exception: OutOfMemoryException] access to property Message | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: Exception] ... == ... | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] ... == ... | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:39:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] ... == ... | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: Exception] ... == ... | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: NullReferenceException] ... == ... | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:39:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] ... == ... | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: Exception] "1" | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: NullReferenceException] "1" | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:52:161:54 | [finally: exception(ArgumentNullException), exception: OutOfMemoryException] "1" | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: Exception] "1" | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: NullReferenceException] "1" | Finally.cs:149:9:169:9 | try {...} ... |
-| Finally.cs:161:52:161:54 | [finally: exception(Exception), exception: OutOfMemoryException] "1" | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:162:13:164:13 | [finally: exception(ArgumentNullException)] {...} | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:162:13:164:13 | [finally: exception(Exception)] {...} | Finally.cs:149:9:169:9 | try {...} ... |
 | Finally.cs:163:17:163:42 | [finally: exception(ArgumentNullException)] call to method WriteLine | Finally.cs:149:9:169:9 | try {...} ... |
@@ -1031,16 +1007,12 @@ finallyNode
 | Finally.cs:251:39:251:53 | [finally: exception(ExceptionA)] "Inner finally" | Finally.cs:244:17:252:17 | try {...} ... |
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:235:9:259:9 | try {...} ... |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:235:9:259:9 | try {...} ... |
-| Finally.cs:257:9:259:9 | [finally: exception(OutOfMemoryException)] {...} | Finally.cs:235:9:259:9 | try {...} ... |
 | Finally.cs:258:13:258:46 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:235:9:259:9 | try {...} ... |
 | Finally.cs:258:13:258:46 | [finally: exception(ExceptionA)] call to method WriteLine | Finally.cs:235:9:259:9 | try {...} ... |
-| Finally.cs:258:13:258:46 | [finally: exception(OutOfMemoryException)] call to method WriteLine | Finally.cs:235:9:259:9 | try {...} ... |
 | Finally.cs:258:13:258:47 | [finally: exception(Exception)] ...; | Finally.cs:235:9:259:9 | try {...} ... |
 | Finally.cs:258:13:258:47 | [finally: exception(ExceptionA)] ...; | Finally.cs:235:9:259:9 | try {...} ... |
-| Finally.cs:258:13:258:47 | [finally: exception(OutOfMemoryException)] ...; | Finally.cs:235:9:259:9 | try {...} ... |
 | Finally.cs:258:31:258:45 | [finally: exception(Exception)] "Outer finally" | Finally.cs:235:9:259:9 | try {...} ... |
 | Finally.cs:258:31:258:45 | [finally: exception(ExceptionA)] "Outer finally" | Finally.cs:235:9:259:9 | try {...} ... |
-| Finally.cs:258:31:258:45 | [finally: exception(OutOfMemoryException)] "Outer finally" | Finally.cs:235:9:259:9 | try {...} ... |
 | cflow.cs:274:9:276:9 | [finally: return] {...} | cflow.cs:268:9:276:9 | try {...} ... |
 | cflow.cs:275:13:275:41 | [finally: return] call to method WriteLine | cflow.cs:268:9:276:9 | try {...} ... |
 | cflow.cs:275:13:275:42 | [finally: return] ...; | cflow.cs:268:9:276:9 | try {...} ... |
diff --git a/csharp/ql/test/library-tests/exceptions/Exceptions1.expected b/csharp/ql/test/library-tests/exceptions/Exceptions1.expected
index 9c88ed1e60a..f3e813a7395 100644
--- a/csharp/ql/test/library-tests/exceptions/Exceptions1.expected
+++ b/csharp/ql/test/library-tests/exceptions/Exceptions1.expected
@@ -12,7 +12,6 @@
 | exceptions.cs:105:13:105:13 | ; | exceptions.cs:114:13:114:13 | ; |
 | exceptions.cs:134:13:134:13 | ; | exceptions.cs:143:13:143:13 | ; |
 | exceptions.cs:163:13:163:13 | ; | exceptions.cs:172:13:172:13 | ; |
-| exceptions.cs:192:13:192:13 | ; | exceptions.cs:205:13:205:13 | ; |
 | exceptions.cs:222:13:222:13 | ; | exceptions.cs:235:13:235:13 | ; |
 | exceptions.cs:280:13:280:13 | ; | exceptions.cs:297:13:297:13 | ; |
 | exceptions.cs:309:13:309:13 | ; | exceptions.cs:314:13:314:13 | ; |

From a00bd7ae027d17a2cd2e2931a37baa31943d1245 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 8 Jan 2021 19:47:02 +0100
Subject: [PATCH 056/343] C++: Respond to review comments.

---
 .../ir/dataflow/internal/DataFlowPrivate.qll  |  48 ++++---
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 120 +++++++++---------
 .../dataflow/fields/ir-path-flow.expected     |   6 +-
 3 files changed, 92 insertions(+), 82 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index 39672fe8e58..e19fc9228c2 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -350,20 +350,25 @@ private class InexactLoadOperand extends LoadOperand {
   InexactLoadOperand() { this.isDefinitionInexact() }
 }
 
+/** Get the result type of an `Instruction` i, if it is a `PointerType`. */
+private PointerType getPointerType(Instruction i) {
+  // We are done if the type is a pointer type that is not a glvalue
+  i.getResultLanguageType().hasType(result, false)
+  or
+  // Some instructions produce a glvalue. Recurse past those to get the actual `PointerType`.
+  result = getPointerType(i.(PointerOffsetInstruction).getLeft())
+}
+
 private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
   a = TArrayContent() and
   // Explicit dereferences such as `*p` or `p[i]` where `p` is a pointer or array.
-  exists(InexactLoadOperand operand, Instruction address |
+  exists(InexactLoadOperand operand, LoadInstruction load |
+    load.getSourceValueOperand() = operand and
     node1.asInstruction() = operand.getAnyDef() and
     not node1.asInstruction().isResultConflated() and
     operand = node2.asOperand() and
-    instructionOperandLocalFlowStep+(instructionNode(address),
-      operandNode(operand.getAddressOperand())) and
-    (
-      address instanceof LoadInstruction or
-      address instanceof ArrayToPointerConvertInstruction or
-      address instanceof PointerOffsetInstruction
-    )
+    // Ensure that the load is actually loading from an array or a pointer.
+    getPointerType(load.getSourceAddress()).getBaseType() = load.getResultType()
   )
 }
 
@@ -392,19 +397,18 @@ bindingset[result, i]
 private int unbindInt(int i) { i <= result and i >= result }
 
 pragma[noinline]
-private predicate getFieldNodeFromLoadOperand(FieldNode fieldNode, LoadOperand loadOperand) {
-  fieldNode = getFieldNodeForFieldInstruction(loadOperand.getAddressOperand().getDef())
+private FieldNode getFieldNodeFromLoadOperand(LoadOperand loadOperand) {
+  result = getFieldNodeForFieldInstruction(loadOperand.getAddressOperand().getDef())
 }
 
-// Sometimes there's no explicit field dereference. In such cases we use the IR alias analysis to
-// determine the offset being, and deduce the field from this information.
+/**
+ * Sometimes there's no explicit field dereference. In such cases we use the IR alias analysis to
+ * determine the offset being, and deduce the field from this information.
+ */
 private predicate aliasedReadStep(Node node1, FieldContent f, Node node2) {
   exists(LoadOperand operand, Class c, int startBit, int endBit |
     // Ensure that we don't already catch this store step using a `FieldNode`.
-    not exists(FieldNode node |
-      getFieldNodeFromLoadOperand(node, operand) and
-      instrToFieldNodeReadStep(node, f, _)
-    ) and
+    not instrToFieldNodeReadStep(getFieldNodeFromLoadOperand(operand), f, _) and
     node1.asInstruction() = operand.getAnyDef() and
     node2.asOperand() = operand and
     not node1.asInstruction().isResultConflated() and
@@ -414,6 +418,11 @@ private predicate aliasedReadStep(Node node1, FieldContent f, Node node2) {
   )
 }
 
+/** Get the result type of an `Instruction` i, if it is a `ReferenceType`. */
+private ReferenceType getReferenceType(Instruction i) {
+  i.getResultLanguageType().hasType(result, false)
+}
+
 /**
  * In cases such as:
  * ```cpp
@@ -431,7 +440,7 @@ private predicate aliasedReadStep(Node node1, FieldContent f, Node node2) {
  */
 private predicate innerReadSteap(Node node1, Content a, Node node2) {
   a = TArrayContent() and
-  exists(WriteSideEffectInstruction write, CallInstruction call, Expr arg |
+  exists(WriteSideEffectInstruction write, CallInstruction call, CopyValueInstruction copyValue |
     write.getPrimaryInstruction() = call and
     node1.asInstruction() = write and
     (
@@ -440,8 +449,9 @@ private predicate innerReadSteap(Node node1, Content a, Node node2) {
       exists(ChiInstruction chi | chi.getPartial() = write and not chi.isResultConflated())
     ) and
     node2.asInstruction() = write and
-    arg = call.getArgument(write.getIndex()).getUnconvertedResultExpression() and
-    (arg instanceof AddressOfExpr or arg.getConversion() instanceof ReferenceToExpr)
+    copyValue = call.getArgument(write.getIndex()) and
+    [getPointerType(copyValue).getBaseType(), getReferenceType(copyValue).getBaseType()] =
+      copyValue.getSourceValue().getResultType()
   )
 }
 
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 5ab582dc6d8..016bf565021 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -192,7 +192,7 @@ class OperandNode extends Node, TOperandNode {
 FieldNode getFieldNodeForFieldInstruction(Instruction instr) {
   result.getFieldInstruction() =
     any(FieldAddressInstruction fai |
-      instructionOperandLocalFlowStep*(instructionNode(fai), instructionNode(instr))
+      longestRegisterInstructionOperandLocalFlowStep(instructionNode(fai), instructionNode(instr))
     )
 }
 
@@ -251,13 +251,19 @@ class FieldNode extends Node, TFieldNode {
 /**
  * INTERNAL: do not use. A partial definition of a `FieldNode`.
  */
-class PartialFieldDefinition extends PartialDefinition {
-  override FieldNode node;
-
-  override FieldNode getPreUpdateNode() { result = node }
+class PartialFieldDefinition extends FieldNode, PartialDefinition {
+  /**
+   * The pre-update node of a partial definition of a `FieldNode` is the `FieldNode` itself. This ensures
+   * that the data flow library's reverse read mechanism builds up the correct access path for nested
+   * fields.
+   * For instance, in `a.b.c = x` there is a partial definition for `c` (let's call it `post[c]`) and a
+   * partial definition for `b` (let's call it `post[b]`), and there is a read step from `b` to `c`
+   * (using `instrToFieldNodeReadStep`), so there is a store step from `post[c]` to `post[b]`.
+   */
+  override FieldNode getPreUpdateNode() { result = this }
 
   override Expr getDefinedExpr() {
-    result = node.getFieldInstruction().getObjectAddress().getUnconvertedResultExpression()
+    result = this.getFieldInstruction().getObjectAddress().getUnconvertedResultExpression()
   }
 }
 
@@ -411,39 +417,13 @@ abstract class PostUpdateNode extends Node {
   override Location getLocation() { result = getPreUpdateNode().getLocation() }
 }
 
-/**
- * A partial definition of a node. A partial definition that targets arrays or pointers is attached to
- * an `InstructionNode` (specifially, to the `ChiInstruction` that follows the `StoreInstruction`), and
- * a partial definition that targets a `FieldNode` is attached to the `FieldNode`.
- *
- * The pre-update node of a partial definition of a `FieldNode` is the `FieldNode` itself. This ensures
- * that the data flow library's reverse read mechanism builds up the correct access path for nested
- * fields.
- * For instance, in `a.b.c = x` there is a partial definition for `c` (let's call it `post[c]`) and a
- * partial definition for `b` (let's call it `post[b]`), and there is a read step from `b` to `c`
- * (using `instrToFieldNodeReadStep`), so there is a store step from `post[c]` to `post[b]`.
- */
-private newtype TPartialDefinition =
-  MkPartialDefinition(Node node) {
-    isPointerStoreNode(node, _, _) or
-    isArrayStoreNode(node, _, _) or
-    node instanceof FieldNode
-  }
-
 /** INTERNAL: do not use. A partial definition of a node. */
-abstract class PartialDefinition extends TPartialDefinition {
-  Node node;
-
-  PartialDefinition() { this = MkPartialDefinition(node) }
-
+abstract class PartialDefinition extends Node {
   /** Gets the node before the state update. */
   abstract Node getPreUpdateNode();
 
   /** Gets the expression that is partially defined by this node. */
   abstract Expr getDefinedExpr();
-
-  /** Gets a string representation of this partial definition. */
-  string toString() { result = node.toString() + " [partial definition]" }
 }
 
 /**
@@ -475,52 +455,44 @@ class PartialDefinitionNode extends PostUpdateNode, TPartialDefinitionNode {
   override string toString() { result = getPreUpdateNode().toString() + " [post update]" }
 }
 
-private predicate isArrayStoreNode(
-  InstructionNode node, ChiInstruction chi, PointerAddInstruction add
-) {
-  chi = node.getInstruction() and
-  not chi.isResultConflated() and
-  exists(StoreInstruction store |
-    chi.getPartial() = store and
-    add = store.getDestinationAddress()
-  )
-}
-
 /**
  * The `PostUpdateNode` that is the target of a `arrayStoreStepChi` store step. The overriden
  * `ChiInstruction` corresponds to the instruction represented by `node2` in `arrayStoreStepChi`.
  */
-private class ArrayStoreNode extends PartialDefinition {
-  override InstructionNode node;
+private class ArrayStoreNode extends InstructionNode, PartialDefinition {
   ChiInstruction chi;
   PointerAddInstruction add;
 
-  ArrayStoreNode() { isArrayStoreNode(node, chi, add) }
+  ArrayStoreNode() {
+    chi = this.getInstruction() and
+    not chi.isResultConflated() and
+    exists(StoreInstruction store |
+      chi.getPartial() = store and
+      add = store.getDestinationAddress()
+    )
+  }
 
   override Node getPreUpdateNode() { result.asOperand() = chi.getTotalOperand() }
 
   override Expr getDefinedExpr() { result = add.getLeft().getUnconvertedResultExpression() }
 }
 
-private predicate isPointerStoreNode(InstructionNode node, ChiInstruction chi, LoadInstruction load) {
-  chi = node.getInstruction() and
-  not chi.isResultConflated() and
-  exists(StoreInstruction store |
-    chi.getPartial() = store and
-    load = store.getDestinationAddress().(CopyValueInstruction).getUnary()
-  )
-}
-
 /**
  * The `PostUpdateNode` that is the target of a `arrayStoreStepChi` store step. The overriden
  * `ChiInstruction` corresponds to the instruction represented by `node2` in `arrayStoreStepChi`.
  */
-private class PointerStoreNode extends PartialDefinition {
-  override InstructionNode node;
+private class PointerStoreNode extends InstructionNode, PartialDefinition {
   ChiInstruction chi;
   LoadInstruction load;
 
-  PointerStoreNode() { isPointerStoreNode(node, chi, load) }
+  PointerStoreNode() {
+    chi = this.getInstruction() and
+    not chi.isResultConflated() and
+    exists(StoreInstruction store |
+      chi.getPartial() = store and
+      load = store.getDestinationAddress().(CopyValueInstruction).getUnary()
+    )
+  }
 
   override Node getPreUpdateNode() { result.asOperand() = chi.getTotalOperand() }
 
@@ -734,12 +706,40 @@ private predicate flowIntoReadNode(Node nodeFrom, FieldNode nodeTo) {
   )
 }
 
+/** Holds if `node` holds an `Instruction` or `Operand` that has a register result. */
+private predicate hasRegisterResult(Node node) {
+  node.asOperand() instanceof RegisterOperand
+  or
+  exists(Instruction i | i = node.asInstruction() and not i.hasMemoryResult())
+}
+
+/**
+ * Holds if there is a `Instruction` or `Operand` flow step from `nodeFrom` to `nodeTo` and both
+ * `nodeFrom` and `nodeTo` wraps register results.
+ */
+private predicate registerInstructionOperandLocalFlowStep(Node nodeFrom, Node nodeTo) {
+  hasRegisterResult(nodeFrom) and
+  hasRegisterResult(nodeTo) and
+  instructionOperandLocalFlowStep(nodeFrom, nodeTo)
+}
+
+/**
+ * INTERNAL: do not use.
+ * Holds if `nodeFrom` has no incoming local `Operand` or `Instruction` register flow and `nodeFrom` can
+ * reach `nodeTo` using only local `Instruction` or `Operand` register flow steps.
+ */
+bindingset[nodeTo]
+private predicate longestRegisterInstructionOperandLocalFlowStep(Node nodeFrom, Node nodeTo) {
+  registerInstructionOperandLocalFlowStep*(nodeFrom, nodeTo) and
+  not registerInstructionOperandLocalFlowStep(_, nodeFrom)
+}
+
 /**
  * INTERNAL: do not use.
  * Holds if `nodeFrom` is an operand and `nodeTo` is an instruction node that uses this operand, or
  * if `nodeFrom` is an instruction and `nodeTo` is an operand that refers to this instruction.
  */
-predicate instructionOperandLocalFlowStep(Node nodeFrom, Node nodeTo) {
+private predicate instructionOperandLocalFlowStep(Node nodeFrom, Node nodeTo) {
   // Operand -> Instruction flow
   simpleInstructionLocalFlowStep(nodeFrom.asOperand(), nodeTo.asInstruction())
   or
diff --git a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
index ee43cd98302..e787b9a5f0e 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
@@ -58,9 +58,9 @@ edges
 | aliasing.cpp:79:11:79:20 | call to user_input | aliasing.cpp:80:12:80:13 | m1 |
 | aliasing.cpp:86:10:86:19 | call to user_input | aliasing.cpp:87:12:87:13 | m1 |
 | aliasing.cpp:92:12:92:21 | call to user_input | aliasing.cpp:93:12:93:13 | m1 |
-| aliasing.cpp:98:5:98:6 | m1 [post update] [m1] | aliasing.cpp:101:21:101:22 | m1 [m1] |
+| aliasing.cpp:98:5:98:6 | m1 [post update] [m1] | aliasing.cpp:100:14:100:14 | Store [m1] |
 | aliasing.cpp:98:10:98:19 | call to user_input | aliasing.cpp:98:5:98:6 | m1 [post update] [m1] |
-| aliasing.cpp:101:21:101:22 | m1 [m1] | aliasing.cpp:102:8:102:10 | * ... |
+| aliasing.cpp:100:14:100:14 | Store [m1] | aliasing.cpp:102:8:102:10 | * ... |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:121:15:121:16 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:126:15:126:20 | taint_a_ptr output argument [array content] |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | aliasing.cpp:131:15:131:16 | taint_a_ptr output argument [array content] |
@@ -373,7 +373,7 @@ nodes
 | aliasing.cpp:93:12:93:13 | m1 | semmle.label | m1 |
 | aliasing.cpp:98:5:98:6 | m1 [post update] [m1] | semmle.label | m1 [post update] [m1] |
 | aliasing.cpp:98:10:98:19 | call to user_input | semmle.label | call to user_input |
-| aliasing.cpp:101:21:101:22 | m1 [m1] | semmle.label | m1 [m1] |
+| aliasing.cpp:100:14:100:14 | Store [m1] | semmle.label | Store [m1] |
 | aliasing.cpp:102:8:102:10 | * ... | semmle.label | * ... |
 | aliasing.cpp:106:3:106:20 | Chi [array content] | semmle.label | Chi [array content] |
 | aliasing.cpp:106:3:106:20 | ChiTotal [post update] [array content] | semmle.label | ChiTotal [post update] [array content] |

From 46393c33ef45534a7e12560f5fba346c6f1b6dc1 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Mon, 11 Jan 2021 09:19:58 +0100
Subject: [PATCH 057/343] C++: Fix bad join orders introduced in previous
 commit.

---
 .../ir/dataflow/internal/DataFlowPrivate.qll  | 27 ++++++++++++++-----
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index e19fc9228c2..a5a30dc756e 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -350,7 +350,7 @@ private class InexactLoadOperand extends LoadOperand {
   InexactLoadOperand() { this.isDefinitionInexact() }
 }
 
-/** Get the result type of an `Instruction` i, if it is a `PointerType`. */
+/** Get the result type of `i`, if it is a `PointerType`. */
 private PointerType getPointerType(Instruction i) {
   // We are done if the type is a pointer type that is not a glvalue
   i.getResultLanguageType().hasType(result, false)
@@ -359,16 +359,24 @@ private PointerType getPointerType(Instruction i) {
   result = getPointerType(i.(PointerOffsetInstruction).getLeft())
 }
 
+pragma[noinline]
+private predicate deconstructLoad(
+  LoadInstruction load, InexactLoadOperand loadOperand, Instruction addressInstr
+) {
+  load.getSourceAddress() = addressInstr and
+  load.getSourceValueOperand() = loadOperand
+}
+
 private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
   a = TArrayContent() and
   // Explicit dereferences such as `*p` or `p[i]` where `p` is a pointer or array.
-  exists(InexactLoadOperand operand, LoadInstruction load |
-    load.getSourceValueOperand() = operand and
-    node1.asInstruction() = operand.getAnyDef() and
+  exists(InexactLoadOperand loadOperand, LoadInstruction load, Instruction address |
+    deconstructLoad(load, loadOperand, address) and
+    node1.asInstruction() = loadOperand.getAnyDef() and
     not node1.asInstruction().isResultConflated() and
-    operand = node2.asOperand() and
+    loadOperand = node2.asOperand() and
     // Ensure that the load is actually loading from an array or a pointer.
-    getPointerType(load.getSourceAddress()).getBaseType() = load.getResultType()
+    getPointerType(address).getBaseType() = load.getResultType()
   )
 }
 
@@ -423,6 +431,11 @@ private ReferenceType getReferenceType(Instruction i) {
   i.getResultLanguageType().hasType(result, false)
 }
 
+pragma[noinline]
+Type getResultTypeOfSourceValue(CopyValueInstruction copy) {
+  result = copy.getSourceValue().getResultType()
+}
+
 /**
  * In cases such as:
  * ```cpp
@@ -451,7 +464,7 @@ private predicate innerReadSteap(Node node1, Content a, Node node2) {
     node2.asInstruction() = write and
     copyValue = call.getArgument(write.getIndex()) and
     [getPointerType(copyValue).getBaseType(), getReferenceType(copyValue).getBaseType()] =
-      copyValue.getSourceValue().getResultType()
+      getResultTypeOfSourceValue(copyValue)
   )
 }
 

From 141b9adc4d38eda5ea3cd9a5b19688979a303c8f Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 11 Jan 2021 11:18:59 +0100
Subject: [PATCH 058/343] Python: Minor refactoring

Co-authored-by: yoff <lerchedahl@gmail.com>
---
 python/ql/src/semmle/python/Concepts.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/Concepts.qll b/python/ql/src/semmle/python/Concepts.qll
index 9a30ebf4871..a90df346b2f 100644
--- a/python/ql/src/semmle/python/Concepts.qll
+++ b/python/ql/src/semmle/python/Concepts.qll
@@ -404,7 +404,7 @@ module HTTP {
 
     /** A parameter that will receive parts of the url when handling an incoming request. */
     private class RoutedParameter extends RemoteFlowSource::Range, DataFlow::ParameterNode {
-      RoutedParameter() { this.getParameter() = any(RequestHandler setup).getARoutedParameter() }
+      RoutedParameter() { this.getParameter() = any(RequestHandler handler).getARoutedParameter() }
 
       override string getSourceType() { result = "RoutedParameter" }
     }

From 580a24e982db8f8412d3aac6d079e4cb7d4ecaa3 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Fri, 19 Jun 2020 11:50:39 +0200
Subject: [PATCH 059/343] JS: rewrite
 js/incomplete-multi-character-sanitization

---
 ...incomplete-multi-character-sanitization.md |   2 +
 .../IncompleteMultiCharacterSanitization.ql   | 194 +++++++++++++-----
 ...ompleteMultiCharacterSanitization.expected |  66 +++---
 .../tst-multi-character-sanitization.js       |  37 +++-
 4 files changed, 204 insertions(+), 95 deletions(-)
 create mode 100644 javascript/change-notes/2021-01-08-js-incomplete-multi-character-sanitization.md

diff --git a/javascript/change-notes/2021-01-08-js-incomplete-multi-character-sanitization.md b/javascript/change-notes/2021-01-08-js-incomplete-multi-character-sanitization.md
new file mode 100644
index 00000000000..653ba2a8994
--- /dev/null
+++ b/javascript/change-notes/2021-01-08-js-incomplete-multi-character-sanitization.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The query "Incomplete multi-character sanitization" (`js/incomplete-multi-character-sanitization`) has been improved to produce additional true positives and fewer false positives.
diff --git a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
index dbff9d98bc5..cef10d3cbe7 100644
--- a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
+++ b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
@@ -12,69 +12,153 @@
  */
 
 import javascript
-import semmle.javascript.security.IncompleteBlacklistSanitizer
 
-predicate isDangerous(RegExpTerm t) {
-  // path traversals
-  t.getAMatchedString() = ["..", "/..", "../"]
-  or
-  exists(RegExpTerm start |
-    start = t.(RegExpSequence).getAChild() and
-    start.getConstantValue() = "." and
-    start.getSuccessor().getConstantValue() = "." and
-    not [start.getPredecessor(), start.getSuccessor().getSuccessor()].getConstantValue() = "."
-  )
-  or
-  // HTML comments
-  t.getAMatchedString() = "<!--"
-  or
-  // HTML scripts
-  t.getAMatchedString().regexpMatch("(?i)<script.*")
-  or
-  exists(RegExpSequence seq | seq = t |
-    t.getChild(0).getConstantValue() = "<" and
-    // the `cript|scrip` case has been observed in the wild, not sure what the goal of that pattern is...
-    t.getChild(0)
-        .getSuccessor+()
-        .getAMatchedString()
-        .regexpMatch("(?i)iframe|script|cript|scrip|style")
-  )
-  or
-  // HTML attributes
-  exists(string dangerousPrefix | dangerousPrefix = ["ng-", "on"] |
-    t.getAMatchedString().regexpMatch("(i?)" + dangerousPrefix + "[a-z]+")
+/**
+ * A regexp term that matches substrings that should be replaced with the empty string.
+ */
+class EmptyReplaceRegExpTerm extends RegExpTerm {
+  EmptyReplaceRegExpTerm() {
+    exists(StringReplaceCall replace |
+      [replace.getRawReplacement(), replace.getCallback(1).getAReturn()].mayHaveStringValue("") and
+      this = replace.getRegExp().getRoot().getAChild*()
+    )
+  }
+}
+
+/**
+ * A prefix that may be dangerous to sanitize explicitly.
+ *
+ * Note that this class exists solely as a (necessary) optimization for this query.
+ */
+class DangerousPrefix extends string {
+  DangerousPrefix() {
+    this = ["/..", "../"] or
+    this = "<!--" or
+    this = "<" + ["iframe", "script", "cript", "scrip", "style"]
+  }
+}
+
+/**
+ * A substring of a prefix that may be dangerous to sanitize explicitly.
+ */
+class DangerousPrefixSubstring extends string {
+  DangerousPrefixSubstring() {
+    exists(DangerousPrefix s | this = s.substring([0 .. s.length()], [0 .. s.length()]))
+  }
+}
+
+/**
+ * Gets a dangerous prefix that is in the prefix language of `t`.
+ */
+DangerousPrefix getADangerousMatchedPrefix(EmptyReplaceRegExpTerm t) {
+  result = getADangerousMatchedPrefixSubstring(t) and
+  not exists(EmptyReplaceRegExpTerm pred | pred = t.getPredecessor+() and not pred.isNullable())
+}
+
+/**
+ * Gets a substring of a dangerous prefix that is in the language starting at `t` (ignoring lookarounds).
+ *
+ * Note that the language of `t` is slightly restricted as not all RegExpTerm types are supported.
+ */
+DangerousPrefixSubstring getADangerousMatchedPrefixSubstring(EmptyReplaceRegExpTerm t) {
+  exists(string left |
+    t.isNullable() and left = ""
     or
-    exists(RegExpTerm start, RegExpTerm event | start = t.getAChild() |
-      start.getConstantValue().regexpMatch("(?i)[^a-z]*" + dangerousPrefix) and
-      event = start.getSuccessor() and
-      exists(RegExpTerm quantified | quantified = event.(RegExpQuantifier).getChild(0) |
-        quantified
-            .(RegExpCharacterClass)
-            .getAChild()
-            .(RegExpCharacterRange)
-            .isRange(["a", "A"], ["z", "Z"]) or
-        [quantified, quantified.(RegExpRange).getAChild()].(RegExpCharacterClassEscape).getValue() =
-          "w"
-      )
+    t.getAMatchedString() = left
+    or
+    (
+      t instanceof RegExpOpt or
+      t instanceof RegExpStar or
+      t instanceof RegExpPlus or
+      t instanceof RegExpGroup or
+      t instanceof RegExpAlt
+    ) and
+    left = getADangerousMatchedPrefixSubstring(t.getAChild())
+  |
+    result = left + getADangerousMatchedPrefixSubstring(t.getSuccessor()) or
+    result = left
+  )
+}
+
+/**
+ * Holds if `t` may match the dangerous `prefix` and some suffix, indicating intent to prevent a vulnerablity of kind `kind`.
+ */
+predicate matchesDangerousPrefix(EmptyReplaceRegExpTerm t, string prefix, string kind) {
+  prefix = getADangerousMatchedPrefix(t) and
+  (
+    kind = "path injection" and
+    // upwards navigation
+    prefix = ["/..", "../"] and
+    not t.getSuccessor*().getAMatchedString().regexpMatch("(?i).*[a-z0-9_-]+.*") // explicit path name mentions make this an unlikely sanitizer
+    or
+    kind = "HTML element injection" and
+    (
+      // comments
+      prefix = "<!--" and
+      not t.getSuccessor*().getAMatchedString().regexpMatch("(?i).*[a-z0-9_]+.*") // explicit comment content mentions make this an unlikely sanitizer
+      or
+      // specific tags
+      prefix = "<" + ["iframe", "script", "cript", "scrip", "style"] // the `cript|scrip` case has been observed in the wild several times
+    )
+  )
+  or
+  kind = "HTML attribute injection" and
+  prefix =
+    [
+      // ordinary event handler prefix
+      "on",
+      // angular prefixes
+      "ng-", "ng:", "data-ng-", "x-ng-"
+    ] and
+  (
+    // explicit matching: `onclick` and `ng-bind`
+    t.getAMatchedString().regexpMatch("(?i)" + prefix + "[a-z]+")
+    or
+    // regexp-based matching: `on[a-z]+`
+    exists(EmptyReplaceRegExpTerm start | start = t.getAChild() |
+      start.getConstantValue().regexpMatch("(?i)[^a-z]*" + prefix) and
+      isCommonWordMatcher(start.getSuccessor())
     )
   )
 }
 
-from StringReplaceCall replace, RegExpTerm regexp, RegExpTerm dangerous
+/**
+ * Holds if `t` is a common pattern for matching words
+ */
+predicate isCommonWordMatcher(RegExpTerm t) {
+  exists(RegExpTerm quantified | quantified = t.(RegExpQuantifier).getChild(0) |
+    // [a-z]+ and similar
+    quantified
+        .(RegExpCharacterClass)
+        .getAChild()
+        .(RegExpCharacterRange)
+        .isRange(["a", "A"], ["z", "Z"])
+    or
+    // \w+ or [\w]+
+    [quantified, quantified.(RegExpCharacterClass).getAChild()]
+        .(RegExpCharacterClassEscape)
+        .getValue() = "w"
+  )
+}
+
+from
+  StringReplaceCall replace, EmptyReplaceRegExpTerm regexp, EmptyReplaceRegExpTerm dangerous,
+  string prefix, string kind
 where
-  [replace.getRawReplacement(), replace.getCallback(1).getAReturn()].mayHaveStringValue("") and
-  replace.isGlobal() and
   regexp = replace.getRegExp().getRoot() and
   dangerous.getRootTerm() = regexp and
-  isDangerous(dangerous) and
-  // avoid anchored terms
-  not exists(RegExpAnchor a | a.getRootTerm() = regexp) and
-  // avoid flagging wrappers
-  not (
-    dangerous instanceof RegExpAlt or
-    dangerous instanceof RegExpGroup
+  // only warn about the longest match (presumably the most descriptive)
+  prefix = max(string m | matchesDangerousPrefix(dangerous, m, kind) | m order by m.length()) and
+  // only warn once per kind
+  not exists(EmptyReplaceRegExpTerm other |
+    other = dangerous.getAChild+() or other = dangerous.getPredecessor+()
+  |
+    matchesDangerousPrefix(other, _, kind)
   ) and
   // don't flag replace operations in a loop
-  not replace.getReceiver().getALocalSource() = replace
-select replace, "The replaced string may still contain a substring that starts matching at $@.",
-  dangerous, dangerous.toString()
+  not replace.getAMethodCall*().flowsTo(replace.getReceiver()) and
+  // avoid anchored terms
+  not exists(RegExpAnchor a | regexp = a.getRootTerm())
+select replace,
+  "This string may still contain a substring that starts matching at $@, which may cause a " + kind +
+    " vulnerability.", dangerous, prefix
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected
index 34e9a5ea94c..048109da744 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected
@@ -1,33 +1,33 @@
-| tst-multi-character-sanitization.js:3:13:3:57 | content ... gi, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:3:30:3:49 | <.*cript.*\\/scrip.*> | <.*cript.*\\/scrip.*> |
-| tst-multi-character-sanitization.js:4:13:4:47 | content ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:4:30:4:40 |  on\\w+=".*" |  on\\w+=".*" |
-| tst-multi-character-sanitization.js:5:13:5:49 | content ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:5:30:5:42 |  on\\w+=\\'.*\\' |  on\\w+=\\'.*\\' |
-| tst-multi-character-sanitization.js:9:13:9:47 | content ... gi, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:9:30:9:39 | <.*cript.* | <.*cript.* |
-| tst-multi-character-sanitization.js:10:13:10:49 | content ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:10:30:10:42 | .on\\w+=.*".*" | .on\\w+=.*".*" |
-| tst-multi-character-sanitization.js:11:13:11:51 | content ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:11:30:11:44 | .on\\w+=.*\\'.*\\' | .on\\w+=.*\\'.*\\' |
-| tst-multi-character-sanitization.js:19:3:19:35 | respons ... pt, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:18:18:18:24 | <script | <script |
-| tst-multi-character-sanitization.js:25:10:25:40 | text.re ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:25:24:25:27 | <!-- | <!-- |
-| tst-multi-character-sanitization.js:38:8:38:30 | id.repl ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:38:20:38:23 | \\.\\. | \\.\\. |
-| tst-multi-character-sanitization.js:49:13:49:43 | req.url ... EL, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:48:21:48:31 | (\\/)?\\.\\.\\/ | (\\/)?\\.\\.\\/ |
-| tst-multi-character-sanitization.js:64:7:64:73 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:64:18:64:24 | <script | <script |
-| tst-multi-character-sanitization.js:66:7:66:56 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:66:18:66:49 | (\\/\|\\s)on\\w+=(\\'\|")?[^"]*(\\'\|")? | (\\/\|\\s)on\\w+=(\\'\|")?[^"]*(\\'\|")? |
-| tst-multi-character-sanitization.js:75:7:75:37 | x.repla ... gm, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:75:18:75:21 | <!-- | <!-- |
-| tst-multi-character-sanitization.js:77:7:77:36 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:77:18:77:29 | \\sng-[a-z-]+ | \\sng-[a-z-]+ |
-| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:81:18:81:24 | <script | <script |
-| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:81:36:81:39 | only | only |
-| tst-multi-character-sanitization.js:82:7:82:50 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:82:18:82:30 | <script async | <script async |
-| tst-multi-character-sanitization.js:83:7:83:63 | x.repla ... gi, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:83:18:83:21 | <!-- | <!-- |
-| tst-multi-character-sanitization.js:85:7:85:48 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:85:18:85:41 | \\x2E\\x2E\\x2F\\x2E\\x2E\\x2F | \\x2E\\x2E\\x2F\\x2E\\x2E\\x2F |
-| tst-multi-character-sanitization.js:87:7:87:47 | x.repla ... gi, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:87:18:87:24 | <script | <script |
-| tst-multi-character-sanitization.js:92:7:96:4 | x.repla ... ";\\n  }) | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:92:18:92:24 | <script | <script |
-| tst-multi-character-sanitization.js:100:7:100:28 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:100:18:100:21 | \\.\\. | \\.\\. |
-| tst-multi-character-sanitization.js:101:7:101:30 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:101:18:101:23 | \\.\\.\\/ | \\.\\.\\/ |
-| tst-multi-character-sanitization.js:102:7:102:30 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:102:18:102:23 | \\/\\.\\. | \\/\\.\\. |
-| tst-multi-character-sanitization.js:104:7:104:58 | x.repla ... gi, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:104:18:104:24 | <script | <script |
-| tst-multi-character-sanitization.js:106:7:106:64 | x.repla ... gi, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:106:18:106:56 | <(script\|del)(?=[\\s>])[\\w\\W]*?<\\/\\1\\s*> | <(script\|del)(?=[\\s>])[\\w\\W]*?<\\/\\1\\s*> |
-| tst-multi-character-sanitization.js:107:7:107:62 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:107:18:107:55 | \\<script[\\s\\S]*?\\>[\\s\\S]*?\\<\\/script\\> | \\<script[\\s\\S]*?\\>[\\s\\S]*?\\<\\/script\\> |
-| tst-multi-character-sanitization.js:108:7:108:75 | x.repla ... gm, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:108:18:108:67 | <(script\|style\|title)[^<]+<\\/(script\|style\|title)> | <(script\|style\|title)[^<]+<\\/(script\|style\|title)> |
-| tst-multi-character-sanitization.js:109:7:109:58 | x.repla ... gi, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:109:18:109:24 | <script | <script |
-| tst-multi-character-sanitization.js:110:7:110:50 | x.repla ... gi, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:110:18:110:24 | <script | <script |
-| tst-multi-character-sanitization.js:111:7:111:32 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:111:20:111:23 | <!-- | <!-- |
-| tst-multi-character-sanitization.js:112:7:112:50 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:112:18:112:43 | require\\('\\.\\.\\/common'\\); | require\\('\\.\\.\\/common'\\); |
-| tst-multi-character-sanitization.js:113:7:113:41 | x.repla ... /g, "") | The replaced string may still contain a substring that starts matching at $@. | tst-multi-character-sanitization.js:113:18:113:34 | \\.\\.\\/\\.\\.\\/lib\\/ | \\.\\.\\/\\.\\.\\/lib\\/ |
+| tst-multi-character-sanitization.js:3:13:3:57 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:3:30:3:30 | < | <cript |
+| tst-multi-character-sanitization.js:4:13:4:47 | content ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:4:30:4:40 |  on\\w+=".*" | on |
+| tst-multi-character-sanitization.js:5:13:5:49 | content ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:5:30:5:42 |  on\\w+=\\'.*\\' | on |
+| tst-multi-character-sanitization.js:9:13:9:47 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:9:30:9:30 | < | <cript |
+| tst-multi-character-sanitization.js:10:13:10:49 | content ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:10:30:10:42 | .on\\w+=.*".*" | on |
+| tst-multi-character-sanitization.js:11:13:11:51 | content ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:11:30:11:44 | .on\\w+=.*\\'.*\\' | on |
+| tst-multi-character-sanitization.js:19:3:19:35 | respons ... pt, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:18:18:18:24 | <script | <script |
+| tst-multi-character-sanitization.js:25:10:25:40 | text.re ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:25:24:25:27 | <!-- | <!-- |
+| tst-multi-character-sanitization.js:49:13:49:43 | req.url ... EL, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:48:22:48:23 | \\/ | /.. |
+| tst-multi-character-sanitization.js:64:7:64:73 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:64:18:64:24 | <script | <script |
+| tst-multi-character-sanitization.js:66:7:66:56 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:66:18:66:49 | (\\/\|\\s)on\\w+=(\\'\|")?[^"]*(\\'\|")? | on |
+| tst-multi-character-sanitization.js:75:7:75:37 | x.repla ... gm, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:75:18:75:21 | <!-- | <!-- |
+| tst-multi-character-sanitization.js:76:7:76:35 | x.repla ... +/, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:76:18:76:29 | \\sng-[a-z-]+ | ng- |
+| tst-multi-character-sanitization.js:77:7:77:36 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:77:18:77:29 | \\sng-[a-z-]+ | ng- |
+| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:81:36:81:39 | only | on |
+| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:81:18:81:24 | <script | <script |
+| tst-multi-character-sanitization.js:83:7:83:63 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:83:18:83:21 | <!-- | <!-- |
+| tst-multi-character-sanitization.js:85:7:85:48 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:85:18:85:21 | \\x2E | ../ |
+| tst-multi-character-sanitization.js:87:7:87:47 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:87:18:87:24 | <script | <script |
+| tst-multi-character-sanitization.js:92:7:96:4 | x.repla ... ";\\n  }) | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:92:18:92:24 | <script | <script |
+| tst-multi-character-sanitization.js:101:7:101:30 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:101:18:101:19 | \\. | ../ |
+| tst-multi-character-sanitization.js:102:7:102:30 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:102:18:102:19 | \\/ | /.. |
+| tst-multi-character-sanitization.js:104:7:104:58 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:104:18:104:24 | <script | <script |
+| tst-multi-character-sanitization.js:106:7:106:64 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:106:18:106:18 | < | <script |
+| tst-multi-character-sanitization.js:107:7:107:62 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:107:18:107:19 | \\< | <script |
+| tst-multi-character-sanitization.js:108:7:108:75 | x.repla ... gm, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:108:18:108:18 | < | <script |
+| tst-multi-character-sanitization.js:109:7:109:58 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:109:18:109:24 | <script | <script |
+| tst-multi-character-sanitization.js:110:7:110:50 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:110:18:110:24 | <script | <script |
+| tst-multi-character-sanitization.js:111:7:111:32 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:111:18:111:19 |  ? | <!-- |
+| tst-multi-character-sanitization.js:126:7:129:34 | x\\n    . ... //, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:129:15:129:20 | [^\\/]* | /.. |
+| tst-multi-character-sanitization.js:135:2:135:44 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:135:19:135:25 | <script | <script |
+| tst-multi-character-sanitization.js:136:2:136:46 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:136:19:136:19 | < | <script |
+| tst-multi-character-sanitization.js:138:2:138:48 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:138:19:138:20 | .* | <script |
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst-multi-character-sanitization.js b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst-multi-character-sanitization.js
index 0400e392bfb..dfb7c493053 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst-multi-character-sanitization.js
+++ b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/tst-multi-character-sanitization.js
@@ -35,7 +35,7 @@
 
 // CVE-2019-10767
 (function(id) {
-  id = id.replace(/\.\./g, ""); // NOT OK
+  id = id.replace(/\.\./g, ""); // OK (can not contain '..' afterwards)
   return id;
 });
 (function(id) {
@@ -73,13 +73,13 @@
   x = x.replace(/<li><\/li>/gi, ""); // OK
 
   x = x.replace(/<!--(.*?)-->/gm, ""); // NOT OK
-  x = x.replace(/\sng-[a-z-]+/, ""); // OK (single ng-attribute, should be flagged by some other query!)
+  x = x.replace(/\sng-[a-z-]+/, ""); // NOT OK
   x = x.replace(/\sng-[a-z-]+/g, ""); // NOT OK (ng-attributes)
 
   x = x.replace(/(<!--\[CDATA\[|\]\]-->)/g, "\n"); // OK: not a sanitizer
 
-  x = x.replace(/<script.+desktop\-only.+<\/script>/g, ""); // OK, but still flagged [INCONSISTENCY]
-  x = x.replace(/<script async.+?<\/script>/g, ""); // OK, but still flagged [INCONSISTENCY]
+  x = x.replace(/<script.+desktop\-only.+<\/script>/g, ""); // OK [INCONSISTENCY]
+  x = x.replace(/<script async.+?<\/script>/g, ""); // OK
   x = x.replace(/<!--[\s\S]*?-->|<\?(?:php)?[\s\S]*?\?>/gi, ""); // NOT OK
 
   x = x.replace(/\x2E\x2E\x2F\x2E\x2E\x2F/g, ""); // NOT OK (matches "../../")
@@ -97,7 +97,7 @@
 
   x = x.replace(/<\/?([a-z][a-z0-9]*)\b[^>]*>/gi, ""); // NOT OK [INCONSISTENCY]
 
-  x = x.replace(/\.\./g, ""); // NOT OK
+  x = x.replace(/\.\./g, ""); // OK
   x = x.replace(/\.\.\//g, ""); // NOT OK
   x = x.replace(/\/\.\./g, ""); // NOT OK
 
@@ -109,8 +109,31 @@
   x = x.replace(/<script[^>]*>([\s\S]*?)<\/script>/gi, ""); // NOT OK
   x = x.replace(/<script[\s\S]*?<\/script>/gi, ""); // NOT OK
   x = x.replace(/ ?<!-- ?/g, ""); // NOT OK
-  x = x.replace(/require\('\.\.\/common'\);/g, ""); // OK [INCONSISTENCY] permit alphanum-suffix after the dots?
-  x = x.replace(/\.\.\/\.\.\/lib\//g, ""); // OK [INCONSISTENCY] permit alphanum-suffix after the dots?
+  x = x.replace(/require\('\.\.\/common'\);/g, ""); // OK
+  x = x.replace(/\.\.\/\.\.\/lib\//g, ""); // OK
+
+  while (x.indexOf(".") !== -1) {
+    x = x
+      .replace(/^\.\//, "")
+      .replace(/\/\.\//, "/")
+      .replace(/[^\/]*\/\.\.\//, ""); // OK
+  }
+
+  x = x.replace(/([^.\s]+\.)+/, ""); // OK
+
+  x = x.replace(/<!\-\-DEVEL[\d\D]*?DEVEL\-\->/g, ""); // OK
+
+  x = x
+    .replace(/^\.\//, "")
+    .replace(/\/\.\//, "/")
+    .replace(/[^\/]*\/\.\.\//, ""); // NOT OK
 
   return x;
 });
+
+(function (content) {
+	content.replace(/<script.*\/script>/gi, ""); // NOT OK
+	content.replace(/<(script).*\/script>/gi, ""); // NOT OK
+	content.replace(/.+<(script).*\/script>/gi, ""); // OK
+	content.replace(/.*<(script).*\/script>/gi, ""); // NOT OK
+});

From 828bb9a90249ac9e4894d158f7b4c8d5a91e203b Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 11 Jan 2021 11:28:40 +0100
Subject: [PATCH 060/343] Python: Small refactor for request param modeling in
 Django

---
 python/ql/src/semmle/python/frameworks/Django.qll | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 74c1856a79b..3e7283208e7 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1905,9 +1905,10 @@ private module Django {
   // ---------------------------------------------------------------------------
   // HttpRequest taint modeling
   // ---------------------------------------------------------------------------
-  class DjangoRouteHandlerRequestParam extends django::http::request::HttpRequest::InstanceSource,
+  /** A parameter that will receive the django `HttpRequest` instance when a request handler is invoked. */
+  private class DjangoRequestHandlerRequestParam extends django::http::request::HttpRequest::InstanceSource,
     RemoteFlowSource::Range, DataFlow::ParameterNode {
-    DjangoRouteHandlerRequestParam() {
+    DjangoRequestHandlerRequestParam() {
       this.getParameter() = any(DjangoRouteSetup setup).getARequestHandler().getRequestParam()
       or
       this.getParameter() = any(DjangoViewClassHandlerWithoutKnownRoute setup).getRequestParam()

From 2dbd762bd964650efe4cd409646490e3882fc267 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Mon, 11 Jan 2021 14:13:41 +0100
Subject: [PATCH 061/343] JS: reintroduce reverted js/server-crash

This reverts commit 0a8d15ccc4acad0ca63af6d39801aa90c7c41588.
---
 .../ql/src/Security/CWE-730/ServerCrash.qhelp |  22 ++++
 .../ql/src/Security/CWE-730/ServerCrash.ql    | 100 ++++++++++++++++++
 .../Security/CWE-730/ServerCrash.expected     |   6 ++
 .../Security/CWE-730/ServerCrash.qlref        |   1 +
 .../Security/CWE-730/server-crash.js          |  73 +++++++++++++
 5 files changed, 202 insertions(+)
 create mode 100644 javascript/ql/src/Security/CWE-730/ServerCrash.qhelp
 create mode 100644 javascript/ql/src/Security/CWE-730/ServerCrash.ql
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.qlref
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-730/server-crash.js

diff --git a/javascript/ql/src/Security/CWE-730/ServerCrash.qhelp b/javascript/ql/src/Security/CWE-730/ServerCrash.qhelp
new file mode 100644
index 00000000000..c3258c4e5f1
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-730/ServerCrash.qhelp
@@ -0,0 +1,22 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+	<overview>
+
+	</overview>
+
+	<recommendation>
+
+	</recommendation>
+
+	<example>
+
+	</example>
+
+	<references>
+
+	</references>
+
+</qhelp>
diff --git a/javascript/ql/src/Security/CWE-730/ServerCrash.ql b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
new file mode 100644
index 00000000000..8db7574d6c9
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
@@ -0,0 +1,100 @@
+/**
+ * @name Server crash
+ * @description A server that can be forced to crash may be vulnerable to denial-of-service
+ *              attacks.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id js/server-crash
+ * @tags security
+ *       external/cwe/cwe-730
+ */
+
+import javascript
+
+/**
+ * Gets a function that `caller` invokes.
+ */
+Function getACallee(Function caller) {
+  exists(DataFlow::InvokeNode invk |
+    invk.getEnclosingFunction() = caller and result = invk.getACallee()
+  )
+}
+
+/**
+ * Gets a function that `caller` invokes, excluding calls guarded in `try`-blocks.
+ */
+Function getAnUnguardedCallee(Function caller) {
+  exists(DataFlow::InvokeNode invk |
+    invk.getEnclosingFunction() = caller and
+    result = invk.getACallee() and
+    not exists(invk.asExpr().getEnclosingStmt().getEnclosingTryCatchStmt())
+  )
+}
+
+predicate isHeaderValue(HTTP::ExplicitHeaderDefinition def, DataFlow::Node node) {
+  def.definesExplicitly(_, node.asExpr())
+}
+
+class Configuration extends TaintTracking::Configuration {
+  Configuration() { this = "Configuration" }
+
+  override predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node node) {
+    // using control characters in a header value will cause an exception
+    isHeaderValue(_, node)
+  }
+}
+
+predicate isLikelyToThrow(DataFlow::Node crash) {
+  exists(Configuration cfg, DataFlow::Node sink | cfg.hasFlow(_, sink) | isHeaderValue(crash, sink))
+}
+
+/**
+ * A call that looks like it is asynchronous.
+ */
+class AsyncCall extends DataFlow::CallNode {
+  DataFlow::FunctionNode callback;
+
+  AsyncCall() {
+    callback.flowsTo(getLastArgument()) and
+    callback.getParameter(0).getName() = ["e", "err", "error"] and
+    callback.getNumParameter() = 2 and
+    not exists(callback.getAReturn())
+  }
+
+  DataFlow::FunctionNode getCallback() { result = callback }
+}
+
+/**
+ * Gets a function that is invoked by `asyncCallback` without any try-block wrapping, `asyncCallback` is in turn is called indirectly by `routeHandler`.
+ *
+ * If the result throws an excection, the server of `routeHandler` will crash.
+ */
+Function getAPotentialServerCrasher(
+  HTTP::RouteHandler routeHandler, DataFlow::FunctionNode asyncCallback
+) {
+  exists(AsyncCall asyncCall |
+    // the route handler transitively calls an async function
+    asyncCall.getEnclosingFunction() =
+      getACallee*(routeHandler.(DataFlow::FunctionNode).getFunction()) and
+    asyncCallback = asyncCall.getCallback() and
+    // the async function transitively calls a function that may throw an exception out of the the async function
+    result = getAnUnguardedCallee*(asyncCallback.getFunction())
+  )
+}
+
+/**
+ * Gets an AST node that is likely to throw an uncaught exception in `fun`.
+ */
+ExprOrStmt getALikelyExceptionThrower(Function fun) {
+  result.getContainer() = fun and
+  not exists([result.(Expr).getEnclosingStmt(), result.(Stmt)].getEnclosingTryCatchStmt()) and
+  (isLikelyToThrow(result.(Expr).flow()) or result instanceof ThrowStmt)
+}
+
+from HTTP::RouteHandler routeHandler, DataFlow::FunctionNode asyncCallback, ExprOrStmt crasher
+where crasher = getALikelyExceptionThrower(getAPotentialServerCrasher(routeHandler, asyncCallback))
+select crasher, "When an exception is thrown here and later exits $@, the server of $@ will crash.",
+  asyncCallback, "this asynchronous callback", routeHandler, "this route handler"
diff --git a/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected b/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected
new file mode 100644
index 00000000000..b4e8de623a6
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected
@@ -0,0 +1,6 @@
+| server-crash.js:7:5:7:14 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:6:28:8:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:11:3:11:11 | throw 42; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:50:28:52:3 | (err, x ... ();\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:16:7:16:16 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:15:30:17:5 | (err, x ... K\\n    } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:28:5:28:14 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:27:28:29:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:33:5:33:14 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:32:28:34:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:41:5:41:48 | res.set ... header) | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:40:28:42:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
diff --git a/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.qlref b/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.qlref
new file mode 100644
index 00000000000..294d08cdcbb
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.qlref
@@ -0,0 +1 @@
+Security/CWE-730/ServerCrash.ql
diff --git a/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js b/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
new file mode 100644
index 00000000000..96b5fc71187
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
@@ -0,0 +1,73 @@
+const express = require("express");
+const app = express();
+const fs = require("fs");
+
+function indirection1() {
+  fs.readFile("/WHATEVER", (err, x) => {
+    throw err; // NOT OK
+  });
+}
+function indirection2() {
+  throw 42; // NOT OK
+}
+function indirection3() {
+  try {
+    fs.readFile("/WHATEVER", (err, x) => {
+      throw err; // NOT OK
+    });
+  } catch (e) {}
+}
+function indirection4() {
+  throw 42; // OK: guarded caller
+}
+function indirection5() {
+  indirection6();
+}
+function indirection6() {
+  fs.readFile("/WHATEVER", (err, x) => {
+    throw err; // NOT OK
+  });
+}
+app.get("/async-throw", (req, res) => {
+  fs.readFile("/WHATEVER", (err, x) => {
+    throw err; // NOT OK
+  });
+  fs.readFile("/WHATEVER", (err, x) => {
+    try {
+      throw err; // OK: guarded throw
+    } catch (e) {}
+  });
+  fs.readFile("/WHATEVER", (err, x) => {
+    res.setHeader("reflected", req.query.header); // NOT OK
+  });
+  fs.readFile("/WHATEVER", (err, x) => {
+    try {
+      res.setHeader("reflected", req.query.header); // OK: guarded call
+    } catch (e) {}
+  });
+
+  indirection1();
+  fs.readFile("/WHATEVER", (err, x) => {
+    indirection2();
+  });
+
+  indirection3();
+  try {
+    indirection4();
+  } catch (e) {}
+  indirection5();
+
+  fs.readFile("/WHATEVER", (err, x) => {
+    req.query.foo; // OK
+  });
+  fs.readFile("/WHATEVER", (err, x) => {
+    req.query.foo.toString(); // OK
+  });
+
+  fs.readFile("/WHATEVER", (err, x) => {
+    req.query.foo.bar; // NOT OK [INCONSISTENCY]: need to add property reads as sinks
+  });
+  fs.readFile("/WHATEVER", (err, x) => {
+    res.setHeader("reflected", unknown); // OK
+  });
+});

From ecab17a6266f0fb965346b454ea544d1f1b2fbfa Mon Sep 17 00:00:00 2001
From: Max Schaefer <max-schaefer@github.com>
Date: Mon, 23 Nov 2020 10:22:14 +0000
Subject: [PATCH 062/343] JavaScript: Teach API graphs to handle `promisify`.

Following a suggestion by Asger, we track use nodes through calls to `promisify`. When we see a call to a promisified function, we introduce a new synthetic API-graph node representing the callback argument synthesised by the promisification, and track the result of the call to an `await` (or other promise resolution), which is then considered to be a use of the first parameter of the synthetic callback (the zeroth parameter being an error code, which we do not model yet).
---
 .../ql/src/semmle/javascript/ApiGraphs.qll    | 61 ++++++++++++++++---
 .../promisify/VerifyAssertions.expected       |  0
 .../ApiGraphs/promisify/VerifyAssertions.ql   |  1 +
 .../ql/test/ApiGraphs/promisify/index.js      | 28 +++++++++
 .../ql/test/ApiGraphs/promisify/package.json  |  6 ++
 5 files changed, 86 insertions(+), 10 deletions(-)
 create mode 100644 javascript/ql/test/ApiGraphs/promisify/VerifyAssertions.expected
 create mode 100644 javascript/ql/test/ApiGraphs/promisify/VerifyAssertions.ql
 create mode 100644 javascript/ql/test/ApiGraphs/promisify/index.js
 create mode 100644 javascript/ql/test/ApiGraphs/promisify/package.json

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index e3d627c3da7..216dcfb3f6d 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -206,7 +206,8 @@ module API {
       this = Impl::MkClassInstance(result) or
       this = Impl::MkUse(result) or
       this = Impl::MkDef(result) or
-      this = Impl::MkAsyncFuncResult(result)
+      this = Impl::MkAsyncFuncResult(result) or
+      this = Impl::MkSyntheticCallbackArg(_, result)
     }
 
     /**
@@ -389,12 +390,16 @@ module API {
       MkCanonicalNameUse(CanonicalName n) {
         not n.isRoot() and
         isUsed(n)
+      } or
+      MkSyntheticCallbackArg(DataFlow::Node src, DataFlow::InvokeNode nd) {
+        trackUseNode(src, true).flowsTo(nd.getCalleeNode())
       }
 
     class TDef = MkModuleDef or TNonModuleDef;
 
     class TNonModuleDef =
-      MkModuleExport or MkClassInstance or MkAsyncFuncResult or MkDef or MkCanonicalNameDef;
+      MkModuleExport or MkClassInstance or MkAsyncFuncResult or MkDef or MkCanonicalNameDef or
+          MkSyntheticCallbackArg;
 
     class TUse = MkModuleUse or MkModuleImport or MkUse or MkCanonicalNameUse;
 
@@ -523,8 +528,8 @@ module API {
      * The receiver is considered to be argument -1.
      */
     private predicate argumentPassing(TApiNode base, int i, DataFlow::Node arg) {
-      exists(DataFlow::SourceNode use, DataFlow::SourceNode pred |
-        use(base, use) and pred = trackUseNode(use)
+      exists(DataFlow::Node use, DataFlow::SourceNode pred |
+        use(base, use) and pred = trackUseNode(use, _)
       |
         arg = pred.getAnInvocation().getArgument(i)
         or
@@ -609,6 +614,12 @@ module API {
           lbl = Label::instance() and
           ref = getANodeWithType(tn)
         )
+        or
+        exists(DataFlow::InvokeNode call |
+          base = MkSyntheticCallbackArg(_, call) and
+          lbl = Label::parameter(1) and
+          ref = awaited(call)
+        )
       )
     }
 
@@ -672,21 +683,34 @@ module API {
       )
     }
 
-    private DataFlow::SourceNode trackUseNode(DataFlow::SourceNode nd, DataFlow::TypeTracker t) {
+    private DataFlow::SourceNode trackUseNode(
+      DataFlow::SourceNode nd, boolean promisified, DataFlow::TypeTracker t
+    ) {
       t.start() and
       use(_, nd) and
-      result = nd
+      result = nd and
+      promisified = false
       or
-      exists(DataFlow::TypeTracker t2 | result = trackUseNode(nd, t2).track(t2, t))
+      exists(DataFlow::CallNode promisify |
+        promisify = API::moduleImport(["util", "bluebird"]).getMember("promisify").getACall()
+      |
+        trackUseNode(nd, false, t.continue()).flowsTo(promisify.getArgument(0)) and
+        promisified = true and
+        result = promisify
+      )
+      or
+      exists(DataFlow::TypeTracker t2 | result = trackUseNode(nd, promisified, t2).track(t2, t))
+    }
+
+    private DataFlow::SourceNode trackUseNode(DataFlow::SourceNode nd, boolean promisified) {
+      result = trackUseNode(nd, promisified, DataFlow::TypeTracker::end())
     }
 
     /**
      * Gets a node that is inter-procedurally reachable from `nd`, which is a use of some node.
      */
     cached
-    DataFlow::SourceNode trackUseNode(DataFlow::SourceNode nd) {
-      result = trackUseNode(nd, DataFlow::TypeTracker::end())
-    }
+    DataFlow::SourceNode trackUseNode(DataFlow::SourceNode nd) { result = trackUseNode(nd, false) }
 
     private DataFlow::SourceNode trackDefNode(DataFlow::Node nd, DataFlow::TypeBackTracker t) {
       t.start() and
@@ -714,6 +738,17 @@ module API {
       result = trackDefNode(nd, DataFlow::TypeBackTracker::end())
     }
 
+    private DataFlow::SourceNode awaited(DataFlow::InvokeNode call, DataFlow::TypeTracker t) {
+      t.startInPromise() and
+      exists(MkSyntheticCallbackArg(_, call))
+      or
+      exists(DataFlow::TypeTracker t2 | result = awaited(call, t2).track(t2, t))
+    }
+
+    private DataFlow::Node awaited(DataFlow::InvokeNode call) {
+      result = awaited(call, DataFlow::TypeTracker::end())
+    }
+
     private DataFlow::SourceNode getANodeWithType(TypeName tn) {
       exists(string moduleName, string typeName |
         tn.hasQualifiedName(moduleName, typeName) and
@@ -774,6 +809,12 @@ module API {
         lbl = Label::return() and
         succ = MkAsyncFuncResult(f)
       )
+      or
+      exists(DataFlow::SourceNode src, DataFlow::InvokeNode call |
+        use(pred, src) and
+        lbl = Label::parameter(call.getNumArgument()) and
+        succ = MkSyntheticCallbackArg(src, call)
+      )
     }
 
     /**
diff --git a/javascript/ql/test/ApiGraphs/promisify/VerifyAssertions.expected b/javascript/ql/test/ApiGraphs/promisify/VerifyAssertions.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/javascript/ql/test/ApiGraphs/promisify/VerifyAssertions.ql b/javascript/ql/test/ApiGraphs/promisify/VerifyAssertions.ql
new file mode 100644
index 00000000000..b9c54e26072
--- /dev/null
+++ b/javascript/ql/test/ApiGraphs/promisify/VerifyAssertions.ql
@@ -0,0 +1 @@
+import ApiGraphs.VerifyAssertions
diff --git a/javascript/ql/test/ApiGraphs/promisify/index.js b/javascript/ql/test/ApiGraphs/promisify/index.js
new file mode 100644
index 00000000000..d4d095bae9b
--- /dev/null
+++ b/javascript/ql/test/ApiGraphs/promisify/index.js
@@ -0,0 +1,28 @@
+var bluebird = require("bluebird");
+var readFile = require("fs").readFile;
+
+var readFileAsync = bluebird.promisify(readFile);
+
+readFile(
+    "tst.txt", // def (parameter 0 (member readFile (member exports (module fs))))
+    "utf8", // def (parameter 1 (member readFile (member exports (module fs))))
+    function (
+        err, // use (parameter 0 (parameter 2 (member readFile (member exports (module fs)))))
+        contents // use (parameter 1 (parameter 2 (member readFile (member exports (module fs)))))
+    ) { });
+
+readFileAsync(
+    "tst.txt"  // def (parameter 0 (member readFile (member exports (module fs))))
+).then(
+    function (buf) { } // use (parameter 1 (parameter 1 (member readFile (member exports (module fs)))))
+).catch(
+    function (err) { } // not yet modelled: (parameter 0 (parameter 1 (member readFile (member exports (module fs)))))
+);
+
+try {
+    let p = readFileAsync(
+        "tst.txt",  // def (parameter 0 (member readFile (member exports (module fs))))
+        "utf8"  // def (parameter 1 (member readFile (member exports (module fs))))
+    );
+    let data = await p; // use (parameter 1 (parameter 2 (member readFile (member exports (module fs)))))
+} catch (e) { } // not yet modelled: (parameter 0 (parameter 2 (member readFile (member exports (module fs)))))
diff --git a/javascript/ql/test/ApiGraphs/promisify/package.json b/javascript/ql/test/ApiGraphs/promisify/package.json
new file mode 100644
index 00000000000..a94c8dc9a3d
--- /dev/null
+++ b/javascript/ql/test/ApiGraphs/promisify/package.json
@@ -0,0 +1,6 @@
+{
+    "name": "promisify-test",
+    "dependencies": {
+        "bluebird": "*"
+    }
+}
\ No newline at end of file

From 3853da0969ab1ed754c4f2b4a4df5c15e36d6812 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max-schaefer@github.com>
Date: Mon, 23 Nov 2020 10:26:26 +0000
Subject: [PATCH 063/343] JavaScript: Teach API-graphs about bound arguments.

---
 .../ql/src/semmle/javascript/ApiGraphs.qll    | 64 +++++++++++++------
 .../bound-args/VerifyAssertions.expected      |  0
 .../ApiGraphs/bound-args/VerifyAssertions.ql  |  1 +
 .../ql/test/ApiGraphs/bound-args/index.js     | 24 +++++++
 .../ql/test/ApiGraphs/bound-args/package.json |  6 ++
 5 files changed, 76 insertions(+), 19 deletions(-)
 create mode 100644 javascript/ql/test/ApiGraphs/bound-args/VerifyAssertions.expected
 create mode 100644 javascript/ql/test/ApiGraphs/bound-args/VerifyAssertions.ql
 create mode 100644 javascript/ql/test/ApiGraphs/bound-args/index.js
 create mode 100644 javascript/ql/test/ApiGraphs/bound-args/package.json

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index 216dcfb3f6d..d2c2d3d54b3 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -207,7 +207,7 @@ module API {
       this = Impl::MkUse(result) or
       this = Impl::MkDef(result) or
       this = Impl::MkAsyncFuncResult(result) or
-      this = Impl::MkSyntheticCallbackArg(_, result)
+      this = Impl::MkSyntheticCallbackArg(_, _, result)
     }
 
     /**
@@ -391,8 +391,8 @@ module API {
         not n.isRoot() and
         isUsed(n)
       } or
-      MkSyntheticCallbackArg(DataFlow::Node src, DataFlow::InvokeNode nd) {
-        trackUseNode(src, true).flowsTo(nd.getCalleeNode())
+      MkSyntheticCallbackArg(DataFlow::Node src, int bound, DataFlow::InvokeNode nd) {
+        trackUseNode(src, true, bound).flowsTo(nd.getCalleeNode())
       }
 
     class TDef = MkModuleDef or TNonModuleDef;
@@ -528,18 +528,20 @@ module API {
      * The receiver is considered to be argument -1.
      */
     private predicate argumentPassing(TApiNode base, int i, DataFlow::Node arg) {
-      exists(DataFlow::Node use, DataFlow::SourceNode pred |
-        use(base, use) and pred = trackUseNode(use, _)
+      exists(DataFlow::Node use, DataFlow::SourceNode pred, int bound |
+        use(base, use) and pred = trackUseNode(use, _, bound)
       |
-        arg = pred.getAnInvocation().getArgument(i)
+        arg = pred.getAnInvocation().getArgument(i - bound)
         or
         arg = pred.getACall().getReceiver() and
+        bound = 0 and
         i = -1
         or
         exists(DataFlow::PartialInvokeNode pin, DataFlow::Node callback | pred.flowsTo(callback) |
-          pin.isPartialArgument(callback, arg, i)
+          pin.isPartialArgument(callback, arg, i - bound)
           or
           arg = pin.getBoundReceiver(callback) and
+          bound = 0 and
           i = -1
         )
       )
@@ -616,7 +618,7 @@ module API {
         )
         or
         exists(DataFlow::InvokeNode call |
-          base = MkSyntheticCallbackArg(_, call) and
+          base = MkSyntheticCallbackArg(_, _, call) and
           lbl = Label::parameter(1) and
           ref = awaited(call)
         )
@@ -683,34 +685,55 @@ module API {
       )
     }
 
+    /**
+     * Gets a data-flow node to which `nd`, which is a use of an API-graph node, flows.
+     *
+     * The flow from `nd` to that node may be inter-procedural. If `promisified` is `true`, the
+     * flow goes through a promisification, and `boundArgs` indicates how many arguments have been
+     * bound throughout the flow. (To ensure termination, we somewhat arbitrarily constrain the
+     * number of bound arguments to be at most ten.)
+     */
     private DataFlow::SourceNode trackUseNode(
-      DataFlow::SourceNode nd, boolean promisified, DataFlow::TypeTracker t
+      DataFlow::SourceNode nd, boolean promisified, int boundArgs, DataFlow::TypeTracker t
     ) {
       t.start() and
       use(_, nd) and
       result = nd and
-      promisified = false
+      promisified = false and
+      boundArgs = 0
       or
       exists(DataFlow::CallNode promisify |
         promisify = API::moduleImport(["util", "bluebird"]).getMember("promisify").getACall()
       |
-        trackUseNode(nd, false, t.continue()).flowsTo(promisify.getArgument(0)) and
+        trackUseNode(nd, false, boundArgs, t.continue()).flowsTo(promisify.getArgument(0)) and
         promisified = true and
         result = promisify
       )
       or
-      exists(DataFlow::TypeTracker t2 | result = trackUseNode(nd, promisified, t2).track(t2, t))
+      exists(DataFlow::PartialInvokeNode pin, DataFlow::Node pred, int predBoundArgs |
+        trackUseNode(nd, promisified, predBoundArgs, t.continue()).flowsTo(pred) and
+        result = pin.getBoundFunction(pred, boundArgs - predBoundArgs) and
+        boundArgs <= 10
+      )
+      or
+      exists(DataFlow::TypeTracker t2 |
+        result = trackUseNode(nd, promisified, boundArgs, t2).track(t2, t)
+      )
     }
 
-    private DataFlow::SourceNode trackUseNode(DataFlow::SourceNode nd, boolean promisified) {
-      result = trackUseNode(nd, promisified, DataFlow::TypeTracker::end())
+    private DataFlow::SourceNode trackUseNode(
+      DataFlow::SourceNode nd, boolean promisified, int boundArgs
+    ) {
+      result = trackUseNode(nd, promisified, boundArgs, DataFlow::TypeTracker::end())
     }
 
     /**
      * Gets a node that is inter-procedurally reachable from `nd`, which is a use of some node.
      */
     cached
-    DataFlow::SourceNode trackUseNode(DataFlow::SourceNode nd) { result = trackUseNode(nd, false) }
+    DataFlow::SourceNode trackUseNode(DataFlow::SourceNode nd) {
+      result = trackUseNode(nd, false, 0)
+    }
 
     private DataFlow::SourceNode trackDefNode(DataFlow::Node nd, DataFlow::TypeBackTracker t) {
       t.start() and
@@ -740,11 +763,14 @@ module API {
 
     private DataFlow::SourceNode awaited(DataFlow::InvokeNode call, DataFlow::TypeTracker t) {
       t.startInPromise() and
-      exists(MkSyntheticCallbackArg(_, call))
+      exists(MkSyntheticCallbackArg(_, _, call))
       or
       exists(DataFlow::TypeTracker t2 | result = awaited(call, t2).track(t2, t))
     }
 
+    /**
+     * Gets a node holding the resolved value of promise `call`.
+     */
     private DataFlow::Node awaited(DataFlow::InvokeNode call) {
       result = awaited(call, DataFlow::TypeTracker::end())
     }
@@ -810,10 +836,10 @@ module API {
         succ = MkAsyncFuncResult(f)
       )
       or
-      exists(DataFlow::SourceNode src, DataFlow::InvokeNode call |
+      exists(DataFlow::SourceNode src, int bound, DataFlow::InvokeNode call |
         use(pred, src) and
-        lbl = Label::parameter(call.getNumArgument()) and
-        succ = MkSyntheticCallbackArg(src, call)
+        lbl = Label::parameter(bound + call.getNumArgument()) and
+        succ = MkSyntheticCallbackArg(src, bound, call)
       )
     }
 
diff --git a/javascript/ql/test/ApiGraphs/bound-args/VerifyAssertions.expected b/javascript/ql/test/ApiGraphs/bound-args/VerifyAssertions.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/javascript/ql/test/ApiGraphs/bound-args/VerifyAssertions.ql b/javascript/ql/test/ApiGraphs/bound-args/VerifyAssertions.ql
new file mode 100644
index 00000000000..b9c54e26072
--- /dev/null
+++ b/javascript/ql/test/ApiGraphs/bound-args/VerifyAssertions.ql
@@ -0,0 +1 @@
+import ApiGraphs.VerifyAssertions
diff --git a/javascript/ql/test/ApiGraphs/bound-args/index.js b/javascript/ql/test/ApiGraphs/bound-args/index.js
new file mode 100644
index 00000000000..654f11976c5
--- /dev/null
+++ b/javascript/ql/test/ApiGraphs/bound-args/index.js
@@ -0,0 +1,24 @@
+import bar from 'foo';
+
+let boundbar = bar.bind(
+    "receiver", // def (parameter -1 (member default (member exports (module foo))))
+    "firstarg"  // def (parameter 0 (member default (member exports (module foo))))
+);
+boundbar(
+    "secondarg" // def (parameter 1 (member default (member exports (module foo))))
+)
+
+let boundbar2 = boundbar.bind(
+    "ignored", // !def (parameter -1 (member default (member exports (module foo))))
+    "othersecondarg" // def (parameter 1 (member default (member exports (module foo))))
+)
+boundbar2(
+    "thirdarg" // def (parameter 2 (member default (member exports (module foo))))
+)
+
+let bar2 = bar;
+for (var i = 0; i < 2; ++i)
+    bar2 = bar2.bind(
+        null,
+        i /* def (parameter 1 (member default (member exports (module foo)))) */ /* def (parameter 9 (member default (member exports (module foo)))) */
+    );
diff --git a/javascript/ql/test/ApiGraphs/bound-args/package.json b/javascript/ql/test/ApiGraphs/bound-args/package.json
new file mode 100644
index 00000000000..40db36fb877
--- /dev/null
+++ b/javascript/ql/test/ApiGraphs/bound-args/package.json
@@ -0,0 +1,6 @@
+{
+    "name": "bound-args",
+    "dependencies": {
+        "foo": "*"
+    }
+}
\ No newline at end of file

From b3ab6efd1d418ea037a64ee229a0834cfcaadca7 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max-schaefer@github.com>
Date: Mon, 23 Nov 2020 10:27:29 +0000
Subject: [PATCH 064/343] JavaScript: Remove a bindingset annotation.

---
 javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
index 0002a057b8e..907711d4ed4 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
@@ -804,7 +804,6 @@ private module Redis {
      * For getter-like methods it is not generally possible to gain access "outside" of where you are supposed to have access,
      * it is at most possible to get a Redis call to return more results than expected (e.g. by adding more members to [`geohash`](https://redis.io/commands/geohash)).
      */
-    bindingset[argIndex]
     predicate argumentIsAmbiguousKey(string method, int argIndex) {
       method =
         [
@@ -815,7 +814,8 @@ private module Redis {
         ] and
       argIndex = 0
       or
-      method = ["bitop", "hmset", "mset", "msetnx", "geoadd"] and argIndex >= 0
+      method = ["bitop", "hmset", "mset", "msetnx", "geoadd"] and
+      argIndex in [0 .. any(DataFlow::InvokeNode invk).getNumArgument() - 1]
     }
   }
 

From 7a229d93815c2ce861f9ab25362649b24942a68f Mon Sep 17 00:00:00 2001
From: Max Schaefer <max-schaefer@github.com>
Date: Mon, 23 Nov 2020 10:27:52 +0000
Subject: [PATCH 065/343] JavaScript: Simplify NoSQL framework modelling.

---
 .../semmle/javascript/frameworks/NoSQL.qll    | 26 ++-----------------
 1 file changed, 2 insertions(+), 24 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
index 907711d4ed4..48403735873 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll
@@ -825,31 +825,9 @@ private module Redis {
   class RedisKeyArgument extends NoSQL::Query {
     RedisKeyArgument() {
       exists(string method, int argIndex |
-        QuerySignatures::argumentIsAmbiguousKey(method, argIndex)
-      |
-        this =
-          [promisify(redis().getMember(method)), redis().getMember(method)]
-              .getACall()
-              .getArgument(argIndex)
-              .asExpr()
+        QuerySignatures::argumentIsAmbiguousKey(method, argIndex) and
+        this = redis().getMember(method).getParameter(argIndex).getARhs().asExpr()
       )
     }
   }
-
-  /**
-   * Gets a promisified version of `method`.
-   */
-  private API::Node promisify(API::Node method) {
-    exists(API::Node promisify |
-      promisify = API::moduleImport(["util", "bluebird"]).getMember("promisify").getReturn() and
-      method
-          .getAnImmediateUse()
-          .flowsTo(promisify.getAnImmediateUse().(DataFlow::CallNode).getArgument(0))
-    |
-      result = promisify
-      or
-      result = promisify.getMember("bind").getReturn() and
-      result.getAnImmediateUse().(DataFlow::CallNode).getNumArgument() = 1
-    )
-  }
 }

From c9132ca6f883ca59fcbf461ca6d44782ca918c07 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max-schaefer@github.com>
Date: Tue, 24 Nov 2020 15:13:04 +0000
Subject: [PATCH 066/343] JavaScript: Refactor `trackUseNode` to avoid bad join
 order.

---
 .../ql/src/semmle/javascript/ApiGraphs.qll    | 20 +++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index d2c2d3d54b3..32bd30d30c6 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -716,11 +716,27 @@ module API {
         boundArgs <= 10
       )
       or
-      exists(DataFlow::TypeTracker t2 |
-        result = trackUseNode(nd, promisified, boundArgs, t2).track(t2, t)
+      exists(StepSummary summary |
+        t = useStep(nd, promisified, boundArgs, result, summary).append(summary)
       )
     }
 
+    private import semmle.javascript.dataflow.internal.StepSummary
+
+    /**
+     * Holds if `nd`, which is a use of an API-graph node, flows in zero or more potentially
+     * inter-procedural steps to some intermediate node, and then from that intermediate node to
+     * `res` in one step described by `summary`.
+     *
+     * This predicate exists solely to enforce a better join order in `trackUseNode` above.
+     */
+    pragma[noinline]
+    private DataFlow::TypeTracker useStep(
+      DataFlow::Node nd, boolean promisified, int boundArgs, DataFlow::Node res, StepSummary summary
+    ) {
+      StepSummary::step(trackUseNode(nd, promisified, boundArgs, result), res, summary)
+    }
+
     private DataFlow::SourceNode trackUseNode(
       DataFlow::SourceNode nd, boolean promisified, int boundArgs
     ) {

From f40b406a2de47af56cb0602c43012744fbaa5588 Mon Sep 17 00:00:00 2001
From: Max Schaefer <max-schaefer@github.com>
Date: Thu, 3 Dec 2020 10:21:21 +0000
Subject: [PATCH 067/343] JavaScript: Address review comments.

---
 javascript/ql/src/semmle/javascript/ApiGraphs.qll | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index 32bd30d30c6..5dc2eebcfb0 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -703,7 +703,7 @@ module API {
       boundArgs = 0
       or
       exists(DataFlow::CallNode promisify |
-        promisify = API::moduleImport(["util", "bluebird"]).getMember("promisify").getACall()
+        promisify = DataFlow::moduleImport(["util", "bluebird"]).getAMemberCall("promisify")
       |
         trackUseNode(nd, false, boundArgs, t.continue()).flowsTo(promisify.getArgument(0)) and
         promisified = true and
@@ -713,7 +713,7 @@ module API {
       exists(DataFlow::PartialInvokeNode pin, DataFlow::Node pred, int predBoundArgs |
         trackUseNode(nd, promisified, predBoundArgs, t.continue()).flowsTo(pred) and
         result = pin.getBoundFunction(pred, boundArgs - predBoundArgs) and
-        boundArgs <= 10
+        boundArgs in [0 .. 10]
       )
       or
       exists(StepSummary summary |
@@ -779,7 +779,8 @@ module API {
 
     private DataFlow::SourceNode awaited(DataFlow::InvokeNode call, DataFlow::TypeTracker t) {
       t.startInPromise() and
-      exists(MkSyntheticCallbackArg(_, _, call))
+      exists(MkSyntheticCallbackArg(_, _, call)) and
+      result = call
       or
       exists(DataFlow::TypeTracker t2 | result = awaited(call, t2).track(t2, t))
     }

From 1cde5e1828d0b7425f8f5bb6491818bd5206cf3c Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 11 Jan 2021 16:20:54 +0000
Subject: [PATCH 068/343] C++: Test of taint through ConstructorDelegationInit.

---
 .../taint-tests/constructor_delegation.cpp    | 47 +++++++++++++++++++
 .../dataflow/taint-tests/localTaint.expected  | 22 +++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 cpp/ql/test/library-tests/dataflow/taint-tests/constructor_delegation.cpp

diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/constructor_delegation.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/constructor_delegation.cpp
new file mode 100644
index 00000000000..3ee388347a6
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/constructor_delegation.cpp
@@ -0,0 +1,47 @@
+
+int source();
+void sink(...);
+
+class MyValue
+{
+public:
+	MyValue(int _x) : x(_x) {}; // taint flows directly from _x to x
+	MyValue(int _x, bool ex) : MyValue(_x) {}; // taint flows indirectly from _x to x
+	MyValue(int _x, int _y) : MyValue(_x + _y) {}; // taint flows indirectly from _x to x
+	MyValue(int _x, bool ex1, bool ex2) : MyValue(0) {}; // taint doesn't flow to _x
+
+	int x;
+};
+
+class MyDerivedValue : public MyValue
+{
+public:
+	MyDerivedValue(bool ex, int _x) : MyValue(_x) {}; // taint flows indirectly from _x to x
+};
+
+void test_inits()
+{
+	MyValue v1(0);
+	MyValue v2(source());
+	MyValue v3(0, true);
+	MyValue v4(source(), true);
+	MyValue v5(0, 1);
+	MyValue v6(source(), 1);
+	MyValue v7(0, source());
+	MyValue v8(0, true, true);
+	MyValue v9(source(), true, true);
+	MyDerivedValue v10(true, 0);
+	MyDerivedValue v11(true, source());
+
+	sink(v1.x);
+	sink(v2.x); // $ ast,ir
+	sink(v3.x);
+	sink(v4.x); // $ ir MISSING: ast
+	sink(v5.x);
+	sink(v6.x); // $ ir MISSING: ast
+	sink(v7.x); // $ ir MISSING: ast
+	sink(v8.x);
+	sink(v9.x);
+	sink(v10.x);
+	sink(v11.x); // $ ir MISSING: ast
+}
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 6edd97d0069..7b8d59fe3e7 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -135,6 +135,28 @@
 | arrayassignment.cpp:145:12:145:12 | 5 | arrayassignment.cpp:145:7:145:13 | access to array | TAINT |
 | arrayassignment.cpp:146:7:146:10 | arr3 | arrayassignment.cpp:146:7:146:13 | access to array |  |
 | arrayassignment.cpp:146:12:146:12 | 5 | arrayassignment.cpp:146:7:146:13 | access to array | TAINT |
+| constructor_delegation.cpp:8:2:8:8 | this | constructor_delegation.cpp:8:20:8:24 | constructor init of field x [pre-this] |  |
+| constructor_delegation.cpp:8:14:8:15 | _x | constructor_delegation.cpp:8:22:8:23 | _x |  |
+| constructor_delegation.cpp:8:22:8:23 | _x | constructor_delegation.cpp:8:20:8:24 | constructor init of field x | TAINT |
+| constructor_delegation.cpp:9:37:9:38 | _x | constructor_delegation.cpp:9:29:9:39 | call to MyValue | TAINT |
+| constructor_delegation.cpp:10:36:10:37 | _x | constructor_delegation.cpp:10:36:10:42 | ... + ... | TAINT |
+| constructor_delegation.cpp:10:36:10:42 | ... + ... | constructor_delegation.cpp:10:28:10:43 | call to MyValue | TAINT |
+| constructor_delegation.cpp:10:41:10:42 | _y | constructor_delegation.cpp:10:36:10:42 | ... + ... | TAINT |
+| constructor_delegation.cpp:11:48:11:48 | 0 | constructor_delegation.cpp:11:40:11:49 | call to MyValue | TAINT |
+| constructor_delegation.cpp:19:44:19:45 | _x | constructor_delegation.cpp:19:36:19:46 | call to MyValue | TAINT |
+| constructor_delegation.cpp:24:13:24:13 | 0 | constructor_delegation.cpp:24:13:24:14 | call to MyValue | TAINT |
+| constructor_delegation.cpp:24:13:24:14 | call to MyValue | constructor_delegation.cpp:36:7:36:8 | v1 |  |
+| constructor_delegation.cpp:25:13:25:18 | call to source | constructor_delegation.cpp:25:13:25:21 | call to MyValue | TAINT |
+| constructor_delegation.cpp:25:13:25:21 | call to MyValue | constructor_delegation.cpp:37:7:37:8 | v2 |  |
+| constructor_delegation.cpp:26:13:26:20 | call to MyValue | constructor_delegation.cpp:38:7:38:8 | v3 |  |
+| constructor_delegation.cpp:27:13:27:27 | call to MyValue | constructor_delegation.cpp:39:7:39:8 | v4 |  |
+| constructor_delegation.cpp:28:13:28:17 | call to MyValue | constructor_delegation.cpp:40:7:40:8 | v5 |  |
+| constructor_delegation.cpp:29:13:29:24 | call to MyValue | constructor_delegation.cpp:41:7:41:8 | v6 |  |
+| constructor_delegation.cpp:30:13:30:24 | call to MyValue | constructor_delegation.cpp:42:7:42:8 | v7 |  |
+| constructor_delegation.cpp:31:13:31:26 | call to MyValue | constructor_delegation.cpp:43:7:43:8 | v8 |  |
+| constructor_delegation.cpp:32:13:32:33 | call to MyValue | constructor_delegation.cpp:44:7:44:8 | v9 |  |
+| constructor_delegation.cpp:33:21:33:28 | call to MyDerivedValue | constructor_delegation.cpp:45:7:45:9 | v10 |  |
+| constructor_delegation.cpp:34:21:34:35 | call to MyDerivedValue | constructor_delegation.cpp:46:7:46:9 | v11 |  |
 | copyableclass.cpp:8:2:8:16 | this | copyableclass.cpp:8:28:8:32 | constructor init of field v [pre-this] |  |
 | copyableclass.cpp:8:22:8:23 | _v | copyableclass.cpp:8:30:8:31 | _v |  |
 | copyableclass.cpp:8:30:8:31 | _v | copyableclass.cpp:8:28:8:32 | constructor init of field v | TAINT |

From 7409dd015e04d45b417dbe85681274e2eacd3769 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 11 Jan 2021 18:58:32 +0000
Subject: [PATCH 069/343] C++: Autoformat.

---
 .../src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll  | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
index 23161bc4b89..7ca03067d0a 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -582,9 +582,7 @@ module TaintedWithPath {
     }
 
     override predicate isBarrier(DataFlow::Node node) {
-      exists(TaintTrackingConfiguration cfg, Expr e |
-        cfg.isBarrier(e) and node = getNodeForExpr(e)
-      )
+      exists(TaintTrackingConfiguration cfg, Expr e | cfg.isBarrier(e) and node = getNodeForExpr(e))
     }
 
     override predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }

From 40cfbab335370d674fbf9b704381e0d88c473ce3 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Tue, 12 Jan 2021 08:25:16 +0100
Subject: [PATCH 070/343] JS: address review feedback

---
 .../IncompleteMultiCharacterSanitization.ql   |  9 ++-
 ...ompleteMultiCharacterSanitization.expected | 66 +++++++++----------
 2 files changed, 37 insertions(+), 38 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
index cef10d3cbe7..3ae30ffe15b 100644
--- a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
+++ b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
@@ -89,13 +89,13 @@ predicate matchesDangerousPrefix(EmptyReplaceRegExpTerm t, string prefix, string
     kind = "path injection" and
     // upwards navigation
     prefix = ["/..", "../"] and
-    not t.getSuccessor*().getAMatchedString().regexpMatch("(?i).*[a-z0-9_-]+.*") // explicit path name mentions make this an unlikely sanitizer
+    not t.getSuccessor*().getAMatchedString().regexpMatch("(?is).*[a-z0-9_-].*") // explicit path name mentions make this an unlikely sanitizer
     or
     kind = "HTML element injection" and
     (
       // comments
       prefix = "<!--" and
-      not t.getSuccessor*().getAMatchedString().regexpMatch("(?i).*[a-z0-9_]+.*") // explicit comment content mentions make this an unlikely sanitizer
+      not t.getSuccessor*().getAMatchedString().regexpMatch("(?is).*[a-z0-9_].*") // explicit comment content mentions make this an unlikely sanitizer
       or
       // specific tags
       prefix = "<" + ["iframe", "script", "cript", "scrip", "style"] // the `cript|scrip` case has been observed in the wild several times
@@ -159,6 +159,5 @@ where
   not replace.getAMethodCall*().flowsTo(replace.getReceiver()) and
   // avoid anchored terms
   not exists(RegExpAnchor a | regexp = a.getRootTerm())
-select replace,
-  "This string may still contain a substring that starts matching at $@, which may cause a " + kind +
-    " vulnerability.", dangerous, prefix
+select replace, "This string may still contain $@, which may cause a " + kind + " vulnerability.",
+  dangerous, prefix
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected
index 048109da744..9403b43cd43 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected
@@ -1,33 +1,33 @@
-| tst-multi-character-sanitization.js:3:13:3:57 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:3:30:3:30 | < | <cript |
-| tst-multi-character-sanitization.js:4:13:4:47 | content ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:4:30:4:40 |  on\\w+=".*" | on |
-| tst-multi-character-sanitization.js:5:13:5:49 | content ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:5:30:5:42 |  on\\w+=\\'.*\\' | on |
-| tst-multi-character-sanitization.js:9:13:9:47 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:9:30:9:30 | < | <cript |
-| tst-multi-character-sanitization.js:10:13:10:49 | content ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:10:30:10:42 | .on\\w+=.*".*" | on |
-| tst-multi-character-sanitization.js:11:13:11:51 | content ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:11:30:11:44 | .on\\w+=.*\\'.*\\' | on |
-| tst-multi-character-sanitization.js:19:3:19:35 | respons ... pt, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:18:18:18:24 | <script | <script |
-| tst-multi-character-sanitization.js:25:10:25:40 | text.re ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:25:24:25:27 | <!-- | <!-- |
-| tst-multi-character-sanitization.js:49:13:49:43 | req.url ... EL, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:48:22:48:23 | \\/ | /.. |
-| tst-multi-character-sanitization.js:64:7:64:73 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:64:18:64:24 | <script | <script |
-| tst-multi-character-sanitization.js:66:7:66:56 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:66:18:66:49 | (\\/\|\\s)on\\w+=(\\'\|")?[^"]*(\\'\|")? | on |
-| tst-multi-character-sanitization.js:75:7:75:37 | x.repla ... gm, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:75:18:75:21 | <!-- | <!-- |
-| tst-multi-character-sanitization.js:76:7:76:35 | x.repla ... +/, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:76:18:76:29 | \\sng-[a-z-]+ | ng- |
-| tst-multi-character-sanitization.js:77:7:77:36 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:77:18:77:29 | \\sng-[a-z-]+ | ng- |
-| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:81:36:81:39 | only | on |
-| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:81:18:81:24 | <script | <script |
-| tst-multi-character-sanitization.js:83:7:83:63 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:83:18:83:21 | <!-- | <!-- |
-| tst-multi-character-sanitization.js:85:7:85:48 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:85:18:85:21 | \\x2E | ../ |
-| tst-multi-character-sanitization.js:87:7:87:47 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:87:18:87:24 | <script | <script |
-| tst-multi-character-sanitization.js:92:7:96:4 | x.repla ... ";\\n  }) | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:92:18:92:24 | <script | <script |
-| tst-multi-character-sanitization.js:101:7:101:30 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:101:18:101:19 | \\. | ../ |
-| tst-multi-character-sanitization.js:102:7:102:30 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:102:18:102:19 | \\/ | /.. |
-| tst-multi-character-sanitization.js:104:7:104:58 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:104:18:104:24 | <script | <script |
-| tst-multi-character-sanitization.js:106:7:106:64 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:106:18:106:18 | < | <script |
-| tst-multi-character-sanitization.js:107:7:107:62 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:107:18:107:19 | \\< | <script |
-| tst-multi-character-sanitization.js:108:7:108:75 | x.repla ... gm, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:108:18:108:18 | < | <script |
-| tst-multi-character-sanitization.js:109:7:109:58 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:109:18:109:24 | <script | <script |
-| tst-multi-character-sanitization.js:110:7:110:50 | x.repla ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:110:18:110:24 | <script | <script |
-| tst-multi-character-sanitization.js:111:7:111:32 | x.repla ... /g, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:111:18:111:19 |  ? | <!-- |
-| tst-multi-character-sanitization.js:126:7:129:34 | x\\n    . ... //, "") | This string may still contain a substring that starts matching at $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:129:15:129:20 | [^\\/]* | /.. |
-| tst-multi-character-sanitization.js:135:2:135:44 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:135:19:135:25 | <script | <script |
-| tst-multi-character-sanitization.js:136:2:136:46 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:136:19:136:19 | < | <script |
-| tst-multi-character-sanitization.js:138:2:138:48 | content ... gi, "") | This string may still contain a substring that starts matching at $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:138:19:138:20 | .* | <script |
+| tst-multi-character-sanitization.js:3:13:3:57 | content ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:3:30:3:30 | < | <cript |
+| tst-multi-character-sanitization.js:4:13:4:47 | content ... /g, "") | This string may still contain $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:4:30:4:40 |  on\\w+=".*" | on |
+| tst-multi-character-sanitization.js:5:13:5:49 | content ... /g, "") | This string may still contain $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:5:30:5:42 |  on\\w+=\\'.*\\' | on |
+| tst-multi-character-sanitization.js:9:13:9:47 | content ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:9:30:9:30 | < | <cript |
+| tst-multi-character-sanitization.js:10:13:10:49 | content ... /g, "") | This string may still contain $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:10:30:10:42 | .on\\w+=.*".*" | on |
+| tst-multi-character-sanitization.js:11:13:11:51 | content ... /g, "") | This string may still contain $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:11:30:11:44 | .on\\w+=.*\\'.*\\' | on |
+| tst-multi-character-sanitization.js:19:3:19:35 | respons ... pt, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:18:18:18:24 | <script | <script |
+| tst-multi-character-sanitization.js:25:10:25:40 | text.re ... /g, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:25:24:25:27 | <!-- | <!-- |
+| tst-multi-character-sanitization.js:49:13:49:43 | req.url ... EL, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:48:22:48:23 | \\/ | /.. |
+| tst-multi-character-sanitization.js:64:7:64:73 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:64:18:64:24 | <script | <script |
+| tst-multi-character-sanitization.js:66:7:66:56 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:66:18:66:49 | (\\/\|\\s)on\\w+=(\\'\|")?[^"]*(\\'\|")? | on |
+| tst-multi-character-sanitization.js:75:7:75:37 | x.repla ... gm, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:75:18:75:21 | <!-- | <!-- |
+| tst-multi-character-sanitization.js:76:7:76:35 | x.repla ... +/, "") | This string may still contain $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:76:18:76:29 | \\sng-[a-z-]+ | ng- |
+| tst-multi-character-sanitization.js:77:7:77:36 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:77:18:77:29 | \\sng-[a-z-]+ | ng- |
+| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:81:36:81:39 | only | on |
+| tst-multi-character-sanitization.js:81:7:81:58 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:81:18:81:24 | <script | <script |
+| tst-multi-character-sanitization.js:83:7:83:63 | x.repla ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:83:18:83:21 | <!-- | <!-- |
+| tst-multi-character-sanitization.js:85:7:85:48 | x.repla ... /g, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:85:18:85:21 | \\x2E | ../ |
+| tst-multi-character-sanitization.js:87:7:87:47 | x.repla ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:87:18:87:24 | <script | <script |
+| tst-multi-character-sanitization.js:92:7:96:4 | x.repla ... ";\\n  }) | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:92:18:92:24 | <script | <script |
+| tst-multi-character-sanitization.js:101:7:101:30 | x.repla ... /g, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:101:18:101:19 | \\. | ../ |
+| tst-multi-character-sanitization.js:102:7:102:30 | x.repla ... /g, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:102:18:102:19 | \\/ | /.. |
+| tst-multi-character-sanitization.js:104:7:104:58 | x.repla ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:104:18:104:24 | <script | <script |
+| tst-multi-character-sanitization.js:106:7:106:64 | x.repla ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:106:18:106:18 | < | <script |
+| tst-multi-character-sanitization.js:107:7:107:62 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:107:18:107:19 | \\< | <script |
+| tst-multi-character-sanitization.js:108:7:108:75 | x.repla ... gm, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:108:18:108:18 | < | <script |
+| tst-multi-character-sanitization.js:109:7:109:58 | x.repla ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:109:18:109:24 | <script | <script |
+| tst-multi-character-sanitization.js:110:7:110:50 | x.repla ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:110:18:110:24 | <script | <script |
+| tst-multi-character-sanitization.js:111:7:111:32 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:111:18:111:19 |  ? | <!-- |
+| tst-multi-character-sanitization.js:126:7:129:34 | x\\n    . ... //, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:129:15:129:20 | [^\\/]* | /.. |
+| tst-multi-character-sanitization.js:135:2:135:44 | content ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:135:19:135:25 | <script | <script |
+| tst-multi-character-sanitization.js:136:2:136:46 | content ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:136:19:136:19 | < | <script |
+| tst-multi-character-sanitization.js:138:2:138:48 | content ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:138:19:138:20 | .* | <script |

From 847687974fd2152146b46af7c4c73da483d2577a Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Tue, 12 Jan 2021 08:50:19 +0100
Subject: [PATCH 071/343] JS: only select non-nullable terms in the broken
 sanitizer

---
 .../CWE-116/IncompleteMultiCharacterSanitization.ql        | 5 ++++-
 .../IncompleteMultiCharacterSanitization.expected          | 7 ++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
index 3ae30ffe15b..d19cb2716c2 100644
--- a/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
+++ b/javascript/ql/src/Security/CWE-116/IncompleteMultiCharacterSanitization.ql
@@ -147,13 +147,16 @@ from
 where
   regexp = replace.getRegExp().getRoot() and
   dangerous.getRootTerm() = regexp and
+  // skip leading optional elements
+  not dangerous.isNullable() and
   // only warn about the longest match (presumably the most descriptive)
   prefix = max(string m | matchesDangerousPrefix(dangerous, m, kind) | m order by m.length()) and
   // only warn once per kind
   not exists(EmptyReplaceRegExpTerm other |
     other = dangerous.getAChild+() or other = dangerous.getPredecessor+()
   |
-    matchesDangerousPrefix(other, _, kind)
+    matchesDangerousPrefix(other, _, kind) and
+    not other.isNullable()
   ) and
   // don't flag replace operations in a loop
   not replace.getAMethodCall*().flowsTo(replace.getReceiver()) and
diff --git a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected
index 9403b43cd43..172baa9c1c1 100644
--- a/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-116/IncompleteSanitization/IncompleteMultiCharacterSanitization.expected
@@ -7,6 +7,7 @@
 | tst-multi-character-sanitization.js:19:3:19:35 | respons ... pt, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:18:18:18:24 | <script | <script |
 | tst-multi-character-sanitization.js:25:10:25:40 | text.re ... /g, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:25:24:25:27 | <!-- | <!-- |
 | tst-multi-character-sanitization.js:49:13:49:43 | req.url ... EL, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:48:22:48:23 | \\/ | /.. |
+| tst-multi-character-sanitization.js:49:13:49:43 | req.url ... EL, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:48:26:48:27 | \\. | ../ |
 | tst-multi-character-sanitization.js:64:7:64:73 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:64:18:64:24 | <script | <script |
 | tst-multi-character-sanitization.js:66:7:66:56 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML attribute injection vulnerability. | tst-multi-character-sanitization.js:66:18:66:49 | (\\/\|\\s)on\\w+=(\\'\|")?[^"]*(\\'\|")? | on |
 | tst-multi-character-sanitization.js:75:7:75:37 | x.repla ... gm, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:75:18:75:21 | <!-- | <!-- |
@@ -26,8 +27,8 @@
 | tst-multi-character-sanitization.js:108:7:108:75 | x.repla ... gm, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:108:18:108:18 | < | <script |
 | tst-multi-character-sanitization.js:109:7:109:58 | x.repla ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:109:18:109:24 | <script | <script |
 | tst-multi-character-sanitization.js:110:7:110:50 | x.repla ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:110:18:110:24 | <script | <script |
-| tst-multi-character-sanitization.js:111:7:111:32 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:111:18:111:19 |  ? | <!-- |
-| tst-multi-character-sanitization.js:126:7:129:34 | x\\n    . ... //, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:129:15:129:20 | [^\\/]* | /.. |
+| tst-multi-character-sanitization.js:111:7:111:32 | x.repla ... /g, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:111:20:111:23 | <!-- | <!-- |
+| tst-multi-character-sanitization.js:126:7:129:34 | x\\n    . ... //, "") | This string may still contain $@, which may cause a path injection vulnerability. | tst-multi-character-sanitization.js:129:21:129:22 | \\/ | /.. |
 | tst-multi-character-sanitization.js:135:2:135:44 | content ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:135:19:135:25 | <script | <script |
 | tst-multi-character-sanitization.js:136:2:136:46 | content ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:136:19:136:19 | < | <script |
-| tst-multi-character-sanitization.js:138:2:138:48 | content ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:138:19:138:20 | .* | <script |
+| tst-multi-character-sanitization.js:138:2:138:48 | content ... gi, "") | This string may still contain $@, which may cause a HTML element injection vulnerability. | tst-multi-character-sanitization.js:138:21:138:21 | < | <script |

From 5965035c09339efee3d627b37154a7236452803c Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Fri, 12 Jun 2020 10:52:20 +0200
Subject: [PATCH 072/343] JS: add query js/resource-exhaustion

---
 javascript/config/suites/javascript/security  |   1 +
 .../Security/CWE-770/ResourceExhaustion.qhelp | 113 +++++++++
 .../Security/CWE-770/ResourceExhaustion.ql    |  20 ++
 .../examples/ResourceExhaustion_array.js      |  10 +
 .../ResourceExhaustion_array_fixed.js         |  16 ++
 .../examples/ResourceExhaustion_buffer.js     |  10 +
 .../ResourceExhaustion_buffer_fixed.js        |  16 ++
 .../examples/ResourceExhaustion_timeout.js    |   9 +
 .../ResourceExhaustion_timeout_fixed.js       |  15 ++
 .../security/dataflow/ResourceExhaustion.qll  |  77 ++++++
 .../ResourceExhaustionCustomizations.qll      | 184 ++++++++++++++
 .../CWE-770/ResourceExhaustion.expected       | 234 ++++++++++++++++++
 .../Security/CWE-770/ResourceExhaustion.qlref |   1 +
 .../ResourceExhaustion_array.js               |  10 +
 .../ResourceExhaustion_array_fixed.js         |  16 ++
 .../ResourceExhaustion_buffer.js              |  10 +
 .../ResourceExhaustion_buffer_fixed.js        |  16 ++
 .../ResourceExhaustion_timeout.js             |   9 +
 .../ResourceExhaustion_timeout_fixed.js       |  15 ++
 .../Security/CWE-770/resource-exhaustion.js   |  85 +++++++
 20 files changed, 867 insertions(+)
 create mode 100644 javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp
 create mode 100644 javascript/ql/src/Security/CWE-770/ResourceExhaustion.ql
 create mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array.js
 create mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array_fixed.js
 create mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer.js
 create mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer_fixed.js
 create mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout.js
 create mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout_fixed.js
 create mode 100644 javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll
 create mode 100644 javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.qlref
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array.js
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array_fixed.js
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer.js
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer_fixed.js
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout.js
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout_fixed.js
 create mode 100644 javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js

diff --git a/javascript/config/suites/javascript/security b/javascript/config/suites/javascript/security
index 3e87d292d7b..9c9f2e007f8 100644
--- a/javascript/config/suites/javascript/security
+++ b/javascript/config/suites/javascript/security
@@ -51,6 +51,7 @@
 + semmlecode-javascript-queries/Security/CWE-730/RegExpInjection.ql: /Security/CWE/CWE-730
 + semmlecode-javascript-queries/Security/CWE-754/UnvalidatedDynamicMethodCall.ql: /Security/CWE/CWE-754
 + semmlecode-javascript-queries/Security/CWE-770/MissingRateLimiting.ql: /Security/CWE/CWE-770
++ semmlecode-javascript-queries/Security/CWE-770/ResourceExhaustion.ql: /Security/CWE/CWE-770
 + semmlecode-javascript-queries/Security/CWE-776/XmlBomb.ql: /Security/CWE/CWE-776
 + semmlecode-javascript-queries/Security/CWE-798/HardcodedCredentials.ql: /Security/CWE/CWE-798
 + semmlecode-javascript-queries/Security/CWE-807/ConditionalBypass.ql: /Security/CWE/CWE-807
diff --git a/javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp b/javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp
new file mode 100644
index 00000000000..7ffd054945e
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp
@@ -0,0 +1,113 @@
+<!DOCTYPE qhelp PUBLIC
+"-//Semmle//qhelp//EN"
+"qhelp.dtd">
+<qhelp>
+
+	<overview>
+
+		<p>
+
+			Applications are constrained by how many resources they can make use
+			of. Failing to respect these constraints may cause the application to
+			be unresponsive or crash. It is therefore problematic if attackers
+			can control the sizes or lifetimes of allocated objects.
+
+		</p>
+
+	</overview>
+
+	<recommendation>
+
+		<p>
+
+			Ensure that attackers can not control object sizes and their
+			lifetimes. If object sizes and lifetimes must be controlled by
+			external parties, ensure you restrict the object sizes and lifetimes so that
+			they are within acceptable ranges.
+
+		</p>
+
+	</recommendation>
+
+	<example>
+
+		<p>
+
+			The following example allocates a buffer with a user-controlled
+			size.
+
+		</p>
+
+		<sample src="examples/ResourceExhaustion_buffer.js" />
+
+		<p>
+
+			This is problematic since an attacker can choose a size
+			that makes the application run out of memory. Even worse, in older
+			versions of Node.js, this could leak confidential memory.
+
+			To prevent such attacks, limit the buffer size:
+
+		</p>
+
+		<sample src="examples/ResourceExhaustion_buffer_fixed.js" />
+
+	</example>
+
+	<example>
+
+		<p>
+
+			As another example, consider an application that allocates an
+			array with a user-controlled size, and then fills it with values:
+
+		</p>
+
+		<sample src="examples/ResourceExhaustion_array.js" />
+
+		<p>
+			The allocation of the array itself is not problematic since arrays are
+			allocated sparsely, but the subsequent filling of the array will take
+			a long time, causing the application to be unresponsive, or even run
+			out of memory.
+
+			Again, a limit on the size will prevent the attack:
+
+		</p>
+
+		<sample src="examples/ResourceExhaustion_array_fixed.js" />
+
+	</example>
+
+	<example>
+
+		<p>
+
+			Finally, the following example lets a user choose a delay after
+			which a function is executed:
+
+		</p>
+
+		<sample src="examples/ResourceExhaustion_timeout.js" />
+
+		<p>
+
+			This is problematic because a large delay essentially makes the
+			application wait indefinitely before executing the function. Repeated
+			registrations of such delays will therefore use up all of the memory
+			in the application.
+
+			Again, a limit on the delay will prevent the attack:
+
+		</p>
+
+		<sample src="examples/ResourceExhaustion_timeout_fixed.js" />
+
+
+	</example>
+
+	<references>
+
+	</references>
+
+</qhelp>
diff --git a/javascript/ql/src/Security/CWE-770/ResourceExhaustion.ql b/javascript/ql/src/Security/CWE-770/ResourceExhaustion.ql
new file mode 100644
index 00000000000..adb8663085e
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-770/ResourceExhaustion.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Resource exhaustion
+ * @description Allocating objects or timers with user-controlled
+ *              sizes or durations can cause resource exhaustion.
+ * @kind path-problem
+ * @problem.severity warning
+ * @id js/resource-exhaustion
+ * @precision high
+ * @tags security
+ *       external/cwe/cwe-770
+ */
+
+import javascript
+import DataFlow::PathGraph
+import semmle.javascript.security.dataflow.ResourceExhaustion::ResourceExhaustion
+
+from Configuration dataflow, DataFlow::PathNode source, DataFlow::PathNode sink
+where dataflow.hasFlowPath(source, sink)
+select sink, source, sink, sink.getNode().(Sink).getProblemDescription() + " from $@.", source,
+  "here"
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array.js
new file mode 100644
index 00000000000..e7c6be16953
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array.js
@@ -0,0 +1,10 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var size = parseInt(url.parse(req.url, true).query.size);
+
+	let dogs = new Array(size).fill(x => "dog"); // BAD
+
+	// ... use the dogs
+});
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array_fixed.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array_fixed.js
new file mode 100644
index 00000000000..f7c88129264
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array_fixed.js
@@ -0,0 +1,16 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var size = parseInt(url.parse(req.url, true).query.size);
+
+	if (size > 1024) {
+		res.statusCode = 400;
+		res.end("Bad request.");
+		return;
+	}
+
+	let dogs = new Array(size).fill(x => "dog"); // GOOD
+
+	// ... use the dogs
+});
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer.js
new file mode 100644
index 00000000000..d821901e818
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer.js
@@ -0,0 +1,10 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var size = parseInt(url.parse(req.url, true).query.size);
+
+	let buffer = Buffer.alloc(size); // BAD
+
+	// ... use the buffer
+});
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer_fixed.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer_fixed.js
new file mode 100644
index 00000000000..8d9f9b0839f
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer_fixed.js
@@ -0,0 +1,16 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var size = parseInt(url.parse(req.url, true).query.size);
+
+	if (size > 1024) {
+		res.statusCode = 400;
+		res.end("Bad request.");
+		return;
+	}
+
+	let buffer = Buffer.alloc(size); // GOOD
+
+	// ... use the buffer
+});
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout.js
new file mode 100644
index 00000000000..1718509534b
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout.js
@@ -0,0 +1,9 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var delay = parseInt(url.parse(req.url, true).query.delay);
+
+	setTimeout(f, delay); // BAD
+
+});
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout_fixed.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout_fixed.js
new file mode 100644
index 00000000000..2f5a614e3d7
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout_fixed.js
@@ -0,0 +1,15 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var delay = parseInt(url.parse(req.url, true).query.delay);
+
+	if (delay > 1000) {
+		res.statusCode = 400;
+		res.end("Bad request.");
+		return;
+	}
+
+	setTimeout(f, delay); // GOOD
+
+});
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll b/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll
new file mode 100644
index 00000000000..dc46eb7daf0
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll
@@ -0,0 +1,77 @@
+/**
+ * Provides a taint tracking configuration for reasoning about
+ * resource exhaustion vulnerabilities (CWE-770).
+ *
+ * Note, for performance reasons: only import this file if
+ * `ResourceExhaustion::Configuration` is needed, otherwise
+ * `ResourceExhaustionCustomizations` should be imported instead.
+ */
+
+import javascript
+import semmle.javascript.security.dataflow.LoopBoundInjectionCustomizations
+
+module ResourceExhaustion {
+  import ResourceExhaustionCustomizations::ResourceExhaustion
+
+  /**
+   * A data flow configuration for resource exhaustion vulnerabilities.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "ResourceExhaustion" }
+
+    override predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
+      source.(Source).getAFlowLabel() = label
+    }
+
+    override predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel label) {
+      sink.(Sink).getAFlowLabel() = label
+    }
+
+    override predicate isAdditionalFlowStep(
+      DataFlow::Node src, DataFlow::Node dst, DataFlow::FlowLabel srclabel,
+      DataFlow::FlowLabel dstlabel
+    ) {
+      dstlabel instanceof Label::Number and
+      isNumericFlowStep(src, dst)
+      or
+      // reuse most existing taint steps
+      super.isAdditionalFlowStep(src, dst) and
+      not dst.asExpr() instanceof AddExpr and
+      if dst.(DataFlow::MethodCallNode).calls(src, "toString")
+      then dstlabel.isTaint()
+      else srclabel = dstlabel
+    }
+
+    override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
+      guard instanceof LoopBoundInjection::LengthCheckSanitizerGuard or
+      guard instanceof UpperBoundsCheckSanitizerGuard or
+      guard instanceof TypeTestGuard
+    }
+  }
+
+  /**
+   * Holds if data may flow from `src` to `dst` as a number.
+   */
+  predicate isNumericFlowStep(DataFlow::Node src, DataFlow::Node dst) {
+    // steps that introduce or preserve a number
+    dst.(DataFlow::PropRead).accesses(src, ["length", "size"])
+    or
+    exists(DataFlow::CallNode c |
+      c = dst and
+      src = c.getAnArgument()
+    |
+      c = DataFlow::globalVarRef("Math").getAMemberCall(_) or
+      c = DataFlow::globalVarRef(["Number", "parseInt", "parseFloat"]).getACall()
+    )
+    or
+    exists(Expr dstExpr, Expr srcExpr |
+      dstExpr = dst.asExpr() and
+      srcExpr = src.asExpr()
+    |
+      dstExpr.(BinaryExpr).getAnOperand() = srcExpr and
+      not dstExpr instanceof AddExpr
+      or
+      dstExpr.(PlusExpr).getOperand() = srcExpr
+    )
+  }
+}
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
new file mode 100644
index 00000000000..b428f2c4e8b
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
@@ -0,0 +1,184 @@
+/**
+ * Provides default sources, sinks and sanitizers for reasoning about
+ * resource exhaustion vulnerabilities, as well as extension points for
+ * adding your own.
+ */
+
+import javascript
+
+module ResourceExhaustion {
+  /**
+   * A data flow source for resource exhaustion vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node {
+    /** Gets a flow label denoting the type of value for which this is a source. */
+    DataFlow::FlowLabel getAFlowLabel() { result.isTaint() }
+  }
+
+  /**
+   * A data flow sink for resource exhaustion vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node {
+    /** Gets a flow label denoting the type of value for which this is a sink. */
+    DataFlow::FlowLabel getAFlowLabel() { result instanceof Label::Number }
+
+    /**
+     * Gets a description of why this is a problematic sink.
+     */
+    abstract string getProblemDescription();
+  }
+
+  /**
+   * A data flow sanitizer for resource exhaustion vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * Provides data flow labels for resource exhaustion vulnerabilities.
+   */
+  module Label {
+    /**
+     * A number data flow label.
+     */
+    class Number extends DataFlow::FlowLabel {
+      Number() { this = "number" }
+    }
+  }
+
+  /**
+   * A sanitizer that blocks taint flow if the size of a number is limited.
+   */
+  class UpperBoundsCheckSanitizerGuard extends TaintTracking::LabeledSanitizerGuardNode,
+    DataFlow::ValueNode {
+    override RelationalComparison astNode;
+
+    override predicate sanitizes(boolean outcome, Expr e, DataFlow::FlowLabel label) {
+      label instanceof Label::Number and
+      (
+        true = outcome and
+        e = astNode.getLesserOperand()
+        or
+        false = outcome and
+        e = astNode.getGreaterOperand()
+      )
+    }
+  }
+
+  /**
+   * A test of form `typeof x === "something"`, preventing `x` from being a number in some cases.
+   */
+  class TypeTestGuard extends TaintTracking::LabeledSanitizerGuardNode, DataFlow::ValueNode {
+    override EqualityTest astNode;
+    Expr x;
+    boolean polarity;
+
+    TypeTestGuard() {
+      // typeof x === "number" sanitizes `x` when it evaluates to false
+      TaintTracking::isTypeofGuard(astNode, x, "number") and
+      polarity = astNode.getPolarity().booleanNot()
+      or
+      // typeof x === "string" sanitizes `x` when it evaluates to true
+      TaintTracking::isTypeofGuard(astNode, x, any(string s | s != "number")) and
+      polarity = astNode.getPolarity()
+    }
+
+    override predicate sanitizes(boolean outcome, Expr e, DataFlow::FlowLabel label) {
+      polarity = outcome and
+      e = x and
+      label instanceof Label::Number
+    }
+  }
+
+  /** A source of remote user input, considered as a data flow source for resource exhaustion vulnerabilities. */
+  class RemoteFlowSourceAsSource extends Source {
+    RemoteFlowSourceAsSource() { this instanceof RemoteFlowSource }
+  }
+
+  /**
+   * A node that determines the size of a buffer, considered as a data flow sink for resource exhaustion vulnerabilities.
+   */
+  class BufferSizeSink extends Sink {
+    BufferSizeSink() {
+      exists(DataFlow::SourceNode clazz, DataFlow::InvokeNode invk, int index |
+        clazz = DataFlow::globalVarRef("Buffer") and this = invk.getArgument(index)
+      |
+        exists(string name |
+          invk = clazz.getAMemberCall(name) and
+          (
+            name = "from" and index = 2
+            or
+            name = ["alloc", "allocUnsafe", "allocUnsafeSlow"] and index = 0
+          )
+        )
+        or
+        invk = clazz.getAnInvocation() and
+        (
+          invk.getNumArgument() = 1 and
+          index = 0
+          or
+          invk.getNumArgument() = 3 and index = 2
+        )
+      )
+      or
+      this = DataFlow::globalVarRef("SlowBuffer").getAnInstantiation().getArgument(0)
+    }
+
+    override string getProblemDescription() {
+      result = "This creates a buffer with a user-controlled size"
+    }
+  }
+
+  /**
+   * A node that determines the size of an array, considered as a data flow sink for resource exhaustion vulnerabilities.
+   */
+  class DenseArraySizeSink extends Sink {
+    DenseArraySizeSink() {
+      // Arrays are sparse by default, so we must also look at how the array is used
+      exists(DataFlow::ArrayConstructorInvokeNode instance |
+        this = instance.getArgument(0) and
+        instance.getNumArgument() = 1
+      |
+        exists(instance.getAMethodCall(["map", "fill", "join", "toString"])) or
+        instance.flowsToExpr(any(AddExpr p).getAnOperand())
+      )
+    }
+
+    override string getProblemDescription() {
+      result = "This creates an array with a user-controlled length"
+    }
+  }
+
+  /**
+   * A node that determines the repetitions of a string, considered as a data flow sink for resource exhaustion vulnerabilities.
+   */
+  class StringRepetitionSink extends Sink {
+    StringRepetitionSink() {
+      exists(DataFlow::MethodCallNode repeat |
+        repeat.getMethodName() = "repeat" and
+        this = repeat.getArgument(0)
+      )
+    }
+
+    override DataFlow::FlowLabel getAFlowLabel() { any() }
+
+    override string getProblemDescription() {
+      result = "This creates a string with a user-controlled length"
+    }
+  }
+
+  /**
+   * A node that determines the duration of a timer, considered as a data flow sink for resource exhaustion vulnerabilities.
+   */
+  class TimerDurationSink extends Sink {
+    TimerDurationSink() {
+      this = DataFlow::globalVarRef(["setTimeout", "setInterval"]).getACall().getArgument(1) or
+      this = LodashUnderscore::member(["delay", "throttle", "debounce"]).getACall().getArgument(1)
+    }
+
+    override DataFlow::FlowLabel getAFlowLabel() { any() }
+
+    override string getProblemDescription() {
+      result = "This creates a timer with a user-controlled duration"
+    }
+  }
+}
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected b/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected
new file mode 100644
index 00000000000..0260567be53
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected
@@ -0,0 +1,234 @@
+nodes
+| documentation_examples/ResourceExhaustion_array.js:5:6:5:57 | size |
+| documentation_examples/ResourceExhaustion_array.js:5:13:5:57 | parseIn ... y.size) |
+| documentation_examples/ResourceExhaustion_array.js:5:22:5:45 | url.par ... , true) |
+| documentation_examples/ResourceExhaustion_array.js:5:22:5:51 | url.par ... ).query |
+| documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size |
+| documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size |
+| documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url |
+| documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url |
+| documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size |
+| documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size |
+| documentation_examples/ResourceExhaustion_buffer.js:5:6:5:57 | size |
+| documentation_examples/ResourceExhaustion_buffer.js:5:13:5:57 | parseIn ... y.size) |
+| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:45 | url.par ... , true) |
+| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:51 | url.par ... ).query |
+| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size |
+| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size |
+| documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url |
+| documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url |
+| documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size |
+| documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size |
+| documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay |
+| documentation_examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) |
+| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
+| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:52 | url.par ... ).query |
+| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay |
+| documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url |
+| documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url |
+| documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
+| documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
+| resource-exhaustion.js:5:7:5:42 | s |
+| resource-exhaustion.js:5:11:5:34 | url.par ... , true) |
+| resource-exhaustion.js:5:11:5:40 | url.par ... ).query |
+| resource-exhaustion.js:5:11:5:42 | url.par ... query.s |
+| resource-exhaustion.js:5:21:5:27 | req.url |
+| resource-exhaustion.js:5:21:5:27 | req.url |
+| resource-exhaustion.js:6:7:6:21 | n |
+| resource-exhaustion.js:6:11:6:21 | parseInt(s) |
+| resource-exhaustion.js:6:20:6:20 | s |
+| resource-exhaustion.js:12:21:12:21 | n |
+| resource-exhaustion.js:12:21:12:21 | n |
+| resource-exhaustion.js:13:21:13:21 | n |
+| resource-exhaustion.js:13:21:13:21 | n |
+| resource-exhaustion.js:14:16:14:16 | n |
+| resource-exhaustion.js:14:16:14:16 | n |
+| resource-exhaustion.js:15:22:15:22 | n |
+| resource-exhaustion.js:15:22:15:22 | n |
+| resource-exhaustion.js:16:26:16:26 | n |
+| resource-exhaustion.js:16:26:16:26 | n |
+| resource-exhaustion.js:18:14:18:14 | n |
+| resource-exhaustion.js:18:14:18:14 | n |
+| resource-exhaustion.js:20:20:20:20 | n |
+| resource-exhaustion.js:20:20:20:20 | n |
+| resource-exhaustion.js:22:18:22:18 | n |
+| resource-exhaustion.js:22:18:22:18 | n |
+| resource-exhaustion.js:27:9:27:9 | n |
+| resource-exhaustion.js:27:9:27:9 | n |
+| resource-exhaustion.js:28:13:28:13 | n |
+| resource-exhaustion.js:28:13:28:13 | n |
+| resource-exhaustion.js:29:9:29:9 | n |
+| resource-exhaustion.js:29:9:29:9 | n |
+| resource-exhaustion.js:30:9:30:9 | n |
+| resource-exhaustion.js:30:9:30:9 | n |
+| resource-exhaustion.js:31:9:31:9 | n |
+| resource-exhaustion.js:31:9:31:9 | n |
+| resource-exhaustion.js:32:9:32:9 | n |
+| resource-exhaustion.js:32:9:32:9 | n |
+| resource-exhaustion.js:34:12:34:12 | n |
+| resource-exhaustion.js:34:12:34:12 | n |
+| resource-exhaustion.js:35:12:35:12 | s |
+| resource-exhaustion.js:35:12:35:12 | s |
+| resource-exhaustion.js:37:14:37:14 | n |
+| resource-exhaustion.js:37:14:37:18 | n * x |
+| resource-exhaustion.js:37:14:37:18 | n * x |
+| resource-exhaustion.js:45:14:45:25 | Math.ceil(s) |
+| resource-exhaustion.js:45:14:45:25 | Math.ceil(s) |
+| resource-exhaustion.js:45:24:45:24 | s |
+| resource-exhaustion.js:46:14:46:22 | Number(s) |
+| resource-exhaustion.js:46:14:46:22 | Number(s) |
+| resource-exhaustion.js:46:21:46:21 | s |
+| resource-exhaustion.js:50:14:50:14 | s |
+| resource-exhaustion.js:50:14:50:21 | s.length |
+| resource-exhaustion.js:50:14:50:21 | s.length |
+| resource-exhaustion.js:55:16:55:16 | n |
+| resource-exhaustion.js:55:16:55:16 | n |
+| resource-exhaustion.js:58:7:58:20 | ns |
+| resource-exhaustion.js:58:12:58:20 | x ? n : s |
+| resource-exhaustion.js:58:16:58:16 | n |
+| resource-exhaustion.js:59:14:59:15 | ns |
+| resource-exhaustion.js:59:14:59:15 | ns |
+| resource-exhaustion.js:66:16:66:16 | n |
+| resource-exhaustion.js:66:16:66:16 | n |
+| resource-exhaustion.js:70:16:70:16 | n |
+| resource-exhaustion.js:70:16:70:16 | n |
+| resource-exhaustion.js:81:17:81:17 | n |
+| resource-exhaustion.js:81:17:81:17 | n |
+| resource-exhaustion.js:82:17:82:17 | s |
+| resource-exhaustion.js:82:17:82:17 | s |
+| resource-exhaustion.js:83:18:83:18 | n |
+| resource-exhaustion.js:83:18:83:18 | n |
+| resource-exhaustion.js:84:18:84:18 | s |
+| resource-exhaustion.js:84:18:84:18 | s |
+edges
+| documentation_examples/ResourceExhaustion_array.js:5:6:5:57 | size | documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size |
+| documentation_examples/ResourceExhaustion_array.js:5:6:5:57 | size | documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size |
+| documentation_examples/ResourceExhaustion_array.js:5:13:5:57 | parseIn ... y.size) | documentation_examples/ResourceExhaustion_array.js:5:6:5:57 | size |
+| documentation_examples/ResourceExhaustion_array.js:5:22:5:45 | url.par ... , true) | documentation_examples/ResourceExhaustion_array.js:5:22:5:51 | url.par ... ).query |
+| documentation_examples/ResourceExhaustion_array.js:5:22:5:51 | url.par ... ).query | documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size |
+| documentation_examples/ResourceExhaustion_array.js:5:22:5:51 | url.par ... ).query | documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size |
+| documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size | documentation_examples/ResourceExhaustion_array.js:5:13:5:57 | parseIn ... y.size) |
+| documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size | documentation_examples/ResourceExhaustion_array.js:5:13:5:57 | parseIn ... y.size) |
+| documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_array.js:5:22:5:45 | url.par ... , true) |
+| documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_array.js:5:22:5:45 | url.par ... , true) |
+| documentation_examples/ResourceExhaustion_buffer.js:5:6:5:57 | size | documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size |
+| documentation_examples/ResourceExhaustion_buffer.js:5:6:5:57 | size | documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size |
+| documentation_examples/ResourceExhaustion_buffer.js:5:13:5:57 | parseIn ... y.size) | documentation_examples/ResourceExhaustion_buffer.js:5:6:5:57 | size |
+| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:45 | url.par ... , true) | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:51 | url.par ... ).query |
+| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:51 | url.par ... ).query | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size |
+| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:51 | url.par ... ).query | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size |
+| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size | documentation_examples/ResourceExhaustion_buffer.js:5:13:5:57 | parseIn ... y.size) |
+| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size | documentation_examples/ResourceExhaustion_buffer.js:5:13:5:57 | parseIn ... y.size) |
+| documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:45 | url.par ... , true) |
+| documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:45 | url.par ... , true) |
+| documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
+| documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
+| documentation_examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) | documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay |
+| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:52 | url.par ... ).query |
+| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:52 | url.par ... ).query | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay |
+| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay | documentation_examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) |
+| documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
+| documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:6:20:6:20 | s |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:35:12:35:12 | s |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:35:12:35:12 | s |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:45:24:45:24 | s |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:46:21:46:21 | s |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:50:14:50:14 | s |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:82:17:82:17 | s |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:82:17:82:17 | s |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:84:18:84:18 | s |
+| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:84:18:84:18 | s |
+| resource-exhaustion.js:5:11:5:34 | url.par ... , true) | resource-exhaustion.js:5:11:5:40 | url.par ... ).query |
+| resource-exhaustion.js:5:11:5:40 | url.par ... ).query | resource-exhaustion.js:5:11:5:42 | url.par ... query.s |
+| resource-exhaustion.js:5:11:5:42 | url.par ... query.s | resource-exhaustion.js:5:7:5:42 | s |
+| resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:5:11:5:34 | url.par ... , true) |
+| resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:5:11:5:34 | url.par ... , true) |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:12:21:12:21 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:12:21:12:21 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:13:21:13:21 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:13:21:13:21 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:14:16:14:16 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:14:16:14:16 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:15:22:15:22 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:15:22:15:22 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:16:26:16:26 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:16:26:16:26 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:18:14:18:14 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:18:14:18:14 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:20:20:20:20 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:20:20:20:20 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:22:18:22:18 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:22:18:22:18 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:27:9:27:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:27:9:27:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:28:13:28:13 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:28:13:28:13 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:29:9:29:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:29:9:29:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:30:9:30:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:30:9:30:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:31:9:31:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:31:9:31:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:32:9:32:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:32:9:32:9 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:34:12:34:12 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:34:12:34:12 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:37:14:37:14 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:55:16:55:16 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:55:16:55:16 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:58:16:58:16 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:66:16:66:16 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:66:16:66:16 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:70:16:70:16 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:70:16:70:16 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:81:17:81:17 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:81:17:81:17 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:83:18:83:18 | n |
+| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:83:18:83:18 | n |
+| resource-exhaustion.js:6:11:6:21 | parseInt(s) | resource-exhaustion.js:6:7:6:21 | n |
+| resource-exhaustion.js:6:20:6:20 | s | resource-exhaustion.js:6:11:6:21 | parseInt(s) |
+| resource-exhaustion.js:37:14:37:14 | n | resource-exhaustion.js:37:14:37:18 | n * x |
+| resource-exhaustion.js:37:14:37:14 | n | resource-exhaustion.js:37:14:37:18 | n * x |
+| resource-exhaustion.js:45:24:45:24 | s | resource-exhaustion.js:45:14:45:25 | Math.ceil(s) |
+| resource-exhaustion.js:45:24:45:24 | s | resource-exhaustion.js:45:14:45:25 | Math.ceil(s) |
+| resource-exhaustion.js:46:21:46:21 | s | resource-exhaustion.js:46:14:46:22 | Number(s) |
+| resource-exhaustion.js:46:21:46:21 | s | resource-exhaustion.js:46:14:46:22 | Number(s) |
+| resource-exhaustion.js:50:14:50:14 | s | resource-exhaustion.js:50:14:50:21 | s.length |
+| resource-exhaustion.js:50:14:50:14 | s | resource-exhaustion.js:50:14:50:21 | s.length |
+| resource-exhaustion.js:58:7:58:20 | ns | resource-exhaustion.js:59:14:59:15 | ns |
+| resource-exhaustion.js:58:7:58:20 | ns | resource-exhaustion.js:59:14:59:15 | ns |
+| resource-exhaustion.js:58:12:58:20 | x ? n : s | resource-exhaustion.js:58:7:58:20 | ns |
+| resource-exhaustion.js:58:16:58:16 | n | resource-exhaustion.js:58:12:58:20 | x ? n : s |
+#select
+| documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size | documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size | This creates an array with a user-controlled length from $@. | documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url | here |
+| documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size | documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size | This creates a buffer with a user-controlled size from $@. | documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url | here |
+| documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay | documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay | This creates a timer with a user-controlled duration from $@. | documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | here |
+| resource-exhaustion.js:12:21:12:21 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:12:21:12:21 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:13:21:13:21 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:13:21:13:21 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:14:16:14:16 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:14:16:14:16 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:15:22:15:22 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:15:22:15:22 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:16:26:16:26 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:16:26:16:26 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:18:14:18:14 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:18:14:18:14 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:20:20:20:20 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:20:20:20:20 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:22:18:22:18 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:22:18:22:18 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:27:9:27:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:27:9:27:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:28:13:28:13 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:28:13:28:13 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:29:9:29:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:29:9:29:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:30:9:30:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:30:9:30:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:31:9:31:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:31:9:31:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:32:9:32:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:32:9:32:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:34:12:34:12 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:34:12:34:12 | n | This creates a string with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:35:12:35:12 | s | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:35:12:35:12 | s | This creates a string with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:37:14:37:18 | n * x | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:37:14:37:18 | n * x | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:45:14:45:25 | Math.ceil(s) | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:45:14:45:25 | Math.ceil(s) | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:46:14:46:22 | Number(s) | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:46:14:46:22 | Number(s) | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:50:14:50:21 | s.length | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:50:14:50:21 | s.length | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:55:16:55:16 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:55:16:55:16 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:59:14:59:15 | ns | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:59:14:59:15 | ns | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:66:16:66:16 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:66:16:66:16 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:70:16:70:16 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:70:16:70:16 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:81:17:81:17 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:81:17:81:17 | n | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:82:17:82:17 | s | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:82:17:82:17 | s | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:83:18:83:18 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:83:18:83:18 | n | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:84:18:84:18 | s | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:84:18:84:18 | s | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.qlref b/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.qlref
new file mode 100644
index 00000000000..38e612d406f
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.qlref
@@ -0,0 +1 @@
+Security/CWE-770/ResourceExhaustion.ql
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array.js
new file mode 100644
index 00000000000..2fad9da5d93
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array.js
@@ -0,0 +1,10 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var size = parseInt(url.parse(req.url, true).query.size);
+
+	let dogs = new Array(size).fill(x => "dog"); // BAD
+
+	// ... use the dog
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array_fixed.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array_fixed.js
new file mode 100644
index 00000000000..f7c88129264
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array_fixed.js
@@ -0,0 +1,16 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var size = parseInt(url.parse(req.url, true).query.size);
+
+	if (size > 1024) {
+		res.statusCode = 400;
+		res.end("Bad request.");
+		return;
+	}
+
+	let dogs = new Array(size).fill(x => "dog"); // GOOD
+
+	// ... use the dogs
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer.js
new file mode 100644
index 00000000000..d821901e818
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer.js
@@ -0,0 +1,10 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var size = parseInt(url.parse(req.url, true).query.size);
+
+	let buffer = Buffer.alloc(size); // BAD
+
+	// ... use the buffer
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer_fixed.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer_fixed.js
new file mode 100644
index 00000000000..8d9f9b0839f
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer_fixed.js
@@ -0,0 +1,16 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var size = parseInt(url.parse(req.url, true).query.size);
+
+	if (size > 1024) {
+		res.statusCode = 400;
+		res.end("Bad request.");
+		return;
+	}
+
+	let buffer = Buffer.alloc(size); // GOOD
+
+	// ... use the buffer
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout.js
new file mode 100644
index 00000000000..1718509534b
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout.js
@@ -0,0 +1,9 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var delay = parseInt(url.parse(req.url, true).query.delay);
+
+	setTimeout(f, delay); // BAD
+
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout_fixed.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout_fixed.js
new file mode 100644
index 00000000000..2f5a614e3d7
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout_fixed.js
@@ -0,0 +1,15 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+	var delay = parseInt(url.parse(req.url, true).query.delay);
+
+	if (delay > 1000) {
+		res.statusCode = 400;
+		res.end("Bad request.");
+		return;
+	}
+
+	setTimeout(f, delay); // GOOD
+
+});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js b/javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js
new file mode 100644
index 00000000000..1500fe15b87
--- /dev/null
+++ b/javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js
@@ -0,0 +1,85 @@
+var http = require("http"),
+    url = require("url");
+
+var server = http.createServer(function(req, res) {
+  let s = url.parse(req.url, true).query.s;
+  let n = parseInt(s);
+
+  Buffer.from(s); // OK
+  Buffer.from(n); // OK
+  Buffer.from(x, n); // OK
+  Buffer.from(x, y, s); // NOT OK
+  Buffer.from(x, y, n); // NOT OK
+  Buffer.from(x, y, n); // NOT OK
+  Buffer.alloc(n); // NOT OK
+  Buffer.allocUnsafe(n); // NOT OK
+  Buffer.allocUnsafeSlow(n); // NOT OK
+
+  new Buffer(n); // NOT OK
+  new Buffer(x, n); // OK
+  new Buffer(x, y, n); // NOT OK
+
+  new SlowBuffer(n); // NOT OK
+
+  Array(n); // OK
+  new Array(n); // OK
+
+  Array(n).map(); // NOT OK
+  new Array(n).map(); // NOT OK
+  Array(n).fill(); // NOT OK
+  Array(n).join(); // NOT OK
+  Array(n).toString(); // NOT OK
+  Array(n) + x; // NOT OK
+
+  x.repeat(n); // NOT OK
+  x.repeat(s); // NOT OK
+
+  new Buffer(n * x); // NOT OK
+  new Buffer(n + n); // NOT OK [INCONSISTENCY]
+  new Buffer(n + x); // OK (maybe)
+  new Buffer(n + s); // OK (this is  a string if `s` is a string)
+  new Buffer(s + 2); // OK (this is  a string if `s` is a string)
+  new Buffer(s + s); // OK
+  new Buffer(n + "X"); // OK
+
+  new Buffer(Math.ceil(s)); // NOT OK
+  new Buffer(Number(s)); // NOT OK
+  new Buffer(new Number(s)); // OK
+
+  new Buffer(s + x.length); // OK (this is a string if `s` is a string)
+  new Buffer(s.length); // NOT OK
+
+  if (n < 100) {
+    new Buffer(n); // OK
+  } else {
+    new Buffer(n); // NOT OK
+  }
+
+  let ns = x ? n : s;
+  new Buffer(ns); // NOT OK
+
+  new Buffer(n.toString()); // OK
+
+  if (typeof n === "string") {
+    new Buffer(n); // OK
+  } else {
+    new Buffer(n); // NOT OK
+  }
+
+  if (typeof n === "number") {
+    new Buffer(n); // NOT OK
+  } else {
+    new Buffer(n); // OK
+  }
+
+  if (typeof s === "number") {
+    new Buffer(s); // NOT OK [INCONSISTENCY]
+  } else {
+    new Buffer(s); // OK
+  }
+
+  setTimeout(f, n); // NOT OK
+  setTimeout(f, s); // NOT OK
+  setInterval(f, n); // NOT OK
+  setInterval(f, s); // NOT OK
+});

From 3c9c79a550564f1fcb009b4de5f564ce9143b599 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Tue, 12 Jan 2021 13:19:11 +0100
Subject: [PATCH 073/343] JS: remove flow labels from js/resource-exhaustion

---
 .../Security/CWE-770/ResourceExhaustion.qhelp |  54 +---
 .../examples/ResourceExhaustion_array.js      |  10 -
 .../ResourceExhaustion_array_fixed.js         |  16 --
 .../examples/ResourceExhaustion_buffer.js     |  10 -
 .../ResourceExhaustion_buffer_fixed.js        |  16 --
 .../security/dataflow/ResourceExhaustion.qll  |  29 +-
 .../ResourceExhaustionCustomizations.qll      | 118 +-------
 .../CWE-770/ResourceExhaustion.expected       | 260 ++++--------------
 .../ResourceExhaustion_array.js               |  10 -
 .../ResourceExhaustion_array_fixed.js         |  16 --
 .../ResourceExhaustion_buffer.js              |  10 -
 .../ResourceExhaustion_buffer_fixed.js        |  16 --
 .../Security/CWE-770/resource-exhaustion.js   |  48 ++--
 13 files changed, 93 insertions(+), 520 deletions(-)
 delete mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array.js
 delete mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array_fixed.js
 delete mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer.js
 delete mode 100644 javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer_fixed.js
 delete mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array.js
 delete mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array_fixed.js
 delete mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer.js
 delete mode 100644 javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer_fixed.js

diff --git a/javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp b/javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp
index 7ffd054945e..8f9283944fc 100644
--- a/javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp
+++ b/javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp
@@ -33,57 +33,7 @@
 
 		<p>
 
-			The following example allocates a buffer with a user-controlled
-			size.
-
-		</p>
-
-		<sample src="examples/ResourceExhaustion_buffer.js" />
-
-		<p>
-
-			This is problematic since an attacker can choose a size
-			that makes the application run out of memory. Even worse, in older
-			versions of Node.js, this could leak confidential memory.
-
-			To prevent such attacks, limit the buffer size:
-
-		</p>
-
-		<sample src="examples/ResourceExhaustion_buffer_fixed.js" />
-
-	</example>
-
-	<example>
-
-		<p>
-
-			As another example, consider an application that allocates an
-			array with a user-controlled size, and then fills it with values:
-
-		</p>
-
-		<sample src="examples/ResourceExhaustion_array.js" />
-
-		<p>
-			The allocation of the array itself is not problematic since arrays are
-			allocated sparsely, but the subsequent filling of the array will take
-			a long time, causing the application to be unresponsive, or even run
-			out of memory.
-
-			Again, a limit on the size will prevent the attack:
-
-		</p>
-
-		<sample src="examples/ResourceExhaustion_array_fixed.js" />
-
-	</example>
-
-	<example>
-
-		<p>
-
-			Finally, the following example lets a user choose a delay after
+			The following example lets a user choose a delay after
 			which a function is executed:
 
 		</p>
@@ -97,7 +47,7 @@
 			registrations of such delays will therefore use up all of the memory
 			in the application.
 
-			Again, a limit on the delay will prevent the attack:
+			A limit on the delay will prevent the attack:
 
 		</p>
 
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array.js
deleted file mode 100644
index e7c6be16953..00000000000
--- a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array.js
+++ /dev/null
@@ -1,10 +0,0 @@
-var http = require("http"),
-    url = require("url");
-
-var server = http.createServer(function(req, res) {
-	var size = parseInt(url.parse(req.url, true).query.size);
-
-	let dogs = new Array(size).fill(x => "dog"); // BAD
-
-	// ... use the dogs
-});
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array_fixed.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array_fixed.js
deleted file mode 100644
index f7c88129264..00000000000
--- a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_array_fixed.js
+++ /dev/null
@@ -1,16 +0,0 @@
-var http = require("http"),
-    url = require("url");
-
-var server = http.createServer(function(req, res) {
-	var size = parseInt(url.parse(req.url, true).query.size);
-
-	if (size > 1024) {
-		res.statusCode = 400;
-		res.end("Bad request.");
-		return;
-	}
-
-	let dogs = new Array(size).fill(x => "dog"); // GOOD
-
-	// ... use the dogs
-});
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer.js
deleted file mode 100644
index d821901e818..00000000000
--- a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer.js
+++ /dev/null
@@ -1,10 +0,0 @@
-var http = require("http"),
-    url = require("url");
-
-var server = http.createServer(function(req, res) {
-	var size = parseInt(url.parse(req.url, true).query.size);
-
-	let buffer = Buffer.alloc(size); // BAD
-
-	// ... use the buffer
-});
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer_fixed.js b/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer_fixed.js
deleted file mode 100644
index 8d9f9b0839f..00000000000
--- a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_buffer_fixed.js
+++ /dev/null
@@ -1,16 +0,0 @@
-var http = require("http"),
-    url = require("url");
-
-var server = http.createServer(function(req, res) {
-	var size = parseInt(url.parse(req.url, true).query.size);
-
-	if (size > 1024) {
-		res.statusCode = 400;
-		res.end("Bad request.");
-		return;
-	}
-
-	let buffer = Buffer.alloc(size); // GOOD
-
-	// ... use the buffer
-});
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll b/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll
index dc46eb7daf0..b17167318fd 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll
@@ -19,36 +19,29 @@ module ResourceExhaustion {
   class Configuration extends TaintTracking::Configuration {
     Configuration() { this = "ResourceExhaustion" }
 
-    override predicate isSource(DataFlow::Node source, DataFlow::FlowLabel label) {
-      source.(Source).getAFlowLabel() = label
-    }
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
 
-    override predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel label) {
-      sink.(Sink).getAFlowLabel() = label
-    }
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
-    override predicate isAdditionalFlowStep(
-      DataFlow::Node src, DataFlow::Node dst, DataFlow::FlowLabel srclabel,
-      DataFlow::FlowLabel dstlabel
-    ) {
-      dstlabel instanceof Label::Number and
+    override predicate isAdditionalTaintStep(DataFlow::Node src, DataFlow::Node dst) {
       isNumericFlowStep(src, dst)
       or
       // reuse most existing taint steps
-      super.isAdditionalFlowStep(src, dst) and
-      not dst.asExpr() instanceof AddExpr and
-      if dst.(DataFlow::MethodCallNode).calls(src, "toString")
-      then dstlabel.isTaint()
-      else srclabel = dstlabel
+      isRestrictedAdditionalTaintStep(src, dst)
     }
 
     override predicate isSanitizerGuard(TaintTracking::SanitizerGuardNode guard) {
       guard instanceof LoopBoundInjection::LengthCheckSanitizerGuard or
-      guard instanceof UpperBoundsCheckSanitizerGuard or
-      guard instanceof TypeTestGuard
+      guard instanceof UpperBoundsCheckSanitizerGuard
     }
   }
 
+  predicate isRestrictedAdditionalTaintStep(DataFlow::Node src, DataFlow::Node dst) {
+    any(TaintTracking::AdditionalTaintStep dts).step(src, dst) and
+    not dst.asExpr() instanceof AddExpr and
+    not dst.(DataFlow::MethodCallNode).calls(src, "toString")
+  }
+
   /**
    * Holds if data may flow from `src` to `dst` as a number.
    */
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
index b428f2c4e8b..a2aedef105e 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
@@ -10,18 +10,12 @@ module ResourceExhaustion {
   /**
    * A data flow source for resource exhaustion vulnerabilities.
    */
-  abstract class Source extends DataFlow::Node {
-    /** Gets a flow label denoting the type of value for which this is a source. */
-    DataFlow::FlowLabel getAFlowLabel() { result.isTaint() }
-  }
+  abstract class Source extends DataFlow::Node { }
 
   /**
    * A data flow sink for resource exhaustion vulnerabilities.
    */
   abstract class Sink extends DataFlow::Node {
-    /** Gets a flow label denoting the type of value for which this is a sink. */
-    DataFlow::FlowLabel getAFlowLabel() { result instanceof Label::Number }
-
     /**
      * Gets a description of why this is a problematic sink.
      */
@@ -33,59 +27,19 @@ module ResourceExhaustion {
    */
   abstract class Sanitizer extends DataFlow::Node { }
 
-  /**
-   * Provides data flow labels for resource exhaustion vulnerabilities.
-   */
-  module Label {
-    /**
-     * A number data flow label.
-     */
-    class Number extends DataFlow::FlowLabel {
-      Number() { this = "number" }
-    }
-  }
-
   /**
    * A sanitizer that blocks taint flow if the size of a number is limited.
    */
-  class UpperBoundsCheckSanitizerGuard extends TaintTracking::LabeledSanitizerGuardNode,
+  class UpperBoundsCheckSanitizerGuard extends TaintTracking::SanitizerGuardNode,
     DataFlow::ValueNode {
     override RelationalComparison astNode;
 
-    override predicate sanitizes(boolean outcome, Expr e, DataFlow::FlowLabel label) {
-      label instanceof Label::Number and
-      (
-        true = outcome and
-        e = astNode.getLesserOperand()
-        or
-        false = outcome and
-        e = astNode.getGreaterOperand()
-      )
-    }
-  }
-
-  /**
-   * A test of form `typeof x === "something"`, preventing `x` from being a number in some cases.
-   */
-  class TypeTestGuard extends TaintTracking::LabeledSanitizerGuardNode, DataFlow::ValueNode {
-    override EqualityTest astNode;
-    Expr x;
-    boolean polarity;
-
-    TypeTestGuard() {
-      // typeof x === "number" sanitizes `x` when it evaluates to false
-      TaintTracking::isTypeofGuard(astNode, x, "number") and
-      polarity = astNode.getPolarity().booleanNot()
+    override predicate sanitizes(boolean outcome, Expr e) {
+      true = outcome and
+      e = astNode.getLesserOperand()
       or
-      // typeof x === "string" sanitizes `x` when it evaluates to true
-      TaintTracking::isTypeofGuard(astNode, x, any(string s | s != "number")) and
-      polarity = astNode.getPolarity()
-    }
-
-    override predicate sanitizes(boolean outcome, Expr e, DataFlow::FlowLabel label) {
-      polarity = outcome and
-      e = x and
-      label instanceof Label::Number
+      false = outcome and
+      e = astNode.getGreaterOperand()
     }
   }
 
@@ -94,60 +48,6 @@ module ResourceExhaustion {
     RemoteFlowSourceAsSource() { this instanceof RemoteFlowSource }
   }
 
-  /**
-   * A node that determines the size of a buffer, considered as a data flow sink for resource exhaustion vulnerabilities.
-   */
-  class BufferSizeSink extends Sink {
-    BufferSizeSink() {
-      exists(DataFlow::SourceNode clazz, DataFlow::InvokeNode invk, int index |
-        clazz = DataFlow::globalVarRef("Buffer") and this = invk.getArgument(index)
-      |
-        exists(string name |
-          invk = clazz.getAMemberCall(name) and
-          (
-            name = "from" and index = 2
-            or
-            name = ["alloc", "allocUnsafe", "allocUnsafeSlow"] and index = 0
-          )
-        )
-        or
-        invk = clazz.getAnInvocation() and
-        (
-          invk.getNumArgument() = 1 and
-          index = 0
-          or
-          invk.getNumArgument() = 3 and index = 2
-        )
-      )
-      or
-      this = DataFlow::globalVarRef("SlowBuffer").getAnInstantiation().getArgument(0)
-    }
-
-    override string getProblemDescription() {
-      result = "This creates a buffer with a user-controlled size"
-    }
-  }
-
-  /**
-   * A node that determines the size of an array, considered as a data flow sink for resource exhaustion vulnerabilities.
-   */
-  class DenseArraySizeSink extends Sink {
-    DenseArraySizeSink() {
-      // Arrays are sparse by default, so we must also look at how the array is used
-      exists(DataFlow::ArrayConstructorInvokeNode instance |
-        this = instance.getArgument(0) and
-        instance.getNumArgument() = 1
-      |
-        exists(instance.getAMethodCall(["map", "fill", "join", "toString"])) or
-        instance.flowsToExpr(any(AddExpr p).getAnOperand())
-      )
-    }
-
-    override string getProblemDescription() {
-      result = "This creates an array with a user-controlled length"
-    }
-  }
-
   /**
    * A node that determines the repetitions of a string, considered as a data flow sink for resource exhaustion vulnerabilities.
    */
@@ -159,8 +59,6 @@ module ResourceExhaustion {
       )
     }
 
-    override DataFlow::FlowLabel getAFlowLabel() { any() }
-
     override string getProblemDescription() {
       result = "This creates a string with a user-controlled length"
     }
@@ -175,8 +73,6 @@ module ResourceExhaustion {
       this = LodashUnderscore::member(["delay", "throttle", "debounce"]).getACall().getArgument(1)
     }
 
-    override DataFlow::FlowLabel getAFlowLabel() { any() }
-
     override string getProblemDescription() {
       result = "This creates a timer with a user-controlled duration"
     }
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected b/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected
index 0260567be53..e3bb6853d19 100644
--- a/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected
@@ -1,24 +1,4 @@
 nodes
-| documentation_examples/ResourceExhaustion_array.js:5:6:5:57 | size |
-| documentation_examples/ResourceExhaustion_array.js:5:13:5:57 | parseIn ... y.size) |
-| documentation_examples/ResourceExhaustion_array.js:5:22:5:45 | url.par ... , true) |
-| documentation_examples/ResourceExhaustion_array.js:5:22:5:51 | url.par ... ).query |
-| documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size |
-| documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size |
-| documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url |
-| documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url |
-| documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size |
-| documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size |
-| documentation_examples/ResourceExhaustion_buffer.js:5:6:5:57 | size |
-| documentation_examples/ResourceExhaustion_buffer.js:5:13:5:57 | parseIn ... y.size) |
-| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:45 | url.par ... , true) |
-| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:51 | url.par ... ).query |
-| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size |
-| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size |
-| documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url |
-| documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url |
-| documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size |
-| documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size |
 | documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay |
 | documentation_examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) |
 | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
@@ -28,99 +8,28 @@ nodes
 | documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url |
 | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
 | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
-| resource-exhaustion.js:5:7:5:42 | s |
-| resource-exhaustion.js:5:11:5:34 | url.par ... , true) |
-| resource-exhaustion.js:5:11:5:40 | url.par ... ).query |
-| resource-exhaustion.js:5:11:5:42 | url.par ... query.s |
-| resource-exhaustion.js:5:21:5:27 | req.url |
-| resource-exhaustion.js:5:21:5:27 | req.url |
-| resource-exhaustion.js:6:7:6:21 | n |
-| resource-exhaustion.js:6:11:6:21 | parseInt(s) |
-| resource-exhaustion.js:6:20:6:20 | s |
-| resource-exhaustion.js:12:21:12:21 | n |
-| resource-exhaustion.js:12:21:12:21 | n |
-| resource-exhaustion.js:13:21:13:21 | n |
-| resource-exhaustion.js:13:21:13:21 | n |
-| resource-exhaustion.js:14:16:14:16 | n |
-| resource-exhaustion.js:14:16:14:16 | n |
-| resource-exhaustion.js:15:22:15:22 | n |
-| resource-exhaustion.js:15:22:15:22 | n |
-| resource-exhaustion.js:16:26:16:26 | n |
-| resource-exhaustion.js:16:26:16:26 | n |
-| resource-exhaustion.js:18:14:18:14 | n |
-| resource-exhaustion.js:18:14:18:14 | n |
-| resource-exhaustion.js:20:20:20:20 | n |
-| resource-exhaustion.js:20:20:20:20 | n |
-| resource-exhaustion.js:22:18:22:18 | n |
-| resource-exhaustion.js:22:18:22:18 | n |
-| resource-exhaustion.js:27:9:27:9 | n |
-| resource-exhaustion.js:27:9:27:9 | n |
-| resource-exhaustion.js:28:13:28:13 | n |
-| resource-exhaustion.js:28:13:28:13 | n |
-| resource-exhaustion.js:29:9:29:9 | n |
-| resource-exhaustion.js:29:9:29:9 | n |
-| resource-exhaustion.js:30:9:30:9 | n |
-| resource-exhaustion.js:30:9:30:9 | n |
-| resource-exhaustion.js:31:9:31:9 | n |
-| resource-exhaustion.js:31:9:31:9 | n |
-| resource-exhaustion.js:32:9:32:9 | n |
-| resource-exhaustion.js:32:9:32:9 | n |
-| resource-exhaustion.js:34:12:34:12 | n |
-| resource-exhaustion.js:34:12:34:12 | n |
-| resource-exhaustion.js:35:12:35:12 | s |
-| resource-exhaustion.js:35:12:35:12 | s |
-| resource-exhaustion.js:37:14:37:14 | n |
-| resource-exhaustion.js:37:14:37:18 | n * x |
-| resource-exhaustion.js:37:14:37:18 | n * x |
-| resource-exhaustion.js:45:14:45:25 | Math.ceil(s) |
-| resource-exhaustion.js:45:14:45:25 | Math.ceil(s) |
-| resource-exhaustion.js:45:24:45:24 | s |
-| resource-exhaustion.js:46:14:46:22 | Number(s) |
-| resource-exhaustion.js:46:14:46:22 | Number(s) |
-| resource-exhaustion.js:46:21:46:21 | s |
-| resource-exhaustion.js:50:14:50:14 | s |
-| resource-exhaustion.js:50:14:50:21 | s.length |
-| resource-exhaustion.js:50:14:50:21 | s.length |
-| resource-exhaustion.js:55:16:55:16 | n |
-| resource-exhaustion.js:55:16:55:16 | n |
-| resource-exhaustion.js:58:7:58:20 | ns |
-| resource-exhaustion.js:58:12:58:20 | x ? n : s |
-| resource-exhaustion.js:58:16:58:16 | n |
-| resource-exhaustion.js:59:14:59:15 | ns |
-| resource-exhaustion.js:59:14:59:15 | ns |
-| resource-exhaustion.js:66:16:66:16 | n |
-| resource-exhaustion.js:66:16:66:16 | n |
-| resource-exhaustion.js:70:16:70:16 | n |
-| resource-exhaustion.js:70:16:70:16 | n |
-| resource-exhaustion.js:81:17:81:17 | n |
-| resource-exhaustion.js:81:17:81:17 | n |
-| resource-exhaustion.js:82:17:82:17 | s |
-| resource-exhaustion.js:82:17:82:17 | s |
-| resource-exhaustion.js:83:18:83:18 | n |
-| resource-exhaustion.js:83:18:83:18 | n |
-| resource-exhaustion.js:84:18:84:18 | s |
-| resource-exhaustion.js:84:18:84:18 | s |
+| resource-exhaustion.js:9:7:9:42 | s |
+| resource-exhaustion.js:9:11:9:34 | url.par ... , true) |
+| resource-exhaustion.js:9:11:9:40 | url.par ... ).query |
+| resource-exhaustion.js:9:11:9:42 | url.par ... query.s |
+| resource-exhaustion.js:9:21:9:27 | req.url |
+| resource-exhaustion.js:9:21:9:27 | req.url |
+| resource-exhaustion.js:10:7:10:21 | n |
+| resource-exhaustion.js:10:11:10:21 | parseInt(s) |
+| resource-exhaustion.js:10:20:10:20 | s |
+| resource-exhaustion.js:38:12:38:12 | n |
+| resource-exhaustion.js:38:12:38:12 | n |
+| resource-exhaustion.js:39:12:39:12 | s |
+| resource-exhaustion.js:39:12:39:12 | s |
+| resource-exhaustion.js:85:17:85:17 | n |
+| resource-exhaustion.js:85:17:85:17 | n |
+| resource-exhaustion.js:86:17:86:17 | s |
+| resource-exhaustion.js:86:17:86:17 | s |
+| resource-exhaustion.js:87:18:87:18 | n |
+| resource-exhaustion.js:87:18:87:18 | n |
+| resource-exhaustion.js:88:18:88:18 | s |
+| resource-exhaustion.js:88:18:88:18 | s |
 edges
-| documentation_examples/ResourceExhaustion_array.js:5:6:5:57 | size | documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size |
-| documentation_examples/ResourceExhaustion_array.js:5:6:5:57 | size | documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size |
-| documentation_examples/ResourceExhaustion_array.js:5:13:5:57 | parseIn ... y.size) | documentation_examples/ResourceExhaustion_array.js:5:6:5:57 | size |
-| documentation_examples/ResourceExhaustion_array.js:5:22:5:45 | url.par ... , true) | documentation_examples/ResourceExhaustion_array.js:5:22:5:51 | url.par ... ).query |
-| documentation_examples/ResourceExhaustion_array.js:5:22:5:51 | url.par ... ).query | documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size |
-| documentation_examples/ResourceExhaustion_array.js:5:22:5:51 | url.par ... ).query | documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size |
-| documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size | documentation_examples/ResourceExhaustion_array.js:5:13:5:57 | parseIn ... y.size) |
-| documentation_examples/ResourceExhaustion_array.js:5:22:5:56 | url.par ... ry.size | documentation_examples/ResourceExhaustion_array.js:5:13:5:57 | parseIn ... y.size) |
-| documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_array.js:5:22:5:45 | url.par ... , true) |
-| documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_array.js:5:22:5:45 | url.par ... , true) |
-| documentation_examples/ResourceExhaustion_buffer.js:5:6:5:57 | size | documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size |
-| documentation_examples/ResourceExhaustion_buffer.js:5:6:5:57 | size | documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size |
-| documentation_examples/ResourceExhaustion_buffer.js:5:13:5:57 | parseIn ... y.size) | documentation_examples/ResourceExhaustion_buffer.js:5:6:5:57 | size |
-| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:45 | url.par ... , true) | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:51 | url.par ... ).query |
-| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:51 | url.par ... ).query | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size |
-| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:51 | url.par ... ).query | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size |
-| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size | documentation_examples/ResourceExhaustion_buffer.js:5:13:5:57 | parseIn ... y.size) |
-| documentation_examples/ResourceExhaustion_buffer.js:5:22:5:56 | url.par ... ry.size | documentation_examples/ResourceExhaustion_buffer.js:5:13:5:57 | parseIn ... y.size) |
-| documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:45 | url.par ... , true) |
-| documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_buffer.js:5:22:5:45 | url.par ... , true) |
 | documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
 | documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
 | documentation_examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) | documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay |
@@ -129,106 +38,31 @@ edges
 | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay | documentation_examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) |
 | documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
 | documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:6:20:6:20 | s |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:35:12:35:12 | s |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:35:12:35:12 | s |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:45:24:45:24 | s |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:46:21:46:21 | s |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:50:14:50:14 | s |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:82:17:82:17 | s |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:82:17:82:17 | s |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:84:18:84:18 | s |
-| resource-exhaustion.js:5:7:5:42 | s | resource-exhaustion.js:84:18:84:18 | s |
-| resource-exhaustion.js:5:11:5:34 | url.par ... , true) | resource-exhaustion.js:5:11:5:40 | url.par ... ).query |
-| resource-exhaustion.js:5:11:5:40 | url.par ... ).query | resource-exhaustion.js:5:11:5:42 | url.par ... query.s |
-| resource-exhaustion.js:5:11:5:42 | url.par ... query.s | resource-exhaustion.js:5:7:5:42 | s |
-| resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:5:11:5:34 | url.par ... , true) |
-| resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:5:11:5:34 | url.par ... , true) |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:12:21:12:21 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:12:21:12:21 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:13:21:13:21 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:13:21:13:21 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:14:16:14:16 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:14:16:14:16 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:15:22:15:22 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:15:22:15:22 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:16:26:16:26 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:16:26:16:26 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:18:14:18:14 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:18:14:18:14 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:20:20:20:20 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:20:20:20:20 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:22:18:22:18 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:22:18:22:18 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:27:9:27:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:27:9:27:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:28:13:28:13 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:28:13:28:13 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:29:9:29:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:29:9:29:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:30:9:30:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:30:9:30:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:31:9:31:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:31:9:31:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:32:9:32:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:32:9:32:9 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:34:12:34:12 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:34:12:34:12 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:37:14:37:14 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:55:16:55:16 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:55:16:55:16 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:58:16:58:16 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:66:16:66:16 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:66:16:66:16 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:70:16:70:16 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:70:16:70:16 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:81:17:81:17 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:81:17:81:17 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:83:18:83:18 | n |
-| resource-exhaustion.js:6:7:6:21 | n | resource-exhaustion.js:83:18:83:18 | n |
-| resource-exhaustion.js:6:11:6:21 | parseInt(s) | resource-exhaustion.js:6:7:6:21 | n |
-| resource-exhaustion.js:6:20:6:20 | s | resource-exhaustion.js:6:11:6:21 | parseInt(s) |
-| resource-exhaustion.js:37:14:37:14 | n | resource-exhaustion.js:37:14:37:18 | n * x |
-| resource-exhaustion.js:37:14:37:14 | n | resource-exhaustion.js:37:14:37:18 | n * x |
-| resource-exhaustion.js:45:24:45:24 | s | resource-exhaustion.js:45:14:45:25 | Math.ceil(s) |
-| resource-exhaustion.js:45:24:45:24 | s | resource-exhaustion.js:45:14:45:25 | Math.ceil(s) |
-| resource-exhaustion.js:46:21:46:21 | s | resource-exhaustion.js:46:14:46:22 | Number(s) |
-| resource-exhaustion.js:46:21:46:21 | s | resource-exhaustion.js:46:14:46:22 | Number(s) |
-| resource-exhaustion.js:50:14:50:14 | s | resource-exhaustion.js:50:14:50:21 | s.length |
-| resource-exhaustion.js:50:14:50:14 | s | resource-exhaustion.js:50:14:50:21 | s.length |
-| resource-exhaustion.js:58:7:58:20 | ns | resource-exhaustion.js:59:14:59:15 | ns |
-| resource-exhaustion.js:58:7:58:20 | ns | resource-exhaustion.js:59:14:59:15 | ns |
-| resource-exhaustion.js:58:12:58:20 | x ? n : s | resource-exhaustion.js:58:7:58:20 | ns |
-| resource-exhaustion.js:58:16:58:16 | n | resource-exhaustion.js:58:12:58:20 | x ? n : s |
+| resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:10:20:10:20 | s |
+| resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:39:12:39:12 | s |
+| resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:39:12:39:12 | s |
+| resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:86:17:86:17 | s |
+| resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:86:17:86:17 | s |
+| resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:88:18:88:18 | s |
+| resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:88:18:88:18 | s |
+| resource-exhaustion.js:9:11:9:34 | url.par ... , true) | resource-exhaustion.js:9:11:9:40 | url.par ... ).query |
+| resource-exhaustion.js:9:11:9:40 | url.par ... ).query | resource-exhaustion.js:9:11:9:42 | url.par ... query.s |
+| resource-exhaustion.js:9:11:9:42 | url.par ... query.s | resource-exhaustion.js:9:7:9:42 | s |
+| resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:9:11:9:34 | url.par ... , true) |
+| resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:9:11:9:34 | url.par ... , true) |
+| resource-exhaustion.js:10:7:10:21 | n | resource-exhaustion.js:38:12:38:12 | n |
+| resource-exhaustion.js:10:7:10:21 | n | resource-exhaustion.js:38:12:38:12 | n |
+| resource-exhaustion.js:10:7:10:21 | n | resource-exhaustion.js:85:17:85:17 | n |
+| resource-exhaustion.js:10:7:10:21 | n | resource-exhaustion.js:85:17:85:17 | n |
+| resource-exhaustion.js:10:7:10:21 | n | resource-exhaustion.js:87:18:87:18 | n |
+| resource-exhaustion.js:10:7:10:21 | n | resource-exhaustion.js:87:18:87:18 | n |
+| resource-exhaustion.js:10:11:10:21 | parseInt(s) | resource-exhaustion.js:10:7:10:21 | n |
+| resource-exhaustion.js:10:20:10:20 | s | resource-exhaustion.js:10:11:10:21 | parseInt(s) |
 #select
-| documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size | documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_array.js:7:23:7:26 | size | This creates an array with a user-controlled length from $@. | documentation_examples/ResourceExhaustion_array.js:5:32:5:38 | req.url | here |
-| documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size | documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url | documentation_examples/ResourceExhaustion_buffer.js:7:28:7:31 | size | This creates a buffer with a user-controlled size from $@. | documentation_examples/ResourceExhaustion_buffer.js:5:32:5:38 | req.url | here |
 | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay | documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay | This creates a timer with a user-controlled duration from $@. | documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | here |
-| resource-exhaustion.js:12:21:12:21 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:12:21:12:21 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:13:21:13:21 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:13:21:13:21 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:14:16:14:16 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:14:16:14:16 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:15:22:15:22 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:15:22:15:22 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:16:26:16:26 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:16:26:16:26 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:18:14:18:14 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:18:14:18:14 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:20:20:20:20 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:20:20:20:20 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:22:18:22:18 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:22:18:22:18 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:27:9:27:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:27:9:27:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:28:13:28:13 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:28:13:28:13 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:29:9:29:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:29:9:29:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:30:9:30:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:30:9:30:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:31:9:31:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:31:9:31:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:32:9:32:9 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:32:9:32:9 | n | This creates an array with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:34:12:34:12 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:34:12:34:12 | n | This creates a string with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:35:12:35:12 | s | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:35:12:35:12 | s | This creates a string with a user-controlled length from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:37:14:37:18 | n * x | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:37:14:37:18 | n * x | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:45:14:45:25 | Math.ceil(s) | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:45:14:45:25 | Math.ceil(s) | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:46:14:46:22 | Number(s) | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:46:14:46:22 | Number(s) | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:50:14:50:21 | s.length | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:50:14:50:21 | s.length | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:55:16:55:16 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:55:16:55:16 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:59:14:59:15 | ns | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:59:14:59:15 | ns | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:66:16:66:16 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:66:16:66:16 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:70:16:70:16 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:70:16:70:16 | n | This creates a buffer with a user-controlled size from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:81:17:81:17 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:81:17:81:17 | n | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:82:17:82:17 | s | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:82:17:82:17 | s | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:83:18:83:18 | n | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:83:18:83:18 | n | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
-| resource-exhaustion.js:84:18:84:18 | s | resource-exhaustion.js:5:21:5:27 | req.url | resource-exhaustion.js:84:18:84:18 | s | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:5:21:5:27 | req.url | here |
+| resource-exhaustion.js:38:12:38:12 | n | resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:38:12:38:12 | n | This creates a string with a user-controlled length from $@. | resource-exhaustion.js:9:21:9:27 | req.url | here |
+| resource-exhaustion.js:39:12:39:12 | s | resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:39:12:39:12 | s | This creates a string with a user-controlled length from $@. | resource-exhaustion.js:9:21:9:27 | req.url | here |
+| resource-exhaustion.js:85:17:85:17 | n | resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:85:17:85:17 | n | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:9:21:9:27 | req.url | here |
+| resource-exhaustion.js:86:17:86:17 | s | resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:86:17:86:17 | s | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:9:21:9:27 | req.url | here |
+| resource-exhaustion.js:87:18:87:18 | n | resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:87:18:87:18 | n | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:9:21:9:27 | req.url | here |
+| resource-exhaustion.js:88:18:88:18 | s | resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:88:18:88:18 | s | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:9:21:9:27 | req.url | here |
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array.js
deleted file mode 100644
index 2fad9da5d93..00000000000
--- a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array.js
+++ /dev/null
@@ -1,10 +0,0 @@
-var http = require("http"),
-    url = require("url");
-
-var server = http.createServer(function(req, res) {
-	var size = parseInt(url.parse(req.url, true).query.size);
-
-	let dogs = new Array(size).fill(x => "dog"); // BAD
-
-	// ... use the dog
-});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array_fixed.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array_fixed.js
deleted file mode 100644
index f7c88129264..00000000000
--- a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_array_fixed.js
+++ /dev/null
@@ -1,16 +0,0 @@
-var http = require("http"),
-    url = require("url");
-
-var server = http.createServer(function(req, res) {
-	var size = parseInt(url.parse(req.url, true).query.size);
-
-	if (size > 1024) {
-		res.statusCode = 400;
-		res.end("Bad request.");
-		return;
-	}
-
-	let dogs = new Array(size).fill(x => "dog"); // GOOD
-
-	// ... use the dogs
-});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer.js
deleted file mode 100644
index d821901e818..00000000000
--- a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer.js
+++ /dev/null
@@ -1,10 +0,0 @@
-var http = require("http"),
-    url = require("url");
-
-var server = http.createServer(function(req, res) {
-	var size = parseInt(url.parse(req.url, true).query.size);
-
-	let buffer = Buffer.alloc(size); // BAD
-
-	// ... use the buffer
-});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer_fixed.js b/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer_fixed.js
deleted file mode 100644
index 8d9f9b0839f..00000000000
--- a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_buffer_fixed.js
+++ /dev/null
@@ -1,16 +0,0 @@
-var http = require("http"),
-    url = require("url");
-
-var server = http.createServer(function(req, res) {
-	var size = parseInt(url.parse(req.url, true).query.size);
-
-	if (size > 1024) {
-		res.statusCode = 400;
-		res.end("Bad request.");
-		return;
-	}
-
-	let buffer = Buffer.alloc(size); // GOOD
-
-	// ... use the buffer
-});
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js b/javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js
index 1500fe15b87..1815fdb30e9 100644
--- a/javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js
+++ b/javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js
@@ -1,3 +1,7 @@
+// this file contains many `NOT OK [INCONSISTENCY]` annotations, those
+// would be resolved if the query used flow labels to recognice
+// numbers flowing to sinks
+
 var http = require("http"),
     url = require("url");
 
@@ -9,32 +13,32 @@ var server = http.createServer(function(req, res) {
   Buffer.from(n); // OK
   Buffer.from(x, n); // OK
   Buffer.from(x, y, s); // NOT OK
-  Buffer.from(x, y, n); // NOT OK
-  Buffer.from(x, y, n); // NOT OK
-  Buffer.alloc(n); // NOT OK
-  Buffer.allocUnsafe(n); // NOT OK
-  Buffer.allocUnsafeSlow(n); // NOT OK
+  Buffer.from(x, y, n); // NOT OK [INCONSISTENCY]
+  Buffer.from(x, y, n); // NOT OK [INCONSISTENCY]
+  Buffer.alloc(n); // NOT OK [INCONSISTENCY]
+  Buffer.allocUnsafe(n); // NOT OK [INCONSISTENCY]
+  Buffer.allocUnsafeSlow(n); // NOT OK [INCONSISTENCY]
 
-  new Buffer(n); // NOT OK
+  new Buffer(n); // NOT OK [INCONSISTENCY]
   new Buffer(x, n); // OK
-  new Buffer(x, y, n); // NOT OK
+  new Buffer(x, y, n); // NOT OK [INCONSISTENCY]
 
-  new SlowBuffer(n); // NOT OK
+  new SlowBuffer(n); // NOT OK [INCONSISTENCY]
 
   Array(n); // OK
   new Array(n); // OK
 
-  Array(n).map(); // NOT OK
-  new Array(n).map(); // NOT OK
-  Array(n).fill(); // NOT OK
-  Array(n).join(); // NOT OK
-  Array(n).toString(); // NOT OK
-  Array(n) + x; // NOT OK
+  Array(n).map(); // NOT OK [INCONSISTENCY]
+  new Array(n).map(); // NOT OK [INCONSISTENCY]
+  Array(n).fill(); // NOT OK [INCONSISTENCY]
+  Array(n).join(); // NOT OK [INCONSISTENCY]
+  Array(n).toString(); // NOT OK [INCONSISTENCY]
+  Array(n) + x; // NOT OK [INCONSISTENCY]
 
   x.repeat(n); // NOT OK
   x.repeat(s); // NOT OK
 
-  new Buffer(n * x); // NOT OK
+  new Buffer(n * x); // NOT OK [INCONSISTENCY]
   new Buffer(n + n); // NOT OK [INCONSISTENCY]
   new Buffer(n + x); // OK (maybe)
   new Buffer(n + s); // OK (this is  a string if `s` is a string)
@@ -42,32 +46,32 @@ var server = http.createServer(function(req, res) {
   new Buffer(s + s); // OK
   new Buffer(n + "X"); // OK
 
-  new Buffer(Math.ceil(s)); // NOT OK
-  new Buffer(Number(s)); // NOT OK
+  new Buffer(Math.ceil(s)); // NOT OK [INCONSISTENCY]
+  new Buffer(Number(s)); // NOT OK [INCONSISTENCY]
   new Buffer(new Number(s)); // OK
 
   new Buffer(s + x.length); // OK (this is a string if `s` is a string)
-  new Buffer(s.length); // NOT OK
+  new Buffer(s.length); // NOT OK [INCONSISTENCY]
 
   if (n < 100) {
     new Buffer(n); // OK
   } else {
-    new Buffer(n); // NOT OK
+    new Buffer(n); // NOT OK [INCONSISTENCY]
   }
 
   let ns = x ? n : s;
-  new Buffer(ns); // NOT OK
+  new Buffer(ns); // NOT OK [INCONSISTENCY]
 
   new Buffer(n.toString()); // OK
 
   if (typeof n === "string") {
     new Buffer(n); // OK
   } else {
-    new Buffer(n); // NOT OK
+    new Buffer(n); // NOT OK [INCONSISTENCY]
   }
 
   if (typeof n === "number") {
-    new Buffer(n); // NOT OK
+    new Buffer(n); // NOT OK [INCONSISTENCY]
   } else {
     new Buffer(n); // OK
   }

From 2ba7ed49400b91f768e21c28d86bf53f2c2e65ea Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 12 Jan 2021 13:32:43 +0100
Subject: [PATCH 074/343] Python: Add note about future work for
 getARequestHandler

---
 python/ql/src/semmle/python/Concepts.qll | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/semmle/python/Concepts.qll b/python/ql/src/semmle/python/Concepts.qll
index 6eda29e6c51..a79eaa2dc55 100644
--- a/python/ql/src/semmle/python/Concepts.qll
+++ b/python/ql/src/semmle/python/Concepts.qll
@@ -313,7 +313,11 @@ module HTTP {
       /** Gets the URL pattern for this route, if it can be statically determined. */
       string getUrlPattern() { result = range.getUrlPattern() }
 
-      /** Gets a function that will handle incoming requests for this route, if any. */
+      /**
+       * Gets a function that will handle incoming requests for this route, if any.
+       *
+       * NOTE: This will be modified in the near future to have a `RequestHandler` result, instead of a `Function`.
+       */
       Function getARequestHandler() { result = range.getARequestHandler() }
 
       /**
@@ -343,7 +347,11 @@ module HTTP {
           )
         }
 
-        /** Gets a function that will handle incoming requests for this route, if any. */
+        /**
+         * Gets a function that will handle incoming requests for this route, if any.
+         *
+         * NOTE: This will be modified in the near future to have a `RequestHandler` result, instead of a `Function`.
+         */
         abstract Function getARequestHandler();
 
         /**

From 3f09a047ae10e96cc29f50a8154256fa784a9c7f Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 12 Jan 2021 14:52:11 +0000
Subject: [PATCH 075/343] C++: Test comments.

---
 .../dataflow/taint-tests/constructor_delegation.cpp    | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/constructor_delegation.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/constructor_delegation.cpp
index 3ee388347a6..d1acc67f81f 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/constructor_delegation.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/constructor_delegation.cpp
@@ -5,10 +5,10 @@ void sink(...);
 class MyValue
 {
 public:
-	MyValue(int _x) : x(_x) {}; // taint flows directly from _x to x
-	MyValue(int _x, bool ex) : MyValue(_x) {}; // taint flows indirectly from _x to x
-	MyValue(int _x, int _y) : MyValue(_x + _y) {}; // taint flows indirectly from _x to x
-	MyValue(int _x, bool ex1, bool ex2) : MyValue(0) {}; // taint doesn't flow to _x
+	MyValue(int _x) : x(_x) {}; // taint flows from parameter `_x` to member variable `x`
+	MyValue(int _x, bool ex) : MyValue(_x) {}; // taint flows from parameter `_x` to member variable `x`
+	MyValue(int _x, int _y) : MyValue(_x + _y) {}; // taint flows from parameters `_x` and `_y` to member variable `x`
+	MyValue(int _x, bool ex1, bool ex2) : MyValue(0) {}; // taint doesn't flow from parameter `_x`
 
 	int x;
 };
@@ -16,7 +16,7 @@ public:
 class MyDerivedValue : public MyValue
 {
 public:
-	MyDerivedValue(bool ex, int _x) : MyValue(_x) {}; // taint flows indirectly from _x to x
+	MyDerivedValue(bool ex, int _x) : MyValue(_x) {}; // taint flows from parameter `_x` to member variable `x`
 };
 
 void test_inits()

From eaee5c2d8733a90aade4abb5d766ae71002ddaff Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 12 Jan 2021 14:04:55 +0100
Subject: [PATCH 076/343] add library input as source for `js/polynomial-redos`

---
 .../ql/src/Performance/PolynomialReDoS.ql     |  3 +-
 .../PolynomialReDoSCustomizations.qll         | 31 +++++++++++++++++--
 .../ReDoS/PolynomialBackTracking.expected     |  1 +
 .../ReDoS/PolynomialReDoS.expected            |  9 ++++++
 .../query-tests/Performance/ReDoS/lib/lib.js  |  5 +++
 .../Performance/ReDoS/package.json            |  5 +++
 6 files changed, 51 insertions(+), 3 deletions(-)
 create mode 100644 javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js
 create mode 100644 javascript/ql/test/query-tests/Performance/ReDoS/package.json

diff --git a/javascript/ql/src/Performance/PolynomialReDoS.ql b/javascript/ql/src/Performance/PolynomialReDoS.ql
index f77a312ed9c..393faef10dd 100644
--- a/javascript/ql/src/Performance/PolynomialReDoS.ql
+++ b/javascript/ql/src/Performance/PolynomialReDoS.ql
@@ -25,4 +25,5 @@ where
     sink.getNode().(Sink).getRegExp().(PolynomialBackTrackingTerm).isAtEndLine()
   )
 select sink.getNode(), source, sink, "This expensive $@ use depends on $@.",
-  sink.getNode().(Sink).getRegExp(), "regular expression", source.getNode(), "a user-provided value"
+  sink.getNode().(Sink).getRegExp(), "regular expression", source.getNode(),
+  source.getNode().(Source).describe()
diff --git a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
index 3392342db6b..bcd267d8487 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
@@ -13,10 +13,17 @@ module PolynomialReDoS {
    */
   abstract class Source extends DataFlow::Node {
     /**
-     * Gets the kind of source that is being accesed. See `HTTP::RequestInputAccess::getKind()`.
-     * Can be one of "parameter", "header", "body", "url", "cookie".
+     * Gets the kind of source that is being accesed.
+     *
+     * Is either a kind from `HTTP::RequestInputAccess::getKind()`, or "library".
      */
     abstract string getKind();
+
+    /**
+     * Gets a string that describes the source.
+     * For use in the alert message
+     */
+    string describe() { result = "a user-provided value" }
   }
 
   /**
@@ -108,4 +115,24 @@ module PolynomialReDoS {
       e = input.asExpr()
     }
   }
+
+  private import semmle.javascript.PackageExports as Exports
+
+  /**
+   * A parameter of an exported function, seen as a source for polynomial-redos.
+   */
+  class ExternalInputSource extends Source, DataFlow::ParameterNode {
+    ExternalInputSource() {
+      exists(int bound, DataFlow::FunctionNode func |
+        func =
+          Exports::getAValueExportedBy(Exports::getTopmostPackageJSON())
+              .getABoundFunctionValue(bound) and
+        this = func.getParameter(any(int arg | arg >= bound))
+      )
+    }
+
+    override string getKind() { result = "library" }
+
+    override string describe() { result = "library input" }
+  }
 }
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
index ee861fb16d8..c351f3f902e 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
@@ -24,6 +24,7 @@
 | highlight.js:38:54:38:59 | [^()]* | Strings starting with 'A((' and with many repetitions of ''' can start matching anywhere after the start of the preceeding [^()]* |
 | highlight.js:38:64:38:69 | [^()]* | Strings starting with 'A(' and with many repetitions of ''' can start matching anywhere after the start of the preceeding [^()]* |
 | highlight.js:39:22:39:24 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding [a-zA-Z_]\\w*\\([^()]*(\\([^()]*(\\([^()]*\\)[^()]*)*\\)[^()]*)*\\)\\s*\\{ |
+| lib/lib.js:1:15:1:16 | a* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding a*b |
 | polynomial-redos.js:7:24:7:26 | \\s+ | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s+$ |
 | polynomial-redos.js:8:17:8:18 |  * | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding  *, * |
 | polynomial-redos.js:9:19:9:21 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s*\\n\\s* |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
index 70e4720bcfe..71990d6b919 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
@@ -1,4 +1,8 @@
 nodes
+| lib/lib.js:3:28:3:31 | name |
+| lib/lib.js:3:28:3:31 | name |
+| lib/lib.js:4:14:4:17 | name |
+| lib/lib.js:4:14:4:17 | name |
 | polynomial-redos.js:5:6:5:32 | tainted |
 | polynomial-redos.js:5:16:5:32 | req.query.tainted |
 | polynomial-redos.js:5:16:5:32 | req.query.tainted |
@@ -135,6 +139,10 @@ nodes
 | polynomial-redos.js:118:2:118:8 | tainted |
 | polynomial-redos.js:118:2:118:8 | tainted |
 edges
+| lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
+| lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
+| lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
+| lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
 | polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:7:2:7:8 | tainted |
 | polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:7:2:7:8 | tainted |
 | polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:8:2:8:8 | tainted |
@@ -266,6 +274,7 @@ edges
 | polynomial-redos.js:68:18:68:24 | req.url | polynomial-redos.js:68:18:68:24 | req.url |
 | polynomial-redos.js:69:18:69:25 | req.body | polynomial-redos.js:69:18:69:25 | req.body |
 #select
+| lib/lib.js:4:14:4:17 | name | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name | This expensive $@ use depends on $@. | lib/lib.js:1:15:1:16 | a* | regular expression | lib/lib.js:3:28:3:31 | name | library input |
 | polynomial-redos.js:7:2:7:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:7:2:7:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:7:24:7:26 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
 | polynomial-redos.js:8:2:8:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:8:2:8:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:8:17:8:18 |  * | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
 | polynomial-redos.js:9:2:9:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:9:2:9:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:9:19:9:21 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js b/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js
new file mode 100644
index 00000000000..23ba27a32c2
--- /dev/null
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js
@@ -0,0 +1,5 @@
+var regexp = /a*b/;
+
+module.exports = function (name) {
+	regexp.test(name); // NOT OK
+};
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/package.json b/javascript/ql/test/query-tests/Performance/ReDoS/package.json
new file mode 100644
index 00000000000..27e480ea5c1
--- /dev/null
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "myLib",
+  "version": "0.0.7",
+  "main": "./lib/lib.js"
+}
\ No newline at end of file

From 0a17b0465050282074b01e8ba497c245607f1e76 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 12 Jan 2021 14:08:10 +0100
Subject: [PATCH 077/343] refactor copy-pasted code into
 `getAnLibraryInputParameter`

---
 javascript/ql/src/semmle/javascript/PackageExports.qll | 10 ++++++++++
 .../UnsafeShellCommandConstructionCustomizations.qll   |  7 +------
 .../performance/PolynomialReDoSCustomizations.qll      |  9 +--------
 3 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/PackageExports.qll b/javascript/ql/src/semmle/javascript/PackageExports.qll
index 545e2743eee..1ec89dfa08b 100644
--- a/javascript/ql/src/semmle/javascript/PackageExports.qll
+++ b/javascript/ql/src/semmle/javascript/PackageExports.qll
@@ -6,6 +6,16 @@
 
 import javascript
 
+/**
+ * Gets a parameter that is a library input to a top-level package.
+ */
+DataFlow::ParameterNode getAnLibraryInputParameter() {
+  exists(int bound, DataFlow::FunctionNode func |
+    func = getAValueExportedBy(getTopmostPackageJSON()).getABoundFunctionValue(bound) and
+    result = func.getParameter(any(int arg | arg >= bound))
+  )
+}
+
 /**
  * Gets the number of occurrences of "/" in `path`.
  */
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
index 589efa25c30..6ae79b723ea 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
@@ -52,12 +52,7 @@ module UnsafeShellCommandConstruction {
    */
   class ExternalInputSource extends Source, DataFlow::ParameterNode {
     ExternalInputSource() {
-      exists(int bound, DataFlow::FunctionNode func |
-        func =
-          Exports::getAValueExportedBy(Exports::getTopmostPackageJSON())
-              .getABoundFunctionValue(bound) and
-        this = func.getParameter(any(int arg | arg >= bound))
-      ) and
+      this = Exports::getAnLibraryInputParameter() and
       not this.getName() = ["cmd", "command"] // looks to be on purpose.
     }
   }
diff --git a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
index bcd267d8487..0645589a5e6 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
@@ -122,14 +122,7 @@ module PolynomialReDoS {
    * A parameter of an exported function, seen as a source for polynomial-redos.
    */
   class ExternalInputSource extends Source, DataFlow::ParameterNode {
-    ExternalInputSource() {
-      exists(int bound, DataFlow::FunctionNode func |
-        func =
-          Exports::getAValueExportedBy(Exports::getTopmostPackageJSON())
-              .getABoundFunctionValue(bound) and
-        this = func.getParameter(any(int arg | arg >= bound))
-      )
-    }
+    ExternalInputSource() { this = Exports::getAnLibraryInputParameter() }
 
     override string getKind() { result = "library" }
 

From d591c519a8062053bbe588e8133b9297aa6cf4da Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Tue, 12 Jan 2021 15:11:52 +0100
Subject: [PATCH 078/343] JS: reformulate js/server-crash as a path problem

---
 .../ql/src/Security/CWE-730/ServerCrash.ql    | 194 ++++++++++++------
 .../Security/CWE-730/ServerCrash.expected     |  54 ++++-
 .../Security/CWE-730/server-crash.js          |   2 +-
 3 files changed, 185 insertions(+), 65 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-730/ServerCrash.ql b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
index 8db7574d6c9..4df31174150 100644
--- a/javascript/ql/src/Security/CWE-730/ServerCrash.ql
+++ b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
@@ -2,7 +2,7 @@
  * @name Server crash
  * @description A server that can be forced to crash may be vulnerable to denial-of-service
  *              attacks.
- * @kind problem
+ * @kind path-problem
  * @problem.severity error
  * @precision high
  * @id js/server-crash
@@ -13,46 +13,7 @@
 import javascript
 
 /**
- * Gets a function that `caller` invokes.
- */
-Function getACallee(Function caller) {
-  exists(DataFlow::InvokeNode invk |
-    invk.getEnclosingFunction() = caller and result = invk.getACallee()
-  )
-}
-
-/**
- * Gets a function that `caller` invokes, excluding calls guarded in `try`-blocks.
- */
-Function getAnUnguardedCallee(Function caller) {
-  exists(DataFlow::InvokeNode invk |
-    invk.getEnclosingFunction() = caller and
-    result = invk.getACallee() and
-    not exists(invk.asExpr().getEnclosingStmt().getEnclosingTryCatchStmt())
-  )
-}
-
-predicate isHeaderValue(HTTP::ExplicitHeaderDefinition def, DataFlow::Node node) {
-  def.definesExplicitly(_, node.asExpr())
-}
-
-class Configuration extends TaintTracking::Configuration {
-  Configuration() { this = "Configuration" }
-
-  override predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node node) {
-    // using control characters in a header value will cause an exception
-    isHeaderValue(_, node)
-  }
-}
-
-predicate isLikelyToThrow(DataFlow::Node crash) {
-  exists(Configuration cfg, DataFlow::Node sink | cfg.hasFlow(_, sink) | isHeaderValue(crash, sink))
-}
-
-/**
- * A call that looks like it is asynchronous.
+ * A call that appears to be asynchronous (heuristic).
  */
 class AsyncCall extends DataFlow::CallNode {
   DataFlow::FunctionNode callback;
@@ -64,37 +25,154 @@ class AsyncCall extends DataFlow::CallNode {
     not exists(callback.getAReturn())
   }
 
+  /**
+   * Gets the callback that is invoked asynchronously.
+   */
   DataFlow::FunctionNode getCallback() { result = callback }
 }
 
+/**
+ * Gets a function that is invoked as a consequence of invoking a route handler `rh`.
+ */
+Function invokedByRouteHandler(HTTP::RouteHandler rh) {
+  rh = result.flow()
+  or
+  // follow the immediate call graph
+  exists(DataFlow::InvokeNode invk |
+    result = invk.getACallee() and
+    invk.getEnclosingFunction() = invokedByRouteHandler(rh)
+  )
+  // if new edges are added here, the `edges` predicate should be updated accordingly
+}
+
+/**
+ * A callback provided to an asynchronous call.
+ */
+class AsyncCallback extends DataFlow::FunctionNode {
+  AsyncCallback() { this = any(AsyncCall c).getCallback() }
+}
+
+/**
+ * Gets a function that is in a call stack that starts at an asynchronous `callback`, calls in the call stack occur outside of `try` blocks.
+ */
+Function inUnguardedAsyncCallStack(AsyncCallback callback) {
+  callback = result.flow()
+  or
+  exists(DataFlow::InvokeNode invk |
+    result = invk.getACallee() and
+    not exists(invk.asExpr().getEnclosingStmt().getEnclosingTryCatchStmt()) and
+    invk.getEnclosingFunction() = inUnguardedAsyncCallStack(callback)
+  )
+}
+
 /**
  * Gets a function that is invoked by `asyncCallback` without any try-block wrapping, `asyncCallback` is in turn is called indirectly by `routeHandler`.
  *
  * If the result throws an excection, the server of `routeHandler` will crash.
  */
 Function getAPotentialServerCrasher(
-  HTTP::RouteHandler routeHandler, DataFlow::FunctionNode asyncCallback
+  HTTP::RouteHandler routeHandler, AsyncCall asyncCall, AsyncCallback asyncCallback
 ) {
-  exists(AsyncCall asyncCall |
-    // the route handler transitively calls an async function
-    asyncCall.getEnclosingFunction() =
-      getACallee*(routeHandler.(DataFlow::FunctionNode).getFunction()) and
-    asyncCallback = asyncCall.getCallback() and
-    // the async function transitively calls a function that may throw an exception out of the the async function
-    result = getAnUnguardedCallee*(asyncCallback.getFunction())
+  // the route handler transitively calls an async function
+  asyncCall.getEnclosingFunction() = invokedByRouteHandler(routeHandler) and
+  asyncCallback = asyncCall.getCallback() and
+  // the async function transitively calls a function that may throw an exception out of the the async function
+  result = inUnguardedAsyncCallStack(asyncCallback)
+}
+
+/**
+ * Gets a node that is likely to throw an uncaught exception in `fun`.
+ */
+LikelyExceptionThrower getALikelyUncaughtExceptionThrower(Function fun) {
+  result.getContainer() = fun and
+  not exists([result.(Expr).getEnclosingStmt(), result.(Stmt)].getEnclosingTryCatchStmt())
+}
+
+/**
+ * Edges that builds an explanatory graph that follows the mental model of how the the exception flows.
+ *
+ * - step 1. exception is thrown
+ * - step 2. exception exits the enclosing function
+ * - step 3. exception follows the call graph backwards until an async callee is encountered
+ * - step 4. (at this point, the program crashes)
+ * - step 5. if the program had not crashed, the exception would conceptually follow the call graph backwards to a route handler
+ */
+query predicate edges(ASTNode pred, ASTNode succ) {
+  nodes(pred) and
+  nodes(succ) and
+  (
+    // the first step from the alert location to the enclosing function
+    pred = getALikelyUncaughtExceptionThrower(_) and
+    succ = pred.getContainer()
+    or
+    // ordinary flow graph
+    exists(DataFlow::InvokeNode invoke, Function f |
+      invoke.getACallee() = f and
+      succ = invoke.getAstNode() and
+      pred = f
+      or
+      invoke.getContainer() = f and
+      succ = f and
+      pred = invoke.getAstNode()
+    )
+    or
+    // the async step
+    exists(DataFlow::Node predNode, DataFlow::Node succNode |
+      exists(getAPotentialServerCrasher(_, predNode, succNode)) and
+      predNode.getAstNode() = succ and
+      succNode.getAstNode() = pred
+    )
   )
 }
 
 /**
- * Gets an AST node that is likely to throw an uncaught exception in `fun`.
+ * Nodes for building an explanatory graph that follows the mental model of how the the exception flows.
  */
-ExprOrStmt getALikelyExceptionThrower(Function fun) {
-  result.getContainer() = fun and
-  not exists([result.(Expr).getEnclosingStmt(), result.(Stmt)].getEnclosingTryCatchStmt()) and
-  (isLikelyToThrow(result.(Expr).flow()) or result instanceof ThrowStmt)
+query predicate nodes(ASTNode node) {
+  exists(HTTP::RouteHandler rh, Function fun |
+    main(rh, _, _) and
+    fun = invokedByRouteHandler(rh)
+  |
+    node = any(DataFlow::InvokeNode invk | invk.getACallee() = fun).getAstNode() or
+    node = fun
+  )
+  or
+  exists(AsyncCallback cb, Function fun |
+    main(_, cb, _) and
+    fun = inUnguardedAsyncCallStack(cb)
+  |
+    node = any(DataFlow::InvokeNode invk | invk.getACallee() = fun).getAstNode() or
+    node = fun
+  )
+  or
+  main(_, _, node)
 }
 
-from HTTP::RouteHandler routeHandler, DataFlow::FunctionNode asyncCallback, ExprOrStmt crasher
-where crasher = getALikelyExceptionThrower(getAPotentialServerCrasher(routeHandler, asyncCallback))
-select crasher, "When an exception is thrown here and later exits $@, the server of $@ will crash.",
-  asyncCallback, "this asynchronous callback", routeHandler, "this route handler"
+predicate main(HTTP::RouteHandler rh, AsyncCallback asyncCallback, ExprOrStmt crasher) {
+  crasher = getALikelyUncaughtExceptionThrower(getAPotentialServerCrasher(rh, _, asyncCallback))
+}
+
+/**
+ * A node that is likely to throw an exception.
+ *
+ * This is the primary extension point for this query.
+ */
+abstract class LikelyExceptionThrower extends ASTNode { }
+
+/**
+ * A `throw` statement.
+ */
+class TrivialThrowStatement extends LikelyExceptionThrower, ThrowStmt { }
+
+/**
+ * Empty class for avoiding emptiness checks from the compiler when there are no Expr-typed instances of the LikelyExceptionThrower type.
+ */
+class CompilerConfusingExceptionThrower extends LikelyExceptionThrower {
+  CompilerConfusingExceptionThrower() { none() }
+}
+
+from HTTP::RouteHandler rh, AsyncCallback asyncCallback, ExprOrStmt crasher
+where main(rh, asyncCallback, crasher)
+select crasher, crasher, rh.getAstNode(),
+  "When an exception is thrown here and later escapes at $@, the server of $@ will crash.",
+  asyncCallback, "this asynchronous callback", rh, "this route handler"
diff --git a/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected b/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected
index b4e8de623a6..acee72436fc 100644
--- a/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected
@@ -1,6 +1,48 @@
-| server-crash.js:7:5:7:14 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:6:28:8:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
-| server-crash.js:11:3:11:11 | throw 42; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:50:28:52:3 | (err, x ... ();\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
-| server-crash.js:16:7:16:16 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:15:30:17:5 | (err, x ... K\\n    } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
-| server-crash.js:28:5:28:14 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:27:28:29:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
-| server-crash.js:33:5:33:14 | throw err; | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:32:28:34:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
-| server-crash.js:41:5:41:48 | res.set ... header) | When an exception is thrown here and later exits $@, the server of $@ will crash. | server-crash.js:40:28:42:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+edges
+| server-crash.js:5:1:9:1 | functio ...   });\\n} | server-crash.js:49:3:49:16 | indirection1() |
+| server-crash.js:7:5:7:14 | throw err; | server-crash.js:6:28:8:3 | (err, x ...  OK\\n  } |
+| server-crash.js:10:1:12:1 | functio ... OT OK\\n} | server-crash.js:51:5:51:18 | indirection2() |
+| server-crash.js:11:3:11:11 | throw 42; | server-crash.js:10:1:12:1 | functio ... OT OK\\n} |
+| server-crash.js:13:1:19:1 | functio ... e) {}\\n} | server-crash.js:54:3:54:16 | indirection3() |
+| server-crash.js:16:7:16:16 | throw err; | server-crash.js:15:30:17:5 | (err, x ... K\\n    } |
+| server-crash.js:20:1:22:1 | functio ... aller\\n} | server-crash.js:56:5:56:18 | indirection4() |
+| server-crash.js:23:1:25:1 | functio ... n6();\\n} | server-crash.js:58:3:58:16 | indirection5() |
+| server-crash.js:24:3:24:16 | indirection6() | server-crash.js:23:1:25:1 | functio ... n6();\\n} |
+| server-crash.js:26:1:30:1 | functio ...   });\\n} | server-crash.js:24:3:24:16 | indirection6() |
+| server-crash.js:28:5:28:14 | throw err; | server-crash.js:27:28:29:3 | (err, x ...  OK\\n  } |
+| server-crash.js:33:5:33:14 | throw err; | server-crash.js:32:28:34:3 | (err, x ...  OK\\n  } |
+| server-crash.js:49:3:49:16 | indirection1() | server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
+| server-crash.js:51:5:51:18 | indirection2() | server-crash.js:50:28:52:3 | (err, x ... ();\\n  } |
+| server-crash.js:54:3:54:16 | indirection3() | server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
+| server-crash.js:56:5:56:18 | indirection4() | server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
+| server-crash.js:58:3:58:16 | indirection5() | server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
+nodes
+| server-crash.js:5:1:9:1 | functio ...   });\\n} |
+| server-crash.js:6:28:8:3 | (err, x ...  OK\\n  } |
+| server-crash.js:7:5:7:14 | throw err; |
+| server-crash.js:10:1:12:1 | functio ... OT OK\\n} |
+| server-crash.js:11:3:11:11 | throw 42; |
+| server-crash.js:13:1:19:1 | functio ... e) {}\\n} |
+| server-crash.js:15:30:17:5 | (err, x ... K\\n    } |
+| server-crash.js:16:7:16:16 | throw err; |
+| server-crash.js:20:1:22:1 | functio ... aller\\n} |
+| server-crash.js:23:1:25:1 | functio ... n6();\\n} |
+| server-crash.js:24:3:24:16 | indirection6() |
+| server-crash.js:26:1:30:1 | functio ...   });\\n} |
+| server-crash.js:27:28:29:3 | (err, x ...  OK\\n  } |
+| server-crash.js:28:5:28:14 | throw err; |
+| server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
+| server-crash.js:32:28:34:3 | (err, x ...  OK\\n  } |
+| server-crash.js:33:5:33:14 | throw err; |
+| server-crash.js:49:3:49:16 | indirection1() |
+| server-crash.js:50:28:52:3 | (err, x ... ();\\n  } |
+| server-crash.js:51:5:51:18 | indirection2() |
+| server-crash.js:54:3:54:16 | indirection3() |
+| server-crash.js:56:5:56:18 | indirection4() |
+| server-crash.js:58:3:58:16 | indirection5() |
+#select
+| server-crash.js:7:5:7:14 | throw err; | server-crash.js:7:5:7:14 | throw err; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:6:28:8:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:11:3:11:11 | throw 42; | server-crash.js:11:3:11:11 | throw 42; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:50:28:52:3 | (err, x ... ();\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:16:7:16:16 | throw err; | server-crash.js:16:7:16:16 | throw err; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:15:30:17:5 | (err, x ... K\\n    } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:28:5:28:14 | throw err; | server-crash.js:28:5:28:14 | throw err; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:27:28:29:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:33:5:33:14 | throw err; | server-crash.js:33:5:33:14 | throw err; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:32:28:34:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
diff --git a/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js b/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
index 96b5fc71187..7b61262ee92 100644
--- a/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
+++ b/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
@@ -38,7 +38,7 @@ app.get("/async-throw", (req, res) => {
     } catch (e) {}
   });
   fs.readFile("/WHATEVER", (err, x) => {
-    res.setHeader("reflected", req.query.header); // NOT OK
+    res.setHeader("reflected", req.query.header); // NOT OK [INCONSISTENCY]
   });
   fs.readFile("/WHATEVER", (err, x) => {
     try {

From 7418c05594548a3107b1e9d98d17d0980bc83760 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 8 Jan 2021 12:15:49 +0100
Subject: [PATCH 079/343] Always populate assemblies

---
 csharp/extractor/Semmle.Extraction.CSharp/Analyser.cs   | 4 ++--
 csharp/extractor/Semmle.Extraction/AssemblyScope.cs     | 5 +----
 csharp/extractor/Semmle.Extraction/Context.cs           | 2 --
 csharp/extractor/Semmle.Extraction/Entities/Assembly.cs | 3 +--
 csharp/extractor/Semmle.Extraction/IExtractionScope.cs  | 2 --
 csharp/extractor/Semmle.Extraction/SourceScope.cs       | 2 --
 6 files changed, 4 insertions(+), 14 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Analyser.cs b/csharp/extractor/Semmle.Extraction.CSharp/Analyser.cs
index b5a4c79d8f2..1222403515f 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Analyser.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Analyser.cs
@@ -232,7 +232,7 @@ namespace Semmle.Extraction.CSharp
                 var projectLayout = layout.LookupProjectOrDefault(transformedAssemblyPath);
                 var trapWriter = projectLayout.CreateTrapWriter(Logger, transformedAssemblyPath, options.TrapCompression, discardDuplicates: false);
                 compilationTrapFile = trapWriter;  // Dispose later
-                var cx = extractor.CreateContext(compilation.Clone(), trapWriter, new AssemblyScope(assembly, assemblyPath, true), AddAssemblyTrapPrefix);
+                var cx = extractor.CreateContext(compilation.Clone(), trapWriter, new AssemblyScope(assembly, assemblyPath), AddAssemblyTrapPrefix);
 
                 compilationEntity = new Entities.Compilation(cx, cwd, args);
             }
@@ -287,7 +287,7 @@ namespace Semmle.Extraction.CSharp
 
                     if (c.GetAssemblyOrModuleSymbol(r) is IAssemblySymbol assembly)
                     {
-                        var cx = extractor.CreateContext(c, trapWriter, new AssemblyScope(assembly, assemblyPath, false), AddAssemblyTrapPrefix);
+                        var cx = extractor.CreateContext(c, trapWriter, new AssemblyScope(assembly, assemblyPath), AddAssemblyTrapPrefix);
 
                         foreach (var module in assembly.Modules)
                         {
diff --git a/csharp/extractor/Semmle.Extraction/AssemblyScope.cs b/csharp/extractor/Semmle.Extraction/AssemblyScope.cs
index b2c947dea83..84c117d17c4 100644
--- a/csharp/extractor/Semmle.Extraction/AssemblyScope.cs
+++ b/csharp/extractor/Semmle.Extraction/AssemblyScope.cs
@@ -10,15 +10,12 @@ namespace Semmle.Extraction
         private readonly IAssemblySymbol assembly;
         private readonly string filepath;
 
-        public AssemblyScope(IAssemblySymbol symbol, string path, bool isOutput)
+        public AssemblyScope(IAssemblySymbol symbol, string path)
         {
             assembly = symbol;
             filepath = path;
-            IsGlobalScope = isOutput;
         }
 
-        public bool IsGlobalScope { get; }
-
         public bool InFileScope(string path) => path == filepath;
 
         public bool InScope(ISymbol symbol) =>
diff --git a/csharp/extractor/Semmle.Extraction/Context.cs b/csharp/extractor/Semmle.Extraction/Context.cs
index af254c817a3..fc50d01f113 100644
--- a/csharp/extractor/Semmle.Extraction/Context.cs
+++ b/csharp/extractor/Semmle.Extraction/Context.cs
@@ -244,8 +244,6 @@ namespace Semmle.Extraction
 
         public bool FromSource => scope.FromSource;
 
-        public bool IsGlobalContext => scope.IsGlobalScope;
-
         public ICommentGenerator CommentGenerator { get; } = new CommentProcessor();
 
         private IExtractionScope scope { get; }
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
index 35055541371..711441f7009 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
@@ -35,8 +35,7 @@ namespace Semmle.Extraction.Entities
             }
         }
 
-        public override bool NeedsPopulation =>
-            !SymbolEqualityComparer.Default.Equals(assembly, Context.Compilation.Assembly) || !Context.IsGlobalContext;
+        public override bool NeedsPopulation => true;
 
         public override int GetHashCode() =>
             symbol == null ? 91187354 : symbol.GetHashCode();
diff --git a/csharp/extractor/Semmle.Extraction/IExtractionScope.cs b/csharp/extractor/Semmle.Extraction/IExtractionScope.cs
index 43a58a88e51..78b4a29d0d1 100644
--- a/csharp/extractor/Semmle.Extraction/IExtractionScope.cs
+++ b/csharp/extractor/Semmle.Extraction/IExtractionScope.cs
@@ -23,8 +23,6 @@ namespace Semmle.Extraction
         /// <param name="path">The path to populate.</param>
         bool InFileScope(string path);
 
-        bool IsGlobalScope { get; }
-
         bool FromSource { get; }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction/SourceScope.cs b/csharp/extractor/Semmle.Extraction/SourceScope.cs
index 107db83a146..48a89decba9 100644
--- a/csharp/extractor/Semmle.Extraction/SourceScope.cs
+++ b/csharp/extractor/Semmle.Extraction/SourceScope.cs
@@ -16,8 +16,6 @@ namespace Semmle.Extraction
             SourceTree = tree;
         }
 
-        public bool IsGlobalScope => false;
-
         public bool InFileScope(string path) => path == SourceTree.FilePath;
 
         public bool InScope(ISymbol symbol) => symbol.Locations.Any(loc => loc.SourceTree == SourceTree);

From 5cfa900828996f21120af56f1772da4342847c57 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 8 Jan 2021 09:35:57 +0100
Subject: [PATCH 080/343] C#: Add output assembly to compilation

---
 .../Semmle.Extraction.CSharp/Entities/Compilation.cs     | 4 ++--
 csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs      | 4 ++--
 csharp/extractor/Semmle.Extraction/Entities/Assembly.cs  | 3 ++-
 csharp/ql/src/semmle/code/csharp/Location.qll            | 4 ++++
 csharp/ql/src/semmle/code/csharp/commons/Compilation.qll | 5 ++++-
 csharp/ql/src/semmlecode.csharp.dbscheme                 | 6 ++++--
 .../test/library-tests/assemblies/compilation.expected   | 9 +++++++++
 csharp/ql/test/library-tests/assemblies/compilation.ql   | 8 ++++++++
 .../library-tests/compilations/Compilations.expected     | 2 ++
 .../ql/test/library-tests/compilations/Compilations.ql   | 2 ++
 10 files changed, 39 insertions(+), 8 deletions(-)
 create mode 100644 csharp/ql/test/library-tests/assemblies/compilation.expected
 create mode 100644 csharp/ql/test/library-tests/assemblies/compilation.ql

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs
index 67a4325ce35..53680852901 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs
@@ -21,9 +21,9 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected override void Populate(TextWriter trapFile)
         {
-            Extraction.Entities.Assembly.CreateOutputAssembly(cx);
+            var assembly = Extraction.Entities.Assembly.CreateOutputAssembly(cx);
 
-            trapFile.compilations(this, FileUtils.ConvertToUnix(cwd));
+            trapFile.compilations(this, FileUtils.ConvertToUnix(cwd), assembly);
 
             // Arguments
             var index = 0;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
index 254aa367570..e2cfe16df10 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
@@ -106,9 +106,9 @@ namespace Semmle.Extraction.CSharp
             trapFile.WriteTuple("compilation_time", compilation, num, index, metric);
         }
 
-        internal static void compilations(this TextWriter trapFile, Compilation compilation, string cwd)
+        internal static void compilations(this TextWriter trapFile, Compilation compilation, string cwd, Assembly assembly)
         {
-            trapFile.WriteTuple("compilations", compilation, cwd);
+            trapFile.WriteTuple("compilations", compilation, cwd, assembly);
         }
 
         internal static void compiler_generated(this TextWriter trapFile, IEntity entity)
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
index 711441f7009..a6210356199 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
@@ -58,7 +58,8 @@ namespace Semmle.Extraction.Entities
         }
 
         private static readonly object outputAssemblyCacheKey = new object();
-        public static Location CreateOutputAssembly(Context cx)
+
+        public static Assembly CreateOutputAssembly(Context cx)
         {
             if (cx.Extractor.OutputPath == null)
                 throw new InternalError("Attempting to create the output assembly in standalone extraction mode");
diff --git a/csharp/ql/src/semmle/code/csharp/Location.qll b/csharp/ql/src/semmle/code/csharp/Location.qll
index 99df294ae63..55233355022 100644
--- a/csharp/ql/src/semmle/code/csharp/Location.qll
+++ b/csharp/ql/src/semmle/code/csharp/Location.qll
@@ -14,6 +14,7 @@
 
 import File
 private import Attribute
+private import semmle.code.csharp.commons.Compilation
 
 /**
  * A location of a program element.
@@ -171,6 +172,9 @@ class Assembly extends Location, Attributable, @assembly {
   /** Gets the version of this assembly. */
   Version getVersion() { assemblies(this, _, _, _, result) }
 
+  /** Gets the compilation producing this assembly if any. */
+  Compilation getCompilation() { compilations(result, _, this) }
+
   override File getFile() { assemblies(this, result, _, _, _) }
 
   override string toString() { result = this.getFullName() }
diff --git a/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll b/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll
index c1eb3362c47..7f2b5ffeda6 100644
--- a/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll
+++ b/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll
@@ -7,7 +7,10 @@ class Compilation extends @compilation {
   string toString() { result = "compilation" }
 
   /** Gets the directory in which this compilation was run, as a string. */
-  string getDirectoryString() { compilations(this, result) }
+  string getDirectoryString() { compilations(this, result, _) }
+
+  /** Gets the output assembly. */
+  Assembly getOutputAssembly() { compilations(this, _, result) }
 
   /** Gets the folder in which this compilation was run. */
   Folder getFolder() { result.getAbsolutePath() = getDirectoryString() }
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index 26249c105a8..2259449c72b 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -7,11 +7,13 @@
  *   csc f1.cs f2.cs f3.cs
  *
  * The `id` simply identifies the invocation, while `cwd` is the working
- * directory from which the compiler was invoked.
+ * directory from which the compiler was invoked. The `assembly` identifies
+ * the output assembly of the compilation.
  */
 compilations(
     unique int id : @compilation,
-    string cwd : string ref
+    string cwd : string ref,
+    int assembly: @assembly ref
 );
 
 /**
diff --git a/csharp/ql/test/library-tests/assemblies/compilation.expected b/csharp/ql/test/library-tests/assemblies/compilation.expected
new file mode 100644
index 00000000000..5075507382c
--- /dev/null
+++ b/csharp/ql/test/library-tests/assemblies/compilation.expected
@@ -0,0 +1,9 @@
+| Assembly1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | no compilation |
+| Locations, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | has compilation |
+| System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
+| System.Console, Version=4.1.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
+| System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
+| System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e | no compilation |
+| System.Runtime, Version=4.2.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
+| System.Runtime.Extensions, Version=4.2.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
+| mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
diff --git a/csharp/ql/test/library-tests/assemblies/compilation.ql b/csharp/ql/test/library-tests/assemblies/compilation.ql
new file mode 100644
index 00000000000..6783c6eebca
--- /dev/null
+++ b/csharp/ql/test/library-tests/assemblies/compilation.ql
@@ -0,0 +1,8 @@
+import csharp
+
+private string hasCompilation(Assembly a) {
+  if exists(a.getCompilation()) then result = "has compilation" else result = "no compilation"
+}
+
+from Assembly a
+select a.getFullName(), hasCompilation(a)
diff --git a/csharp/ql/test/library-tests/compilations/Compilations.expected b/csharp/ql/test/library-tests/compilations/Compilations.expected
index 92905087cc3..de6c72255ed 100644
--- a/csharp/ql/test/library-tests/compilations/Compilations.expected
+++ b/csharp/ql/test/library-tests/compilations/Compilations.expected
@@ -35,3 +35,5 @@ references
 | compilation | mscorlib.dll |
 timings
 | compilation |
+assembly
+| compilation | Program.dll:0:0:0:0 | Program, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null |
diff --git a/csharp/ql/test/library-tests/compilations/Compilations.ql b/csharp/ql/test/library-tests/compilations/Compilations.ql
index e54b36c4e10..c523dea5780 100644
--- a/csharp/ql/test/library-tests/compilations/Compilations.ql
+++ b/csharp/ql/test/library-tests/compilations/Compilations.ql
@@ -39,3 +39,5 @@ query predicate timings(Compilation c) {
   c.getCpuSeconds() > 0 and
   c.getElapsedSeconds() > 0
 }
+
+query predicate assembly(Compilation c, Assembly a) { c.getOutputAssembly() = a }

From 983c4d06d407cb836d8710a1b3fb958b85c0e880 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 13 Jan 2021 09:12:31 +0100
Subject: [PATCH 081/343] Revert "C#: Add output assembly to compilation"

This reverts commit 5cfa900828996f21120af56f1772da4342847c57.
---
 .../Semmle.Extraction.CSharp/Entities/Compilation.cs     | 4 ++--
 csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs      | 4 ++--
 csharp/extractor/Semmle.Extraction/Entities/Assembly.cs  | 3 +--
 csharp/ql/src/semmle/code/csharp/Location.qll            | 4 ----
 csharp/ql/src/semmle/code/csharp/commons/Compilation.qll | 5 +----
 csharp/ql/src/semmlecode.csharp.dbscheme                 | 6 ++----
 .../test/library-tests/assemblies/compilation.expected   | 9 ---------
 csharp/ql/test/library-tests/assemblies/compilation.ql   | 8 --------
 .../library-tests/compilations/Compilations.expected     | 2 --
 .../ql/test/library-tests/compilations/Compilations.ql   | 2 --
 10 files changed, 8 insertions(+), 39 deletions(-)
 delete mode 100644 csharp/ql/test/library-tests/assemblies/compilation.expected
 delete mode 100644 csharp/ql/test/library-tests/assemblies/compilation.ql

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs
index 53680852901..67a4325ce35 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs
@@ -21,9 +21,9 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected override void Populate(TextWriter trapFile)
         {
-            var assembly = Extraction.Entities.Assembly.CreateOutputAssembly(cx);
+            Extraction.Entities.Assembly.CreateOutputAssembly(cx);
 
-            trapFile.compilations(this, FileUtils.ConvertToUnix(cwd), assembly);
+            trapFile.compilations(this, FileUtils.ConvertToUnix(cwd));
 
             // Arguments
             var index = 0;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
index e2cfe16df10..254aa367570 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
@@ -106,9 +106,9 @@ namespace Semmle.Extraction.CSharp
             trapFile.WriteTuple("compilation_time", compilation, num, index, metric);
         }
 
-        internal static void compilations(this TextWriter trapFile, Compilation compilation, string cwd, Assembly assembly)
+        internal static void compilations(this TextWriter trapFile, Compilation compilation, string cwd)
         {
-            trapFile.WriteTuple("compilations", compilation, cwd, assembly);
+            trapFile.WriteTuple("compilations", compilation, cwd);
         }
 
         internal static void compiler_generated(this TextWriter trapFile, IEntity entity)
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
index a6210356199..711441f7009 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
@@ -58,8 +58,7 @@ namespace Semmle.Extraction.Entities
         }
 
         private static readonly object outputAssemblyCacheKey = new object();
-
-        public static Assembly CreateOutputAssembly(Context cx)
+        public static Location CreateOutputAssembly(Context cx)
         {
             if (cx.Extractor.OutputPath == null)
                 throw new InternalError("Attempting to create the output assembly in standalone extraction mode");
diff --git a/csharp/ql/src/semmle/code/csharp/Location.qll b/csharp/ql/src/semmle/code/csharp/Location.qll
index 55233355022..99df294ae63 100644
--- a/csharp/ql/src/semmle/code/csharp/Location.qll
+++ b/csharp/ql/src/semmle/code/csharp/Location.qll
@@ -14,7 +14,6 @@
 
 import File
 private import Attribute
-private import semmle.code.csharp.commons.Compilation
 
 /**
  * A location of a program element.
@@ -172,9 +171,6 @@ class Assembly extends Location, Attributable, @assembly {
   /** Gets the version of this assembly. */
   Version getVersion() { assemblies(this, _, _, _, result) }
 
-  /** Gets the compilation producing this assembly if any. */
-  Compilation getCompilation() { compilations(result, _, this) }
-
   override File getFile() { assemblies(this, result, _, _, _) }
 
   override string toString() { result = this.getFullName() }
diff --git a/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll b/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll
index 7f2b5ffeda6..c1eb3362c47 100644
--- a/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll
+++ b/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll
@@ -7,10 +7,7 @@ class Compilation extends @compilation {
   string toString() { result = "compilation" }
 
   /** Gets the directory in which this compilation was run, as a string. */
-  string getDirectoryString() { compilations(this, result, _) }
-
-  /** Gets the output assembly. */
-  Assembly getOutputAssembly() { compilations(this, _, result) }
+  string getDirectoryString() { compilations(this, result) }
 
   /** Gets the folder in which this compilation was run. */
   Folder getFolder() { result.getAbsolutePath() = getDirectoryString() }
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index 2259449c72b..26249c105a8 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -7,13 +7,11 @@
  *   csc f1.cs f2.cs f3.cs
  *
  * The `id` simply identifies the invocation, while `cwd` is the working
- * directory from which the compiler was invoked. The `assembly` identifies
- * the output assembly of the compilation.
+ * directory from which the compiler was invoked.
  */
 compilations(
     unique int id : @compilation,
-    string cwd : string ref,
-    int assembly: @assembly ref
+    string cwd : string ref
 );
 
 /**
diff --git a/csharp/ql/test/library-tests/assemblies/compilation.expected b/csharp/ql/test/library-tests/assemblies/compilation.expected
deleted file mode 100644
index 5075507382c..00000000000
--- a/csharp/ql/test/library-tests/assemblies/compilation.expected
+++ /dev/null
@@ -1,9 +0,0 @@
-| Assembly1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | no compilation |
-| Locations, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | has compilation |
-| System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
-| System.Console, Version=4.1.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
-| System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
-| System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e | no compilation |
-| System.Runtime, Version=4.2.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
-| System.Runtime.Extensions, Version=4.2.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
-| mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
diff --git a/csharp/ql/test/library-tests/assemblies/compilation.ql b/csharp/ql/test/library-tests/assemblies/compilation.ql
deleted file mode 100644
index 6783c6eebca..00000000000
--- a/csharp/ql/test/library-tests/assemblies/compilation.ql
+++ /dev/null
@@ -1,8 +0,0 @@
-import csharp
-
-private string hasCompilation(Assembly a) {
-  if exists(a.getCompilation()) then result = "has compilation" else result = "no compilation"
-}
-
-from Assembly a
-select a.getFullName(), hasCompilation(a)
diff --git a/csharp/ql/test/library-tests/compilations/Compilations.expected b/csharp/ql/test/library-tests/compilations/Compilations.expected
index de6c72255ed..92905087cc3 100644
--- a/csharp/ql/test/library-tests/compilations/Compilations.expected
+++ b/csharp/ql/test/library-tests/compilations/Compilations.expected
@@ -35,5 +35,3 @@ references
 | compilation | mscorlib.dll |
 timings
 | compilation |
-assembly
-| compilation | Program.dll:0:0:0:0 | Program, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null |
diff --git a/csharp/ql/test/library-tests/compilations/Compilations.ql b/csharp/ql/test/library-tests/compilations/Compilations.ql
index c523dea5780..e54b36c4e10 100644
--- a/csharp/ql/test/library-tests/compilations/Compilations.ql
+++ b/csharp/ql/test/library-tests/compilations/Compilations.ql
@@ -39,5 +39,3 @@ query predicate timings(Compilation c) {
   c.getCpuSeconds() > 0 and
   c.getElapsedSeconds() > 0
 }
-
-query predicate assembly(Compilation c, Assembly a) { c.getOutputAssembly() = a }

From fb1312667605fdca836ea11c90ea97226be972cc Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 8 Jan 2021 09:35:57 +0100
Subject: [PATCH 082/343] C#: Store output assembly in compilation_assembly
 relation

---
 .../Semmle.Extraction.CSharp/Entities/Compilation.cs     | 3 ++-
 csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs      | 5 +++++
 csharp/extractor/Semmle.Extraction/Entities/Assembly.cs  | 3 ++-
 csharp/ql/src/semmle/code/csharp/Location.qll            | 4 ++++
 csharp/ql/src/semmle/code/csharp/commons/Compilation.qll | 3 +++
 csharp/ql/src/semmlecode.csharp.dbscheme                 | 5 +++++
 .../test/library-tests/assemblies/compilation.expected   | 9 +++++++++
 csharp/ql/test/library-tests/assemblies/compilation.ql   | 8 ++++++++
 .../library-tests/compilations/Compilations.expected     | 2 ++
 .../ql/test/library-tests/compilations/Compilations.ql   | 2 ++
 10 files changed, 42 insertions(+), 2 deletions(-)
 create mode 100644 csharp/ql/test/library-tests/assemblies/compilation.expected
 create mode 100644 csharp/ql/test/library-tests/assemblies/compilation.ql

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs
index 67a4325ce35..d4f0da99a28 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilation.cs
@@ -21,9 +21,10 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected override void Populate(TextWriter trapFile)
         {
-            Extraction.Entities.Assembly.CreateOutputAssembly(cx);
+            var assembly = Extraction.Entities.Assembly.CreateOutputAssembly(cx);
 
             trapFile.compilations(this, FileUtils.ConvertToUnix(cwd));
+            trapFile.compilation_assembly(this, assembly);
 
             // Arguments
             var index = 0;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
index 254aa367570..53fe9a00ca4 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
@@ -111,6 +111,11 @@ namespace Semmle.Extraction.CSharp
             trapFile.WriteTuple("compilations", compilation, cwd);
         }
 
+        internal static void compilation_assembly(this TextWriter trapFile, Compilation compilation, Assembly assembly)
+        {
+            trapFile.WriteTuple("compilation_assembly", compilation, assembly);
+        }
+
         internal static void compiler_generated(this TextWriter trapFile, IEntity entity)
         {
             trapFile.WriteTuple("compiler_generated", entity);
diff --git a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
index 711441f7009..a6210356199 100644
--- a/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
+++ b/csharp/extractor/Semmle.Extraction/Entities/Assembly.cs
@@ -58,7 +58,8 @@ namespace Semmle.Extraction.Entities
         }
 
         private static readonly object outputAssemblyCacheKey = new object();
-        public static Location CreateOutputAssembly(Context cx)
+
+        public static Assembly CreateOutputAssembly(Context cx)
         {
             if (cx.Extractor.OutputPath == null)
                 throw new InternalError("Attempting to create the output assembly in standalone extraction mode");
diff --git a/csharp/ql/src/semmle/code/csharp/Location.qll b/csharp/ql/src/semmle/code/csharp/Location.qll
index 99df294ae63..77a4dc4fe4c 100644
--- a/csharp/ql/src/semmle/code/csharp/Location.qll
+++ b/csharp/ql/src/semmle/code/csharp/Location.qll
@@ -14,6 +14,7 @@
 
 import File
 private import Attribute
+private import semmle.code.csharp.commons.Compilation
 
 /**
  * A location of a program element.
@@ -171,6 +172,9 @@ class Assembly extends Location, Attributable, @assembly {
   /** Gets the version of this assembly. */
   Version getVersion() { assemblies(this, _, _, _, result) }
 
+  /** Gets the compilation producing this assembly if any. */
+  Compilation getCompilation() { compilation_assembly(result, this) }
+
   override File getFile() { assemblies(this, result, _, _, _) }
 
   override string toString() { result = this.getFullName() }
diff --git a/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll b/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll
index c1eb3362c47..6af0af0e8a9 100644
--- a/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll
+++ b/csharp/ql/src/semmle/code/csharp/commons/Compilation.qll
@@ -9,6 +9,9 @@ class Compilation extends @compilation {
   /** Gets the directory in which this compilation was run, as a string. */
   string getDirectoryString() { compilations(this, result) }
 
+  /** Gets the output assembly. */
+  Assembly getOutputAssembly() { compilation_assembly(this, result) }
+
   /** Gets the folder in which this compilation was run. */
   Folder getFolder() { result.getAbsolutePath() = getDirectoryString() }
 
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index 26249c105a8..e6442d16b7e 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -151,6 +151,11 @@ compilation_finished(
     float elapsed_seconds : float ref
 );
 
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
 /*
  * External artifacts
  */
diff --git a/csharp/ql/test/library-tests/assemblies/compilation.expected b/csharp/ql/test/library-tests/assemblies/compilation.expected
new file mode 100644
index 00000000000..5075507382c
--- /dev/null
+++ b/csharp/ql/test/library-tests/assemblies/compilation.expected
@@ -0,0 +1,9 @@
+| Assembly1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | no compilation |
+| Locations, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | has compilation |
+| System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
+| System.Console, Version=4.1.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
+| System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
+| System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e | no compilation |
+| System.Runtime, Version=4.2.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
+| System.Runtime.Extensions, Version=4.2.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
+| mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
diff --git a/csharp/ql/test/library-tests/assemblies/compilation.ql b/csharp/ql/test/library-tests/assemblies/compilation.ql
new file mode 100644
index 00000000000..6783c6eebca
--- /dev/null
+++ b/csharp/ql/test/library-tests/assemblies/compilation.ql
@@ -0,0 +1,8 @@
+import csharp
+
+private string hasCompilation(Assembly a) {
+  if exists(a.getCompilation()) then result = "has compilation" else result = "no compilation"
+}
+
+from Assembly a
+select a.getFullName(), hasCompilation(a)
diff --git a/csharp/ql/test/library-tests/compilations/Compilations.expected b/csharp/ql/test/library-tests/compilations/Compilations.expected
index 92905087cc3..de6c72255ed 100644
--- a/csharp/ql/test/library-tests/compilations/Compilations.expected
+++ b/csharp/ql/test/library-tests/compilations/Compilations.expected
@@ -35,3 +35,5 @@ references
 | compilation | mscorlib.dll |
 timings
 | compilation |
+assembly
+| compilation | Program.dll:0:0:0:0 | Program, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null |
diff --git a/csharp/ql/test/library-tests/compilations/Compilations.ql b/csharp/ql/test/library-tests/compilations/Compilations.ql
index e54b36c4e10..c523dea5780 100644
--- a/csharp/ql/test/library-tests/compilations/Compilations.ql
+++ b/csharp/ql/test/library-tests/compilations/Compilations.ql
@@ -39,3 +39,5 @@ query predicate timings(Compilation c) {
   c.getCpuSeconds() > 0 and
   c.getElapsedSeconds() > 0
 }
+
+query predicate assembly(Compilation c, Assembly a) { c.getOutputAssembly() = a }

From d71adff079aaef04620e3797b50a41a4e9c8274f Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 12 Jan 2021 18:15:59 +0100
Subject: [PATCH 083/343] dont sanitize global replacements where the regexp is
 a char class

---
 .../performance/PolynomialReDoSCustomizations.qll |  8 +++++++-
 .../ReDoS/PolynomialBackTracking.expected         |  1 +
 .../Performance/ReDoS/PolynomialReDoS.expected    | 15 +++++++++++++++
 .../Performance/ReDoS/polynomial-redos.js         |  7 +++++++
 4 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
index 0645589a5e6..09266256f6c 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
@@ -84,7 +84,13 @@ module PolynomialReDoS {
    */
   class StringLengthLimiter extends Sanitizer {
     StringLengthLimiter() {
-      this.(StringReplaceCall).isGlobal()
+      this.(StringReplaceCall).isGlobal() and
+      // not char classes - they don't remove any repeated pattern.
+      not exists(RegExpTerm root | root = this.(StringReplaceCall).getRegExp().getRoot() |
+        root instanceof RegExpCharacterClass
+        or
+        root instanceof RegExpCharacterClassEscape
+      )
       or
       exists(string name | name = "slice" or name = "substring" or name = "substr" |
         this.(DataFlow::MethodCallNode).getMethodName() = name
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
index c351f3f902e..e44d8596e67 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
@@ -104,6 +104,7 @@
 | polynomial-redos.js:114:22:114:24 | \\w* | Strings starting with '5' and with many repetitions of '5' can start matching anywhere after the start of the preceeding \\d* |
 | polynomial-redos.js:116:21:116:28 | [\\d\\D]*? | Strings starting with '/*' and with many repetitions of 'a/*' can start matching anywhere after the start of the preceeding \\/\\*[\\d\\D]*?\\*\\/ |
 | polynomial-redos.js:118:17:118:23 | (#\\d+)+ | Strings with many repetitions of '9' can start matching anywhere after the start of the preceeding \\d+ |
+| polynomial-redos.js:124:33:124:35 | \\s+ | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s+$ |
 | regexplib/address.js:27:3:27:5 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (\\s*\\(?0\\d{4}\\)?(\\s*\|-)\\d{3}(\\s*\|-)\\d{3}\\s*) |
 | regexplib/address.js:27:48:27:50 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (\\s*\\(?0\\d{3}\\)?(\\s*\|-)\\d{3}(\\s*\|-)\\d{4}\\s*) |
 | regexplib/address.js:27:93:27:95 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (\\s*(7\|8)(\\d{7}\|\\d{3}(\\-\|\\s{1})\\d{4})\\s*) |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
index 71990d6b919..4a2b6a87c9f 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
@@ -138,6 +138,13 @@ nodes
 | polynomial-redos.js:116:2:116:8 | tainted |
 | polynomial-redos.js:118:2:118:8 | tainted |
 | polynomial-redos.js:118:2:118:8 | tainted |
+| polynomial-redos.js:121:7:121:55 | replaced |
+| polynomial-redos.js:121:18:121:24 | tainted |
+| polynomial-redos.js:121:18:121:55 | tainted ... /g, '') |
+| polynomial-redos.js:123:3:123:20 | result |
+| polynomial-redos.js:123:13:123:20 | replaced |
+| polynomial-redos.js:124:12:124:17 | result |
+| polynomial-redos.js:124:12:124:17 | result |
 edges
 | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
 | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
@@ -269,10 +276,17 @@ edges
 | polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:116:2:116:8 | tainted |
 | polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:118:2:118:8 | tainted |
 | polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:118:2:118:8 | tainted |
+| polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:121:18:121:24 | tainted |
 | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:5:6:5:32 | tainted |
 | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:5:6:5:32 | tainted |
 | polynomial-redos.js:68:18:68:24 | req.url | polynomial-redos.js:68:18:68:24 | req.url |
 | polynomial-redos.js:69:18:69:25 | req.body | polynomial-redos.js:69:18:69:25 | req.body |
+| polynomial-redos.js:121:7:121:55 | replaced | polynomial-redos.js:123:13:123:20 | replaced |
+| polynomial-redos.js:121:18:121:24 | tainted | polynomial-redos.js:121:18:121:55 | tainted ... /g, '') |
+| polynomial-redos.js:121:18:121:55 | tainted ... /g, '') | polynomial-redos.js:121:7:121:55 | replaced |
+| polynomial-redos.js:123:3:123:20 | result | polynomial-redos.js:124:12:124:17 | result |
+| polynomial-redos.js:123:3:123:20 | result | polynomial-redos.js:124:12:124:17 | result |
+| polynomial-redos.js:123:13:123:20 | replaced | polynomial-redos.js:123:3:123:20 | result |
 #select
 | lib/lib.js:4:14:4:17 | name | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name | This expensive $@ use depends on $@. | lib/lib.js:1:15:1:16 | a* | regular expression | lib/lib.js:3:28:3:31 | name | library input |
 | polynomial-redos.js:7:2:7:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:7:2:7:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:7:24:7:26 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
@@ -349,3 +363,4 @@ edges
 | polynomial-redos.js:114:2:114:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:114:2:114:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:114:22:114:24 | \\w* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
 | polynomial-redos.js:116:2:116:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:116:2:116:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:116:21:116:28 | [\\d\\D]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
 | polynomial-redos.js:118:2:118:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:118:2:118:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:118:17:118:23 | (#\\d+)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:124:12:124:17 | result | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:124:12:124:17 | result | This expensive $@ use depends on $@. | polynomial-redos.js:124:33:124:35 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/polynomial-redos.js b/javascript/ql/test/query-tests/Performance/ReDoS/polynomial-redos.js
index f474b7c3869..0e91b5a9b56 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/polynomial-redos.js
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/polynomial-redos.js
@@ -116,4 +116,11 @@ app.use(function(req, res) {
 	tainted.match(/\/\*[\d\D]*?\*\//g); // NOT OK
 
 	tainted.match(/(#\d+)+/); // OK - but still flagged due to insufficient suffix-checking.
+
+	(function foo() {
+		var replaced = tainted.replace(/[^\w\s\-\.\_~]/g, '');
+		var result = ""
+		result += replaced;
+		result = result.replace(/^\s+|\s+$/g, ''); // NOT OK
+	})();
 });

From c98dacf8421c2af9470e004ffae1760950bd4ff2 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Wed, 13 Jan 2021 10:36:50 +0100
Subject: [PATCH 084/343] changes based on doc review

---
 javascript/ql/src/Security/CWE-117/LogInjection.qhelp | 8 ++++----
 javascript/ql/src/Security/CWE-117/LogInjection.ql    | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-117/LogInjection.qhelp b/javascript/ql/src/Security/CWE-117/LogInjection.qhelp
index b125d3beadb..04a1a3e36e8 100644
--- a/javascript/ql/src/Security/CWE-117/LogInjection.qhelp
+++ b/javascript/ql/src/Security/CWE-117/LogInjection.qhelp
@@ -18,12 +18,12 @@ arbitrary HTML may be included to spoof log entries.</p>
 User input should be suitably sanitized before it is logged.
 </p>
 <p>
-If the log entries are plain text then line breaks should be removed from user input, using
+If the log entries are in plain text then line breaks should be removed from user input, using
 <code>String.prototype.replace</code> or similar. Care should also be taken that user input is clearly marked
-in log entries, and that a malicious user cannot cause confusion in other ways.
+in log entries.
 </p>
 <p>
-For log entries that will be displayed in HTML, user input should be HTML encoded before being logged, to prevent forgery and
+For log entries that will be displayed in HTML, user input should be HTML-encoded before being logged, to prevent forgery and
 other forms of HTML injection.
 </p>
 
@@ -31,7 +31,7 @@ other forms of HTML injection.
 
 <example>
 <p>In the first example, a username, provided by the user, is logged using `console.info`. In
-the first case, it is logged without any sanitization. In the second case the username is used to build an error that is logged using `console.error`.
+the first case, it is logged without any sanitization. In the second case, the username is used to build an error that is logged using `console.error`.
 If a malicious user provides `username=Guest%0a[INFO]+User:+Admin%0a` as a username parameter, 
 the log entry will be splitted in two different lines, where the second line will be `[INFO]+User:+Admin`.
 </p>
diff --git a/javascript/ql/src/Security/CWE-117/LogInjection.ql b/javascript/ql/src/Security/CWE-117/LogInjection.ql
index ad374bac55c..ac475373f93 100644
--- a/javascript/ql/src/Security/CWE-117/LogInjection.ql
+++ b/javascript/ql/src/Security/CWE-117/LogInjection.ql
@@ -1,5 +1,5 @@
 /**
- * @name Log Injection
+ * @name Log injection
  * @description Building log entries from user-controlled sources is vulnerable to
  *              insertion of forged log entries by a malicious user.
  * @kind path-problem

From 4cee67da753bd001222aeefc1757428e9b8214f2 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Wed, 13 Jan 2021 14:17:21 +0300
Subject: [PATCH 085/343] Add files via upload

---
 .../CompilerRemovalOfCodeToClearBuffers.c     |  35 +++++
 .../CompilerRemovalOfCodeToClearBuffers.qhelp |  31 +++++
 .../CompilerRemovalOfCodeToClearBuffers.ql    | 121 ++++++++++++++++++
 3 files changed, 187 insertions(+)
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
new file mode 100644
index 00000000000..ab1bae3ae21
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
@@ -0,0 +1,35 @@
+// BAD: the memset call will probably be optimized.
+void getPassword(void) {
+  char pwd[64];
+  if (GetPassword(pwd, sizeof(pwd))) {
+    /* Checking of password, secure operations, etc. */
+  }
+  memset(pwd, 0, sizeof(pwd));
+}
+// GOOD: in this case the memset will not be optimized.
+void getPassword(void) {
+  char pwd[64];
+ 
+  if (retrievePassword(pwd, sizeof(pwd))) {
+     /* Checking of password, secure operations, etc. */
+  }
+  memset_s(pwd, 0, sizeof(pwd));
+}
+// GOOD: in this case the memset will not be optimized.
+void getPassword(void) {
+  char pwd[64];
+  if (retrievePassword(pwd, sizeof(pwd))) {
+    /* Checking of password, secure operations, etc. */
+  }
+  SecureZeroMemory(pwd, sizeof(pwd));
+}
+// GOOD: in this case the memset will not be optimized.
+void getPassword(void) {
+  char pwd[64];
+  if (retrievePassword(pwd, sizeof(pwd))) {
+    /* Checking of password, secure operations, etc. */
+  }
+#pragma optimize("", off)
+  memset(pwd, 0, sizeof(pwd));
+#pragma optimize("", on)
+}
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
new file mode 100644
index 00000000000..89b4189a100
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
@@ -0,0 +1,31 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>Compiler optimization will exclude the cleaning of private information.
+Using the memset function to clear private data as a final expression when working with a variable is potentially dangerous, since the compiler can optimize this call.
+For some compilers, optimization is also possible when using calls to free memory after the <code>memset</codee> function.</p>
+
+<p>It is possible to miss detection of vulnerabilities if used to clear fields of structures or parts of a buffer.</p>
+
+</overview>
+<recommendation>
+
+<p>We recommend to use the <code>RtlSecureZeroMemory</code> or <code>memset_s</code> functions, or compilation flags that exclude optimization of <code>memset</code> calls (-fno-builtin-memset).</p>
+
+</recommendation>
+<example>
+<p>The following example demonstrates an erroneous and corrected use of the <code>memset</code> function.</p>
+<sample src="CompilerRemovalOfCodeToClearBuffers.c" />
+
+</example>
+<references>
+
+<li>
+  CERT C Coding Standard:
+  <a href="https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations">MSC06-C. Beware of compiler optimizations</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
new file mode 100644
index 00000000000..fd53478cce6
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -0,0 +1,121 @@
+/**
+ * @name Compiler Removal Of Code To Clear Buffers
+ * @description --Using the memset function to clear private data as a final expression when working with a variable is potentially dangerous because the compiler can optimize this call.
+ *              --For some compilers, optimization is also possible when using calls to free memory after the memset function.
+ *              --To clear it, you need to use the RtlSecureZeroMemory or memset_s functions, or compilation flags that exclude optimization of memset calls (-fno-builtin-memset).
+ * @kind problem
+ * @id cpp/compiler-removal-of-code-to-clear-buffers
+ * @problem.severity warning
+ * @precision medium
+ * @tags security
+ *       external/cwe/cwe-14
+ */
+
+import cpp
+import semmle.code.cpp.dataflow.DataFlow
+
+/**
+ * A call to `memset` , for some local variable.
+ */
+class CompilerRemovaMemset extends FunctionCall {
+  CompilerRemovaMemset() {
+    this.getTarget().hasName("memset") and
+    exists(DataFlow::Node source, DataFlow::Node sink, LocalVariable isv, Expr exp |
+      DataFlow::localFlow(source, sink) and
+      this.getArgument(0) = isv.getAnAccess() and
+      source.asExpr() = exp and
+      exp.getLocation().getEndLine() < this.getArgument(0).getLocation().getStartLine() and
+      sink.asExpr() = this.getArgument(0)
+    )
+  }
+
+  predicate isExistsAllocForThisVariable() {
+    exists(FunctionCall alloc, Variable v |
+      alloc = v.getAnAssignedValue() and
+      this.getArgument(0) = v.getAnAccess() and
+      alloc.getASuccessor+() = this
+    )
+  }
+
+  predicate isExistsFreeForThisVariable() {
+    exists(FunctionCall free, Variable v |
+      free instanceof DeallocationExpr and
+      this.getArgument(0) = v.getAnAccess() and
+      free.getArgument(0) = v.getAnAccess() and
+      this.getASuccessor+() = free
+    )
+  }
+
+  predicate isExistsCallWithThisVariableExcludingDeallocationCalls() {
+    exists(FunctionCall fc, Variable v |
+      not fc instanceof DeallocationExpr and
+      this.getArgument(0) = v.getAnAccess() and
+      fc.getAnArgument() = v.getAnAccess() and
+      this.getASuccessor+() = fc
+    )
+  }
+
+  predicate isVariableUseAfterMemsetExcludingCalls() {
+    exists(DataFlow::Node source, DataFlow::Node sink, LocalVariable isv, Expr exp |
+      DataFlow::localFlow(source, sink) and
+      this.getArgument(0) = isv.getAnAccess() and
+      source.asExpr() = isv.getAnAccess() and
+      exp.getLocation().getStartLine() > this.getArgument(2).getLocation().getEndLine() and
+      not exp.getParent() instanceof FunctionCall and
+      sink.asExpr() = exp
+    )
+  }
+
+  predicate isVariableUseBoundWithArgumentFunction() {
+    exists(DataFlow::Node source, DataFlow::Node sink, LocalVariable isv, Parameter p, Expr exp |
+      DataFlow::localFlow(source, sink) and
+      this.getArgument(0) = isv.getAnAccess() and
+      this.getEnclosingFunction().getAParameter() = p and
+      exp.getAChild*() = p.getAnAccess() and
+      source.asExpr() = exp and
+      sink.asExpr() = isv.getAnAccess()
+    )
+  }
+
+  predicate isVariableUseBoundWithGlobalVariable() {
+    exists(
+      DataFlow::Node source, DataFlow::Node sink, LocalVariable isv, GlobalVariable gv, Expr exp
+    |
+      DataFlow::localFlow(source, sink) and
+      this.getArgument(0) = isv.getAnAccess() and
+      exp.getAChild*() = gv.getAnAccess() and
+      source.asExpr() = exp and
+      sink.asExpr() = isv.getAnAccess()
+    )
+  }
+
+  predicate isExistsCompilationFlagsBlockingRemoval() {
+    exists(Compilation c |
+      c.getAFileCompiled() = this.getFile() and
+      c.getAnArgument() = "-fno-builtin-memset"
+    )
+  }
+
+  predicate isUseVCCompilation() {
+    exists(Compilation c |
+      c.getAFileCompiled() = this.getFile() and
+      (
+        c.getArgument(2).toString().matches("%gcc%") or
+        c.getArgument(2).toString().matches("%g++%") or
+        c.getArgument(2).toString().matches("%clang%") or
+        c.getArgument(2).toString() = "--force-recompute"
+      )
+    )
+  }
+}
+
+from CompilerRemovaMemset fc
+where
+  not (fc.isExistsAllocForThisVariable() and not fc.isExistsFreeForThisVariable()) and
+  not (fc.isExistsFreeForThisVariable() and not fc.isUseVCCompilation()) and
+  not fc.isVariableUseAfterMemsetExcludingCalls() and
+  not fc.isExistsCallWithThisVariableExcludingDeallocationCalls() and
+  not fc.isVariableUseBoundWithArgumentFunction() and
+  not fc.isVariableUseBoundWithGlobalVariable() and
+  not fc.isExistsCompilationFlagsBlockingRemoval()
+select fc.getArgument(0), "this variable will not be cleared"

From 3ad45f28c90ceb429d53e7245ab7627f36b677d8 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Wed, 13 Jan 2021 14:18:54 +0300
Subject: [PATCH 086/343] Add files via upload

---
 ...mpilerRemovalOfCodeToClearBuffers.expected |   3 +
 .../CompilerRemovalOfCodeToClearBuffers.qlref |   1 +
 .../Security/CWE/CWE-14/semmle/tests/test.c   | 201 ++++++++++++++++++
 3 files changed, 205 insertions(+)
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.expected
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.qlref
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/test.c

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.expected
new file mode 100644
index 00000000000..fbb5a3f1552
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.expected
@@ -0,0 +1,3 @@
+| test.c:13:9:13:13 | buff1 | this variable will not be cleared |
+| test.c:35:9:35:13 | buff1 | this variable will not be cleared |
+| test.c:43:9:43:13 | buff1 | this variable will not be cleared |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.qlref
new file mode 100644
index 00000000000..61d2a29b126
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/test.c
new file mode 100644
index 00000000000..221072330c3
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/test.c
@@ -0,0 +1,201 @@
+struct buffers
+{
+    unsigned char buff1[50];
+    unsigned char *buff2;
+} globalBuff1,*globalBuff2;
+
+unsigned char * globalBuff;
+void badFunc0_0(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+}
+void nobadFunc0_0(){
+	unsigned char buff1[12];
+	memset(buff1,12,12);
+}
+void nobadFunc0_1(){
+	unsigned char buff1[12];
+	int i;
+	memset(buff1,12,12);
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	free(buff1);
+}
+void nobadFunc1_0(){
+	unsigned char * buff1;
+	buff1 = (unsigned char *) malloc(12);
+	memset(buff1,12,12);
+}
+void badFunc1_0(){
+	unsigned char * buff1;
+	buff1 = (unsigned char *) malloc(12);
+	memset(buff1,12,12);
+	free(buff1);
+}
+void badFunc1_1(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;	
+	memset(buff1,12,12);
+	free(buff1);
+}
+void nobadFunc2_0_0(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	printf(buff1);
+}
+
+void nobadFunc2_0_1(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	printf(buff1+3);
+}
+
+void nobadFunc2_0_2(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	printf(*buff1);
+}
+
+void nobadFunc2_0_3(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	printf(*(buff1+3));
+}
+unsigned char * nobadFunc2_0_4(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	return buff1;
+}
+
+unsigned char * nobadFunc2_0_5(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	return buff1+3;
+}
+unsigned char nobadFunc2_0_6(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	return *buff1;
+}
+
+unsigned char nobadFunc2_0_7(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	return *(buff1+3);
+}
+void nobadFunc2_1_0(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	if(*buff1==0)
+		printf("123123");
+}
+void nobadFunc2_1_1(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	if(*(buff1+3)==0)
+		printf("123123");
+}
+void nobadFunc2_1_2(){
+	unsigned char buff1[12];
+	int i;
+	for(i=0;i<12;i++)
+		buff1[i]=13;
+	memset(buff1,12,12);
+	buff1[2]=5;
+}
+void nobadFunc3_0(unsigned char * buffAll){
+	unsigned char * buff1 = buffAll;
+	memset(buff1,12,12);
+}
+void nobadFunc3_1(unsigned char * buffAll){
+	unsigned char * buff1 = buffAll+3;
+	memset(buff1,12,12);
+}
+void nobadFunc3_2(struct buffers buffAll){
+	unsigned char * buff1 = buffAll.buff1;
+	memset(buff1,12,12);
+}
+void nobadFunc3_3(struct buffers buffAll){
+	unsigned char * buff1 = buffAll.buff2;
+	memset(buff1,12,12);
+}
+void nobadFunc3_4(struct buffers buffAll){
+	unsigned char * buff1 = buffAll.buff2+3;
+	memset(buff1,12,12);
+}
+void nobadFunc3_5(struct buffers * buffAll){
+	unsigned char * buff1 = buffAll->buff1;
+	memset(buff1,12,12);
+}
+void nobadFunc3_6(struct buffers *buffAll){
+	unsigned char * buff1 = buffAll->buff2;
+	memset(buff1,12,12);
+}
+void nobadFunc4(){
+	unsigned char * buff1 = globalBuff;
+	memset(buff1,12,12);
+}
+void nobadFunc4_0(){
+	unsigned char * buff1 = globalBuff;
+	memset(buff1,12,12);
+}
+void nobadFunc4_1(){
+	unsigned char * buff1 = globalBuff+3;
+	memset(buff1,12,12);
+}
+void nobadFunc4_2(){
+	unsigned char * buff1 = globalBuff1.buff1;
+	memset(buff1,12,12);
+}
+void nobadFunc4_3(){
+	unsigned char * buff1 = globalBuff1.buff2;
+	memset(buff1,12,12);
+}
+void nobadFunc4_4(){
+	unsigned char * buff1 = globalBuff1.buff2+3;
+	memset(buff1,12,12);
+}
+void nobadFunc4_5(){
+	unsigned char * buff1 = globalBuff2->buff1;
+	memset(buff1,12,12);
+}
+void nobadFunc4_6(){
+	unsigned char * buff1 = globalBuff2->buff2;
+	memset(buff1,12,12);
+}
+

From c2a4235db8ada7107206ec95af5bf3f5548db0f2 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 13 Jan 2021 08:50:50 +0100
Subject: [PATCH 087/343] C#: Add type-mention tests with nullability

---
 .../typeMentions/nullable-disable/Program.cs  | 22 +++++++++++++++++++
 .../nullable-disable/TypeMentions.expected    | 19 ++++++++++++++++
 .../nullable-disable/TypeMentions.ql          |  4 ++++
 .../typeMentions/nullable-enable/Program.cs   | 22 +++++++++++++++++++
 .../nullable-enable/TypeMentions.expected     | 21 ++++++++++++++++++
 .../nullable-enable/TypeMentions.ql           |  4 ++++
 6 files changed, 92 insertions(+)
 create mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-disable/Program.cs
 create mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected
 create mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.ql
 create mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-enable/Program.cs
 create mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected
 create mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.ql

diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-disable/Program.cs b/csharp/ql/test/library-tests/typeMentions/nullable-disable/Program.cs
new file mode 100644
index 00000000000..b7627a992d7
--- /dev/null
+++ b/csharp/ql/test/library-tests/typeMentions/nullable-disable/Program.cs
@@ -0,0 +1,22 @@
+using System;
+
+#nullable disable
+
+public class Base { }
+public class Derived : Base { }
+public interface I0 { }
+public interface I1 : I0 { }
+public struct Str : I1 { }
+
+public class C1
+{
+    public void M1()
+    {
+        Derived? d0 = new Derived();
+        Derived d1 = new Derived();
+        Str? s0 = new Str();
+        Str s1 = new Str();
+        I1? i0 = new Str();
+        I1 i1 = new Str();
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected b/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected
new file mode 100644
index 00000000000..643dbc807fc
--- /dev/null
+++ b/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected
@@ -0,0 +1,19 @@
+| Program.cs:6:24:6:27 | Base |
+| Program.cs:6:24:6:27 | Base |
+| Program.cs:8:23:8:24 | I0 |
+| Program.cs:8:23:8:24 | I0 |
+| Program.cs:9:21:9:22 | I1 |
+| Program.cs:13:12:13:15 | Void |
+| Program.cs:15:9:15:15 | Derived |
+| Program.cs:15:27:15:33 | Derived |
+| Program.cs:16:9:16:15 | Derived |
+| Program.cs:16:26:16:32 | Derived |
+| Program.cs:17:9:17:11 | Str |
+| Program.cs:17:9:17:12 | Nullable<Str> |
+| Program.cs:17:23:17:25 | Str |
+| Program.cs:18:9:18:11 | Str |
+| Program.cs:18:22:18:24 | Str |
+| Program.cs:19:9:19:10 | I1 |
+| Program.cs:19:22:19:24 | Str |
+| Program.cs:20:9:20:10 | I1 |
+| Program.cs:20:21:20:23 | Str |
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.ql b/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.ql
new file mode 100644
index 00000000000..817a4fde7df
--- /dev/null
+++ b/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.ql
@@ -0,0 +1,4 @@
+import csharp
+
+from TypeMention tm
+select tm
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-enable/Program.cs b/csharp/ql/test/library-tests/typeMentions/nullable-enable/Program.cs
new file mode 100644
index 00000000000..6763ca2d2b1
--- /dev/null
+++ b/csharp/ql/test/library-tests/typeMentions/nullable-enable/Program.cs
@@ -0,0 +1,22 @@
+using System;
+
+#nullable enable
+
+public class Base { }
+public class Derived : Base { }
+public interface I0 { }
+public interface I1 : I0 { }
+public struct Str : I1 { }
+
+public class C1
+{
+    public void M1()
+    {
+        Derived? d0 = new Derived();
+        Derived d1 = new Derived();
+        Str? s0 = new Str();
+        Str s1 = new Str();
+        I1? i0 = new Str();
+        I1 i1 = new Str();
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected b/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected
new file mode 100644
index 00000000000..4c1108227dd
--- /dev/null
+++ b/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected
@@ -0,0 +1,21 @@
+| Program.cs:6:24:6:27 | Base |
+| Program.cs:6:24:6:27 | Base |
+| Program.cs:6:24:6:27 | Base |
+| Program.cs:8:23:8:24 | I0 |
+| Program.cs:8:23:8:24 | I0 |
+| Program.cs:8:23:8:24 | I0 |
+| Program.cs:9:21:9:22 | I1 |
+| Program.cs:13:12:13:15 | Void |
+| Program.cs:15:9:15:15 | Derived |
+| Program.cs:15:27:15:33 | Derived |
+| Program.cs:16:9:16:15 | Derived |
+| Program.cs:16:26:16:32 | Derived |
+| Program.cs:17:9:17:11 | Str |
+| Program.cs:17:9:17:12 | Nullable<Str> |
+| Program.cs:17:23:17:25 | Str |
+| Program.cs:18:9:18:11 | Str |
+| Program.cs:18:22:18:24 | Str |
+| Program.cs:19:9:19:10 | I1 |
+| Program.cs:19:22:19:24 | Str |
+| Program.cs:20:9:20:10 | I1 |
+| Program.cs:20:21:20:23 | Str |
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.ql b/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.ql
new file mode 100644
index 00000000000..817a4fde7df
--- /dev/null
+++ b/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.ql
@@ -0,0 +1,4 @@
+import csharp
+
+from TypeMention tm
+select tm

From c0e0bd2531a3d235711e25c5e492cbf502e9e8b7 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 13 Jan 2021 08:51:47 +0100
Subject: [PATCH 088/343] C#: Fix type mention extraction of named types with
 nullability enabled

---
 csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs | 4 ++--
 .../typeMentions/nullable-disable/TypeMentions.expected       | 2 --
 .../typeMentions/nullable-enable/TypeMentions.expected        | 4 ----
 3 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs b/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
index 530a30d8a51..6ea04c7ca9f 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
@@ -497,13 +497,13 @@ namespace Semmle.Extraction.CSharp
         /// <summary>
         /// Holds if this symbol is a source declaration.
         /// </summary>
-        public static bool IsSourceDeclaration(this ISymbol symbol) => SymbolEqualityComparer.Default.Equals(symbol, symbol.OriginalDefinition);
+        public static bool IsSourceDeclaration(this ISymbol symbol) => SymbolEqualityComparer.IncludeNullability.Equals(symbol, symbol.OriginalDefinition);
 
         /// <summary>
         /// Holds if this method is a source declaration.
         /// </summary>
         public static bool IsSourceDeclaration(this IMethodSymbol method) =>
-            IsSourceDeclaration((ISymbol)method) && SymbolEqualityComparer.Default.Equals(method, method.ConstructedFrom) && method.ReducedFrom == null;
+            IsSourceDeclaration((ISymbol)method) && SymbolEqualityComparer.IncludeNullability.Equals(method, method.ConstructedFrom) && method.ReducedFrom == null;
 
         /// <summary>
         /// Holds if this parameter is a source declaration.
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected b/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected
index 643dbc807fc..23c1fc21767 100644
--- a/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected
+++ b/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected
@@ -1,6 +1,4 @@
 | Program.cs:6:24:6:27 | Base |
-| Program.cs:6:24:6:27 | Base |
-| Program.cs:8:23:8:24 | I0 |
 | Program.cs:8:23:8:24 | I0 |
 | Program.cs:9:21:9:22 | I1 |
 | Program.cs:13:12:13:15 | Void |
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected b/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected
index 4c1108227dd..23c1fc21767 100644
--- a/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected
+++ b/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected
@@ -1,8 +1,4 @@
 | Program.cs:6:24:6:27 | Base |
-| Program.cs:6:24:6:27 | Base |
-| Program.cs:6:24:6:27 | Base |
-| Program.cs:8:23:8:24 | I0 |
-| Program.cs:8:23:8:24 | I0 |
 | Program.cs:8:23:8:24 | I0 |
 | Program.cs:9:21:9:22 | I1 |
 | Program.cs:13:12:13:15 | Void |

From 61b207f0675f1a62e9155305d0e80f5900625905 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 13 Jan 2021 13:24:48 +0100
Subject: [PATCH 089/343] Rework type mention test

---
 .../Program.cs => NullableDisabled.cs}        |  0
 .../Program.cs => NullableEnabled.cs}         |  4 +-
 .../typeMentions/TypeMentions.expected        | 37 +++++++++++++++++++
 .../typeMentions/TypeMentions.ql              | 29 +++++++++++++++
 .../nullable-disable/TypeMentions.expected    | 17 ---------
 .../nullable-disable/TypeMentions.ql          |  4 --
 .../nullable-enable/TypeMentions.expected     | 17 ---------
 .../nullable-enable/TypeMentions.ql           |  4 --
 8 files changed, 69 insertions(+), 43 deletions(-)
 rename csharp/ql/test/library-tests/typeMentions/{nullable-disable/Program.cs => NullableDisabled.cs} (100%)
 rename csharp/ql/test/library-tests/typeMentions/{nullable-enable/Program.cs => NullableEnabled.cs} (88%)
 create mode 100644 csharp/ql/test/library-tests/typeMentions/TypeMentions.expected
 create mode 100644 csharp/ql/test/library-tests/typeMentions/TypeMentions.ql
 delete mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected
 delete mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.ql
 delete mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected
 delete mode 100644 csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.ql

diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-disable/Program.cs b/csharp/ql/test/library-tests/typeMentions/NullableDisabled.cs
similarity index 100%
rename from csharp/ql/test/library-tests/typeMentions/nullable-disable/Program.cs
rename to csharp/ql/test/library-tests/typeMentions/NullableDisabled.cs
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-enable/Program.cs b/csharp/ql/test/library-tests/typeMentions/NullableEnabled.cs
similarity index 88%
rename from csharp/ql/test/library-tests/typeMentions/nullable-enable/Program.cs
rename to csharp/ql/test/library-tests/typeMentions/NullableEnabled.cs
index 6763ca2d2b1..e9240aa9d77 100644
--- a/csharp/ql/test/library-tests/typeMentions/nullable-enable/Program.cs
+++ b/csharp/ql/test/library-tests/typeMentions/NullableEnabled.cs
@@ -19,4 +19,6 @@ public class C1
         I1? i0 = new Str();
         I1 i1 = new Str();
     }
-}
\ No newline at end of file
+}
+
+// semmle-extractor-options: --separate-compilation
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/typeMentions/TypeMentions.expected b/csharp/ql/test/library-tests/typeMentions/TypeMentions.expected
new file mode 100644
index 00000000000..b0e69ebc377
--- /dev/null
+++ b/csharp/ql/test/library-tests/typeMentions/TypeMentions.expected
@@ -0,0 +1,37 @@
+typeMentions
+| NullableDisabled.cs:6:24:6:27 | Base |
+| NullableDisabled.cs:8:23:8:24 | I0 |
+| NullableDisabled.cs:9:21:9:22 | I1 |
+| NullableDisabled.cs:13:12:13:15 | Void |
+| NullableDisabled.cs:15:9:15:15 | Derived |
+| NullableDisabled.cs:15:27:15:33 | Derived |
+| NullableDisabled.cs:16:9:16:15 | Derived |
+| NullableDisabled.cs:16:26:16:32 | Derived |
+| NullableDisabled.cs:17:9:17:11 | Str |
+| NullableDisabled.cs:17:9:17:12 | Nullable<Str> |
+| NullableDisabled.cs:17:23:17:25 | Str |
+| NullableDisabled.cs:18:9:18:11 | Str |
+| NullableDisabled.cs:18:22:18:24 | Str |
+| NullableDisabled.cs:19:9:19:10 | I1 |
+| NullableDisabled.cs:19:22:19:24 | Str |
+| NullableDisabled.cs:20:9:20:10 | I1 |
+| NullableDisabled.cs:20:21:20:23 | Str |
+| NullableEnabled.cs:6:24:6:27 | Base |
+| NullableEnabled.cs:8:23:8:24 | I0 |
+| NullableEnabled.cs:9:21:9:22 | I1 |
+| NullableEnabled.cs:13:12:13:15 | Void |
+| NullableEnabled.cs:15:9:15:15 | Derived |
+| NullableEnabled.cs:15:27:15:33 | Derived |
+| NullableEnabled.cs:16:9:16:15 | Derived |
+| NullableEnabled.cs:16:26:16:32 | Derived |
+| NullableEnabled.cs:17:9:17:11 | Str |
+| NullableEnabled.cs:17:9:17:12 | Nullable<Str> |
+| NullableEnabled.cs:17:23:17:25 | Str |
+| NullableEnabled.cs:18:9:18:11 | Str |
+| NullableEnabled.cs:18:22:18:24 | Str |
+| NullableEnabled.cs:19:9:19:10 | I1 |
+| NullableEnabled.cs:19:22:19:24 | Str |
+| NullableEnabled.cs:20:9:20:10 | I1 |
+| NullableEnabled.cs:20:21:20:23 | Str |
+duplicates
+diff
diff --git a/csharp/ql/test/library-tests/typeMentions/TypeMentions.ql b/csharp/ql/test/library-tests/typeMentions/TypeMentions.ql
new file mode 100644
index 00000000000..abe0a12ed0e
--- /dev/null
+++ b/csharp/ql/test/library-tests/typeMentions/TypeMentions.ql
@@ -0,0 +1,29 @@
+import csharp
+
+private predicate matchingLineLoc(TypeMention tm0, TypeMention tm1) {
+  tm0.getLocation().getStartLine() = tm1.getLocation().getStartLine() and
+  tm0.getLocation().getEndLine() = tm1.getLocation().getEndLine() and
+  tm0.getLocation().getStartColumn() = tm1.getLocation().getStartColumn() and
+  tm0.getLocation().getEndColumn() = tm1.getLocation().getEndColumn()
+}
+
+private predicate matchingFile(TypeMention tm0, TypeMention tm1) {
+  tm0.getLocation().getFile().getStem() = tm1.getLocation().getFile().getStem()
+}
+
+query predicate typeMentions(TypeMention tm) { any() }
+
+query predicate duplicates(TypeMention tm) {
+  exists(TypeMention other |
+    matchingLineLoc(other, tm) and
+    matchingFile(other, tm) and
+    other != tm
+  )
+}
+
+query predicate diff(TypeMention tm) {
+  not exists(TypeMention other |
+    matchingLineLoc(other, tm) and
+    not matchingFile(other, tm)
+  )
+}
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected b/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected
deleted file mode 100644
index 23c1fc21767..00000000000
--- a/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.expected
+++ /dev/null
@@ -1,17 +0,0 @@
-| Program.cs:6:24:6:27 | Base |
-| Program.cs:8:23:8:24 | I0 |
-| Program.cs:9:21:9:22 | I1 |
-| Program.cs:13:12:13:15 | Void |
-| Program.cs:15:9:15:15 | Derived |
-| Program.cs:15:27:15:33 | Derived |
-| Program.cs:16:9:16:15 | Derived |
-| Program.cs:16:26:16:32 | Derived |
-| Program.cs:17:9:17:11 | Str |
-| Program.cs:17:9:17:12 | Nullable<Str> |
-| Program.cs:17:23:17:25 | Str |
-| Program.cs:18:9:18:11 | Str |
-| Program.cs:18:22:18:24 | Str |
-| Program.cs:19:9:19:10 | I1 |
-| Program.cs:19:22:19:24 | Str |
-| Program.cs:20:9:20:10 | I1 |
-| Program.cs:20:21:20:23 | Str |
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.ql b/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.ql
deleted file mode 100644
index 817a4fde7df..00000000000
--- a/csharp/ql/test/library-tests/typeMentions/nullable-disable/TypeMentions.ql
+++ /dev/null
@@ -1,4 +0,0 @@
-import csharp
-
-from TypeMention tm
-select tm
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected b/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected
deleted file mode 100644
index 23c1fc21767..00000000000
--- a/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.expected
+++ /dev/null
@@ -1,17 +0,0 @@
-| Program.cs:6:24:6:27 | Base |
-| Program.cs:8:23:8:24 | I0 |
-| Program.cs:9:21:9:22 | I1 |
-| Program.cs:13:12:13:15 | Void |
-| Program.cs:15:9:15:15 | Derived |
-| Program.cs:15:27:15:33 | Derived |
-| Program.cs:16:9:16:15 | Derived |
-| Program.cs:16:26:16:32 | Derived |
-| Program.cs:17:9:17:11 | Str |
-| Program.cs:17:9:17:12 | Nullable<Str> |
-| Program.cs:17:23:17:25 | Str |
-| Program.cs:18:9:18:11 | Str |
-| Program.cs:18:22:18:24 | Str |
-| Program.cs:19:9:19:10 | I1 |
-| Program.cs:19:22:19:24 | Str |
-| Program.cs:20:9:20:10 | I1 |
-| Program.cs:20:21:20:23 | Str |
diff --git a/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.ql b/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.ql
deleted file mode 100644
index 817a4fde7df..00000000000
--- a/csharp/ql/test/library-tests/typeMentions/nullable-enable/TypeMentions.ql
+++ /dev/null
@@ -1,4 +0,0 @@
-import csharp
-
-from TypeMention tm
-select tm

From 12b985be8748f5cd646639eb82aea560424f0bd0 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Wed, 13 Jan 2021 14:49:29 +0100
Subject: [PATCH 090/343] Update
 javascript/ql/src/Security/CWE-730/ServerCrash.ql

Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
---
 javascript/ql/src/Security/CWE-730/ServerCrash.ql | 1 +
 1 file changed, 1 insertion(+)

diff --git a/javascript/ql/src/Security/CWE-730/ServerCrash.ql b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
index 4df31174150..68607db011f 100644
--- a/javascript/ql/src/Security/CWE-730/ServerCrash.ql
+++ b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
@@ -40,6 +40,7 @@ Function invokedByRouteHandler(HTTP::RouteHandler rh) {
   // follow the immediate call graph
   exists(DataFlow::InvokeNode invk |
     result = invk.getACallee() and
+    // purposely not checking for `getEnclosingTryCatchStmt`. An async callback called from inside a try-catch can still crash the server.
     invk.getEnclosingFunction() = invokedByRouteHandler(rh)
   )
   // if new edges are added here, the `edges` predicate should be updated accordingly

From 1bc7d68a50f402641a6fb5ba555ad4c55d37b763 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Wed, 13 Jan 2021 14:49:42 +0100
Subject: [PATCH 091/343] Update
 javascript/ql/test/query-tests/Security/CWE-730/server-crash.js

Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
---
 .../ql/test/query-tests/Security/CWE-730/server-crash.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js b/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
index 7b61262ee92..b1e796cbd7a 100644
--- a/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
+++ b/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
@@ -70,4 +70,13 @@ app.get("/async-throw", (req, res) => {
   fs.readFile("/WHATEVER", (err, x) => {
     res.setHeader("reflected", unknown); // OK
   });
+
+  try {
+    indirection7();
+  } catch (e) {}
 });
+function indirection7() {
+  fs.readFile("/foo", (err, x) => {
+    throw err; // NOT OK
+  });
+}

From 12d602b798ee17205110e3a37a676bd7011690cd Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 13 Jan 2021 15:46:08 +0100
Subject: [PATCH 092/343] Add new .stats file

---
 .../ql/src/semmlecode.csharp.dbscheme.stats   | 5091 ++++++++---------
 1 file changed, 2542 insertions(+), 2549 deletions(-)

diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme.stats b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
index 185b464f7b6..f60c0b8ec1e 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme.stats
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
@@ -9,7 +9,7 @@
 </e>
 <e>
 <k>@extractor_message</k>
-<v>8324</v>
+<v>7682</v>
 </e>
 <e>
 <k>@externalDefect</k>
@@ -25,7 +25,7 @@
 </e>
 <e>
 <k>@duplication</k>
-<v>22778</v>
+<v>22774</v>
 </e>
 <e>
 <k>@similarity</k>
@@ -33,31 +33,31 @@
 </e>
 <e>
 <k>@location_default</k>
-<v>14071803</v>
+<v>14071854</v>
 </e>
 <e>
 <k>@assembly</k>
-<v>4206</v>
+<v>4205</v>
 </e>
 <e>
 <k>@file</k>
-<v>42547</v>
+<v>42539</v>
 </e>
 <e>
 <k>@folder</k>
-<v>16971</v>
+<v>16968</v>
 </e>
 <e>
 <k>@namespace</k>
-<v>21983</v>
+<v>21979</v>
 </e>
 <e>
 <k>@namespace_declaration</k>
-<v>19797</v>
+<v>19793</v>
 </e>
 <e>
 <k>@using_namespace_directive</k>
-<v>144525</v>
+<v>144498</v>
 </e>
 <e>
 <k>@using_static_directive</k>
@@ -117,23 +117,23 @@
 </e>
 <e>
 <k>@enum_type</k>
-<v>11975</v>
+<v>11972</v>
 </e>
 <e>
 <k>@struct_type</k>
-<v>49759</v>
+<v>49750</v>
 </e>
 <e>
 <k>@class_type</k>
-<v>305676</v>
+<v>305620</v>
 </e>
 <e>
 <k>@interface_type</k>
-<v>178449</v>
+<v>178417</v>
 </e>
 <e>
 <k>@delegate_type</k>
-<v>107770</v>
+<v>107750</v>
 </e>
 <e>
 <k>@null_type</k>
@@ -141,7 +141,7 @@
 </e>
 <e>
 <k>@type_parameter</k>
-<v>202980</v>
+<v>202943</v>
 </e>
 <e>
 <k>@pointer_type</k>
@@ -153,7 +153,7 @@
 </e>
 <e>
 <k>@array_type</k>
-<v>9139</v>
+<v>9138</v>
 </e>
 <e>
 <k>@void_type</k>
@@ -165,7 +165,7 @@
 </e>
 <e>
 <k>@tuple_type</k>
-<v>1786</v>
+<v>1785</v>
 </e>
 <e>
 <k>@uint_ptr_type</k>
@@ -185,15 +185,15 @@
 </e>
 <e>
 <k>@typeref</k>
-<v>235236</v>
+<v>235192</v>
 </e>
 <e>
 <k>@attribute</k>
-<v>750685</v>
+<v>750562</v>
 </e>
 <e>
 <k>@type_mention</k>
-<v>1269672</v>
+<v>1269461</v>
 </e>
 <e>
 <k>@oblivious</k>
@@ -205,11 +205,11 @@
 </e>
 <e>
 <k>@annotated</k>
-<v>120</v>
+<v>119</v>
 </e>
 <e>
 <k>@type_parameter_constraints</k>
-<v>611937</v>
+<v>611825</v>
 </e>
 <e>
 <k>@modifier</k>
@@ -217,47 +217,47 @@
 </e>
 <e>
 <k>@property</k>
-<v>424328</v>
+<v>424250</v>
 </e>
 <e>
 <k>@indexer</k>
-<v>17074</v>
+<v>17071</v>
 </e>
 <e>
 <k>@getter</k>
-<v>441168</v>
+<v>441087</v>
 </e>
 <e>
 <k>@setter</k>
-<v>127768</v>
+<v>127744</v>
 </e>
 <e>
 <k>@event</k>
-<v>15259</v>
+<v>15256</v>
 </e>
 <e>
 <k>@add_event_accessor</k>
-<v>15259</v>
+<v>15256</v>
 </e>
 <e>
 <k>@remove_event_accessor</k>
-<v>15259</v>
+<v>15256</v>
 </e>
 <e>
 <k>@operator</k>
-<v>12433</v>
+<v>12431</v>
 </e>
 <e>
 <k>@method</k>
-<v>1118739</v>
+<v>1118769</v>
 </e>
 <e>
 <k>@constructor</k>
-<v>278163</v>
+<v>278112</v>
 </e>
 <e>
 <k>@destructor</k>
-<v>444</v>
+<v>443</v>
 </e>
 <e>
 <k>@local_function</k>
@@ -265,15 +265,15 @@
 </e>
 <e>
 <k>@addressable_field</k>
-<v>371167</v>
+<v>371099</v>
 </e>
 <e>
 <k>@constant</k>
-<v>185564</v>
+<v>185530</v>
 </e>
 <e>
 <k>@addressable_local_variable</k>
-<v>162441</v>
+<v>162444</v>
 </e>
 <e>
 <k>@local_constant</k>
@@ -285,31 +285,31 @@
 </e>
 <e>
 <k>@parameter</k>
-<v>2422000</v>
+<v>2421790</v>
 </e>
 <e>
 <k>@block_stmt</k>
-<v>308628</v>
+<v>308574</v>
 </e>
 <e>
 <k>@expr_stmt</k>
-<v>367903</v>
+<v>367835</v>
 </e>
 <e>
 <k>@return_stmt</k>
-<v>96212</v>
+<v>96195</v>
 </e>
 <e>
 <k>@using_block_stmt</k>
-<v>1142</v>
+<v>1141</v>
 </e>
 <e>
 <k>@var_decl_stmt</k>
-<v>147912</v>
+<v>147915</v>
 </e>
 <e>
 <k>@if_stmt</k>
-<v>119194</v>
+<v>119173</v>
 </e>
 <e>
 <k>@switch_stmt</k>
@@ -317,7 +317,7 @@
 </e>
 <e>
 <k>@while_stmt</k>
-<v>4545</v>
+<v>4544</v>
 </e>
 <e>
 <k>@do_stmt</k>
@@ -325,15 +325,15 @@
 </e>
 <e>
 <k>@for_stmt</k>
-<v>6968</v>
+<v>6966</v>
 </e>
 <e>
 <k>@foreach_stmt</k>
-<v>5362</v>
+<v>5361</v>
 </e>
 <e>
 <k>@break_stmt</k>
-<v>10915</v>
+<v>10913</v>
 </e>
 <e>
 <k>@continue_stmt</k>
@@ -353,7 +353,7 @@
 </e>
 <e>
 <k>@throw_stmt</k>
-<v>74350</v>
+<v>74338</v>
 </e>
 <e>
 <k>@yield_stmt</k>
@@ -401,7 +401,7 @@
 </e>
 <e>
 <k>@case_stmt</k>
-<v>22450</v>
+<v>22446</v>
 </e>
 <e>
 <k>@local_function_stmt</k>
@@ -413,11 +413,11 @@
 </e>
 <e>
 <k>@bool_literal_expr</k>
-<v>69540</v>
+<v>69528</v>
 </e>
 <e>
 <k>@int_literal_expr</k>
-<v>756452</v>
+<v>755600</v>
 </e>
 <e>
 <k>@long_literal_expr</k>
@@ -429,63 +429,63 @@
 </e>
 <e>
 <k>@string_literal_expr</k>
-<v>412534</v>
+<v>412438</v>
 </e>
 <e>
 <k>@null_literal_expr</k>
-<v>107831</v>
+<v>107812</v>
 </e>
 <e>
 <k>@local_variable_access_expr</k>
-<v>524151</v>
+<v>524163</v>
 </e>
 <e>
 <k>@parameter_access_expr</k>
-<v>357639</v>
+<v>357577</v>
 </e>
 <e>
 <k>@field_access_expr</k>
-<v>460497</v>
+<v>460413</v>
 </e>
 <e>
 <k>@property_access_expr</k>
-<v>359783</v>
+<v>359717</v>
 </e>
 <e>
 <k>@type_access_expr</k>
-<v>346969</v>
+<v>347109</v>
 </e>
 <e>
 <k>@typeof_expr</k>
-<v>30103</v>
+<v>30098</v>
 </e>
 <e>
 <k>@method_invocation_expr</k>
-<v>548153</v>
+<v>548155</v>
 </e>
 <e>
 <k>@cast_expr</k>
-<v>262933</v>
+<v>262888</v>
 </e>
 <e>
 <k>@object_creation_expr</k>
-<v>62886</v>
+<v>62875</v>
 </e>
 <e>
 <k>@array_creation_expr</k>
-<v>179466</v>
+<v>179509</v>
 </e>
 <e>
 <k>@array_init_expr</k>
-<v>179290</v>
+<v>179049</v>
 </e>
 <e>
 <k>@local_var_decl_expr</k>
-<v>163747</v>
+<v>163750</v>
 </e>
 <e>
 <k>@char_literal_expr</k>
-<v>15902</v>
+<v>15899</v>
 </e>
 <e>
 <k>@decimal_literal_expr</k>
@@ -493,7 +493,7 @@
 </e>
 <e>
 <k>@uint_literal_expr</k>
-<v>2368</v>
+<v>2367</v>
 </e>
 <e>
 <k>@ulong_literal_expr</k>
@@ -505,11 +505,11 @@
 </e>
 <e>
 <k>@this_access_expr</k>
-<v>592935</v>
+<v>592827</v>
 </e>
 <e>
 <k>@base_access_expr</k>
-<v>2822</v>
+<v>2821</v>
 </e>
 <e>
 <k>@method_access_expr</k>
@@ -517,15 +517,15 @@
 </e>
 <e>
 <k>@event_access_expr</k>
-<v>431</v>
+<v>430</v>
 </e>
 <e>
 <k>@indexer_access_expr</k>
-<v>30815</v>
+<v>30810</v>
 </e>
 <e>
 <k>@array_access_expr</k>
-<v>19754</v>
+<v>19751</v>
 </e>
 <e>
 <k>@delegate_invocation_expr</k>
@@ -533,7 +533,7 @@
 </e>
 <e>
 <k>@operator_invocation_expr</k>
-<v>30005</v>
+<v>30001</v>
 </e>
 <e>
 <k>@explicit_delegate_creation_expr</k>
@@ -541,11 +541,11 @@
 </e>
 <e>
 <k>@implicit_delegate_creation_expr</k>
-<v>5118</v>
+<v>5117</v>
 </e>
 <e>
 <k>@default_expr</k>
-<v>6360</v>
+<v>6359</v>
 </e>
 <e>
 <k>@plus_expr</k>
@@ -553,7 +553,7 @@
 </e>
 <e>
 <k>@minus_expr</k>
-<v>7145</v>
+<v>7144</v>
 </e>
 <e>
 <k>@bit_not_expr</k>
@@ -561,11 +561,11 @@
 </e>
 <e>
 <k>@log_not_expr</k>
-<v>26433</v>
+<v>26429</v>
 </e>
 <e>
 <k>@post_incr_expr</k>
-<v>12570</v>
+<v>12567</v>
 </e>
 <e>
 <k>@post_decr_expr</k>
@@ -585,7 +585,7 @@
 </e>
 <e>
 <k>@div_expr</k>
-<v>1819</v>
+<v>1818</v>
 </e>
 <e>
 <k>@rem_expr</k>
@@ -593,11 +593,11 @@
 </e>
 <e>
 <k>@add_expr</k>
-<v>27890</v>
+<v>27885</v>
 </e>
 <e>
 <k>@sub_expr</k>
-<v>12846</v>
+<v>12844</v>
 </e>
 <e>
 <k>@lshift_expr</k>
@@ -609,31 +609,31 @@
 </e>
 <e>
 <k>@lt_expr</k>
-<v>16301</v>
+<v>16298</v>
 </e>
 <e>
 <k>@gt_expr</k>
-<v>9590</v>
+<v>9588</v>
 </e>
 <e>
 <k>@le_expr</k>
-<v>3898</v>
+<v>3897</v>
 </e>
 <e>
 <k>@ge_expr</k>
-<v>6285</v>
+<v>6283</v>
 </e>
 <e>
 <k>@eq_expr</k>
-<v>53935</v>
+<v>53925</v>
 </e>
 <e>
 <k>@ne_expr</k>
-<v>37966</v>
+<v>37960</v>
 </e>
 <e>
 <k>@bit_and_expr</k>
-<v>6332</v>
+<v>6331</v>
 </e>
 <e>
 <k>@bit_xor_expr</k>
@@ -641,35 +641,35 @@
 </e>
 <e>
 <k>@bit_or_expr</k>
-<v>14994</v>
+<v>14991</v>
 </e>
 <e>
 <k>@log_and_expr</k>
-<v>20839</v>
+<v>20835</v>
 </e>
 <e>
 <k>@log_or_expr</k>
-<v>14084</v>
+<v>14082</v>
 </e>
 <e>
 <k>@is_expr</k>
-<v>6720</v>
+<v>6719</v>
 </e>
 <e>
 <k>@as_expr</k>
-<v>2760</v>
+<v>2759</v>
 </e>
 <e>
 <k>@null_coalescing_expr</k>
-<v>3684</v>
+<v>3683</v>
 </e>
 <e>
 <k>@conditional_expr</k>
-<v>9158</v>
+<v>9156</v>
 </e>
 <e>
 <k>@simple_assign_expr</k>
-<v>167518</v>
+<v>167488</v>
 </e>
 <e>
 <k>@assign_add_expr</k>
@@ -713,7 +713,7 @@
 </e>
 <e>
 <k>@object_init_expr</k>
-<v>7700</v>
+<v>7698</v>
 </e>
 <e>
 <k>@collection_init_expr</k>
@@ -725,11 +725,11 @@
 </e>
 <e>
 <k>@unchecked_expr</k>
-<v>1422</v>
+<v>1421</v>
 </e>
 <e>
 <k>@constructor_init_expr</k>
-<v>5822</v>
+<v>5821</v>
 </e>
 <e>
 <k>@add_event_expr</k>
@@ -745,7 +745,7 @@
 </e>
 <e>
 <k>@lambda_expr</k>
-<v>48861</v>
+<v>48852</v>
 </e>
 <e>
 <k>@anonymous_method_expr</k>
@@ -761,11 +761,11 @@
 </e>
 <e>
 <k>@dynamic_member_access_expr</k>
-<v>6856</v>
+<v>6854</v>
 </e>
 <e>
 <k>@pointer_indirection_expr</k>
-<v>4060</v>
+<v>4059</v>
 </e>
 <e>
 <k>@address_of_expr</k>
@@ -773,15 +773,15 @@
 </e>
 <e>
 <k>@sizeof_expr</k>
-<v>1041</v>
+<v>1040</v>
 </e>
 <e>
 <k>@await_expr</k>
-<v>54853</v>
+<v>54843</v>
 </e>
 <e>
 <k>@nameof_expr</k>
-<v>15938</v>
+<v>15936</v>
 </e>
 <e>
 <k>@interpolated_string_expr</k>
@@ -837,7 +837,7 @@
 </e>
 <e>
 <k>@switch_case_expr</k>
-<v>4352</v>
+<v>4351</v>
 </e>
 <e>
 <k>@assign_coalesce_expr</k>
@@ -845,7 +845,7 @@
 </e>
 <e>
 <k>@suppress_nullable_warning_expr</k>
-<v>14409</v>
+<v>14407</v>
 </e>
 <e>
 <k>@namespace_access_expr</k>
@@ -877,19 +877,19 @@
 </e>
 <e>
 <k>@singlelinecomment</k>
-<v>184765</v>
+<v>184733</v>
 </e>
 <e>
 <k>@multilinecomment</k>
-<v>22113</v>
+<v>22109</v>
 </e>
 <e>
 <k>@xmldoccomment</k>
-<v>203763</v>
+<v>203727</v>
 </e>
 <e>
 <k>@commentblock</k>
-<v>144334</v>
+<v>144309</v>
 </e>
 <e>
 <k>@asp_close_tag</k>
@@ -929,7 +929,7 @@
 </e>
 <e>
 <k>@cil_nop</k>
-<v>820468</v>
+<v>820326</v>
 </e>
 <e>
 <k>@cil_break</k>
@@ -937,147 +937,147 @@
 </e>
 <e>
 <k>@cil_ldarg_0</k>
-<v>3977155</v>
+<v>3976427</v>
 </e>
 <e>
 <k>@cil_ldarg_1</k>
-<v>1217248</v>
+<v>1217025</v>
 </e>
 <e>
 <k>@cil_ldarg_2</k>
-<v>444091</v>
+<v>444010</v>
 </e>
 <e>
 <k>@cil_ldarg_3</k>
-<v>209265</v>
+<v>209227</v>
 </e>
 <e>
 <k>@cil_ldloc_0</k>
-<v>929705</v>
+<v>929535</v>
 </e>
 <e>
 <k>@cil_ldloc_1</k>
-<v>494163</v>
+<v>494072</v>
 </e>
 <e>
 <k>@cil_ldloc_2</k>
-<v>288860</v>
+<v>288807</v>
 </e>
 <e>
 <k>@cil_ldloc_3</k>
-<v>192152</v>
+<v>192116</v>
 </e>
 <e>
 <k>@cil_stloc_0</k>
-<v>525218</v>
+<v>525122</v>
 </e>
 <e>
 <k>@cil_stloc_1</k>
-<v>260635</v>
+<v>260587</v>
 </e>
 <e>
 <k>@cil_stloc_2</k>
-<v>198408</v>
+<v>198371</v>
 </e>
 <e>
 <k>@cil_stloc_3</k>
-<v>138366</v>
+<v>138341</v>
 </e>
 <e>
 <k>@cil_ldarg_s</k>
-<v>264646</v>
+<v>264598</v>
 </e>
 <e>
 <k>@cil_ldarga_s</k>
-<v>74807</v>
+<v>74793</v>
 </e>
 <e>
 <k>@cil_starg_s</k>
-<v>37193</v>
+<v>37187</v>
 </e>
 <e>
 <k>@cil_ldloc_s</k>
-<v>686711</v>
+<v>686585</v>
 </e>
 <e>
 <k>@cil_ldloca_s</k>
-<v>629558</v>
+<v>629443</v>
 </e>
 <e>
 <k>@cil_stloc_s</k>
-<v>481085</v>
+<v>480997</v>
 </e>
 <e>
 <k>@cil_ldnull</k>
-<v>604022</v>
+<v>603911</v>
 </e>
 <e>
 <k>@cil_ldc_i4_m1</k>
-<v>126265</v>
+<v>126241</v>
 </e>
 <e>
 <k>@cil_ldc_i4_0</k>
-<v>625898</v>
+<v>625784</v>
 </e>
 <e>
 <k>@cil_ldc_i4_1</k>
-<v>494905</v>
+<v>494814</v>
 </e>
 <e>
 <k>@cil_ldc_i4_2</k>
-<v>121092</v>
+<v>121070</v>
 </e>
 <e>
 <k>@cil_ldc_i4_3</k>
-<v>64184</v>
+<v>64172</v>
 </e>
 <e>
 <k>@cil_ldc_i4_4</k>
-<v>58909</v>
+<v>58898</v>
 </e>
 <e>
 <k>@cil_ldc_i4_5</k>
-<v>38701</v>
+<v>38694</v>
 </e>
 <e>
 <k>@cil_ldc_i4_6</k>
-<v>23276</v>
+<v>23272</v>
 </e>
 <e>
 <k>@cil_ldc_i4_7</k>
-<v>20763</v>
+<v>20759</v>
 </e>
 <e>
 <k>@cil_ldc_i4_8</k>
-<v>33499</v>
+<v>33493</v>
 </e>
 <e>
 <k>@cil_ldc_i4_s</k>
-<v>423547</v>
+<v>423470</v>
 </e>
 <e>
 <k>@cil_ldc_i4</k>
-<v>511111</v>
+<v>511017</v>
 </e>
 <e>
 <k>@cil_ldc_i8</k>
-<v>4889</v>
+<v>4888</v>
 </e>
 <e>
 <k>@cil_ldc_r4</k>
-<v>10267</v>
+<v>10265</v>
 </e>
 <e>
 <k>@cil_ldc_r8</k>
-<v>10335</v>
+<v>10333</v>
 </e>
 <e>
 <k>@cil_dup</k>
-<v>842616</v>
+<v>842461</v>
 </e>
 <e>
 <k>@cil_pop</k>
-<v>256594</v>
+<v>256547</v>
 </e>
 <e>
 <k>@cil_jmp</k>
@@ -1085,7 +1085,7 @@
 </e>
 <e>
 <k>@cil_call</k>
-<v>2743198</v>
+<v>2742696</v>
 </e>
 <e>
 <k>@cil_calli</k>
@@ -1093,55 +1093,55 @@
 </e>
 <e>
 <k>@cil_ret</k>
-<v>1787576</v>
+<v>1787248</v>
 </e>
 <e>
 <k>@cil_br_s</k>
-<v>346036</v>
+<v>345973</v>
 </e>
 <e>
 <k>@cil_brfalse_s</k>
-<v>466260</v>
+<v>466175</v>
 </e>
 <e>
 <k>@cil_brtrue_s</k>
-<v>430979</v>
+<v>430900</v>
 </e>
 <e>
 <k>@cil_beq_s</k>
-<v>82312</v>
+<v>82297</v>
 </e>
 <e>
 <k>@cil_bge_s</k>
-<v>34949</v>
+<v>34942</v>
 </e>
 <e>
 <k>@cil_bgt_s</k>
-<v>16508</v>
+<v>16505</v>
 </e>
 <e>
 <k>@cil_ble_s</k>
-<v>29220</v>
+<v>29214</v>
 </e>
 <e>
 <k>@cil_blt_s</k>
-<v>60973</v>
+<v>60962</v>
 </e>
 <e>
 <k>@cil_bne_un_s</k>
-<v>102724</v>
+<v>102706</v>
 </e>
 <e>
 <k>@cil_bge_un_s</k>
-<v>2186</v>
+<v>2185</v>
 </e>
 <e>
 <k>@cil_bgt_un_s</k>
-<v>8739</v>
+<v>8738</v>
 </e>
 <e>
 <k>@cil_ble_un_s</k>
-<v>6124</v>
+<v>6123</v>
 </e>
 <e>
 <k>@cil_blt_un_s</k>
@@ -1149,19 +1149,19 @@
 </e>
 <e>
 <k>@cil_br</k>
-<v>96220</v>
+<v>96202</v>
 </e>
 <e>
 <k>@cil_brfalse</k>
-<v>32416</v>
+<v>32410</v>
 </e>
 <e>
 <k>@cil_brtrue</k>
-<v>27351</v>
+<v>27346</v>
 </e>
 <e>
 <k>@cil_beq</k>
-<v>21524</v>
+<v>21520</v>
 </e>
 <e>
 <k>@cil_bge</k>
@@ -1173,15 +1173,15 @@
 </e>
 <e>
 <k>@cil_ble</k>
-<v>4645</v>
+<v>4644</v>
 </e>
 <e>
 <k>@cil_blt</k>
-<v>7939</v>
+<v>7937</v>
 </e>
 <e>
 <k>@cil_bne_un</k>
-<v>7241</v>
+<v>7240</v>
 </e>
 <e>
 <k>@cil_bge_un</k>
@@ -1201,7 +1201,7 @@
 </e>
 <e>
 <k>@cil_switch</k>
-<v>23896</v>
+<v>23892</v>
 </e>
 <e>
 <k>@cil_ldind_i1</k>
@@ -1209,7 +1209,7 @@
 </e>
 <e>
 <k>@cil_ldind_u1</k>
-<v>5514</v>
+<v>5513</v>
 </e>
 <e>
 <k>@cil_ldind_i2</k>
@@ -1217,11 +1217,11 @@
 </e>
 <e>
 <k>@cil_ldind_u2</k>
-<v>2446</v>
+<v>2445</v>
 </e>
 <e>
 <k>@cil_ldind_i4</k>
-<v>9784</v>
+<v>9782</v>
 </e>
 <e>
 <k>@cil_ldind_u4</k>
@@ -1245,27 +1245,27 @@
 </e>
 <e>
 <k>@cil_ldind_ref</k>
-<v>6660</v>
+<v>6659</v>
 </e>
 <e>
 <k>@cil_stind_ref</k>
-<v>16947</v>
+<v>16944</v>
 </e>
 <e>
 <k>@cil_stind_i1</k>
-<v>8529</v>
+<v>8528</v>
 </e>
 <e>
 <k>@cil_stind_i2</k>
-<v>1377</v>
+<v>1376</v>
 </e>
 <e>
 <k>@cil_stind_i4</k>
-<v>10369</v>
+<v>10367</v>
 </e>
 <e>
 <k>@cil_stind_i8</k>
-<v>2347</v>
+<v>2346</v>
 </e>
 <e>
 <k>@cil_stind_r4</k>
@@ -1277,19 +1277,19 @@
 </e>
 <e>
 <k>@cil_add</k>
-<v>224134</v>
+<v>224093</v>
 </e>
 <e>
 <k>@cil_sub</k>
-<v>85342</v>
+<v>85327</v>
 </e>
 <e>
 <k>@cil_mul</k>
-<v>29971</v>
+<v>29966</v>
 </e>
 <e>
 <k>@cil_div</k>
-<v>9130</v>
+<v>9128</v>
 </e>
 <e>
 <k>@cil_div_un</k>
@@ -1305,35 +1305,35 @@
 </e>
 <e>
 <k>@cil_and</k>
-<v>59377</v>
+<v>59366</v>
 </e>
 <e>
 <k>@cil_or</k>
-<v>22164</v>
+<v>22160</v>
 </e>
 <e>
 <k>@cil_xor</k>
-<v>22730</v>
+<v>22725</v>
 </e>
 <e>
 <k>@cil_shl</k>
-<v>18982</v>
+<v>18978</v>
 </e>
 <e>
 <k>@cil_shr</k>
-<v>9183</v>
+<v>9182</v>
 </e>
 <e>
 <k>@cil_shr_un</k>
-<v>26126</v>
+<v>26121</v>
 </e>
 <e>
 <k>@cil_neg</k>
-<v>2337</v>
+<v>2336</v>
 </e>
 <e>
 <k>@cil_not</k>
-<v>1459</v>
+<v>1458</v>
 </e>
 <e>
 <k>@cil_conv_i1</k>
@@ -1345,31 +1345,31 @@
 </e>
 <e>
 <k>@cil_conv_i4</k>
-<v>59821</v>
+<v>59810</v>
 </e>
 <e>
 <k>@cil_conv_i8</k>
-<v>50325</v>
+<v>50316</v>
 </e>
 <e>
 <k>@cil_conv_r4</k>
-<v>2469</v>
+<v>2468</v>
 </e>
 <e>
 <k>@cil_conv_r8</k>
-<v>5284</v>
+<v>5283</v>
 </e>
 <e>
 <k>@cil_conv_u4</k>
-<v>7836</v>
+<v>7835</v>
 </e>
 <e>
 <k>@cil_conv_u8</k>
-<v>19558</v>
+<v>19554</v>
 </e>
 <e>
 <k>@cil_callvirt</k>
-<v>2051871</v>
+<v>2051495</v>
 </e>
 <e>
 <k>@cil_cpobj</k>
@@ -1377,23 +1377,23 @@
 </e>
 <e>
 <k>@cil_ldobj</k>
-<v>12663</v>
+<v>12660</v>
 </e>
 <e>
 <k>@cil_ldstr</k>
-<v>927407</v>
+<v>927237</v>
 </e>
 <e>
 <k>@cil_newobj</k>
-<v>657539</v>
+<v>657419</v>
 </e>
 <e>
 <k>@cil_castclass</k>
-<v>97137</v>
+<v>97119</v>
 </e>
 <e>
 <k>@cil_isinst</k>
-<v>56488</v>
+<v>56478</v>
 </e>
 <e>
 <k>@cil_conv_r_un</k>
@@ -1405,23 +1405,23 @@
 </e>
 <e>
 <k>@cil_throw</k>
-<v>381498</v>
+<v>381428</v>
 </e>
 <e>
 <k>@cil_ldfld</k>
-<v>1677892</v>
+<v>1677585</v>
 </e>
 <e>
 <k>@cil_ldflda</k>
-<v>300918</v>
+<v>300863</v>
 </e>
 <e>
 <k>@cil_stfld</k>
-<v>1073860</v>
+<v>1073663</v>
 </e>
 <e>
 <k>@cil_ldsfld</k>
-<v>407629</v>
+<v>407555</v>
 </e>
 <e>
 <k>@cil_ldsflda</k>
@@ -1429,11 +1429,11 @@
 </e>
 <e>
 <k>@cil_stsfld</k>
-<v>131013</v>
+<v>130989</v>
 </e>
 <e>
 <k>@cil_stobj</k>
-<v>7026</v>
+<v>7025</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1_un</k>
@@ -1477,19 +1477,19 @@
 </e>
 <e>
 <k>@cil_box</k>
-<v>79897</v>
+<v>79882</v>
 </e>
 <e>
 <k>@cil_newarr</k>
-<v>112191</v>
+<v>112171</v>
 </e>
 <e>
 <k>@cil_ldlen</k>
-<v>55371</v>
+<v>55361</v>
 </e>
 <e>
 <k>@cil_ldelema</k>
-<v>9876</v>
+<v>9874</v>
 </e>
 <e>
 <k>@cil_ldelem_i1</k>
@@ -1497,7 +1497,7 @@
 </e>
 <e>
 <k>@cil_ldelem_u1</k>
-<v>15586</v>
+<v>15583</v>
 </e>
 <e>
 <k>@cil_ldelem_i2</k>
@@ -1505,19 +1505,19 @@
 </e>
 <e>
 <k>@cil_ldelem_u2</k>
-<v>6094</v>
+<v>6093</v>
 </e>
 <e>
 <k>@cil_ldelem_i4</k>
-<v>17596</v>
+<v>17593</v>
 </e>
 <e>
 <k>@cil_ldelem_u4</k>
-<v>19128</v>
+<v>19125</v>
 </e>
 <e>
 <k>@cil_ldelem_i8</k>
-<v>11931</v>
+<v>11928</v>
 </e>
 <e>
 <k>@cil_ldelem_i</k>
@@ -1525,7 +1525,7 @@
 </e>
 <e>
 <k>@cil_ldelem_r4</k>
-<v>283</v>
+<v>282</v>
 </e>
 <e>
 <k>@cil_ldelem_r8</k>
@@ -1533,7 +1533,7 @@
 </e>
 <e>
 <k>@cil_ldelem_ref</k>
-<v>30723</v>
+<v>30717</v>
 </e>
 <e>
 <k>@cil_stelem_i</k>
@@ -1541,19 +1541,19 @@
 </e>
 <e>
 <k>@cil_stelem_i1</k>
-<v>8798</v>
+<v>8796</v>
 </e>
 <e>
 <k>@cil_stelem_i2</k>
-<v>8993</v>
+<v>8991</v>
 </e>
 <e>
 <k>@cil_stelem_i4</k>
-<v>22842</v>
+<v>22838</v>
 </e>
 <e>
 <k>@cil_stelem_i8</k>
-<v>9432</v>
+<v>9430</v>
 </e>
 <e>
 <k>@cil_stelem_r4</k>
@@ -1565,7 +1565,7 @@
 </e>
 <e>
 <k>@cil_stelem_ref</k>
-<v>363209</v>
+<v>363142</v>
 </e>
 <e>
 <k>@cil_ldelem</k>
@@ -1573,11 +1573,11 @@
 </e>
 <e>
 <k>@cil_stelem</k>
-<v>53658</v>
+<v>53648</v>
 </e>
 <e>
 <k>@cil_unbox_any</k>
-<v>14400</v>
+<v>14397</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1</k>
@@ -1625,15 +1625,15 @@
 </e>
 <e>
 <k>@cil_ldtoken</k>
-<v>71367</v>
+<v>71354</v>
 </e>
 <e>
 <k>@cil_conv_u2</k>
-<v>4343</v>
+<v>4342</v>
 </e>
 <e>
 <k>@cil_conv_u1</k>
-<v>11267</v>
+<v>11265</v>
 </e>
 <e>
 <k>@cil_conv_i</k>
@@ -1657,7 +1657,7 @@
 </e>
 <e>
 <k>@cil_mul_ovf</k>
-<v>444</v>
+<v>443</v>
 </e>
 <e>
 <k>@cil_mul_ovf_un</k>
@@ -1673,15 +1673,15 @@
 </e>
 <e>
 <k>@cil_endfinally</k>
-<v>56942</v>
+<v>56932</v>
 </e>
 <e>
 <k>@cil_leave</k>
-<v>66911</v>
+<v>66899</v>
 </e>
 <e>
 <k>@cil_leave_s</k>
-<v>149453</v>
+<v>149426</v>
 </e>
 <e>
 <k>@cil_stind_i</k>
@@ -1689,7 +1689,7 @@
 </e>
 <e>
 <k>@cil_conv_u</k>
-<v>5812</v>
+<v>5811</v>
 </e>
 <e>
 <k>@cil_arglist</k>
@@ -1697,19 +1697,19 @@
 </e>
 <e>
 <k>@cil_ceq</k>
-<v>97040</v>
+<v>97023</v>
 </e>
 <e>
 <k>@cil_cgt</k>
-<v>11575</v>
+<v>11573</v>
 </e>
 <e>
 <k>@cil_cgt_un</k>
-<v>36734</v>
+<v>36728</v>
 </e>
 <e>
 <k>@cil_clt</k>
-<v>19535</v>
+<v>19532</v>
 </e>
 <e>
 <k>@cil_clt_un</k>
@@ -1717,7 +1717,7 @@
 </e>
 <e>
 <k>@cil_ldftn</k>
-<v>79989</v>
+<v>79975</v>
 </e>
 <e>
 <k>@cil_ldvirtftn</k>
@@ -1753,7 +1753,7 @@
 </e>
 <e>
 <k>@cil_endfilter</k>
-<v>810</v>
+<v>809</v>
 </e>
 <e>
 <k>@cil_unaligned</k>
@@ -1761,7 +1761,7 @@
 </e>
 <e>
 <k>@cil_volatile</k>
-<v>8544</v>
+<v>8542</v>
 </e>
 <e>
 <k>@cil_tail</k>
@@ -1769,11 +1769,11 @@
 </e>
 <e>
 <k>@cil_initobj</k>
-<v>101851</v>
+<v>101832</v>
 </e>
 <e>
 <k>@cil_constrained</k>
-<v>25331</v>
+<v>25326</v>
 </e>
 <e>
 <k>@cil_cpblk</k>
@@ -1785,7 +1785,7 @@
 </e>
 <e>
 <k>@cil_rethrow</k>
-<v>3772</v>
+<v>3771</v>
 </e>
 <e>
 <k>@cil_sizeof</k>
@@ -1801,15 +1801,15 @@
 </e>
 <e>
 <k>@cil_valueorreftype</k>
-<v>596336</v>
+<v>596227</v>
 </e>
 <e>
 <k>@cil_typeparameter</k>
-<v>185100</v>
+<v>185066</v>
 </e>
 <e>
 <k>@cil_array_type</k>
-<v>14195</v>
+<v>14192</v>
 </e>
 <e>
 <k>@cil_pointer_type</k>
@@ -1817,43 +1817,43 @@
 </e>
 <e>
 <k>@cil_method</k>
-<v>2316098</v>
+<v>2315674</v>
 </e>
 <e>
 <k>@cil_method_implementation</k>
-<v>1728950</v>
+<v>1728633</v>
 </e>
 <e>
 <k>@cil_field</k>
-<v>1010208</v>
+<v>1010023</v>
 </e>
 <e>
 <k>@cil_parameter</k>
-<v>4555008</v>
+<v>4554173</v>
 </e>
 <e>
 <k>@cil_property</k>
-<v>380610</v>
+<v>380540</v>
 </e>
 <e>
 <k>@cil_event</k>
-<v>20880</v>
+<v>20876</v>
 </e>
 <e>
 <k>@cil_local_variable</k>
-<v>1152771</v>
+<v>1152560</v>
 </e>
 <e>
 <k>@cil_catch_handler</k>
-<v>43888</v>
+<v>43880</v>
 </e>
 <e>
 <k>@cil_filter_handler</k>
-<v>810</v>
+<v>809</v>
 </e>
 <e>
 <k>@cil_finally_handler</k>
-<v>55468</v>
+<v>55458</v>
 </e>
 <e>
 <k>@cil_fault_handler</k>
@@ -1861,7 +1861,7 @@
 </e>
 <e>
 <k>@cil_attribute</k>
-<v>328879</v>
+<v>328819</v>
 </e>
 </typesizes>
   <stats><relation>
@@ -1919,7 +1919,7 @@
 </relation>
 <relation>
 <name>compilation_args</name>
-<cardinality>4894</cardinality>
+<cardinality>4630</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -1945,12 +1945,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>595</v>
+<v>858</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>502</v>
+<v>239</v>
 </b>
 </bs>
 </hist>
@@ -1966,12 +1966,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>595</v>
+<v>858</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>502</v>
+<v>239</v>
 </b>
 </bs>
 </hist>
@@ -1985,8 +1985,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>103</a>
-<b>104</b>
+<a>49</a>
+<b>50</b>
 <v>4</v>
 </b>
 <b>
@@ -2011,13 +2011,13 @@
 <v>14</v>
 </b>
 <b>
-<a>103</a>
-<b>104</b>
+<a>49</a>
+<b>50</b>
 <v>4</v>
 </b>
 <b>
-<a>123</a>
-<b>124</b>
+<a>177</a>
+<b>178</b>
 <v>4</v>
 </b>
 </bs>
@@ -2037,7 +2037,7 @@
 <v>1097</v>
 </b>
 <b>
-<a>103</a>
+<a>49</a>
 <b>226</b>
 <v>24</v>
 </b>
@@ -2070,7 +2070,7 @@
 </relation>
 <relation>
 <name>compilation_compiling_files</name>
-<cardinality>22627</cardinality>
+<cardinality>22623</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -2082,7 +2082,7 @@
 </e>
 <e>
 <k>file</k>
-<v>22622</v>
+<v>22618</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2420,7 +2420,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22617</v>
+<v>22613</v>
 </b>
 <b>
 <a>2</a>
@@ -2441,7 +2441,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22617</v>
+<v>22613</v>
 </b>
 <b>
 <a>2</a>
@@ -2456,7 +2456,7 @@
 </relation>
 <relation>
 <name>compilation_referencing_files</name>
-<cardinality>359939</cardinality>
+<cardinality>359873</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -2464,7 +2464,7 @@
 </e>
 <e>
 <k>num</k>
-<v>2747</v>
+<v>2746</v>
 </e>
 <e>
 <k>file</k>
@@ -2689,58 +2689,58 @@
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>9</v>
-</b>
-<b>
-<a>5</a>
 <b>6</b>
-<v>619</v>
+<v>239</v>
 </b>
 <b>
 <a>6</a>
-<b>19</b>
+<b>7</b>
+<v>468</v>
+</b>
+<b>
+<a>7</a>
+<b>20</b>
 <v>219</v>
 </b>
 <b>
-<a>19</a>
-<b>24</b>
+<a>20</a>
+<b>25</b>
 <v>209</v>
 </b>
 <b>
-<a>24</a>
-<b>31</b>
-<v>209</v>
-</b>
-<b>
-<a>31</a>
-<b>36</b>
-<v>243</v>
-</b>
-<b>
-<a>36</a>
-<b>48</b>
-<v>219</v>
-</b>
-<b>
-<a>48</a>
-<b>60</b>
-<v>209</v>
-</b>
-<b>
-<a>60</a>
-<b>64</b>
-<v>204</v>
-</b>
-<b>
-<a>64</a>
-<b>67</b>
+<a>25</a>
+<b>30</b>
 <v>229</v>
 </b>
 <b>
-<a>67</a>
-<b>74</b>
-<v>151</v>
+<a>30</a>
+<b>36</b>
+<v>209</v>
+</b>
+<b>
+<a>36</a>
+<b>47</b>
+<v>209</v>
+</b>
+<b>
+<a>47</a>
+<b>59</b>
+<v>253</v>
+</b>
+<b>
+<a>59</a>
+<b>61</b>
+<v>185</v>
+</b>
+<b>
+<a>61</a>
+<b>64</b>
+<v>209</v>
+</b>
+<b>
+<a>64</a>
+<b>69</b>
+<v>92</v>
 </b>
 </bs>
 </hist>
@@ -2756,7 +2756,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>527</v>
+<v>526</v>
 </b>
 <b>
 <a>2</a>
@@ -2827,57 +2827,62 @@
 <b>
 <a>2</a>
 <b>5</b>
-<v>268</v>
+<v>258</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>224</v>
+<v>190</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>263</v>
-</b>
-<b>
-<a>7</a>
-<b>11</b>
-<v>302</v>
-</b>
-<b>
-<a>11</a>
-<b>20</b>
-<v>258</v>
-</b>
-<b>
-<a>20</a>
-<b>26</b>
-<v>287</v>
-</b>
-<b>
-<a>26</a>
-<b>31</b>
-<v>263</v>
-</b>
-<b>
-<a>31</a>
-<b>61</b>
-<v>258</v>
-</b>
-<b>
-<a>61</a>
-<b>66</b>
 <v>312</v>
 </b>
 <b>
-<a>66</a>
+<a>7</a>
+<b>10</b>
+<v>258</v>
+</b>
+<b>
+<a>10</a>
+<b>18</b>
+<v>268</v>
+</b>
+<b>
+<a>18</a>
+<b>22</b>
+<v>243</v>
+</b>
+<b>
+<a>22</a>
+<b>26</b>
+<v>268</v>
+</b>
+<b>
+<a>26</a>
+<b>38</b>
+<v>258</v>
+</b>
+<b>
+<a>38</a>
+<b>61</b>
+<v>253</v>
+</b>
+<b>
+<a>61</a>
+<b>64</b>
+<v>273</v>
+</b>
+<b>
+<a>64</a>
 <b>69</b>
 <v>258</v>
 </b>
 <b>
 <a>69</a>
-<b>76</b>
-<v>161</v>
+<b>72</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -2887,7 +2892,7 @@
 </relation>
 <relation>
 <name>compilation_time</name>
-<cardinality>7685</cardinality>
+<cardinality>7684</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -2903,7 +2908,7 @@
 </e>
 <e>
 <k>seconds</k>
-<v>5763</v>
+<v>5298</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2949,12 +2954,12 @@
 <b>
 <a>6</a>
 <b>7</b>
-<v>9</v>
+<v>4</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>1088</v>
+<v>1092</v>
 </b>
 </bs>
 </hist>
@@ -3000,8 +3005,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1181</a>
-<b>1182</b>
+<a>1086</a>
+<b>1087</b>
 <v>4</v>
 </b>
 </bs>
@@ -3048,8 +3053,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>163</a>
-<b>164</b>
+<a>149</a>
+<b>150</b>
+<v>4</v>
+</b>
+<b>
+<a>152</a>
+<b>153</b>
+<v>4</v>
+</b>
+<b>
+<a>167</a>
+<b>168</b>
 <v>4</v>
 </b>
 <b>
@@ -3058,24 +3073,9 @@
 <v>4</v>
 </b>
 <b>
-<a>183</a>
-<b>184</b>
-<v>4</v>
-</b>
-<b>
-<a>185</a>
-<b>186</b>
-<v>4</v>
-</b>
-<b>
-<a>223</a>
-<b>224</b>
-<v>4</v>
-</b>
-<b>
 <a>225</a>
 <b>226</b>
-<v>9</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -3091,22 +3091,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4655</v>
+<v>4142</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>580</v>
+<v>502</v>
 </b>
 <b>
 <a>3</a>
-<b>5</b>
-<v>468</v>
+<b>4</b>
+<v>351</v>
 </b>
 <b>
-<a>5</a>
-<b>8</b>
-<v>58</v>
+<a>4</a>
+<b>10</b>
+<v>302</v>
 </b>
 </bs>
 </hist>
@@ -3122,7 +3122,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5763</v>
+<v>5298</v>
 </b>
 </bs>
 </hist>
@@ -3138,17 +3138,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4948</v>
+<v>4376</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>702</v>
+<v>756</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>112</v>
+<v>165</v>
 </b>
 </bs>
 </hist>
@@ -4391,11 +4391,11 @@
 </relation>
 <relation>
 <name>extractor_messages</name>
-<cardinality>8324</cardinality>
+<cardinality>7682</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>8324</v>
+<v>7682</v>
 </e>
 <e>
 <k>severity</k>
@@ -4411,7 +4411,7 @@
 </e>
 <e>
 <k>entity</k>
-<v>5344</v>
+<v>5342</v>
 </e>
 <e>
 <k>location</k>
@@ -4419,7 +4419,7 @@
 </e>
 <e>
 <k>stack_trace</k>
-<v>212</v>
+<v>279</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -4433,7 +4433,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8324</v>
+<v>7682</v>
 </b>
 </bs>
 </hist>
@@ -4449,7 +4449,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8324</v>
+<v>7682</v>
 </b>
 </bs>
 </hist>
@@ -4465,7 +4465,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8324</v>
+<v>7682</v>
 </b>
 </bs>
 </hist>
@@ -4481,7 +4481,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8324</v>
+<v>7682</v>
 </b>
 </bs>
 </hist>
@@ -4497,7 +4497,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8324</v>
+<v>7682</v>
 </b>
 </bs>
 </hist>
@@ -4513,7 +4513,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8324</v>
+<v>7682</v>
 </b>
 </bs>
 </hist>
@@ -4537,8 +4537,8 @@
 <v>1</v>
 </b>
 <b>
-<a>8295</a>
-<b>8296</b>
+<a>7653</a>
+<b>7654</b>
 <v>1</v>
 </b>
 </bs>
@@ -4600,8 +4600,8 @@
 <v>1</v>
 </b>
 <b>
-<a>5338</a>
-<b>5339</b>
+<a>5336</a>
+<b>5337</b>
 <v>1</v>
 </b>
 </bs>
@@ -4647,8 +4647,8 @@
 <v>2</v>
 </b>
 <b>
-<a>211</a>
-<b>212</b>
+<a>278</a>
+<b>279</b>
 <v>1</v>
 </b>
 </bs>
@@ -4663,8 +4663,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>8324</a>
-<b>8325</b>
+<a>7682</a>
+<b>7683</b>
 <v>1</v>
 </b>
 </bs>
@@ -4711,8 +4711,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>5344</a>
-<b>5345</b>
+<a>5342</a>
+<b>5343</b>
 <v>1</v>
 </b>
 </bs>
@@ -4743,8 +4743,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>212</a>
-<b>213</b>
+<a>279</a>
+<b>280</b>
 <v>1</v>
 </b>
 </bs>
@@ -4769,6 +4769,11 @@
 <v>1</v>
 </b>
 <b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
 <a>11</a>
 <b>12</b>
 <v>1</v>
@@ -4804,11 +4809,6 @@
 <v>1</v>
 </b>
 <b>
-<a>650</a>
-<b>651</b>
-<v>1</v>
-</b>
-<b>
 <a>2411</a>
 <b>2412</b>
 <v>1</v>
@@ -4864,12 +4864,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>1</v>
+<v>3</v>
 </b>
 <b>
 <a>5</a>
@@ -4994,33 +4989,33 @@
 <v>4</v>
 </b>
 <b>
-<a>2</a>
-<b>3</b>
-<v>2</v>
-</b>
-<b>
 <a>3</a>
 <b>4</b>
-<v>1</v>
-</b>
-<b>
-<a>7</a>
-<b>8</b>
-<v>1</v>
-</b>
-<b>
-<a>9</a>
-<b>10</b>
 <v>2</v>
 </b>
 <b>
-<a>54</a>
-<b>55</b>
+<a>4</a>
+<b>5</b>
 <v>1</v>
 </b>
 <b>
-<a>123</a>
-<b>124</b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>2</v>
+</b>
+<b>
+<a>71</a>
+<b>72</b>
+<v>1</v>
+</b>
+<b>
+<a>170</a>
+<b>171</b>
 <v>1</v>
 </b>
 </bs>
@@ -5046,8 +5041,8 @@
 </b>
 <b>
 <a>3</a>
-<b>384</b>
-<v>293</v>
+<b>133</b>
+<v>291</v>
 </b>
 </bs>
 </hist>
@@ -5063,7 +5058,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5344</v>
+<v>5342</v>
 </b>
 </bs>
 </hist>
@@ -5079,7 +5074,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5344</v>
+<v>5342</v>
 </b>
 </bs>
 </hist>
@@ -5095,7 +5090,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5335</v>
+<v>5333</v>
 </b>
 <b>
 <a>2</a>
@@ -5116,7 +5111,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4656</v>
+<v>4654</v>
 </b>
 <b>
 <a>2</a>
@@ -5142,12 +5137,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5275</v>
+<v>5239</v>
 </b>
 <b>
 <a>2</a>
-<b>6</b>
-<v>69</v>
+<b>7</b>
+<v>103</v>
 </b>
 </bs>
 </hist>
@@ -5171,8 +5166,8 @@
 <v>911</v>
 </b>
 <b>
-<a>655</a>
-<b>656</b>
+<a>13</a>
+<b>14</b>
 <v>1</v>
 </b>
 </bs>
@@ -5250,8 +5245,8 @@
 <v>6758</v>
 </b>
 <b>
-<a>4</a>
-<b>5</b>
+<a>2</a>
+<b>3</b>
 <v>1</v>
 </b>
 </bs>
@@ -5268,12 +5263,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6742</v>
+<v>6736</v>
 </b>
 <b>
 <a>2</a>
-<b>9</b>
-<v>17</v>
+<b>7</b>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -5289,48 +5284,48 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>56</v>
+<v>85</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>45</v>
+<v>48</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13</v>
+<v>24</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>18</v>
+<v>23</v>
 </b>
 <b>
 <a>6</a>
-<b>9</b>
-<v>17</v>
+<b>8</b>
+<v>18</v>
 </b>
 <b>
-<a>9</a>
-<b>14</b>
+<a>8</a>
+<b>11</b>
+<v>23</v>
+</b>
+<b>
+<a>11</a>
+<b>30</b>
+<v>21</v>
+</b>
+<b>
+<a>30</a>
+<b>88</b>
+<v>21</v>
+</b>
+<b>
+<a>93</a>
+<b>1003</b>
 <v>16</v>
 </b>
-<b>
-<a>14</a>
-<b>43</b>
-<v>16</v>
-</b>
-<b>
-<a>48</a>
-<b>122</b>
-<v>16</v>
-</b>
-<b>
-<a>168</a>
-<b>1169</b>
-<v>15</v>
-</b>
 </bs>
 </hist>
 </val>
@@ -5345,7 +5340,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>211</v>
+<v>278</v>
 </b>
 <b>
 <a>2</a>
@@ -5366,7 +5361,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212</v>
+<v>279</v>
 </b>
 </bs>
 </hist>
@@ -5382,7 +5377,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>211</v>
+<v>278</v>
 </b>
 <b>
 <a>2</a>
@@ -5403,42 +5398,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78</v>
+<v>100</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>40</v>
+<v>47</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18</v>
+<v>26</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>14</v>
+<v>25</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>17</v>
+<v>25</v>
 </b>
 <b>
 <a>9</a>
-<b>20</b>
-<v>16</v>
+<b>21</b>
+<v>21</v>
 </b>
 <b>
-<a>20</a>
-<b>87</b>
-<v>16</v>
+<a>22</a>
+<b>70</b>
+<v>21</v>
 </b>
 <b>
-<a>108</a>
-<b>942</b>
-<v>13</v>
+<a>71</a>
+<b>808</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -5454,47 +5449,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70</v>
+<v>94</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41</v>
+<v>44</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>16</v>
+<v>27</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>19</v>
+<v>25</v>
 </b>
 <b>
 <a>6</a>
-<b>10</b>
-<v>16</v>
+<b>9</b>
+<v>22</v>
 </b>
 <b>
-<a>10</a>
-<b>16</b>
-<v>16</v>
+<a>9</a>
+<b>14</b>
+<v>24</v>
 </b>
 <b>
-<a>17</a>
-<b>77</b>
-<v>16</v>
+<a>14</a>
+<b>66</b>
+<v>21</v>
 </b>
 <b>
-<a>81</a>
-<b>434</b>
-<v>16</v>
+<a>68</a>
+<b>596</b>
+<v>21</v>
 </b>
 <b>
-<a>684</a>
-<b>1169</b>
-<v>2</v>
+<a>1002</a>
+<b>1003</b>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -5512,7 +5507,7 @@
 </e>
 <e>
 <k>cpu_seconds</k>
-<v>980</v>
+<v>936</v>
 </e>
 <e>
 <k>elapsed_seconds</k>
@@ -5562,7 +5557,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>868</v>
+<v>805</v>
 </b>
 <b>
 <a>2</a>
@@ -5571,8 +5566,8 @@
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>4</v>
+<b>5</b>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -5588,7 +5583,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>868</v>
+<v>805</v>
 </b>
 <b>
 <a>2</a>
@@ -5597,8 +5592,8 @@
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>4</v>
+<b>5</b>
+<v>24</v>
 </b>
 </bs>
 </hist>
@@ -5639,6 +5634,54 @@
 </dependencies>
 </relation>
 <relation>
+<name>compilation_assembly</name>
+<cardinality>1097</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1097</v>
+</e>
+<e>
+<k>assembly</k>
+<v>1097</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>assembly</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1097</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>assembly</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1097</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
 <name>externalDefects</name>
 <cardinality>0</cardinality>
 <columnsizes>
@@ -6292,19 +6335,19 @@
 </relation>
 <relation>
 <name>duplicateCode</name>
-<cardinality>22778</cardinality>
+<cardinality>22774</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>22778</v>
+<v>22774</v>
 </e>
 <e>
 <k>relativePath</k>
-<v>3811</v>
+<v>3810</v>
 </e>
 <e>
 <k>equivClass</k>
-<v>7022</v>
+<v>7020</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -6318,7 +6361,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22778</v>
+<v>22774</v>
 </b>
 </bs>
 </hist>
@@ -6334,7 +6377,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22778</v>
+<v>22774</v>
 </b>
 </bs>
 </hist>
@@ -6355,7 +6398,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>566</v>
+<v>565</v>
 </b>
 <b>
 <a>3</a>
@@ -6411,7 +6454,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1132</v>
+<v>1131</v>
 </b>
 <b>
 <a>2</a>
@@ -6421,7 +6464,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>444</v>
+<v>443</v>
 </b>
 <b>
 <a>4</a>
@@ -6472,7 +6515,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3772</v>
+<v>3771</v>
 </b>
 <b>
 <a>3</a>
@@ -6518,7 +6561,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3445</v>
+<v>3444</v>
 </b>
 <b>
 <a>3</a>
@@ -8621,11 +8664,11 @@
 </relation>
 <relation>
 <name>locations_default</name>
-<cardinality>14071803</cardinality>
+<cardinality>14071854</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14071803</v>
+<v>14071854</v>
 </e>
 <e>
 <k>file</k>
@@ -8659,7 +8702,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071803</v>
+<v>14071854</v>
 </b>
 </bs>
 </hist>
@@ -8675,7 +8718,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071803</v>
+<v>14071854</v>
 </b>
 </bs>
 </hist>
@@ -8691,7 +8734,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071803</v>
+<v>14071854</v>
 </b>
 </bs>
 </hist>
@@ -8707,7 +8750,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071803</v>
+<v>14071854</v>
 </b>
 </bs>
 </hist>
@@ -8723,7 +8766,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071803</v>
+<v>14071854</v>
 </b>
 </bs>
 </hist>
@@ -8769,37 +8812,37 @@
 <b>
 <a>150</a>
 <b>208</b>
-<v>470</v>
+<v>471</v>
 </b>
 <b>
 <a>208</a>
-<b>296</b>
-<v>468</v>
+<b>297</b>
+<v>472</v>
 </b>
 <b>
-<a>296</a>
-<b>445</b>
-<v>468</v>
-</b>
-<b>
-<a>445</a>
-<b>685</b>
+<a>297</a>
+<b>446</b>
 <v>469</v>
 </b>
 <b>
-<a>685</a>
-<b>1200</b>
+<a>446</a>
+<b>693</b>
+<v>469</v>
+</b>
+<b>
+<a>693</a>
+<b>1208</b>
 <v>468</v>
 </b>
 <b>
-<a>1200</a>
-<b>2633</b>
+<a>1209</a>
+<b>2677</b>
 <v>468</v>
 </b>
 <b>
-<a>2635</a>
+<a>2691</a>
 <b>42820</b>
-<v>494</v>
+<v>488</v>
 </b>
 <b>
 <a>43087</a>
@@ -9183,7 +9226,7 @@
 </b>
 <b>
 <a>301</a>
-<b>10783</b>
+<b>10788</b>
 <v>9050</v>
 </b>
 </bs>
@@ -9473,7 +9516,7 @@
 </b>
 <b>
 <a>76216</a>
-<b>2221239</b>
+<b>2221242</b>
 <v>24</v>
 </b>
 </bs>
@@ -10839,19 +10882,19 @@
 </relation>
 <relation>
 <name>assemblies</name>
-<cardinality>4206</cardinality>
+<cardinality>4205</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4206</v>
+<v>4205</v>
 </e>
 <e>
 <k>file</k>
-<v>4206</v>
+<v>4205</v>
 </e>
 <e>
 <k>fullname</k>
-<v>3445</v>
+<v>3444</v>
 </e>
 <e>
 <k>name</k>
@@ -10873,7 +10916,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4206</v>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -10889,7 +10932,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4206</v>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -10905,7 +10948,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4206</v>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -10921,7 +10964,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4206</v>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -10937,7 +10980,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4206</v>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -10953,7 +10996,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4206</v>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -10969,7 +11012,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4206</v>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -10985,7 +11028,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4206</v>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -11043,7 +11086,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3445</v>
+<v>3444</v>
 </b>
 </bs>
 </hist>
@@ -11059,7 +11102,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3445</v>
+<v>3444</v>
 </b>
 </bs>
 </hist>
@@ -11075,7 +11118,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2191</v>
+<v>2190</v>
 </b>
 <b>
 <a>2</a>
@@ -11101,7 +11144,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2191</v>
+<v>2190</v>
 </b>
 <b>
 <a>2</a>
@@ -11127,7 +11170,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2952</v>
+<v>2951</v>
 </b>
 <b>
 <a>2</a>
@@ -11148,7 +11191,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2952</v>
+<v>2951</v>
 </b>
 <b>
 <a>2</a>
@@ -11327,19 +11370,19 @@
 </relation>
 <relation>
 <name>files</name>
-<cardinality>42547</cardinality>
+<cardinality>42539</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42547</v>
+<v>42539</v>
 </e>
 <e>
 <k>name</k>
-<v>42547</v>
+<v>42539</v>
 </e>
 <e>
 <k>simple</k>
-<v>22979</v>
+<v>22974</v>
 </e>
 <e>
 <k>ext</k>
@@ -11361,7 +11404,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42547</v>
+<v>42539</v>
 </b>
 </bs>
 </hist>
@@ -11377,7 +11420,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42547</v>
+<v>42539</v>
 </b>
 </bs>
 </hist>
@@ -11393,7 +11436,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42547</v>
+<v>42539</v>
 </b>
 </bs>
 </hist>
@@ -11409,7 +11452,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42547</v>
+<v>42539</v>
 </b>
 </bs>
 </hist>
@@ -11425,7 +11468,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42547</v>
+<v>42539</v>
 </b>
 </bs>
 </hist>
@@ -11441,7 +11484,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42547</v>
+<v>42539</v>
 </b>
 </bs>
 </hist>
@@ -11457,7 +11500,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42547</v>
+<v>42539</v>
 </b>
 </bs>
 </hist>
@@ -11473,7 +11516,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42547</v>
+<v>42539</v>
 </b>
 </bs>
 </hist>
@@ -11489,7 +11532,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21568</v>
+<v>21564</v>
 </b>
 <b>
 <a>2</a>
@@ -11510,7 +11553,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21568</v>
+<v>21564</v>
 </b>
 <b>
 <a>2</a>
@@ -11531,7 +11574,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22188</v>
+<v>22184</v>
 </b>
 <b>
 <a>2</a>
@@ -11552,7 +11595,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22979</v>
+<v>22974</v>
 </b>
 </bs>
 </hist>
@@ -11790,19 +11833,19 @@
 </relation>
 <relation>
 <name>folders</name>
-<cardinality>16971</cardinality>
+<cardinality>16968</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16971</v>
+<v>16968</v>
 </e>
 <e>
 <k>name</k>
-<v>14751</v>
+<v>14748</v>
 </e>
 <e>
 <k>simple</k>
-<v>2781</v>
+<v>2780</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -11816,7 +11859,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16971</v>
+<v>16968</v>
 </b>
 </bs>
 </hist>
@@ -11832,7 +11875,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16971</v>
+<v>16968</v>
 </b>
 </bs>
 </hist>
@@ -11848,7 +11891,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14751</v>
+<v>14748</v>
 </b>
 </bs>
 </hist>
@@ -11864,12 +11907,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12531</v>
+<v>12529</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2220</v>
+<v>2219</v>
 </b>
 </bs>
 </hist>
@@ -11885,7 +11928,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1825</v>
+<v>1824</v>
 </b>
 <b>
 <a>2</a>
@@ -11921,7 +11964,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1825</v>
+<v>1824</v>
 </b>
 <b>
 <a>2</a>
@@ -11951,15 +11994,15 @@
 </relation>
 <relation>
 <name>containerparent</name>
-<cardinality>57288</cardinality>
+<cardinality>57278</cardinality>
 <columnsizes>
 <e>
 <k>parent</k>
-<v>14751</v>
+<v>14748</v>
 </e>
 <e>
 <k>child</k>
-<v>57288</v>
+<v>57278</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -11973,22 +12016,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8271</v>
+<v>8269</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1942</v>
+<v>1941</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>771</v>
+<v>770</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>971</v>
+<v>970</v>
 </b>
 <b>
 <a>5</a>
@@ -12019,7 +12062,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>57288</v>
+<v>57278</v>
 </b>
 </bs>
 </hist>
@@ -12029,11 +12072,11 @@
 </relation>
 <relation>
 <name>file_extraction_mode</name>
-<cardinality>26829</cardinality>
+<cardinality>26824</cardinality>
 <columnsizes>
 <e>
 <k>file</k>
-<v>26829</v>
+<v>26824</v>
 </e>
 <e>
 <k>mode</k>
@@ -12051,7 +12094,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26829</v>
+<v>26824</v>
 </b>
 </bs>
 </hist>
@@ -12077,15 +12120,15 @@
 </relation>
 <relation>
 <name>namespaces</name>
-<cardinality>21983</cardinality>
+<cardinality>21979</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>21983</v>
+<v>21979</v>
 </e>
 <e>
 <k>name</k>
-<v>4899</v>
+<v>4898</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12099,7 +12142,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21983</v>
+<v>21979</v>
 </b>
 </bs>
 </hist>
@@ -12155,15 +12198,15 @@
 </relation>
 <relation>
 <name>namespace_declarations</name>
-<cardinality>19797</cardinality>
+<cardinality>19793</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19797</v>
+<v>19793</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>3894</v>
+<v>3893</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12177,7 +12220,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19797</v>
+<v>19793</v>
 </b>
 </bs>
 </hist>
@@ -12238,15 +12281,15 @@
 </relation>
 <relation>
 <name>namespace_declaration_location</name>
-<cardinality>19797</cardinality>
+<cardinality>19793</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19797</v>
+<v>19793</v>
 </e>
 <e>
 <k>loc</k>
-<v>19797</v>
+<v>19793</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12260,7 +12303,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19797</v>
+<v>19793</v>
 </b>
 </bs>
 </hist>
@@ -12276,7 +12319,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19797</v>
+<v>19793</v>
 </b>
 </bs>
 </hist>
@@ -12286,15 +12329,15 @@
 </relation>
 <relation>
 <name>parent_namespace</name>
-<cardinality>778529</cardinality>
+<cardinality>778386</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>778529</v>
+<v>778386</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>13580</v>
+<v>13578</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12308,7 +12351,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>778529</v>
+<v>778386</v>
 </b>
 </bs>
 </hist>
@@ -12344,12 +12387,12 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>1254</v>
+<v>1253</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>1093</v>
+<v>1092</v>
 </b>
 <b>
 <a>10</a>
@@ -12384,15 +12427,15 @@
 </relation>
 <relation>
 <name>parent_namespace_declaration</name>
-<cardinality>88470</cardinality>
+<cardinality>88454</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>87953</v>
+<v>87937</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>19797</v>
+<v>19793</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12406,7 +12449,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87802</v>
+<v>87786</v>
 </b>
 <b>
 <a>2</a>
@@ -12427,7 +12470,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13804</v>
+<v>13802</v>
 </b>
 <b>
 <a>2</a>
@@ -12462,15 +12505,15 @@
 </relation>
 <relation>
 <name>using_namespace_directives</name>
-<cardinality>144525</cardinality>
+<cardinality>144498</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144525</v>
+<v>144498</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>4235</v>
+<v>4234</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12484,7 +12527,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144525</v>
+<v>144498</v>
 </b>
 </bs>
 </hist>
@@ -12500,7 +12543,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1498</v>
+<v>1497</v>
 </b>
 <b>
 <a>2</a>
@@ -12643,15 +12686,15 @@
 </relation>
 <relation>
 <name>using_directive_location</name>
-<cardinality>144583</cardinality>
+<cardinality>144557</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144583</v>
+<v>144557</v>
 </e>
 <e>
 <k>loc</k>
-<v>144539</v>
+<v>144513</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12665,7 +12708,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144583</v>
+<v>144557</v>
 </b>
 </bs>
 </hist>
@@ -12681,7 +12724,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144496</v>
+<v>144469</v>
 </b>
 <b>
 <a>2</a>
@@ -12696,11 +12739,11 @@
 </relation>
 <relation>
 <name>types</name>
-<cardinality>868805</cardinality>
+<cardinality>868646</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>868805</v>
+<v>868646</v>
 </e>
 <e>
 <k>kind</k>
@@ -12708,7 +12751,7 @@
 </e>
 <e>
 <k>name</k>
-<v>367552</v>
+<v>367484</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12722,7 +12765,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>868805</v>
+<v>868646</v>
 </b>
 </bs>
 </hist>
@@ -12738,7 +12781,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>868805</v>
+<v>868646</v>
 </b>
 </bs>
 </hist>
@@ -12836,17 +12879,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>325224</v>
+<v>325164</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>28893</v>
+<v>28888</v>
 </b>
 <b>
 <a>5</a>
 <b>6356</b>
-<v>13434</v>
+<v>13431</v>
 </b>
 </bs>
 </hist>
@@ -12862,7 +12905,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>366112</v>
+<v>366045</v>
 </b>
 <b>
 <a>2</a>
@@ -12877,15 +12920,15 @@
 </relation>
 <relation>
 <name>typerefs</name>
-<cardinality>235236</cardinality>
+<cardinality>235192</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235236</v>
+<v>235192</v>
 </e>
 <e>
 <k>name</k>
-<v>177317</v>
+<v>177285</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12899,7 +12942,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235236</v>
+<v>235192</v>
 </b>
 </bs>
 </hist>
@@ -12915,12 +12958,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162741</v>
+<v>162711</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>13507</v>
+<v>13504</v>
 </b>
 <b>
 <a>7</a>
@@ -12935,15 +12978,15 @@
 </relation>
 <relation>
 <name>typeref_type</name>
-<cardinality>235055</cardinality>
+<cardinality>235012</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235055</v>
+<v>235012</v>
 </e>
 <e>
 <k>typeId</k>
-<v>235055</v>
+<v>235012</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12957,7 +13000,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235055</v>
+<v>235012</v>
 </b>
 </bs>
 </hist>
@@ -12973,7 +13016,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235055</v>
+<v>235012</v>
 </b>
 </bs>
 </hist>
@@ -12983,11 +13026,11 @@
 </relation>
 <relation>
 <name>array_element_type</name>
-<cardinality>9139</cardinality>
+<cardinality>9138</cardinality>
 <columnsizes>
 <e>
 <k>array</k>
-<v>9139</v>
+<v>9138</v>
 </e>
 <e>
 <k>dimension</k>
@@ -12999,7 +13042,7 @@
 </e>
 <e>
 <k>element</k>
-<v>9130</v>
+<v>9128</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13013,7 +13056,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9139</v>
+<v>9138</v>
 </b>
 </bs>
 </hist>
@@ -13029,7 +13072,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9139</v>
+<v>9138</v>
 </b>
 </bs>
 </hist>
@@ -13045,7 +13088,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9139</v>
+<v>9138</v>
 </b>
 </bs>
 </hist>
@@ -13187,7 +13230,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9120</v>
+<v>9118</v>
 </b>
 <b>
 <a>2</a>
@@ -13208,7 +13251,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9130</v>
+<v>9128</v>
 </b>
 </bs>
 </hist>
@@ -13224,7 +13267,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9120</v>
+<v>9118</v>
 </b>
 <b>
 <a>2</a>
@@ -13335,11 +13378,11 @@
 </relation>
 <relation>
 <name>enum_underlying_type</name>
-<cardinality>11975</cardinality>
+<cardinality>11972</cardinality>
 <columnsizes>
 <e>
 <k>enum_id</k>
-<v>11975</v>
+<v>11972</v>
 </e>
 <e>
 <k>underlying_type_id</k>
@@ -13357,7 +13400,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11975</v>
+<v>11972</v>
 </b>
 </bs>
 </hist>
@@ -13413,15 +13456,15 @@
 </relation>
 <relation>
 <name>delegate_return_type</name>
-<cardinality>107755</cardinality>
+<cardinality>107736</cardinality>
 <columnsizes>
 <e>
 <k>delegate_id</k>
-<v>107755</v>
+<v>107736</v>
 </e>
 <e>
 <k>return_type_id</k>
-<v>55615</v>
+<v>55604</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13435,7 +13478,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107755</v>
+<v>107736</v>
 </b>
 </bs>
 </hist>
@@ -13451,12 +13494,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52296</v>
+<v>52287</v>
 </b>
 <b>
 <a>2</a>
 <b>4178</b>
-<v>3318</v>
+<v>3317</v>
 </b>
 </bs>
 </hist>
@@ -13466,15 +13509,15 @@
 </relation>
 <relation>
 <name>extend</name>
-<cardinality>324097</cardinality>
+<cardinality>324037</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>324097</v>
+<v>324037</v>
 </e>
 <e>
 <k>super</k>
-<v>31626</v>
+<v>31620</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13488,7 +13531,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>324097</v>
+<v>324037</v>
 </b>
 </bs>
 </hist>
@@ -13504,7 +13547,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22671</v>
+<v>22667</v>
 </b>
 <b>
 <a>2</a>
@@ -13514,12 +13557,12 @@
 <b>
 <a>3</a>
 <b>5</b>
-<v>2420</v>
+<v>2419</v>
 </b>
 <b>
 <a>5</a>
 <b>70</b>
-<v>2381</v>
+<v>2380</v>
 </b>
 <b>
 <a>70</a>
@@ -13534,26 +13577,26 @@
 </relation>
 <relation>
 <name>anonymous_types</name>
-<cardinality>1215</cardinality>
+<cardinality>1214</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1215</v>
+<v>1214</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>implement</name>
-<cardinality>542649</cardinality>
+<cardinality>542549</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>226779</v>
+<v>226737</v>
 </e>
 <e>
 <k>super</k>
-<v>122775</v>
+<v>122753</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13567,27 +13610,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100963</v>
+<v>100944</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>57152</v>
+<v>57141</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>36178</v>
+<v>36172</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>19006</v>
+<v>19003</v>
 </b>
 <b>
 <a>7</a>
 <b>21</b>
-<v>13478</v>
+<v>13475</v>
 </b>
 </bs>
 </hist>
@@ -13603,27 +13646,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>67077</v>
+<v>67065</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29840</v>
+<v>29834</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10267</v>
+<v>10265</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>8710</v>
+<v>8708</v>
 </b>
 <b>
 <a>6</a>
 <b>21807</b>
-<v>6880</v>
+<v>6879</v>
 </b>
 </bs>
 </hist>
@@ -13633,15 +13676,15 @@
 </relation>
 <relation>
 <name>type_location</name>
-<cardinality>554736</cardinality>
+<cardinality>554634</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>467846</v>
+<v>467760</v>
 </e>
 <e>
 <k>loc</k>
-<v>29932</v>
+<v>29927</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13655,17 +13698,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>408156</v>
+<v>408082</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39306</v>
+<v>39299</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>20382</v>
+<v>20379</v>
 </b>
 </bs>
 </hist>
@@ -13681,7 +13724,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26053</v>
+<v>26048</v>
 </b>
 <b>
 <a>2</a>
@@ -13701,11 +13744,11 @@
 </relation>
 <relation>
 <name>tuple_underlying_type</name>
-<cardinality>1786</cardinality>
+<cardinality>1785</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>1786</v>
+<v>1785</v>
 </e>
 <e>
 <k>struct</k>
@@ -13723,7 +13766,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1786</v>
+<v>1785</v>
 </b>
 </bs>
 </hist>
@@ -13759,11 +13802,11 @@
 </relation>
 <relation>
 <name>tuple_element</name>
-<cardinality>6802</cardinality>
+<cardinality>6801</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>1781</v>
+<v>1780</v>
 </e>
 <e>
 <k>index</k>
@@ -13771,7 +13814,7 @@
 </e>
 <e>
 <k>field</k>
-<v>6802</v>
+<v>6801</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14109,7 +14152,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6802</v>
+<v>6801</v>
 </b>
 </bs>
 </hist>
@@ -14125,7 +14168,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6802</v>
+<v>6801</v>
 </b>
 </bs>
 </hist>
@@ -14135,11 +14178,11 @@
 </relation>
 <relation>
 <name>attributes</name>
-<cardinality>750685</cardinality>
+<cardinality>750562</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>750685</v>
+<v>750562</v>
 </e>
 <e>
 <k>type_id</k>
@@ -14147,7 +14190,7 @@
 </e>
 <e>
 <k>target</k>
-<v>429862</v>
+<v>429793</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14161,7 +14204,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750685</v>
+<v>750562</v>
 </b>
 </bs>
 </hist>
@@ -14177,7 +14220,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750685</v>
+<v>750562</v>
 </b>
 </bs>
 </hist>
@@ -14252,7 +14295,7 @@
 </b>
 <b>
 <a>5204</a>
-<b>41857</b>
+<b>41859</b>
 <v>19</v>
 </b>
 </bs>
@@ -14323,7 +14366,7 @@
 </b>
 <b>
 <a>562</a>
-<b>39377</b>
+<b>39379</b>
 <v>117</v>
 </b>
 </bs>
@@ -14340,17 +14383,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>366258</v>
+<v>366196</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48900</v>
+<v>48896</v>
 </b>
 <b>
 <a>3</a>
 <b>957</b>
-<v>14702</v>
+<v>14700</v>
 </b>
 </bs>
 </hist>
@@ -14366,12 +14409,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>395527</v>
+<v>395465</v>
 </b>
 <b>
 <a>2</a>
 <b>15</b>
-<v>33509</v>
+<v>33503</v>
 </b>
 <b>
 <a>15</a>
@@ -14386,15 +14429,15 @@
 </relation>
 <relation>
 <name>attribute_location</name>
-<cardinality>818870</cardinality>
+<cardinality>818735</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>750685</v>
+<v>750562</v>
 </e>
 <e>
 <k>loc</k>
-<v>72465</v>
+<v>72451</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14408,12 +14451,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>682499</v>
+<v>682389</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>68185</v>
+<v>68173</v>
 </b>
 </bs>
 </hist>
@@ -14429,12 +14472,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68253</v>
+<v>68241</v>
 </b>
 <b>
 <a>4</a>
 <b>26710</b>
-<v>4211</v>
+<v>4210</v>
 </b>
 </bs>
 </hist>
@@ -14444,19 +14487,19 @@
 </relation>
 <relation>
 <name>type_mention</name>
-<cardinality>1269672</cardinality>
+<cardinality>1269461</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1269672</v>
+<v>1269461</v>
 </e>
 <e>
 <k>type_id</k>
-<v>34470</v>
+<v>34464</v>
 </e>
 <e>
 <k>parent</k>
-<v>1029037</v>
+<v>1028868</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14470,7 +14513,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1269672</v>
+<v>1269461</v>
 </b>
 </bs>
 </hist>
@@ -14486,7 +14529,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1269672</v>
+<v>1269461</v>
 </b>
 </bs>
 </hist>
@@ -14502,22 +14545,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4966</v>
+<v>4965</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6800</v>
+<v>6798</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3386</v>
+<v>3385</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4027</v>
+<v>4026</v>
 </b>
 <b>
 <a>5</a>
@@ -14527,12 +14570,12 @@
 <b>
 <a>6</a>
 <b>8</b>
-<v>2905</v>
+<v>2904</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>2804</v>
+<v>2803</v>
 </b>
 <b>
 <a>12</a>
@@ -14542,7 +14585,7 @@
 <b>
 <a>20</a>
 <b>51</b>
-<v>2586</v>
+<v>2585</v>
 </b>
 <b>
 <a>51</a>
@@ -14563,12 +14606,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9470</v>
+<v>9468</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5705</v>
+<v>5704</v>
 </b>
 <b>
 <a>3</a>
@@ -14578,12 +14621,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>3002</v>
+<v>3001</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1948</v>
+<v>1947</v>
 </b>
 <b>
 <a>6</a>
@@ -14598,7 +14641,7 @@
 <b>
 <a>13</a>
 <b>29</b>
-<v>2631</v>
+<v>2630</v>
 </b>
 <b>
 <a>29</a>
@@ -14624,17 +14667,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>871267</v>
+<v>871125</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137410</v>
+<v>137386</v>
 </b>
 <b>
 <a>3</a>
 <b>342</b>
-<v>20359</v>
+<v>20356</v>
 </b>
 </bs>
 </hist>
@@ -14650,12 +14693,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1008350</v>
+<v>1008184</v>
 </b>
 <b>
 <a>2</a>
 <b>22</b>
-<v>20687</v>
+<v>20683</v>
 </b>
 </bs>
 </hist>
@@ -14665,15 +14708,15 @@
 </relation>
 <relation>
 <name>type_mention_location</name>
-<cardinality>1269672</cardinality>
+<cardinality>1269461</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1269672</v>
+<v>1269461</v>
 </e>
 <e>
 <k>loc</k>
-<v>1140168</v>
+<v>1139970</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14687,7 +14730,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1269672</v>
+<v>1269461</v>
 </b>
 </bs>
 </hist>
@@ -14703,12 +14746,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1077652</v>
+<v>1077465</v>
 </b>
 <b>
 <a>2</a>
 <b>199</b>
-<v>62516</v>
+<v>62504</v>
 </b>
 </bs>
 </hist>
@@ -14718,11 +14761,11 @@
 </relation>
 <relation>
 <name>type_annotation</name>
-<cardinality>51023</cardinality>
+<cardinality>51013</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>51023</v>
+<v>51013</v>
 </e>
 <e>
 <k>annotation</k>
@@ -14740,7 +14783,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51023</v>
+<v>51013</v>
 </b>
 </bs>
 </hist>
@@ -14834,7 +14877,7 @@
 </relation>
 <relation>
 <name>nullability_parent</name>
-<cardinality>6290</cardinality>
+<cardinality>6288</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
@@ -14846,7 +14889,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>1986</v>
+<v>1985</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15155,15 +15198,15 @@
 </relation>
 <relation>
 <name>type_nullability</name>
-<cardinality>4610901</cardinality>
+<cardinality>4610461</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4536257</v>
+<v>4535975</v>
 </e>
 <e>
 <k>nullability</k>
-<v>967</v>
+<v>965</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15177,12 +15220,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4470528</v>
+<v>4470328</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>65729</v>
+<v>65647</v>
 </b>
 </bs>
 </hist>
@@ -15203,57 +15246,57 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>149</v>
+<v>147</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>56</v>
+<v>54</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>67</v>
+<v>70</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>82</v>
+<v>85</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>68</v>
+<v>65</v>
 </b>
 <b>
 <a>10</a>
 <b>14</b>
-<v>73</v>
+<v>74</v>
 </b>
 <b>
 <a>14</a>
 <b>23</b>
-<v>79</v>
+<v>77</v>
 </b>
 <b>
 <a>23</a>
-<b>43</b>
+<b>45</b>
+<v>75</v>
+</b>
+<b>
+<a>45</a>
+<b>123</b>
+<v>74</v>
+</b>
+<b>
+<a>124</a>
+<b>4643</b>
 <v>73</v>
 </b>
 <b>
-<a>44</a>
-<b>121</b>
-<v>73</v>
-</b>
-<b>
-<a>121</a>
-<b>3088</b>
-<v>73</v>
-</b>
-<b>
-<a>3396</a>
-<b>3685234</b>
-<v>13</v>
+<a>5100</a>
+<b>3685112</b>
+<v>10</v>
 </b>
 </bs>
 </hist>
@@ -15263,11 +15306,11 @@
 </relation>
 <relation>
 <name>expr_flowstate</name>
-<cardinality>2995349</cardinality>
+<cardinality>2994827</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2995349</v>
+<v>2994827</v>
 </e>
 <e>
 <k>state</k>
@@ -15285,7 +15328,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2995349</v>
+<v>2994827</v>
 </b>
 </bs>
 </hist>
@@ -15316,11 +15359,11 @@
 </relation>
 <relation>
 <name>type_parameters</name>
-<cardinality>203068</cardinality>
+<cardinality>203031</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>203068</v>
+<v>203031</v>
 </e>
 <e>
 <k>index</k>
@@ -15328,7 +15371,7 @@
 </e>
 <e>
 <k>generic_id</k>
-<v>103900</v>
+<v>103881</v>
 </e>
 <e>
 <k>variance</k>
@@ -15346,7 +15389,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203068</v>
+<v>203031</v>
 </b>
 </bs>
 </hist>
@@ -15362,7 +15405,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203068</v>
+<v>203031</v>
 </b>
 </bs>
 </hist>
@@ -15378,7 +15421,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203068</v>
+<v>203031</v>
 </b>
 </bs>
 </hist>
@@ -15652,22 +15695,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80731</v>
+<v>80716</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10794</v>
+<v>10792</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8363</v>
+<v>8362</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>4011</v>
+<v>4010</v>
 </b>
 </bs>
 </hist>
@@ -15683,22 +15726,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80731</v>
+<v>80716</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10794</v>
+<v>10792</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8363</v>
+<v>8362</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>4011</v>
+<v>4010</v>
 </b>
 </bs>
 </hist>
@@ -15714,7 +15757,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>103749</v>
+<v>103730</v>
 </b>
 <b>
 <a>2</a>
@@ -15807,11 +15850,11 @@
 </relation>
 <relation>
 <name>type_arguments</name>
-<cardinality>644983</cardinality>
+<cardinality>644865</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>273767</v>
+<v>273716</v>
 </e>
 <e>
 <k>index</k>
@@ -15819,7 +15862,7 @@
 </e>
 <e>
 <k>constructed_id</k>
-<v>413656</v>
+<v>413580</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15833,12 +15876,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235104</v>
+<v>235061</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37184</v>
+<v>37177</v>
 </b>
 <b>
 <a>3</a>
@@ -15859,22 +15902,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>174257</v>
+<v>174226</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>56576</v>
+<v>56566</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>20607</v>
+<v>20603</v>
 </b>
 <b>
 <a>5</a>
 <b>23</b>
-<v>20690</v>
+<v>20686</v>
 </b>
 <b>
 <a>23</a>
@@ -16107,17 +16150,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>290592</v>
+<v>290539</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>96410</v>
+<v>96392</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>26653</v>
+<v>26648</v>
 </b>
 </bs>
 </hist>
@@ -16133,17 +16176,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>288425</v>
+<v>288373</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>97410</v>
+<v>97392</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27819</v>
+<v>27814</v>
 </b>
 </bs>
 </hist>
@@ -16153,15 +16196,15 @@
 </relation>
 <relation>
 <name>constructed_generic</name>
-<cardinality>413656</cardinality>
+<cardinality>413580</cardinality>
 <columnsizes>
 <e>
 <k>constructed</k>
-<v>413656</v>
+<v>413580</v>
 </e>
 <e>
 <k>generic</k>
-<v>8593</v>
+<v>8591</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16175,7 +16218,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>413656</v>
+<v>413580</v>
 </b>
 </bs>
 </hist>
@@ -16191,7 +16234,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3450</v>
+<v>3449</v>
 </b>
 <b>
 <a>2</a>
@@ -16211,12 +16254,12 @@
 <b>
 <a>6</a>
 <b>11</b>
-<v>727</v>
+<v>726</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>649</v>
+<v>648</v>
 </b>
 <b>
 <a>26</a>
@@ -16226,7 +16269,7 @@
 <b>
 <a>63</a>
 <b>2866</b>
-<v>649</v>
+<v>648</v>
 </b>
 <b>
 <a>2964</a>
@@ -16241,15 +16284,15 @@
 </relation>
 <relation>
 <name>type_parameter_constraints</name>
-<cardinality>611937</cardinality>
+<cardinality>611825</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>611937</v>
+<v>611825</v>
 </e>
 <e>
 <k>param_id</k>
-<v>202980</v>
+<v>202943</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16263,7 +16306,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>611937</v>
+<v>611825</v>
 </b>
 </bs>
 </hist>
@@ -16279,22 +16322,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>164527</v>
+<v>164497</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17718</v>
+<v>17715</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>16620</v>
+<v>16617</v>
 </b>
 <b>
 <a>11</a>
 <b>2108</b>
-<v>4113</v>
+<v>4112</v>
 </b>
 </bs>
 </hist>
@@ -16340,11 +16383,11 @@
 </relation>
 <relation>
 <name>general_type_parameter_constraints</name>
-<cardinality>119044</cardinality>
+<cardinality>119012</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>68444</v>
+<v>68415</v>
 </e>
 <e>
 <k>kind</k>
@@ -16362,12 +16405,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17844</v>
+<v>17818</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>50600</v>
+<v>50597</v>
 </b>
 </bs>
 </hist>
@@ -16386,23 +16429,23 @@
 <v>1</v>
 </b>
 <b>
-<a>443</a>
-<b>444</b>
+<a>442</a>
+<b>443</b>
 <v>1</v>
 </b>
 <b>
-<a>5912</a>
-<b>5913</b>
+<a>5903</a>
+<b>5904</b>
 <v>1</v>
 </b>
 <b>
-<a>50478</a>
-<b>50479</b>
+<a>50476</a>
+<b>50477</b>
 <v>1</v>
 </b>
 <b>
-<a>62207</a>
-<b>62208</b>
+<a>62187</a>
+<b>62188</b>
 <v>1</v>
 </b>
 </bs>
@@ -16413,11 +16456,11 @@
 </relation>
 <relation>
 <name>specific_type_parameter_constraints</name>
-<cardinality>57212</cardinality>
+<cardinality>57192</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>56357</v>
+<v>56338</v>
 </e>
 <e>
 <k>base_id</k>
@@ -16435,12 +16478,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55550</v>
+<v>55532</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>807</v>
+<v>806</v>
 </b>
 </bs>
 </hist>
@@ -16526,11 +16569,11 @@
 </relation>
 <relation>
 <name>specific_type_parameter_nullability</name>
-<cardinality>39929</cardinality>
+<cardinality>39909</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>39690</v>
+<v>39671</v>
 </e>
 <e>
 <k>base_id</k>
@@ -16552,12 +16595,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39451</v>
+<v>39433</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>239</v>
+<v>238</v>
 </b>
 </bs>
 </hist>
@@ -16573,7 +16616,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39690</v>
+<v>39671</v>
 </b>
 </bs>
 </hist>
@@ -16639,12 +16682,12 @@
 <b>
 <a>22</a>
 <b>33</b>
-<v>73</v>
+<v>74</v>
 </b>
 <b>
 <a>33</a>
 <b>93</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>93</a>
@@ -16749,8 +16792,8 @@
 <v>1</v>
 </b>
 <b>
-<a>38763</a>
-<b>38764</b>
+<a>38744</a>
+<b>38745</b>
 <v>1</v>
 </b>
 </bs>
@@ -16865,11 +16908,11 @@
 </relation>
 <relation>
 <name>has_modifiers</name>
-<cardinality>5506014</cardinality>
+<cardinality>5505244</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3697562</v>
+<v>3697119</v>
 </e>
 <e>
 <k>mod_id</k>
@@ -16887,17 +16930,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2024847</v>
+<v>2024705</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1538823</v>
+<v>1538546</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>133892</v>
+<v>133867</v>
 </b>
 </bs>
 </hist>
@@ -16956,8 +16999,8 @@
 <v>4</v>
 </b>
 <b>
-<a>30651</a>
-<b>30652</b>
+<a>30699</a>
+<b>30700</b>
 <v>4</v>
 </b>
 <b>
@@ -16971,8 +17014,8 @@
 <v>4</v>
 </b>
 <b>
-<a>63916</a>
-<b>63917</b>
+<a>63917</a>
+<b>63918</b>
 <v>4</v>
 </b>
 <b>
@@ -17003,11 +17046,11 @@
 </relation>
 <relation>
 <name>compiler_generated</name>
-<cardinality>136097</cardinality>
+<cardinality>136072</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>136097</v>
+<v>136072</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -17087,7 +17130,7 @@
 <b>
 <a>21</a>
 <b>85</b>
-<v>28</v>
+<v>27</v>
 </b>
 <b>
 <a>118</a>
@@ -17102,19 +17145,19 @@
 </relation>
 <relation>
 <name>nested_types</name>
-<cardinality>112142</cardinality>
+<cardinality>112122</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>112142</v>
+<v>112122</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>40673</v>
+<v>40665</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>81268</v>
+<v>81253</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17128,7 +17171,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112142</v>
+<v>112122</v>
 </b>
 </bs>
 </hist>
@@ -17144,7 +17187,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112142</v>
+<v>112122</v>
 </b>
 </bs>
 </hist>
@@ -17160,22 +17203,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23530</v>
+<v>23526</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6348</v>
+<v>6347</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3235</v>
+<v>3234</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3362</v>
+<v>3361</v>
 </b>
 <b>
 <a>7</a>
@@ -17201,32 +17244,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23564</v>
+<v>23560</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6431</v>
+<v>6430</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3152</v>
+<v>3151</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3391</v>
+<v>3390</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>3084</v>
+<v>3083</v>
 </b>
 <b>
 <a>12</a>
 <b>206</b>
-<v>1049</v>
+<v>1048</v>
 </b>
 </bs>
 </hist>
@@ -17242,7 +17285,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78247</v>
+<v>78233</v>
 </b>
 <b>
 <a>2</a>
@@ -17263,7 +17306,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78989</v>
+<v>78974</v>
 </b>
 <b>
 <a>2</a>
@@ -17278,27 +17321,27 @@
 </relation>
 <relation>
 <name>properties</name>
-<cardinality>424328</cardinality>
+<cardinality>424250</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>424328</v>
+<v>424250</v>
 </e>
 <e>
 <k>name</k>
-<v>84518</v>
+<v>84502</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>116593</v>
+<v>116571</v>
 </e>
 <e>
 <k>type_id</k>
-<v>52223</v>
+<v>52214</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>334471</v>
+<v>334410</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17312,7 +17355,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424328</v>
+<v>424250</v>
 </b>
 </bs>
 </hist>
@@ -17328,7 +17371,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424328</v>
+<v>424250</v>
 </b>
 </bs>
 </hist>
@@ -17344,7 +17387,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424328</v>
+<v>424250</v>
 </b>
 </bs>
 </hist>
@@ -17360,7 +17403,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424328</v>
+<v>424250</v>
 </b>
 </bs>
 </hist>
@@ -17376,27 +17419,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50847</v>
+<v>50838</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14019</v>
+<v>14017</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5763</v>
+<v>5761</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6660</v>
+<v>6659</v>
 </b>
 <b>
 <a>7</a>
 <b>49</b>
-<v>6348</v>
+<v>6347</v>
 </b>
 <b>
 <a>49</a>
@@ -17417,27 +17460,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50847</v>
+<v>50838</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14088</v>
+<v>14085</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5748</v>
+<v>5747</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6695</v>
+<v>6693</v>
 </b>
 <b>
 <a>7</a>
 <b>51</b>
-<v>6343</v>
+<v>6342</v>
 </b>
 <b>
 <a>51</a>
@@ -17458,17 +17501,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72972</v>
+<v>72959</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6943</v>
+<v>6942</v>
 </b>
 <b>
 <a>3</a>
 <b>524</b>
-<v>4601</v>
+<v>4600</v>
 </b>
 </bs>
 </hist>
@@ -17484,27 +17527,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51277</v>
+<v>51267</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14283</v>
+<v>14280</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5748</v>
+<v>5747</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6455</v>
+<v>6454</v>
 </b>
 <b>
 <a>7</a>
 <b>68</b>
-<v>6338</v>
+<v>6337</v>
 </b>
 <b>
 <a>68</a>
@@ -17525,37 +17568,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39458</v>
+<v>39450</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29922</v>
+<v>29917</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10921</v>
+<v>10919</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7856</v>
+<v>7855</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7144</v>
+<v>7142</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9344</v>
+<v>9343</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>9583</v>
+<v>9582</v>
 </b>
 <b>
 <a>16</a>
@@ -17576,42 +17619,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43976</v>
+<v>43968</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25482</v>
+<v>25477</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10916</v>
+<v>10914</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7876</v>
+<v>7874</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7158</v>
+<v>7157</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9300</v>
+<v>9299</v>
 </b>
 <b>
 <a>8</a>
 <b>14</b>
-<v>8759</v>
+<v>8757</v>
 </b>
 <b>
 <a>14</a>
 <b>250</b>
-<v>3123</v>
+<v>3122</v>
 </b>
 </bs>
 </hist>
@@ -17627,32 +17670,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>45533</v>
+<v>45525</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32675</v>
+<v>32669</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13863</v>
+<v>13860</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7558</v>
+<v>7557</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>9398</v>
+<v>9396</v>
 </b>
 <b>
 <a>7</a>
 <b>48</b>
-<v>7563</v>
+<v>7562</v>
 </b>
 </bs>
 </hist>
@@ -17668,37 +17711,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39458</v>
+<v>39450</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29922</v>
+<v>29917</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10921</v>
+<v>10919</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7856</v>
+<v>7855</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7144</v>
+<v>7142</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9344</v>
+<v>9343</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>9583</v>
+<v>9582</v>
 </b>
 <b>
 <a>16</a>
@@ -17719,22 +17762,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31474</v>
+<v>31468</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10799</v>
+<v>10797</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4640</v>
+<v>4639</v>
 </b>
 <b>
 <a>5</a>
 <b>21</b>
-<v>3952</v>
+<v>3951</v>
 </b>
 <b>
 <a>21</a>
@@ -17755,12 +17798,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44157</v>
+<v>44149</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4406</v>
+<v>4405</v>
 </b>
 <b>
 <a>3</a>
@@ -17781,12 +17824,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32660</v>
+<v>32654</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10501</v>
+<v>10499</v>
 </b>
 <b>
 <a>3</a>
@@ -17796,7 +17839,7 @@
 <b>
 <a>5</a>
 <b>33</b>
-<v>3918</v>
+<v>3917</v>
 </b>
 <b>
 <a>33</a>
@@ -17817,22 +17860,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31616</v>
+<v>31610</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10930</v>
+<v>10928</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4674</v>
+<v>4673</v>
 </b>
 <b>
 <a>5</a>
 <b>22</b>
-<v>3918</v>
+<v>3917</v>
 </b>
 <b>
 <a>22</a>
@@ -17853,12 +17896,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>329289</v>
+<v>329229</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5182</v>
+<v>5181</v>
 </b>
 </bs>
 </hist>
@@ -17874,7 +17917,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>334471</v>
+<v>334410</v>
 </b>
 </bs>
 </hist>
@@ -17890,12 +17933,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>329289</v>
+<v>329229</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5182</v>
+<v>5181</v>
 </b>
 </bs>
 </hist>
@@ -17911,12 +17954,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>333261</v>
+<v>333200</v>
 </b>
 <b>
 <a>2</a>
 <b>439</b>
-<v>1210</v>
+<v>1209</v>
 </b>
 </bs>
 </hist>
@@ -17926,15 +17969,15 @@
 </relation>
 <relation>
 <name>property_location</name>
-<cardinality>535451</cardinality>
+<cardinality>535358</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>424328</v>
+<v>424250</v>
 </e>
 <e>
 <k>loc</k>
-<v>52994</v>
+<v>52985</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17948,17 +17991,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>338741</v>
+<v>338679</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>64228</v>
+<v>64211</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>21358</v>
+<v>21359</v>
 </b>
 </bs>
 </hist>
@@ -17974,12 +18017,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49505</v>
+<v>49496</v>
 </b>
 <b>
 <a>2</a>
 <b>7080</b>
-<v>3489</v>
+<v>3488</v>
 </b>
 </bs>
 </hist>
@@ -17989,11 +18032,11 @@
 </relation>
 <relation>
 <name>indexers</name>
-<cardinality>17074</cardinality>
+<cardinality>17071</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>17074</v>
+<v>17071</v>
 </e>
 <e>
 <k>name</k>
@@ -18001,15 +18044,15 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>13575</v>
+<v>13573</v>
 </e>
 <e>
 <k>type_id</k>
-<v>3977</v>
+<v>3976</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>4445</v>
+<v>4444</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18023,7 +18066,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17074</v>
+<v>17071</v>
 </b>
 </bs>
 </hist>
@@ -18039,7 +18082,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17074</v>
+<v>17071</v>
 </b>
 </bs>
 </hist>
@@ -18055,7 +18098,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17074</v>
+<v>17071</v>
 </b>
 </bs>
 </hist>
@@ -18071,7 +18114,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17074</v>
+<v>17071</v>
 </b>
 </bs>
 </hist>
@@ -18206,12 +18249,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10525</v>
+<v>10523</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2752</v>
+<v>2751</v>
 </b>
 <b>
 <a>3</a>
@@ -18232,7 +18275,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13565</v>
+<v>13563</v>
 </b>
 <b>
 <a>2</a>
@@ -18253,12 +18296,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11067</v>
+<v>11065</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2508</v>
+<v>2507</v>
 </b>
 </bs>
 </hist>
@@ -18274,12 +18317,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10525</v>
+<v>10523</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2752</v>
+<v>2751</v>
 </b>
 <b>
 <a>3</a>
@@ -18341,7 +18384,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3972</v>
+<v>3971</v>
 </b>
 <b>
 <a>2</a>
@@ -18372,7 +18415,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>1664</v>
+<v>1663</v>
 </b>
 <b>
 <a>4</a>
@@ -18408,7 +18451,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>1654</v>
+<v>1653</v>
 </b>
 <b>
 <a>4</a>
@@ -18455,7 +18498,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4445</v>
+<v>4444</v>
 </b>
 </bs>
 </hist>
@@ -18492,7 +18535,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4255</v>
+<v>4254</v>
 </b>
 <b>
 <a>2</a>
@@ -18507,7 +18550,7 @@
 </relation>
 <relation>
 <name>indexer_location</name>
-<cardinality>23986</cardinality>
+<cardinality>23816</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -18515,7 +18558,7 @@
 </e>
 <e>
 <k>loc</k>
-<v>222</v>
+<v>221</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18529,7 +18572,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4499</v>
+<v>4584</v>
 </b>
 <b>
 <a>2</a>
@@ -18539,17 +18582,17 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>361</v>
+<v>275</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1122</v>
+<v>1124</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>114</v>
+<v>113</v>
 </b>
 </bs>
 </hist>
@@ -18575,17 +18618,17 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>18</v>
+<v>19</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>13</v>
+<v>12</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>19</v>
+<v>20</v>
 </b>
 <b>
 <a>8</a>
@@ -18595,22 +18638,22 @@
 <b>
 <a>13</a>
 <b>21</b>
-<v>19</v>
+<v>18</v>
 </b>
 <b>
 <a>23</a>
 <b>45</b>
-<v>19</v>
-</b>
-<b>
-<a>47</a>
-<b>2441</b>
 <v>17</v>
 </b>
 <b>
-<a>3540</a>
+<a>47</a>
+<b>1716</b>
+<v>17</v>
+</b>
+<b>
+<a>2229</a>
 <b>5342</b>
-<v>3</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -18620,11 +18663,11 @@
 </relation>
 <relation>
 <name>accessors</name>
-<cardinality>568936</cardinality>
+<cardinality>568832</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>568936</v>
+<v>568832</v>
 </e>
 <e>
 <k>kind</k>
@@ -18632,15 +18675,15 @@
 </e>
 <e>
 <k>name</k>
-<v>121473</v>
+<v>121450</v>
 </e>
 <e>
 <k>declaring_member_id</k>
-<v>441403</v>
+<v>441322</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>441251</v>
+<v>441170</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18654,7 +18697,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568936</v>
+<v>568832</v>
 </b>
 </bs>
 </hist>
@@ -18670,7 +18713,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568936</v>
+<v>568832</v>
 </b>
 </bs>
 </hist>
@@ -18686,7 +18729,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568936</v>
+<v>568832</v>
 </b>
 </bs>
 </hist>
@@ -18702,7 +18745,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568936</v>
+<v>568832</v>
 </b>
 </bs>
 </hist>
@@ -18802,27 +18845,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75334</v>
+<v>75320</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19987</v>
+<v>19984</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7944</v>
+<v>7942</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10145</v>
+<v>10143</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8061</v>
+<v>8059</v>
 </b>
 </bs>
 </hist>
@@ -18838,7 +18881,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>121473</v>
+<v>121450</v>
 </b>
 </bs>
 </hist>
@@ -18854,27 +18897,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75344</v>
+<v>75330</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19977</v>
+<v>19974</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7944</v>
+<v>7942</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10145</v>
+<v>10143</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8061</v>
+<v>8059</v>
 </b>
 </bs>
 </hist>
@@ -18890,27 +18933,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75983</v>
+<v>75969</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20656</v>
+<v>20652</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7778</v>
+<v>7776</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>9671</v>
+<v>9670</v>
 </b>
 <b>
 <a>8</a>
 <b>1202</b>
-<v>7383</v>
+<v>7381</v>
 </b>
 </bs>
 </hist>
@@ -18926,12 +18969,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313879</v>
+<v>313821</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127519</v>
+<v>127495</v>
 </b>
 <b>
 <a>4</a>
@@ -18952,12 +18995,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313879</v>
+<v>313821</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127524</v>
+<v>127500</v>
 </b>
 </bs>
 </hist>
@@ -18973,12 +19016,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313879</v>
+<v>313821</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127524</v>
+<v>127500</v>
 </b>
 </bs>
 </hist>
@@ -18994,12 +19037,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313879</v>
+<v>313821</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127519</v>
+<v>127495</v>
 </b>
 <b>
 <a>4</a>
@@ -19020,12 +19063,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434576</v>
+<v>434496</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6675</v>
+<v>6674</v>
 </b>
 </bs>
 </hist>
@@ -19041,7 +19084,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441251</v>
+<v>441170</v>
 </b>
 </bs>
 </hist>
@@ -19057,7 +19100,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441251</v>
+<v>441170</v>
 </b>
 </bs>
 </hist>
@@ -19073,12 +19116,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434576</v>
+<v>434496</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6675</v>
+<v>6674</v>
 </b>
 </bs>
 </hist>
@@ -19099,15 +19142,15 @@
 </relation>
 <relation>
 <name>accessor_location</name>
-<cardinality>749172</cardinality>
+<cardinality>749045</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>568936</v>
+<v>568832</v>
 </e>
 <e>
 <k>loc</k>
-<v>93389</v>
+<v>93372</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19121,17 +19164,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>433522</v>
+<v>433442</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98591</v>
+<v>98563</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>36823</v>
+<v>36826</v>
 </b>
 </bs>
 </hist>
@@ -19147,12 +19190,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89778</v>
+<v>89762</v>
 </b>
 <b>
 <a>2</a>
 <b>8294</b>
-<v>3611</v>
+<v>3610</v>
 </b>
 </bs>
 </hist>
@@ -19162,15 +19205,15 @@
 </relation>
 <relation>
 <name>events</name>
-<cardinality>15259</cardinality>
+<cardinality>15256</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15259</v>
+<v>15256</v>
 </e>
 <e>
 <k>name</k>
-<v>13014</v>
+<v>13012</v>
 </e>
 <e>
 <k>declaring_type_id</k>
@@ -19178,11 +19221,11 @@
 </e>
 <e>
 <k>type_id</k>
-<v>6377</v>
+<v>6376</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>15249</v>
+<v>15246</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19196,7 +19239,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15259</v>
+<v>15256</v>
 </b>
 </bs>
 </hist>
@@ -19212,7 +19255,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15259</v>
+<v>15256</v>
 </b>
 </bs>
 </hist>
@@ -19228,7 +19271,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15259</v>
+<v>15256</v>
 </b>
 </bs>
 </hist>
@@ -19244,7 +19287,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15259</v>
+<v>15256</v>
 </b>
 </bs>
 </hist>
@@ -19260,7 +19303,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12023</v>
+<v>12021</v>
 </b>
 <b>
 <a>2</a>
@@ -19286,7 +19329,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12023</v>
+<v>12021</v>
 </b>
 <b>
 <a>2</a>
@@ -19312,7 +19355,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12872</v>
+<v>12870</v>
 </b>
 <b>
 <a>2</a>
@@ -19333,7 +19376,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12023</v>
+<v>12021</v>
 </b>
 <b>
 <a>2</a>
@@ -19441,7 +19484,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>771</v>
+<v>770</v>
 </b>
 <b>
 <a>2</a>
@@ -19518,7 +19561,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4421</v>
+<v>4420</v>
 </b>
 <b>
 <a>2</a>
@@ -19549,7 +19592,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4811</v>
+<v>4810</v>
 </b>
 <b>
 <a>2</a>
@@ -19580,7 +19623,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5763</v>
+<v>5761</v>
 </b>
 <b>
 <a>2</a>
@@ -19606,7 +19649,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4421</v>
+<v>4420</v>
 </b>
 <b>
 <a>2</a>
@@ -19637,7 +19680,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15239</v>
+<v>15236</v>
 </b>
 <b>
 <a>2</a>
@@ -19658,7 +19701,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15249</v>
+<v>15246</v>
 </b>
 </bs>
 </hist>
@@ -19674,7 +19717,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15239</v>
+<v>15236</v>
 </b>
 <b>
 <a>2</a>
@@ -19695,7 +19738,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15239</v>
+<v>15236</v>
 </b>
 <b>
 <a>2</a>
@@ -19710,11 +19753,11 @@
 </relation>
 <relation>
 <name>event_location</name>
-<cardinality>15898</cardinality>
+<cardinality>15895</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15259</v>
+<v>15256</v>
 </e>
 <e>
 <k>loc</k>
@@ -19732,7 +19775,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14619</v>
+<v>14617</v>
 </b>
 <b>
 <a>2</a>
@@ -19813,11 +19856,11 @@
 </relation>
 <relation>
 <name>event_accessors</name>
-<cardinality>30518</cardinality>
+<cardinality>30512</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30518</v>
+<v>30512</v>
 </e>
 <e>
 <k>kind</k>
@@ -19825,15 +19868,15 @@
 </e>
 <e>
 <k>name</k>
-<v>26741</v>
+<v>26736</v>
 </e>
 <e>
 <k>declaring_event_id</k>
-<v>15259</v>
+<v>15256</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>30498</v>
+<v>30493</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19847,7 +19890,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30518</v>
+<v>30512</v>
 </b>
 </bs>
 </hist>
@@ -19863,7 +19906,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30518</v>
+<v>30512</v>
 </b>
 </bs>
 </hist>
@@ -19879,7 +19922,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30518</v>
+<v>30512</v>
 </b>
 </bs>
 </hist>
@@ -19895,7 +19938,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30518</v>
+<v>30512</v>
 </b>
 </bs>
 </hist>
@@ -19975,7 +20018,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24750</v>
+<v>24745</v>
 </b>
 <b>
 <a>2</a>
@@ -19996,7 +20039,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26741</v>
+<v>26736</v>
 </b>
 </bs>
 </hist>
@@ -20012,7 +20055,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24750</v>
+<v>24745</v>
 </b>
 <b>
 <a>2</a>
@@ -20033,7 +20076,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24750</v>
+<v>24745</v>
 </b>
 <b>
 <a>2</a>
@@ -20054,7 +20097,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15259</v>
+<v>15256</v>
 </b>
 </bs>
 </hist>
@@ -20070,7 +20113,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15259</v>
+<v>15256</v>
 </b>
 </bs>
 </hist>
@@ -20086,7 +20129,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15259</v>
+<v>15256</v>
 </b>
 </bs>
 </hist>
@@ -20102,7 +20145,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15259</v>
+<v>15256</v>
 </b>
 </bs>
 </hist>
@@ -20118,7 +20161,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30479</v>
+<v>30473</v>
 </b>
 <b>
 <a>2</a>
@@ -20139,7 +20182,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30498</v>
+<v>30493</v>
 </b>
 </bs>
 </hist>
@@ -20155,7 +20198,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30498</v>
+<v>30493</v>
 </b>
 </bs>
 </hist>
@@ -20171,7 +20214,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30479</v>
+<v>30473</v>
 </b>
 <b>
 <a>2</a>
@@ -20186,11 +20229,11 @@
 </relation>
 <relation>
 <name>event_accessor_location</name>
-<cardinality>31796</cardinality>
+<cardinality>31791</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30518</v>
+<v>30512</v>
 </e>
 <e>
 <k>loc</k>
@@ -20208,7 +20251,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29239</v>
+<v>29234</v>
 </b>
 <b>
 <a>2</a>
@@ -20289,11 +20332,11 @@
 </relation>
 <relation>
 <name>operators</name>
-<cardinality>12433</cardinality>
+<cardinality>12431</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12433</v>
+<v>12431</v>
 </e>
 <e>
 <k>name</k>
@@ -20305,7 +20348,7 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>3030</v>
+<v>3029</v>
 </e>
 <e>
 <k>type_id</k>
@@ -20313,7 +20356,7 @@
 </e>
 <e>
 <k>unbound_id</k>
-<v>11677</v>
+<v>11675</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20327,7 +20370,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12433</v>
+<v>12431</v>
 </b>
 </bs>
 </hist>
@@ -20343,7 +20386,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12433</v>
+<v>12431</v>
 </b>
 </bs>
 </hist>
@@ -20359,7 +20402,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12433</v>
+<v>12431</v>
 </b>
 </bs>
 </hist>
@@ -20375,7 +20418,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12433</v>
+<v>12431</v>
 </b>
 </bs>
 </hist>
@@ -20391,7 +20434,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12433</v>
+<v>12431</v>
 </b>
 </bs>
 </hist>
@@ -21063,7 +21106,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1542</v>
+<v>1541</v>
 </b>
 <b>
 <a>3</a>
@@ -21140,7 +21183,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2025</v>
+<v>2024</v>
 </b>
 <b>
 <a>2</a>
@@ -21263,7 +21306,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1210</v>
+<v>1209</v>
 </b>
 <b>
 <a>2</a>
@@ -21299,7 +21342,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1210</v>
+<v>1209</v>
 </b>
 <b>
 <a>2</a>
@@ -21407,7 +21450,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11530</v>
+<v>11528</v>
 </b>
 <b>
 <a>2</a>
@@ -21428,7 +21471,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11677</v>
+<v>11675</v>
 </b>
 </bs>
 </hist>
@@ -21444,7 +21487,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11677</v>
+<v>11675</v>
 </b>
 </bs>
 </hist>
@@ -21460,7 +21503,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11530</v>
+<v>11528</v>
 </b>
 <b>
 <a>2</a>
@@ -21481,7 +21524,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11618</v>
+<v>11616</v>
 </b>
 <b>
 <a>2</a>
@@ -21496,15 +21539,15 @@
 </relation>
 <relation>
 <name>operator_location</name>
-<cardinality>22298</cardinality>
+<cardinality>22294</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>5647</v>
+<v>5646</v>
 </e>
 <e>
 <k>loc</k>
-<v>3164</v>
+<v>3163</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21579,15 +21622,15 @@
 </relation>
 <relation>
 <name>constant_value</name>
-<cardinality>185701</cardinality>
+<cardinality>185667</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>185588</v>
+<v>185554</v>
 </e>
 <e>
 <k>value</k>
-<v>47944</v>
+<v>47935</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21601,7 +21644,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185476</v>
+<v>185442</v>
 </b>
 <b>
 <a>2</a>
@@ -21622,22 +21665,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32953</v>
+<v>32947</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7231</v>
+<v>7230</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3894</v>
+<v>3893</v>
 </b>
 <b>
 <a>4</a>
 <b>61</b>
-<v>3596</v>
+<v>3595</v>
 </b>
 <b>
 <a>61</a>
@@ -21652,27 +21695,27 @@
 </relation>
 <relation>
 <name>methods</name>
-<cardinality>1118739</cardinality>
+<cardinality>1118769</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1118739</v>
+<v>1118769</v>
 </e>
 <e>
 <k>name</k>
-<v>133843</v>
+<v>134018</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>202414</v>
+<v>202592</v>
 </e>
 <e>
 <k>type_id</k>
-<v>113089</v>
+<v>113068</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>697871</v>
+<v>697977</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21686,7 +21729,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118739</v>
+<v>1118769</v>
 </b>
 </bs>
 </hist>
@@ -21702,7 +21745,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118739</v>
+<v>1118769</v>
 </b>
 </bs>
 </hist>
@@ -21718,7 +21761,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118739</v>
+<v>1118769</v>
 </b>
 </bs>
 </hist>
@@ -21734,7 +21777,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118739</v>
+<v>1118769</v>
 </b>
 </bs>
 </hist>
@@ -21750,32 +21793,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>69273</v>
+<v>69436</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23662</v>
+<v>23672</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10852</v>
+<v>10860</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10442</v>
+<v>10440</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>10589</v>
+<v>10587</v>
 </b>
 <b>
 <a>12</a>
 <b>5621</b>
-<v>9022</v>
+<v>9021</v>
 </b>
 </bs>
 </hist>
@@ -21791,27 +21834,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>79662</v>
+<v>79823</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19377</v>
+<v>19388</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11335</v>
+<v>11343</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>11067</v>
+<v>11065</v>
 </b>
 <b>
 <a>7</a>
 <b>33</b>
-<v>10125</v>
+<v>10123</v>
 </b>
 <b>
 <a>33</a>
@@ -21832,22 +21875,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>113070</v>
+<v>113249</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10613</v>
+<v>10611</v>
 </b>
 <b>
 <a>3</a>
-<b>174</b>
-<v>10042</v>
+<b>209</b>
+<v>10055</v>
 </b>
 <b>
-<a>177</a>
+<a>222</a>
 <b>2703</b>
-<v>117</v>
+<v>102</v>
 </b>
 </bs>
 </hist>
@@ -21863,32 +21906,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71015</v>
+<v>71178</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24530</v>
+<v>24540</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10925</v>
+<v>10933</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10740</v>
+<v>10738</v>
 </b>
 <b>
 <a>6</a>
-<b>12</b>
-<v>10047</v>
+<b>13</b>
+<v>10738</v>
 </b>
 <b>
-<a>12</a>
+<a>13</a>
 <b>4958</b>
-<v>6582</v>
+<v>5888</v>
 </b>
 </bs>
 </hist>
@@ -21904,42 +21947,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>59836</v>
+<v>60020</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43064</v>
+<v>43075</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31352</v>
+<v>31347</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14278</v>
+<v>14275</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14815</v>
+<v>14812</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>16127</v>
+<v>16124</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>15683</v>
+<v>15680</v>
 </b>
 <b>
 <a>23</a>
 <b>1309</b>
-<v>7256</v>
+<v>7254</v>
 </b>
 </bs>
 </hist>
@@ -21955,37 +21998,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64911</v>
+<v>65094</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44752</v>
+<v>44764</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>34456</v>
+<v>34450</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18226</v>
+<v>18222</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>18191</v>
+<v>18188</v>
 </b>
 <b>
 <a>8</a>
 <b>18</b>
-<v>15278</v>
+<v>15275</v>
 </b>
 <b>
 <a>18</a>
 <b>457</b>
-<v>6597</v>
+<v>6596</v>
 </b>
 </bs>
 </hist>
@@ -22001,32 +22044,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97981</v>
+<v>98178</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48998</v>
+<v>48989</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22988</v>
+<v>22984</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11643</v>
+<v>11641</v>
 </b>
 <b>
 <a>5</a>
 <b>10</b>
-<v>15234</v>
+<v>15231</v>
 </b>
 <b>
 <a>10</a>
 <b>738</b>
-<v>5567</v>
+<v>5566</v>
 </b>
 </bs>
 </hist>
@@ -22042,42 +22085,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>59943</v>
+<v>60127</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43142</v>
+<v>43153</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31352</v>
+<v>31347</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14312</v>
+<v>14309</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14834</v>
+<v>14831</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>16044</v>
+<v>16041</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>16142</v>
+<v>16139</v>
 </b>
 <b>
 <a>23</a>
 <b>698</b>
-<v>6641</v>
+<v>6640</v>
 </b>
 </bs>
 </hist>
@@ -22093,27 +22136,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75578</v>
+<v>75564</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14507</v>
+<v>14505</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8324</v>
+<v>8323</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8842</v>
+<v>8840</v>
 </b>
 <b>
 <a>10</a>
-<b>62149</b>
-<v>5836</v>
+<b>62181</b>
+<v>5835</v>
 </b>
 </bs>
 </hist>
@@ -22129,22 +22172,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>91740</v>
+<v>91723</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9632</v>
+<v>9630</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8681</v>
+<v>8679</v>
 </b>
 <b>
 <a>8</a>
-<b>7666</b>
-<v>3035</v>
+<b>7691</b>
+<v>3034</v>
 </b>
 </bs>
 </hist>
@@ -22160,22 +22203,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87558</v>
+<v>87542</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14005</v>
+<v>14002</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8817</v>
+<v>8816</v>
 </b>
 <b>
 <a>8</a>
-<b>19632</b>
-<v>2708</v>
+<b>19662</b>
+<v>2707</v>
 </b>
 </bs>
 </hist>
@@ -22191,27 +22234,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75690</v>
+<v>75676</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14566</v>
+<v>14563</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8398</v>
+<v>8396</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8778</v>
+<v>8777</v>
 </b>
 <b>
 <a>10</a>
-<b>44480</b>
-<v>5655</v>
+<b>44512</b>
+<v>5654</v>
 </b>
 </bs>
 </hist>
@@ -22227,12 +22270,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>670988</v>
+<v>671099</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>26882</v>
+<v>26877</v>
 </b>
 </bs>
 </hist>
@@ -22248,7 +22291,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>697871</v>
+<v>697977</v>
 </b>
 </bs>
 </hist>
@@ -22264,12 +22307,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>672857</v>
+<v>672968</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>25013</v>
+<v>25009</v>
 </b>
 </bs>
 </hist>
@@ -22285,12 +22328,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>687486</v>
+<v>687595</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>10384</v>
+<v>10382</v>
 </b>
 </bs>
 </hist>
@@ -22300,15 +22343,15 @@
 </relation>
 <relation>
 <name>method_location</name>
-<cardinality>1282755</cardinality>
+<cardinality>1282783</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1118739</v>
+<v>1118769</v>
 </e>
 <e>
 <k>loc</k>
-<v>40907</v>
+<v>40899</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22322,17 +22365,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>988122</v>
+<v>988175</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98450</v>
+<v>98402</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>32167</v>
+<v>32191</v>
 </b>
 </bs>
 </hist>
@@ -22348,17 +22391,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36286</v>
+<v>36279</v>
 </b>
 <b>
 <a>2</a>
 <b>51</b>
-<v>3084</v>
+<v>3083</v>
 </b>
 <b>
 <a>51</a>
 <b>27729</b>
-<v>1537</v>
+<v>1536</v>
 </b>
 </bs>
 </hist>
@@ -22368,23 +22411,23 @@
 </relation>
 <relation>
 <name>constructors</name>
-<cardinality>278163</cardinality>
+<cardinality>278112</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>278163</v>
+<v>278112</v>
 </e>
 <e>
 <k>name</k>
-<v>133716</v>
+<v>133692</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>212379</v>
+<v>212340</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>223670</v>
+<v>223629</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22398,7 +22441,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278163</v>
+<v>278112</v>
 </b>
 </bs>
 </hist>
@@ -22414,7 +22457,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278163</v>
+<v>278112</v>
 </b>
 </bs>
 </hist>
@@ -22430,7 +22473,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278163</v>
+<v>278112</v>
 </b>
 </bs>
 </hist>
@@ -22446,22 +22489,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102378</v>
+<v>102359</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19206</v>
+<v>19203</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>10267</v>
+<v>10265</v>
 </b>
 <b>
 <a>8</a>
 <b>2183</b>
-<v>1864</v>
+<v>1863</v>
 </b>
 </bs>
 </hist>
@@ -22477,12 +22520,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>122712</v>
+<v>122690</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>10101</v>
+<v>10099</v>
 </b>
 <b>
 <a>11</a>
@@ -22503,17 +22546,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>103261</v>
+<v>103242</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19363</v>
+<v>19359</v>
 </b>
 <b>
 <a>3</a>
 <b>10</b>
-<v>10106</v>
+<v>10104</v>
 </b>
 <b>
 <a>10</a>
@@ -22534,17 +22577,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179650</v>
+<v>179617</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19787</v>
+<v>19783</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12941</v>
+<v>12938</v>
 </b>
 </bs>
 </hist>
@@ -22560,7 +22603,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212379</v>
+<v>212340</v>
 </b>
 </bs>
 </hist>
@@ -22576,17 +22619,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179650</v>
+<v>179617</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19787</v>
+<v>19783</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12941</v>
+<v>12938</v>
 </b>
 </bs>
 </hist>
@@ -22602,12 +22645,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>221235</v>
+<v>221195</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2435</v>
+<v>2434</v>
 </b>
 </bs>
 </hist>
@@ -22623,7 +22666,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>223670</v>
+<v>223629</v>
 </b>
 </bs>
 </hist>
@@ -22639,12 +22682,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>221235</v>
+<v>221195</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2435</v>
+<v>2434</v>
 </b>
 </bs>
 </hist>
@@ -22654,15 +22697,15 @@
 </relation>
 <relation>
 <name>constructor_location</name>
-<cardinality>322042</cardinality>
+<cardinality>321983</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>278163</v>
+<v>278112</v>
 </e>
 <e>
 <k>loc</k>
-<v>24818</v>
+<v>24814</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22676,12 +22719,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>238769</v>
+<v>238725</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37642</v>
+<v>37635</v>
 </b>
 <b>
 <a>3</a>
@@ -22702,12 +22745,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19036</v>
+<v>19032</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3186</v>
+<v>3185</v>
 </b>
 <b>
 <a>3</a>
@@ -22717,7 +22760,7 @@
 <b>
 <a>59</a>
 <b>4796</b>
-<v>727</v>
+<v>726</v>
 </b>
 </bs>
 </hist>
@@ -22727,11 +22770,11 @@
 </relation>
 <relation>
 <name>destructors</name>
-<cardinality>444</cardinality>
+<cardinality>443</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>444</v>
+<v>443</v>
 </e>
 <e>
 <k>name</k>
@@ -22739,7 +22782,7 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>444</v>
+<v>443</v>
 </e>
 <e>
 <k>unbound_id</k>
@@ -22757,7 +22800,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -22773,7 +22816,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -22789,7 +22832,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -22868,7 +22911,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -22884,7 +22927,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -22900,7 +22943,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -23056,7 +23099,7 @@
 <b>
 <a>3</a>
 <b>5</b>
-<v>28</v>
+<v>27</v>
 </b>
 <b>
 <a>5</a>
@@ -23071,15 +23114,15 @@
 </relation>
 <relation>
 <name>overrides</name>
-<cardinality>274445</cardinality>
+<cardinality>274395</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>274420</v>
+<v>274370</v>
 </e>
 <e>
 <k>base_id</k>
-<v>65526</v>
+<v>65514</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23093,7 +23136,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>274396</v>
+<v>274346</v>
 </b>
 <b>
 <a>2</a>
@@ -23114,27 +23157,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40326</v>
+<v>40319</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10491</v>
+<v>10489</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4294</v>
+<v>4293</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>5348</v>
+<v>5347</v>
 </b>
 <b>
 <a>7</a>
 <b>184</b>
-<v>4918</v>
+<v>4917</v>
 </b>
 <b>
 <a>215</a>
@@ -23149,15 +23192,15 @@
 </relation>
 <relation>
 <name>explicitly_implements</name>
-<cardinality>156236</cardinality>
+<cardinality>156208</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>156236</v>
+<v>156208</v>
 </e>
 <e>
 <k>interface_id</k>
-<v>13307</v>
+<v>13304</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23171,7 +23214,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>156236</v>
+<v>156208</v>
 </b>
 </bs>
 </hist>
@@ -23187,7 +23230,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6782</v>
+<v>6781</v>
 </b>
 <b>
 <a>2</a>
@@ -23207,7 +23250,7 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>1210</v>
+<v>1209</v>
 </b>
 <b>
 <a>7</a>
@@ -23576,11 +23619,11 @@
 </relation>
 <relation>
 <name>fields</name>
-<cardinality>556732</cardinality>
+<cardinality>556630</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>556732</v>
+<v>556630</v>
 </e>
 <e>
 <k>kind</k>
@@ -23588,19 +23631,19 @@
 </e>
 <e>
 <k>name</k>
-<v>218630</v>
+<v>218589</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>103774</v>
+<v>103754</v>
 </e>
 <e>
 <k>type_id</k>
-<v>89681</v>
+<v>89664</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>549022</v>
+<v>548921</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23614,7 +23657,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556732</v>
+<v>556630</v>
 </b>
 </bs>
 </hist>
@@ -23630,7 +23673,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556732</v>
+<v>556630</v>
 </b>
 </bs>
 </hist>
@@ -23646,7 +23689,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556732</v>
+<v>556630</v>
 </b>
 </bs>
 </hist>
@@ -23662,7 +23705,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556732</v>
+<v>556630</v>
 </b>
 </bs>
 </hist>
@@ -23678,7 +23721,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556732</v>
+<v>556630</v>
 </b>
 </bs>
 </hist>
@@ -23799,17 +23842,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176502</v>
+<v>176470</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22608</v>
+<v>22604</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>16586</v>
+<v>16583</v>
 </b>
 <b>
 <a>14</a>
@@ -23830,12 +23873,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>209255</v>
+<v>209217</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9374</v>
+<v>9372</v>
 </b>
 </bs>
 </hist>
@@ -23851,17 +23894,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176527</v>
+<v>176494</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22593</v>
+<v>22589</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>16576</v>
+<v>16573</v>
 </b>
 <b>
 <a>14</a>
@@ -23882,17 +23925,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>189034</v>
+<v>188999</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17689</v>
+<v>17686</v>
 </b>
 <b>
 <a>3</a>
 <b>2459</b>
-<v>11906</v>
+<v>11904</v>
 </b>
 </bs>
 </hist>
@@ -23908,22 +23951,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176893</v>
+<v>176860</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22613</v>
+<v>22608</v>
 </b>
 <b>
 <a>3</a>
 <b>15</b>
-<v>16503</v>
+<v>16500</v>
 </b>
 <b>
 <a>15</a>
 <b>4800</b>
-<v>2620</v>
+<v>2619</v>
 </b>
 </bs>
 </hist>
@@ -23939,42 +23982,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27370</v>
+<v>27365</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21188</v>
+<v>21184</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12594</v>
+<v>12592</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10120</v>
+<v>10118</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7949</v>
+<v>7947</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9291</v>
+<v>9289</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8163</v>
+<v>8162</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7095</v>
+<v>7093</v>
 </b>
 </bs>
 </hist>
@@ -23990,12 +24033,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102680</v>
+<v>102662</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1093</v>
+<v>1092</v>
 </b>
 </bs>
 </hist>
@@ -24011,42 +24054,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27370</v>
+<v>27365</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21193</v>
+<v>21189</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12599</v>
+<v>12597</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10115</v>
+<v>10113</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7949</v>
+<v>7947</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9296</v>
+<v>9294</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8163</v>
+<v>8162</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7085</v>
+<v>7084</v>
 </b>
 </bs>
 </hist>
@@ -24062,37 +24105,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44611</v>
+<v>44603</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21241</v>
+<v>21237</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>9452</v>
+<v>9450</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7378</v>
+<v>7376</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>6172</v>
+<v>6171</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>9608</v>
+<v>9606</v>
 </b>
 <b>
 <a>9</a>
 <b>132</b>
-<v>5309</v>
+<v>5308</v>
 </b>
 </bs>
 </hist>
@@ -24108,42 +24151,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27370</v>
+<v>27365</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21188</v>
+<v>21184</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12594</v>
+<v>12592</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10120</v>
+<v>10118</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7949</v>
+<v>7947</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9291</v>
+<v>9289</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8163</v>
+<v>8162</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7095</v>
+<v>7093</v>
 </b>
 </bs>
 </hist>
@@ -24159,27 +24202,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55903</v>
+<v>55892</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10901</v>
+<v>10899</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6221</v>
+<v>6220</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7983</v>
+<v>7981</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>6802</v>
+<v>6801</v>
 </b>
 <b>
 <a>27</a>
@@ -24200,7 +24243,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87480</v>
+<v>87464</v>
 </b>
 <b>
 <a>2</a>
@@ -24221,22 +24264,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>63847</v>
+<v>63835</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9335</v>
+<v>9333</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>7900</v>
+<v>7898</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>6851</v>
+<v>6849</v>
 </b>
 <b>
 <a>18</a>
@@ -24257,22 +24300,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68439</v>
+<v>68426</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10057</v>
+<v>10055</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>7246</v>
+<v>7245</v>
 </b>
 <b>
 <a>7</a>
 <b>5746</b>
-<v>3938</v>
+<v>3937</v>
 </b>
 </bs>
 </hist>
@@ -24288,32 +24331,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55947</v>
+<v>55936</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11228</v>
+<v>11226</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5933</v>
+<v>5932</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7958</v>
+<v>7957</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>6758</v>
+<v>6757</v>
 </b>
 <b>
 <a>27</a>
 <b>9185</b>
-<v>1854</v>
+<v>1853</v>
 </b>
 </bs>
 </hist>
@@ -24329,7 +24372,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548109</v>
+<v>548009</v>
 </b>
 <b>
 <a>2</a>
@@ -24350,7 +24393,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>549022</v>
+<v>548921</v>
 </b>
 </bs>
 </hist>
@@ -24366,7 +24409,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>549022</v>
+<v>548921</v>
 </b>
 </bs>
 </hist>
@@ -24382,7 +24425,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548109</v>
+<v>548009</v>
 </b>
 <b>
 <a>2</a>
@@ -24403,7 +24446,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548524</v>
+<v>548424</v>
 </b>
 <b>
 <a>2</a>
@@ -24418,15 +24461,15 @@
 </relation>
 <relation>
 <name>field_location</name>
-<cardinality>637639</cardinality>
+<cardinality>637522</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>549354</v>
+<v>549253</v>
 </e>
 <e>
 <k>loc</k>
-<v>52945</v>
+<v>52936</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24440,17 +24483,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>467095</v>
+<v>467009</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>78242</v>
+<v>78228</v>
 </b>
 <b>
 <a>3</a>
 <b>57</b>
-<v>4016</v>
+<v>4015</v>
 </b>
 </bs>
 </hist>
@@ -24466,12 +24509,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49432</v>
+<v>49423</v>
 </b>
 <b>
 <a>2</a>
 <b>8882</b>
-<v>3513</v>
+<v>3512</v>
 </b>
 </bs>
 </hist>
@@ -24481,11 +24524,11 @@
 </relation>
 <relation>
 <name>localvars</name>
-<cardinality>163695</cardinality>
+<cardinality>163698</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163695</v>
+<v>163698</v>
 </e>
 <e>
 <k>kind</k>
@@ -24493,7 +24536,7 @@
 </e>
 <e>
 <k>name</k>
-<v>22593</v>
+<v>22594</v>
 </e>
 <e>
 <k>implicitly_typed</k>
@@ -24505,7 +24548,7 @@
 </e>
 <e>
 <k>parent_id</k>
-<v>163695</v>
+<v>163698</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24519,7 +24562,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -24535,7 +24578,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -24551,7 +24594,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -24567,7 +24610,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -24583,7 +24626,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -24607,8 +24650,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162441</a>
-<b>162442</b>
+<a>162444</a>
+<b>162445</b>
 <v>1</v>
 </b>
 </bs>
@@ -24633,8 +24676,8 @@
 <v>1</v>
 </b>
 <b>
-<a>22380</a>
-<b>22381</b>
+<a>22381</a>
+<b>22382</b>
 <v>1</v>
 </b>
 </bs>
@@ -24706,8 +24749,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162876</a>
-<b>162877</b>
+<a>162879</a>
+<b>162880</b>
 <v>1</v>
 </b>
 </bs>
@@ -24729,7 +24772,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3484</v>
+<v>3485</v>
 </b>
 <b>
 <a>3</a>
@@ -24760,7 +24803,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22501</v>
+<v>22502</v>
 </b>
 <b>
 <a>2</a>
@@ -24781,7 +24824,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19934</v>
+<v>19935</v>
 </b>
 <b>
 <a>2</a>
@@ -24802,7 +24845,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19224</v>
+<v>19225</v>
 </b>
 <b>
 <a>2</a>
@@ -24833,7 +24876,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3502</v>
+<v>3503</v>
 </b>
 <b>
 <a>3</a>
@@ -24862,13 +24905,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36616</a>
-<b>36617</b>
+<a>36617</a>
+<b>36618</b>
 <v>1</v>
 </b>
 <b>
-<a>126642</a>
-<b>126643</b>
+<a>126644</a>
+<b>126645</b>
 <v>1</v>
 </b>
 </bs>
@@ -24909,8 +24952,8 @@
 <v>1</v>
 </b>
 <b>
-<a>16705</a>
-<b>16706</b>
+<a>16706</a>
+<b>16707</b>
 <v>1</v>
 </b>
 </bs>
@@ -24946,13 +24989,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36765</a>
-<b>36766</b>
+<a>36766</a>
+<b>36767</b>
 <v>1</v>
 </b>
 <b>
-<a>126930</a>
-<b>126931</b>
+<a>126932</a>
+<b>126933</b>
 <v>1</v>
 </b>
 </bs>
@@ -24998,7 +25041,7 @@
 </b>
 <b>
 <a>35</a>
-<b>37234</b>
+<b>37235</b>
 <v>317</v>
 </b>
 </bs>
@@ -25060,7 +25103,7 @@
 </b>
 <b>
 <a>49</a>
-<b>1941</b>
+<b>1942</b>
 <v>84</v>
 </b>
 </bs>
@@ -25127,7 +25170,7 @@
 </b>
 <b>
 <a>35</a>
-<b>37239</b>
+<b>37240</b>
 <v>319</v>
 </b>
 </bs>
@@ -25144,7 +25187,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -25160,7 +25203,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -25176,7 +25219,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -25192,7 +25235,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -25208,7 +25251,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163695</v>
+<v>163698</v>
 </b>
 </bs>
 </hist>
@@ -25218,15 +25261,15 @@
 </relation>
 <relation>
 <name>localvar_location</name>
-<cardinality>163258</cardinality>
+<cardinality>163261</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163258</v>
+<v>163261</v>
 </e>
 <e>
 <k>loc</k>
-<v>163179</v>
+<v>163182</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25240,7 +25283,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163258</v>
+<v>163261</v>
 </b>
 </bs>
 </hist>
@@ -25256,7 +25299,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163100</v>
+<v>163103</v>
 </b>
 <b>
 <a>2</a>
@@ -25271,19 +25314,19 @@
 </relation>
 <relation>
 <name>params</name>
-<cardinality>2422000</cardinality>
+<cardinality>2421790</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2422000</v>
+<v>2421790</v>
 </e>
 <e>
 <k>name</k>
-<v>80960</v>
+<v>80946</v>
 </e>
 <e>
 <k>type_id</k>
-<v>331197</v>
+<v>331136</v>
 </e>
 <e>
 <k>index</k>
@@ -25295,11 +25338,11 @@
 </e>
 <e>
 <k>parent_id</k>
-<v>1372177</v>
+<v>1372160</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>1437654</v>
+<v>1437625</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25313,7 +25356,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422000</v>
+<v>2421790</v>
 </b>
 </bs>
 </hist>
@@ -25329,7 +25372,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422000</v>
+<v>2421790</v>
 </b>
 </bs>
 </hist>
@@ -25345,7 +25388,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422000</v>
+<v>2421790</v>
 </b>
 </bs>
 </hist>
@@ -25361,7 +25404,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422000</v>
+<v>2421790</v>
 </b>
 </bs>
 </hist>
@@ -25377,7 +25420,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422000</v>
+<v>2421790</v>
 </b>
 </bs>
 </hist>
@@ -25393,7 +25436,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422000</v>
+<v>2421790</v>
 </b>
 </bs>
 </hist>
@@ -25409,42 +25452,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31172</v>
+<v>31166</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13878</v>
+<v>13875</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7070</v>
+<v>7069</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4845</v>
+<v>4844</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6660</v>
+<v>6659</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6909</v>
+<v>6903</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6090</v>
+<v>6093</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4333</v>
+<v>4332</v>
 </b>
 </bs>
 </hist>
@@ -25460,17 +25503,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64330</v>
+<v>64318</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8173</v>
+<v>8172</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>6182</v>
+<v>6181</v>
 </b>
 <b>
 <a>12</a>
@@ -25491,22 +25534,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55107</v>
+<v>55097</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14590</v>
+<v>14587</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5523</v>
+<v>5522</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>5738</v>
+<v>5737</v>
 </b>
 </bs>
 </hist>
@@ -25522,12 +25565,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75920</v>
+<v>75906</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>5040</v>
+<v>5039</v>
 </b>
 </bs>
 </hist>
@@ -25543,42 +25586,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31172</v>
+<v>31166</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13878</v>
+<v>13875</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7070</v>
+<v>7069</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4845</v>
+<v>4844</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6660</v>
+<v>6659</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6909</v>
+<v>6903</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6090</v>
+<v>6093</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4333</v>
+<v>4332</v>
 </b>
 </bs>
 </hist>
@@ -25594,37 +25637,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31562</v>
+<v>31556</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14107</v>
+<v>14104</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7085</v>
+<v>7084</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4962</v>
+<v>4961</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6490</v>
+<v>6488</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6924</v>
+<v>6918</v>
 </b>
 <b>
 <a>13</a>
 <b>43</b>
-<v>6163</v>
+<v>6166</v>
 </b>
 <b>
 <a>43</a>
@@ -25645,27 +25688,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>227989</v>
+<v>227947</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39014</v>
+<v>39006</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30137</v>
+<v>30132</v>
 </b>
 <b>
 <a>6</a>
 <b>24</b>
-<v>25106</v>
+<v>25102</v>
 </b>
 <b>
 <a>24</a>
-<b>48952</b>
-<v>8949</v>
+<b>48953</b>
+<v>8947</v>
 </b>
 </bs>
 </hist>
@@ -25681,17 +25724,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>289631</v>
+<v>289578</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>30547</v>
+<v>30542</v>
 </b>
 <b>
 <a>4</a>
 <b>2470</b>
-<v>11018</v>
+<v>11016</v>
 </b>
 </bs>
 </hist>
@@ -25707,17 +25750,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>292700</v>
+<v>292647</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25121</v>
+<v>25116</v>
 </b>
 <b>
 <a>3</a>
 <b>36</b>
-<v>13375</v>
+<v>13373</v>
 </b>
 </bs>
 </hist>
@@ -25733,12 +25776,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>322472</v>
+<v>322413</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>8725</v>
+<v>8723</v>
 </b>
 </bs>
 </hist>
@@ -25754,27 +25797,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>230492</v>
+<v>230450</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37052</v>
+<v>37045</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30552</v>
+<v>30546</v>
 </b>
 <b>
 <a>6</a>
 <b>25</b>
-<v>25067</v>
+<v>25062</v>
 </b>
 <b>
 <a>25</a>
-<b>40409</b>
-<v>8032</v>
+<b>40410</b>
+<v>8030</v>
 </b>
 </bs>
 </hist>
@@ -25790,27 +25833,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>233689</v>
+<v>233646</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34968</v>
+<v>34962</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>25789</v>
+<v>25785</v>
 </b>
 <b>
 <a>5</a>
 <b>16</b>
-<v>25355</v>
+<v>25345</v>
 </b>
 <b>
 <a>16</a>
-<b>33990</b>
-<v>11394</v>
+<b>33991</b>
+<v>11397</v>
 </b>
 </bs>
 </hist>
@@ -25885,7 +25928,7 @@
 </b>
 <b>
 <a>47756</a>
-<b>281002</b>
+<b>281050</b>
 <v>14</v>
 </b>
 </bs>
@@ -26169,7 +26212,7 @@
 </b>
 <b>
 <a>47756</a>
-<b>281002</b>
+<b>281050</b>
 <v>14</v>
 </b>
 </bs>
@@ -26245,7 +26288,7 @@
 </b>
 <b>
 <a>29619</a>
-<b>168422</b>
+<b>168470</b>
 <v>14</v>
 </b>
 </bs>
@@ -26285,8 +26328,8 @@
 <v>4</v>
 </b>
 <b>
-<a>473058</a>
-<b>473059</b>
+<a>473106</a>
+<b>473107</b>
 <v>4</v>
 </b>
 </bs>
@@ -26449,8 +26492,8 @@
 <v>4</v>
 </b>
 <b>
-<a>274200</a>
-<b>274201</b>
+<a>274248</a>
+<b>274249</b>
 <v>4</v>
 </b>
 </bs>
@@ -26490,8 +26533,8 @@
 <v>4</v>
 </b>
 <b>
-<a>275403</a>
-<b>275404</b>
+<a>275451</a>
+<b>275452</b>
 <v>4</v>
 </b>
 </bs>
@@ -26508,22 +26551,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806022</v>
+<v>806108</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333261</v>
+<v>333200</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129432</v>
+<v>129408</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102949</v>
+<v>102930</v>
 </b>
 <b>
 <a>17</a>
@@ -26544,22 +26587,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806022</v>
+<v>806108</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333261</v>
+<v>333200</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129432</v>
+<v>129408</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102949</v>
+<v>102930</v>
 </b>
 <b>
 <a>17</a>
@@ -26580,22 +26623,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>855664</v>
+<v>855741</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333559</v>
+<v>333498</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>113489</v>
+<v>113468</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>69464</v>
+<v>69451</v>
 </b>
 </bs>
 </hist>
@@ -26611,22 +26654,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806022</v>
+<v>806108</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333261</v>
+<v>333200</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129432</v>
+<v>129408</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102949</v>
+<v>102930</v>
 </b>
 <b>
 <a>17</a>
@@ -26647,12 +26690,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1303543</v>
+<v>1303538</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>68634</v>
+<v>68621</v>
 </b>
 </bs>
 </hist>
@@ -26668,22 +26711,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806022</v>
+<v>806108</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333261</v>
+<v>333200</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129432</v>
+<v>129408</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102949</v>
+<v>102930</v>
 </b>
 <b>
 <a>17</a>
@@ -26704,12 +26747,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1387280</v>
+<v>1387260</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50374</v>
+<v>50365</v>
 </b>
 </bs>
 </hist>
@@ -26725,7 +26768,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1437654</v>
+<v>1437625</v>
 </b>
 </bs>
 </hist>
@@ -26741,12 +26784,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1419516</v>
+<v>1419490</v>
 </b>
 <b>
 <a>2</a>
 <b>3718</b>
-<v>18138</v>
+<v>18134</v>
 </b>
 </bs>
 </hist>
@@ -26762,7 +26805,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1437654</v>
+<v>1437625</v>
 </b>
 </bs>
 </hist>
@@ -26778,7 +26821,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1437654</v>
+<v>1437625</v>
 </b>
 </bs>
 </hist>
@@ -26794,12 +26837,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1387280</v>
+<v>1387260</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50374</v>
+<v>50365</v>
 </b>
 </bs>
 </hist>
@@ -26809,15 +26852,15 @@
 </relation>
 <relation>
 <name>param_location</name>
-<cardinality>2692131</cardinality>
+<cardinality>2691916</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2418301</v>
+<v>2418092</v>
 </e>
 <e>
 <k>loc</k>
-<v>137796</v>
+<v>137770</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -26831,17 +26874,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2154684</v>
+<v>2154479</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>256799</v>
+<v>256796</v>
 </b>
 <b>
 <a>3</a>
 <b>60</b>
-<v>6817</v>
+<v>6815</v>
 </b>
 </bs>
 </hist>
@@ -26857,12 +26900,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133467</v>
+<v>133443</v>
 </b>
 <b>
 <a>2</a>
 <b>99581</b>
-<v>4328</v>
+<v>4327</v>
 </b>
 </bs>
 </hist>
@@ -26872,11 +26915,11 @@
 </relation>
 <relation>
 <name>statements</name>
-<cardinality>991739</cardinality>
+<cardinality>991566</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>991739</v>
+<v>991566</v>
 </e>
 <e>
 <k>kind</k>
@@ -26894,7 +26937,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>991739</v>
+<v>991566</v>
 </b>
 </bs>
 </hist>
@@ -26995,11 +27038,11 @@
 </relation>
 <relation>
 <name>stmt_parent</name>
-<cardinality>820047</cardinality>
+<cardinality>819904</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>820047</v>
+<v>819904</v>
 </e>
 <e>
 <k>index</k>
@@ -27007,7 +27050,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>434427</v>
+<v>434351</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27021,7 +27064,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>820047</v>
+<v>819904</v>
 </b>
 </bs>
 </hist>
@@ -27037,7 +27080,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>820047</v>
+<v>819904</v>
 </b>
 </bs>
 </hist>
@@ -27053,7 +27096,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112</v>
+<v>111</v>
 </b>
 <b>
 <a>2</a>
@@ -27124,7 +27167,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112</v>
+<v>111</v>
 </b>
 <b>
 <a>2</a>
@@ -27195,22 +27238,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>293584</v>
+<v>293533</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>75350</v>
+<v>75337</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>38127</v>
+<v>38120</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27364</v>
+<v>27359</v>
 </b>
 </bs>
 </hist>
@@ -27226,22 +27269,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>293584</v>
+<v>293533</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>75350</v>
+<v>75337</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>38127</v>
+<v>38120</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27364</v>
+<v>27359</v>
 </b>
 </bs>
 </hist>
@@ -27251,11 +27294,11 @@
 </relation>
 <relation>
 <name>stmt_parent_top_level</name>
-<cardinality>171691</cardinality>
+<cardinality>171661</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>171691</v>
+<v>171661</v>
 </e>
 <e>
 <k>index</k>
@@ -27263,7 +27306,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>123179</v>
+<v>123158</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27277,7 +27320,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171691</v>
+<v>171661</v>
 </b>
 </bs>
 </hist>
@@ -27293,7 +27336,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171691</v>
+<v>171661</v>
 </b>
 </bs>
 </hist>
@@ -27341,12 +27384,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>77142</v>
+<v>77129</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43666</v>
+<v>43658</v>
 </b>
 <b>
 <a>3</a>
@@ -27367,7 +27410,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>123179</v>
+<v>123158</v>
 </b>
 </bs>
 </hist>
@@ -27377,15 +27420,15 @@
 </relation>
 <relation>
 <name>stmt_location</name>
-<cardinality>991739</cardinality>
+<cardinality>991566</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>991739</v>
+<v>991566</v>
 </e>
 <e>
 <k>loc</k>
-<v>960079</v>
+<v>959912</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27399,7 +27442,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>991739</v>
+<v>991566</v>
 </b>
 </bs>
 </hist>
@@ -27415,12 +27458,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>928419</v>
+<v>928257</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31659</v>
+<v>31654</v>
 </b>
 </bs>
 </hist>
@@ -27596,19 +27639,19 @@
 </relation>
 <relation>
 <name>expressions</name>
-<cardinality>4261883</cardinality>
+<cardinality>4261141</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4261883</v>
+<v>4261141</v>
 </e>
 <e>
 <k>kind</k>
-<v>127</v>
+<v>404</v>
 </e>
 <e>
 <k>type_id</k>
-<v>32658</v>
+<v>70422</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27622,7 +27665,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4261883</v>
+<v>4261141</v>
 </b>
 </bs>
 </hist>
@@ -27638,7 +27681,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4261883</v>
+<v>4261141</v>
 </b>
 </bs>
 </hist>
@@ -27653,68 +27696,68 @@
 <bs>
 <b>
 <a>1</a>
-<b>39</b>
-<v>10</v>
+<b>2</b>
+<v>19</v>
 </b>
 <b>
-<a>48</a>
-<b>151</b>
-<v>9</v>
+<a>2</a>
+<b>7</b>
+<v>34</v>
 </b>
 <b>
-<a>179</a>
-<b>368</b>
-<v>9</v>
+<a>7</a>
+<b>14</b>
+<v>34</v>
 </b>
 <b>
-<a>426</a>
-<b>610</b>
-<v>9</v>
+<a>16</a>
+<b>40</b>
+<v>29</v>
 </b>
 <b>
-<a>642</a>
-<b>1029</b>
-<v>9</v>
+<a>41</a>
+<b>56</b>
+<v>34</v>
 </b>
 <b>
-<a>1047</a>
-<b>1492</b>
-<v>9</v>
+<a>58</a>
+<b>166</b>
+<v>34</v>
 </b>
 <b>
-<a>1494</a>
-<b>3027</b>
-<v>9</v>
+<a>166</a>
+<b>302</b>
+<v>34</v>
 </b>
 <b>
-<a>3202</a>
-<b>5163</b>
-<v>9</v>
+<a>315</a>
+<b>813</b>
+<v>34</v>
 </b>
 <b>
-<a>5201</a>
-<b>10552</b>
-<v>9</v>
+<a>995</a>
+<b>1589</b>
+<v>34</v>
 </b>
 <b>
-<a>11568</a>
-<b>14479</b>
-<v>9</v>
+<a>3359</a>
+<b>9533</b>
+<v>34</v>
 </b>
 <b>
-<a>15514</a>
-<b>38009</b>
-<v>9</v>
+<a>10013</a>
+<b>21784</b>
+<v>34</v>
 </b>
 <b>
-<a>44298</a>
-<b>159279</b>
-<v>9</v>
+<a>28621</a>
+<b>87094</b>
+<v>34</v>
 </b>
 <b>
-<a>215953</a>
-<b>422428</b>
-<v>9</v>
+<a>94368</a>
+<b>128776</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -27730,57 +27773,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>37</v>
+<v>156</v>
 </b>
 <b>
 <a>2</a>
+<b>3</b>
+<v>39</v>
+</b>
+<b>
+<a>3</a>
 <b>6</b>
-<v>7</v>
+<v>34</v>
 </b>
 <b>
-<a>8</a>
-<b>10</b>
-<v>10</v>
+<a>7</a>
+<b>23</b>
+<v>34</v>
 </b>
 <b>
-<a>11</a>
-<b>24</b>
-<v>9</v>
+<a>25</a>
+<b>54</b>
+<v>34</v>
 </b>
 <b>
-<a>24</a>
-<b>57</b>
-<v>9</v>
+<a>63</a>
+<b>117</b>
+<v>34</v>
 </b>
 <b>
-<a>61</a>
-<b>140</b>
-<v>9</v>
+<a>252</a>
+<b>1822</b>
+<v>34</v>
 </b>
 <b>
-<a>142</a>
-<b>287</b>
-<v>9</v>
+<a>1908</a>
+<b>3347</b>
+<v>34</v>
 </b>
 <b>
-<a>296</a>
-<b>672</b>
-<v>9</v>
-</b>
-<b>
-<a>702</a>
-<b>1379</b>
-<v>9</v>
-</b>
-<b>
-<a>3180</a>
-<b>7557</b>
-<v>9</v>
-</b>
-<b>
-<a>8161</a>
-<b>10154</b>
-<v>3</v>
+<a>5304</a>
+<b>5305</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -27796,62 +27829,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6597</v>
+<v>12855</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3517</v>
+<v>21672</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>2252</v>
+<v>3342</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2203</v>
+<v>5605</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>2676</v>
+<v>5620</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>2956</v>
+<v>5596</v>
 </b>
 <b>
 <a>11</a>
-<b>17</b>
-<v>2455</v>
+<b>20</b>
+<v>5552</v>
 </b>
 <b>
-<a>17</a>
-<b>28</b>
-<v>2584</v>
+<a>20</a>
+<b>51</b>
+<v>5318</v>
 </b>
 <b>
-<a>28</a>
-<b>49</b>
-<v>2500</v>
-</b>
-<b>
-<a>49</a>
-<b>120</b>
-<v>2454</v>
-</b>
-<b>
-<a>120</a>
-<b>52455</b>
-<v>2449</v>
-</b>
-<b>
-<a>52738</a>
-<b>654765</b>
-<v>8</v>
+<a>51</a>
+<b>139941</b>
+<v>4859</v>
 </b>
 </bs>
 </hist>
@@ -27867,42 +27885,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12781</v>
+<v>31234</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4693</v>
+<v>24984</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4629</v>
+<v>5278</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>2542</v>
-</b>
-<b>
-<a>5</a>
 <b>6</b>
-<v>1998</v>
+<v>5113</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>2718</v>
-</b>
-<b>
-<a>8</a>
-<b>12</b>
-<v>2474</v>
-</b>
-<b>
-<a>12</a>
-<b>57</b>
-<v>820</v>
+<b>34</b>
+<v>3810</v>
 </b>
 </bs>
 </hist>
@@ -27912,19 +27915,19 @@
 </relation>
 <relation>
 <name>expr_parent</name>
-<cardinality>3939951</cardinality>
+<cardinality>3939265</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>3939951</v>
+<v>3939265</v>
 </e>
 <e>
 <k>index</k>
-<v>79803</v>
+<v>79789</v>
 </e>
 <e>
 <k>parent</k>
-<v>2586414</v>
+<v>2585963</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27938,7 +27941,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3939951</v>
+<v>3939265</v>
 </b>
 </bs>
 </hist>
@@ -27954,7 +27957,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3939951</v>
+<v>3939265</v>
 </b>
 </bs>
 </hist>
@@ -27970,17 +27973,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66181</v>
+<v>66169</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6196</v>
+<v>6195</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6040</v>
+<v>6039</v>
 </b>
 <b>
 <a>13</a>
@@ -28001,17 +28004,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66181</v>
+<v>66169</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6196</v>
+<v>6195</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6040</v>
+<v>6039</v>
 </b>
 <b>
 <a>13</a>
@@ -28032,17 +28035,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1623748</v>
+<v>1623465</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>833338</v>
+<v>833193</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>129327</v>
+<v>129304</v>
 </b>
 </bs>
 </hist>
@@ -28058,17 +28061,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1623748</v>
+<v>1623465</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>833338</v>
+<v>833193</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>129327</v>
+<v>129304</v>
 </b>
 </bs>
 </hist>
@@ -28078,11 +28081,11 @@
 </relation>
 <relation>
 <name>expr_parent_top_level</name>
-<cardinality>504747</cardinality>
+<cardinality>504665</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>504747</v>
+<v>504665</v>
 </e>
 <e>
 <k>index</k>
@@ -28090,7 +28093,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>436435</v>
+<v>436355</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28104,7 +28107,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>504747</v>
+<v>504665</v>
 </b>
 </bs>
 </hist>
@@ -28120,7 +28123,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>504747</v>
+<v>504665</v>
 </b>
 </bs>
 </hist>
@@ -28169,8 +28172,8 @@
 <v>4</v>
 </b>
 <b>
-<a>8472</a>
-<b>8473</b>
+<a>8474</a>
+<b>8475</b>
 <v>4</v>
 </b>
 <b>
@@ -28225,8 +28228,8 @@
 <v>4</v>
 </b>
 <b>
-<a>8472</a>
-<b>8473</b>
+<a>8474</a>
+<b>8475</b>
 <v>4</v>
 </b>
 <b>
@@ -28248,17 +28251,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396347</v>
+<v>396265</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35715</v>
+<v>35718</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4372</v>
+<v>4371</v>
 </b>
 </bs>
 </hist>
@@ -28274,17 +28277,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396528</v>
+<v>396445</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35593</v>
+<v>35596</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4313</v>
+<v>4312</v>
 </b>
 </bs>
 </hist>
@@ -28305,11 +28308,11 @@
 </relation>
 <relation>
 <name>explicitly_sized_array_creation</name>
-<cardinality>4357</cardinality>
+<cardinality>4356</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4357</v>
+<v>4356</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -28386,26 +28389,26 @@
 </relation>
 <relation>
 <name>expr_compiler_generated</name>
-<cardinality>1636707</cardinality>
+<cardinality>1636465</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1636707</v>
+<v>1636465</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_value</name>
-<cardinality>1403283</cardinality>
+<cardinality>1402656</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1403283</v>
+<v>1402656</v>
 </e>
 <e>
 <k>value</k>
-<v>102870</v>
+<v>102872</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28419,7 +28422,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1403283</v>
+<v>1402656</v>
 </b>
 </bs>
 </hist>
@@ -28435,27 +28438,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72259</v>
+<v>72270</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14965</v>
+<v>14976</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>7891</v>
+<v>7876</v>
 </b>
 <b>
 <a>6</a>
-<b>2062</b>
+<b>2345</b>
 <v>7716</v>
 </b>
 <b>
-<a>2136</a>
-<b>272585</b>
-<v>39</v>
+<a>2360</a>
+<b>272221</b>
+<v>34</v>
 </b>
 </bs>
 </hist>
@@ -28465,15 +28468,15 @@
 </relation>
 <relation>
 <name>expr_call</name>
-<cardinality>679347</cardinality>
+<cardinality>679349</cardinality>
 <columnsizes>
 <e>
 <k>caller_id</k>
-<v>679347</v>
+<v>679349</v>
 </e>
 <e>
 <k>target_id</k>
-<v>53849</v>
+<v>53845</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28487,7 +28490,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>679347</v>
+<v>679349</v>
 </b>
 </bs>
 </hist>
@@ -28503,32 +28506,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28343</v>
+<v>28345</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10448</v>
+<v>10445</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4324</v>
+<v>4322</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>4792</v>
+<v>4791</v>
 </b>
 <b>
 <a>7</a>
 <b>24</b>
-<v>4086</v>
+<v>4087</v>
 </b>
 <b>
 <a>24</a>
 <b>43831</b>
-<v>1856</v>
+<v>1855</v>
 </b>
 </bs>
 </hist>
@@ -28538,15 +28541,15 @@
 </relation>
 <relation>
 <name>expr_access</name>
-<cardinality>1389127</cardinality>
+<cardinality>1388885</cardinality>
 <columnsizes>
 <e>
 <k>accesser_id</k>
-<v>1389127</v>
+<v>1388885</v>
 </e>
 <e>
 <k>target_id</k>
-<v>331374</v>
+<v>331317</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28560,7 +28563,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1389127</v>
+<v>1388885</v>
 </b>
 </bs>
 </hist>
@@ -28576,37 +28579,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>104691</v>
+<v>104672</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70722</v>
+<v>70710</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>51580</v>
+<v>51571</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>33420</v>
+<v>33414</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>18851</v>
+<v>18848</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>27040</v>
+<v>27035</v>
 </b>
 <b>
 <a>9</a>
 <b>185</b>
-<v>24856</v>
+<v>24851</v>
 </b>
 <b>
 <a>185</a>
@@ -28621,15 +28624,15 @@
 </relation>
 <relation>
 <name>expr_location</name>
-<cardinality>4261883</cardinality>
+<cardinality>4261141</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4261883</v>
+<v>4261141</v>
 </e>
 <e>
 <k>loc</k>
-<v>3003685</v>
+<v>2613278</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28643,7 +28646,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4261883</v>
+<v>4261141</v>
 </b>
 </bs>
 </hist>
@@ -28659,17 +28662,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2748969</v>
+<v>1993792</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>249223</v>
+<v>610396</v>
 </b>
 <b>
 <a>3</a>
-<b>542816</b>
-<v>5493</v>
+<b>111245</b>
+<v>9089</v>
 </b>
 </bs>
 </hist>
@@ -28679,11 +28682,11 @@
 </relation>
 <relation>
 <name>dynamic_member_name</name>
-<cardinality>13653</cardinality>
+<cardinality>13651</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>13653</v>
+<v>13651</v>
 </e>
 <e>
 <k>name</k>
@@ -28701,7 +28704,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13653</v>
+<v>13651</v>
 </b>
 </bs>
 </hist>
@@ -28767,22 +28770,22 @@
 </relation>
 <relation>
 <name>conditional_access</name>
-<cardinality>3079</cardinality>
+<cardinality>3078</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3079</v>
+<v>3078</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_argument</name>
-<cardinality>875546</cardinality>
+<cardinality>875542</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>875546</v>
+<v>875542</v>
 </e>
 <e>
 <k>mode</k>
@@ -28800,7 +28803,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>875546</v>
+<v>875542</v>
 </b>
 </bs>
 </hist>
@@ -28829,8 +28832,8 @@
 <v>1</v>
 </b>
 <b>
-<a>865297</a>
-<b>865298</b>
+<a>865293</a>
+<b>865294</b>
 <v>1</v>
 </b>
 </bs>
@@ -33388,11 +33391,11 @@
 </relation>
 <relation>
 <name>commentline</name>
-<cardinality>410642</cardinality>
+<cardinality>410570</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>410642</v>
+<v>410570</v>
 </e>
 <e>
 <k>kind</k>
@@ -33400,11 +33403,11 @@
 </e>
 <e>
 <k>text</k>
-<v>196990</v>
+<v>196955</v>
 </e>
 <e>
 <k>rawtext</k>
-<v>199601</v>
+<v>199566</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33418,7 +33421,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410642</v>
+<v>410570</v>
 </b>
 </bs>
 </hist>
@@ -33434,7 +33437,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410642</v>
+<v>410570</v>
 </b>
 </bs>
 </hist>
@@ -33450,7 +33453,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410642</v>
+<v>410570</v>
 </b>
 </bs>
 </hist>
@@ -33544,17 +33547,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>161409</v>
+<v>161381</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23479</v>
+<v>23475</v>
 </b>
 <b>
 <a>3</a>
 <b>24462</b>
-<v>12101</v>
+<v>12099</v>
 </b>
 </bs>
 </hist>
@@ -33570,7 +33573,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>195900</v>
+<v>195866</v>
 </b>
 <b>
 <a>2</a>
@@ -33591,7 +33594,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>194914</v>
+<v>194880</v>
 </b>
 <b>
 <a>2</a>
@@ -33612,17 +33615,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>164732</v>
+<v>164703</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23012</v>
+<v>23008</v>
 </b>
 <b>
 <a>3</a>
 <b>24457</b>
-<v>11856</v>
+<v>11854</v>
 </b>
 </bs>
 </hist>
@@ -33638,7 +33641,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199601</v>
+<v>199566</v>
 </b>
 </bs>
 </hist>
@@ -33654,7 +33657,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199601</v>
+<v>199566</v>
 </b>
 </bs>
 </hist>
@@ -33664,15 +33667,15 @@
 </relation>
 <relation>
 <name>commentline_location</name>
-<cardinality>410642</cardinality>
+<cardinality>410570</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>410642</v>
+<v>410570</v>
 </e>
 <e>
 <k>loc</k>
-<v>410642</v>
+<v>410570</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33686,7 +33689,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410642</v>
+<v>410570</v>
 </b>
 </bs>
 </hist>
@@ -33702,7 +33705,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410642</v>
+<v>410570</v>
 </b>
 </bs>
 </hist>
@@ -33712,26 +33715,26 @@
 </relation>
 <relation>
 <name>commentblock</name>
-<cardinality>144334</cardinality>
+<cardinality>144309</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144334</v>
+<v>144309</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>commentblock_location</name>
-<cardinality>144334</cardinality>
+<cardinality>144309</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144334</v>
+<v>144309</v>
 </e>
 <e>
 <k>loc</k>
-<v>144334</v>
+<v>144309</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33745,7 +33748,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144334</v>
+<v>144309</v>
 </b>
 </bs>
 </hist>
@@ -33761,7 +33764,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144334</v>
+<v>144309</v>
 </b>
 </bs>
 </hist>
@@ -33771,15 +33774,15 @@
 </relation>
 <relation>
 <name>commentblock_binding</name>
-<cardinality>499908</cardinality>
+<cardinality>499821</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144276</v>
+<v>144251</v>
 </e>
 <e>
 <k>entity</k>
-<v>216060</v>
+<v>216022</v>
 </e>
 <e>
 <k>bindtype</k>
@@ -33797,17 +33800,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18058</v>
+<v>18055</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29056</v>
+<v>29051</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>96869</v>
+<v>96852</v>
 </b>
 <b>
 <a>4</a>
@@ -33828,22 +33831,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12957</v>
+<v>12954</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5222</v>
+<v>5221</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>29010</v>
+<v>29005</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>97086</v>
+<v>97069</v>
 </b>
 </bs>
 </hist>
@@ -33859,17 +33862,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>158340</v>
+<v>158312</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>42067</v>
+<v>42060</v>
 </b>
 <b>
 <a>3</a>
 <b>9895</b>
-<v>15652</v>
+<v>15650</v>
 </b>
 </bs>
 </hist>
@@ -33885,17 +33888,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94331</v>
+<v>94314</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>92778</v>
+<v>92762</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>28080</v>
+<v>28075</v>
 </b>
 <b>
 <a>4</a>
@@ -33972,19 +33975,19 @@
 </relation>
 <relation>
 <name>commentblock_child</name>
-<cardinality>543904</cardinality>
+<cardinality>543809</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144334</v>
+<v>144309</v>
 </e>
 <e>
 <k>commentline</k>
-<v>410555</v>
+<v>410484</v>
 </e>
 <e>
 <k>index</k>
-<v>4989</v>
+<v>4988</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33998,32 +34001,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76907</v>
+<v>76894</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19920</v>
+<v>19916</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18980</v>
+<v>18977</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8966</v>
+<v>8964</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>11476</v>
+<v>11474</v>
 </b>
 <b>
 <a>8</a>
 <b>4098</b>
-<v>8083</v>
+<v>8081</v>
 </b>
 </bs>
 </hist>
@@ -34039,37 +34042,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4206</v>
+<v>4205</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>73603</v>
+<v>73590</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>21669</v>
+<v>21666</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>17227</v>
+<v>17224</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>8623</v>
+<v>8622</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>11196</v>
+<v>11194</v>
 </b>
 <b>
 <a>9</a>
 <b>4099</b>
-<v>7806</v>
+<v>7805</v>
 </b>
 </bs>
 </hist>
@@ -34085,7 +34088,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410547</v>
+<v>410475</v>
 </b>
 <b>
 <a>2</a>
@@ -34106,12 +34109,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>277215</v>
+<v>277167</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>133340</v>
+<v>133316</v>
 </b>
 </bs>
 </hist>
@@ -34997,7 +35000,7 @@
 </e>
 <e>
 <k>name</k>
-<v>6</v>
+<v>3</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35025,19 +35028,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
-<v>4</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1</v>
-</b>
-<b>
 <a>3</a>
 <b>4</b>
-<v>1</v>
+<v>3</v>
 </b>
 </bs>
 </hist>
@@ -35058,11 +35051,11 @@
 </relation>
 <relation>
 <name>cil_instruction</name>
-<cardinality>32221232</cardinality>
+<cardinality>32215327</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32221232</v>
+<v>32215327</v>
 </e>
 <e>
 <k>opcode</k>
@@ -35070,11 +35063,11 @@
 </e>
 <e>
 <k>index</k>
-<v>332949</v>
+<v>332888</v>
 </e>
 <e>
 <k>impl</k>
-<v>1728950</v>
+<v>1728633</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35088,7 +35081,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32221232</v>
+<v>32215327</v>
 </b>
 </bs>
 </hist>
@@ -35104,7 +35097,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32221232</v>
+<v>32215327</v>
 </b>
 </bs>
 </hist>
@@ -35120,7 +35113,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32221232</v>
+<v>32215327</v>
 </b>
 </bs>
 </hist>
@@ -35374,22 +35367,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>260796</v>
+<v>260748</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30645</v>
+<v>30639</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25531</v>
+<v>25526</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15976</v>
+<v>15973</v>
 </b>
 </bs>
 </hist>
@@ -35405,22 +35398,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>261391</v>
+<v>261343</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17708</v>
+<v>17705</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>28776</v>
+<v>28770</v>
 </b>
 <b>
 <a>5</a>
 <b>160</b>
-<v>24974</v>
+<v>24970</v>
 </b>
 <b>
 <a>160</a>
@@ -35441,22 +35434,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>260796</v>
+<v>260748</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30645</v>
+<v>30639</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25531</v>
+<v>25526</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15976</v>
+<v>15973</v>
 </b>
 </bs>
 </hist>
@@ -35472,57 +35465,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84137</v>
+<v>84122</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252217</v>
+<v>252171</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>332837</v>
+<v>332776</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>196163</v>
+<v>196127</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>107224</v>
+<v>107204</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>158222</v>
+<v>158193</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>151220</v>
+<v>151192</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>134038</v>
+<v>134014</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131686</v>
+<v>131662</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129710</v>
+<v>129686</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51491</v>
+<v>51482</v>
 </b>
 </bs>
 </hist>
@@ -35538,57 +35531,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84137</v>
+<v>84122</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252505</v>
+<v>252459</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>338814</v>
+<v>338752</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>239813</v>
+<v>239769</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>132628</v>
+<v>132604</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>96468</v>
+<v>96451</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>147999</v>
+<v>147972</v>
 </b>
 <b>
 <a>9</a>
 <b>12</b>
-<v>129046</v>
+<v>129022</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>136005</v>
+<v>135980</v>
 </b>
 <b>
 <a>17</a>
 <b>33</b>
-<v>132281</v>
+<v>132257</v>
 </b>
 <b>
 <a>33</a>
 <b>74</b>
-<v>39248</v>
+<v>39241</v>
 </b>
 </bs>
 </hist>
@@ -35604,57 +35597,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84137</v>
+<v>84122</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252217</v>
+<v>252171</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>332837</v>
+<v>332776</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>196163</v>
+<v>196127</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>107224</v>
+<v>107204</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>158222</v>
+<v>158193</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>151220</v>
+<v>151192</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>134038</v>
+<v>134014</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131686</v>
+<v>131662</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129710</v>
+<v>129686</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51491</v>
+<v>51482</v>
 </b>
 </bs>
 </hist>
@@ -35664,15 +35657,15 @@
 </relation>
 <relation>
 <name>cil_jump</name>
-<cardinality>2007133</cardinality>
+<cardinality>2006765</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>2007133</v>
+<v>2006765</v>
 </e>
 <e>
 <k>target</k>
-<v>1607506</v>
+<v>1607211</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35686,7 +35679,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2007133</v>
+<v>2006765</v>
 </b>
 </bs>
 </hist>
@@ -35702,17 +35695,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1393507</v>
+<v>1393251</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>143954</v>
+<v>143927</v>
 </b>
 <b>
 <a>3</a>
 <b>360</b>
-<v>70044</v>
+<v>70031</v>
 </b>
 </bs>
 </hist>
@@ -35722,15 +35715,15 @@
 </relation>
 <relation>
 <name>cil_access</name>
-<cardinality>11947478</cardinality>
+<cardinality>11945289</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>11947478</v>
+<v>11945289</v>
 </e>
 <e>
 <k>target</k>
-<v>2669655</v>
+<v>2669166</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35744,7 +35737,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11947478</v>
+<v>11945289</v>
 </b>
 </bs>
 </hist>
@@ -35760,37 +35753,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>946721</v>
+<v>946548</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>741374</v>
+<v>741238</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>269560</v>
+<v>269511</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>187477</v>
+<v>187442</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>227116</v>
+<v>227074</v>
 </b>
 <b>
 <a>7</a>
 <b>14</b>
-<v>203922</v>
+<v>203884</v>
 </b>
 <b>
 <a>14</a>
 <b>25741</b>
-<v>93482</v>
+<v>93465</v>
 </b>
 </bs>
 </hist>
@@ -35800,15 +35793,15 @@
 </relation>
 <relation>
 <name>cil_value</name>
-<cardinality>1887558</cardinality>
+<cardinality>1887212</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>1887558</v>
+<v>1887212</v>
 </e>
 <e>
 <k>value</k>
-<v>495783</v>
+<v>495692</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35822,7 +35815,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1887558</v>
+<v>1887212</v>
 </b>
 </bs>
 </hist>
@@ -35838,27 +35831,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>334998</v>
+<v>334937</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79155</v>
+<v>79140</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>40785</v>
+<v>40777</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>37320</v>
+<v>37313</v>
 </b>
 <b>
 <a>33</a>
 <b>86799</b>
-<v>3523</v>
+<v>3522</v>
 </b>
 </bs>
 </hist>
@@ -35868,11 +35861,11 @@
 </relation>
 <relation>
 <name>cil_switch</name>
-<cardinality>194767</cardinality>
+<cardinality>194732</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>23896</v>
+<v>23892</v>
 </e>
 <e>
 <k>index</k>
@@ -35880,7 +35873,7 @@
 </e>
 <e>
 <k>target</k>
-<v>130852</v>
+<v>130828</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35894,17 +35887,17 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>7031</v>
+<v>7030</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4601</v>
+<v>4600</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3235</v>
+<v>3234</v>
 </b>
 <b>
 <a>6</a>
@@ -35955,12 +35948,12 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>8261</v>
+<v>8260</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5499</v>
+<v>5498</v>
 </b>
 <b>
 <a>5</a>
@@ -35975,7 +35968,7 @@
 <b>
 <a>7</a>
 <b>9</b>
-<v>1703</v>
+<v>1702</v>
 </b>
 <b>
 <a>9</a>
@@ -36123,7 +36116,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>129217</v>
+<v>129193</v>
 </b>
 <b>
 <a>2</a>
@@ -36144,12 +36137,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118437</v>
+<v>118416</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>10018</v>
+<v>10016</v>
 </b>
 <b>
 <a>7</a>
@@ -36232,11 +36225,11 @@
 </relation>
 <relation>
 <name>cil_type_location</name>
-<cardinality>277866</cardinality>
+<cardinality>277815</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>255453</v>
+<v>255406</v>
 </e>
 <e>
 <k>loc</k>
@@ -36254,12 +36247,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>233040</v>
+<v>232997</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22412</v>
+<v>22408</v>
 </b>
 </bs>
 </hist>
@@ -36305,7 +36298,7 @@
 <b>
 <a>17</a>
 <b>23</b>
-<v>283</v>
+<v>282</v>
 </b>
 <b>
 <a>23</a>
@@ -36345,11 +36338,11 @@
 </relation>
 <relation>
 <name>cil_method_location</name>
-<cardinality>1887514</cardinality>
+<cardinality>1887168</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1799941</v>
+<v>1799611</v>
 </e>
 <e>
 <k>loc</k>
@@ -36367,12 +36360,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1712368</v>
+<v>1712054</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>87573</v>
+<v>87556</v>
 </b>
 </bs>
 </hist>
@@ -36458,15 +36451,15 @@
 </relation>
 <relation>
 <name>cil_type</name>
-<cardinality>796257</cardinality>
+<cardinality>796111</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>796257</v>
+<v>796111</v>
 </e>
 <e>
 <k>name</k>
-<v>179406</v>
+<v>179373</v>
 </e>
 <e>
 <k>kind</k>
@@ -36474,11 +36467,11 @@
 </e>
 <e>
 <k>parent</k>
-<v>155719</v>
+<v>155691</v>
 </e>
 <e>
 <k>sourceDecl</k>
-<v>465480</v>
+<v>465394</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36492,7 +36485,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796257</v>
+<v>796111</v>
 </b>
 </bs>
 </hist>
@@ -36508,7 +36501,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796257</v>
+<v>796111</v>
 </b>
 </bs>
 </hist>
@@ -36524,7 +36517,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796257</v>
+<v>796111</v>
 </b>
 </bs>
 </hist>
@@ -36540,7 +36533,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796257</v>
+<v>796111</v>
 </b>
 </bs>
 </hist>
@@ -36556,22 +36549,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>137918</v>
+<v>137892</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22534</v>
+<v>22530</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>14175</v>
+<v>14173</v>
 </b>
 <b>
 <a>7</a>
 <b>21324</b>
-<v>4777</v>
+<v>4776</v>
 </b>
 </bs>
 </hist>
@@ -36587,7 +36580,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179406</v>
+<v>179373</v>
 </b>
 </bs>
 </hist>
@@ -36603,12 +36596,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162726</v>
+<v>162697</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>13668</v>
+<v>13665</v>
 </b>
 <b>
 <a>4</a>
@@ -36629,17 +36622,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>146394</v>
+<v>146367</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22559</v>
+<v>22555</v>
 </b>
 <b>
 <a>3</a>
 <b>21324</b>
-<v>10452</v>
+<v>10450</v>
 </b>
 </bs>
 </hist>
@@ -36779,27 +36772,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101968</v>
+<v>101949</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>26843</v>
+<v>26838</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13365</v>
+<v>13363</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>11721</v>
+<v>11719</v>
 </b>
 <b>
 <a>33</a>
 <b>26080</b>
-<v>1820</v>
+<v>1819</v>
 </b>
 </bs>
 </hist>
@@ -36815,22 +36808,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102544</v>
+<v>102525</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27263</v>
+<v>27258</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13263</v>
+<v>13260</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11706</v>
+<v>11704</v>
 </b>
 <b>
 <a>38</a>
@@ -36851,7 +36844,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>152508</v>
+<v>152480</v>
 </b>
 <b>
 <a>2</a>
@@ -36872,22 +36865,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102441</v>
+<v>102423</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27283</v>
+<v>27278</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13170</v>
+<v>13168</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11687</v>
+<v>11684</v>
 </b>
 <b>
 <a>38</a>
@@ -36908,12 +36901,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>438645</v>
+<v>438565</v>
 </b>
 <b>
 <a>2</a>
 <b>3705</b>
-<v>26834</v>
+<v>26829</v>
 </b>
 </bs>
 </hist>
@@ -36929,7 +36922,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>465480</v>
+<v>465394</v>
 </b>
 </bs>
 </hist>
@@ -36945,7 +36938,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>465480</v>
+<v>465394</v>
 </b>
 </bs>
 </hist>
@@ -36961,12 +36954,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>457140</v>
+<v>457056</v>
 </b>
 <b>
 <a>2</a>
 <b>225</b>
-<v>8339</v>
+<v>8338</v>
 </b>
 </bs>
 </hist>
@@ -37024,15 +37017,15 @@
 </relation>
 <relation>
 <name>cil_array_type</name>
-<cardinality>14195</cardinality>
+<cardinality>14192</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14195</v>
+<v>14192</v>
 </e>
 <e>
 <k>element_type</k>
-<v>14117</v>
+<v>14114</v>
 </e>
 <e>
 <k>rank</k>
@@ -37050,7 +37043,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14195</v>
+<v>14192</v>
 </b>
 </bs>
 </hist>
@@ -37066,7 +37059,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14195</v>
+<v>14192</v>
 </b>
 </bs>
 </hist>
@@ -37082,7 +37075,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14044</v>
+<v>14041</v>
 </b>
 <b>
 <a>2</a>
@@ -37103,7 +37096,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14044</v>
+<v>14041</v>
 </b>
 <b>
 <a>2</a>
@@ -37170,23 +37163,23 @@
 </relation>
 <relation>
 <name>cil_method</name>
-<cardinality>2316098</cardinality>
+<cardinality>2315674</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2316098</v>
+<v>2315674</v>
 </e>
 <e>
 <k>name</k>
-<v>440451</v>
+<v>440370</v>
 </e>
 <e>
 <k>parent</k>
-<v>380615</v>
+<v>380545</v>
 </e>
 <e>
 <k>return_type</k>
-<v>214252</v>
+<v>214213</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37200,7 +37193,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2316098</v>
+<v>2315674</v>
 </b>
 </bs>
 </hist>
@@ -37216,7 +37209,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2316098</v>
+<v>2315674</v>
 </b>
 </bs>
 </hist>
@@ -37232,7 +37225,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2316098</v>
+<v>2315674</v>
 </b>
 </bs>
 </hist>
@@ -37248,27 +37241,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>271371</v>
+<v>271321</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79711</v>
+<v>79697</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>25067</v>
+<v>25062</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>33538</v>
+<v>33532</v>
 </b>
 <b>
 <a>7</a>
 <b>64064</b>
-<v>30762</v>
+<v>30756</v>
 </b>
 </bs>
 </hist>
@@ -37284,27 +37277,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>285400</v>
+<v>285348</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>76666</v>
+<v>76652</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>39921</v>
+<v>39914</v>
 </b>
 <b>
 <a>5</a>
 <b>25</b>
-<v>33202</v>
+<v>33196</v>
 </b>
 <b>
 <a>25</a>
 <b>52725</b>
-<v>5260</v>
+<v>5259</v>
 </b>
 </bs>
 </hist>
@@ -37320,17 +37313,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>384606</v>
+<v>384536</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>40282</v>
+<v>40275</v>
 </b>
 <b>
 <a>4</a>
 <b>2803</b>
-<v>15561</v>
+<v>15558</v>
 </b>
 </bs>
 </hist>
@@ -37346,42 +37339,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>108112</v>
+<v>108092</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>84615</v>
+<v>84600</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50013</v>
+<v>50003</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28605</v>
+<v>28600</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>30908</v>
+<v>30903</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>32958</v>
+<v>32952</v>
 </b>
 <b>
 <a>11</a>
 <b>21</b>
-<v>28990</v>
+<v>28985</v>
 </b>
 <b>
 <a>21</a>
 <b>3536</b>
-<v>16410</v>
+<v>16407</v>
 </b>
 </bs>
 </hist>
@@ -37397,42 +37390,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>114509</v>
+<v>114488</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86772</v>
+<v>86756</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50569</v>
+<v>50560</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28951</v>
+<v>28946</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>32914</v>
+<v>32908</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>30049</v>
+<v>30044</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>28727</v>
+<v>28722</v>
 </b>
 <b>
 <a>26</a>
 <b>1885</b>
-<v>8120</v>
+<v>8118</v>
 </b>
 </bs>
 </hist>
@@ -37448,32 +37441,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162365</v>
+<v>162336</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>93809</v>
+<v>93792</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>46450</v>
+<v>46442</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23325</v>
+<v>23321</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>28429</v>
+<v>28424</v>
 </b>
 <b>
 <a>7</a>
 <b>1924</b>
-<v>26233</v>
+<v>26229</v>
 </b>
 </bs>
 </hist>
@@ -37489,27 +37482,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132130</v>
+<v>132106</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>38286</v>
+<v>38279</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>18865</v>
+<v>18861</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>16586</v>
+<v>16583</v>
 </b>
 <b>
 <a>13</a>
 <b>190707</b>
-<v>8383</v>
+<v>8381</v>
 </b>
 </bs>
 </hist>
@@ -37525,22 +37518,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>153728</v>
+<v>153700</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30381</v>
+<v>30376</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>19167</v>
+<v>19164</v>
 </b>
 <b>
 <a>6</a>
 <b>28461</b>
-<v>10974</v>
+<v>10972</v>
 </b>
 </bs>
 </hist>
@@ -37556,22 +37549,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145569</v>
+<v>145542</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>35432</v>
+<v>35425</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>17572</v>
+<v>17568</v>
 </b>
 <b>
 <a>5</a>
 <b>62018</b>
-<v>15678</v>
+<v>15675</v>
 </b>
 </bs>
 </hist>
@@ -37581,15 +37574,15 @@
 </relation>
 <relation>
 <name>cil_method_source_declaration</name>
-<cardinality>2109599</cardinality>
+<cardinality>2109213</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>2109599</v>
+<v>2109213</v>
 </e>
 <e>
 <k>source</k>
-<v>1866692</v>
+<v>1866350</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37603,7 +37596,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2109599</v>
+<v>2109213</v>
 </b>
 </bs>
 </hist>
@@ -37619,12 +37612,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1761625</v>
+<v>1761302</v>
 </b>
 <b>
 <a>2</a>
 <b>1021</b>
-<v>105067</v>
+<v>105047</v>
 </b>
 </bs>
 </hist>
@@ -37634,15 +37627,15 @@
 </relation>
 <relation>
 <name>cil_method_implementation</name>
-<cardinality>1728950</cardinality>
+<cardinality>1728633</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1728950</v>
+<v>1728633</v>
 </e>
 <e>
 <k>method</k>
-<v>1642021</v>
+<v>1641720</v>
 </e>
 <e>
 <k>location</k>
@@ -37660,7 +37653,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1728950</v>
+<v>1728633</v>
 </b>
 </bs>
 </hist>
@@ -37676,7 +37669,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1728950</v>
+<v>1728633</v>
 </b>
 </bs>
 </hist>
@@ -37692,12 +37685,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1555092</v>
+<v>1554807</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86928</v>
+<v>86912</v>
 </b>
 </bs>
 </hist>
@@ -37713,12 +37706,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1555092</v>
+<v>1554807</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86928</v>
+<v>86912</v>
 </b>
 </bs>
 </hist>
@@ -37880,15 +37873,15 @@
 </relation>
 <relation>
 <name>cil_implements</name>
-<cardinality>107253</cardinality>
+<cardinality>107233</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>106492</v>
+<v>106472</v>
 </e>
 <e>
 <k>decl</k>
-<v>17752</v>
+<v>17749</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37902,7 +37895,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>105730</v>
+<v>105711</v>
 </b>
 <b>
 <a>2</a>
@@ -37923,22 +37916,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11555</v>
+<v>11553</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2708</v>
+<v>2707</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>1581</v>
+<v>1580</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>1332</v>
+<v>1331</v>
 </b>
 <b>
 <a>18</a>
@@ -37953,23 +37946,23 @@
 </relation>
 <relation>
 <name>cil_field</name>
-<cardinality>1010208</cardinality>
+<cardinality>1010023</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1010208</v>
+<v>1010023</v>
 </e>
 <e>
 <k>parent</k>
-<v>201492</v>
+<v>201455</v>
 </e>
 <e>
 <k>name</k>
-<v>361486</v>
+<v>361420</v>
 </e>
 <e>
 <k>field_type</k>
-<v>166147</v>
+<v>166117</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37983,7 +37976,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1010208</v>
+<v>1010023</v>
 </b>
 </bs>
 </hist>
@@ -37999,7 +37992,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1010208</v>
+<v>1010023</v>
 </b>
 </bs>
 </hist>
@@ -38015,7 +38008,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1010208</v>
+<v>1010023</v>
 </b>
 </bs>
 </hist>
@@ -38031,42 +38024,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60724</v>
+<v>60713</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41102</v>
+<v>41095</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22330</v>
+<v>22325</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15508</v>
+<v>15505</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11731</v>
+<v>11728</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16976</v>
+<v>16973</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17884</v>
+<v>17881</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15117</v>
+<v>15114</v>
 </b>
 <b>
 <a>237</a>
@@ -38087,42 +38080,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60724</v>
+<v>60713</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41102</v>
+<v>41095</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22330</v>
+<v>22325</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15508</v>
+<v>15505</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11731</v>
+<v>11728</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16976</v>
+<v>16973</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17884</v>
+<v>17881</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15117</v>
+<v>15114</v>
 </b>
 <b>
 <a>237</a>
@@ -38143,37 +38136,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70527</v>
+<v>70514</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>59860</v>
+<v>59849</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20456</v>
+<v>20452</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11482</v>
+<v>11480</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>15712</v>
+<v>15710</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>16083</v>
+<v>16080</v>
 </b>
 <b>
 <a>11</a>
 <b>132</b>
-<v>7368</v>
+<v>7367</v>
 </b>
 </bs>
 </hist>
@@ -38189,22 +38182,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>262304</v>
+<v>262256</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55449</v>
+<v>55439</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30123</v>
+<v>30117</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13609</v>
+<v>13607</v>
 </b>
 </bs>
 </hist>
@@ -38220,22 +38213,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>262304</v>
+<v>262256</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55449</v>
+<v>55439</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30123</v>
+<v>30117</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13609</v>
+<v>13607</v>
 </b>
 </bs>
 </hist>
@@ -38251,17 +38244,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>305929</v>
+<v>305873</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34114</v>
+<v>34108</v>
 </b>
 <b>
 <a>3</a>
 <b>2790</b>
-<v>21441</v>
+<v>21437</v>
 </b>
 </bs>
 </hist>
@@ -38277,27 +38270,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>82761</v>
+<v>82746</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43840</v>
+<v>43832</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8973</v>
+<v>8972</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>15283</v>
+<v>15280</v>
 </b>
 <b>
 <a>7</a>
 <b>31</b>
-<v>12560</v>
+<v>12558</v>
 </b>
 <b>
 <a>31</a>
@@ -38318,22 +38311,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96864</v>
+<v>96846</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44567</v>
+<v>44559</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>14253</v>
+<v>14251</v>
 </b>
 <b>
 <a>6</a>
 <b>12257</b>
-<v>10462</v>
+<v>10460</v>
 </b>
 </bs>
 </hist>
@@ -38349,27 +38342,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>120018</v>
+<v>119996</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17991</v>
+<v>17988</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>13263</v>
+<v>13260</v>
 </b>
 <b>
 <a>5</a>
 <b>20</b>
-<v>12487</v>
+<v>12485</v>
 </b>
 <b>
 <a>20</a>
 <b>8901</b>
-<v>2386</v>
+<v>2385</v>
 </b>
 </bs>
 </hist>
@@ -38379,15 +38372,15 @@
 </relation>
 <relation>
 <name>cil_parameter</name>
-<cardinality>4555008</cardinality>
+<cardinality>4554173</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4555008</v>
+<v>4554173</v>
 </e>
 <e>
 <k>method</k>
-<v>2224426</v>
+<v>2224018</v>
 </e>
 <e>
 <k>index</k>
@@ -38395,7 +38388,7 @@
 </e>
 <e>
 <k>param_type</k>
-<v>553531</v>
+<v>553429</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38409,7 +38402,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4555008</v>
+<v>4554173</v>
 </b>
 </bs>
 </hist>
@@ -38425,7 +38418,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4555008</v>
+<v>4554173</v>
 </b>
 </bs>
 </hist>
@@ -38441,7 +38434,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4555008</v>
+<v>4554173</v>
 </b>
 </bs>
 </hist>
@@ -38457,27 +38450,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>902227</v>
+<v>902062</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>788864</v>
+<v>788720</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>325224</v>
+<v>325164</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>175248</v>
+<v>175216</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32860</v>
+<v>32854</v>
 </b>
 </bs>
 </hist>
@@ -38493,27 +38486,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>902227</v>
+<v>902062</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>788864</v>
+<v>788720</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>325224</v>
+<v>325164</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>175248</v>
+<v>175216</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32860</v>
+<v>32854</v>
 </b>
 </bs>
 </hist>
@@ -38529,22 +38522,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>950347</v>
+<v>950173</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>799390</v>
+<v>799244</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>313566</v>
+<v>313509</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>161121</v>
+<v>161091</v>
 </b>
 </bs>
 </hist>
@@ -38793,42 +38786,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185740</v>
+<v>185706</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137312</v>
+<v>137287</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45099</v>
+<v>45090</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>38521</v>
+<v>38514</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>43932</v>
+<v>43924</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42839</v>
+<v>42831</v>
 </b>
 <b>
 <a>11</a>
 <b>27</b>
-<v>41956</v>
+<v>41948</v>
 </b>
 <b>
 <a>27</a>
 <b>58010</b>
-<v>18128</v>
+<v>18125</v>
 </b>
 </bs>
 </hist>
@@ -38844,42 +38837,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>188951</v>
+<v>188916</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>136010</v>
+<v>135985</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45513</v>
+<v>45505</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>37301</v>
+<v>37294</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>44381</v>
+<v>44373</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42898</v>
+<v>42890</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>41795</v>
+<v>41787</v>
 </b>
 <b>
 <a>28</a>
 <b>46068</b>
-<v>16679</v>
+<v>16676</v>
 </b>
 </bs>
 </hist>
@@ -38895,22 +38888,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>386285</v>
+<v>386214</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>110029</v>
+<v>110009</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>44547</v>
+<v>44539</v>
 </b>
 <b>
 <a>4</a>
 <b>36</b>
-<v>12667</v>
+<v>12665</v>
 </b>
 </bs>
 </hist>
@@ -38920,37 +38913,37 @@
 </relation>
 <relation>
 <name>cil_parameter_in</name>
-<cardinality>32411</cardinality>
+<cardinality>32405</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32411</v>
+<v>32405</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_parameter_out</name>
-<cardinality>46109</cardinality>
+<cardinality>46100</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>46109</v>
+<v>46100</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_setter</name>
-<cardinality>106955</cardinality>
+<cardinality>106936</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>106955</v>
+<v>106936</v>
 </e>
 <e>
 <k>method</k>
-<v>106955</v>
+<v>106936</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38964,7 +38957,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106955</v>
+<v>106936</v>
 </b>
 </bs>
 </hist>
@@ -38980,7 +38973,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106955</v>
+<v>106936</v>
 </b>
 </bs>
 </hist>
@@ -38990,11 +38983,11 @@
 </relation>
 <relation>
 <name>cil_custom_modifiers</name>
-<cardinality>4113</cardinality>
+<cardinality>4112</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4113</v>
+<v>4112</v>
 </e>
 <e>
 <k>modifier</k>
@@ -39016,7 +39009,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4113</v>
+<v>4112</v>
 </b>
 </bs>
 </hist>
@@ -39032,7 +39025,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4113</v>
+<v>4112</v>
 </b>
 </bs>
 </hist>
@@ -39156,15 +39149,15 @@
 </relation>
 <relation>
 <name>cil_getter</name>
-<cardinality>380063</cardinality>
+<cardinality>379994</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>380063</v>
+<v>379994</v>
 </e>
 <e>
 <k>method</k>
-<v>380063</v>
+<v>379994</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39178,7 +39171,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380063</v>
+<v>379994</v>
 </b>
 </bs>
 </hist>
@@ -39194,7 +39187,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380063</v>
+<v>379994</v>
 </b>
 </bs>
 </hist>
@@ -39204,15 +39197,15 @@
 </relation>
 <relation>
 <name>cil_adder</name>
-<cardinality>20909</cardinality>
+<cardinality>20906</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20909</v>
+<v>20906</v>
 </e>
 <e>
 <k>method</k>
-<v>20909</v>
+<v>20906</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39226,7 +39219,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20909</v>
+<v>20906</v>
 </b>
 </bs>
 </hist>
@@ -39242,7 +39235,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20909</v>
+<v>20906</v>
 </b>
 </bs>
 </hist>
@@ -39252,15 +39245,15 @@
 </relation>
 <relation>
 <name>cil_remover</name>
-<cardinality>20909</cardinality>
+<cardinality>20906</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20909</v>
+<v>20906</v>
 </e>
 <e>
 <k>method</k>
-<v>20909</v>
+<v>20906</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39274,7 +39267,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20909</v>
+<v>20906</v>
 </b>
 </bs>
 </hist>
@@ -39290,7 +39283,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20909</v>
+<v>20906</v>
 </b>
 </bs>
 </hist>
@@ -39348,23 +39341,23 @@
 </relation>
 <relation>
 <name>cil_property</name>
-<cardinality>380610</cardinality>
+<cardinality>380540</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>380610</v>
+<v>380540</v>
 </e>
 <e>
 <k>parent</k>
-<v>93824</v>
+<v>93806</v>
 </e>
 <e>
 <k>name</k>
-<v>106428</v>
+<v>106409</v>
 </e>
 <e>
 <k>property_type</k>
-<v>49915</v>
+<v>49906</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39378,7 +39371,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380610</v>
+<v>380540</v>
 </b>
 </bs>
 </hist>
@@ -39394,7 +39387,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380610</v>
+<v>380540</v>
 </b>
 </bs>
 </hist>
@@ -39410,7 +39403,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380610</v>
+<v>380540</v>
 </b>
 </bs>
 </hist>
@@ -39426,37 +39419,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28917</v>
+<v>28912</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22315</v>
+<v>22311</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11433</v>
+<v>11431</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8466</v>
+<v>8464</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5748</v>
+<v>5747</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>8676</v>
+<v>8674</v>
 </b>
 <b>
 <a>9</a>
 <b>25</b>
-<v>7109</v>
+<v>7108</v>
 </b>
 <b>
 <a>25</a>
@@ -39477,37 +39470,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33670</v>
+<v>33664</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17821</v>
+<v>17817</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11330</v>
+<v>11328</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8476</v>
+<v>8474</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5728</v>
+<v>5727</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>6636</v>
+<v>6635</v>
 </b>
 <b>
 <a>8</a>
 <b>15</b>
-<v>7226</v>
+<v>7225</v>
 </b>
 <b>
 <a>15</a>
@@ -39528,32 +39521,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35119</v>
+<v>35113</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25804</v>
+<v>25799</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13497</v>
+<v>13495</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8115</v>
+<v>8113</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>7768</v>
+<v>7767</v>
 </b>
 <b>
 <a>8</a>
 <b>50</b>
-<v>3518</v>
+<v>3517</v>
 </b>
 </bs>
 </hist>
@@ -39569,27 +39562,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62744</v>
+<v>62733</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21471</v>
+<v>21467</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6490</v>
+<v>6488</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8773</v>
+<v>8772</v>
 </b>
 <b>
 <a>8</a>
 <b>2134</b>
-<v>6948</v>
+<v>6947</v>
 </b>
 </bs>
 </hist>
@@ -39605,27 +39598,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62744</v>
+<v>62733</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21544</v>
+<v>21540</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6465</v>
+<v>6464</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8788</v>
+<v>8786</v>
 </b>
 <b>
 <a>8</a>
 <b>1400</b>
-<v>6885</v>
+<v>6884</v>
 </b>
 </bs>
 </hist>
@@ -39641,17 +39634,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89568</v>
+<v>89552</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10989</v>
+<v>10987</v>
 </b>
 <b>
 <a>3</a>
 <b>568</b>
-<v>5870</v>
+<v>5869</v>
 </b>
 </bs>
 </hist>
@@ -39667,27 +39660,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31474</v>
+<v>31468</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7529</v>
+<v>7528</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3186</v>
+<v>3185</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>4372</v>
+<v>4371</v>
 </b>
 <b>
 <a>8</a>
 <b>15452</b>
-<v>3352</v>
+<v>3351</v>
 </b>
 </bs>
 </hist>
@@ -39703,12 +39696,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33265</v>
+<v>33259</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7041</v>
+<v>7040</v>
 </b>
 <b>
 <a>3</a>
@@ -39718,7 +39711,7 @@
 <b>
 <a>4</a>
 <b>8</b>
-<v>3869</v>
+<v>3868</v>
 </b>
 <b>
 <a>8</a>
@@ -39739,7 +39732,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39999</v>
+<v>39992</v>
 </b>
 <b>
 <a>2</a>
@@ -39749,7 +39742,7 @@
 <b>
 <a>3</a>
 <b>12</b>
-<v>3806</v>
+<v>3805</v>
 </b>
 <b>
 <a>12</a>
@@ -39764,23 +39757,23 @@
 </relation>
 <relation>
 <name>cil_event</name>
-<cardinality>20880</cardinality>
+<cardinality>20876</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>20880</v>
+<v>20876</v>
 </e>
 <e>
 <k>parent</k>
-<v>6470</v>
+<v>6469</v>
 </e>
 <e>
 <k>name</k>
-<v>13087</v>
+<v>13085</v>
 </e>
 <e>
 <k>event_type</k>
-<v>6807</v>
+<v>6806</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39794,7 +39787,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20880</v>
+<v>20876</v>
 </b>
 </bs>
 </hist>
@@ -39810,7 +39803,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20880</v>
+<v>20876</v>
 </b>
 </bs>
 </hist>
@@ -39826,7 +39819,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20880</v>
+<v>20876</v>
 </b>
 </bs>
 </hist>
@@ -39842,7 +39835,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5753</v>
+<v>5752</v>
 </b>
 <b>
 <a>2</a>
@@ -39868,7 +39861,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5753</v>
+<v>5752</v>
 </b>
 <b>
 <a>2</a>
@@ -39894,7 +39887,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5928</v>
+<v>5927</v>
 </b>
 <b>
 <a>2</a>
@@ -39920,7 +39913,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11677</v>
+<v>11675</v>
 </b>
 <b>
 <a>2</a>
@@ -39930,7 +39923,7 @@
 <b>
 <a>4</a>
 <b>566</b>
-<v>444</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -39946,7 +39939,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11677</v>
+<v>11675</v>
 </b>
 <b>
 <a>2</a>
@@ -39956,7 +39949,7 @@
 <b>
 <a>4</a>
 <b>566</b>
-<v>444</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -39972,7 +39965,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12492</v>
+<v>12490</v>
 </b>
 <b>
 <a>2</a>
@@ -39998,7 +39991,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>4523</v>
+<v>4522</v>
 </b>
 <b>
 <a>3</a>
@@ -40034,7 +40027,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>5094</v>
+<v>5093</v>
 </b>
 <b>
 <a>3</a>
@@ -40060,7 +40053,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>4352</v>
+<v>4351</v>
 </b>
 <b>
 <a>3</a>
@@ -40085,15 +40078,15 @@
 </relation>
 <relation>
 <name>cil_local_variable</name>
-<cardinality>1152771</cardinality>
+<cardinality>1152560</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1152771</v>
+<v>1152560</v>
 </e>
 <e>
 <k>impl</k>
-<v>349267</v>
+<v>349203</v>
 </e>
 <e>
 <k>index</k>
@@ -40101,7 +40094,7 @@
 </e>
 <e>
 <k>var_type</k>
-<v>154524</v>
+<v>154495</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40115,7 +40108,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1152771</v>
+<v>1152560</v>
 </b>
 </bs>
 </hist>
@@ -40131,7 +40124,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1152771</v>
+<v>1152560</v>
 </b>
 </bs>
 </hist>
@@ -40147,7 +40140,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1152771</v>
+<v>1152560</v>
 </b>
 </bs>
 </hist>
@@ -40163,37 +40156,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140152</v>
+<v>140127</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62144</v>
+<v>62132</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49408</v>
+<v>49399</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23515</v>
+<v>23511</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31933</v>
+<v>31927</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28907</v>
+<v>28902</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13204</v>
+<v>13202</v>
 </b>
 </bs>
 </hist>
@@ -40209,37 +40202,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140152</v>
+<v>140127</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62144</v>
+<v>62132</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49408</v>
+<v>49399</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23515</v>
+<v>23511</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31933</v>
+<v>31927</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28907</v>
+<v>28902</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13204</v>
+<v>13202</v>
 </b>
 </bs>
 </hist>
@@ -40255,32 +40248,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>168860</v>
+<v>168829</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70142</v>
+<v>70129</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>37901</v>
+<v>37894</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>20641</v>
+<v>20637</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>27741</v>
+<v>27736</v>
 </b>
 <b>
 <a>7</a>
 <b>47</b>
-<v>23979</v>
+<v>23974</v>
 </b>
 </bs>
 </hist>
@@ -40514,32 +40507,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>81429</v>
+<v>81414</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27307</v>
+<v>27302</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8383</v>
+<v>8381</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11848</v>
+<v>11846</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>12809</v>
+<v>12807</v>
 </b>
 <b>
 <a>8</a>
 <b>76</b>
-<v>11599</v>
+<v>11597</v>
 </b>
 <b>
 <a>76</a>
@@ -40560,32 +40553,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85469</v>
+<v>85454</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31055</v>
+<v>31049</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8398</v>
+<v>8396</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11716</v>
+<v>11714</v>
 </b>
 <b>
 <a>5</a>
 <b>14</b>
-<v>12043</v>
+<v>12041</v>
 </b>
 <b>
 <a>14</a>
 <b>21451</b>
-<v>5841</v>
+<v>5840</v>
 </b>
 </bs>
 </hist>
@@ -40601,27 +40594,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96790</v>
+<v>96773</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>28737</v>
+<v>28731</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13790</v>
+<v>13787</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>11896</v>
+<v>11894</v>
 </b>
 <b>
 <a>9</a>
 <b>122</b>
-<v>3308</v>
+<v>3307</v>
 </b>
 </bs>
 </hist>
@@ -40631,15 +40624,15 @@
 </relation>
 <relation>
 <name>cil_handler</name>
-<cardinality>101641</cardinality>
+<cardinality>101622</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>101641</v>
+<v>101622</v>
 </e>
 <e>
 <k>impl</k>
-<v>71557</v>
+<v>71544</v>
 </e>
 <e>
 <k>index</k>
@@ -40651,15 +40644,15 @@
 </e>
 <e>
 <k>try_start</k>
-<v>97796</v>
+<v>97778</v>
 </e>
 <e>
 <k>try_end</k>
-<v>100016</v>
+<v>99998</v>
 </e>
 <e>
 <k>handler_start</k>
-<v>101641</v>
+<v>101622</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40673,7 +40666,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -40689,7 +40682,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -40705,7 +40698,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -40721,7 +40714,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -40737,7 +40730,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -40753,7 +40746,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -40769,17 +40762,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53877</v>
+<v>53868</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11174</v>
+<v>11172</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5436</v>
+<v>5435</v>
 </b>
 <b>
 <a>5</a>
@@ -40800,17 +40793,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53877</v>
+<v>53868</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11174</v>
+<v>11172</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5436</v>
+<v>5435</v>
 </b>
 <b>
 <a>5</a>
@@ -40831,12 +40824,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>61978</v>
+<v>61967</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9354</v>
+<v>9352</v>
 </b>
 <b>
 <a>3</a>
@@ -40857,17 +40850,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54907</v>
+<v>54897</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10867</v>
+<v>10865</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>5538</v>
+<v>5537</v>
 </b>
 <b>
 <a>7</a>
@@ -40888,17 +40881,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54429</v>
+<v>54419</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11086</v>
+<v>11084</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>5533</v>
+<v>5532</v>
 </b>
 <b>
 <a>6</a>
@@ -40919,17 +40912,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53877</v>
+<v>53868</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11174</v>
+<v>11172</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5436</v>
+<v>5435</v>
 </b>
 <b>
 <a>5</a>
@@ -41597,7 +41590,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94492</v>
+<v>94475</v>
 </b>
 <b>
 <a>2</a>
@@ -41618,7 +41611,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97796</v>
+<v>97778</v>
 </b>
 </bs>
 </hist>
@@ -41634,7 +41627,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94492</v>
+<v>94475</v>
 </b>
 <b>
 <a>2</a>
@@ -41655,12 +41648,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95532</v>
+<v>95514</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>2264</v>
+<v>2263</v>
 </b>
 </bs>
 </hist>
@@ -41676,12 +41669,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95575</v>
+<v>95558</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2220</v>
+<v>2219</v>
 </b>
 </bs>
 </hist>
@@ -41697,7 +41690,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94492</v>
+<v>94475</v>
 </b>
 <b>
 <a>2</a>
@@ -41718,7 +41711,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98786</v>
+<v>98768</v>
 </b>
 <b>
 <a>2</a>
@@ -41739,7 +41732,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100016</v>
+<v>99998</v>
 </b>
 </bs>
 </hist>
@@ -41755,7 +41748,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98786</v>
+<v>98768</v>
 </b>
 <b>
 <a>2</a>
@@ -41776,7 +41769,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99840</v>
+<v>99822</v>
 </b>
 <b>
 <a>2</a>
@@ -41797,7 +41790,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100016</v>
+<v>99998</v>
 </b>
 </bs>
 </hist>
@@ -41813,7 +41806,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98786</v>
+<v>98768</v>
 </b>
 <b>
 <a>2</a>
@@ -41834,7 +41827,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -41850,7 +41843,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -41866,7 +41859,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -41882,7 +41875,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -41898,7 +41891,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -41914,7 +41907,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101641</v>
+<v>101622</v>
 </b>
 </bs>
 </hist>
@@ -41924,15 +41917,15 @@
 </relation>
 <relation>
 <name>cil_handler_filter</name>
-<cardinality>810</cardinality>
+<cardinality>809</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>810</v>
+<v>809</v>
 </e>
 <e>
 <k>filter_start</k>
-<v>810</v>
+<v>809</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41946,7 +41939,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>810</v>
+<v>809</v>
 </b>
 </bs>
 </hist>
@@ -41962,7 +41955,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>810</v>
+<v>809</v>
 </b>
 </bs>
 </hist>
@@ -41972,11 +41965,11 @@
 </relation>
 <relation>
 <name>cil_handler_type</name>
-<cardinality>43888</cardinality>
+<cardinality>43880</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>43888</v>
+<v>43880</v>
 </e>
 <e>
 <k>catch_type</k>
@@ -41994,7 +41987,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43888</v>
+<v>43880</v>
 </b>
 </bs>
 </hist>
@@ -42055,11 +42048,11 @@
 </relation>
 <relation>
 <name>cil_method_stack_size</name>
-<cardinality>1728950</cardinality>
+<cardinality>1728633</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>1728950</v>
+<v>1728633</v>
 </e>
 <e>
 <k>size</k>
@@ -42077,7 +42070,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1728950</v>
+<v>1728633</v>
 </b>
 </bs>
 </hist>
@@ -42158,121 +42151,121 @@
 </relation>
 <relation>
 <name>cil_public</name>
-<cardinality>1913485</cardinality>
+<cardinality>1913134</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1913485</v>
+<v>1913134</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_private</name>
-<cardinality>930018</cardinality>
+<cardinality>929847</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>930018</v>
+<v>929847</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_protected</name>
-<cardinality>1820719</cardinality>
+<cardinality>1820386</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1820719</v>
+<v>1820386</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_internal</name>
-<cardinality>41741</cardinality>
+<cardinality>41734</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>41741</v>
+<v>41734</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_static</name>
-<cardinality>795979</cardinality>
+<cardinality>795833</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>795979</v>
+<v>795833</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_sealed</name>
-<cardinality>357036</cardinality>
+<cardinality>356970</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>357036</v>
+<v>356970</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_virtual</name>
-<cardinality>678512</cardinality>
+<cardinality>678388</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>678512</v>
+<v>678388</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_abstract</name>
-<cardinality>165405</cardinality>
+<cardinality>165375</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>165405</v>
+<v>165375</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_class</name>
-<cardinality>238881</cardinality>
+<cardinality>238837</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>238881</v>
+<v>238837</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_interface</name>
-<cardinality>16571</cardinality>
+<cardinality>16568</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16571</v>
+<v>16568</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_security</name>
-<cardinality>1908</cardinality>
+<cardinality>1907</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1908</v>
+<v>1907</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -42290,37 +42283,37 @@
 </relation>
 <relation>
 <name>cil_specialname</name>
-<cardinality>812083</cardinality>
+<cardinality>811934</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>812083</v>
+<v>811934</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_newslot</name>
-<cardinality>422840</cardinality>
+<cardinality>422762</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>422840</v>
+<v>422762</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_base_class</name>
-<cardinality>235894</cardinality>
+<cardinality>235851</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235894</v>
+<v>235851</v>
 </e>
 <e>
 <k>base</k>
-<v>21436</v>
+<v>21433</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42334,7 +42327,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235894</v>
+<v>235851</v>
 </b>
 </bs>
 </hist>
@@ -42350,7 +42343,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12331</v>
+<v>12329</v>
 </b>
 <b>
 <a>2</a>
@@ -42360,7 +42353,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>1615</v>
+<v>1614</v>
 </b>
 <b>
 <a>4</a>
@@ -42385,15 +42378,15 @@
 </relation>
 <relation>
 <name>cil_base_interface</name>
-<cardinality>125372</cardinality>
+<cardinality>125349</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>68688</v>
+<v>68675</v>
 </e>
 <e>
 <k>base</k>
-<v>31235</v>
+<v>31229</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42407,22 +42400,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>47758</v>
+<v>47749</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8124</v>
+<v>8123</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>6270</v>
+<v>6269</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>5382</v>
+<v>5381</v>
 </b>
 <b>
 <a>9</a>
@@ -42443,12 +42436,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22505</v>
+<v>22501</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3435</v>
+<v>3434</v>
 </b>
 <b>
 <a>3</a>
@@ -42458,7 +42451,7 @@
 <b>
 <a>5</a>
 <b>30</b>
-<v>2347</v>
+<v>2346</v>
 </b>
 <b>
 <a>30</a>
@@ -42473,11 +42466,11 @@
 </relation>
 <relation>
 <name>cil_enum_underlying_type</name>
-<cardinality>14088</cardinality>
+<cardinality>14085</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14088</v>
+<v>14085</v>
 </e>
 <e>
 <k>underlying</k>
@@ -42495,7 +42488,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14088</v>
+<v>14085</v>
 </b>
 </bs>
 </hist>
@@ -42556,11 +42549,11 @@
 </relation>
 <relation>
 <name>cil_type_parameter</name>
-<cardinality>185100</cardinality>
+<cardinality>185066</cardinality>
 <columnsizes>
 <e>
 <k>unbound</k>
-<v>104052</v>
+<v>104033</v>
 </e>
 <e>
 <k>index</k>
@@ -42568,7 +42561,7 @@
 </e>
 <e>
 <k>param</k>
-<v>185100</v>
+<v>185066</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42582,17 +42575,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75085</v>
+<v>75071</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19026</v>
+<v>19022</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8168</v>
+<v>8167</v>
 </b>
 <b>
 <a>13</a>
@@ -42613,17 +42606,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75085</v>
+<v>75071</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19026</v>
+<v>19022</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8168</v>
+<v>8167</v>
 </b>
 <b>
 <a>13</a>
@@ -42876,7 +42869,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185100</v>
+<v>185066</v>
 </b>
 </bs>
 </hist>
@@ -42892,7 +42885,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185100</v>
+<v>185066</v>
 </b>
 </bs>
 </hist>
@@ -42902,11 +42895,11 @@
 </relation>
 <relation>
 <name>cil_type_argument</name>
-<cardinality>738363</cardinality>
+<cardinality>738228</cardinality>
 <columnsizes>
 <e>
 <k>bound</k>
-<v>482168</v>
+<v>482080</v>
 </e>
 <e>
 <k>index</k>
@@ -42914,7 +42907,7 @@
 </e>
 <e>
 <k>t</k>
-<v>252632</v>
+<v>252586</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42928,17 +42921,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>336755</v>
+<v>336693</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>117559</v>
+<v>117537</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27853</v>
+<v>27848</v>
 </b>
 </bs>
 </hist>
@@ -42954,17 +42947,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>341669</v>
+<v>341606</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>115441</v>
+<v>115420</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>25057</v>
+<v>25053</v>
 </b>
 </bs>
 </hist>
@@ -43192,27 +43185,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100489</v>
+<v>100471</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>72875</v>
+<v>72861</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>42561</v>
+<v>42553</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>20138</v>
+<v>20135</v>
 </b>
 <b>
 <a>6</a>
 <b>4208</b>
-<v>16566</v>
+<v>16563</v>
 </b>
 </bs>
 </hist>
@@ -43228,17 +43221,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>191132</v>
+<v>191097</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55581</v>
+<v>55570</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>5919</v>
+<v>5918</v>
 </b>
 </bs>
 </hist>
@@ -43339,15 +43332,15 @@
 </relation>
 <relation>
 <name>cil_attribute</name>
-<cardinality>328879</cardinality>
+<cardinality>328819</cardinality>
 <columnsizes>
 <e>
 <k>attributeid</k>
-<v>328879</v>
+<v>328819</v>
 </e>
 <e>
 <k>element</k>
-<v>249036</v>
+<v>248990</v>
 </e>
 <e>
 <k>constructor</k>
@@ -43365,7 +43358,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328879</v>
+<v>328819</v>
 </b>
 </bs>
 </hist>
@@ -43381,7 +43374,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328879</v>
+<v>328819</v>
 </b>
 </bs>
 </hist>
@@ -43397,17 +43390,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>197695</v>
+<v>197659</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36759</v>
+<v>36752</v>
 </b>
 <b>
 <a>3</a>
 <b>92</b>
-<v>14580</v>
+<v>14578</v>
 </b>
 </bs>
 </hist>
@@ -43423,17 +43416,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>213579</v>
+<v>213540</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31050</v>
+<v>31044</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>4406</v>
+<v>4405</v>
 </b>
 </bs>
 </hist>
@@ -43525,7 +43518,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>283</v>
+<v>282</v>
 </b>
 <b>
 <a>4</a>
@@ -43540,7 +43533,7 @@
 <b>
 <a>7</a>
 <b>10</b>
-<v>283</v>
+<v>282</v>
 </b>
 <b>
 <a>10</a>
@@ -43575,7 +43568,7 @@
 </relation>
 <relation>
 <name>cil_attribute_named_argument</name>
-<cardinality>5567</cardinality>
+<cardinality>5566</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
@@ -43601,7 +43594,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3767</v>
+<v>3766</v>
 </b>
 <b>
 <a>2</a>
@@ -43627,7 +43620,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4060</v>
+<v>4059</v>
 </b>
 <b>
 <a>2</a>
@@ -43821,11 +43814,11 @@
 </relation>
 <relation>
 <name>cil_attribute_positional_argument</name>
-<cardinality>96327</cardinality>
+<cardinality>96309</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>90193</v>
+<v>90176</v>
 </e>
 <e>
 <k>index</k>
@@ -43833,7 +43826,7 @@
 </e>
 <e>
 <k>value</k>
-<v>17142</v>
+<v>17139</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43847,12 +43840,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85503</v>
+<v>85488</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4689</v>
+<v>4688</v>
 </b>
 </bs>
 </hist>
@@ -43868,12 +43861,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85513</v>
+<v>85498</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4679</v>
+<v>4678</v>
 </b>
 </bs>
 </hist>
@@ -43966,12 +43959,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12360</v>
+<v>12358</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2464</v>
+<v>2463</v>
 </b>
 <b>
 <a>3</a>
@@ -43981,7 +43974,7 @@
 <b>
 <a>6</a>
 <b>5555</b>
-<v>888</v>
+<v>887</v>
 </b>
 </bs>
 </hist>
@@ -43997,7 +43990,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16815</v>
+<v>16812</v>
 </b>
 <b>
 <a>2</a>
@@ -44012,11 +44005,11 @@
 </relation>
 <relation>
 <name>metadata_handle</name>
-<cardinality>6187767</cardinality>
+<cardinality>6186911</cardinality>
 <columnsizes>
 <e>
 <k>entity</k>
-<v>5696083</v>
+<v>5695317</v>
 </e>
 <e>
 <k>location</k>
@@ -44024,7 +44017,7 @@
 </e>
 <e>
 <k>handle</k>
-<v>274538</v>
+<v>274487</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44038,17 +44031,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5222609</v>
+<v>5221930</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>464440</v>
+<v>464355</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>9032</v>
+<v>9030</v>
 </b>
 </bs>
 </hist>
@@ -44064,12 +44057,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5454908</v>
+<v>5454186</v>
 </b>
 <b>
 <a>2</a>
 <b>59</b>
-<v>241174</v>
+<v>241130</v>
 </b>
 </bs>
 </hist>
@@ -44171,7 +44164,7 @@
 <b>
 <a>3</a>
 <b>20</b>
-<v>283</v>
+<v>282</v>
 </b>
 <b>
 <a>20</a>
@@ -44242,62 +44235,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18962</v>
+<v>18959</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>45089</v>
+<v>45081</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>23950</v>
+<v>23945</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>17538</v>
+<v>17534</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>30181</v>
+<v>30176</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>19001</v>
+<v>18998</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>22120</v>
+<v>22116</v>
 </b>
 <b>
 <a>11</a>
 <b>13</b>
-<v>21066</v>
+<v>21062</v>
 </b>
 <b>
 <a>13</a>
 <b>21</b>
-<v>21495</v>
+<v>21491</v>
 </b>
 <b>
 <a>21</a>
 <b>39</b>
-<v>21158</v>
+<v>21154</v>
 </b>
 <b>
 <a>39</a>
 <b>83</b>
-<v>20602</v>
+<v>20598</v>
 </b>
 <b>
 <a>83</a>
-<b>1061</b>
-<v>13370</v>
+<b>1062</b>
+<v>13368</v>
 </b>
 </bs>
 </hist>
@@ -44313,52 +44306,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62998</v>
+<v>62986</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21124</v>
+<v>21120</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>47055</v>
+<v>47047</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18962</v>
+<v>18959</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>19426</v>
+<v>19422</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>22095</v>
+<v>22091</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>23325</v>
+<v>23321</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>22027</v>
+<v>22023</v>
 </b>
 <b>
 <a>19</a>
 <b>41</b>
-<v>20885</v>
+<v>20881</v>
 </b>
 <b>
 <a>41</a>
 <b>702</b>
-<v>16635</v>
+<v>16632</v>
 </b>
 </bs>
 </hist>

From 5060756a0bf621b67895eedb9af54934d5fae689 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 14 Jan 2021 08:20:45 +0100
Subject: [PATCH 093/343] Fix typo in comment

---
 csharp/ql/src/semmle/code/csharp/Location.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/ql/src/semmle/code/csharp/Location.qll b/csharp/ql/src/semmle/code/csharp/Location.qll
index 77a4dc4fe4c..ac9a120849c 100644
--- a/csharp/ql/src/semmle/code/csharp/Location.qll
+++ b/csharp/ql/src/semmle/code/csharp/Location.qll
@@ -172,7 +172,7 @@ class Assembly extends Location, Attributable, @assembly {
   /** Gets the version of this assembly. */
   Version getVersion() { assemblies(this, _, _, _, result) }
 
-  /** Gets the compilation producing this assembly if any. */
+  /** Gets the compilation producing this assembly, if any. */
   Compilation getCompilation() { compilation_assembly(result, this) }
 
   override File getFile() { assemblies(this, result, _, _, _) }

From ec669c883a4f936635a95dfd1aed594806d872d2 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 14 Jan 2021 08:25:35 +0100
Subject: [PATCH 094/343] Add DB upgrade folder

---
 .../old.dbscheme                              | 1909 ++++++++++++++++
 .../semmlecode.csharp.dbscheme                | 1914 +++++++++++++++++
 .../upgrade.properties                        |    2 +
 3 files changed, 3825 insertions(+)
 create mode 100644 csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/old.dbscheme
 create mode 100644 csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/semmlecode.csharp.dbscheme
 create mode 100644 csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/upgrade.properties

diff --git a/csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/old.dbscheme b/csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/old.dbscheme
new file mode 100644
index 00000000000..26249c105a8
--- /dev/null
+++ b/csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/old.dbscheme
@@ -0,0 +1,1909 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+
+#keyset[method, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int method: @cil_method ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/semmlecode.csharp.dbscheme b/csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/semmlecode.csharp.dbscheme
new file mode 100644
index 00000000000..e6442d16b7e
--- /dev/null
+++ b/csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/semmlecode.csharp.dbscheme
@@ -0,0 +1,1914 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+
+#keyset[method, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int method: @cil_method ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/upgrade.properties b/csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/upgrade.properties
new file mode 100644
index 00000000000..3ee4f62265f
--- /dev/null
+++ b/csharp/upgrades/26249c105a81c61ef8738a198928de2d4b763c37/upgrade.properties
@@ -0,0 +1,2 @@
+description: Added 'compilation_assembly' to store the output assemblies of compilations.
+compatibility: backwards

From 5803a449be796b055a8800d6b415108ae7349ff5 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 7 Jan 2021 12:14:25 +0100
Subject: [PATCH 095/343] Add test case for assign operation in finally

---
 .../controlflow/graph/BasicBlock.expected     |  3 ++
 .../controlflow/graph/Dominance.expected      | 38 +++++++++++++++++++
 .../graph/EnclosingCallable.expected          | 20 ++++++++++
 .../controlflow/graph/EntryElement.expected   | 16 ++++++++
 .../controlflow/graph/ExitElement.expected    | 21 ++++++++++
 .../controlflow/graph/Finally.cs              | 13 +++++++
 .../controlflow/graph/NodeGraph.expected      | 16 ++++++++
 .../controlflow/graph/Nodes.expected          |  6 +++
 8 files changed, 133 insertions(+)

diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
index d9fc6b0c1f6..76511cca34a 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
@@ -639,6 +639,9 @@
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:258:13:258:46 | [finally: exception(Exception)] call to method WriteLine | 4 |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:258:13:258:46 | [finally: exception(ExceptionA)] call to method WriteLine | 4 |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:233:10:233:12 | exit M12 (normal) | 8 |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:267:13:267:34 | call to method WriteLine | 7 |
+| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | 5 |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:272:13:272:19 | ...; | 5 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:8:29:8:32 | access to parameter args | 3 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | exit M1 | 2 |
 | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | 1 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
index b9f51a64281..c439a55d8a5 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
@@ -2366,6 +2366,22 @@ dominance
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:233:10:233:12 | exit M12 (normal) |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:260:27:260:32 | "Done" |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:9:260:33 | call to method WriteLine |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:264:5:274:5 | {...} |
+| Finally.cs:264:5:274:5 | {...} | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:266:9:268:9 | {...} |
+| Finally.cs:266:9:268:9 | {...} | Finally.cs:267:13:267:35 | ...; |
+| Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} |
+| Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:270:9:273:9 | {...} |
+| Finally.cs:267:13:267:35 | ...; | Finally.cs:267:31:267:33 | "1" |
+| Finally.cs:267:31:267:33 | "1" | Finally.cs:267:13:267:34 | call to method WriteLine |
+| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:271:13:271:35 | ...; |
+| Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; |
+| Finally.cs:271:13:271:34 | call to method WriteLine | Finally.cs:272:13:272:19 | ...; |
+| Finally.cs:271:13:271:35 | ...; | Finally.cs:271:31:271:33 | "3" |
+| Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" |
+| Finally.cs:271:31:271:33 | "3" | Finally.cs:271:13:271:34 | call to method WriteLine |
+| Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:7:5:10:5 | {...} |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | exit M1 |
 | Foreach.cs:7:5:10:5 | {...} | Foreach.cs:8:29:8:32 | access to parameter args |
@@ -6307,6 +6323,20 @@ postDominance
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:260:27:260:32 | "Done" |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:258:13:258:46 | call to method WriteLine |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:9:260:34 | ...; |
+| Finally.cs:264:5:274:5 | {...} | Finally.cs:263:10:263:12 | enter M13 |
+| Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:264:5:274:5 | {...} |
+| Finally.cs:266:9:268:9 | {...} | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:267:31:267:33 | "1" |
+| Finally.cs:267:13:267:35 | ...; | Finally.cs:266:9:268:9 | {...} |
+| Finally.cs:267:31:267:33 | "1" | Finally.cs:267:13:267:35 | ...; |
+| Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" |
+| Finally.cs:271:13:271:34 | call to method WriteLine | Finally.cs:271:31:271:33 | "3" |
+| Finally.cs:271:13:271:35 | ...; | Finally.cs:270:9:273:9 | {...} |
+| Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} |
+| Finally.cs:271:31:271:33 | "3" | Finally.cs:271:13:271:35 | ...; |
+| Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; |
+| Finally.cs:272:13:272:19 | ...; | Finally.cs:271:13:271:34 | call to method WriteLine |
+| Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine |
 | Foreach.cs:6:10:6:11 | exit M1 | Foreach.cs:6:10:6:11 | exit M1 (normal) |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... |
 | Foreach.cs:7:5:10:5 | {...} | Foreach.cs:6:10:6:11 | enter M1 |
@@ -10829,6 +10859,11 @@ blockDominance
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:257:9:259:9 | {...} |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:263:10:263:12 | enter M13 |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:270:9:273:9 | {...} |
+| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:270:9:273:9 | {...} |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | enter M1 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | exit M1 (normal) |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... |
@@ -14176,6 +14211,9 @@ postBlockDominance
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:243:13:253:13 | {...} |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:250:17:252:17 | {...} |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:257:9:259:9 | {...} |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:263:10:263:12 | enter M13 |
+| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:270:9:273:9 | {...} |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | enter M1 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | enter M1 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | exit M1 (normal) |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
index c6d70953677..7bbe168a6d9 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
@@ -2555,6 +2555,23 @@ nodeEnclosing
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:233:10:233:12 | M12 |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:264:5:274:5 | {...} | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:266:9:268:9 | {...} | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:267:13:267:35 | ...; | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:267:31:267:33 | "1" | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:271:13:271:34 | call to method WriteLine | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:271:13:271:35 | ...; | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:271:31:271:33 | "3" | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:13:272:19 | ...; | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | Finally.cs:263:10:263:12 | M13 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | M1 |
 | Foreach.cs:6:10:6:11 | exit M1 | Foreach.cs:6:10:6:11 | M1 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | M1 |
@@ -5310,6 +5327,9 @@ blockEnclosing
 | Finally.cs:257:9:259:9 | [finally: exception(Exception)] {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:233:10:233:12 | M12 |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:263:10:263:12 | M13 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | M1 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | M1 |
 | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | Foreach.cs:6:10:6:11 | M1 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected b/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
index 3c5d4db19dd..610c8d7f8eb 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
@@ -1610,6 +1610,22 @@
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:260:27:260:32 | "Done" |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:260:9:260:34 | ...; |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:27:260:32 | "Done" |
+| Finally.cs:264:5:274:5 | {...} | Finally.cs:264:5:274:5 | {...} |
+| Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:266:9:268:9 | {...} | Finally.cs:266:9:268:9 | {...} |
+| Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:267:31:267:33 | "1" |
+| Finally.cs:267:13:267:35 | ...; | Finally.cs:267:13:267:35 | ...; |
+| Finally.cs:267:31:267:33 | "1" | Finally.cs:267:31:267:33 | "1" |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:270:9:273:9 | {...} |
+| Finally.cs:271:13:271:34 | call to method WriteLine | Finally.cs:271:31:271:33 | "3" |
+| Finally.cs:271:13:271:35 | ...; | Finally.cs:271:13:271:35 | ...; |
+| Finally.cs:271:31:271:33 | "3" | Finally.cs:271:31:271:33 | "3" |
+| Finally.cs:272:13:272:13 | access to parameter i | Finally.cs:272:13:272:13 | access to parameter i |
+| Finally.cs:272:13:272:18 | ... + ... | Finally.cs:272:13:272:13 | access to parameter i |
+| Finally.cs:272:13:272:18 | ... += ... | Finally.cs:272:13:272:13 | access to parameter i |
+| Finally.cs:272:13:272:18 | ... = ... | Finally.cs:272:13:272:13 | access to parameter i |
+| Finally.cs:272:13:272:19 | ...; | Finally.cs:272:13:272:19 | ...; |
+| Finally.cs:272:18:272:18 | 3 | Finally.cs:272:18:272:18 | 3 |
 | Foreach.cs:7:5:10:5 | {...} | Foreach.cs:7:5:10:5 | {...} |
 | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | Foreach.cs:8:29:8:32 | access to parameter args |
 | Foreach.cs:8:22:8:24 | String arg | Foreach.cs:8:22:8:24 | String arg |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
index 9a657596235..07a0a9cffc7 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
@@ -2236,6 +2236,27 @@
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:260:9:260:33 | call to method WriteLine | normal |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:260:9:260:33 | call to method WriteLine | normal |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:27:260:32 | "Done" | normal |
+| Finally.cs:264:5:274:5 | {...} | Finally.cs:272:13:272:18 | ... = ... | normal |
+| Finally.cs:264:5:274:5 | {...} | Finally.cs:272:13:272:18 | ... = ... | throw(Exception) [normal] (0) |
+| Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:272:13:272:18 | ... = ... | normal |
+| Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:272:13:272:18 | ... = ... | throw(Exception) [normal] (0) |
+| Finally.cs:266:9:268:9 | {...} | Finally.cs:267:13:267:34 | call to method WriteLine | normal |
+| Finally.cs:266:9:268:9 | {...} | Finally.cs:267:13:267:34 | call to method WriteLine | throw(Exception) |
+| Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:267:13:267:34 | call to method WriteLine | normal |
+| Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:267:13:267:34 | call to method WriteLine | throw(Exception) |
+| Finally.cs:267:13:267:35 | ...; | Finally.cs:267:13:267:34 | call to method WriteLine | normal |
+| Finally.cs:267:13:267:35 | ...; | Finally.cs:267:13:267:34 | call to method WriteLine | throw(Exception) |
+| Finally.cs:267:31:267:33 | "1" | Finally.cs:267:31:267:33 | "1" | normal |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:272:13:272:18 | ... = ... | normal |
+| Finally.cs:271:13:271:34 | call to method WriteLine | Finally.cs:271:13:271:34 | call to method WriteLine | normal |
+| Finally.cs:271:13:271:35 | ...; | Finally.cs:271:13:271:34 | call to method WriteLine | normal |
+| Finally.cs:271:31:271:33 | "3" | Finally.cs:271:31:271:33 | "3" | normal |
+| Finally.cs:272:13:272:13 | access to parameter i | Finally.cs:272:13:272:13 | access to parameter i | normal |
+| Finally.cs:272:13:272:18 | ... + ... | Finally.cs:272:13:272:18 | ... + ... | normal |
+| Finally.cs:272:13:272:18 | ... += ... | Finally.cs:272:13:272:18 | ... = ... | normal |
+| Finally.cs:272:13:272:18 | ... = ... | Finally.cs:272:13:272:18 | ... = ... | normal |
+| Finally.cs:272:13:272:19 | ...; | Finally.cs:272:13:272:18 | ... = ... | normal |
+| Finally.cs:272:18:272:18 | 3 | Finally.cs:272:18:272:18 | 3 | normal |
 | Foreach.cs:7:5:10:5 | {...} | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | empty |
 | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | empty |
 | Foreach.cs:8:22:8:24 | String arg | Foreach.cs:8:22:8:24 | String arg | normal |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Finally.cs b/csharp/ql/test/library-tests/controlflow/graph/Finally.cs
index c8848747aaa..563afdeb618 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Finally.cs
+++ b/csharp/ql/test/library-tests/controlflow/graph/Finally.cs
@@ -259,4 +259,17 @@ public class Finally
         }
         Console.WriteLine("Done");
     }
+
+    void M13(int i)
+    {
+        try
+        {
+            Console.WriteLine("1");
+        }
+        finally
+        {
+            Console.WriteLine("3");
+            i += 3;
+        }
+    }
 }
diff --git a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
index f3fabcfe6bb..11f7a7914b6 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
@@ -2670,6 +2670,22 @@
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:233:10:233:12 | exit M12 (normal) | semmle.label | successor |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:260:27:260:32 | "Done" | semmle.label | successor |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:9:260:33 | call to method WriteLine | semmle.label | successor |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:264:5:274:5 | {...} | semmle.label | successor |
+| Finally.cs:264:5:274:5 | {...} | Finally.cs:265:9:273:9 | try {...} ... | semmle.label | successor |
+| Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:266:9:268:9 | {...} | semmle.label | successor |
+| Finally.cs:266:9:268:9 | {...} | Finally.cs:267:13:267:35 | ...; | semmle.label | successor |
+| Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | semmle.label | exception(Exception) |
+| Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:270:9:273:9 | {...} | semmle.label | successor |
+| Finally.cs:267:13:267:35 | ...; | Finally.cs:267:31:267:33 | "1" | semmle.label | successor |
+| Finally.cs:267:31:267:33 | "1" | Finally.cs:267:13:267:34 | call to method WriteLine | semmle.label | successor |
+| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | semmle.label | successor |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:271:13:271:35 | ...; | semmle.label | successor |
+| Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | semmle.label | successor |
+| Finally.cs:271:13:271:34 | call to method WriteLine | Finally.cs:272:13:272:19 | ...; | semmle.label | successor |
+| Finally.cs:271:13:271:35 | ...; | Finally.cs:271:31:271:33 | "3" | semmle.label | successor |
+| Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | semmle.label | successor |
+| Finally.cs:271:31:271:33 | "3" | Finally.cs:271:13:271:34 | call to method WriteLine | semmle.label | successor |
+| Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine | semmle.label | successor |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:7:5:10:5 | {...} | semmle.label | successor |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | exit M1 | semmle.label | successor |
 | Foreach.cs:7:5:10:5 | {...} | Foreach.cs:8:29:8:32 | access to parameter args | semmle.label | successor |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
index bac3edcdd3f..c3ea98fef9c 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
@@ -1013,6 +1013,11 @@ finallyNode
 | Finally.cs:258:13:258:47 | [finally: exception(ExceptionA)] ...; | Finally.cs:235:9:259:9 | try {...} ... |
 | Finally.cs:258:31:258:45 | [finally: exception(Exception)] "Outer finally" | Finally.cs:235:9:259:9 | try {...} ... |
 | Finally.cs:258:31:258:45 | [finally: exception(ExceptionA)] "Outer finally" | Finally.cs:235:9:259:9 | try {...} ... |
+| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | Finally.cs:265:9:273:9 | try {...} ... |
 | cflow.cs:274:9:276:9 | [finally: return] {...} | cflow.cs:268:9:276:9 | try {...} ... |
 | cflow.cs:275:13:275:41 | [finally: return] call to method WriteLine | cflow.cs:268:9:276:9 | try {...} ... |
 | cflow.cs:275:13:275:42 | [finally: return] ...; | cflow.cs:268:9:276:9 | try {...} ... |
@@ -1120,6 +1125,7 @@ entryPoint
 | Finally.cs:195:10:195:12 | M10 | Finally.cs:196:5:214:5 | {...} |
 | Finally.cs:216:10:216:12 | M11 | Finally.cs:217:5:231:5 | {...} |
 | Finally.cs:233:10:233:12 | M12 | Finally.cs:234:5:261:5 | {...} |
+| Finally.cs:263:10:263:12 | M13 | Finally.cs:264:5:274:5 | {...} |
 | Foreach.cs:6:10:6:11 | M1 | Foreach.cs:7:5:10:5 | {...} |
 | Foreach.cs:12:10:12:11 | M2 | Foreach.cs:13:5:16:5 | {...} |
 | Foreach.cs:18:10:18:11 | M3 | Foreach.cs:19:5:22:5 | {...} |

From 05c858ec2c40a3abd09e5a0e214c8defc469f26c Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 7 Jan 2021 12:15:21 +0100
Subject: [PATCH 096/343] C#: Fix expanded assignment lookup in finally blocks
 for CFG

---
 .../internal/ControlFlowGraphImpl.qll         |  2 +-
 .../controlflow/graph/BasicBlock.expected     |  5 ++--
 .../controlflow/graph/Dominance.expected      | 25 +++++++++++++++++++
 .../graph/EnclosingCallable.expected          | 12 +++++++++
 .../controlflow/graph/NodeGraph.expected      | 12 +++++++++
 .../controlflow/graph/Nodes.expected          |  4 +++
 6 files changed, 57 insertions(+), 3 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
index a3256941f86..c2a170080b1 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
@@ -1302,7 +1302,7 @@ module Statements {
   /** Gets a child of `cfe` that is in CFG scope `scope`. */
   pragma[noinline]
   private ControlFlowElement getAChildInScope(ControlFlowElement cfe, Callable scope) {
-    result = cfe.getAChild() and
+    result = [cfe.getAChild(), cfe.(AssignOperation).getExpandedAssignment()] and
     scope = result.getEnclosingCallable()
   }
 
diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
index 76511cca34a..6f3b0b5e956 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
@@ -640,8 +640,9 @@
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:258:13:258:46 | [finally: exception(ExceptionA)] call to method WriteLine | 4 |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:233:10:233:12 | exit M12 (normal) | 8 |
 | Finally.cs:263:10:263:12 | enter M13 | Finally.cs:267:13:267:34 | call to method WriteLine | 7 |
-| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | 5 |
-| Finally.cs:270:9:273:9 | {...} | Finally.cs:272:13:272:19 | ...; | 5 |
+| Finally.cs:263:10:263:12 | exit M13 | Finally.cs:263:10:263:12 | exit M13 | 1 |
+| Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:263:10:263:12 | exit M13 (abnormal) | 10 |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:263:10:263:12 | exit M13 (normal) | 10 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:8:29:8:32 | access to parameter args | 3 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | exit M1 | 2 |
 | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | 1 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
index c439a55d8a5..8fe3dbbf796 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
@@ -2382,6 +2382,16 @@ dominance
 | Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" |
 | Finally.cs:271:31:271:33 | "3" | Finally.cs:271:13:271:34 | call to method WriteLine |
 | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine |
+| Finally.cs:272:13:272:13 | [finally: exception(Exception)] access to parameter i | Finally.cs:272:18:272:18 | [finally: exception(Exception)] 3 |
+| Finally.cs:272:13:272:13 | access to parameter i | Finally.cs:272:18:272:18 | 3 |
+| Finally.cs:272:13:272:18 | ... + ... | Finally.cs:272:13:272:18 | ... = ... |
+| Finally.cs:272:13:272:18 | ... = ... | Finally.cs:263:10:263:12 | exit M13 (normal) |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... + ... | Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... = ... |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... = ... | Finally.cs:263:10:263:12 | exit M13 (abnormal) |
+| Finally.cs:272:13:272:19 | ...; | Finally.cs:272:13:272:13 | access to parameter i |
+| Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | Finally.cs:272:13:272:13 | [finally: exception(Exception)] access to parameter i |
+| Finally.cs:272:18:272:18 | 3 | Finally.cs:272:13:272:18 | ... + ... |
+| Finally.cs:272:18:272:18 | [finally: exception(Exception)] 3 | Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... + ... |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:7:5:10:5 | {...} |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | exit M1 |
 | Foreach.cs:7:5:10:5 | {...} | Foreach.cs:8:29:8:32 | access to parameter args |
@@ -6323,20 +6333,31 @@ postDominance
 | Finally.cs:260:9:260:33 | call to method WriteLine | Finally.cs:260:27:260:32 | "Done" |
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:258:13:258:46 | call to method WriteLine |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:9:260:34 | ...; |
+| Finally.cs:263:10:263:12 | exit M13 (abnormal) | Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... = ... |
+| Finally.cs:263:10:263:12 | exit M13 (normal) | Finally.cs:272:13:272:18 | ... = ... |
 | Finally.cs:264:5:274:5 | {...} | Finally.cs:263:10:263:12 | enter M13 |
 | Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:264:5:274:5 | {...} |
 | Finally.cs:266:9:268:9 | {...} | Finally.cs:265:9:273:9 | try {...} ... |
 | Finally.cs:267:13:267:34 | call to method WriteLine | Finally.cs:267:31:267:33 | "1" |
 | Finally.cs:267:13:267:35 | ...; | Finally.cs:266:9:268:9 | {...} |
 | Finally.cs:267:31:267:33 | "1" | Finally.cs:267:13:267:35 | ...; |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:267:13:267:34 | call to method WriteLine |
 | Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" |
 | Finally.cs:271:13:271:34 | call to method WriteLine | Finally.cs:271:31:271:33 | "3" |
 | Finally.cs:271:13:271:35 | ...; | Finally.cs:270:9:273:9 | {...} |
 | Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:271:31:271:33 | "3" | Finally.cs:271:13:271:35 | ...; |
 | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; |
+| Finally.cs:272:13:272:13 | [finally: exception(Exception)] access to parameter i | Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; |
+| Finally.cs:272:13:272:13 | access to parameter i | Finally.cs:272:13:272:19 | ...; |
+| Finally.cs:272:13:272:18 | ... + ... | Finally.cs:272:18:272:18 | 3 |
+| Finally.cs:272:13:272:18 | ... = ... | Finally.cs:272:13:272:18 | ... + ... |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... + ... | Finally.cs:272:18:272:18 | [finally: exception(Exception)] 3 |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... = ... | Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... + ... |
 | Finally.cs:272:13:272:19 | ...; | Finally.cs:271:13:271:34 | call to method WriteLine |
 | Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine |
+| Finally.cs:272:18:272:18 | 3 | Finally.cs:272:13:272:13 | access to parameter i |
+| Finally.cs:272:18:272:18 | [finally: exception(Exception)] 3 | Finally.cs:272:13:272:13 | [finally: exception(Exception)] access to parameter i |
 | Foreach.cs:6:10:6:11 | exit M1 | Foreach.cs:6:10:6:11 | exit M1 (normal) |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... |
 | Foreach.cs:7:5:10:5 | {...} | Foreach.cs:6:10:6:11 | enter M1 |
@@ -10860,8 +10881,10 @@ blockDominance
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:257:9:259:9 | {...} |
 | Finally.cs:263:10:263:12 | enter M13 | Finally.cs:263:10:263:12 | enter M13 |
+| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:263:10:263:12 | exit M13 |
 | Finally.cs:263:10:263:12 | enter M13 | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:263:10:263:12 | enter M13 | Finally.cs:270:9:273:9 | {...} |
+| Finally.cs:263:10:263:12 | exit M13 | Finally.cs:263:10:263:12 | exit M13 |
 | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} |
 | Finally.cs:270:9:273:9 | {...} | Finally.cs:270:9:273:9 | {...} |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | enter M1 |
@@ -14212,7 +14235,9 @@ postBlockDominance
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:250:17:252:17 | {...} |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:257:9:259:9 | {...} |
 | Finally.cs:263:10:263:12 | enter M13 | Finally.cs:263:10:263:12 | enter M13 |
+| Finally.cs:263:10:263:12 | exit M13 | Finally.cs:263:10:263:12 | exit M13 |
 | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} |
+| Finally.cs:270:9:273:9 | {...} | Finally.cs:263:10:263:12 | enter M13 |
 | Finally.cs:270:9:273:9 | {...} | Finally.cs:270:9:273:9 | {...} |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | enter M1 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | enter M1 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
index 7bbe168a6d9..3ab6261019f 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
@@ -2556,6 +2556,9 @@ nodeEnclosing
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:263:10:263:12 | enter M13 | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:263:10:263:12 | exit M13 | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:263:10:263:12 | exit M13 (abnormal) | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:263:10:263:12 | exit M13 (normal) | Finally.cs:263:10:263:12 | M13 |
 | Finally.cs:264:5:274:5 | {...} | Finally.cs:263:10:263:12 | M13 |
 | Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:263:10:263:12 | M13 |
 | Finally.cs:266:9:268:9 | {...} | Finally.cs:263:10:263:12 | M13 |
@@ -2570,8 +2573,16 @@ nodeEnclosing
 | Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:263:10:263:12 | M13 |
 | Finally.cs:271:31:271:33 | "3" | Finally.cs:263:10:263:12 | M13 |
 | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:13:272:13 | [finally: exception(Exception)] access to parameter i | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:13:272:13 | access to parameter i | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:13:272:18 | ... + ... | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:13:272:18 | ... = ... | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... + ... | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... = ... | Finally.cs:263:10:263:12 | M13 |
 | Finally.cs:272:13:272:19 | ...; | Finally.cs:263:10:263:12 | M13 |
 | Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:18:272:18 | 3 | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:272:18:272:18 | [finally: exception(Exception)] 3 | Finally.cs:263:10:263:12 | M13 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | M1 |
 | Foreach.cs:6:10:6:11 | exit M1 | Foreach.cs:6:10:6:11 | M1 |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | M1 |
@@ -5328,6 +5339,7 @@ blockEnclosing
 | Finally.cs:257:9:259:9 | [finally: exception(ExceptionA)] {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:257:9:259:9 | {...} | Finally.cs:233:10:233:12 | M12 |
 | Finally.cs:263:10:263:12 | enter M13 | Finally.cs:263:10:263:12 | M13 |
+| Finally.cs:263:10:263:12 | exit M13 | Finally.cs:263:10:263:12 | M13 |
 | Finally.cs:270:9:273:9 | [finally: exception(Exception)] {...} | Finally.cs:263:10:263:12 | M13 |
 | Finally.cs:270:9:273:9 | {...} | Finally.cs:263:10:263:12 | M13 |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:6:10:6:11 | M1 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
index 11f7a7914b6..6218a3a3b46 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
@@ -2671,6 +2671,8 @@
 | Finally.cs:260:9:260:34 | ...; | Finally.cs:260:27:260:32 | "Done" | semmle.label | successor |
 | Finally.cs:260:27:260:32 | "Done" | Finally.cs:260:9:260:33 | call to method WriteLine | semmle.label | successor |
 | Finally.cs:263:10:263:12 | enter M13 | Finally.cs:264:5:274:5 | {...} | semmle.label | successor |
+| Finally.cs:263:10:263:12 | exit M13 (abnormal) | Finally.cs:263:10:263:12 | exit M13 | semmle.label | successor |
+| Finally.cs:263:10:263:12 | exit M13 (normal) | Finally.cs:263:10:263:12 | exit M13 | semmle.label | successor |
 | Finally.cs:264:5:274:5 | {...} | Finally.cs:265:9:273:9 | try {...} ... | semmle.label | successor |
 | Finally.cs:265:9:273:9 | try {...} ... | Finally.cs:266:9:268:9 | {...} | semmle.label | successor |
 | Finally.cs:266:9:268:9 | {...} | Finally.cs:267:13:267:35 | ...; | semmle.label | successor |
@@ -2686,6 +2688,16 @@
 | Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | semmle.label | successor |
 | Finally.cs:271:31:271:33 | "3" | Finally.cs:271:13:271:34 | call to method WriteLine | semmle.label | successor |
 | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine | semmle.label | successor |
+| Finally.cs:272:13:272:13 | [finally: exception(Exception)] access to parameter i | Finally.cs:272:18:272:18 | [finally: exception(Exception)] 3 | semmle.label | successor |
+| Finally.cs:272:13:272:13 | access to parameter i | Finally.cs:272:18:272:18 | 3 | semmle.label | successor |
+| Finally.cs:272:13:272:18 | ... + ... | Finally.cs:272:13:272:18 | ... = ... | semmle.label | successor |
+| Finally.cs:272:13:272:18 | ... = ... | Finally.cs:263:10:263:12 | exit M13 (normal) | semmle.label | successor |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... + ... | Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... = ... | semmle.label | successor |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... = ... | Finally.cs:263:10:263:12 | exit M13 (abnormal) | semmle.label | exception(Exception) |
+| Finally.cs:272:13:272:19 | ...; | Finally.cs:272:13:272:13 | access to parameter i | semmle.label | successor |
+| Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | Finally.cs:272:13:272:13 | [finally: exception(Exception)] access to parameter i | semmle.label | successor |
+| Finally.cs:272:18:272:18 | 3 | Finally.cs:272:13:272:18 | ... + ... | semmle.label | successor |
+| Finally.cs:272:18:272:18 | [finally: exception(Exception)] 3 | Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... + ... | semmle.label | successor |
 | Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:7:5:10:5 | {...} | semmle.label | successor |
 | Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | exit M1 | semmle.label | successor |
 | Foreach.cs:7:5:10:5 | {...} | Foreach.cs:8:29:8:32 | access to parameter args | semmle.label | successor |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
index c3ea98fef9c..fd138aea838 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
@@ -1017,7 +1017,11 @@ finallyNode
 | Finally.cs:271:13:271:34 | [finally: exception(Exception)] call to method WriteLine | Finally.cs:265:9:273:9 | try {...} ... |
 | Finally.cs:271:13:271:35 | [finally: exception(Exception)] ...; | Finally.cs:265:9:273:9 | try {...} ... |
 | Finally.cs:271:31:271:33 | [finally: exception(Exception)] "3" | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:272:13:272:13 | [finally: exception(Exception)] access to parameter i | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... + ... | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:272:13:272:18 | [finally: exception(Exception)] ... = ... | Finally.cs:265:9:273:9 | try {...} ... |
 | Finally.cs:272:13:272:19 | [finally: exception(Exception)] ...; | Finally.cs:265:9:273:9 | try {...} ... |
+| Finally.cs:272:18:272:18 | [finally: exception(Exception)] 3 | Finally.cs:265:9:273:9 | try {...} ... |
 | cflow.cs:274:9:276:9 | [finally: return] {...} | cflow.cs:268:9:276:9 | try {...} ... |
 | cflow.cs:275:13:275:41 | [finally: return] call to method WriteLine | cflow.cs:268:9:276:9 | try {...} ... |
 | cflow.cs:275:13:275:42 | [finally: return] ...; | cflow.cs:268:9:276:9 | try {...} ... |

From 927dd514eab212d2cb7824ee97296b4d68e485d5 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 11 Jan 2021 14:03:53 +0100
Subject: [PATCH 097/343] C#: Extract unary patterns

---
 .../change-notes/2020-11-19-Unary-pattern.md  |  3 +
 .../Entities/Expressions/Patterns/Pattern.cs  |  3 +
 .../Expressions/Patterns/UnaryPattern.cs      | 15 +++++
 .../Kinds/ExprKind.cs                         |  3 +-
 .../ql/src/semmle/code/csharp/exprs/Expr.qll  | 19 +++++++
 csharp/ql/src/semmlecode.csharp.dbscheme      |  3 +
 .../library-tests/csharp9/PrintAst.expected   | 56 +++++++++++++++++++
 .../library-tests/csharp9/UnaryPattern.cs     | 22 ++++++++
 .../csharp9/unaryPattern.expected             |  4 ++
 .../library-tests/csharp9/unaryPattern.ql     |  4 ++
 csharp/upgrades/TO_CHANGE/upgrade.properties  |  2 +
 11 files changed, 133 insertions(+), 1 deletion(-)
 create mode 100644 csharp/change-notes/2020-11-19-Unary-pattern.md
 create mode 100644 csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs
 create mode 100644 csharp/ql/test/library-tests/csharp9/UnaryPattern.cs
 create mode 100644 csharp/ql/test/library-tests/csharp9/unaryPattern.expected
 create mode 100644 csharp/ql/test/library-tests/csharp9/unaryPattern.ql
 create mode 100644 csharp/upgrades/TO_CHANGE/upgrade.properties

diff --git a/csharp/change-notes/2020-11-19-Unary-pattern.md b/csharp/change-notes/2020-11-19-Unary-pattern.md
new file mode 100644
index 00000000000..0afd5f0c7c1
--- /dev/null
+++ b/csharp/change-notes/2020-11-19-Unary-pattern.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* The `UnaryPatternExpr` and `NotPatternExpr` classes have been added to support
+C# 9 unary `not` pattern.
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
index 7fe552ec8e9..eef8f28b5fa 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
@@ -20,6 +20,9 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 case TypePatternSyntax typePattern:
                     return Expressions.TypeAccess.Create(cx, typePattern.Type, parent, child);
 
+                case UnaryPatternSyntax unaryPattern:
+                    return new UnaryPattern(cx, unaryPattern, parent, child);
+
                 case DeclarationPatternSyntax declPattern:
                     // Creates a single local variable declaration.
                     {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs
new file mode 100644
index 00000000000..14760e7331a
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs
@@ -0,0 +1,15 @@
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Semmle.Extraction.Entities;
+using Semmle.Extraction.Kinds;
+
+namespace Semmle.Extraction.CSharp.Entities.Expressions
+{
+    internal class UnaryPattern : Expression
+    {
+        public UnaryPattern(Context cx, UnaryPatternSyntax syntax, IExpressionParentEntity parent, int child) :
+            base(new ExpressionInfo(cx, NullType.Create(cx), cx.Create(syntax.GetLocation()), ExprKind.NOT_PATTERN, parent, child, false, null))
+        {
+            Pattern.Create(cx, syntax.Pattern, this, 0);
+        }
+    }
+}
\ No newline at end of file
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
index f46ed47ff5f..31b69075231 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
@@ -115,6 +115,7 @@ namespace Semmle.Extraction.Kinds
         SWITCH_CASE = 118,
         ASSIGN_COALESCE = 119,
         SUPPRESS_NULLABLE_WARNING = 120,
-        NAMESPACE_ACCESS = 121
+        NAMESPACE_ACCESS = 121,
+        NOT_PATTERN = 126
     }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
index 5baa9da1265..411f75ba40c 100644
--- a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
+++ b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
@@ -295,6 +295,12 @@ private predicate hasChildPattern(ControlFlowElement pm, Expr child) {
     child = mid.getChild(2).getAChildExpr() or
     child = mid.getChild(3).getAChildExpr()
   )
+  or
+  exists(Expr mid |
+    hasChildPattern(pm, mid) and
+    mid instanceof @unary_pattern_expr and
+    child = mid.getChild(0)
+  )
 }
 
 /**
@@ -444,6 +450,19 @@ class PositionalPatternExpr extends Expr, @positional_pattern_expr {
   override string getAPrimaryQlClass() { result = "PositionalPatternExpr" }
 }
 
+/** A unary pattern. For example, `not 1`. */
+class UnaryPatternExpr extends PatternExpr, @unary_pattern_expr {
+  /** Gets the underlying pattern. */
+  PatternExpr getPattern() { result = this.getChild(0) }
+}
+
+/** A not pattern. For example, `not 1`. */
+class NotPatternExpr extends UnaryPatternExpr, @not_pattern_expr {
+  override string toString() { result = "not ..." }
+
+  override string getAPrimaryQlClass() { result = "NotPatternExpr" }
+}
+
 /**
  * An expression or statement that matches the value of an expression against
  * a pattern. Either an `is` expression or a `case` expression/statement.
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index e6442d16b7e..5f6770a8a17 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -1009,11 +1009,14 @@ case @expr.kind of
 | 119 = @assign_coalesce_expr
 | 120 = @suppress_nullable_warning_expr
 | 121 = @namespace_access_expr
+/* C# 9.0 */
+| 126 = @not_pattern_expr
 ;
 
 @switch = @switch_stmt | @switch_expr;
 @case = @case_stmt | @switch_case_expr;
 @pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
 
 @integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
 @real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
diff --git a/csharp/ql/test/library-tests/csharp9/PrintAst.expected b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
index b75cd6c3177..59dabf7e3ad 100644
--- a/csharp/ql/test/library-tests/csharp9/PrintAst.expected
+++ b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
@@ -764,3 +764,59 @@ TypePattern.cs:
 #   14|             0: [VariablePatternExpr] Object o
 #   14|               0: [TypeMention] object
 #   14|             2: [LocalVariableAccess] access to local variable o
+UnaryPattern.cs:
+#    3| [Class] UnaryPattern
+#    5|   5: [Property] P1
+#    5|     -1: [TypeMention] int
+#    5|     3: [Getter] get_P1
+#    5|     4: [Setter] set_P1
+#-----|       2: (Parameters)
+#    5|         0: [Parameter] value
+#    7|   6: [Method] M1
+#    7|     -1: [TypeMention] bool
+#-----|     2: (Parameters)
+#    7|       0: [Parameter] c
+#    7|         -1: [TypeMention] char
+#    8|     4: [IsExpr] ... is ...
+#    8|       0: [ParameterAccess] access to parameter c
+#    8|       1: [NotPatternExpr] not ...
+#    8|         0: [CharLiteral,ConstantPatternExpr] a
+#    9|   7: [Method] M2
+#    9|     -1: [TypeMention] bool
+#-----|     2: (Parameters)
+#    9|       0: [Parameter] c
+#    9|         -1: [TypeMention] object
+#   10|     4: [IsExpr] ... is ...
+#   10|       0: [ParameterAccess] access to parameter c
+#   10|       1: [NotPatternExpr] not ...
+#   10|         0: [ConstantPatternExpr,NullLiteral] null
+#   11|   8: [Method] M3
+#   11|     -1: [TypeMention] bool
+#-----|     2: (Parameters)
+#   11|       0: [Parameter] c
+#   11|         -1: [TypeMention] object
+#   12|     4: [IsExpr] ... is ...
+#   12|       0: [ParameterAccess] access to parameter c
+#   12|       1: [NotPatternExpr] not ...
+#   12|         0: [RecursivePatternExpr] { ... }
+#   12|           0: [LocalVariableDeclExpr] UnaryPattern u
+#   12|           1: [TypeAccess] access to type UnaryPattern
+#   12|             0: [TypeMention] UnaryPattern
+#   12|           3: [PropertyPatternExpr] { ... }
+#   12|             0: [ConstantPatternExpr,IntLiteral,LabeledPatternExpr] 1
+#   14|   9: [Method] M4
+#   14|     -1: [TypeMention] string
+#-----|     2: (Parameters)
+#   14|       0: [Parameter] i
+#   14|         -1: [TypeMention] int
+#   15|     4: [BlockStmt] {...}
+#   16|       0: [ReturnStmt] return ...;
+#   16|         0: [SwitchExpr] ... switch { ... }
+#   16|           -1: [ParameterAccess] access to parameter i
+#   18|           0: [SwitchCaseExpr] ... => ...
+#   18|             0: [NotPatternExpr] not ...
+#   18|               0: [ConstantPatternExpr,IntLiteral] 1
+#   18|             2: [StringLiteral] "not 1"
+#   19|           1: [SwitchCaseExpr] ... => ...
+#   19|             0: [DiscardPatternExpr] _
+#   19|             2: [StringLiteral] "other"
diff --git a/csharp/ql/test/library-tests/csharp9/UnaryPattern.cs b/csharp/ql/test/library-tests/csharp9/UnaryPattern.cs
new file mode 100644
index 00000000000..5dfcb335bfb
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/UnaryPattern.cs
@@ -0,0 +1,22 @@
+using System;
+
+public class UnaryPattern
+{
+    public int P1 { get; set; }
+
+    public static bool M1(char c) =>
+        c is not 'a';
+    public static bool M2(object c) =>
+        c is not null;
+    public static bool M3(object c) =>
+        c is not UnaryPattern { P1: 1 } u;
+
+    public static string M4(int i)
+    {
+        return i switch
+        {
+            not 1 => "not 1",
+            _ => "other"
+        };
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/csharp9/unaryPattern.expected b/csharp/ql/test/library-tests/csharp9/unaryPattern.expected
new file mode 100644
index 00000000000..7a6ecdebeae
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/unaryPattern.expected
@@ -0,0 +1,4 @@
+| UnaryPattern.cs:8:14:8:20 | not ... | UnaryPattern.cs:8:18:8:20 | a |
+| UnaryPattern.cs:10:14:10:21 | not ... | UnaryPattern.cs:10:18:10:21 | null |
+| UnaryPattern.cs:12:14:12:41 | not ... | UnaryPattern.cs:12:18:12:41 | { ... } |
+| UnaryPattern.cs:18:13:18:17 | not ... | UnaryPattern.cs:18:17:18:17 | 1 |
diff --git a/csharp/ql/test/library-tests/csharp9/unaryPattern.ql b/csharp/ql/test/library-tests/csharp9/unaryPattern.ql
new file mode 100644
index 00000000000..87b70067664
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/unaryPattern.ql
@@ -0,0 +1,4 @@
+import csharp
+
+from UnaryPatternExpr pattern
+select pattern, pattern.getAChild()
diff --git a/csharp/upgrades/TO_CHANGE/upgrade.properties b/csharp/upgrades/TO_CHANGE/upgrade.properties
new file mode 100644
index 00000000000..dd386a913cd
--- /dev/null
+++ b/csharp/upgrades/TO_CHANGE/upgrade.properties
@@ -0,0 +1,2 @@
+description: Add 'not_pattern_expr' to the list of 'expr' types.
+compatibility: backwards

From 48d8ee9166d6e30b0f66c9fb467ab490b1f4df5e Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 11 Jan 2021 16:13:53 +0100
Subject: [PATCH 098/343] Fix failing test

---
 csharp/ql/test/library-tests/csharp9/initOnlyProperty.expected | 1 +
 1 file changed, 1 insertion(+)

diff --git a/csharp/ql/test/library-tests/csharp9/initOnlyProperty.expected b/csharp/ql/test/library-tests/csharp9/initOnlyProperty.expected
index 8915b72cc42..e661db79eb2 100644
--- a/csharp/ql/test/library-tests/csharp9/initOnlyProperty.expected
+++ b/csharp/ql/test/library-tests/csharp9/initOnlyProperty.expected
@@ -4,3 +4,4 @@
 | InitOnlyProperty.cs:14:37:14:39 | set_Prop2 | set |
 | InitOnlyProperty.cs:20:38:20:41 | set_Prop1 | init |
 | InitOnlyProperty.cs:24:9:24:12 | set_Prop2 | init |
+| UnaryPattern.cs:5:26:5:28 | set_P1 | set |

From e8ea720650d9a4888f799d4bb179f8ab7e4daec7 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 14 Jan 2021 10:36:10 +0100
Subject: [PATCH 099/343] adjust `description` to not mention user-provided
 values

---
 javascript/ql/src/Performance/PolynomialReDoS.ql | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/javascript/ql/src/Performance/PolynomialReDoS.ql b/javascript/ql/src/Performance/PolynomialReDoS.ql
index 393faef10dd..96bf1788be3 100644
--- a/javascript/ql/src/Performance/PolynomialReDoS.ql
+++ b/javascript/ql/src/Performance/PolynomialReDoS.ql
@@ -1,8 +1,7 @@
 /**
  * @name Polynomial regular expression used on uncontrolled data
  * @description A regular expression that can require polynomial time
- *              to match user-provided values may be
- *              vulnerable to denial-of-service attacks.
+ *              to match may be vulnerable to denial-of-service attacks.
  * @kind path-problem
  * @problem.severity warning
  * @precision high

From a520a51d42275d0fe7394fc5339e010de8250d45 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 14 Jan 2021 11:22:20 +0100
Subject: [PATCH 100/343] highlight the use of the regular expression, instead
 of the sink for user input

---
 .../ql/src/Performance/PolynomialReDoS.ql     |  10 +-
 .../PolynomialReDoSCustomizations.qll         |  10 +-
 .../ReDoS/PolynomialReDoS.expected            | 152 +++++++++---------
 3 files changed, 90 insertions(+), 82 deletions(-)

diff --git a/javascript/ql/src/Performance/PolynomialReDoS.ql b/javascript/ql/src/Performance/PolynomialReDoS.ql
index 96bf1788be3..e43c6e85d6b 100644
--- a/javascript/ql/src/Performance/PolynomialReDoS.ql
+++ b/javascript/ql/src/Performance/PolynomialReDoS.ql
@@ -16,13 +16,13 @@ import semmle.javascript.security.performance.PolynomialReDoS::PolynomialReDoS
 import semmle.javascript.security.performance.SuperlinearBackTracking
 import DataFlow::PathGraph
 
-from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
+from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
 where
   cfg.hasFlowPath(source, sink) and
+  sinkNode = sink.getNode() and
   not (
     source.getNode().(Source).getKind() = "url" and
-    sink.getNode().(Sink).getRegExp().(PolynomialBackTrackingTerm).isAtEndLine()
+    sinkNode.getRegExp().(PolynomialBackTrackingTerm).isAtEndLine()
   )
-select sink.getNode(), source, sink, "This expensive $@ use depends on $@.",
-  sink.getNode().(Sink).getRegExp(), "regular expression", source.getNode(),
-  source.getNode().(Source).describe()
+select sinkNode.getHighlight(), source, sink, "This expensive $@ use depends on $@.",
+  sinkNode.getRegExp(), "regular expression", source.getNode(), source.getNode().(Source).describe()
diff --git a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
index 09266256f6c..67904a9bfe3 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
@@ -31,6 +31,11 @@ module PolynomialReDoS {
    */
   abstract class Sink extends DataFlow::Node {
     abstract RegExpTerm getRegExp();
+
+    /**
+     * Gets the node to highlight in the alert message.
+     */
+    DataFlow::Node getHighlight() { result = this }
   }
 
   /**
@@ -54,9 +59,10 @@ module PolynomialReDoS {
    */
   class PolynomialBackTrackingTermUse extends Sink {
     PolynomialBackTrackingTerm term;
+    DataFlow::MethodCallNode mcn;
 
     PolynomialBackTrackingTermUse() {
-      exists(DataFlow::MethodCallNode mcn, DataFlow::Node regexp, string name |
+      exists(DataFlow::Node regexp, string name |
         term.getRootTerm() = RegExp::getRegExpFromNode(regexp)
       |
         this = mcn.getArgument(0) and
@@ -77,6 +83,8 @@ module PolynomialReDoS {
     }
 
     override RegExpTerm getRegExp() { result = term }
+
+    override DataFlow::Node getHighlight() { result = mcn }
   }
 
   /**
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
index 4a2b6a87c9f..c7a8b211703 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
@@ -288,79 +288,79 @@ edges
 | polynomial-redos.js:123:3:123:20 | result | polynomial-redos.js:124:12:124:17 | result |
 | polynomial-redos.js:123:13:123:20 | replaced | polynomial-redos.js:123:3:123:20 | result |
 #select
-| lib/lib.js:4:14:4:17 | name | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name | This expensive $@ use depends on $@. | lib/lib.js:1:15:1:16 | a* | regular expression | lib/lib.js:3:28:3:31 | name | library input |
-| polynomial-redos.js:7:2:7:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:7:2:7:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:7:24:7:26 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:8:2:8:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:8:2:8:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:8:17:8:18 |  * | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:9:2:9:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:9:2:9:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:9:19:9:21 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:11:2:11:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:11:2:11:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:11:19:11:20 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:12:2:12:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:12:2:12:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:12:19:12:20 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:15:2:15:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:15:2:15:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:15:28:15:35 | [\\s\\S]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:15:2:15:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:15:2:15:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:15:41:15:43 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:16:2:16:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:16:2:16:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:16:25:16:32 | [\\s\\S]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:17:23:17:29 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:17:23:17:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:17:5:17:6 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:17:23:17:29 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:17:23:17:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:17:11:17:12 | .+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:18:2:18:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:18:2:18:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:18:83:18:100 | [\\u0600-\\u06FF\\/]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:19:2:19:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:19:2:19:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:19:17:19:22 | [0-9]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:20:2:20:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:20:2:20:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:20:56:20:58 | \\d+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:25:2:25:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:25:2:25:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:25:37:25:56 | [a-zA-Z0-9+\\/ \\t\\n]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:25:2:25:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:25:2:25:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:25:63:25:64 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:30:2:30:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:30:2:30:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:30:19:30:22 | [?]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:30:2:30:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:30:2:30:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:30:23:30:24 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:33:2:33:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:33:2:33:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:33:17:33:20 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:36:2:36:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:36:2:36:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:36:18:36:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:36:2:36:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:36:2:36:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:36:35:36:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:37:2:37:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:37:2:37:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:37:18:37:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:37:2:37:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:37:2:37:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:37:35:37:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:38:2:38:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:38:2:38:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:38:18:38:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:38:2:38:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:38:2:38:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:38:34:38:35 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:40:2:40:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:40:2:40:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:40:51:40:63 | [?\\x21-\\x7E]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:43:2:43:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:43:2:43:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:43:67:43:72 | [^\\n]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:48:2:48:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:48:2:48:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:48:22:48:24 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:50:14:50:20 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:50:14:50:20 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:50:4:50:5 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:51:26:51:32 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:51:26:51:32 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:51:11:51:17 | (YH\|J)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:52:22:52:28 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:52:22:52:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:52:12:52:13 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:53:21:53:27 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:53:21:53:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:53:3:53:8 | (B\|Y)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:53:21:53:27 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:53:21:53:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:53:9:53:12 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:54:22:54:28 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:54:22:54:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:54:4:54:9 | (B\|Y)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:54:22:54:28 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:54:22:54:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:54:10:54:13 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:55:23:55:29 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:55:23:55:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:55:11:55:14 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:56:22:56:28 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:56:22:56:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:56:10:56:13 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:57:25:57:31 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:57:25:57:31 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:57:11:57:16 | (Y\|K)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:58:21:58:27 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:58:21:58:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:58:11:58:12 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:59:23:59:29 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:59:23:59:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:59:11:59:14 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:62:17:62:23 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:62:17:62:23 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:62:7:62:8 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:63:21:63:27 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:63:21:63:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:63:11:63:12 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:64:24:64:30 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:64:24:64:30 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:64:14:64:15 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:65:24:65:30 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:65:24:65:30 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:65:14:65:15 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:66:19:66:25 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:66:19:66:25 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:66:9:66:10 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:67:18:67:24 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:67:18:67:24 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:67:8:67:9 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:69:18:69:25 | req.body | polynomial-redos.js:69:18:69:25 | req.body | polynomial-redos.js:69:18:69:25 | req.body | This expensive $@ use depends on $@. | polynomial-redos.js:69:8:69:9 | .* | regular expression | polynomial-redos.js:69:18:69:25 | req.body | a user-provided value |
-| polynomial-redos.js:71:2:71:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:71:2:71:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:71:51:71:63 | [?\\x21-\\x7E]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:73:2:73:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:73:2:73:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:73:50:73:51 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:75:2:75:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:75:2:75:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:75:18:75:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:75:2:75:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:75:2:75:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:75:35:75:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:77:2:77:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:77:2:77:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:77:18:77:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:80:2:80:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:80:2:80:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:80:17:80:18 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:81:2:81:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:81:2:81:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:81:18:81:19 | c* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:86:2:86:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:86:2:86:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:86:25:86:29 | (ab)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:88:2:88:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:88:2:88:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:88:18:88:19 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:89:2:89:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:89:2:89:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:89:20:89:21 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:90:2:90:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:90:2:90:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:90:19:90:20 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:94:2:94:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:94:2:94:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:94:28:94:37 | ([2-5]\|B)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:95:2:95:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:95:2:95:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:95:21:95:30 | ([2-5]\|B)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:96:2:96:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:96:2:96:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:96:28:96:30 | \\d* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:98:2:98:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:98:2:98:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:98:25:98:29 | (ab)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:100:2:100:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:100:2:100:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:100:18:100:19 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:101:2:101:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:101:2:101:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:101:17:101:18 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:102:2:102:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:102:2:102:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:102:20:102:21 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:103:2:103:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:103:2:103:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:103:19:103:20 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:104:2:104:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:104:2:104:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:104:17:104:18 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:107:2:107:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:107:2:107:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:107:28:107:37 | ([2-5]\|B)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:108:2:108:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:108:2:108:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:108:21:108:30 | ([2-5]\|B)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:109:2:109:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:109:2:109:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:109:28:109:30 | \\d+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:111:2:111:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:111:2:111:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:111:17:111:19 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:112:2:112:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:112:2:112:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:112:17:112:19 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:114:2:114:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:114:2:114:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:114:22:114:24 | \\w* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:116:2:116:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:116:2:116:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:116:21:116:28 | [\\d\\D]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:118:2:118:8 | tainted | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:118:2:118:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:118:17:118:23 | (#\\d+)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:124:12:124:17 | result | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:124:12:124:17 | result | This expensive $@ use depends on $@. | polynomial-redos.js:124:33:124:35 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| lib/lib.js:4:2:4:18 | regexp.test(name) | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name | This expensive $@ use depends on $@. | lib/lib.js:1:15:1:16 | a* | regular expression | lib/lib.js:3:28:3:31 | name | library input |
+| polynomial-redos.js:7:2:7:34 | tainted ... /g, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:7:2:7:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:7:24:7:26 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:8:2:8:23 | tainted ...  *, */) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:8:2:8:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:8:17:8:18 |  * | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:9:2:9:34 | tainted ... g, ' ') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:9:2:9:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:9:19:9:21 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:11:2:11:31 | tainted ... ]/, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:11:2:11:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:11:19:11:20 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:12:2:12:28 | tainted ... ./, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:12:2:12:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:12:19:12:20 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:15:2:15:52 | tainted ... (?!`)/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:15:2:15:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:15:28:15:35 | [\\s\\S]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:15:2:15:52 | tainted ... (?!`)/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:15:2:15:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:15:41:15:43 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:16:2:16:46 | tainted ... (?!`)/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:16:2:16:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:16:25:16:32 | [\\s\\S]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:17:2:17:30 | /^(.*,) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:17:23:17:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:17:5:17:6 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:17:2:17:30 | /^(.*,) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:17:23:17:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:17:11:17:12 | .+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:18:2:18:130 | tainted ... 1,2}/i) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:18:2:18:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:18:83:18:100 | [\\u0600-\\u06FF\\/]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:19:2:19:148 | tainted ... 1,2}/i) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:19:2:19:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:19:17:19:22 | [0-9]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:20:2:20:63 | tainted ... d+)?$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:20:2:20:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:20:56:20:58 | \\d+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:25:2:25:68 | tainted ... (.*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:25:2:25:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:25:37:25:56 | [a-zA-Z0-9+\\/ \\t\\n]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:25:2:25:68 | tainted ... (.*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:25:2:25:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:25:63:25:64 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:30:2:30:32 | tainted ... /g, "") | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:30:2:30:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:30:19:30:22 | [?]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:30:2:30:32 | tainted ... /g, "") | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:30:2:30:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:30:23:30:24 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:33:2:33:56 | tainted ... e(.)*/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:33:2:33:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:33:17:33:20 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:36:2:36:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:36:2:36:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:36:18:36:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:36:2:36:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:36:2:36:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:36:35:36:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:37:2:37:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:37:2:37:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:37:18:37:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:37:2:37:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:37:2:37:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:37:35:37:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:38:2:38:38 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:38:2:38:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:38:18:38:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:38:2:38:38 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:38:2:38:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:38:34:38:35 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:40:2:40:67 | tainted ... E]*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:40:2:40:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:40:51:40:63 | [?\\x21-\\x7E]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:43:2:43:78 | tainted ... +))?$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:43:2:43:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:43:67:43:72 | [^\\n]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:48:2:48:37 | tainted ... g, ' ') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:48:2:48:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:48:22:48:24 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:50:2:50:21 | /Y.*X/.test(tainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:50:14:50:20 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:50:4:50:5 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:51:2:51:33 | /B?(YH\| ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:51:26:51:32 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:51:11:51:17 | (YH\|J)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:52:3:52:29 | /B?(YH\| ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:52:22:52:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:52:12:52:13 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:53:2:53:28 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:53:21:53:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:53:3:53:8 | (B\|Y)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:53:2:53:28 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:53:21:53:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:53:9:53:12 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:54:3:54:29 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:54:22:54:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:54:4:54:9 | (B\|Y)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:54:3:54:29 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:54:22:54:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:54:10:54:13 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:55:3:55:30 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:55:23:55:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:55:11:55:14 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:56:2:56:29 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:56:22:56:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:56:10:56:13 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:57:3:57:32 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:57:25:57:31 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:57:11:57:16 | (Y\|K)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:58:3:58:28 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:58:21:58:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:58:11:58:12 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:59:3:59:30 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:59:23:59:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:59:11:59:14 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:62:3:62:24 | /^Y*Y*X ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:62:17:62:23 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:62:7:62:8 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:63:3:63:28 | /^(K\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:63:21:63:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:63:11:63:12 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:64:3:64:31 | /^foo(K ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:64:24:64:30 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:64:14:64:15 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:65:3:65:31 | /^foo(K ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:65:24:65:30 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:65:14:65:15 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:66:3:66:26 | /(K\|Y). ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:66:19:66:25 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:66:9:66:10 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:67:3:67:25 | /[^Y].* ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:67:18:67:24 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:67:8:67:9 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:69:3:69:26 | /[^Y].* ... q.body) | polynomial-redos.js:69:18:69:25 | req.body | polynomial-redos.js:69:18:69:25 | req.body | This expensive $@ use depends on $@. | polynomial-redos.js:69:8:69:9 | .* | regular expression | polynomial-redos.js:69:18:69:25 | req.body | a user-provided value |
+| polynomial-redos.js:71:2:71:67 | tainted ... E]*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:71:2:71:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:71:51:71:63 | [?\\x21-\\x7E]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:73:2:73:60 | tainted ... LWP7")) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:73:2:73:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:73:50:73:51 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:75:2:75:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:75:2:75:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:75:18:75:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:75:2:75:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:75:2:75:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:75:35:75:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:77:2:77:22 | tainted ... /Y.*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:77:2:77:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:77:18:77:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:80:2:80:21 | tainted.match(/a*b/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:80:2:80:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:80:17:80:18 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:81:2:81:22 | tainted ... /cc*D/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:81:2:81:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:81:18:81:19 | c* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:86:2:86:32 | tainted ... ab)*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:86:2:86:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:86:25:86:29 | (ab)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:88:2:88:22 | tainted ... /aa*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:88:2:88:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:88:18:88:19 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:89:2:89:24 | tainted ... a*a*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:89:2:89:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:89:20:89:21 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:90:2:90:23 | tainted ... \\wa*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:90:2:90:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:90:19:90:20 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:94:2:94:40 | tainted ... \|B)*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:94:2:94:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:94:28:94:37 | ([2-5]\|B)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:95:2:95:33 | tainted ... \|B)*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:95:2:95:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:95:21:95:30 | ([2-5]\|B)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:96:2:96:33 | tainted ... *\\d*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:96:2:96:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:96:28:96:30 | \\d* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:98:2:98:32 | tainted ... ab)+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:98:2:98:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:98:25:98:29 | (ab)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:100:2:100:22 | tainted ... /aa+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:100:2:100:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:100:18:100:19 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:101:2:101:21 | tainted.match(/a+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:101:2:101:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:101:17:101:18 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:102:2:102:24 | tainted ... a+a+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:102:2:102:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:102:20:102:21 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:103:2:103:23 | tainted ... \\wa+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:103:2:103:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:103:19:103:20 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:104:2:104:24 | tainted ... +b+c+/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:104:2:104:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:104:17:104:18 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:107:2:107:40 | tainted ... \|B)+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:107:2:107:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:107:28:107:37 | ([2-5]\|B)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:108:2:108:33 | tainted ... \|B)+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:108:2:108:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:108:21:108:30 | ([2-5]\|B)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:109:2:109:33 | tainted ... +\\d+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:109:2:109:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:109:28:109:30 | \\d+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:111:2:111:22 | tainted ... /\\s*$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:111:2:111:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:111:17:111:19 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:112:2:112:22 | tainted ... /\\s+$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:112:2:112:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:112:17:112:19 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:114:2:114:27 | tainted ... 5\\w*$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:114:2:114:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:114:22:114:24 | \\w* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:116:2:116:35 | tainted ... \\*\\//g) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:116:2:116:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:116:21:116:28 | [\\d\\D]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:118:2:118:25 | tainted ... \\d+)+/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:118:2:118:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:118:17:118:23 | (#\\d+)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:124:12:124:43 | result. ... /g, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:124:12:124:17 | result | This expensive $@ use depends on $@. | polynomial-redos.js:124:33:124:35 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |

From f5eb131e2d272e0871fbe5108c850a6593a4aed3 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 14 Jan 2021 12:42:43 +0100
Subject: [PATCH 101/343] C#: Address review comments

---
 csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index 24166d298e3..6b243fb619d 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -19,7 +19,7 @@ module Ssa {
       }
 
       /**
-       * Holds if the this field or any of the fields part of the qualifier
+       * Holds if this field or any of the fields part of the qualifier
        * are volatile.
        */
       predicate isVolatile() { this.(Field).isVolatile() }
@@ -605,7 +605,7 @@ module Ssa {
 
     /**
      * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-     * either a read (when `k` is `Read()`) or an SSA definition (when `k`
+     * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
      * is `SsaDef()`).
      */
     private predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {

From 03d8aeb7b6afd366c4cf00e8b8ac9a1130e17e06 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 14 Jan 2021 13:35:32 +0100
Subject: [PATCH 102/343] refactor `PolynomialBackTrackingTerm`, to allow
 getting the pump string and the prefix-message

---
 .../performance/SuperlinearBackTracking.qll   | 44 ++++++++++++++-----
 1 file changed, 34 insertions(+), 10 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll b/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
index 94ad095030b..2908960ca5d 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
@@ -347,15 +347,11 @@ predicate isPumpable(State pivot, State succ, string pump) {
 /**
  * Holds if repetitions of `pump` at `t` will cause polynomial backtracking.
  */
-predicate polynimalReDoS(RegExpTerm t, string msg) {
-  exists(string pump, State s, string prefixMsg |
+predicate polynimalReDoS(RegExpTerm t, string pump, string prefixMsg, RegExpTerm prev) {
+  exists(State s, State pivot |
     hasReDoSResult(t, pump, s, prefixMsg) and
-    exists(State pivot |
-      isPumpable(pivot, s, _) and
-      msg =
-        "Strings " + prefixMsg + "with many repetitions of '" + pump +
-          "' can start matching anywhere after the start of the preceeding " + pivot.getRepr()
-    )
+    isPumpable(pivot, s, _) and
+    prev = pivot.getRepr()
   )
 }
 
@@ -388,17 +384,30 @@ private predicate matchesEpsilon(RegExpTerm t) {
   forex(RegExpTerm child | child = t.(RegExpSequence).getAChild() | matchesEpsilon(child))
 }
 
+/**
+ * Gets a message for why `term` can cause polynomial backtracking.
+ */
+string getReasonString(RegExpTerm term, string pump, string prefixMsg, RegExpTerm prev) {
+  polynimalReDoS(term, pump, prefixMsg, prev) and
+  result =
+    "Strings " + prefixMsg + "with many repetitions of '" + pump +
+      "' can start matching anywhere after the start of the preceeding " + prev
+}
+
 /**
  * A term that may cause a regular expression engine to perform a
  * polynomial number of match attempts, relative to the input length.
  */
 class PolynomialBackTrackingTerm extends InfiniteRepetitionQuantifier {
   string reason;
+  string pump;
+  string prefixMsg;
+  RegExpTerm prev;
 
   PolynomialBackTrackingTerm() {
-    polynimalReDoS(this, _) and
+    reason = getReasonString(this, pump, prefixMsg, prev) and
     // there might be many reasons for this term to have polynomial backtracking - we pick an arbitary one.
-    reason = min(string msg | polynimalReDoS(this, msg))
+    reason = min(string msg | msg = getReasonString(this, _, _, _))
   }
 
   /**
@@ -410,6 +419,21 @@ class PolynomialBackTrackingTerm extends InfiniteRepetitionQuantifier {
     )
   }
 
+  /**
+   * Gets the string that should be repeated to cause this regular expression to perform polynomially.
+   */
+  string getPumpString() { result = pump }
+
+  /**
+   * Gets a message for which prefix a matching string must start with for this term to cause polynomial backtracking.
+   */
+  string getPrefixMessage() { result = prefixMsg }
+
+  /**
+   * Gets a predecessor to `this`, which also loops on the pump string, and thereby causes polynomial backtracking.
+   */
+  RegExpTerm getPreviousLoop() { result = prev }
+
   /**
    * Gets the reason for the number of match attempts.
    */

From 7db55906b9b5608286a8cc83e847ec90cecbf9f3 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Wed, 16 Dec 2020 09:52:40 +0100
Subject: [PATCH 103/343] Python: Copy old tornado tests

---
 .../frameworks/tornado/old_tests.py           | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/old_tests.py

diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/old_tests.py b/python/ql/test/experimental/library-tests/frameworks/tornado/old_tests.py
new file mode 100644
index 00000000000..aee0e676bd6
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/old_tests.py
@@ -0,0 +1,25 @@
+import tornado.web
+
+class Handler1(tornado.web.RequestHandler):
+    def get(self):
+        self.write(self.get_argument("xss"))
+
+class Handler2(tornado.web.RequestHandler):
+    def get(self):
+        args = self.get_body_arguments()
+        name = args[0]
+        self.write(name)
+
+class Handler3(tornado.web.RequestHandler):
+
+    def get(self):
+        req = self.request
+        h = req.headers
+        url = h["url"]
+        self.redirect(url)
+
+
+class DeepInheritance(Handler3):
+
+    def get(self):
+        self.write(self.get_argument("also_xss"))

From 57d08a85235129f0d999a61acec60b032d77ab0c Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Wed, 16 Dec 2020 10:37:18 +0100
Subject: [PATCH 104/343] Python: Rewrite old Tornado tests

Now you can run them, and the examples have been adjusted so they actually work!
---
 .../library-tests/frameworks/tornado/basic.py | 54 +++++++++++++++++++
 .../frameworks/tornado/old_tests.py           | 25 ---------
 2 files changed, 54 insertions(+), 25 deletions(-)
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
 delete mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/old_tests.py

diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
new file mode 100644
index 00000000000..7ceb54f07f7
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
@@ -0,0 +1,54 @@
+import tornado.web
+
+
+class BasicHandler(tornado.web.RequestHandler):
+    def get(self):
+        self.write("BasicHandler " + self.get_argument("xss"))
+
+    def post(self):
+        self.write("BasicHandler (POST)")
+
+
+class DeepInheritance(BasicHandler):
+    def get(self):
+        self.write("DeepInheritance" + self.get_argument("also_xss"))
+
+
+class FormHandler(tornado.web.RequestHandler):
+    def post(self):
+        name = self.get_body_argument("name")
+        self.write(name)
+
+
+class RedirectHandler(tornado.web.RequestHandler):
+    def get(self):
+        req = self.request
+        h = req.headers
+        url = h["url"]
+        self.redirect(url)
+
+
+def make_app():
+    return tornado.web.Application([
+        (r"/basic", BasicHandler),
+        (r"/deep", DeepInheritance),
+        (r"/form", FormHandler),
+        (r"/redirect", RedirectHandler),
+    ])
+
+
+if __name__ == "__main__":
+    import tornado.ioloop
+
+    app = make_app()
+    app.listen(8888)
+    tornado.ioloop.IOLoop.current().start()
+
+    # http://localhost:8888/basic?xss=foo
+    # http://localhost:8888/deep?also_xss=foo
+
+    # curl -X POST http://localhost:8888/basic
+    # curl -X POST http://localhost:8888/deep
+
+    # curl -X POST -F "name=foo" http://localhost:8888/form
+    # curl -v -H 'url: http://example.com' http://localhost:8888/redirect
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/old_tests.py b/python/ql/test/experimental/library-tests/frameworks/tornado/old_tests.py
deleted file mode 100644
index aee0e676bd6..00000000000
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/old_tests.py
+++ /dev/null
@@ -1,25 +0,0 @@
-import tornado.web
-
-class Handler1(tornado.web.RequestHandler):
-    def get(self):
-        self.write(self.get_argument("xss"))
-
-class Handler2(tornado.web.RequestHandler):
-    def get(self):
-        args = self.get_body_arguments()
-        name = args[0]
-        self.write(name)
-
-class Handler3(tornado.web.RequestHandler):
-
-    def get(self):
-        req = self.request
-        h = req.headers
-        url = h["url"]
-        self.redirect(url)
-
-
-class DeepInheritance(Handler3):
-
-    def get(self):
-        self.write(self.get_argument("also_xss"))

From b4f3399534931aa557c8fc89e9bd4b3a77386489 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Thu, 17 Dec 2020 17:34:45 +0100
Subject: [PATCH 105/343] Python: Add reverse inheritance test for Tornado

---
 .../library-tests/frameworks/tornado/basic.py        | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
index 7ceb54f07f7..a586175cab9 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
@@ -28,12 +28,22 @@ class RedirectHandler(tornado.web.RequestHandler):
         self.redirect(url)
 
 
+class BaseReverseInheritance(tornado.web.RequestHandler):
+    def get(self):
+        self.write("hello from BaseReverseInheritance")
+
+
+class ReverseInheritance(BaseReverseInheritance):
+    pass
+
+
 def make_app():
     return tornado.web.Application([
         (r"/basic", BasicHandler),
         (r"/deep", DeepInheritance),
         (r"/form", FormHandler),
         (r"/redirect", RedirectHandler),
+        (r"/reverse-inheritance", ReverseInheritance),
     ])
 
 
@@ -52,3 +62,5 @@ if __name__ == "__main__":
 
     # curl -X POST -F "name=foo" http://localhost:8888/form
     # curl -v -H 'url: http://example.com' http://localhost:8888/redirect
+
+    # http://localhost:8888/reverse-inheritance

From 9cd8a862a09d5f1ca1b1ba2183ded5995be764d9 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 21 Dec 2020 15:29:01 +0100
Subject: [PATCH 106/343] Python: Expand Tornado tests and add annotations

I should probably have split this up into 2 commits, so sorry that didn't happen :|
---
 .../frameworks/tornado/ConceptsTest.expected  |   0
 .../frameworks/tornado/ConceptsTest.ql        |  12 ++
 .../frameworks/tornado/README.md              |   3 +
 .../frameworks/tornado/TestTaint.expected     |  41 +++++++
 .../frameworks/tornado/TestTaint.ql           |   6 +
 .../library-tests/frameworks/tornado/basic.py |  29 ++---
 .../library-tests/frameworks/tornado/options  |   1 +
 .../frameworks/tornado/responses.py           |  35 ++++++
 .../frameworks/tornado/routing_test.py        | 110 ++++++++++++++++++
 .../frameworks/tornado/taint_test.py          |  90 ++++++++++++++
 10 files changed, 314 insertions(+), 13 deletions(-)
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.expected
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/README.md
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.ql
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/options
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/responses.py
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py

diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.expected b/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql b/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql
new file mode 100644
index 00000000000..a946c6befb9
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql
@@ -0,0 +1,12 @@
+import python
+import experimental.meta.ConceptsTest
+//
+// class DedicatedResponseTest extends HttpServerHttpResponseTest {
+//   DedicatedResponseTest() { file.getShortName() = "response_test.py" }
+// }
+//
+// class OtherResponseTest extends HttpServerHttpResponseTest {
+//   OtherResponseTest() { not this instanceof DedicatedResponseTest }
+//
+//   override string getARelevantTag() { result = "HttpResponse" }
+// }
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/README.md b/python/ql/test/experimental/library-tests/frameworks/tornado/README.md
new file mode 100644
index 00000000000..0604cf67cd0
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/README.md
@@ -0,0 +1,3 @@
+From Tornado 6.0 Python 3.5+ is [required](https://www.tornadoweb.org/en/stable/index.html#installation)
+
+https://www.tornadoweb.org/en/stable/guide/structure.html#handling-request-input
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
new file mode 100644
index 00000000000..48b8dc0462f
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
@@ -0,0 +1,41 @@
+| taint_test.py:6 | fail | get | name |
+| taint_test.py:6 | fail | get | number |
+| taint_test.py:7 | ok   | get | foo |
+| taint_test.py:11 | fail | get | self.get_argument(..) |
+| taint_test.py:12 | fail | get | self.get_arguments(..) |
+| taint_test.py:13 | fail | get | self.get_arguments(..)[0] |
+| taint_test.py:15 | fail | get | self.get_body_argument(..) |
+| taint_test.py:16 | fail | get | self.get_body_arguments(..) |
+| taint_test.py:17 | fail | get | self.get_body_arguments(..)[0] |
+| taint_test.py:19 | fail | get | self.get_query_argument(..) |
+| taint_test.py:20 | fail | get | self.get_query_arguments(..) |
+| taint_test.py:21 | fail | get | self.get_query_arguments(..)[0] |
+| taint_test.py:23 | fail | get | self.path_args |
+| taint_test.py:24 | fail | get | self.path_args[0] |
+| taint_test.py:26 | fail | get | self.path_kwargs |
+| taint_test.py:27 | fail | get | self.path_kwargs["name"] |
+| taint_test.py:34 | fail | get | request |
+| taint_test.py:36 | fail | get | request.uri |
+| taint_test.py:37 | fail | get | request.path |
+| taint_test.py:38 | fail | get | request.query |
+| taint_test.py:39 | fail | get | request.full_url() |
+| taint_test.py:41 | fail | get | request.remote_ip |
+| taint_test.py:43 | fail | get | request.body |
+| taint_test.py:45 | fail | get | request.arguments |
+| taint_test.py:46 | fail | get | request.arguments["name"] |
+| taint_test.py:47 | fail | get | request.arguments["name"][0] |
+| taint_test.py:49 | fail | get | request.query_arguments |
+| taint_test.py:50 | fail | get | request.query_arguments["name"] |
+| taint_test.py:51 | fail | get | request.query_arguments["name"][0] |
+| taint_test.py:53 | fail | get | request.body_arguments |
+| taint_test.py:54 | fail | get | request.body_arguments["name"] |
+| taint_test.py:55 | fail | get | request.body_arguments["name"][0] |
+| taint_test.py:58 | fail | get | request.headers |
+| taint_test.py:59 | fail | get | request.headers["header-name"] |
+| taint_test.py:60 | fail | get | request.headers.get_list(..) |
+| taint_test.py:61 | fail | get | request.headers.get_all() |
+| taint_test.py:62 | fail | get | ListComp |
+| taint_test.py:65 | fail | get | request.cookies |
+| taint_test.py:66 | fail | get | request.cookies["cookie-name"] |
+| taint_test.py:67 | fail | get | request.cookies["cookie-name"].key |
+| taint_test.py:68 | fail | get | request.cookies["cookie-name"].value |
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.ql b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.ql
new file mode 100644
index 00000000000..08783404ddd
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.ql
@@ -0,0 +1,6 @@
+import experimental.dataflow.tainttracking.TestTaintLib
+import semmle.python.dataflow.new.RemoteFlowSources
+
+class RemoteFlowTestTaintConfiguration extends TestTaintTrackingConfiguration {
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+}
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
index a586175cab9..fb640d99292 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
@@ -2,26 +2,26 @@ import tornado.web
 
 
 class BasicHandler(tornado.web.RequestHandler):
-    def get(self):
+    def get(self):  # $ MISSING: requestHandler
         self.write("BasicHandler " + self.get_argument("xss"))
 
-    def post(self):
+    def post(self):  # $ MISSING: requestHandler
         self.write("BasicHandler (POST)")
 
 
 class DeepInheritance(BasicHandler):
-    def get(self):
+    def get(self):  # $ MISSING: requestHandler
         self.write("DeepInheritance" + self.get_argument("also_xss"))
 
 
 class FormHandler(tornado.web.RequestHandler):
-    def post(self):
+    def post(self):  # $ MISSING: requestHandler
         name = self.get_body_argument("name")
         self.write(name)
 
 
 class RedirectHandler(tornado.web.RequestHandler):
-    def get(self):
+    def get(self):  # $ MISSING: requestHandler
         req = self.request
         h = req.headers
         url = h["url"]
@@ -29,7 +29,7 @@ class RedirectHandler(tornado.web.RequestHandler):
 
 
 class BaseReverseInheritance(tornado.web.RequestHandler):
-    def get(self):
+    def get(self):  # $ MISSING: requestHandler
         self.write("hello from BaseReverseInheritance")
 
 
@@ -38,13 +38,16 @@ class ReverseInheritance(BaseReverseInheritance):
 
 
 def make_app():
-    return tornado.web.Application([
-        (r"/basic", BasicHandler),
-        (r"/deep", DeepInheritance),
-        (r"/form", FormHandler),
-        (r"/redirect", RedirectHandler),
-        (r"/reverse-inheritance", ReverseInheritance),
-    ])
+    return tornado.web.Application(
+        [
+            (r"/basic", BasicHandler),  # $ MISSING: routeSetup="/basic"
+            (r"/deep", DeepInheritance),  # $ MISSING: routeSetup="/deep"
+            (r"/form", FormHandler),  # $ MISSING: routeSetup="/form"
+            (r"/redirect", RedirectHandler),  # $ MISSING: routeSetup="/redirect"
+            (r"/reverse-inheritance", ReverseInheritance),  # $ MISSING: routeSetup="/reverse-inheritance"
+        ],
+        debug=True,
+    )
 
 
 if __name__ == "__main__":
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/options b/python/ql/test/experimental/library-tests/frameworks/tornado/options
new file mode 100644
index 00000000000..cfef58cf2b2
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/options
@@ -0,0 +1 @@
+semmle-extractor-options: --max-import-depth=1 --lang=3
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py b/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py
new file mode 100644
index 00000000000..b0f4eb52fa0
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py
@@ -0,0 +1,35 @@
+import tornado.web
+
+
+class ResponseWriting(tornado.web.RequestHandler):
+    def get(self, type_):  # $ MISSING: requestHandler routedParameter=type_
+        if type_ == "str":
+            self.write("foo")
+        elif type_ == "bytes":
+            self.write(b"foo")
+        elif type_ == "dict":
+            # Content-type will be set to `application/json`
+            self.write({"foo": 42})
+        else:
+            raise Exception("Bad type {} {}".format(type_, type(type_)))
+
+
+def make_app():
+    return tornado.web.Application(
+        [
+            (r"/ResponseWriting/(str|bytes|dict)", ResponseWriting),  # $ MISSING: routeSetup="/ResponseWriting/(str|bytes|dict)"
+        ],
+        debug=True,
+    )
+
+
+if __name__ == "__main__":
+    import tornado.ioloop
+
+    app = make_app()
+    app.listen(8888)
+    tornado.ioloop.IOLoop.current().start()
+
+    # http://localhost:8888/ResponseWriting/str
+    # http://localhost:8888/ResponseWriting/bytes
+    # http://localhost:8888/ResponseWriting/dict
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
new file mode 100644
index 00000000000..86405ecd9b4
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
@@ -0,0 +1,110 @@
+import tornado.web
+import tornado.routing
+
+
+class FooHandler(tornado.web.RequestHandler):
+    def get(self, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+        self.write("FooHandler {} {}".format(x, y))
+
+
+class BarHandler(tornado.web.RequestHandler):
+    def get(self, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+        self.write("BarHandler {} {}".format(x, y))
+
+
+class BazHandler(tornado.web.RequestHandler):
+    def get(self, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+        self.write("BazHandler {} {}".format(x, y))
+
+
+class KwArgs(tornado.web.RequestHandler):
+    def get(self, *, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+        self.write("KwArgs {} {}".format(x, y))
+
+
+class OnlyLocalhost(tornado.web.RequestHandler):
+    def get(self):  # $ MISSING: requestHandler
+        self.write("OnlyLocalhost")
+
+
+class One(tornado.web.RequestHandler):
+    def get(self):  # $ MISSING: requestHandler
+        self.write("One")
+
+
+class Two(tornado.web.RequestHandler):
+    def get(self):  # $ MISSING: requestHandler
+        self.write("Two")
+
+
+class Three(tornado.web.RequestHandler):
+    def get(self):  # $ MISSING: requestHandler
+        self.write("Three")
+
+
+class AddedLater(tornado.web.RequestHandler):
+    def get(self, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+        self.write("AddedLater {} {}".format(x, y))
+
+
+class PossiblyNotRouted(tornado.web.RequestHandler):
+    # Even if our analysis can't find a route-setup for this class, we should still
+    # consider it to be a handle incoming HTTP requests
+
+    def get(self):  # $ MISSING: requestHandler
+        self.write("NotRouted")
+
+
+def make_app():
+    # see https://www.tornadoweb.org/en/stable/routing.html for even more examples
+    app = tornado.web.Application(
+        [
+            (r"/foo/([0-9]+)/([0-9]+)?", FooHandler),  # $ MISSING: routeSetup="/foo/([0-9]+)/([0-9]+)?"
+            tornado.web.URLSpec(r"/bar/([0-9]+)/([0-9]+)?", BarHandler),  # $ MISSING: routeSetup="/bar/([0-9]+)/([0-9]+)?"
+            # Very verbose way to write same as FooHandler
+            tornado.routing.Rule(tornado.routing.PathMatches(r"/baz/([0-9]+)/([0-9]+)?"), BazHandler),  # $ MISSING: routeSetup="/baz/([0-9]+)/([0-9]+)?"
+            (r"/kw-args/(?P<x>[0-9]+)/(?P<y>[0-9]+)?", KwArgs),  # $ MISSING: routeSetup="/kw-args/(?P<x>[0-9]+)/(?P<y>[0-9]+)?"
+            # You can do nesting
+            (r"/(one|two|three)", [
+                (r"/one", One),  # $ MISSING: routeSetup="/one"
+                (r"/two", Two),  # $ MISSING: routeSetup="/two"
+                (r"/three", Three)  # $ MISSING: routeSetup="/three"
+            ]),
+            # which is _one_ recommended way to ensure known host is used
+            (tornado.routing.HostMatches(r"(localhost|127\.0\.0\.1)"), [
+                ("/only-localhost", OnlyLocalhost)  # $ MISSING: routeSetup="/only-localhost"
+            ]),
+
+        ],
+        debug=True,
+    )
+    app.add_handlers(r".*", [(r"/added-later/([0-9]+)/([0-9]+)?", AddedLater)])  # $ MISSING: routeSetup="/added-later/([0-9]+)/([0-9]+)?"
+    return app
+
+
+if __name__ == "__main__":
+
+    import tornado.ioloop
+    app = make_app()
+    app.listen(8888)
+    tornado.ioloop.IOLoop.current().start()
+
+    # http://localhost:8888/foo/42/
+    # http://localhost:8888/foo/42/1337
+
+    # http://localhost:8888/bar/42/
+    # http://localhost:8888/bar/42/1337
+
+    # http://localhost:8888/baz/42/
+    # http://localhost:8888/baz/42/1337
+
+    # http://localhost:8888/kw-args/42/
+    # http://localhost:8888/kw-args/42/1337
+
+    # http://localhost:8888/only-localhost
+
+    # http://localhost:8888/one
+    # http://localhost:8888/two
+    # http://localhost:8888/three
+
+    # http://localhost:8888/added-later
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py b/python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py
new file mode 100644
index 00000000000..891547b3375
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py
@@ -0,0 +1,90 @@
+import tornado.web
+
+
+class TaintTest(tornado.web.RequestHandler):
+    def get(self, name = "World!", number="0", foo="foo"):  # $ MISSING: requestHandler routedParameter=name routedParameter=number
+        ensure_tainted(name, number)
+        ensure_not_tainted(foo)
+
+        ensure_tainted(
+            # see https://www.tornadoweb.org/en/stable/web.html#input
+            self.get_argument("name"),
+            self.get_arguments("name"),
+            self.get_arguments("name")[0],
+
+            self.get_body_argument("name"),
+            self.get_body_arguments("name"),
+            self.get_body_arguments("name")[0],
+
+            self.get_query_argument("name"),
+            self.get_query_arguments("name"),
+            self.get_query_arguments("name")[0],
+
+            self.path_args,
+            self.path_args[0],
+
+            self.path_kwargs,
+            self.path_kwargs["name"],
+        )
+
+        request = self.request
+
+        ensure_tainted(
+            # see https://www.tornadoweb.org/en/stable/httputil.html#tornado.httputil.HTTPServerRequest
+            request,
+
+            request.uri,
+            request.path,
+            request.query,
+            request.full_url(),
+
+            request.remote_ip,
+
+            request.body,
+
+            request.arguments,
+            request.arguments["name"],
+            request.arguments["name"][0],
+
+            request.query_arguments,
+            request.query_arguments["name"],
+            request.query_arguments["name"][0],
+
+            request.body_arguments,
+            request.body_arguments["name"],
+            request.body_arguments["name"][0],
+
+            # dict-like, see https://www.tornadoweb.org/en/stable/httputil.html#tornado.httputil.HTTPHeaders
+            request.headers,
+            request.headers["header-name"],
+            request.headers.get_list("header-name"),
+            request.headers.get_all(),
+            [(k, v) for (k, v) in request.headers.get_all()],
+
+            # Dict[str, http.cookies.Morsel]
+            request.cookies,
+            request.cookies["cookie-name"],
+            request.cookies["cookie-name"].key,
+            request.cookies["cookie-name"].value,
+        )
+
+
+def make_app():
+    return tornado.web.Application(
+        [
+            (r"/test_taint/([^/]+)/([0-9]+)", TaintTest),  # $ MISSING: routeSetup="/test_taint/([^/]+)/([0-9]+)"
+        ],
+        debug=True,
+    )
+
+
+if __name__ == "__main__":
+    import tornado.ioloop
+
+    app = make_app()
+    app.listen(8888)
+    tornado.ioloop.IOLoop.current().start()
+
+    # http://localhost:8888/ResponseWriting/str
+    # http://localhost:8888/ResponseWriting/bytes
+    # http://localhost:8888/ResponseWriting/dict

From 4641150d45615770bea488a2d48cb2113d807739 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 22 Dec 2020 14:19:26 +0100
Subject: [PATCH 107/343] Python: Basic taint-modeling of
 tornado.web.RequestHandler classes

---
 python/ql/src/semmle/python/Frameworks.qll    |   1 +
 .../src/semmle/python/frameworks/Tornado.qll  | 227 ++++++++++++++++++
 .../frameworks/tornado/TestTaint.expected     |  28 +--
 3 files changed, 242 insertions(+), 14 deletions(-)
 create mode 100644 python/ql/src/semmle/python/frameworks/Tornado.qll

diff --git a/python/ql/src/semmle/python/Frameworks.qll b/python/ql/src/semmle/python/Frameworks.qll
index a758e114fd2..23ffb88641e 100644
--- a/python/ql/src/semmle/python/Frameworks.qll
+++ b/python/ql/src/semmle/python/Frameworks.qll
@@ -12,4 +12,5 @@ private import semmle.python.frameworks.MySQLdb
 private import semmle.python.frameworks.Psycopg2
 private import semmle.python.frameworks.PyMySQL
 private import semmle.python.frameworks.Stdlib
+private import semmle.python.frameworks.Tornado
 private import semmle.python.frameworks.Yaml
diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
new file mode 100644
index 00000000000..34e828b91b1
--- /dev/null
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -0,0 +1,227 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `tornado` PyPI package.
+ * See https://www.tornadoweb.org/en/stable/.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.Concepts
+
+/**
+ * Provides models for the `tornado` PyPI package.
+ * See https://www.tornadoweb.org/en/stable/.
+ */
+private module Tornado {
+  // ---------------------------------------------------------------------------
+  // tornado
+  // ---------------------------------------------------------------------------
+  /** Gets a reference to the `tornado` module. */
+  private DataFlow::Node tornado(DataFlow::TypeTracker t) {
+    t.start() and
+    result = DataFlow::importNode("tornado")
+    or
+    exists(DataFlow::TypeTracker t2 | result = tornado(t2).track(t2, t))
+  }
+
+  /** Gets a reference to the `tornado` module. */
+  DataFlow::Node tornado() { result = tornado(DataFlow::TypeTracker::end()) }
+
+  /**
+   * Gets a reference to the attribute `attr_name` of the `tornado` module.
+   * WARNING: Only holds for a few predefined attributes.
+   */
+  private DataFlow::Node tornado_attr(DataFlow::TypeTracker t, string attr_name) {
+    attr_name in ["web"] and
+    (
+      t.start() and
+      result = DataFlow::importNode("tornado" + "." + attr_name)
+      or
+      t.startInAttr(attr_name) and
+      result = tornado()
+    )
+    or
+    // Due to bad performance when using normal setup with `tornado_attr(t2, attr_name).track(t2, t)`
+    // we have inlined that code and forced a join
+    exists(DataFlow::TypeTracker t2 |
+      exists(DataFlow::StepSummary summary |
+        tornado_attr_first_join(t2, attr_name, result, summary) and
+        t = t2.append(summary)
+      )
+    )
+  }
+
+  pragma[nomagic]
+  private predicate tornado_attr_first_join(
+    DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
+  ) {
+    DataFlow::StepSummary::step(tornado_attr(t2, attr_name), res, summary)
+  }
+
+  /**
+   * Gets a reference to the attribute `attr_name` of the `tornado` module.
+   * WARNING: Only holds for a few predefined attributes.
+   */
+  private DataFlow::Node tornado_attr(string attr_name) {
+    result = tornado_attr(DataFlow::TypeTracker::end(), attr_name)
+  }
+
+  /** Provides models for the `tornado` module. */
+  module tornado {
+    // -------------------------------------------------------------------------
+    // tornado.web
+    // -------------------------------------------------------------------------
+    /** Gets a reference to the `tornado.web` module. */
+    DataFlow::Node web() { result = tornado_attr("web") }
+
+    /** Provides models for the `tornado.web` module */
+    module web {
+      /**
+       * Gets a reference to the attribute `attr_name` of the `tornado.web` module.
+       * WARNING: Only holds for a few predefined attributes.
+       */
+      private DataFlow::Node web_attr(DataFlow::TypeTracker t, string attr_name) {
+        attr_name in ["RequestHandler"] and
+        (
+          t.start() and
+          result = DataFlow::importNode("tornado.web" + "." + attr_name)
+          or
+          t.startInAttr(attr_name) and
+          result = web()
+        )
+        or
+        // Due to bad performance when using normal setup with `web_attr(t2, attr_name).track(t2, t)`
+        // we have inlined that code and forced a join
+        exists(DataFlow::TypeTracker t2 |
+          exists(DataFlow::StepSummary summary |
+            web_attr_first_join(t2, attr_name, result, summary) and
+            t = t2.append(summary)
+          )
+        )
+      }
+
+      pragma[nomagic]
+      private predicate web_attr_first_join(
+        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
+        DataFlow::StepSummary summary
+      ) {
+        DataFlow::StepSummary::step(web_attr(t2, attr_name), res, summary)
+      }
+
+      /**
+       * Gets a reference to the attribute `attr_name` of the `tornado.web` module.
+       * WARNING: Only holds for a few predefined attributes.
+       */
+      private DataFlow::Node web_attr(string attr_name) {
+        result = web_attr(DataFlow::TypeTracker::end(), attr_name)
+      }
+
+      /**
+       * Provides models for the `tornado.web.RequestHandler` class and subclasses.
+       *
+       * See https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.
+       */
+      module RequestHandler {
+        /** Gets a reference to the `tornado.web.RequestHandler` class or any subclass. */
+        private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
+          t.start() and
+          result = web_attr("RequestHandler")
+          or
+          // subclasses in project code
+          result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
+          or
+          exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
+        }
+
+        /** Gets a reference to the `tornado.web.RequestHandler` class or any subclass. */
+        DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
+
+        /** A RequestHandler class (most likely in project code). */
+        private class RequestHandlerClass extends Class {
+          RequestHandlerClass() { this.getParent() = subclassRef().asExpr() }
+        }
+
+        /**
+         * A source of instances of the `tornado.web.RequestHandler` class or any subclass, extend this class to model new instances.
+         *
+         * This can include instantiations of the class, return values from function
+         * calls, or a special parameter that will be set when functions are called by an external
+         * library.
+         *
+         * Use the predicate `RequestHandler::instance()` to get references to instances of the `tornado.web.RequestHandler` class or any subclass.
+         */
+        abstract class InstanceSource extends DataFlow::Node { }
+
+        /** The `self` parameter in a method on the `tornado.web.RequestHandler` class or any subclass. */
+        private class SelfParam extends InstanceSource, RemoteFlowSource::Range,
+          DataFlow::ParameterNode {
+          SelfParam() {
+            exists(RequestHandlerClass cls | cls.getAMethod().getArg(0) = this.getParameter())
+          }
+
+          override string getSourceType() { result = "tornado.web.RequestHandler" }
+        }
+
+        /** Gets a reference to an instance of the `tornado.web.RequestHandler` class or any subclass. */
+        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          t.start() and
+          result instanceof InstanceSource
+          or
+          exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
+        }
+
+        /** Gets a reference to an instance of the `tornado.web.RequestHandler` class or any subclass. */
+        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+
+        /** Gets a reference to one of the methods `get_argument`, `get_body_argument`, `get_query_argument`. */
+        private DataFlow::Node argumentMethod(DataFlow::TypeTracker t) {
+          t.startInAttr(["get_argument", "get_body_argument", "get_query_argument"]) and
+          result = instance()
+          or
+          exists(DataFlow::TypeTracker t2 | result = argumentMethod(t2).track(t2, t))
+        }
+
+        /** Gets a reference to one of the methods `get_argument`, `get_body_argument`, `get_query_argument`. */
+        DataFlow::Node argumentMethod() { result = argumentMethod(DataFlow::TypeTracker::end()) }
+
+        /** Gets a reference to one of the methods `get_arguments`, `get_body_arguments`, `get_query_arguments`. */
+        private DataFlow::Node argumentsMethod(DataFlow::TypeTracker t) {
+          t.startInAttr(["get_arguments", "get_body_arguments", "get_query_arguments"]) and
+          result = instance()
+          or
+          exists(DataFlow::TypeTracker t2 | result = argumentsMethod(t2).track(t2, t))
+        }
+
+        /** Gets a reference to one of the methods `get_arguments`, `get_body_arguments`, `get_query_arguments`. */
+        DataFlow::Node argumentsMethod() { result = argumentsMethod(DataFlow::TypeTracker::end()) }
+
+        private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
+          override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+            // Method access
+            nodeTo.(DataFlow::AttrRead).getObject() = nodeFrom and
+            nodeFrom = instance() and
+            nodeTo in [argumentMethod(), argumentsMethod()]
+            or
+            // Method call
+            nodeTo.asCfgNode().(CallNode).getFunction() = nodeFrom.asCfgNode() and
+            nodeFrom in [argumentMethod(), argumentsMethod()]
+            or
+            // Attributes
+            nodeFrom = instance() and
+            exists(DataFlow::AttrRead read | nodeTo = read and read.getObject() = nodeFrom |
+              read.getAttributeName() in [
+                  // List[str]
+                  "path_args",
+                  // Dict[str, str]
+                  "path_kwargs",
+                  // tornado.httputil.HTTPServerRequest
+                  "request"
+                ]
+            )
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
index 48b8dc0462f..a59997a9adc 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
@@ -1,20 +1,20 @@
 | taint_test.py:6 | fail | get | name |
 | taint_test.py:6 | fail | get | number |
 | taint_test.py:7 | ok   | get | foo |
-| taint_test.py:11 | fail | get | self.get_argument(..) |
-| taint_test.py:12 | fail | get | self.get_arguments(..) |
-| taint_test.py:13 | fail | get | self.get_arguments(..)[0] |
-| taint_test.py:15 | fail | get | self.get_body_argument(..) |
-| taint_test.py:16 | fail | get | self.get_body_arguments(..) |
-| taint_test.py:17 | fail | get | self.get_body_arguments(..)[0] |
-| taint_test.py:19 | fail | get | self.get_query_argument(..) |
-| taint_test.py:20 | fail | get | self.get_query_arguments(..) |
-| taint_test.py:21 | fail | get | self.get_query_arguments(..)[0] |
-| taint_test.py:23 | fail | get | self.path_args |
-| taint_test.py:24 | fail | get | self.path_args[0] |
-| taint_test.py:26 | fail | get | self.path_kwargs |
-| taint_test.py:27 | fail | get | self.path_kwargs["name"] |
-| taint_test.py:34 | fail | get | request |
+| taint_test.py:11 | ok   | get | self.get_argument(..) |
+| taint_test.py:12 | ok   | get | self.get_arguments(..) |
+| taint_test.py:13 | ok   | get | self.get_arguments(..)[0] |
+| taint_test.py:15 | ok   | get | self.get_body_argument(..) |
+| taint_test.py:16 | ok   | get | self.get_body_arguments(..) |
+| taint_test.py:17 | ok   | get | self.get_body_arguments(..)[0] |
+| taint_test.py:19 | ok   | get | self.get_query_argument(..) |
+| taint_test.py:20 | ok   | get | self.get_query_arguments(..) |
+| taint_test.py:21 | ok   | get | self.get_query_arguments(..)[0] |
+| taint_test.py:23 | ok   | get | self.path_args |
+| taint_test.py:24 | ok   | get | self.path_args[0] |
+| taint_test.py:26 | ok   | get | self.path_kwargs |
+| taint_test.py:27 | ok   | get | self.path_kwargs["name"] |
+| taint_test.py:34 | ok   | get | request |
 | taint_test.py:36 | fail | get | request.uri |
 | taint_test.py:37 | fail | get | request.path |
 | taint_test.py:38 | fail | get | request.query |

From 39d85896a1ca2aeb3aa6e9d2c248f6fc3f8bd51b Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 22 Dec 2020 14:37:51 +0100
Subject: [PATCH 108/343] Python: Add basic taint modeling of tornado request

---
 .../src/semmle/python/frameworks/Tornado.qll  | 144 +++++++++++++++++-
 .../frameworks/tornado/TestTaint.expected     |  38 ++---
 2 files changed, 162 insertions(+), 20 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index 34e828b91b1..e898c968fcd 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -33,7 +33,7 @@ private module Tornado {
    * WARNING: Only holds for a few predefined attributes.
    */
   private DataFlow::Node tornado_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["web"] and
+    attr_name in ["web", "httputil"] and
     (
       t.start() and
       result = DataFlow::importNode("tornado" + "." + attr_name)
@@ -221,6 +221,148 @@ private module Tornado {
             )
           }
         }
+
+        private class RequestAttrAccess extends tornado::httputil::HttpServerRequest::InstanceSource {
+          RequestAttrAccess() {
+            this.(DataFlow::AttrRead).getObject() = instance() and
+            this.(DataFlow::AttrRead).getAttributeName() = "request"
+          }
+        }
+      }
+    }
+
+    // -------------------------------------------------------------------------
+    // tornado.httputil
+    // -------------------------------------------------------------------------
+    /** Gets a reference to the `tornado.httputil` module. */
+    DataFlow::Node httputil() { result = tornado_attr("httputil") }
+
+    /** Provides models for the `tornado.httputil` module */
+    module httputil {
+      /**
+       * Gets a reference to the attribute `attr_name` of the `tornado.httputil` module.
+       * WARNING: Only holds for a few predefined attributes.
+       */
+      private DataFlow::Node httputil_attr(DataFlow::TypeTracker t, string attr_name) {
+        attr_name in ["HTTPServerRequest"] and
+        (
+          t.start() and
+          result = DataFlow::importNode("tornado.httputil" + "." + attr_name)
+          or
+          t.startInAttr(attr_name) and
+          result = httputil()
+        )
+        or
+        // Due to bad performance when using normal setup with `httputil_attr(t2, attr_name).track(t2, t)`
+        // we have inlined that code and forced a join
+        exists(DataFlow::TypeTracker t2 |
+          exists(DataFlow::StepSummary summary |
+            httputil_attr_first_join(t2, attr_name, result, summary) and
+            t = t2.append(summary)
+          )
+        )
+      }
+
+      pragma[nomagic]
+      private predicate httputil_attr_first_join(
+        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
+        DataFlow::StepSummary summary
+      ) {
+        DataFlow::StepSummary::step(httputil_attr(t2, attr_name), res, summary)
+      }
+
+      /**
+       * Gets a reference to the attribute `attr_name` of the `tornado.httputil` module.
+       * WARNING: Only holds for a few predefined attributes.
+       */
+      private DataFlow::Node httputil_attr(string attr_name) {
+        result = httputil_attr(DataFlow::TypeTracker::end(), attr_name)
+      }
+
+      /**
+       * Provides models for the `tornado.httputil.HttpServerRequest` class
+       *
+       * See https://www.tornadoweb.org/en/stable/httputil.html#tornado.httputil.HTTPServerRequest.
+       */
+      module HttpServerRequest {
+        /** Gets a reference to the `tornado.httputil.HttpServerRequest` class. */
+        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
+          t.start() and
+          result = httputil_attr("HttpServerRequest")
+          or
+          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+        }
+
+        /** Gets a reference to the `tornado.httputil.HttpServerRequest` class. */
+        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+
+        /**
+         * A source of instances of `tornado.httputil.HttpServerRequest`, extend this class to model new instances.
+         *
+         * This can include instantiations of the class, return values from function
+         * calls, or a special parameter that will be set when functions are called by an external
+         * library.
+         *
+         * Use the predicate `HttpServerRequest::instance()` to get references to instances of `tornado.httputil.HttpServerRequest`.
+         */
+        abstract class InstanceSource extends DataFlow::Node { }
+
+        /** A direct instantiation of `tornado.httputil.HttpServerRequest`. */
+        private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
+          override CallNode node;
+
+          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        }
+
+        /** Gets a reference to an instance of `tornado.httputil.HttpServerRequest`. */
+        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          t.start() and
+          result instanceof InstanceSource
+          or
+          exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
+        }
+
+        /** Gets a reference to an instance of `tornado.httputil.HttpServerRequest`. */
+        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+
+        /** Gets a reference to the `full_url` method. */
+        private DataFlow::Node full_url(DataFlow::TypeTracker t) {
+          t.startInAttr("full_url") and
+          result = instance()
+          or
+          exists(DataFlow::TypeTracker t2 | result = full_url(t2).track(t2, t))
+        }
+
+        /** Gets a reference to the `full_url` method. */
+        DataFlow::Node full_url() { result = full_url(DataFlow::TypeTracker::end()) }
+
+        private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
+          override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+            // Method access
+            nodeTo.(DataFlow::AttrRead).getObject() = nodeFrom and
+            nodeFrom = instance() and
+            nodeTo in [full_url()]
+            or
+            // Method call
+            nodeTo.asCfgNode().(CallNode).getFunction() = nodeFrom.asCfgNode() and
+            nodeFrom in [full_url()]
+            or
+            // Attributes
+            nodeFrom = instance() and
+            exists(DataFlow::AttrRead read | nodeTo = read and read.getObject() = nodeFrom |
+              read.getAttributeName() in [
+                  // str / bytes
+                  "uri", "path", "query", "remote_ip", "body",
+                  // Dict[str, List[bytes]]
+                  "arguments", "query_arguments", "body_arguments",
+                  // dict-like, https://www.tornadoweb.org/en/stable/httputil.html#tornado.httputil.HTTPHeaders
+                  "headers",
+                  // Dict[str, http.cookies.Morsel]
+                  "cookies"
+                ]
+            )
+          }
+        }
       }
     }
   }
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
index a59997a9adc..61e325ad430 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
@@ -15,27 +15,27 @@
 | taint_test.py:26 | ok   | get | self.path_kwargs |
 | taint_test.py:27 | ok   | get | self.path_kwargs["name"] |
 | taint_test.py:34 | ok   | get | request |
-| taint_test.py:36 | fail | get | request.uri |
-| taint_test.py:37 | fail | get | request.path |
-| taint_test.py:38 | fail | get | request.query |
-| taint_test.py:39 | fail | get | request.full_url() |
-| taint_test.py:41 | fail | get | request.remote_ip |
-| taint_test.py:43 | fail | get | request.body |
-| taint_test.py:45 | fail | get | request.arguments |
-| taint_test.py:46 | fail | get | request.arguments["name"] |
-| taint_test.py:47 | fail | get | request.arguments["name"][0] |
-| taint_test.py:49 | fail | get | request.query_arguments |
-| taint_test.py:50 | fail | get | request.query_arguments["name"] |
-| taint_test.py:51 | fail | get | request.query_arguments["name"][0] |
-| taint_test.py:53 | fail | get | request.body_arguments |
-| taint_test.py:54 | fail | get | request.body_arguments["name"] |
-| taint_test.py:55 | fail | get | request.body_arguments["name"][0] |
-| taint_test.py:58 | fail | get | request.headers |
-| taint_test.py:59 | fail | get | request.headers["header-name"] |
+| taint_test.py:36 | ok   | get | request.uri |
+| taint_test.py:37 | ok   | get | request.path |
+| taint_test.py:38 | ok   | get | request.query |
+| taint_test.py:39 | ok   | get | request.full_url() |
+| taint_test.py:41 | ok   | get | request.remote_ip |
+| taint_test.py:43 | ok   | get | request.body |
+| taint_test.py:45 | ok   | get | request.arguments |
+| taint_test.py:46 | ok   | get | request.arguments["name"] |
+| taint_test.py:47 | ok   | get | request.arguments["name"][0] |
+| taint_test.py:49 | ok   | get | request.query_arguments |
+| taint_test.py:50 | ok   | get | request.query_arguments["name"] |
+| taint_test.py:51 | ok   | get | request.query_arguments["name"][0] |
+| taint_test.py:53 | ok   | get | request.body_arguments |
+| taint_test.py:54 | ok   | get | request.body_arguments["name"] |
+| taint_test.py:55 | ok   | get | request.body_arguments["name"][0] |
+| taint_test.py:58 | ok   | get | request.headers |
+| taint_test.py:59 | ok   | get | request.headers["header-name"] |
 | taint_test.py:60 | fail | get | request.headers.get_list(..) |
 | taint_test.py:61 | fail | get | request.headers.get_all() |
 | taint_test.py:62 | fail | get | ListComp |
-| taint_test.py:65 | fail | get | request.cookies |
-| taint_test.py:66 | fail | get | request.cookies["cookie-name"] |
+| taint_test.py:65 | ok   | get | request.cookies |
+| taint_test.py:66 | ok   | get | request.cookies["cookie-name"] |
 | taint_test.py:67 | fail | get | request.cookies["cookie-name"].key |
 | taint_test.py:68 | fail | get | request.cookies["cookie-name"].value |

From 1849b9e7714a4e63946952030ac5c6316ba4e5a5 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 22 Dec 2020 16:16:29 +0100
Subject: [PATCH 109/343] Python: Tornado: Handle basic route setup with tuples

The reason this becomes valueable right now, is that we can mark routed params
as taint-sources. Longer down the line, we can (hopefully) detect that a routed
param will only accept digits, and mark it safe for some of our taint-tracking
queries.
---
 .../src/semmle/python/frameworks/Tornado.qll  | 154 +++++++++++++++++-
 .../frameworks/tornado/TestTaint.expected     |   4 +-
 .../library-tests/frameworks/tornado/basic.py |  20 +--
 .../frameworks/tornado/responses.py           |   4 +-
 .../frameworks/tornado/routing_test.py        |  28 ++--
 .../frameworks/tornado/taint_test.py          |   4 +-
 6 files changed, 182 insertions(+), 32 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index e898c968fcd..59c6ebfeb25 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -8,6 +8,7 @@ private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Concepts
+private import semmle.python.regex
 
 /**
  * Provides models for the `tornado` PyPI package.
@@ -82,7 +83,7 @@ private module Tornado {
        * WARNING: Only holds for a few predefined attributes.
        */
       private DataFlow::Node web_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["RequestHandler"] and
+        attr_name in ["RequestHandler", "Application"] and
         (
           t.start() and
           result = DataFlow::importNode("tornado.web" + "." + attr_name)
@@ -138,8 +139,19 @@ private module Tornado {
         DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
 
         /** A RequestHandler class (most likely in project code). */
-        private class RequestHandlerClass extends Class {
+        class RequestHandlerClass extends Class {
           RequestHandlerClass() { this.getParent() = subclassRef().asExpr() }
+
+          /** Gets a reference to this class. */
+          private DataFlow::Node getARef(DataFlow::TypeTracker t) {
+            t.start() and
+            result.asExpr().(ClassExpr) = this.getParent()
+            or
+            exists(DataFlow::TypeTracker t2 | result = this.getARef(t2).track(t2, t))
+          }
+
+          /** Gets a reference to this class. */
+          DataFlow::Node getARef() { result = this.getARef(DataFlow::TypeTracker::end()) }
         }
 
         /**
@@ -229,6 +241,64 @@ private module Tornado {
           }
         }
       }
+
+      /**
+       * Provides models for the `tornado.web.Application` class
+       *
+       * See https://www.tornadoweb.org/en/stable/web.html#tornado.web.Application.
+       */
+      module Application {
+        /** Gets a reference to the `tornado.web.Application` class. */
+        private DataFlow::Node classRef(DataFlow::TypeTracker t) {
+          t.start() and
+          result = web_attr("Application")
+          or
+          exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+        }
+
+        /** Gets a reference to the `tornado.web.Application` class. */
+        DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+
+        /**
+         * A source of instances of `tornado.web.Application`, extend this class to model new instances.
+         *
+         * This can include instantiations of the class, return values from function
+         * calls, or a special parameter that will be set when functions are called by an external
+         * library.
+         *
+         * Use the predicate `Application::instance()` to get references to instances of `tornado.web.Application`.
+         */
+        abstract class InstanceSource extends DataFlow::Node { }
+
+        /** A direct instantiation of `tornado.web.Application`. */
+        class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
+          override CallNode node;
+
+          ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+        }
+
+        /** Gets a reference to an instance of `tornado.web.Application`. */
+        private DataFlow::Node instance(DataFlow::TypeTracker t) {
+          t.start() and
+          result instanceof InstanceSource
+          or
+          exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
+        }
+
+        /** Gets a reference to an instance of `tornado.web.Application`. */
+        DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+
+        /** Gets a reference to the `add_handlers` method. */
+        private DataFlow::Node add_handlers(DataFlow::TypeTracker t) {
+          t.startInAttr("add_handlers") and
+          result = instance()
+          or
+          exists(DataFlow::TypeTracker t2 | result = add_handlers(t2).track(t2, t))
+        }
+
+        /** Gets a reference to the `add_handlers` method. */
+        DataFlow::Node add_handlers() { result = add_handlers(DataFlow::TypeTracker::end()) }
+      }
     }
 
     // -------------------------------------------------------------------------
@@ -366,4 +436,84 @@ private module Tornado {
       }
     }
   }
+
+  // ---------------------------------------------------------------------------
+  // routing
+  // ---------------------------------------------------------------------------
+  /** A sequence that defines a number of route rules */
+  SequenceNode routeSetupRuleList() {
+    exists(CallNode call | call = any(tornado::web::Application::ClassInstantiation c).asCfgNode() |
+      result in [call.getArg(0), call.getArgByName("handlers")]
+    )
+    or
+    exists(CallNode call |
+      call.getFunction() = tornado::web::Application::add_handlers().asCfgNode()
+    |
+      result in [call.getArg(1), call.getArgByName("host_handlers")]
+    )
+    or
+    result = routeSetupRuleList().getElement(_).(TupleNode).getElement(1)
+  }
+
+  /** A tornado route setup. */
+  abstract class TornadoRouteSetup extends HTTP::Server::RouteSetup::Range { }
+
+  /**
+   * A regex that is used to set up a route.
+   *
+   * Needs this subclass to be considered a RegexString.
+   */
+  private class TornadoRouteRegex extends RegexString {
+    TornadoRouteSetup setup;
+
+    TornadoRouteRegex() {
+      this instanceof StrConst and
+      DataFlow::localFlow(DataFlow::exprNode(this), setup.getUrlPatternArg())
+    }
+
+    TornadoRouteSetup getRouteSetup() { result = setup }
+  }
+
+  /** A route setup using a tuple. */
+  private class TornadoTupleRouteSetup extends TornadoRouteSetup, DataFlow::CfgNode {
+    override TupleNode node;
+
+    TornadoTupleRouteSetup() {
+      node = routeSetupRuleList().getElement(_) and
+      count(node.getElement(_)) = 2 and
+      not node.getElement(1) instanceof SequenceNode
+    }
+
+    override DataFlow::Node getUrlPatternArg() { result.asCfgNode() = node.getElement(0) }
+
+    override Function getARequestHandler() {
+      exists(tornado::web::RequestHandler::RequestHandlerClass cls |
+        cls.getARef().asCfgNode() = node.getElement(1) and
+        // TODO: Proper MRO
+        result = cls.getAMethod() and
+        result.getName() = HTTP::httpVerbLower()
+      )
+    }
+
+    override Parameter getARoutedParameter() {
+      // If we don't know the URL pattern, we simply mark all parameters as a routed
+      // parameter. This should give us more RemoteFlowSources but could also lead to
+      // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
+      exists(Function requestHandler | requestHandler = this.getARequestHandler() |
+        not exists(this.getUrlPattern()) and
+        result in [requestHandler.getArg(_), requestHandler.getArgByName(_)] and
+        not result = requestHandler.getArg(0)
+      )
+      or
+      exists(Function requestHandler, TornadoRouteRegex regex |
+        requestHandler = this.getARequestHandler() and
+        regex.getRouteSetup() = this
+      |
+        // first group will have group number 1
+        result = requestHandler.getArg(regex.getGroupNumber(_, _))
+        or
+        result = requestHandler.getArgByName(regex.getGroupName(_, _))
+      )
+    }
+  }
 }
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
index 61e325ad430..f14b12d580e 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/TestTaint.expected
@@ -1,5 +1,5 @@
-| taint_test.py:6 | fail | get | name |
-| taint_test.py:6 | fail | get | number |
+| taint_test.py:6 | ok   | get | name |
+| taint_test.py:6 | ok   | get | number |
 | taint_test.py:7 | ok   | get | foo |
 | taint_test.py:11 | ok   | get | self.get_argument(..) |
 | taint_test.py:12 | ok   | get | self.get_arguments(..) |
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
index fb640d99292..d90ce074319 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
@@ -2,26 +2,26 @@ import tornado.web
 
 
 class BasicHandler(tornado.web.RequestHandler):
-    def get(self):  # $ MISSING: requestHandler
+    def get(self):  # $ requestHandler
         self.write("BasicHandler " + self.get_argument("xss"))
 
-    def post(self):  # $ MISSING: requestHandler
+    def post(self):  # $ requestHandler
         self.write("BasicHandler (POST)")
 
 
 class DeepInheritance(BasicHandler):
-    def get(self):  # $ MISSING: requestHandler
+    def get(self):  # $ requestHandler
         self.write("DeepInheritance" + self.get_argument("also_xss"))
 
 
 class FormHandler(tornado.web.RequestHandler):
-    def post(self):  # $ MISSING: requestHandler
+    def post(self):  # $ requestHandler
         name = self.get_body_argument("name")
         self.write(name)
 
 
 class RedirectHandler(tornado.web.RequestHandler):
-    def get(self):  # $ MISSING: requestHandler
+    def get(self):  # $ requestHandler
         req = self.request
         h = req.headers
         url = h["url"]
@@ -40,11 +40,11 @@ class ReverseInheritance(BaseReverseInheritance):
 def make_app():
     return tornado.web.Application(
         [
-            (r"/basic", BasicHandler),  # $ MISSING: routeSetup="/basic"
-            (r"/deep", DeepInheritance),  # $ MISSING: routeSetup="/deep"
-            (r"/form", FormHandler),  # $ MISSING: routeSetup="/form"
-            (r"/redirect", RedirectHandler),  # $ MISSING: routeSetup="/redirect"
-            (r"/reverse-inheritance", ReverseInheritance),  # $ MISSING: routeSetup="/reverse-inheritance"
+            (r"/basic", BasicHandler),  # $ routeSetup="/basic"
+            (r"/deep", DeepInheritance),  # $ routeSetup="/deep"
+            (r"/form", FormHandler),  # $ routeSetup="/form"
+            (r"/redirect", RedirectHandler),  # $ routeSetup="/redirect"
+            (r"/reverse-inheritance", ReverseInheritance),  # $ routeSetup="/reverse-inheritance"
         ],
         debug=True,
     )
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py b/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py
index b0f4eb52fa0..fed6da1527b 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py
@@ -2,7 +2,7 @@ import tornado.web
 
 
 class ResponseWriting(tornado.web.RequestHandler):
-    def get(self, type_):  # $ MISSING: requestHandler routedParameter=type_
+    def get(self, type_):  # $ requestHandler routedParameter=type_
         if type_ == "str":
             self.write("foo")
         elif type_ == "bytes":
@@ -17,7 +17,7 @@ class ResponseWriting(tornado.web.RequestHandler):
 def make_app():
     return tornado.web.Application(
         [
-            (r"/ResponseWriting/(str|bytes|dict)", ResponseWriting),  # $ MISSING: routeSetup="/ResponseWriting/(str|bytes|dict)"
+            (r"/ResponseWriting/(str|bytes|dict)", ResponseWriting),  # $ routeSetup="/ResponseWriting/(str|bytes|dict)"
         ],
         debug=True,
     )
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
index 86405ecd9b4..1e3efa7c611 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
@@ -3,7 +3,7 @@ import tornado.routing
 
 
 class FooHandler(tornado.web.RequestHandler):
-    def get(self, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+    def get(self, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y
         self.write("FooHandler {} {}".format(x, y))
 
 
@@ -18,32 +18,32 @@ class BazHandler(tornado.web.RequestHandler):
 
 
 class KwArgs(tornado.web.RequestHandler):
-    def get(self, *, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+    def get(self, *, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y
         self.write("KwArgs {} {}".format(x, y))
 
 
 class OnlyLocalhost(tornado.web.RequestHandler):
-    def get(self):  # $ MISSING: requestHandler
+    def get(self):  # $ requestHandler
         self.write("OnlyLocalhost")
 
 
 class One(tornado.web.RequestHandler):
-    def get(self):  # $ MISSING: requestHandler
+    def get(self):  # $ requestHandler
         self.write("One")
 
 
 class Two(tornado.web.RequestHandler):
-    def get(self):  # $ MISSING: requestHandler
+    def get(self):  # $ requestHandler
         self.write("Two")
 
 
 class Three(tornado.web.RequestHandler):
-    def get(self):  # $ MISSING: requestHandler
+    def get(self):  # $ requestHandler
         self.write("Three")
 
 
 class AddedLater(tornado.web.RequestHandler):
-    def get(self, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+    def get(self, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y
         self.write("AddedLater {} {}".format(x, y))
 
 
@@ -59,26 +59,26 @@ def make_app():
     # see https://www.tornadoweb.org/en/stable/routing.html for even more examples
     app = tornado.web.Application(
         [
-            (r"/foo/([0-9]+)/([0-9]+)?", FooHandler),  # $ MISSING: routeSetup="/foo/([0-9]+)/([0-9]+)?"
+            (r"/foo/([0-9]+)/([0-9]+)?", FooHandler),  # $ routeSetup="/foo/([0-9]+)/([0-9]+)?"
             tornado.web.URLSpec(r"/bar/([0-9]+)/([0-9]+)?", BarHandler),  # $ MISSING: routeSetup="/bar/([0-9]+)/([0-9]+)?"
             # Very verbose way to write same as FooHandler
             tornado.routing.Rule(tornado.routing.PathMatches(r"/baz/([0-9]+)/([0-9]+)?"), BazHandler),  # $ MISSING: routeSetup="/baz/([0-9]+)/([0-9]+)?"
-            (r"/kw-args/(?P<x>[0-9]+)/(?P<y>[0-9]+)?", KwArgs),  # $ MISSING: routeSetup="/kw-args/(?P<x>[0-9]+)/(?P<y>[0-9]+)?"
+            (r"/kw-args/(?P<x>[0-9]+)/(?P<y>[0-9]+)?", KwArgs),  # $ routeSetup="/kw-args/(?P<x>[0-9]+)/(?P<y>[0-9]+)?"
             # You can do nesting
             (r"/(one|two|three)", [
-                (r"/one", One),  # $ MISSING: routeSetup="/one"
-                (r"/two", Two),  # $ MISSING: routeSetup="/two"
-                (r"/three", Three)  # $ MISSING: routeSetup="/three"
+                (r"/one", One),  # $ routeSetup="/one"
+                (r"/two", Two),  # $ routeSetup="/two"
+                (r"/three", Three)  # $ routeSetup="/three"
             ]),
             # which is _one_ recommended way to ensure known host is used
             (tornado.routing.HostMatches(r"(localhost|127\.0\.0\.1)"), [
-                ("/only-localhost", OnlyLocalhost)  # $ MISSING: routeSetup="/only-localhost"
+                ("/only-localhost", OnlyLocalhost)  # $ routeSetup="/only-localhost"
             ]),
 
         ],
         debug=True,
     )
-    app.add_handlers(r".*", [(r"/added-later/([0-9]+)/([0-9]+)?", AddedLater)])  # $ MISSING: routeSetup="/added-later/([0-9]+)/([0-9]+)?"
+    app.add_handlers(r".*", [(r"/added-later/([0-9]+)/([0-9]+)?", AddedLater)])  # $ routeSetup="/added-later/([0-9]+)/([0-9]+)?"
     return app
 
 
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py b/python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py
index 891547b3375..cb41cfe1d7f 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/taint_test.py
@@ -2,7 +2,7 @@ import tornado.web
 
 
 class TaintTest(tornado.web.RequestHandler):
-    def get(self, name = "World!", number="0", foo="foo"):  # $ MISSING: requestHandler routedParameter=name routedParameter=number
+    def get(self, name = "World!", number="0", foo="foo"):  # $ requestHandler routedParameter=name routedParameter=number
         ensure_tainted(name, number)
         ensure_not_tainted(foo)
 
@@ -72,7 +72,7 @@ class TaintTest(tornado.web.RequestHandler):
 def make_app():
     return tornado.web.Application(
         [
-            (r"/test_taint/([^/]+)/([0-9]+)", TaintTest),  # $ MISSING: routeSetup="/test_taint/([^/]+)/([0-9]+)"
+            (r"/test_taint/([^/]+)/([0-9]+)", TaintTest),  # $ routeSetup="/test_taint/([^/]+)/([0-9]+)"
         ],
         debug=True,
     )

From 812ea5dde587c69b23fdf5a5df0cd446daeaeac5 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 22 Dec 2020 16:29:08 +0100
Subject: [PATCH 110/343] Python: Tornado: Model request handlers without known
 route

---
 .../src/semmle/python/frameworks/Tornado.qll  | 30 +++++++++++++++++--
 .../library-tests/frameworks/tornado/basic.py |  2 +-
 .../frameworks/tornado/routing_test.py        |  6 ++--
 3 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index 59c6ebfeb25..292ea802114 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -142,6 +142,14 @@ private module Tornado {
         class RequestHandlerClass extends Class {
           RequestHandlerClass() { this.getParent() = subclassRef().asExpr() }
 
+          /** Gets a function that could handle incoming requests, if any. */
+          Function getARequestHandler() {
+            // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
+            // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
+            result = this.getAMethod() and
+            result.getName() = HTTP::httpVerbLower()
+          }
+
           /** Gets a reference to this class. */
           private DataFlow::Node getARef(DataFlow::TypeTracker t) {
             t.start() and
@@ -489,9 +497,7 @@ private module Tornado {
     override Function getARequestHandler() {
       exists(tornado::web::RequestHandler::RequestHandlerClass cls |
         cls.getARef().asCfgNode() = node.getElement(1) and
-        // TODO: Proper MRO
-        result = cls.getAMethod() and
-        result.getName() = HTTP::httpVerbLower()
+        result = cls.getARequestHandler()
       )
     }
 
@@ -516,4 +522,22 @@ private module Tornado {
       )
     }
   }
+
+  /** A request handler defined in a tornado RequestHandler class, that has no known route. */
+  private class TornadoRequestHandlerWithoutKnownRoute extends HTTP::Server::RequestHandler::Range {
+    TornadoRequestHandlerWithoutKnownRoute() {
+      exists(tornado::web::RequestHandler::RequestHandlerClass cls |
+        cls.getARequestHandler() = this
+      ) and
+      not exists(TornadoRouteSetup setup | setup.getARequestHandler() = this)
+    }
+
+    override Parameter getARoutedParameter() {
+      // Since we don't know the URL pattern, we simply mark all parameters as a routed
+      // parameter. This should give us more RemoteFlowSources but could also lead to
+      // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
+      result in [this.getArg(_), this.getArgByName(_)] and
+      not result = this.getArg(0)
+    }
+  }
 }
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
index d90ce074319..6733de040b1 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
@@ -29,7 +29,7 @@ class RedirectHandler(tornado.web.RequestHandler):
 
 
 class BaseReverseInheritance(tornado.web.RequestHandler):
-    def get(self):  # $ MISSING: requestHandler
+    def get(self):  # $ requestHandler
         self.write("hello from BaseReverseInheritance")
 
 
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
index 1e3efa7c611..c9fbc0c91e0 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
@@ -8,12 +8,12 @@ class FooHandler(tornado.web.RequestHandler):
 
 
 class BarHandler(tornado.web.RequestHandler):
-    def get(self, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+    def get(self, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y SPURIOUS: routedParameter=not_used
         self.write("BarHandler {} {}".format(x, y))
 
 
 class BazHandler(tornado.web.RequestHandler):
-    def get(self, x, y=None, not_used=None):  # $ MISSING: requestHandler routedParameter=x routedParameter=y
+    def get(self, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y SPURIOUS: routedParameter=not_used
         self.write("BazHandler {} {}".format(x, y))
 
 
@@ -51,7 +51,7 @@ class PossiblyNotRouted(tornado.web.RequestHandler):
     # Even if our analysis can't find a route-setup for this class, we should still
     # consider it to be a handle incoming HTTP requests
 
-    def get(self):  # $ MISSING: requestHandler
+    def get(self):  # $ requestHandler
         self.write("NotRouted")
 
 

From f9a29cb8862fe29b26bc2f6d6bcc5bcb8e27619f Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 22 Dec 2020 16:34:31 +0100
Subject: [PATCH 111/343] Python: Add change-note for tornado source modeling

---
 python/change-notes/2020-12-22-tornado-source-modeling.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 python/change-notes/2020-12-22-tornado-source-modeling.md

diff --git a/python/change-notes/2020-12-22-tornado-source-modeling.md b/python/change-notes/2020-12-22-tornado-source-modeling.md
new file mode 100644
index 00000000000..bd1e001c50e
--- /dev/null
+++ b/python/change-notes/2020-12-22-tornado-source-modeling.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added modeling of sources of remote user input (`RemoteFlowSource`) when using `tornado` to create HTTP servers, to the new data-flow queries.

From 86e33d9d79cb1560f36a373918fe0099081e98a9 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 14 Jan 2021 13:37:42 +0100
Subject: [PATCH 112/343] select the shortest possible reason

---
 .../performance/SuperlinearBackTracking.qll   |   2 +-
 .../ReDoS/PolynomialBackTracking.expected     | 190 +++++++++---------
 2 files changed, 96 insertions(+), 96 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll b/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
index 2908960ca5d..f604c3871c5 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
@@ -407,7 +407,7 @@ class PolynomialBackTrackingTerm extends InfiniteRepetitionQuantifier {
   PolynomialBackTrackingTerm() {
     reason = getReasonString(this, pump, prefixMsg, prev) and
     // there might be many reasons for this term to have polynomial backtracking - we pick an arbitary one.
-    reason = min(string msg | msg = getReasonString(this, _, _, _))
+    reason = min(string msg | msg = getReasonString(this, _, _, _) | msg order by msg.length(), msg)
   }
 
   /**
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
index e44d8596e67..ed016fed419 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
@@ -3,16 +3,16 @@
 | highlight.js:6:12:6:695 | (Add\|Clear\|Close\|Copy\|Enter\|Exit\|Find\|Format\|Get\|Hide\|Join\|Lock\|Move\|New\|Open\|Optimize\|Pop\|Push\|Redo\|Remove\|Rename\|Reset\|Resize\|Search\|Select\|Set\|Show\|Skip\|Split\|Step\|Switch\|Undo\|Unlock\|Watch\|Backup\|Checkpoint\|Compare\|Compress\|Convert\|ConvertFrom\|ConvertTo\|Dismount\|Edit\|Expand\|Export\|Group\|Import\|Initialize\|Limit\|Merge\|New\|Out\|Publish\|Restore\|Save\|Sync\|Unpublish\|Update\|Approve\|Assert\|Complete\|Confirm\|Deny\|Disable\|Enable\|Install\|Invoke\|Register\|Request\|Restart\|Resume\|Start\|Stop\|Submit\|Suspend\|Uninstall\|Unregister\|Wait\|Debug\|Measure\|Ping\|Repair\|Resolve\|Test\|Trace\|Connect\|Disconnect\|Read\|Receive\|Send\|Write\|Block\|Grant\|Protect\|Revoke\|Unblock\|Unprotect\|Use\|ForEach\|Sort\|Tee\|Where)+ | Strings with many repetitions of 'Add' can start matching anywhere after the start of the preceeding (Add\|Clear\|Close\|Copy\|Enter\|Exit\|Find\|Format\|Get\|Hide\|Join\|Lock\|Move\|New\|Open\|Optimize\|Pop\|Push\|Redo\|Remove\|Rename\|Reset\|Resize\|Search\|Select\|Set\|Show\|Skip\|Split\|Step\|Switch\|Undo\|Unlock\|Watch\|Backup\|Checkpoint\|Compare\|Compress\|Convert\|ConvertFrom\|ConvertTo\|Dismount\|Edit\|Expand\|Export\|Group\|Import\|Initialize\|Limit\|Merge\|New\|Out\|Publish\|Restore\|Save\|Sync\|Unpublish\|Update\|Approve\|Assert\|Complete\|Confirm\|Deny\|Disable\|Enable\|Install\|Invoke\|Register\|Request\|Restart\|Resume\|Start\|Stop\|Submit\|Suspend\|Uninstall\|Unregister\|Wait\|Debug\|Measure\|Ping\|Repair\|Resolve\|Test\|Trace\|Connect\|Disconnect\|Read\|Receive\|Send\|Write\|Block\|Grant\|Protect\|Revoke\|Unblock\|Unprotect\|Use\|ForEach\|Sort\|Tee\|Where)+(-)[\\w\\d]+ |
 | highlight.js:7:13:7:692 | (Add\|Clear\|Close\|Copy\|Enter\|Exit\|Find\|Format\|Get\|Hide\|Join\|Lock\|Move\|New\|Open\|Optimize\|Pop\|Push\|Redo\|Remove\|Rename\|Reset\|Resize\|Search\|Select\|Set\|Show\|Skip\|Split\|Step\|Switch\|Undo\|Unlock\|Watch\|Backup\|Checkpoint\|Compare\|Compress\|Convert\|ConvertFrom\|ConvertTo\|Dismount\|Edit\|Expand\|Export\|Group\|Import\|Initialize\|Limit\|Merge\|Out\|Publish\|Restore\|Save\|Sync\|Unpublish\|Update\|Approve\|Assert\|Complete\|Confirm\|Deny\|Disable\|Enable\|Install\|Invoke\|Register\|Request\|Restart\|Resume\|Start\|Stop\|Submit\|Suspend\|Uninstall\|Unregister\|Wait\|Debug\|Measure\|Ping\|Repair\|Resolve\|Test\|Trace\|Connect\|Disconnect\|Read\|Receive\|Send\|Write\|Block\|Grant\|Protect\|Revoke\|Unblock\|Unprotect\|Use\|ForEach\|Sort\|Tee\|Where)+ | Strings with many repetitions of 'Add' can start matching anywhere after the start of the preceeding (Add\|Clear\|Close\|Copy\|Enter\|Exit\|Find\|Format\|Get\|Hide\|Join\|Lock\|Move\|New\|Open\|Optimize\|Pop\|Push\|Redo\|Remove\|Rename\|Reset\|Resize\|Search\|Select\|Set\|Show\|Skip\|Split\|Step\|Switch\|Undo\|Unlock\|Watch\|Backup\|Checkpoint\|Compare\|Compress\|Convert\|ConvertFrom\|ConvertTo\|Dismount\|Edit\|Expand\|Export\|Group\|Import\|Initialize\|Limit\|Merge\|Out\|Publish\|Restore\|Save\|Sync\|Unpublish\|Update\|Approve\|Assert\|Complete\|Confirm\|Deny\|Disable\|Enable\|Install\|Invoke\|Register\|Request\|Restart\|Resume\|Start\|Stop\|Submit\|Suspend\|Uninstall\|Unregister\|Wait\|Debug\|Measure\|Ping\|Repair\|Resolve\|Test\|Trace\|Connect\|Disconnect\|Read\|Receive\|Send\|Write\|Block\|Grant\|Protect\|Revoke\|Unblock\|Unprotect\|Use\|ForEach\|Sort\|Tee\|Where)+(-)[\\w\\d]+ |
 | highlight.js:14:17:14:52 | [a-z0-9&#*=?@\\\\><:,()$[\\]_.{}!+%^-]+ | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding ([ ]*[a-z0-9&#*=?@\\\\><:,()$[\\]_.{}!+%^-]+)+ |
-| highlight.js:18:14:18:16 | .*? | Strings starting with ''' and with many repetitions of ''' can start matching anywhere after the start of the preceeding ('.*?'\|".*?"\|\\[.*?\\]\|[^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+\|\\.\|\\/)+ |
-| highlight.js:18:20:18:22 | .*? | Strings starting with '"' and with many repetitions of '"' can start matching anywhere after the start of the preceeding ('.*?'\|".*?"\|\\[.*?\\]\|[^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+\|\\.\|\\/)+ |
-| highlight.js:18:27:18:29 | .*? | Strings starting with '[' and with many repetitions of '[' can start matching anywhere after the start of the preceeding ('.*?'\|".*?"\|\\[.*?\\]\|[^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+\|\\.\|\\/)+ |
-| highlight.js:18:33:18:69 | [^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+ | Strings with many repetitions of '$' can start matching anywhere after the start of the preceeding ('.*?'\|".*?"\|\\[.*?\\]\|[^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+\|\\.\|\\/)+ |
+| highlight.js:18:14:18:16 | .*? | Strings starting with ''' and with many repetitions of ''' can start matching anywhere after the start of the preceeding .*? |
+| highlight.js:18:20:18:22 | .*? | Strings starting with '"' and with many repetitions of '"' can start matching anywhere after the start of the preceeding .*? |
+| highlight.js:18:27:18:29 | .*? | Strings starting with '[' and with many repetitions of '[' can start matching anywhere after the start of the preceeding .*? |
+| highlight.js:18:33:18:69 | [^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+ | Strings with many repetitions of '$' can start matching anywhere after the start of the preceeding .*? |
 | highlight.js:19:56:19:61 | [^\\]]+ | Strings starting with '[' and with many repetitions of '[' can start matching anywhere after the start of the preceeding (\\.\|\\.\\/\|\\/)?(""\|"[^"]+"\|''\|'[^']+'\|\\[\\]\|\\[[^\\]]+\\]\|[^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+)((\\.\|\\/)(""\|"[^"]+"\|''\|'[^']+'\|\\[\\]\|\\[[^\\]]+\\]\|[^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+))* |
 | highlight.js:19:141:19:146 | [^\\]]+ | Strings starting with '"".[' and with many repetitions of '$.[' can start matching anywhere after the start of the preceeding (\\.\|\\.\\/\|\\/)?(""\|"[^"]+"\|''\|'[^']+'\|\\[\\]\|\\[[^\\]]+\\]\|[^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+)((\\.\|\\/)(""\|"[^"]+"\|''\|'[^']+'\|\\[\\]\|\\[[^\\]]+\\]\|[^\\s!"#%&'()*+,.\\/;<=>@\\[\\\\\\]^`{\|}~]+))* |
-| highlight.js:22:12:22:82 | ((decltype\\(auto\\)\|(?:[a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(?:<.*?>)?)[\\*&\\s]+)+ | Strings with many repetitions of 'A\\t' can start matching anywhere after the start of the preceeding ((decltype\\(auto\\)\|(?:[a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(?:<.*?>)?)[\\*&\\s]+)+(?:[a-zA-Z_]\\w*::)?[a-zA-Z]\\w*\\s*\\( |
-| highlight.js:22:43:22:45 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding ((decltype\\(auto\\)\|(?:[a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(?:<.*?>)?)[\\*&\\s]+)+(?:[a-zA-Z_]\\w*::)?[a-zA-Z]\\w*\\s*\\( |
-| highlight.js:22:66:22:68 | .*? | Strings starting with 'A<' and with many repetitions of 'A<' can start matching anywhere after the start of the preceeding ((decltype\\(auto\\)\|(?:[a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(?:<.*?>)?)[\\*&\\s]+)+ |
-| highlight.js:22:73:22:80 | [\\*&\\s]+ | Strings starting with 'A' and with many repetitions of '\\tA\\t' can start matching anywhere after the start of the preceeding ((decltype\\(auto\\)\|(?:[a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(?:<.*?>)?)[\\*&\\s]+)+(?:[a-zA-Z_]\\w*::)?[a-zA-Z]\\w*\\s*\\( |
+| highlight.js:22:12:22:82 | ((decltype\\(auto\\)\|(?:[a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(?:<.*?>)?)[\\*&\\s]+)+ | Strings with many repetitions of 'A\\t' can start matching anywhere after the start of the preceeding .*? |
+| highlight.js:22:43:22:45 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding .*? |
+| highlight.js:22:66:22:68 | .*? | Strings starting with 'A<' and with many repetitions of 'A<' can start matching anywhere after the start of the preceeding \\w* |
+| highlight.js:22:73:22:80 | [\\*&\\s]+ | Strings starting with 'A' and with many repetitions of '\\tA\\t' can start matching anywhere after the start of the preceeding .*? |
 | highlight.js:23:13:23:82 | ((decltype\\(auto\\)\|([a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(<[^<>]+>)?)[\\*&\\s]+)+ | Strings with many repetitions of 'A\\t' can start matching anywhere after the start of the preceeding ((decltype\\(auto\\)\|([a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(<[^<>]+>)?)[\\*&\\s]+)+([a-zA-Z_]\\w*::)?[a-zA-Z]\\w*\\s*\\( |
 | highlight.js:23:42:23:44 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding ((decltype\\(auto\\)\|([a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(<[^<>]+>)?)[\\*&\\s]+)+([a-zA-Z_]\\w*::)?[a-zA-Z]\\w*\\s*\\( |
 | highlight.js:23:63:23:68 | [^<>]+ | Strings starting with 'A<' and with many repetitions of ';>\\tA<' can start matching anywhere after the start of the preceeding ((decltype\\(auto\\)\|([a-zA-Z_]\\w*::)?[a-zA-Z_]\\w*(<[^<>]+>)?)[\\*&\\s]+)+([a-zA-Z_]\\w*::)?[a-zA-Z]\\w*\\s*\\( |
@@ -30,17 +30,17 @@
 | polynomial-redos.js:9:19:9:21 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s*\\n\\s* |
 | polynomial-redos.js:11:19:11:20 | .* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding .*[/\\\\] |
 | polynomial-redos.js:12:19:12:20 | .* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding .*\\. |
-| polynomial-redos.js:15:28:15:35 | [\\s\\S]*? | Strings starting with '`' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s* |
-| polynomial-redos.js:15:41:15:43 | \\s* | Strings starting with '`_' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding [\\s\\S]*? |
+| polynomial-redos.js:15:28:15:35 | [\\s\\S]*? | Strings starting with '`' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding `+ |
+| polynomial-redos.js:15:41:15:43 | \\s* | Strings starting with '`_' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s* |
 | polynomial-redos.js:16:25:16:32 | [\\s\\S]*? | Strings starting with '`' and with many repetitions of '``' can start matching anywhere after the start of the preceeding `+ |
 | polynomial-redos.js:17:5:17:6 | .* | Strings with many repetitions of ',' can start matching anywhere after the start of the preceeding (.*,)+ |
-| polynomial-redos.js:17:11:17:12 | .+ | Strings starting with ',' and with many repetitions of ',,' can start matching anywhere after the start of the preceeding (.*,)+ |
+| polynomial-redos.js:17:11:17:12 | .+ | Strings starting with ',' and with many repetitions of ',,' can start matching anywhere after the start of the preceeding .* |
 | polynomial-redos.js:18:83:18:100 | [\\u0600-\\u06FF\\/]+ | Strings with many repetitions of '/' can start matching anywhere after the start of the preceeding [\\u0600-\\u06FF\\/]+(\\s*?[\\u0600-\\u06FF]+){1,2} |
 | polynomial-redos.js:19:17:19:22 | [0-9]* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [0-9]*['a-z\\u00A0-\\u05FF\\u0700-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFEF]{1,256} |
 | polynomial-redos.js:20:56:20:58 | \\d+ | Strings with many repetitions of '9' can start matching anywhere after the start of the preceeding \\d* |
 | polynomial-redos.js:22:57:22:59 | \\d+ | Strings with many repetitions of '9' can start matching anywhere after the start of the preceeding \\d* |
 | polynomial-redos.js:25:37:25:56 | [a-zA-Z0-9+\\/ \\t\\n]+ | Strings starting with '-\\t' and with many repetitions of '\\t\\t' can start matching anywhere after the start of the preceeding [ \\t]+ |
-| polynomial-redos.js:25:63:25:64 | .* | Strings starting with '-\\t\\t' and with many repetitions of '=' can start matching anywhere after the start of the preceeding [ \\t]+ |
+| polynomial-redos.js:25:63:25:64 | .* | Strings starting with '-\\t\\t' and with many repetitions of '=' can start matching anywhere after the start of the preceeding [=]* |
 | polynomial-redos.js:30:19:30:22 | [?]+ | Strings with many repetitions of '?' can start matching anywhere after the start of the preceeding [?]+.*$ |
 | polynomial-redos.js:30:23:30:24 | .* | Strings starting with '?' and with many repetitions of '?' can start matching anywhere after the start of the preceeding [?]+ |
 | polynomial-redos.js:31:42:31:43 | -+ | Strings with many repetitions of '-' can start matching anywhere after the start of the preceeding -+$ |
@@ -76,7 +76,7 @@
 | polynomial-redos.js:68:8:68:9 | .* | Strings starting with 'X' and with many repetitions of 'X' can start matching anywhere after the start of the preceeding [^Y].*$ |
 | polynomial-redos.js:69:8:69:9 | .* | Strings starting with 'X' and with many repetitions of 'X' can start matching anywhere after the start of the preceeding [^Y].*$ |
 | polynomial-redos.js:71:51:71:63 | [?\\x21-\\x7E]* | Strings starting with ',-+' and with many repetitions of '++' can start matching anywhere after the start of the preceeding [A-Za-z0-9+/]+ |
-| polynomial-redos.js:73:50:73:51 | .* | Strings starting with 'MSIE 9.9' and with many repetitions of '9' can start matching anywhere after the start of the preceeding (MSIE) (\\d+)\\.(\\d+).*XBLWP7 |
+| polynomial-redos.js:73:50:73:51 | .* | Strings starting with 'MSIE 9.9' and with many repetitions of '9' can start matching anywhere after the start of the preceeding \\d+ |
 | polynomial-redos.js:75:18:75:19 | .* | Strings starting with '<' and with many repetitions of '<' can start matching anywhere after the start of the preceeding <.*class="([^"]+)".*> |
 | polynomial-redos.js:75:35:75:36 | .* | Strings starting with '<class="!"' and with many repetitions of 'class="!"' can start matching anywhere after the start of the preceeding .* |
 | polynomial-redos.js:77:18:77:19 | .* | Strings starting with 'Y' and with many repetitions of 'Y' can start matching anywhere after the start of the preceeding Y.*X |
@@ -132,7 +132,7 @@
 | regexplib/address.js:75:796:75:798 | \\s+ | Strings starting with '9 a ' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s+ |
 | regexplib/address.js:75:803:75:811 | [A-Za-z]+ | Strings starting with '9 a  ' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding \\w+ |
 | regexplib/address.js:85:15:85:49 | ([0-9]\|[ ]\|[-]\|[\\(]\|[\\)]\|ext.\|[,])+ | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (?<Telephone>([0-9]\|[ ]\|[-]\|[\\(]\|[\\)]\|ext.\|[,])+)([ ]\|[:]\|\\t\|[-])*(?<Where>Home\|Office\|Work\|Away\|Fax\|FAX\|Phone) |
-| regexplib/address.js:85:51:85:67 | ([ ]\|[:]\|\\t\|[-])* | Strings starting with '0' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding (?<Telephone>([0-9]\|[ ]\|[-]\|[\\(]\|[\\)]\|ext.\|[,])+)([ ]\|[:]\|\\t\|[-])*(?<Where>Home\|Office\|Work\|Away\|Fax\|FAX\|Phone) |
+| regexplib/address.js:85:51:85:67 | ([ ]\|[:]\|\\t\|[-])* | Strings starting with '0' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding ([0-9]\|[ ]\|[-]\|[\\(]\|[\\)]\|ext.\|[,])+ |
 | regexplib/address.js:93:3:93:5 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (\\s*\\(?0\\d{4}\\)?(\\s*\|-)\\d{3}(\\s*\|-)\\d{3}\\s*) |
 | regexplib/address.js:93:48:93:50 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (\\s*\\(?0\\d{3}\\)?(\\s*\|-)\\d{3}(\\s*\|-)\\d{4}\\s*) |
 | regexplib/address.js:93:93:93:95 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (\\s*(7\|8)(\\d{7}\|\\d{3}(\\-\|\\s{1})\\d{4})\\s*) |
@@ -141,7 +141,7 @@
 | regexplib/email.js:1:16:1:22 | [-.\\w]* | Strings starting with '0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([-.\\w]*[0-9a-zA-Z])* |
 | regexplib/email.js:2:5:2:12 | [-._\\w]* | Strings starting with 'a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding (\\w[-._\\w]*\\w@\\w[-._\\w]*\\w\\.\\w{2,3}) |
 | regexplib/email.js:5:24:5:35 | [a-zA-Z0-9]+ | Strings starting with '0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([_\\.\\-]?[a-zA-Z0-9]+)* |
-| regexplib/email.js:5:63:5:74 | [a-zA-Z0-9]+ | Strings starting with '0@0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([\\.\\-]?[a-zA-Z0-9]+)* |
+| regexplib/email.js:5:63:5:74 | [a-zA-Z0-9]+ | Strings starting with '0@0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [A-Za-z0-9]+ |
 | regexplib/email.js:8:16:8:49 | [^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+ | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding (?<user>(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\"(?:(?:[^\\"\\\\\\r\\n])\|(?:\\\\.))*\\"))(?:\\.(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\"(?:(?:[^\\"\\\\\\r\\n])\|(?:\\\\.))*\\")))*)@(?<domain>(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\[(?:(?:[^\\[\\]\\\\\\r\\n])\|(?:\\\\.))*\\]))(?:\\.(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\[(?:(?:[^\\[\\]\\\\\\r\\n])\|(?:\\\\.))*\\])))*) |
 | regexplib/email.js:8:57:8:84 | (?:(?:[^\\"\\\\\\r\\n])\|(?:\\\\.))* | Strings starting with '"' and with many repetitions of '\\\\"' can start matching anywhere after the start of the preceeding (?<user>(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\"(?:(?:[^\\"\\\\\\r\\n])\|(?:\\\\.))*\\"))(?:\\.(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\"(?:(?:[^\\"\\\\\\r\\n])\|(?:\\\\.))*\\")))*)@(?<domain>(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\[(?:(?:[^\\[\\]\\\\\\r\\n])\|(?:\\\\.))*\\]))(?:\\.(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\[(?:(?:[^\\[\\]\\\\\\r\\n])\|(?:\\\\.))*\\])))*) |
 | regexplib/email.js:8:89:8:174 | (?:\\.(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\"(?:(?:[^\\"\\\\\\r\\n])\|(?:\\\\.))*\\")))* | Strings starting with '!' and with many repetitions of '.!' can start matching anywhere after the start of the preceeding (?<user>(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\"(?:(?:[^\\"\\\\\\r\\n])\|(?:\\\\.))*\\"))(?:\\.(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\"(?:(?:[^\\"\\\\\\r\\n])\|(?:\\\\.))*\\")))*)@(?<domain>(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\[(?:(?:[^\\[\\]\\\\\\r\\n])\|(?:\\\\.))*\\]))(?:\\.(?:(?:[^ \\t\\(\\)\\<\\>@,;\\:\\\\\\"\\.\\[\\]\\r\\n]+)\|(?:\\[(?:(?:[^\\[\\]\\\\\\r\\n])\|(?:\\\\.))*\\])))*) |
@@ -155,9 +155,9 @@
 | regexplib/email.js:15:28:15:30 | \\w* | Strings starting with 'a@a' and with many repetitions of 'aa' can start matching anywhere after the start of the preceeding \\w+ |
 | regexplib/email.js:20:3:20:6 | \\w+? | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (\\w+?@\\w+?\\x2E.+) |
 | regexplib/email.js:25:67:25:78 | [a-zA-Z0-9]+ | Strings starting with '0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([_\\.\\-]?[a-zA-Z0-9]+)* |
-| regexplib/email.js:25:106:25:117 | [a-zA-Z0-9]+ | Strings starting with '0@0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([\\.\\-]?[a-zA-Z0-9]+)* |
+| regexplib/email.js:25:106:25:117 | [a-zA-Z0-9]+ | Strings starting with '0@0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [A-Za-z0-9]+ |
 | regexplib/email.js:25:212:25:223 | [a-zA-Z0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding ([_\\.\\-]?[a-zA-Z0-9]+)* |
-| regexplib/email.js:25:251:25:262 | [a-zA-Z0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding ([\\.\\-]?[a-zA-Z0-9]+)* |
+| regexplib/email.js:25:251:25:262 | [a-zA-Z0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [A-Za-z0-9]+ |
 | regexplib/email.js:28:2:28:4 | \\w+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding \\w+[\\w-\\.]*\\@\\w+((-\\w+)\|(\\w*))\\.[a-z]{2,3}$ |
 | regexplib/email.js:28:5:28:12 | [\\w-\\.]* | Strings starting with 'a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding \\w+ |
 | regexplib/email.js:28:27:28:29 | \\w* | Strings starting with 'a@a' and with many repetitions of 'aa' can start matching anywhere after the start of the preceeding \\w+ |
@@ -166,20 +166,20 @@
 | regexplib/email.js:29:2:29:7 | [\\w-]+ | Strings with many repetitions of '-' can start matching anywhere after the start of the preceeding [\\w-]+@([\\w-]+\\.)+[\\w-]+ |
 | regexplib/email.js:31:197:31:224 | [^\\x01-\\x1F\\\\""\\*\\?<>:\|\\\\/]* | Strings starting with '!' and with many repetitions of '!' can start matching anywhere after the start of the preceeding [^\\x01-\\x1F\\\\""\\*\\?\|><:\\\\/]* |
 | regexplib/email.js:33:16:33:22 | [-.\\w]* | Strings starting with '0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([-.\\w]*[0-9a-zA-Z])* |
-| regexplib/email.js:33:38:33:51 | ([0-9a-zA-Z])+ | Strings starting with '0@' and with many repetitions of '0.0' can start matching anywhere after the start of the preceeding ([-\\w]*[0-9a-zA-Z])* |
-| regexplib/email.js:33:53:33:58 | [-\\w]* | Strings starting with '0@0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([-\\w]*[0-9a-zA-Z])* |
+| regexplib/email.js:33:38:33:51 | ([0-9a-zA-Z])+ | Strings starting with '0@' and with many repetitions of '0.0' can start matching anywhere after the start of the preceeding [-\\w]* |
+| regexplib/email.js:33:53:33:58 | [-\\w]* | Strings starting with '0@0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([0-9a-zA-Z])+ |
 | regexplib/email.js:34:24:34:35 | [a-zA-Z0-9]+ | Strings starting with '0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([_\\.\\-]?[a-zA-Z0-9]+)* |
-| regexplib/email.js:34:63:34:74 | [a-zA-Z0-9]+ | Strings starting with '0@0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([\\.\\-]?[a-zA-Z0-9]+)* |
+| regexplib/email.js:34:63:34:74 | [a-zA-Z0-9]+ | Strings starting with '0@0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [A-Za-z0-9]+ |
 | regexplib/email.js:38:11:38:12 | .* | Strings starting with 'a@-' and with many repetitions of 'a@-' can start matching anywhere after the start of the preceeding .+ |
-| regexplib/markup.js:1:11:1:12 | .* | Strings starting with '<' and with many repetitions of '=' can start matching anywhere after the start of the preceeding <[^>]*\\n?.*=("\|')?(.*\\.jpg)("\|')?.*\\n?[^<]*> |
+| regexplib/markup.js:1:11:1:12 | .* | Strings starting with '<' and with many repetitions of '=' can start matching anywhere after the start of the preceeding [^>]* |
 | regexplib/markup.js:1:21:1:22 | .* | Strings starting with '<=' and with many repetitions of '==' can start matching anywhere after the start of the preceeding .* |
 | regexplib/markup.js:1:40:1:44 | [^<]* | Strings starting with '<=.jpg' and with many repetitions of ';' can start matching anywhere after the start of the preceeding .* |
 | regexplib/markup.js:2:3:2:7 | [^>]* | Strings starting with '<' and with many repetitions of '<' can start matching anywhere after the start of the preceeding <[^>]*> |
-| regexplib/markup.js:3:440:3:456 | (\\s(?<attr>.+?))* | Strings starting with '<?i:q' and with many repetitions of ' a' can start matching anywhere after the start of the preceeding (<\\/?)(?i:(?<element>a(bbr\|cronym\|ddress\|pplet\|rea)?\|b(ase(font)?\|do\|ig\|lockquote\|ody\|r\|utton)?\|c(aption\|enter\|ite\|(o(de\|l(group)?)))\|d(d\|el\|fn\|i(r\|v)\|l\|t)\|em\|f(ieldset\|o(nt\|rm)\|rame(set)?)\|h([1-6]\|ead\|r\|tml)\|i(frame\|mg\|n(put\|s)\|sindex)?\|kbd\|l(abel\|egend\|i(nk)?)\|m(ap\|e(nu\|ta))\|no(frames\|script)\|o(bject\|l\|pt(group\|ion))\|p(aram\|re)?\|q\|s(amp\|cript\|elect\|mall\|pan\|t(r(ike\|ong)\|yle)\|u(b\|p))\|t(able\|body\|d\|extarea\|foot\|h\|itle\|r\|t)\|u(l)?\|var))(\\s(?<attr>.+?))*> |
-| regexplib/markup.js:3:451:3:453 | .+? | Strings starting with '<?i:q ' and with many repetitions of ' a' can start matching anywhere after the start of the preceeding (<\\/?)(?i:(?<element>a(bbr\|cronym\|ddress\|pplet\|rea)?\|b(ase(font)?\|do\|ig\|lockquote\|ody\|r\|utton)?\|c(aption\|enter\|ite\|(o(de\|l(group)?)))\|d(d\|el\|fn\|i(r\|v)\|l\|t)\|em\|f(ieldset\|o(nt\|rm)\|rame(set)?)\|h([1-6]\|ead\|r\|tml)\|i(frame\|mg\|n(put\|s)\|sindex)?\|kbd\|l(abel\|egend\|i(nk)?)\|m(ap\|e(nu\|ta))\|no(frames\|script)\|o(bject\|l\|pt(group\|ion))\|p(aram\|re)?\|q\|s(amp\|cript\|elect\|mall\|pan\|t(r(ike\|ong)\|yle)\|u(b\|p))\|t(able\|body\|d\|extarea\|foot\|h\|itle\|r\|t)\|u(l)?\|var))(\\s(?<attr>.+?))*> |
+| regexplib/markup.js:3:440:3:456 | (\\s(?<attr>.+?))* | Strings starting with '<?i:q' and with many repetitions of ' a' can start matching anywhere after the start of the preceeding .+? |
+| regexplib/markup.js:3:451:3:453 | .+? | Strings starting with '<?i:q ' and with many repetitions of ' a' can start matching anywhere after the start of the preceeding (\\s(?<attr>.+?))* |
 | regexplib/markup.js:5:1525:5:1527 | \\s* | Strings starting with '?'DateLiteral' ?# Per the VB Spec : DateLiteral ::= '#'   DateOrTime   '#'  # ?'DateOrTime'  DateValue    ?# TimeValue ::= HourValue : MinuteValue        10 ?# Hour 01 - 24  : 60 ?# Minute 01 - 60  :  ?# Optional Minute :01 - :60       ' and with many repetitions of '     ' can start matching anywhere after the start of the preceeding \\s* |
 | regexplib/markup.js:6:11:6:25 | [\\w\\*\\)\\(\\,\\s]+ | Strings starting with 'SELECT ' and with many repetitions of 'SELECT\\t' can start matching anywhere after the start of the preceeding (SELECT\\s[\\w\\*\\)\\(\\,\\s]+\\sFROM\\s[\\w]+) |
-| regexplib/markup.js:6:99:6:113 | [\\s\\w\\d\\)\\(\\,]* | Strings starting with ' INSERT INTO 0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding  (INSERT\\sINTO\\s[\\d\\w]+[\\s\\w\\d\\)\\(\\,]*\\sVALUES\\s\\([\\d\\w\\'\\,\\)]+) |
+| regexplib/markup.js:6:99:6:113 | [\\s\\w\\d\\)\\(\\,]* | Strings starting with ' INSERT INTO 0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [\\d\\w]+ |
 | regexplib/markup.js:7:15:7:21 | [^\\\\"]* | Strings starting with '"!' and with many repetitions of '\\\\"!!' can start matching anywhere after the start of the preceeding "([^"](?:\\\\.\|[^\\\\"]*)*)" |
 | regexplib/markup.js:9:6:9:13 | [\\s\\S]*? | Strings starting with '<!--' and with many repetitions of '<!--' can start matching anywhere after the start of the preceeding <!--[\\s\\S]*?--[ \\t\\n\\r]*> |
 | regexplib/markup.js:11:6:11:8 | .*? | Strings starting with '<!--' and with many repetitions of '<!--' can start matching anywhere after the start of the preceeding <!--.*?--> |
@@ -187,15 +187,15 @@
 | regexplib/markup.js:12:117:12:121 | [^>]* | Strings starting with '<span' and with many repetitions of '<span' can start matching anywhere after the start of the preceeding (<span[^>]*>) |
 | regexplib/markup.js:12:149:12:153 | [^>]* | Strings starting with 'font-family:' and with many repetitions of 'font-family:' can start matching anywhere after the start of the preceeding (font-family:[^>]*[;']) |
 | regexplib/markup.js:12:171:12:175 | [^>]* | Strings starting with 'font-size:' and with many repetitions of 'font-size:' can start matching anywhere after the start of the preceeding (font-size:[^>]*[;'])(?-s) |
-| regexplib/markup.js:13:6:13:12 | [^"']+? | Strings starting with '<' and with many repetitions of '!' can start matching anywhere after the start of the preceeding (?:[^"']+?\|.+?(?:"\|').*?(?:"\|')?.*?)*? |
-| regexplib/markup.js:13:14:13:16 | .+? | Strings starting with '<' and with many repetitions of '!' can start matching anywhere after the start of the preceeding (?:[^"']+?\|.+?(?:"\|').*?(?:"\|')?.*?)*? |
+| regexplib/markup.js:13:6:13:12 | [^"']+? | Strings starting with '<' and with many repetitions of '!' can start matching anywhere after the start of the preceeding .*? |
+| regexplib/markup.js:13:14:13:16 | .+? | Strings starting with '<' and with many repetitions of '!' can start matching anywhere after the start of the preceeding .*? |
 | regexplib/markup.js:14:13:14:14 | .* | Strings starting with '<' and with many repetitions of 'a' can start matching anywhere after the start of the preceeding .* |
 | regexplib/markup.js:14:24:14:25 | .* | Strings starting with '<>' and with many repetitions of '>a' can start matching anywhere after the start of the preceeding .* |
 | regexplib/markup.js:16:5:16:9 | [^>]* | Strings starting with 'src' and with many repetitions of 'src' can start matching anywhere after the start of the preceeding src[^>]*[^/].(?:jpg\|bmp\|gif)(?:\\"\|\\') |
 | regexplib/markup.js:17:8:17:24 | (\\s(\\w*=".*?")?)* | Strings starting with '<a' and with many repetitions of ' =""' can start matching anywhere after the start of the preceeding .*? |
 | regexplib/markup.js:17:12:17:14 | \\w* | Strings starting with '<a ' and with many repetitions of '="" a' can start matching anywhere after the start of the preceeding .*? |
-| regexplib/markup.js:17:17:17:19 | .*? | Strings starting with '<a ="' and with many repetitions of ' =""' can start matching anywhere after the start of the preceeding (\\s(\\w*=".*?")?)* |
-| regexplib/markup.js:17:40:17:42 | .*? | Strings starting with '<a>' and with many repetitions of '">' can start matching anywhere after the start of the preceeding (\\s(\\w*=".*?")?)* |
+| regexplib/markup.js:17:17:17:19 | .*? | Strings starting with '<a ="' and with many repetitions of ' =""' can start matching anywhere after the start of the preceeding \\w* |
+| regexplib/markup.js:17:40:17:42 | .*? | Strings starting with '<a>' and with many repetitions of '">' can start matching anywhere after the start of the preceeding .*? |
 | regexplib/markup.js:19:2:19:12 | (<meta\\s+)* | Strings with many repetitions of '<meta ' can start matching anywhere after the start of the preceeding (<meta\\s+)*((name\\s*=\\s*("\|')(?<name>[^'("\|')]*)("\|')){1}\|content\\s*=\\s*("\|')(?<content>[^'("\|')]*)("\|')\|scheme\\s*=\\s*("\|')(?<scheme>[^'("\|')]*)("\|')) |
 | regexplib/markup.js:19:8:19:10 | \\s+ | Strings starting with '<meta' and with many repetitions of ' <meta' can start matching anywhere after the start of the preceeding (<meta\\s+)*((name\\s*=\\s*("\|')(?<name>[^'("\|')]*)("\|')){1}\|content\\s*=\\s*("\|')(?<content>[^'("\|')]*)("\|')\|scheme\\s*=\\s*("\|')(?<scheme>[^'("\|')]*)("\|')) |
 | regexplib/markup.js:20:52:20:53 | .* | Strings with many repetitions of '=color' can start matching anywhere after the start of the preceeding [^>]+ |
@@ -204,22 +204,22 @@
 | regexplib/markup.js:20:245:20:247 | .*? | Strings with many repetitions of 'color: # IF found THEN move ahead "" # single or double  # or no quotes\\t' can start matching anywhere after the start of the preceeding .*? |
 | regexplib/markup.js:20:274:20:276 | .*? | Strings starting with '<font # Match start of Font Tag ' and with many repetitions of '<font # Match start of Font Tag a' can start matching anywhere after the start of the preceeding <\\*?font # Match start of Font Tag (?(?=[^>]+color.*>) #IF\\/THEN lookahead color in tag (.*?color\\s*?[=\|:]\\s*?) # IF found THEN move ahead ('+\\#*?[\\w\\s]*'+ # CAPTURE ColorName\\/Hex \|"+\\#*?[\\w\\s]*"+ # single or double \|\\#*\\w*\\b) # or no quotes\t.*?> # & move to end of tag \|.*?> # ELSE move to end of Tag ) # Close the If\\/Then lookahead # Use Multiline and IgnoreCase # Replace the matches from RE with MatchEvaluator below: # if m.Groups(1).Value<>"" then # Return "<font color=" & m.Groups(1).Value & ">" # else # Return "<font>" # end if |
 | regexplib/markup.js:25:11:25:15 | [^>]* | Strings starting with '<A' and with many repetitions of '<A' can start matching anywhere after the start of the preceeding <[a-zA-Z][^>]*\\son\\w+=(\\w+\|'[^']*'\|"[^"]*")[^>]*> |
-| regexplib/markup.js:25:45:25:49 | [^>]* | Strings starting with '<A ona=a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [^>]* |
+| regexplib/markup.js:25:45:25:49 | [^>]* | Strings starting with '<A ona=a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding \\w+ |
 | regexplib/markup.js:27:3:27:7 | [^>]* | Strings starting with '<' and with many repetitions of '<' can start matching anywhere after the start of the preceeding <[^>]*name[\\s]*=[\\s]*"?[^\\w_]*"?[^>]*> |
-| regexplib/markup.js:27:34:27:38 | [^>]* | Strings starting with '<name=' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding <[^>]*name[\\s]*=[\\s]*"?[^\\w_]*"?[^>]*> |
+| regexplib/markup.js:27:34:27:38 | [^>]* | Strings starting with '<name=' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding [\\s]* |
 | regexplib/markup.js:29:6:29:13 | [\\d\\D]*? | Strings starting with '/*' and with many repetitions of 'a/*' can start matching anywhere after the start of the preceeding \\/\\*[\\d\\D]*?\\*\\/ |
 | regexplib/markup.js:33:10:33:11 | .* | Strings starting with '?s/*' and with many repetitions of '?s/*' can start matching anywhere after the start of the preceeding (?s)\\/\\*.*\\*\\/ |
 | regexplib/markup.js:34:4:34:10 | [^\\s>]* | Strings starting with '<' and with many repetitions of '<!' can start matching anywhere after the start of the preceeding <([^\\s>]*)(\\s[^<]*)> |
-| regexplib/markup.js:37:15:37:19 | [\\w]* | Strings starting with '[a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* |
+| regexplib/markup.js:37:15:37:19 | [\\w]* | Strings starting with '[a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding \\w+ |
 | regexplib/markup.js:40:23:40:25 | \\w+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (\\/?(?<step>\\w+))+ |
 | regexplib/markup.js:40:59:40:61 | \\s* | Strings starting with 'a[' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s* |
 | regexplib/markup.js:43:11:43:15 | [^>]* | Strings starting with '<A' and with many repetitions of '<A' can start matching anywhere after the start of the preceeding <[a-zA-Z][^>]*\\son\\w+=(\\w+\|'[^']*'\|"[^"]*")[^>]*> |
-| regexplib/markup.js:43:45:43:49 | [^>]* | Strings starting with '<A ona=a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [^>]* |
+| regexplib/markup.js:43:45:43:49 | [^>]* | Strings starting with '<A ona=a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding \\w+ |
 | regexplib/markup.js:44:3:44:7 | [^>]* | Strings starting with '<' and with many repetitions of '<' can start matching anywhere after the start of the preceeding <[^>]*name[\\s]*=[\\s]*"?[^\\w_]*"?[^>]*> |
-| regexplib/markup.js:44:34:44:38 | [^>]* | Strings starting with '<name=' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding <[^>]*name[\\s]*=[\\s]*"?[^\\w_]*"?[^>]*> |
+| regexplib/markup.js:44:34:44:38 | [^>]* | Strings starting with '<name=' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding [\\s]* |
 | regexplib/markup.js:45:6:45:13 | [\\d\\D]*? | Strings starting with '/*' and with many repetitions of 'a/*' can start matching anywhere after the start of the preceeding \\/\\*[\\d\\D]*?\\*\\/ |
 | regexplib/markup.js:48:6:48:13 | [\\s\\S]*? | Strings starting with '<!--' and with many repetitions of '<!--' can start matching anywhere after the start of the preceeding <!--[\\s\\S]*?--> |
-| regexplib/markup.js:53:15:53:19 | [\\w]* | Strings starting with '[a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-zA-Z0-9\|:\|\\/\|=\|-\|.\|\\?\|&]* |
+| regexplib/markup.js:53:15:53:19 | [\\w]* | Strings starting with '[a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding \\w+ |
 | regexplib/markup.js:56:23:56:25 | \\w+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (\\/?(?<step>\\w+))+ |
 | regexplib/markup.js:56:59:56:61 | \\s* | Strings starting with 'a[' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s* |
 | regexplib/markup.js:61:74:61:79 | [0-9]+ | Strings starting with '<Assembly:AssemblyVersion("0a' and with many repetitions of '00' can start matching anywhere after the start of the preceeding [0-9]+ |
@@ -229,7 +229,7 @@
 | regexplib/markup.js:61:122:61:127 | [0-9]+ | Strings starting with '<Assembly:AssemblyVersion("0a0a' and with many repetitions of '00' can start matching anywhere after the start of the preceeding [0-9]+ |
 | regexplib/markup.js:61:129:61:134 | [0-9]+ | Strings starting with '<Assembly:AssemblyVersion("0a0a0a' and with many repetitions of '00' can start matching anywhere after the start of the preceeding [0-9]+ |
 | regexplib/markup.js:61:147:61:148 | .* | Strings starting with '<Assembly:AssemblyVersion("*")>' and with many repetitions of '<Assembly:AssemblyVersion("*")>' can start matching anywhere after the start of the preceeding [^']*? |
-| regexplib/markup.js:62:9:62:14 | [^>]*? | Strings starting with '<a\\t' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding <a[\\s]+[^>]*?href[\\s]?=[\\s\\"\\']+(.*?)[\\"\\']+.*?>([^<]+\|.*?)?<\\/a> |
+| regexplib/markup.js:62:9:62:14 | [^>]*? | Strings starting with '<a\\t' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding [\\s]+ |
 | regexplib/markup.js:62:39:62:45 | [\\"\\']+ | Strings starting with '<a\\thref=\\t' and with many repetitions of '"' can start matching anywhere after the start of the preceeding .*? |
 | regexplib/markup.js:62:46:62:48 | .*? | Strings starting with '<a\\thref=\\t"' and with many repetitions of '"' can start matching anywhere after the start of the preceeding .*? |
 | regexplib/markup.js:62:51:62:55 | [^<]+ | Strings starting with '<a\\thref=\\t">' and with many repetitions of '>;' can start matching anywhere after the start of the preceeding .*? |
@@ -239,16 +239,16 @@
 | regexplib/misc.js:76:2:76:27 | (AUX\|PRN\|NUL\|COM\\d\|LPT\\d)+ | Strings with many repetitions of 'AUX' can start matching anywhere after the start of the preceeding (AUX\|PRN\|NUL\|COM\\d\|LPT\\d)+\\s*$ |
 | regexplib/misc.js:81:31:81:45 | [^a-z\\:\\,\\(\\)]* | Strings starting with '#' and with many repetitions of '#' can start matching anywhere after the start of the preceeding ([A-Z&#228;&#246;&#252;0-9\\/][^a-z\\:\\,\\(\\)]*[A-Z&#228;&#246;&#252;0-9])($\|[\\.\\:\\,\\;\\)\\-\\ \\+]\|s\\b) |
 | regexplib/misc.js:83:18:83:23 | [0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding \\d* |
-| regexplib/misc.js:83:24:83:26 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [0-9]+ |
+| regexplib/misc.js:83:24:83:26 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding \\d* |
 | regexplib/misc.js:83:36:83:38 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [0-9]+ |
 | regexplib/misc.js:83:72:83:77 | [0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding \\d* |
-| regexplib/misc.js:83:78:83:80 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [0-9]+ |
+| regexplib/misc.js:83:78:83:80 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding \\d* |
 | regexplib/misc.js:83:90:83:92 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [0-9]+ |
 | regexplib/misc.js:90:4:90:11 | ([a-z])+ | Strings with many repetitions of 'aa' can start matching anywhere after the start of the preceeding (([a-z])+.)+ |
 | regexplib/misc.js:93:3:93:4 | .* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (.*\\.([wW][mM][aA])\|([mM][pP][3])$) |
 | regexplib/misc.js:95:25:95:26 | .+ | Strings starting with 'at ' and with many repetitions of 'at a' can start matching anywhere after the start of the preceeding (at\\s)(?<fullClassName>.+)(\\.)(?<methodName>[^\\.]*)(\\()(?<parameters>[^\\)]*)(\\))((\\sin\\s)(?<fileName>.+)(:line )(?<lineNumber>[\\d]*))? |
-| regexplib/misc.js:95:71:95:76 | [^\\)]* | Strings starting with 'at a.(' and with many repetitions of '((' can start matching anywhere after the start of the preceeding (at\\s)(?<fullClassName>.+)(\\.)(?<methodName>[^\\.]*)(\\()(?<parameters>[^\\)]*)(\\))((\\sin\\s)(?<fileName>.+)(:line )(?<lineNumber>[\\d]*))? |
-| regexplib/misc.js:95:103:95:104 | .+ | Strings starting with 'at a.() in ' and with many repetitions of '() in -' can start matching anywhere after the start of the preceeding (at\\s)(?<fullClassName>.+)(\\.)(?<methodName>[^\\.]*)(\\()(?<parameters>[^\\)]*)(\\))((\\sin\\s)(?<fileName>.+)(:line )(?<lineNumber>[\\d]*))? |
+| regexplib/misc.js:95:71:95:76 | [^\\)]* | Strings starting with 'at a.(' and with many repetitions of '((' can start matching anywhere after the start of the preceeding .+ |
+| regexplib/misc.js:95:103:95:104 | .+ | Strings starting with 'at a.() in ' and with many repetitions of '() in -' can start matching anywhere after the start of the preceeding .+ |
 | regexplib/misc.js:101:52:101:70 | [a-z0-9\\/\\.\\?\\=\\&]* | Strings starting with '".htm' and with many repetitions of '.asp' can start matching anywhere after the start of the preceeding [a-z0-9\\/\\.\\?\\=\\&]* |
 | regexplib/misc.js:112:3:112:5 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (\\s*\\(?0\\d{4}\\)?\\s*\\d{6}\\s*) |
 | regexplib/misc.js:112:32:112:34 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (\\s*\\(?0\\d{3}\\)?\\s*\\d{3}\\s*\\d{4}\\s*) |
@@ -262,15 +262,15 @@
 | regexplib/misc.js:144:52:144:70 | [a-z0-9\\/\\.\\?\\=\\&]* | Strings starting with '".htm' and with many repetitions of '.asp' can start matching anywhere after the start of the preceeding [a-z0-9\\/\\.\\?\\=\\&]* |
 | regexplib/misc.js:148:12:148:18 | [^\\s>]+ | Strings starting with '<' and with many repetitions of '<!' can start matching anywhere after the start of the preceeding \\w?<\\s?\\/?[^\\s>]+(\\s+[^"'=]+(=("[^"]*")\|('[^\\']*')\|([^\\s"'>]*))?)*\\s*\\/?> |
 | regexplib/misc.js:148:20:148:22 | \\s+ | Strings starting with '<!' and with many repetitions of '  ' can start matching anywhere after the start of the preceeding [^"'=]+ |
-| regexplib/misc.js:148:23:148:29 | [^"'=]+ | Strings starting with '<! ' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding [^\\s"'>]* |
+| regexplib/misc.js:148:23:148:29 | [^"'=]+ | Strings starting with '<! ' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s+ |
 | regexplib/misc.js:148:34:148:38 | [^"]* | Strings starting with '<! !="' and with many repetitions of '<" !="' can start matching anywhere after the start of the preceeding \\w?<\\s?\\/?[^\\s>]+(\\s+[^"'=]+(=("[^"]*")\|('[^\\']*')\|([^\\s"'>]*))?)*\\s*\\/?> |
 | regexplib/misc.js:148:44:148:49 | [^\\']* | Strings starting with '<! !'' and with many repetitions of '<' !'' can start matching anywhere after the start of the preceeding \\w?<\\s?\\/?[^\\s>]+(\\s+[^"'=]+(=("[^"]*")\|('[^\\']*')\|([^\\s"'>]*))?)*\\s*\\/?> |
-| regexplib/misc.js:148:68:148:70 | \\s* | Strings starting with '<!' and with many repetitions of '  ' can start matching anywhere after the start of the preceeding [^"'=]+ |
+| regexplib/misc.js:148:68:148:70 | \\s* | Strings starting with '<!' and with many repetitions of '  ' can start matching anywhere after the start of the preceeding \\s+ |
 | regexplib/misc.js:162:18:162:23 | [0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding \\d* |
-| regexplib/misc.js:162:24:162:26 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [0-9]+ |
+| regexplib/misc.js:162:24:162:26 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding \\d* |
 | regexplib/misc.js:162:36:162:38 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [0-9]+ |
 | regexplib/misc.js:162:72:162:77 | [0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding \\d* |
-| regexplib/misc.js:162:78:162:80 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [0-9]+ |
+| regexplib/misc.js:162:78:162:80 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding \\d* |
 | regexplib/misc.js:162:90:162:92 | \\d* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [0-9]+ |
 | regexplib/misc.js:163:41:163:43 | \\s* | Strings starting with 'SR' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s* |
 | regexplib/misc.js:163:75:163:77 | \\s* | Strings starting with '99' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s* |
@@ -286,33 +286,33 @@
 | regexplib/numbers.js:13:9:13:11 | \\d* | Strings with many repetitions of '9' can start matching anywhere after the start of the preceeding \\d* |
 | regexplib/numbers.js:16:14:16:16 | \\d* | Strings starting with '0a' and with many repetitions of '09' can start matching anywhere after the start of the preceeding \\d* |
 | regexplib/strings.js:2:2:2:3 | .* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding .*[Pp]en[Ii1][\\$s].* |
-| regexplib/strings.js:14:35:14:37 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding (?<FirstName>[A-Z]\\.?\\w*\\-?[A-Z]?\\w*)\\s?(?<MiddleName>[A-Z]\\w*\|[A-Z]?\\.?)\\s?(?<LastName>[A-Z]\\w*\\-?[A-Z]?\\w*)(?:,\\s\|)(?<Suffix>Jr\\.\|Sr\\.\|IV\|III\|II\|) |
-| regexplib/strings.js:14:61:14:63 | \\w* | Strings starting with 'AA' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding (?<FirstName>[A-Z]\\.?\\w*\\-?[A-Z]?\\w*)\\s?(?<MiddleName>[A-Z]\\w*\|[A-Z]?\\.?)\\s?(?<LastName>[A-Z]\\w*\\-?[A-Z]?\\w*)(?:,\\s\|)(?<Suffix>Jr\\.\|Sr\\.\|IV\|III\|II\|) |
-| regexplib/strings.js:14:107:14:109 | \\w* | Strings starting with 'AAA' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding (?<FirstName>[A-Z]\\.?\\w*\\-?[A-Z]?\\w*)\\s?(?<MiddleName>[A-Z]\\w*\|[A-Z]?\\.?)\\s?(?<LastName>[A-Z]\\w*\\-?[A-Z]?\\w*)(?:,\\s\|)(?<Suffix>Jr\\.\|Sr\\.\|IV\|III\|II\|) |
-| regexplib/strings.js:19:31:19:57 | [a-z&#230;&#248;&#229;0-9]+ | Strings starting with '#@' and with many repetitions of '##' can start matching anywhere after the start of the preceeding ([a-z&#230;&#248;&#229;0-9]+([\\.-]{0,1}[a-z&#230;&#248;&#229;0-9]+\|[a-z&#230;&#248;&#229;0-9]?))+ |
+| regexplib/strings.js:14:35:14:37 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding \\w* |
+| regexplib/strings.js:14:61:14:63 | \\w* | Strings starting with 'AA' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding \\w* |
+| regexplib/strings.js:14:107:14:109 | \\w* | Strings starting with 'AAA' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding \\w* |
+| regexplib/strings.js:19:31:19:57 | [a-z&#230;&#248;&#229;0-9]+ | Strings starting with '#@' and with many repetitions of '##' can start matching anywhere after the start of the preceeding [a-z&#230;&#248;&#229;0-9]+ |
 | regexplib/strings.js:20:3:20:20 | ((\\\\")\|[^"(\\\\")])+ | Strings starting with '"' and with many repetitions of '\\\\"' can start matching anywhere after the start of the preceeding "((\\\\")\|[^"(\\\\")])+" |
 | regexplib/strings.js:21:3:21:7 | [^>]+ | Strings starting with '<' and with many repetitions of '<' can start matching anywhere after the start of the preceeding <[^>]+> |
 | regexplib/strings.js:23:3:23:20 | ((\\\\")\|[^"(\\\\")])+ | Strings starting with '"' and with many repetitions of '\\\\"' can start matching anywhere after the start of the preceeding "((\\\\")\|[^"(\\\\")])+" |
 | regexplib/strings.js:26:6:26:17 | [a-zA-Z,\\s]+ | Strings with many repetitions of '\\t' can start matching anywhere after the start of the preceeding \\s* |
-| regexplib/strings.js:26:18:26:20 | \\s* | Strings starting with '\\t' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding [a-zA-Z,\\s]+ |
+| regexplib/strings.js:26:18:26:20 | \\s* | Strings starting with '\\t' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding \\s* |
 | regexplib/strings.js:29:2:29:3 | .* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding .*\\$AVE |
 | regexplib/strings.js:30:2:30:3 | .* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding .*[Pp]re[Ss\\$]cr[iI1]pt.* |
-| regexplib/strings.js:32:35:32:37 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding (?<FirstName>[A-Z]\\.?\\w*\\-?[A-Z]?\\w*)\\s?(?<MiddleName>[A-Z]\\w+\|[A-Z]?\\.?)\\s(?<LastName>[A-Z]?\\w{0,3}[A-Z]\\w+\\-?[A-Z]?\\w*)(?:,\\s\|)(?<Suffix>Jr\\.\|Sr\\.\|IV\|III\|II\|) |
-| regexplib/strings.js:32:61:32:63 | \\w+ | Strings starting with 'AA' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding (?<FirstName>[A-Z]\\.?\\w*\\-?[A-Z]?\\w*)\\s?(?<MiddleName>[A-Z]\\w+\|[A-Z]?\\.?)\\s(?<LastName>[A-Z]?\\w{0,3}[A-Z]\\w+\\-?[A-Z]?\\w*)(?:,\\s\|)(?<Suffix>Jr\\.\|Sr\\.\|IV\|III\|II\|) |
+| regexplib/strings.js:32:35:32:37 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding \\w* |
+| regexplib/strings.js:32:61:32:63 | \\w+ | Strings starting with 'AA' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding \\w* |
 | regexplib/strings.js:32:119:32:121 | \\w* | Strings with many repetitions of 'aA' can start matching anywhere after the start of the preceeding \\w+ |
 | regexplib/strings.js:40:3:40:5 | \\w+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (\\w+)\\s+\\1 |
 | regexplib/strings.js:48:3:48:12 | [^\\.\\?\\!]* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding ([^\\.\\?\\!]*)[\\.\\?\\!] |
 | regexplib/strings.js:49:3:49:5 | \\S+ | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding (\\S+)\\x20{2,}(?=\\S+) |
-| regexplib/strings.js:53:25:53:33 | [a-z0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [\\-a-z0-9]* |
-| regexplib/strings.js:53:65:53:73 | [a-z0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [\\-a-z0-9]* |
+| regexplib/strings.js:53:25:53:33 | [a-z0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
+| regexplib/strings.js:53:65:53:73 | [a-z0-9]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
 | regexplib/strings.js:54:20:54:22 | \\w+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (NOT)?(\\s*\\(*)\\s*(\\w+)\\s*(=\|<>\|<\|>\|LIKE\|IN)\\s*(\\(([^\\)]*)\\)\|'([^']*)'\|(-?\\d*\\.?\\d+))(\\s*\\)*\\s*)(AND\|OR)? |
 | regexplib/strings.js:56:52:56:53 | .+ | Strings starting with 'PRN.' and with many repetitions of '.' can start matching anywhere after the start of the preceeding .* |
 | regexplib/strings.js:57:36:57:38 | .*? | Strings starting with '?se[A' and with many repetitions of '?se[Aa' can start matching anywhere after the start of the preceeding (?s)(?:\\e\\[(?:(\\d+);?)*([A-Za-z])(.*?))(?=\\e\\[\|\\z) |
 | regexplib/strings.js:64:3:64:5 | \\w+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (\\w+)\\s+\\1 |
 | regexplib/strings.js:70:6:70:17 | [a-zA-Z,\\s]+ | Strings with many repetitions of '\\t' can start matching anywhere after the start of the preceeding \\s* |
-| regexplib/strings.js:70:18:70:20 | \\s* | Strings starting with '\\t' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding [a-zA-Z,\\s]+ |
-| regexplib/strings.js:72:35:72:37 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding (?<FirstName>[A-Z]\\.?\\w*\\-?[A-Z]?\\w*)\\s?(?<MiddleName>[A-Z]\\w+\|[A-Z]?\\.?)\\s(?<LastName>[A-Z]?\\w{0,3}[A-Z]\\w+\\-?[A-Z]?\\w*)(?:,\\s\|)(?<Suffix>Jr\\.\|Sr\\.\|IV\|III\|II\|) |
-| regexplib/strings.js:72:61:72:63 | \\w+ | Strings starting with 'AA' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding (?<FirstName>[A-Z]\\.?\\w*\\-?[A-Z]?\\w*)\\s?(?<MiddleName>[A-Z]\\w+\|[A-Z]?\\.?)\\s(?<LastName>[A-Z]?\\w{0,3}[A-Z]\\w+\\-?[A-Z]?\\w*)(?:,\\s\|)(?<Suffix>Jr\\.\|Sr\\.\|IV\|III\|II\|) |
+| regexplib/strings.js:70:18:70:20 | \\s* | Strings starting with '\\t' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding \\s* |
+| regexplib/strings.js:72:35:72:37 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding \\w* |
+| regexplib/strings.js:72:61:72:63 | \\w+ | Strings starting with 'AA' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding \\w* |
 | regexplib/strings.js:72:119:72:121 | \\w* | Strings with many repetitions of 'aA' can start matching anywhere after the start of the preceeding \\w+ |
 | regexplib/strings.js:73:2:73:3 | .* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding .*\\$AVE |
 | regexplib/strings.js:74:2:74:3 | .* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding .*[Pp]re[Ss\\$]cr[iI1]pt.* |
@@ -322,11 +322,11 @@
 | regexplib/strings.js:82:20:82:22 | \\w+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (NOT)?(\\s*\\(*)\\s*(\\w+)\\s*(=\|<>\|<\|>\|LIKE\|IN)\\s*(\\(([^\\)]*)\\)\|'([^']*)'\|(-?\\d*\\.?\\d+))(\\s*\\)*\\s*)(AND\|OR)? |
 | regexplib/strings.js:88:3:88:12 | [^\\.\\?\\!]* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding ([^\\.\\?\\!]*)[\\.\\?\\!] |
 | regexplib/strings.js:89:3:89:5 | \\S+ | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding (\\S+)\\x20{2,}(?=\\S+) |
-| regexplib/uri.js:3:149:3:151 | .*? | Strings starting with 'ftp://     ' and with many repetitions of '/ /' can start matching anywhere after the start of the preceeding (?:(?<protocol>http(?:s?)\|ftp)(?:\\:\\/\\/)) (?:(?<usrpwd>\\w+\\:\\w+)(?:\\@))? (?<domain>[^/\\r\\n\\:]+)? (?<port>\\:\\d+)? (?<path>(?:\\/.*)*\\/)? (?<filename>.*?\\.(?<ext>\\w{2,4}))? (?<qrystr>\\??(?:\\w+\\=[^\\#]+)(?:\\&?\\w+\\=\\w+)*)* (?<bkmrk>\\#.*)? |
-| regexplib/uri.js:3:188:3:190 | \\w+ | Strings starting with 'ftp://      ' and with many repetitions of '00' can start matching anywhere after the start of the preceeding (?:(?<protocol>http(?:s?)\|ftp)(?:\\:\\/\\/)) (?:(?<usrpwd>\\w+\\:\\w+)(?:\\@))? (?<domain>[^/\\r\\n\\:]+)? (?<port>\\:\\d+)? (?<path>(?:\\/.*)*\\/)? (?<filename>.*?\\.(?<ext>\\w{2,4}))? (?<qrystr>\\??(?:\\w+\\=[^\\#]+)(?:\\&?\\w+\\=\\w+)*)* (?<bkmrk>\\#.*)? |
-| regexplib/uri.js:3:193:3:198 | [^\\#]+ | Strings starting with 'ftp://      a=' and with many repetitions of '00=' can start matching anywhere after the start of the preceeding (?:(?<protocol>http(?:s?)\|ftp)(?:\\:\\/\\/)) (?:(?<usrpwd>\\w+\\:\\w+)(?:\\@))? (?<domain>[^/\\r\\n\\:]+)? (?<port>\\:\\d+)? (?<path>(?:\\/.*)*\\/)? (?<filename>.*?\\.(?<ext>\\w{2,4}))? (?<qrystr>\\??(?:\\w+\\=[^\\#]+)(?:\\&?\\w+\\=\\w+)*)* (?<bkmrk>\\#.*)? |
-| regexplib/uri.js:3:206:3:208 | \\w+ | Strings starting with 'ftp://      a="' and with many repetitions of '00' can start matching anywhere after the start of the preceeding (?:(?<protocol>http(?:s?)\|ftp)(?:\\:\\/\\/)) (?:(?<usrpwd>\\w+\\:\\w+)(?:\\@))? (?<domain>[^/\\r\\n\\:]+)? (?<port>\\:\\d+)? (?<path>(?:\\/.*)*\\/)? (?<filename>.*?\\.(?<ext>\\w{2,4}))? (?<qrystr>\\??(?:\\w+\\=[^\\#]+)(?:\\&?\\w+\\=\\w+)*)* (?<bkmrk>\\#.*)? |
-| regexplib/uri.js:3:211:3:213 | \\w+ | Strings starting with 'ftp://      a="a=' and with many repetitions of '00=' can start matching anywhere after the start of the preceeding (?:(?<protocol>http(?:s?)\|ftp)(?:\\:\\/\\/)) (?:(?<usrpwd>\\w+\\:\\w+)(?:\\@))? (?<domain>[^/\\r\\n\\:]+)? (?<port>\\:\\d+)? (?<path>(?:\\/.*)*\\/)? (?<filename>.*?\\.(?<ext>\\w{2,4}))? (?<qrystr>\\??(?:\\w+\\=[^\\#]+)(?:\\&?\\w+\\=\\w+)*)* (?<bkmrk>\\#.*)? |
+| regexplib/uri.js:3:149:3:151 | .*? | Strings starting with 'ftp://     ' and with many repetitions of '/ /' can start matching anywhere after the start of the preceeding .* |
+| regexplib/uri.js:3:188:3:190 | \\w+ | Strings starting with 'ftp://      ' and with many repetitions of '00' can start matching anywhere after the start of the preceeding .* |
+| regexplib/uri.js:3:193:3:198 | [^\\#]+ | Strings starting with 'ftp://      a=' and with many repetitions of '00=' can start matching anywhere after the start of the preceeding .* |
+| regexplib/uri.js:3:206:3:208 | \\w+ | Strings starting with 'ftp://      a="' and with many repetitions of '00' can start matching anywhere after the start of the preceeding .* |
+| regexplib/uri.js:3:211:3:213 | \\w+ | Strings starting with 'ftp://      a="a=' and with many repetitions of '00=' can start matching anywhere after the start of the preceeding .* |
 | regexplib/uri.js:5:42:5:43 | .* | Strings starting with 'A:\\\\a' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding [\\w ]* |
 | regexplib/uri.js:14:175:14:213 | [\\d\\w\\.\\/\\%\\+\\-\\=\\&\\?\\:\\\\\\"\\'\\,\\\|\\~\\;]* | Strings with many repetitions of '.ac+' can start matching anywhere after the start of the preceeding [\\d\\w\\.\\/\\+\\-\\?\\:]* |
 | regexplib/uri.js:17:42:17:43 | .* | Strings starting with 'A:\\\\a' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding [\\w ]* |
@@ -355,46 +355,46 @@
 | regexplib/uri.js:29:48:29:62 | [a-zA-Z0-9\\.-]+ | Strings starting with 'wwwa' and with many repetitions of 'www--' can start matching anywhere after the start of the preceeding ((http\\:\\/\\/\|https\\:\\/\\/\|ftp\\:\\/\\/)\|(www.))+ |
 | regexplib/uri.js:31:65:31:69 | [^<]+ | Strings starting with 'href=! >' and with many repetitions of 'href=! >;' can start matching anywhere after the start of the preceeding href\\s*=\\s*(?:(?:\\"(?<url>[^\\"]*)\\")\|(?<url>[^\\s*] ))>(?<title>[^<]+)<\\/\\w> |
 | regexplib/uri.js:36:40:36:42 | \\d* | Strings starting with '$1' and with many repetitions of '1' can start matching anywhere after the start of the preceeding [1-9]+ |
-| regexplib/uri.js:38:20:38:28 | [a-z0-9]+ | Strings starting with 'a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z0-9-]* |
-| regexplib/uri.js:38:35:38:40 | [a-z]+ | Strings starting with 'a.' and with many repetitions of 'aa' can start matching anywhere after the start of the preceeding ([a-z]+([a-z0-9-]*[a-z0-9]+)?)+ |
-| regexplib/uri.js:38:52:38:60 | [a-z0-9]+ | Strings starting with 'a.a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([a-z]+([a-z0-9-]*[a-z0-9]+)?)+ |
-| regexplib/uri.js:39:7:39:9 | .*? | Strings starting with '<a' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding <a\\s*.*?href\\s*=\\s*['"](?!http:\\/\\/).*?>(.*?)<\\/a> |
+| regexplib/uri.js:38:20:38:28 | [a-z0-9]+ | Strings starting with 'a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z]+ |
+| regexplib/uri.js:38:35:38:40 | [a-z]+ | Strings starting with 'a.' and with many repetitions of 'aa' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
+| regexplib/uri.js:38:52:38:60 | [a-z0-9]+ | Strings starting with 'a.a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z]+ |
+| regexplib/uri.js:39:7:39:9 | .*? | Strings starting with '<a' and with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s* |
 | regexplib/uri.js:39:43:39:45 | .*? | Strings with many repetitions of '>a' can start matching anywhere after the start of the preceeding .*? |
 | regexplib/uri.js:41:16:41:31 | [a-zA-Z0-9\\-\\.]+ | Strings starting with '0' and with many repetitions of '00' can start matching anywhere after the start of the preceeding [a-zA-Z0-9]+ |
 | regexplib/uri.js:47:31:47:36 | [\\w-]+ | Strings with many repetitions of '-' can start matching anywhere after the start of the preceeding [\\w-\\s]* |
 | regexplib/uri.js:51:51:51:53 | \\S+ | Strings with many repetitions of '!@' can start matching anywhere after the start of the preceeding \\S+ |
 | regexplib/uri.js:54:40:54:42 | \\d* | Strings starting with '$1' and with many repetitions of '1' can start matching anywhere after the start of the preceeding [1-9]+ |
-| regexplib/uri.js:55:20:55:28 | [a-z0-9]+ | Strings starting with 'a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z0-9-]* |
-| regexplib/uri.js:55:35:55:40 | [a-z]+ | Strings starting with 'a.' and with many repetitions of 'aa' can start matching anywhere after the start of the preceeding ([a-z]+([a-z0-9-]*[a-z0-9]+)?)+ |
-| regexplib/uri.js:55:52:55:60 | [a-z0-9]+ | Strings starting with 'a.a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding ([a-z]+([a-z0-9-]*[a-z0-9]+)?)+ |
+| regexplib/uri.js:55:20:55:28 | [a-z0-9]+ | Strings starting with 'a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z]+ |
+| regexplib/uri.js:55:35:55:40 | [a-z]+ | Strings starting with 'a.' and with many repetitions of 'aa' can start matching anywhere after the start of the preceeding [a-z0-9]+ |
+| regexplib/uri.js:55:52:55:60 | [a-z0-9]+ | Strings starting with 'a.a' and with many repetitions of '0' can start matching anywhere after the start of the preceeding [a-z]+ |
 | regexplib/uri.js:58:2:58:45 | ((http\\:\\/\\/\|https\\:\\/\\/\|ftp\\:\\/\\/)\|(www.))+ | Strings with many repetitions of 'wwwa' can start matching anywhere after the start of the preceeding ((http\\:\\/\\/\|https\\:\\/\\/\|ftp\\:\\/\\/)\|(www.))+(([a-zA-Z0-9\\.-]+\\.[a-zA-Z]{2,4})\|([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}))(\\/[a-zA-Z0-9%:/-_\\?\\.'~]*)? |
 | regexplib/uri.js:58:48:58:62 | [a-zA-Z0-9\\.-]+ | Strings starting with 'wwwa' and with many repetitions of 'www--' can start matching anywhere after the start of the preceeding ((http\\:\\/\\/\|https\\:\\/\\/\|ftp\\:\\/\\/)\|(www.))+ |
 | regexplib/uri.js:64:31:64:36 | [\\w-]+ | Strings with many repetitions of '-' can start matching anywhere after the start of the preceeding [\\w-\\s]* |
 | regexplib/uri.js:70:16:70:31 | [a-zA-Z0-9\\-\\.]+ | Strings starting with '0' and with many repetitions of '00' can start matching anywhere after the start of the preceeding [a-zA-Z0-9]+ |
 | regexplib/uri.js:71:75:71:89 | [^\\/\\\\:*?"<>\|]+ | Strings starting with 'A:\\\\!.' and with many repetitions of '!.' can start matching anywhere after the start of the preceeding [^\\/\\\\:*?"<>\|]+ |
 | tst.js:14:15:14:16 | .* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (.*,)+ |
-| tst.js:23:21:23:28 | [\\s\\S]*? | Strings starting with '(*' and with many repetitions of '(*a' can start matching anywhere after the start of the preceeding (?:[\\s\\S]*?\\(\\*[\\s\\S]*?\\*\\))* |
-| tst.js:23:33:23:40 | [\\s\\S]*? | Strings starting with '(*(*' and with many repetitions of '(*' can start matching anywhere after the start of the preceeding (?:[\\s\\S]*?\\(\\*[\\s\\S]*?\\*\\))* |
-| tst.js:23:47:23:54 | [\\s\\S]*? | Strings starting with '(*' and with many repetitions of '(*a' can start matching anywhere after the start of the preceeding (?:[\\s\\S]*?\\(\\*[\\s\\S]*?\\*\\))* |
+| tst.js:23:21:23:28 | [\\s\\S]*? | Strings starting with '(*' and with many repetitions of '(*a' can start matching anywhere after the start of the preceeding [\\s\\S]*? |
+| tst.js:23:33:23:40 | [\\s\\S]*? | Strings starting with '(*(*' and with many repetitions of '(*' can start matching anywhere after the start of the preceeding [\\s\\S]*? |
+| tst.js:23:47:23:54 | [\\s\\S]*? | Strings starting with '(*' and with many repetitions of '(*a' can start matching anywhere after the start of the preceeding [\\s\\S]*? |
 | tst.js:28:24:28:25 | .* | Strings starting with '!\|' and with many repetitions of '\|' can start matching anywhere after the start of the preceeding .* |
 | tst.js:28:59:28:60 | .* | Strings starting with '!\|\\n-\|\\n\|' and with many repetitions of '\|' can start matching anywhere after the start of the preceeding .* |
 | tst.js:31:23:31:24 | .* | Strings starting with '!\|' and with many repetitions of '\|' can start matching anywhere after the start of the preceeding .* |
 | tst.js:31:54:31:55 | .* | Strings starting with '!\|\\n-\|\\n' and with many repetitions of '\|\\n\|' can start matching anywhere after the start of the preceeding .* |
 | tst.js:31:58:31:59 | .* | Strings starting with '!\|\\n-\|\\n\|' and with many repetitions of '\|' can start matching anywhere after the start of the preceeding .* |
 | tst.js:41:14:41:30 | ([\\s\\[\\{\\(]\|#.*)* | Strings with many repetitions of '\\t' can start matching anywhere after the start of the preceeding .* |
-| tst.js:47:21:47:43 | (?:[^"']\|".*?"\|'.*?')*? | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding ((?:[^"']\|".*?"\|'.*?')*?)([(,)]\|$) |
-| tst.js:47:31:47:33 | .*? | Strings starting with '"' and with many repetitions of '"' can start matching anywhere after the start of the preceeding ((?:[^"']\|".*?"\|'.*?')*?)([(,)]\|$) |
-| tst.js:47:37:47:39 | .*? | Strings starting with ''' and with many repetitions of ''' can start matching anywhere after the start of the preceeding ((?:[^"']\|".*?"\|'.*?')*?)([(,)]\|$) |
+| tst.js:47:21:47:43 | (?:[^"']\|".*?"\|'.*?')*? | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding .*? |
+| tst.js:47:31:47:33 | .*? | Strings starting with '"' and with many repetitions of '"' can start matching anywhere after the start of the preceeding .*? |
+| tst.js:47:37:47:39 | .*? | Strings starting with ''' and with many repetitions of ''' can start matching anywhere after the start of the preceeding .*? |
 | tst.js:52:34:52:43 | (\\[.*?\\])* | Strings starting with '$' and with many repetitions of '[]' can start matching anywhere after the start of the preceeding .*? |
 | tst.js:52:37:52:39 | .*? | Strings starting with '$[' and with many repetitions of '[]' can start matching anywhere after the start of the preceeding (\\[.*?\\])* |
-| tst.js:52:67:52:76 | (\\[.*?\\])* | Strings starting with '$.$' and with many repetitions of '[]' can start matching anywhere after the start of the preceeding (\\[.*?\\])* |
-| tst.js:52:70:52:72 | .*? | Strings starting with '$.$[' and with many repetitions of '[]' can start matching anywhere after the start of the preceeding (\\[.*?\\])* |
+| tst.js:52:67:52:76 | (\\[.*?\\])* | Strings starting with '$.$' and with many repetitions of '[]' can start matching anywhere after the start of the preceeding .*? |
+| tst.js:52:70:52:72 | .*? | Strings starting with '$.$[' and with many repetitions of '[]' can start matching anywhere after the start of the preceeding .*? |
 | tst.js:58:15:58:20 | [a-z]+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding ([a-z]+)+ |
 | tst.js:60:43:60:54 | [a-zA-Z0-9]+ | Strings starting with '0' and with many repetitions of '0' can start matching anywhere after the start of the preceeding (([\\\\-.]\|[_]+)?([a-zA-Z0-9]+))* |
 | tst.js:61:16:61:23 | ([a-z])+ | Strings with many repetitions of 'aa' can start matching anywhere after the start of the preceeding (([a-z])+.)+ |
-| tst.js:66:16:66:31 | [\\w#:.~>+()\\s-]+ | Strings with many repetitions of '\\t' can start matching anywhere after the start of the preceeding (([\\w#:.~>+()\\s-]+\|\\*\|\\[.*?\\])+)\\s*(,\|$) |
-| tst.js:66:38:66:40 | .*? | Strings starting with '[' and with many repetitions of '[' can start matching anywhere after the start of the preceeding (([\\w#:.~>+()\\s-]+\|\\*\|\\[.*?\\])+)\\s*(,\|$) |
-| tst.js:66:46:66:48 | \\s* | Strings starting with '*' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding (([\\w#:.~>+()\\s-]+\|\\*\|\\[.*?\\])+)\\s*(,\|$) |
+| tst.js:66:16:66:31 | [\\w#:.~>+()\\s-]+ | Strings with many repetitions of '\\t' can start matching anywhere after the start of the preceeding .*? |
+| tst.js:66:38:66:40 | .*? | Strings starting with '[' and with many repetitions of '[' can start matching anywhere after the start of the preceeding [\\w#:.~>+()\\s-]+ |
+| tst.js:66:46:66:48 | \\s* | Strings starting with '*' and with many repetitions of '\\t' can start matching anywhere after the start of the preceeding [\\w#:.~>+()\\s-]+ |
 | tst.js:71:19:71:26 | (\\\\?.)*? | Strings starting with '"' and with many repetitions of '"' can start matching anywhere after the start of the preceeding ("\|')(\\\\?.)*?\\1 |
 | tst.js:74:14:74:21 | (b\|a?b)* | Strings with many repetitions of 'b' can start matching anywhere after the start of the preceeding (b\|a?b)*c |
 | tst.js:77:14:77:21 | (a\|aa?)* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a\|aa?)*b |
@@ -424,17 +424,17 @@
 | tst.js:164:15:164:24 | (\\S\|[\\w])* | Strings with many repetitions of '!' can start matching anywhere after the start of the preceeding ((\\S\|[\\w])*)" |
 | tst.js:167:15:167:27 | (1s\|[\\da-z])* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding ((1s\|[\\da-z])*)" |
 | tst.js:170:15:170:23 | (0\|[\\d])* | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding ((0\|[\\d])*)" |
-| tst.js:173:16:173:20 | [\\d]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding (([\\d]+)*)" |
+| tst.js:173:16:173:20 | [\\d]+ | Strings with many repetitions of '0' can start matching anywhere after the start of the preceeding ([\\d]+)* |
 | tst.js:185:16:185:21 | [^>a]+ | Strings with many repetitions of '=' can start matching anywhere after the start of the preceeding ([^>a]+)* |
 | tst.js:188:17:188:19 | \\s* | Strings starting with '\\n' and with many repetitions of '\\n' can start matching anywhere after the start of the preceeding (\\n\\s*)+$ |
-| tst.js:191:18:191:20 | \\s+ | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding (?:\\s+\|#.*\|\\(\\?#[^)]*\\))* |
-| tst.js:191:31:191:35 | [^)]* | Strings starting with '(?#' and with many repetitions of '(?#' can start matching anywhere after the start of the preceeding (?:\\s+\|#.*\|\\(\\?#[^)]*\\))* |
+| tst.js:191:18:191:20 | \\s+ | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding .* |
+| tst.js:191:31:191:35 | [^)]* | Strings starting with '(?#' and with many repetitions of '(?#' can start matching anywhere after the start of the preceeding .* |
 | tst.js:194:53:194:61 | [a-zA-Z]+ | Strings starting with '{[A(A)' and with many repetitions of 'AA' can start matching anywhere after the start of the preceeding [ a-zA-Z{}]+ |
-| tst.js:194:68:194:79 | [ a-zA-Z{}]+ | Strings starting with '{[A(A)A:' and with many repetitions of ' A:  ' can start matching anywhere after the start of the preceeding [a-zA-Z]+ |
+| tst.js:194:68:194:79 | [ a-zA-Z{}]+ | Strings starting with '{[A(A)A:' and with many repetitions of ' A:  ' can start matching anywhere after the start of the preceeding \\s* |
 | tst.js:194:87:194:89 | \\s* | Strings starting with '{[A(A)' and with many repetitions of '  ' can start matching anywhere after the start of the preceeding [ a-zA-Z{}]+ |
 | tst.js:197:15:197:16 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a+\|b+\|c+)* |
 | tst.js:197:18:197:19 | b+ | Strings with many repetitions of 'b' can start matching anywhere after the start of the preceeding (a+\|b+\|c+)* |
-| tst.js:200:17:200:18 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (((a+a?)*)+b+) |
+| tst.js:200:17:200:18 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a+a?)* |
 | tst.js:203:15:203:16 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a+)+ |
 | tst.js:209:15:209:16 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a+)+ |
 | tst.js:215:15:215:17 | \\n+ | Strings with many repetitions of '\\n' can start matching anywhere after the start of the preceeding (\\n+)+ |
@@ -443,28 +443,28 @@
 | tst.js:227:15:227:22 | ([^X]b)+ | Strings with many repetitions of 'Wb' can start matching anywhere after the start of the preceeding (([^X]b)+)* |
 | tst.js:239:15:239:19 | (ab)+ | Strings with many repetitions of 'ab' can start matching anywhere after the start of the preceeding ((ab)+)* |
 | tst.js:245:15:245:21 | [\\n\\s]+ | Strings with many repetitions of '\\n' can start matching anywhere after the start of the preceeding ([\\n\\s]+)* |
-| tst.js:248:18:248:19 | A* | Strings with many repetitions of 'A' can start matching anywhere after the start of the preceeding (A*A*X)* |
-| tst.js:254:15:254:17 | \\w* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\s*foobarbaz\\d*foobarbaz\\w*)+- |
-| tst.js:254:27:254:29 | \\w* | Strings starting with 'foobarbaz' and with many repetitions of 'foobarbaz' can start matching anywhere after the start of the preceeding (\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\s*foobarbaz\\d*foobarbaz\\w*)+- |
-| tst.js:254:39:254:41 | \\w* | Strings starting with 'foobarbazfoobarbaz' and with many repetitions of 'foobarbaz' can start matching anywhere after the start of the preceeding (\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\s*foobarbaz\\d*foobarbaz\\w*)+- |
-| tst.js:254:51:254:53 | \\w* | Strings starting with 'foobarbazfoobarbazfoobarbaz' and with many repetitions of 'foobarbaz' can start matching anywhere after the start of the preceeding (\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\s*foobarbaz\\d*foobarbaz\\w*)+- |
-| tst.js:254:63:254:65 | \\s* | Strings starting with 'foobarbazfoobarbazfoobarbazfoobarbaz' and with many repetitions of 'foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz' can start matching anywhere after the start of the preceeding (\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\s*foobarbaz\\d*foobarbaz\\w*)+- |
-| tst.js:254:75:254:77 | \\d* | Strings starting with 'foobarbazfoobarbazfoobarbazfoobarbazfoobarbaz' and with many repetitions of 'foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz' can start matching anywhere after the start of the preceeding (\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\w*foobarbaz\\s*foobarbaz\\d*foobarbaz\\w*)+- |
+| tst.js:248:18:248:19 | A* | Strings with many repetitions of 'A' can start matching anywhere after the start of the preceeding A* |
+| tst.js:254:15:254:17 | \\w* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding \\d* |
+| tst.js:254:27:254:29 | \\w* | Strings starting with 'foobarbaz' and with many repetitions of 'foobarbaz' can start matching anywhere after the start of the preceeding \\d* |
+| tst.js:254:39:254:41 | \\w* | Strings starting with 'foobarbazfoobarbaz' and with many repetitions of 'foobarbaz' can start matching anywhere after the start of the preceeding \\d* |
+| tst.js:254:51:254:53 | \\w* | Strings starting with 'foobarbazfoobarbazfoobarbaz' and with many repetitions of 'foobarbaz' can start matching anywhere after the start of the preceeding \\d* |
+| tst.js:254:63:254:65 | \\s* | Strings starting with 'foobarbazfoobarbazfoobarbazfoobarbaz' and with many repetitions of 'foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz' can start matching anywhere after the start of the preceeding \\d* |
+| tst.js:254:75:254:77 | \\d* | Strings starting with 'foobarbazfoobarbazfoobarbazfoobarbazfoobarbaz' and with many repetitions of 'foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz' can start matching anywhere after the start of the preceeding \\s* |
 | tst.js:257:14:257:116 | (.thisisagoddamnlongstringforstresstestingthequery\|\\sthisisagoddamnlongstringforstresstestingthequery)* | Strings with many repetitions of ' thisisagoddamnlongstringforstresstestingthequery' can start matching anywhere after the start of the preceeding (.thisisagoddamnlongstringforstresstestingthequery\|\\sthisisagoddamnlongstringforstresstestingthequery)*- |
-| tst.js:260:14:260:77 | (thisisagoddamnlongstringforstresstestingthequery\|this\\w+query)* | Strings with many repetitions of 'thisaquery' can start matching anywhere after the start of the preceeding (thisisagoddamnlongstringforstresstestingthequery\|this\\w+query)*- |
+| tst.js:260:14:260:77 | (thisisagoddamnlongstringforstresstestingthequery\|this\\w+query)* | Strings with many repetitions of 'thisaquery' can start matching anywhere after the start of the preceeding \\w+ |
 | tst.js:260:68:260:70 | \\w+ | Strings starting with 'this' and with many repetitions of 'this' can start matching anywhere after the start of the preceeding (thisisagoddamnlongstringforstresstestingthequery\|this\\w+query)* |
 | tst.js:263:15:263:117 | (thisisagoddamnlongstringforstresstestingthequery\|imanotherbutunrelatedstringcomparedtotheotherstring)* | Strings with many repetitions of 'thisisagoddamnlongstringforstresstestingthequery' can start matching anywhere after the start of the preceeding (thisisagoddamnlongstringforstresstestingthequery\|imanotherbutunrelatedstringcomparedtotheotherstring)*- |
 | tst.js:272:21:272:22 | b+ | Strings with many repetitions of 'b' can start matching anywhere after the start of the preceeding (b+)+ |
 | tst.js:275:25:275:27 | \\s+ | Strings starting with '<a' and with many repetitions of ' 0=" 0=" ' can start matching anywhere after the start of the preceeding [^"]* |
 | tst.js:275:28:275:30 | \\w+ | Strings starting with '<a ' and with many repetitions of '0=" 0=" ' can start matching anywhere after the start of the preceeding [^"]* |
 | tst.js:275:34:275:36 | \\s* | Strings starting with '<a a' and with many repetitions of '=" 0=" 0 ' can start matching anywhere after the start of the preceeding [^"]* |
-| tst.js:275:48:275:52 | [^"]* | Strings starting with '<a a="' and with many repetitions of '" a="' can start matching anywhere after the start of the preceeding (?:\\s+\\w+(?:\\s*=\\s*(?:(?:"[^"]*")\|(?:'[^']*')\|[^>\\s]+))?)* |
-| tst.js:275:60:275:64 | [^']* | Strings starting with '<a a='' and with many repetitions of '' a='' can start matching anywhere after the start of the preceeding (?:\\s+\\w+(?:\\s*=\\s*(?:(?:"[^"]*")\|(?:'[^']*')\|[^>\\s]+))?)* |
+| tst.js:275:48:275:52 | [^"]* | Strings starting with '<a a="' and with many repetitions of '" a="' can start matching anywhere after the start of the preceeding \\s* |
+| tst.js:275:60:275:64 | [^']* | Strings starting with '<a a='' and with many repetitions of '' a='' can start matching anywhere after the start of the preceeding \\s* |
 | tst.js:275:68:275:74 | [^>\\s]+ | Strings starting with '<a a=' and with many repetitions of '" a="' can start matching anywhere after the start of the preceeding [^"]* |
 | tst.js:281:16:281:17 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a+)* |
 | tst.js:284:16:284:17 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a+)* |
-| tst.js:290:16:290:17 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding ((a+)*$\|[^]+) |
-| tst.js:293:22:293:23 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding ([^]+\|(a+)*$) |
+| tst.js:290:16:290:17 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a+)* |
+| tst.js:293:22:293:23 | a+ | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding (a+)* |
 | tst.js:296:15:296:24 | ((;\|^)a+)+ | Strings starting with 'a' and with many repetitions of ';a' can start matching anywhere after the start of the preceeding ((;\|^)a+)+$ |
 | tst.js:296:21:296:22 | a+ | Strings with many repetitions of 'a;' can start matching anywhere after the start of the preceeding ((;\|^)a+)+$ |
 | tst.js:299:90:299:91 | e+ | Strings starting with '00000000000000' and with many repetitions of 'e' can start matching anywhere after the start of the preceeding (e+)+ |

From 14bb10a361d80c3d79938b132968a0aa352301b3 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Thu, 14 Jan 2021 13:39:41 +0100
Subject: [PATCH 113/343] Python: Use LocalSourceNode for TornadoRouteRegex

---
 python/ql/src/semmle/python/frameworks/Tornado.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index 292ea802114..995fb19747d 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -476,7 +476,7 @@ private module Tornado {
 
     TornadoRouteRegex() {
       this instanceof StrConst and
-      DataFlow::localFlow(DataFlow::exprNode(this), setup.getUrlPatternArg())
+      DataFlow::exprNode(this).(DataFlow::LocalSourceNode).flowsTo(setup.getUrlPatternArg())
     }
 
     TornadoRouteSetup getRouteSetup() { result = setup }

From 0b1cece523a964efa2a8367d42dee12aa4a408cf Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 11 Jan 2021 14:42:31 +0100
Subject: [PATCH 114/343] Python: Add tests for class based handlers in Flask

---
 .../frameworks/flask/routing_test.py          | 72 ++++++++++++++++++-
 1 file changed, 69 insertions(+), 3 deletions(-)

diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
index 1a6028e8026..2efe2cdcb2c 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
@@ -21,10 +21,76 @@ def later_set():  # $ MISSING: requestHandler
 app.add_url_rule('/later-set', 'later_set', view_func=None)  # $routeSetup="/later-set"
 app.view_functions['later_set'] = later_set
 
+# We don't want to execute this at runtime (since program will crash). Just using
+# `False` makes our analysis skip it, so here's a workaround :D
+if __file__ == "False":
+    @app.route(UNKNOWN_ROUTE) # $routeSetup
+    def unkown_route(foo, bar):  # $requestHandler routedParameter=foo routedParameter=bar
+        return make_response("unkown_route")  # $HttpResponse
 
-@app.route(UNKNOWN_ROUTE) # $routeSetup
-def unkown_route(foo, bar):  # $requestHandler routedParameter=foo routedParameter=bar
-    return make_response("unkown_route")  # $HttpResponse
+# View
+#
+# see https://flask.palletsprojects.com/en/1.1.x/views/#basic-principle
+
+from flask.views import View
+
+
+class ShowUser(View):
+
+    def dispatch_request(self, user_id):  # $ MISSING: requestHandler routedParameter=user_id
+        return "user_id: {}".format(user_id)
+
+app.add_url_rule("/basic/user/<int:user_id>", view_func=ShowUser.as_view('show_user')) # $routeSetup="/basic/user/<int:user_id>"
+
+
+class WithoutKnownRoute1(View):
+    # For handler without known route, treat all parameters as routed parameters
+    # (accepting that there might be a few FPs)
+    def dispatch_request(self, foo, not_routed=42):  # $ MISSING: requestHandler routedParameter=foo
+        pass
+
+
+# MethodView
+#
+# see https://flask.palletsprojects.com/en/1.1.x/views/#method-views-for-apis
+
+from flask.views import MethodView
+
+
+class UserAPI(MethodView):
+
+    def get(self, user_id):  # $ MISSING: requestHandler routedParameter=user_id
+        if user_id is None:
+            # return a list of users
+            pass
+        else:
+            # expose a single user
+            pass
+
+    def post(self):  # $ MISSING: requestHandler
+        # create a new user
+        pass
+
+    def delete(self, user_id):  # $ MISSING: requestHandler routedParameter=user_id
+        # delete a single user
+        pass
+
+    def put(self, user_id):  # $ MISSING: requestHandler routedParameter=user_id
+        # update a single user
+        pass
+
+
+user_view = UserAPI.as_view("user_api")
+app.add_url_rule("/users/", defaults={"user_id": None}, view_func=user_view, methods=["GET",]) # $routeSetup="/users/"
+app.add_url_rule("/users/", view_func=user_view, methods=["POST",]) # $routeSetup="/users/"
+app.add_url_rule("/users/<int:user_id>", view_func=user_view, methods=["GET", "PUT", "DELETE"]) # $routeSetup="/users/<int:user_id>"
+
+
+class WithoutKnownRoute2(MethodView):
+    # For handler without known route, treat all parameters as routed parameters
+    # (accepting that there might be a few FPs)
+    def get(self, foo, not_routed=42):  # $ MISSING: requestHandler routedParameter=foo
+        pass
 
 
 if __name__ == "__main__":

From e327fdb31766c05dbe2b0cdb518187ab3df618ce Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 12 Jan 2021 14:45:48 +0100
Subject: [PATCH 115/343] Python: Model flask View classes

---
 .../ql/src/semmle/python/frameworks/Flask.qll | 148 +++++++++++++++++-
 .../frameworks/flask/routing_test.py          |   8 +-
 2 files changed, 148 insertions(+), 8 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Flask.qll b/python/ql/src/semmle/python/frameworks/Flask.qll
index 14e53a66ef7..63906441680 100644
--- a/python/ql/src/semmle/python/frameworks/Flask.qll
+++ b/python/ql/src/semmle/python/frameworks/Flask.qll
@@ -34,7 +34,7 @@ private module FlaskModel {
    * WARNING: Only holds for a few predefined attributes.
    */
   private DataFlow::Node flask_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["request", "make_response", "Response"] and
+    attr_name in ["request", "make_response", "Response", "views"] and
     (
       t.start() and
       result = DataFlow::importNode("flask" + "." + attr_name)
@@ -187,6 +187,76 @@ private module FlaskModel {
        */
       DataFlow::Node response_class() { result = response_class(DataFlow::TypeTracker::end()) }
     }
+
+    // -------------------------------------------------------------------------
+    // flask.views
+    // -------------------------------------------------------------------------
+    /** Gets a reference to the `flask.views` module. */
+    DataFlow::Node views() { result = flask_attr("views") }
+
+    /** Provides models for the `flask.views` module */
+    module views {
+      /**
+       * Gets a reference to the attribute `attr_name` of the `flask.views` module.
+       * WARNING: Only holds for a few predefined attributes.
+       */
+      private DataFlow::Node views_attr(DataFlow::TypeTracker t, string attr_name) {
+        attr_name in ["View", "MethodView"] and
+        (
+          t.start() and
+          result = DataFlow::importNode("flask.views" + "." + attr_name)
+          or
+          t.startInAttr(attr_name) and
+          result = views()
+        )
+        or
+        // Due to bad performance when using normal setup with `views_attr(t2, attr_name).track(t2, t)`
+        // we have inlined that code and forced a join
+        exists(DataFlow::TypeTracker t2 |
+          exists(DataFlow::StepSummary summary |
+            views_attr_first_join(t2, attr_name, result, summary) and
+            t = t2.append(summary)
+          )
+        )
+      }
+
+      pragma[nomagic]
+      private predicate views_attr_first_join(
+        DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res,
+        DataFlow::StepSummary summary
+      ) {
+        DataFlow::StepSummary::step(views_attr(t2, attr_name), res, summary)
+      }
+
+      /**
+       * Gets a reference to the attribute `attr_name` of the `flask.views` module.
+       * WARNING: Only holds for a few predefined attributes.
+       */
+      private DataFlow::Node views_attr(string attr_name) {
+        result = views_attr(DataFlow::TypeTracker::end(), attr_name)
+      }
+
+      /**
+       * Provides models for the `flask.views.View` class and subclasses.
+       *
+       * See https://flask.palletsprojects.com/en/1.1.x/views/#basic-principle.
+       */
+      module View {
+        /** Gets a reference to the `flask.views.View` class or any subclass. */
+        private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
+          t.start() and
+          result = views_attr(["View", "MethodView"])
+          or
+          // subclasses in project code
+          result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
+          or
+          exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
+        }
+
+        /** Gets a reference to the `flask.views.View` class or any subclass. */
+        DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
+      }
+    }
   }
 
   /**
@@ -261,6 +331,52 @@ private module FlaskModel {
   // ---------------------------------------------------------------------------
   // routing modeling
   // ---------------------------------------------------------------------------
+  /** A flask View class defined in project code. */
+  class FlaskViewClassDef extends Class {
+    FlaskViewClassDef() { this.getABase() = flask::views::View::subclassRef().asExpr() }
+
+    /** Gets a function that could handle incoming requests, if any. */
+    Function getARequestHandler() {
+      // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
+      // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
+      result = this.getAMethod() and
+      result.getName() = "dispatch_request"
+    }
+
+    /** Gets a reference to this class. */
+    private DataFlow::Node getARef(DataFlow::TypeTracker t) {
+      t.start() and
+      result.asExpr().(ClassExpr) = this.getParent()
+      or
+      exists(DataFlow::TypeTracker t2 | result = this.getARef(t2).track(t2, t))
+    }
+
+    /** Gets a reference to this class. */
+    DataFlow::Node getARef() { result = this.getARef(DataFlow::TypeTracker::end()) }
+
+    /** Gets a reference to the `as_view` classmethod of this class. */
+    private DataFlow::Node asViewRef(DataFlow::TypeTracker t) {
+      t.startInAttr("as_view") and
+      result = this.getARef()
+      or
+      exists(DataFlow::TypeTracker t2 | result = this.asViewRef(t2).track(t2, t))
+    }
+
+    /** Gets a reference to the `as_view` classmethod of this class. */
+    DataFlow::Node asViewRef() { result = this.asViewRef(DataFlow::TypeTracker::end()) }
+
+    /** Gets a reference to the result of calling the `as_view` classmethod of this class. */
+    private DataFlow::Node asViewResult(DataFlow::TypeTracker t) {
+      t.start() and
+      result.asCfgNode().(CallNode).getFunction() = this.asViewRef().asCfgNode()
+      or
+      exists(DataFlow::TypeTracker t2 | result = asViewResult(t2).track(t2, t))
+    }
+
+    /** Gets a reference to the result of calling the `as_view` classmethod of this class. */
+    DataFlow::Node asViewResult() { result = asViewResult(DataFlow::TypeTracker::end()) }
+  }
+
   private string werkzeug_rule_re() {
     // since flask uses werkzeug internally, we are using its routing rules from
     // https://github.com/pallets/werkzeug/blob/4dc8d6ab840d4b78cbd5789cef91b01e3bde01d5/src/werkzeug/routing.py#L138-L151
@@ -318,12 +434,36 @@ private module FlaskModel {
       result.asCfgNode() in [node.getArg(0), node.getArgByName("rule")]
     }
 
+    DataFlow::Node getViewArg() {
+      result.asCfgNode() in [node.getArg(2), node.getArgByName("view_func")]
+    }
+
     override Function getARequestHandler() {
-      exists(DataFlow::Node view_func_arg, DataFlow::LocalSourceNode func_src |
-        view_func_arg.asCfgNode() in [node.getArg(2), node.getArgByName("view_func")] and
-        func_src.flowsTo(view_func_arg) and
+      exists(DataFlow::LocalSourceNode func_src |
+        func_src.flowsTo(getViewArg()) and
         func_src.asExpr().(CallableExpr) = result.getDefinition()
       )
+      or
+      exists(FlaskViewClassDef vc |
+        getViewArg() = vc.asViewResult() and
+        result = vc.getARequestHandler()
+      )
+    }
+  }
+
+  /** A request handler defined in a django view class, that has no known route. */
+  private class FlaskViewClassHandlerWithoutKnownRoute extends HTTP::Server::RequestHandler::Range {
+    FlaskViewClassHandlerWithoutKnownRoute() {
+      exists(FlaskViewClassDef vc | vc.getARequestHandler() = this) and
+      not exists(FlaskRouteSetup setup | setup.getARequestHandler() = this)
+    }
+
+    override Parameter getARoutedParameter() {
+      // Since we don't know the URL pattern, we simply mark all parameters as a routed
+      // parameter. This should give us more RemoteFlowSources but could also lead to
+      // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
+      result in [this.getArg(_), this.getArgByName(_)] and
+      not result = this.getArg(0)
     }
   }
 
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
index 2efe2cdcb2c..5faf7bb9a5d 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
@@ -37,16 +37,16 @@ from flask.views import View
 
 class ShowUser(View):
 
-    def dispatch_request(self, user_id):  # $ MISSING: requestHandler routedParameter=user_id
-        return "user_id: {}".format(user_id)
+    def dispatch_request(self, user_id):  # $ requestHandler routedParameter=user_id
+        return "user_id: {}".format(user_id)  # $ HttpResponse
 
-app.add_url_rule("/basic/user/<int:user_id>", view_func=ShowUser.as_view('show_user')) # $routeSetup="/basic/user/<int:user_id>"
+app.add_url_rule("/basic/user/<int:user_id>", view_func=ShowUser.as_view('show_user'))  # $routeSetup="/basic/user/<int:user_id>"
 
 
 class WithoutKnownRoute1(View):
     # For handler without known route, treat all parameters as routed parameters
     # (accepting that there might be a few FPs)
-    def dispatch_request(self, foo, not_routed=42):  # $ MISSING: requestHandler routedParameter=foo
+    def dispatch_request(self, foo, not_routed=42):  # $ requestHandler routedParameter=foo SPURIOUS: routedParameter=not_routed
         pass
 
 

From 4cb2f2ed1e9c7fb7f4da7ec37f9324ae60f2e942 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 12 Jan 2021 16:36:01 +0100
Subject: [PATCH 116/343] Python: Proper models of flask MethodView classes

---
 .../ql/src/semmle/python/frameworks/Flask.qll | 34 +++++++++++++++++++
 .../frameworks/flask/old_test.py              |  2 +-
 .../frameworks/flask/routing_test.py          | 10 +++---
 3 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Flask.qll b/python/ql/src/semmle/python/frameworks/Flask.qll
index 63906441680..68f81e32ceb 100644
--- a/python/ql/src/semmle/python/frameworks/Flask.qll
+++ b/python/ql/src/semmle/python/frameworks/Flask.qll
@@ -256,6 +256,27 @@ private module FlaskModel {
         /** Gets a reference to the `flask.views.View` class or any subclass. */
         DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
       }
+
+      /**
+       * Provides models for the `flask.views.MethodView` class and subclasses.
+       *
+       * See https://flask.palletsprojects.com/en/1.1.x/views/#method-based-dispatching.
+       */
+      module MethodView {
+        /** Gets a reference to the `flask.views.View` class or any subclass. */
+        private DataFlow::Node subclassRef(DataFlow::TypeTracker t) {
+          t.start() and
+          result = views_attr("MethodView")
+          or
+          // subclasses in project code
+          result.asExpr().(ClassExpr).getABase() = subclassRef(t.continue()).asExpr()
+          or
+          exists(DataFlow::TypeTracker t2 | result = subclassRef(t2).track(t2, t))
+        }
+
+        /** Gets a reference to the `flask.views.View` class or any subclass. */
+        DataFlow::Node subclassRef() { result = subclassRef(DataFlow::TypeTracker::end()) }
+      }
     }
   }
 
@@ -377,6 +398,19 @@ private module FlaskModel {
     DataFlow::Node asViewResult() { result = asViewResult(DataFlow::TypeTracker::end()) }
   }
 
+  class FlaskMethodViewClassDef extends FlaskViewClassDef {
+    FlaskMethodViewClassDef() { this.getABase() = flask::views::MethodView::subclassRef().asExpr() }
+
+    override Function getARequestHandler() {
+      result = super.getARequestHandler()
+      or
+      // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
+      // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
+      result = this.getAMethod() and
+      result.getName() = HTTP::httpVerbLower()
+    }
+  }
+
   private string werkzeug_rule_re() {
     // since flask uses werkzeug internally, we are using its routing rules from
     // https://github.com/pallets/werkzeug/blob/4dc8d6ab840d4b78cbd5789cef91b01e3bde01d5/src/werkzeug/routing.py#L138-L151
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/old_test.py b/python/ql/test/experimental/library-tests/frameworks/flask/old_test.py
index 4e251f6f306..d86c75019e5 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/old_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/old_test.py
@@ -11,7 +11,7 @@ from flask.views import MethodView
 
 class MyView(MethodView):
 
-    def get(self, user_id): # $ MISSING: requestHandler
+    def get(self, user_id): # $ requestHandler
         if user_id is None:
             # return a list of users
             pass
diff --git a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
index 5faf7bb9a5d..813e3751152 100644
--- a/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py
@@ -59,7 +59,7 @@ from flask.views import MethodView
 
 class UserAPI(MethodView):
 
-    def get(self, user_id):  # $ MISSING: requestHandler routedParameter=user_id
+    def get(self, user_id):  # $ requestHandler routedParameter=user_id
         if user_id is None:
             # return a list of users
             pass
@@ -67,15 +67,15 @@ class UserAPI(MethodView):
             # expose a single user
             pass
 
-    def post(self):  # $ MISSING: requestHandler
+    def post(self):  # $ requestHandler
         # create a new user
         pass
 
-    def delete(self, user_id):  # $ MISSING: requestHandler routedParameter=user_id
+    def delete(self, user_id):  # $ requestHandler routedParameter=user_id
         # delete a single user
         pass
 
-    def put(self, user_id):  # $ MISSING: requestHandler routedParameter=user_id
+    def put(self, user_id):  # $ requestHandler routedParameter=user_id
         # update a single user
         pass
 
@@ -89,7 +89,7 @@ app.add_url_rule("/users/<int:user_id>", view_func=user_view, methods=["GET", "P
 class WithoutKnownRoute2(MethodView):
     # For handler without known route, treat all parameters as routed parameters
     # (accepting that there might be a few FPs)
-    def get(self, foo, not_routed=42):  # $ MISSING: requestHandler routedParameter=foo
+    def get(self, foo, not_routed=42):  # $ requestHandler routedParameter=foo SPURIOUS: routedParameter=not_routed
         pass
 
 

From c5595f4cbd8f531dc307409684cb81d6c1c866f6 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 14 Jan 2021 13:48:26 +0100
Subject: [PATCH 117/343] improve alert message for js/polynomial-redos

---
 .../ql/src/Performance/PolynomialReDoS.ql     |  13 +-
 .../ReDoS/PolynomialReDoS.expected            | 152 +++++++++---------
 2 files changed, 85 insertions(+), 80 deletions(-)

diff --git a/javascript/ql/src/Performance/PolynomialReDoS.ql b/javascript/ql/src/Performance/PolynomialReDoS.ql
index e43c6e85d6b..616bf66c719 100644
--- a/javascript/ql/src/Performance/PolynomialReDoS.ql
+++ b/javascript/ql/src/Performance/PolynomialReDoS.ql
@@ -16,13 +16,18 @@ import semmle.javascript.security.performance.PolynomialReDoS::PolynomialReDoS
 import semmle.javascript.security.performance.SuperlinearBackTracking
 import DataFlow::PathGraph
 
-from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
+from
+  Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode,
+  PolynomialBackTrackingTerm regexp
 where
   cfg.hasFlowPath(source, sink) and
   sinkNode = sink.getNode() and
+  regexp = sinkNode.getRegExp() and
   not (
     source.getNode().(Source).getKind() = "url" and
-    sinkNode.getRegExp().(PolynomialBackTrackingTerm).isAtEndLine()
+    regexp.isAtEndLine()
   )
-select sinkNode.getHighlight(), source, sink, "This expensive $@ use depends on $@.",
-  sinkNode.getRegExp(), "regular expression", source.getNode(), source.getNode().(Source).describe()
+select sinkNode.getHighlight(), source, sink,
+  "This $@ that depends on $@ may run slow on strings " + regexp.getPrefixMessage() +
+    "with many repetitions of '" + regexp.getPumpString() + "'.", regexp, "regular expression",
+  source.getNode(), source.getNode().(Source).describe()
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
index c7a8b211703..59428ed86e0 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
@@ -288,79 +288,79 @@ edges
 | polynomial-redos.js:123:3:123:20 | result | polynomial-redos.js:124:12:124:17 | result |
 | polynomial-redos.js:123:13:123:20 | replaced | polynomial-redos.js:123:3:123:20 | result |
 #select
-| lib/lib.js:4:2:4:18 | regexp.test(name) | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name | This expensive $@ use depends on $@. | lib/lib.js:1:15:1:16 | a* | regular expression | lib/lib.js:3:28:3:31 | name | library input |
-| polynomial-redos.js:7:2:7:34 | tainted ... /g, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:7:2:7:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:7:24:7:26 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:8:2:8:23 | tainted ...  *, */) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:8:2:8:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:8:17:8:18 |  * | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:9:2:9:34 | tainted ... g, ' ') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:9:2:9:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:9:19:9:21 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:11:2:11:31 | tainted ... ]/, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:11:2:11:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:11:19:11:20 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:12:2:12:28 | tainted ... ./, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:12:2:12:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:12:19:12:20 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:15:2:15:52 | tainted ... (?!`)/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:15:2:15:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:15:28:15:35 | [\\s\\S]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:15:2:15:52 | tainted ... (?!`)/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:15:2:15:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:15:41:15:43 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:16:2:16:46 | tainted ... (?!`)/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:16:2:16:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:16:25:16:32 | [\\s\\S]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:17:2:17:30 | /^(.*,) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:17:23:17:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:17:5:17:6 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:17:2:17:30 | /^(.*,) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:17:23:17:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:17:11:17:12 | .+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:18:2:18:130 | tainted ... 1,2}/i) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:18:2:18:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:18:83:18:100 | [\\u0600-\\u06FF\\/]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:19:2:19:148 | tainted ... 1,2}/i) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:19:2:19:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:19:17:19:22 | [0-9]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:20:2:20:63 | tainted ... d+)?$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:20:2:20:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:20:56:20:58 | \\d+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:25:2:25:68 | tainted ... (.*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:25:2:25:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:25:37:25:56 | [a-zA-Z0-9+\\/ \\t\\n]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:25:2:25:68 | tainted ... (.*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:25:2:25:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:25:63:25:64 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:30:2:30:32 | tainted ... /g, "") | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:30:2:30:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:30:19:30:22 | [?]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:30:2:30:32 | tainted ... /g, "") | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:30:2:30:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:30:23:30:24 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:33:2:33:56 | tainted ... e(.)*/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:33:2:33:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:33:17:33:20 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:36:2:36:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:36:2:36:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:36:18:36:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:36:2:36:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:36:2:36:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:36:35:36:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:37:2:37:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:37:2:37:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:37:18:37:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:37:2:37:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:37:2:37:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:37:35:37:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:38:2:38:38 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:38:2:38:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:38:18:38:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:38:2:38:38 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:38:2:38:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:38:34:38:35 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:40:2:40:67 | tainted ... E]*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:40:2:40:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:40:51:40:63 | [?\\x21-\\x7E]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:43:2:43:78 | tainted ... +))?$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:43:2:43:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:43:67:43:72 | [^\\n]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:48:2:48:37 | tainted ... g, ' ') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:48:2:48:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:48:22:48:24 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:50:2:50:21 | /Y.*X/.test(tainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:50:14:50:20 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:50:4:50:5 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:51:2:51:33 | /B?(YH\| ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:51:26:51:32 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:51:11:51:17 | (YH\|J)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:52:3:52:29 | /B?(YH\| ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:52:22:52:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:52:12:52:13 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:53:2:53:28 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:53:21:53:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:53:3:53:8 | (B\|Y)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:53:2:53:28 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:53:21:53:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:53:9:53:12 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:54:3:54:29 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:54:22:54:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:54:4:54:9 | (B\|Y)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:54:3:54:29 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:54:22:54:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:54:10:54:13 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:55:3:55:30 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:55:23:55:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:55:11:55:14 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:56:2:56:29 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:56:22:56:28 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:56:10:56:13 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:57:3:57:32 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:57:25:57:31 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:57:11:57:16 | (Y\|K)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:58:3:58:28 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:58:21:58:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:58:11:58:12 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:59:3:59:30 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:59:23:59:29 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:59:11:59:14 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:62:3:62:24 | /^Y*Y*X ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:62:17:62:23 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:62:7:62:8 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:63:3:63:28 | /^(K\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:63:21:63:27 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:63:11:63:12 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:64:3:64:31 | /^foo(K ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:64:24:64:30 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:64:14:64:15 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:65:3:65:31 | /^foo(K ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:65:24:65:30 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:65:14:65:15 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:66:3:66:26 | /(K\|Y). ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:66:19:66:25 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:66:9:66:10 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:67:3:67:25 | /[^Y].* ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:67:18:67:24 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:67:8:67:9 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:69:3:69:26 | /[^Y].* ... q.body) | polynomial-redos.js:69:18:69:25 | req.body | polynomial-redos.js:69:18:69:25 | req.body | This expensive $@ use depends on $@. | polynomial-redos.js:69:8:69:9 | .* | regular expression | polynomial-redos.js:69:18:69:25 | req.body | a user-provided value |
-| polynomial-redos.js:71:2:71:67 | tainted ... E]*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:71:2:71:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:71:51:71:63 | [?\\x21-\\x7E]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:73:2:73:60 | tainted ... LWP7")) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:73:2:73:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:73:50:73:51 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:75:2:75:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:75:2:75:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:75:18:75:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:75:2:75:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:75:2:75:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:75:35:75:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:77:2:77:22 | tainted ... /Y.*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:77:2:77:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:77:18:77:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:80:2:80:21 | tainted.match(/a*b/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:80:2:80:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:80:17:80:18 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:81:2:81:22 | tainted ... /cc*D/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:81:2:81:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:81:18:81:19 | c* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:86:2:86:32 | tainted ... ab)*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:86:2:86:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:86:25:86:29 | (ab)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:88:2:88:22 | tainted ... /aa*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:88:2:88:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:88:18:88:19 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:89:2:89:24 | tainted ... a*a*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:89:2:89:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:89:20:89:21 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:90:2:90:23 | tainted ... \\wa*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:90:2:90:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:90:19:90:20 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:94:2:94:40 | tainted ... \|B)*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:94:2:94:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:94:28:94:37 | ([2-5]\|B)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:95:2:95:33 | tainted ... \|B)*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:95:2:95:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:95:21:95:30 | ([2-5]\|B)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:96:2:96:33 | tainted ... *\\d*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:96:2:96:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:96:28:96:30 | \\d* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:98:2:98:32 | tainted ... ab)+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:98:2:98:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:98:25:98:29 | (ab)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:100:2:100:22 | tainted ... /aa+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:100:2:100:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:100:18:100:19 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:101:2:101:21 | tainted.match(/a+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:101:2:101:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:101:17:101:18 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:102:2:102:24 | tainted ... a+a+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:102:2:102:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:102:20:102:21 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:103:2:103:23 | tainted ... \\wa+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:103:2:103:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:103:19:103:20 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:104:2:104:24 | tainted ... +b+c+/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:104:2:104:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:104:17:104:18 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:107:2:107:40 | tainted ... \|B)+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:107:2:107:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:107:28:107:37 | ([2-5]\|B)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:108:2:108:33 | tainted ... \|B)+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:108:2:108:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:108:21:108:30 | ([2-5]\|B)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:109:2:109:33 | tainted ... +\\d+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:109:2:109:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:109:28:109:30 | \\d+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:111:2:111:22 | tainted ... /\\s*$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:111:2:111:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:111:17:111:19 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:112:2:112:22 | tainted ... /\\s+$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:112:2:112:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:112:17:112:19 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:114:2:114:27 | tainted ... 5\\w*$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:114:2:114:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:114:22:114:24 | \\w* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:116:2:116:35 | tainted ... \\*\\//g) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:116:2:116:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:116:21:116:28 | [\\d\\D]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:118:2:118:25 | tainted ... \\d+)+/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:118:2:118:8 | tainted | This expensive $@ use depends on $@. | polynomial-redos.js:118:17:118:23 | (#\\d+)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
-| polynomial-redos.js:124:12:124:43 | result. ... /g, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:124:12:124:17 | result | This expensive $@ use depends on $@. | polynomial-redos.js:124:33:124:35 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| lib/lib.js:4:2:4:18 | regexp.test(name) | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | lib/lib.js:1:15:1:16 | a* | regular expression | lib/lib.js:3:28:3:31 | name | library input |
+| polynomial-redos.js:7:2:7:34 | tainted ... /g, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:7:2:7:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:7:24:7:26 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:8:2:8:23 | tainted ...  *, */) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:8:2:8:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:8:17:8:18 |  * | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:9:2:9:34 | tainted ... g, ' ') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:9:2:9:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:9:19:9:21 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:11:2:11:31 | tainted ... ]/, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:11:2:11:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | polynomial-redos.js:11:19:11:20 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:12:2:12:28 | tainted ... ./, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:12:2:12:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | polynomial-redos.js:12:19:12:20 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:15:2:15:52 | tainted ... (?!`)/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:15:2:15:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '`' and with many repetitions of ' '. | polynomial-redos.js:15:28:15:35 | [\\s\\S]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:15:2:15:52 | tainted ... (?!`)/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:15:2:15:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '`_' and with many repetitions of ' '. | polynomial-redos.js:15:41:15:43 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:16:2:16:46 | tainted ... (?!`)/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:16:2:16:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '`' and with many repetitions of '``'. | polynomial-redos.js:16:25:16:32 | [\\s\\S]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:17:2:17:30 | /^(.*,) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:17:23:17:29 | tainted | This $@ that depends on $@ may run slow on strings starting with ',' and with many repetitions of ',,'. | polynomial-redos.js:17:11:17:12 | .+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:17:2:17:30 | /^(.*,) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:17:23:17:29 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ','. | polynomial-redos.js:17:5:17:6 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:18:2:18:130 | tainted ... 1,2}/i) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:18:2:18:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of '/'. | polynomial-redos.js:18:83:18:100 | [\\u0600-\\u06FF\\/]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:19:2:19:148 | tainted ... 1,2}/i) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:19:2:19:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of '0'. | polynomial-redos.js:19:17:19:22 | [0-9]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:20:2:20:63 | tainted ... d+)?$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:20:2:20:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of '9'. | polynomial-redos.js:20:56:20:58 | \\d+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:25:2:25:68 | tainted ... (.*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:25:2:25:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '-\\t' and with many repetitions of '\\t\\t'. | polynomial-redos.js:25:37:25:56 | [a-zA-Z0-9+\\/ \\t\\n]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:25:2:25:68 | tainted ... (.*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:25:2:25:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '-\\t\\t' and with many repetitions of '='. | polynomial-redos.js:25:63:25:64 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:30:2:30:32 | tainted ... /g, "") | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:30:2:30:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '?' and with many repetitions of '?'. | polynomial-redos.js:30:23:30:24 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:30:2:30:32 | tainted ... /g, "") | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:30:2:30:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of '?'. | polynomial-redos.js:30:19:30:22 | [?]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:33:2:33:56 | tainted ... e(.)*/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:33:2:33:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | polynomial-redos.js:33:17:33:20 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:36:2:36:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:36:2:36:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '<' and with many repetitions of '<'. | polynomial-redos.js:36:18:36:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:36:2:36:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:36:2:36:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '<class="!"' and with many repetitions of 'class="!"'. | polynomial-redos.js:36:35:36:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:37:2:37:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:37:2:37:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '<' and with many repetitions of '<'. | polynomial-redos.js:37:18:37:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:37:2:37:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:37:2:37:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '<style="!"' and with many repetitions of 'style="!"'. | polynomial-redos.js:37:35:37:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:38:2:38:38 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:38:2:38:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '<' and with many repetitions of '<'. | polynomial-redos.js:38:18:38:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:38:2:38:38 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:38:2:38:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '<href="!"' and with many repetitions of 'href="!"'. | polynomial-redos.js:38:34:38:35 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:40:2:40:67 | tainted ... E]*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:40:2:40:8 | tainted | This $@ that depends on $@ may run slow on strings starting with ',-+' and with many repetitions of '++'. | polynomial-redos.js:40:51:40:63 | [?\\x21-\\x7E]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:43:2:43:78 | tainted ... +))?$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:43:2:43:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '-\\t+\\t' and with many repetitions of '\\t\\t'. | polynomial-redos.js:43:67:43:72 | [^\\n]+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:48:2:48:37 | tainted ... g, ' ') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:48:2:48:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:48:22:48:24 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:50:2:50:21 | /Y.*X/.test(tainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:50:14:50:20 | tainted | This $@ that depends on $@ may run slow on strings starting with 'Y' and with many repetitions of 'Y'. | polynomial-redos.js:50:4:50:5 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:51:2:51:33 | /B?(YH\| ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:51:26:51:32 | tainted | This $@ that depends on $@ may run slow on strings starting with 'K' and with many repetitions of 'YH'. | polynomial-redos.js:51:11:51:17 | (YH\|J)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:52:3:52:29 | /B?(YH\| ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:52:22:52:28 | tainted | This $@ that depends on $@ may run slow on strings starting with 'K' and with many repetitions of 'K'. | polynomial-redos.js:52:12:52:13 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:53:2:53:28 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:53:21:53:27 | tainted | This $@ that depends on $@ may run slow on strings starting with 'B' and with many repetitions of 'Y'. | polynomial-redos.js:53:9:53:12 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:53:2:53:28 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:53:21:53:27 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'B'. | polynomial-redos.js:53:3:53:8 | (B\|Y)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:54:3:54:29 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:54:22:54:28 | tainted | This $@ that depends on $@ may run slow on strings starting with 'B' and with many repetitions of 'B'. | polynomial-redos.js:54:10:54:13 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:54:3:54:29 | /(B\|Y)+ ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:54:22:54:28 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'B'. | polynomial-redos.js:54:4:54:9 | (B\|Y)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:55:3:55:30 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:55:23:55:29 | tainted | This $@ that depends on $@ may run slow on strings starting with 'fB' and with many repetitions of 'Y'. | polynomial-redos.js:55:11:55:14 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:56:2:56:29 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:56:22:56:28 | tainted | This $@ that depends on $@ may run slow on strings starting with 'fB' and with many repetitions of 'Y'. | polynomial-redos.js:56:10:56:13 | (Y)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:57:3:57:32 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:57:25:57:31 | tainted | This $@ that depends on $@ may run slow on strings starting with 'fB' and with many repetitions of 'Y'. | polynomial-redos.js:57:11:57:16 | (Y\|K)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:58:3:58:28 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:58:21:58:27 | tainted | This $@ that depends on $@ may run slow on strings starting with 'fB' and with many repetitions of 'B'. | polynomial-redos.js:58:11:58:12 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:59:3:59:30 | /f(B\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:59:23:59:29 | tainted | This $@ that depends on $@ may run slow on strings starting with 'fB' and with many repetitions of 'B'. | polynomial-redos.js:59:11:59:14 | (.)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:62:3:62:24 | /^Y*Y*X ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:62:17:62:23 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'Y'. | polynomial-redos.js:62:7:62:8 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:63:3:63:28 | /^(K\|Y) ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:63:21:63:27 | tainted | This $@ that depends on $@ may run slow on strings starting with 'K' and with many repetitions of 'Y'. | polynomial-redos.js:63:11:63:12 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:64:3:64:31 | /^foo(K ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:64:24:64:30 | tainted | This $@ that depends on $@ may run slow on strings starting with 'fooK' and with many repetitions of 'Y'. | polynomial-redos.js:64:14:64:15 | Y* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:65:3:65:31 | /^foo(K ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:65:24:65:30 | tainted | This $@ that depends on $@ may run slow on strings starting with 'fooK' and with many repetitions of 'K'. | polynomial-redos.js:65:14:65:15 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:66:3:66:26 | /(K\|Y). ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:66:19:66:25 | tainted | This $@ that depends on $@ may run slow on strings starting with 'K' and with many repetitions of 'K'. | polynomial-redos.js:66:9:66:10 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:67:3:67:25 | /[^Y].* ... ainted) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:67:18:67:24 | tainted | This $@ that depends on $@ may run slow on strings starting with 'X' and with many repetitions of 'Z'. | polynomial-redos.js:67:8:67:9 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:69:3:69:26 | /[^Y].* ... q.body) | polynomial-redos.js:69:18:69:25 | req.body | polynomial-redos.js:69:18:69:25 | req.body | This $@ that depends on $@ may run slow on strings starting with 'X' and with many repetitions of 'X'. | polynomial-redos.js:69:8:69:9 | .* | regular expression | polynomial-redos.js:69:18:69:25 | req.body | a user-provided value |
+| polynomial-redos.js:71:2:71:67 | tainted ... E]*)$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:71:2:71:8 | tainted | This $@ that depends on $@ may run slow on strings starting with ',-+' and with many repetitions of '++'. | polynomial-redos.js:71:51:71:63 | [?\\x21-\\x7E]* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:73:2:73:60 | tainted ... LWP7")) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:73:2:73:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'MSIE 9.9' and with many repetitions of '9'. | polynomial-redos.js:73:50:73:51 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:75:2:75:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:75:2:75:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '<' and with many repetitions of '<'. | polynomial-redos.js:75:18:75:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:75:2:75:39 | tainted ... )".*>/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:75:2:75:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '<class="!"' and with many repetitions of 'class="!"'. | polynomial-redos.js:75:35:75:36 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:77:2:77:22 | tainted ... /Y.*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:77:2:77:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'Y' and with many repetitions of 'Y'. | polynomial-redos.js:77:18:77:19 | .* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:80:2:80:21 | tainted.match(/a*b/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:80:2:80:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | polynomial-redos.js:80:17:80:18 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:81:2:81:22 | tainted ... /cc*D/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:81:2:81:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'c' and with many repetitions of 'c'. | polynomial-redos.js:81:18:81:19 | c* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:86:2:86:32 | tainted ... ab)*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:86:2:86:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'ab' and with many repetitions of 'ab'. | polynomial-redos.js:86:25:86:29 | (ab)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:88:2:88:22 | tainted ... /aa*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:88:2:88:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'a' and with many repetitions of 'a'. | polynomial-redos.js:88:18:88:19 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:89:2:89:24 | tainted ... a*a*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:89:2:89:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | polynomial-redos.js:89:20:89:21 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:90:2:90:23 | tainted ... \\wa*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:90:2:90:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'a' and with many repetitions of 'a'. | polynomial-redos.js:90:19:90:20 | a* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:94:2:94:40 | tainted ... \|B)*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:94:2:94:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of '3'. | polynomial-redos.js:94:28:94:37 | ([2-5]\|B)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:95:2:95:33 | tainted ... \|B)*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:95:2:95:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of '2'. | polynomial-redos.js:95:21:95:30 | ([2-5]\|B)* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:96:2:96:33 | tainted ... *\\d*X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:96:2:96:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of '3'. | polynomial-redos.js:96:28:96:30 | \\d* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:98:2:98:32 | tainted ... ab)+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:98:2:98:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'abab' and with many repetitions of 'abab'. | polynomial-redos.js:98:25:98:29 | (ab)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:100:2:100:22 | tainted ... /aa+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:100:2:100:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'a' and with many repetitions of 'a'. | polynomial-redos.js:100:18:100:19 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:101:2:101:21 | tainted.match(/a+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:101:2:101:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | polynomial-redos.js:101:17:101:18 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:102:2:102:24 | tainted ... a+a+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:102:2:102:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'a' and with many repetitions of 'a'. | polynomial-redos.js:102:20:102:21 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:103:2:103:23 | tainted ... \\wa+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:103:2:103:8 | tainted | This $@ that depends on $@ may run slow on strings starting with 'a' and with many repetitions of 'a'. | polynomial-redos.js:103:19:103:20 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:104:2:104:24 | tainted ... +b+c+/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:104:2:104:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | polynomial-redos.js:104:17:104:18 | a+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:107:2:107:40 | tainted ... \|B)+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:107:2:107:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '3' and with many repetitions of '3'. | polynomial-redos.js:107:28:107:37 | ([2-5]\|B)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:108:2:108:33 | tainted ... \|B)+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:108:2:108:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '9' and with many repetitions of '2'. | polynomial-redos.js:108:21:108:30 | ([2-5]\|B)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:109:2:109:33 | tainted ... +\\d+X/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:109:2:109:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '3' and with many repetitions of '3'. | polynomial-redos.js:109:28:109:30 | \\d+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:111:2:111:22 | tainted ... /\\s*$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:111:2:111:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:111:17:111:19 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:112:2:112:22 | tainted ... /\\s+$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:112:2:112:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:112:17:112:19 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:114:2:114:27 | tainted ... 5\\w*$/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:114:2:114:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '5' and with many repetitions of '5'. | polynomial-redos.js:114:22:114:24 | \\w* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:116:2:116:35 | tainted ... \\*\\//g) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:116:2:116:8 | tainted | This $@ that depends on $@ may run slow on strings starting with '/*' and with many repetitions of 'a/*'. | polynomial-redos.js:116:21:116:28 | [\\d\\D]*? | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:118:2:118:25 | tainted ... \\d+)+/) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:118:2:118:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of '9'. | polynomial-redos.js:118:17:118:23 | (#\\d+)+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
+| polynomial-redos.js:124:12:124:43 | result. ... /g, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:124:12:124:17 | result | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:124:33:124:35 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |

From 66d8b0f1a0fb8ec0f8ceafd9ef431f712c85323a Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 14 Jan 2021 14:11:28 +0100
Subject: [PATCH 118/343] Add new .stats file

---
 .../ql/src/semmlecode.csharp.dbscheme.stats   | 5169 ++++++++---------
 1 file changed, 2584 insertions(+), 2585 deletions(-)

diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme.stats b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
index f60c0b8ec1e..4f550902e34 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme.stats
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
@@ -9,7 +9,7 @@
 </e>
 <e>
 <k>@extractor_message</k>
-<v>7682</v>
+<v>7617</v>
 </e>
 <e>
 <k>@externalDefect</k>
@@ -25,7 +25,7 @@
 </e>
 <e>
 <k>@duplication</k>
-<v>22774</v>
+<v>22766</v>
 </e>
 <e>
 <k>@similarity</k>
@@ -33,31 +33,31 @@
 </e>
 <e>
 <k>@location_default</k>
-<v>14071854</v>
+<v>14072002</v>
 </e>
 <e>
 <k>@assembly</k>
-<v>4205</v>
+<v>4204</v>
 </e>
 <e>
 <k>@file</k>
-<v>42539</v>
+<v>42524</v>
 </e>
 <e>
 <k>@folder</k>
-<v>16968</v>
+<v>16962</v>
 </e>
 <e>
 <k>@namespace</k>
-<v>21979</v>
+<v>21971</v>
 </e>
 <e>
 <k>@namespace_declaration</k>
-<v>19793</v>
+<v>19786</v>
 </e>
 <e>
 <k>@using_namespace_directive</k>
-<v>144498</v>
+<v>144448</v>
 </e>
 <e>
 <k>@using_static_directive</k>
@@ -117,23 +117,23 @@
 </e>
 <e>
 <k>@enum_type</k>
-<v>11972</v>
+<v>11968</v>
 </e>
 <e>
 <k>@struct_type</k>
-<v>49750</v>
+<v>49732</v>
 </e>
 <e>
 <k>@class_type</k>
-<v>305620</v>
+<v>305512</v>
 </e>
 <e>
 <k>@interface_type</k>
-<v>178417</v>
+<v>178354</v>
 </e>
 <e>
 <k>@delegate_type</k>
-<v>107750</v>
+<v>107713</v>
 </e>
 <e>
 <k>@null_type</k>
@@ -141,7 +141,7 @@
 </e>
 <e>
 <k>@type_parameter</k>
-<v>202943</v>
+<v>202872</v>
 </e>
 <e>
 <k>@pointer_type</k>
@@ -153,7 +153,7 @@
 </e>
 <e>
 <k>@array_type</k>
-<v>9138</v>
+<v>9134</v>
 </e>
 <e>
 <k>@void_type</k>
@@ -185,19 +185,19 @@
 </e>
 <e>
 <k>@typeref</k>
-<v>235192</v>
+<v>235110</v>
 </e>
 <e>
 <k>@attribute</k>
-<v>750562</v>
+<v>750284</v>
 </e>
 <e>
 <k>@type_mention</k>
-<v>1269461</v>
+<v>1268966</v>
 </e>
 <e>
 <k>@oblivious</k>
-<v>1317</v>
+<v>1316</v>
 </e>
 <e>
 <k>@not_annotated</k>
@@ -205,11 +205,11 @@
 </e>
 <e>
 <k>@annotated</k>
-<v>119</v>
+<v>116</v>
 </e>
 <e>
 <k>@type_parameter_constraints</k>
-<v>611825</v>
+<v>611610</v>
 </e>
 <e>
 <k>@modifier</k>
@@ -217,43 +217,43 @@
 </e>
 <e>
 <k>@property</k>
-<v>424250</v>
+<v>424101</v>
 </e>
 <e>
 <k>@indexer</k>
-<v>17071</v>
+<v>17065</v>
 </e>
 <e>
 <k>@getter</k>
-<v>441087</v>
+<v>440933</v>
 </e>
 <e>
 <k>@setter</k>
-<v>127744</v>
+<v>127699</v>
 </e>
 <e>
 <k>@event</k>
-<v>15256</v>
+<v>15251</v>
 </e>
 <e>
 <k>@add_event_accessor</k>
-<v>15256</v>
+<v>15251</v>
 </e>
 <e>
 <k>@remove_event_accessor</k>
-<v>15256</v>
+<v>15251</v>
 </e>
 <e>
 <k>@operator</k>
-<v>12431</v>
+<v>12427</v>
 </e>
 <e>
 <k>@method</k>
-<v>1118769</v>
+<v>1118142</v>
 </e>
 <e>
 <k>@constructor</k>
-<v>278112</v>
+<v>278015</v>
 </e>
 <e>
 <k>@destructor</k>
@@ -265,15 +265,15 @@
 </e>
 <e>
 <k>@addressable_field</k>
-<v>371099</v>
+<v>370969</v>
 </e>
 <e>
 <k>@constant</k>
-<v>185530</v>
+<v>185465</v>
 </e>
 <e>
 <k>@addressable_local_variable</k>
-<v>162444</v>
+<v>162452</v>
 </e>
 <e>
 <k>@local_constant</k>
@@ -285,19 +285,19 @@
 </e>
 <e>
 <k>@parameter</k>
-<v>2421790</v>
+<v>2420706</v>
 </e>
 <e>
 <k>@block_stmt</k>
-<v>308574</v>
+<v>308455</v>
 </e>
 <e>
 <k>@expr_stmt</k>
-<v>367835</v>
+<v>367706</v>
 </e>
 <e>
 <k>@return_stmt</k>
-<v>96195</v>
+<v>96158</v>
 </e>
 <e>
 <k>@using_block_stmt</k>
@@ -305,19 +305,19 @@
 </e>
 <e>
 <k>@var_decl_stmt</k>
-<v>147915</v>
+<v>147916</v>
 </e>
 <e>
 <k>@if_stmt</k>
-<v>119173</v>
+<v>119127</v>
 </e>
 <e>
 <k>@switch_stmt</k>
-<v>3049</v>
+<v>3048</v>
 </e>
 <e>
 <k>@while_stmt</k>
-<v>4544</v>
+<v>4542</v>
 </e>
 <e>
 <k>@do_stmt</k>
@@ -325,23 +325,23 @@
 </e>
 <e>
 <k>@for_stmt</k>
-<v>6966</v>
+<v>6964</v>
 </e>
 <e>
 <k>@foreach_stmt</k>
-<v>5361</v>
+<v>5360</v>
 </e>
 <e>
 <k>@break_stmt</k>
-<v>10913</v>
+<v>10909</v>
 </e>
 <e>
 <k>@continue_stmt</k>
-<v>2187</v>
+<v>2186</v>
 </e>
 <e>
 <k>@goto_stmt</k>
-<v>2700</v>
+<v>2699</v>
 </e>
 <e>
 <k>@goto_case_stmt</k>
@@ -353,7 +353,7 @@
 </e>
 <e>
 <k>@throw_stmt</k>
-<v>74338</v>
+<v>74309</v>
 </e>
 <e>
 <k>@yield_stmt</k>
@@ -361,7 +361,7 @@
 </e>
 <e>
 <k>@try_stmt</k>
-<v>4325</v>
+<v>4323</v>
 </e>
 <e>
 <k>@checked_stmt</k>
@@ -373,7 +373,7 @@
 </e>
 <e>
 <k>@lock_stmt</k>
-<v>1660</v>
+<v>1659</v>
 </e>
 <e>
 <k>@const_decl_stmt</k>
@@ -389,19 +389,19 @@
 </e>
 <e>
 <k>@fixed_stmt</k>
-<v>1126</v>
+<v>1125</v>
 </e>
 <e>
 <k>@label_stmt</k>
-<v>1009</v>
+<v>1008</v>
 </e>
 <e>
 <k>@catch</k>
-<v>3440</v>
+<v>3438</v>
 </e>
 <e>
 <k>@case_stmt</k>
-<v>22446</v>
+<v>22437</v>
 </e>
 <e>
 <k>@local_function_stmt</k>
@@ -413,15 +413,15 @@
 </e>
 <e>
 <k>@bool_literal_expr</k>
-<v>69528</v>
+<v>69501</v>
 </e>
 <e>
 <k>@int_literal_expr</k>
-<v>755600</v>
+<v>754021</v>
 </e>
 <e>
 <k>@long_literal_expr</k>
-<v>325</v>
+<v>324</v>
 </e>
 <e>
 <k>@double_literal_expr</k>
@@ -429,11 +429,11 @@
 </e>
 <e>
 <k>@string_literal_expr</k>
-<v>412438</v>
+<v>412294</v>
 </e>
 <e>
 <k>@null_literal_expr</k>
-<v>107812</v>
+<v>107843</v>
 </e>
 <e>
 <k>@local_variable_access_expr</k>
@@ -441,51 +441,51 @@
 </e>
 <e>
 <k>@parameter_access_expr</k>
-<v>357577</v>
+<v>357439</v>
 </e>
 <e>
 <k>@field_access_expr</k>
-<v>460413</v>
+<v>460251</v>
 </e>
 <e>
 <k>@property_access_expr</k>
-<v>359717</v>
+<v>359591</v>
 </e>
 <e>
 <k>@type_access_expr</k>
-<v>347109</v>
+<v>347153</v>
 </e>
 <e>
 <k>@typeof_expr</k>
-<v>30098</v>
+<v>30087</v>
 </e>
 <e>
 <k>@method_invocation_expr</k>
-<v>548155</v>
+<v>548159</v>
 </e>
 <e>
 <k>@cast_expr</k>
-<v>262888</v>
+<v>262786</v>
 </e>
 <e>
 <k>@object_creation_expr</k>
-<v>62875</v>
+<v>62852</v>
 </e>
 <e>
 <k>@array_creation_expr</k>
-<v>179509</v>
+<v>179332</v>
 </e>
 <e>
 <k>@array_init_expr</k>
-<v>179049</v>
+<v>178872</v>
 </e>
 <e>
 <k>@local_var_decl_expr</k>
-<v>163750</v>
+<v>163758</v>
 </e>
 <e>
 <k>@char_literal_expr</k>
-<v>15899</v>
+<v>15893</v>
 </e>
 <e>
 <k>@decimal_literal_expr</k>
@@ -493,7 +493,7 @@
 </e>
 <e>
 <k>@uint_literal_expr</k>
-<v>2367</v>
+<v>2366</v>
 </e>
 <e>
 <k>@ulong_literal_expr</k>
@@ -505,11 +505,11 @@
 </e>
 <e>
 <k>@this_access_expr</k>
-<v>592827</v>
+<v>592619</v>
 </e>
 <e>
 <k>@base_access_expr</k>
-<v>2821</v>
+<v>2820</v>
 </e>
 <e>
 <k>@method_access_expr</k>
@@ -521,15 +521,15 @@
 </e>
 <e>
 <k>@indexer_access_expr</k>
-<v>30810</v>
+<v>30799</v>
 </e>
 <e>
 <k>@array_access_expr</k>
-<v>19751</v>
+<v>19743</v>
 </e>
 <e>
 <k>@delegate_invocation_expr</k>
-<v>2140</v>
+<v>2139</v>
 </e>
 <e>
 <k>@operator_invocation_expr</k>
@@ -541,11 +541,11 @@
 </e>
 <e>
 <k>@implicit_delegate_creation_expr</k>
-<v>5117</v>
+<v>5116</v>
 </e>
 <e>
 <k>@default_expr</k>
-<v>6359</v>
+<v>6356</v>
 </e>
 <e>
 <k>@plus_expr</k>
@@ -553,7 +553,7 @@
 </e>
 <e>
 <k>@minus_expr</k>
-<v>7144</v>
+<v>7141</v>
 </e>
 <e>
 <k>@bit_not_expr</k>
@@ -561,15 +561,15 @@
 </e>
 <e>
 <k>@log_not_expr</k>
-<v>26429</v>
+<v>26419</v>
 </e>
 <e>
 <k>@post_incr_expr</k>
-<v>12567</v>
+<v>12562</v>
 </e>
 <e>
 <k>@post_decr_expr</k>
-<v>1739</v>
+<v>1738</v>
 </e>
 <e>
 <k>@pre_incr_expr</k>
@@ -581,7 +581,7 @@
 </e>
 <e>
 <k>@mul_expr</k>
-<v>4627</v>
+<v>4625</v>
 </e>
 <e>
 <k>@div_expr</k>
@@ -589,51 +589,51 @@
 </e>
 <e>
 <k>@rem_expr</k>
-<v>717</v>
+<v>716</v>
 </e>
 <e>
 <k>@add_expr</k>
-<v>27885</v>
+<v>27874</v>
 </e>
 <e>
 <k>@sub_expr</k>
-<v>12844</v>
+<v>12839</v>
 </e>
 <e>
 <k>@lshift_expr</k>
-<v>4050</v>
+<v>4048</v>
 </e>
 <e>
 <k>@rshift_expr</k>
-<v>1765</v>
+<v>1764</v>
 </e>
 <e>
 <k>@lt_expr</k>
-<v>16298</v>
+<v>16292</v>
 </e>
 <e>
 <k>@gt_expr</k>
-<v>9588</v>
+<v>9585</v>
 </e>
 <e>
 <k>@le_expr</k>
-<v>3897</v>
+<v>3896</v>
 </e>
 <e>
 <k>@ge_expr</k>
-<v>6283</v>
+<v>6281</v>
 </e>
 <e>
 <k>@eq_expr</k>
-<v>53925</v>
+<v>53904</v>
 </e>
 <e>
 <k>@ne_expr</k>
-<v>37960</v>
+<v>37945</v>
 </e>
 <e>
 <k>@bit_and_expr</k>
-<v>6331</v>
+<v>6328</v>
 </e>
 <e>
 <k>@bit_xor_expr</k>
@@ -641,35 +641,35 @@
 </e>
 <e>
 <k>@bit_or_expr</k>
-<v>14991</v>
+<v>14985</v>
 </e>
 <e>
 <k>@log_and_expr</k>
-<v>20835</v>
+<v>20827</v>
 </e>
 <e>
 <k>@log_or_expr</k>
-<v>14082</v>
+<v>14076</v>
 </e>
 <e>
 <k>@is_expr</k>
-<v>6719</v>
+<v>6717</v>
 </e>
 <e>
 <k>@as_expr</k>
-<v>2759</v>
+<v>2758</v>
 </e>
 <e>
 <k>@null_coalescing_expr</k>
-<v>3683</v>
+<v>3682</v>
 </e>
 <e>
 <k>@conditional_expr</k>
-<v>9156</v>
+<v>9153</v>
 </e>
 <e>
 <k>@simple_assign_expr</k>
-<v>167488</v>
+<v>167429</v>
 </e>
 <e>
 <k>@assign_add_expr</k>
@@ -713,7 +713,7 @@
 </e>
 <e>
 <k>@object_init_expr</k>
-<v>7698</v>
+<v>7696</v>
 </e>
 <e>
 <k>@collection_init_expr</k>
@@ -729,7 +729,7 @@
 </e>
 <e>
 <k>@constructor_init_expr</k>
-<v>5821</v>
+<v>5819</v>
 </e>
 <e>
 <k>@add_event_expr</k>
@@ -745,7 +745,7 @@
 </e>
 <e>
 <k>@lambda_expr</k>
-<v>48852</v>
+<v>48835</v>
 </e>
 <e>
 <k>@anonymous_method_expr</k>
@@ -761,15 +761,15 @@
 </e>
 <e>
 <k>@dynamic_member_access_expr</k>
-<v>6854</v>
+<v>6852</v>
 </e>
 <e>
 <k>@pointer_indirection_expr</k>
-<v>4059</v>
+<v>4058</v>
 </e>
 <e>
 <k>@address_of_expr</k>
-<v>1251</v>
+<v>1250</v>
 </e>
 <e>
 <k>@sizeof_expr</k>
@@ -777,11 +777,11 @@
 </e>
 <e>
 <k>@await_expr</k>
-<v>54843</v>
+<v>54824</v>
 </e>
 <e>
 <k>@nameof_expr</k>
-<v>15936</v>
+<v>15930</v>
 </e>
 <e>
 <k>@interpolated_string_expr</k>
@@ -793,7 +793,7 @@
 </e>
 <e>
 <k>@throw_expr</k>
-<v>1543</v>
+<v>1542</v>
 </e>
 <e>
 <k>@tuple_expr</k>
@@ -825,11 +825,11 @@
 </e>
 <e>
 <k>@recursive_pattern_expr</k>
-<v>1011</v>
+<v>1013</v>
 </e>
 <e>
 <k>@property_pattern_expr</k>
-<v>828</v>
+<v>830</v>
 </e>
 <e>
 <k>@positional_pattern_expr</k>
@@ -841,17 +841,21 @@
 </e>
 <e>
 <k>@assign_coalesce_expr</k>
-<v>544</v>
+<v>543</v>
 </e>
 <e>
 <k>@suppress_nullable_warning_expr</k>
-<v>14407</v>
+<v>14401</v>
 </e>
 <e>
 <k>@namespace_access_expr</k>
 <v>20</v>
 </e>
 <e>
+<k>@not_pattern_expr</k>
+<v>74</v>
+</e>
+<e>
 <k>@xmldtd</k>
 <v>6</v>
 </e>
@@ -877,19 +881,19 @@
 </e>
 <e>
 <k>@singlelinecomment</k>
-<v>184733</v>
+<v>184662</v>
 </e>
 <e>
 <k>@multilinecomment</k>
-<v>22109</v>
+<v>22100</v>
 </e>
 <e>
 <k>@xmldoccomment</k>
-<v>203727</v>
+<v>203648</v>
 </e>
 <e>
 <k>@commentblock</k>
-<v>144309</v>
+<v>144253</v>
 </e>
 <e>
 <k>@asp_close_tag</k>
@@ -929,7 +933,7 @@
 </e>
 <e>
 <k>@cil_nop</k>
-<v>820326</v>
+<v>820008</v>
 </e>
 <e>
 <k>@cil_break</k>
@@ -937,147 +941,147 @@
 </e>
 <e>
 <k>@cil_ldarg_0</k>
-<v>3976427</v>
+<v>3975031</v>
 </e>
 <e>
 <k>@cil_ldarg_1</k>
-<v>1217025</v>
+<v>1216598</v>
 </e>
 <e>
 <k>@cil_ldarg_2</k>
-<v>444010</v>
+<v>443854</v>
 </e>
 <e>
 <k>@cil_ldarg_3</k>
-<v>209227</v>
+<v>209153</v>
 </e>
 <e>
 <k>@cil_ldloc_0</k>
-<v>929535</v>
+<v>929209</v>
 </e>
 <e>
 <k>@cil_ldloc_1</k>
-<v>494072</v>
+<v>493899</v>
 </e>
 <e>
 <k>@cil_ldloc_2</k>
-<v>288807</v>
+<v>288705</v>
 </e>
 <e>
 <k>@cil_ldloc_3</k>
-<v>192116</v>
+<v>192049</v>
 </e>
 <e>
 <k>@cil_stloc_0</k>
-<v>525122</v>
+<v>524938</v>
 </e>
 <e>
 <k>@cil_stloc_1</k>
-<v>260587</v>
+<v>260496</v>
 </e>
 <e>
 <k>@cil_stloc_2</k>
-<v>198371</v>
+<v>198302</v>
 </e>
 <e>
 <k>@cil_stloc_3</k>
-<v>138341</v>
+<v>138293</v>
 </e>
 <e>
 <k>@cil_ldarg_s</k>
-<v>264598</v>
+<v>264505</v>
 </e>
 <e>
 <k>@cil_ldarga_s</k>
-<v>74793</v>
+<v>74767</v>
 </e>
 <e>
 <k>@cil_starg_s</k>
-<v>37187</v>
+<v>37174</v>
 </e>
 <e>
 <k>@cil_ldloc_s</k>
-<v>686585</v>
+<v>686344</v>
 </e>
 <e>
 <k>@cil_ldloca_s</k>
-<v>629443</v>
+<v>629222</v>
 </e>
 <e>
 <k>@cil_stloc_s</k>
-<v>480997</v>
+<v>480828</v>
 </e>
 <e>
 <k>@cil_ldnull</k>
-<v>603911</v>
+<v>603700</v>
 </e>
 <e>
 <k>@cil_ldc_i4_m1</k>
-<v>126241</v>
+<v>126197</v>
 </e>
 <e>
 <k>@cil_ldc_i4_0</k>
-<v>625784</v>
+<v>625564</v>
 </e>
 <e>
 <k>@cil_ldc_i4_1</k>
-<v>494814</v>
+<v>494640</v>
 </e>
 <e>
 <k>@cil_ldc_i4_2</k>
-<v>121070</v>
+<v>121027</v>
 </e>
 <e>
 <k>@cil_ldc_i4_3</k>
-<v>64172</v>
+<v>64149</v>
 </e>
 <e>
 <k>@cil_ldc_i4_4</k>
-<v>58898</v>
+<v>58877</v>
 </e>
 <e>
 <k>@cil_ldc_i4_5</k>
-<v>38694</v>
+<v>38681</v>
 </e>
 <e>
 <k>@cil_ldc_i4_6</k>
-<v>23272</v>
+<v>23264</v>
 </e>
 <e>
 <k>@cil_ldc_i4_7</k>
-<v>20759</v>
+<v>20752</v>
 </e>
 <e>
 <k>@cil_ldc_i4_8</k>
-<v>33493</v>
+<v>33481</v>
 </e>
 <e>
 <k>@cil_ldc_i4_s</k>
-<v>423470</v>
+<v>423321</v>
 </e>
 <e>
 <k>@cil_ldc_i4</k>
-<v>511017</v>
+<v>510838</v>
 </e>
 <e>
 <k>@cil_ldc_i8</k>
-<v>4888</v>
+<v>4886</v>
 </e>
 <e>
 <k>@cil_ldc_r4</k>
-<v>10265</v>
+<v>10261</v>
 </e>
 <e>
 <k>@cil_ldc_r8</k>
-<v>10333</v>
+<v>10329</v>
 </e>
 <e>
 <k>@cil_dup</k>
-<v>842461</v>
+<v>842166</v>
 </e>
 <e>
 <k>@cil_pop</k>
-<v>256547</v>
+<v>256457</v>
 </e>
 <e>
 <k>@cil_jmp</k>
@@ -1085,7 +1089,7 @@
 </e>
 <e>
 <k>@cil_call</k>
-<v>2742696</v>
+<v>2741733</v>
 </e>
 <e>
 <k>@cil_calli</k>
@@ -1093,55 +1097,55 @@
 </e>
 <e>
 <k>@cil_ret</k>
-<v>1787248</v>
+<v>1786621</v>
 </e>
 <e>
 <k>@cil_br_s</k>
-<v>345973</v>
+<v>345852</v>
 </e>
 <e>
 <k>@cil_brfalse_s</k>
-<v>466175</v>
+<v>466011</v>
 </e>
 <e>
 <k>@cil_brtrue_s</k>
-<v>430900</v>
+<v>430749</v>
 </e>
 <e>
 <k>@cil_beq_s</k>
-<v>82297</v>
+<v>82268</v>
 </e>
 <e>
 <k>@cil_bge_s</k>
-<v>34942</v>
+<v>34930</v>
 </e>
 <e>
 <k>@cil_bgt_s</k>
-<v>16505</v>
+<v>16499</v>
 </e>
 <e>
 <k>@cil_ble_s</k>
-<v>29214</v>
+<v>29204</v>
 </e>
 <e>
 <k>@cil_blt_s</k>
-<v>60962</v>
+<v>60940</v>
 </e>
 <e>
 <k>@cil_bne_un_s</k>
-<v>102706</v>
+<v>102669</v>
 </e>
 <e>
 <k>@cil_bge_un_s</k>
-<v>2185</v>
+<v>2184</v>
 </e>
 <e>
 <k>@cil_bgt_un_s</k>
-<v>8738</v>
+<v>8735</v>
 </e>
 <e>
 <k>@cil_ble_un_s</k>
-<v>6123</v>
+<v>6120</v>
 </e>
 <e>
 <k>@cil_blt_un_s</k>
@@ -1149,19 +1153,19 @@
 </e>
 <e>
 <k>@cil_br</k>
-<v>96202</v>
+<v>96168</v>
 </e>
 <e>
 <k>@cil_brfalse</k>
-<v>32410</v>
+<v>32399</v>
 </e>
 <e>
 <k>@cil_brtrue</k>
-<v>27346</v>
+<v>27336</v>
 </e>
 <e>
 <k>@cil_beq</k>
-<v>21520</v>
+<v>21513</v>
 </e>
 <e>
 <k>@cil_bge</k>
@@ -1173,15 +1177,15 @@
 </e>
 <e>
 <k>@cil_ble</k>
-<v>4644</v>
+<v>4643</v>
 </e>
 <e>
 <k>@cil_blt</k>
-<v>7937</v>
+<v>7935</v>
 </e>
 <e>
 <k>@cil_bne_un</k>
-<v>7240</v>
+<v>7237</v>
 </e>
 <e>
 <k>@cil_bge_un</k>
@@ -1201,7 +1205,7 @@
 </e>
 <e>
 <k>@cil_switch</k>
-<v>23892</v>
+<v>23883</v>
 </e>
 <e>
 <k>@cil_ldind_i1</k>
@@ -1209,7 +1213,7 @@
 </e>
 <e>
 <k>@cil_ldind_u1</k>
-<v>5513</v>
+<v>5511</v>
 </e>
 <e>
 <k>@cil_ldind_i2</k>
@@ -1217,19 +1221,19 @@
 </e>
 <e>
 <k>@cil_ldind_u2</k>
-<v>2445</v>
+<v>2444</v>
 </e>
 <e>
 <k>@cil_ldind_i4</k>
-<v>9782</v>
+<v>9778</v>
 </e>
 <e>
 <k>@cil_ldind_u4</k>
-<v>1483</v>
+<v>1482</v>
 </e>
 <e>
 <k>@cil_ldind_i8</k>
-<v>1971</v>
+<v>1970</v>
 </e>
 <e>
 <k>@cil_ldind_i</k>
@@ -1245,15 +1249,15 @@
 </e>
 <e>
 <k>@cil_ldind_ref</k>
-<v>6659</v>
+<v>6657</v>
 </e>
 <e>
 <k>@cil_stind_ref</k>
-<v>16944</v>
+<v>16938</v>
 </e>
 <e>
 <k>@cil_stind_i1</k>
-<v>8528</v>
+<v>8525</v>
 </e>
 <e>
 <k>@cil_stind_i2</k>
@@ -1261,11 +1265,11 @@
 </e>
 <e>
 <k>@cil_stind_i4</k>
-<v>10367</v>
+<v>10364</v>
 </e>
 <e>
 <k>@cil_stind_i8</k>
-<v>2346</v>
+<v>2345</v>
 </e>
 <e>
 <k>@cil_stind_r4</k>
@@ -1277,19 +1281,19 @@
 </e>
 <e>
 <k>@cil_add</k>
-<v>224093</v>
+<v>224014</v>
 </e>
 <e>
 <k>@cil_sub</k>
-<v>85327</v>
+<v>85297</v>
 </e>
 <e>
 <k>@cil_mul</k>
-<v>29966</v>
+<v>29955</v>
 </e>
 <e>
 <k>@cil_div</k>
-<v>9128</v>
+<v>9125</v>
 </e>
 <e>
 <k>@cil_div_un</k>
@@ -1297,7 +1301,7 @@
 </e>
 <e>
 <k>@cil_rem</k>
-<v>3410</v>
+<v>3409</v>
 </e>
 <e>
 <k>@cil_rem_un</k>
@@ -1305,27 +1309,27 @@
 </e>
 <e>
 <k>@cil_and</k>
-<v>59366</v>
+<v>59345</v>
 </e>
 <e>
 <k>@cil_or</k>
-<v>22160</v>
+<v>22152</v>
 </e>
 <e>
 <k>@cil_xor</k>
-<v>22725</v>
+<v>22718</v>
 </e>
 <e>
 <k>@cil_shl</k>
-<v>18978</v>
+<v>18972</v>
 </e>
 <e>
 <k>@cil_shr</k>
-<v>9182</v>
+<v>9178</v>
 </e>
 <e>
 <k>@cil_shr_un</k>
-<v>26121</v>
+<v>26112</v>
 </e>
 <e>
 <k>@cil_neg</k>
@@ -1341,35 +1345,35 @@
 </e>
 <e>
 <k>@cil_conv_i2</k>
-<v>1449</v>
+<v>1448</v>
 </e>
 <e>
 <k>@cil_conv_i4</k>
-<v>59810</v>
+<v>59789</v>
 </e>
 <e>
 <k>@cil_conv_i8</k>
-<v>50316</v>
+<v>50298</v>
 </e>
 <e>
 <k>@cil_conv_r4</k>
-<v>2468</v>
+<v>2467</v>
 </e>
 <e>
 <k>@cil_conv_r8</k>
-<v>5283</v>
+<v>5282</v>
 </e>
 <e>
 <k>@cil_conv_u4</k>
-<v>7835</v>
+<v>7832</v>
 </e>
 <e>
 <k>@cil_conv_u8</k>
-<v>19554</v>
+<v>19547</v>
 </e>
 <e>
 <k>@cil_callvirt</k>
-<v>2051495</v>
+<v>2050775</v>
 </e>
 <e>
 <k>@cil_cpobj</k>
@@ -1377,23 +1381,23 @@
 </e>
 <e>
 <k>@cil_ldobj</k>
-<v>12660</v>
+<v>12656</v>
 </e>
 <e>
 <k>@cil_ldstr</k>
-<v>927237</v>
+<v>926912</v>
 </e>
 <e>
 <k>@cil_newobj</k>
-<v>657419</v>
+<v>657188</v>
 </e>
 <e>
 <k>@cil_castclass</k>
-<v>97119</v>
+<v>97085</v>
 </e>
 <e>
 <k>@cil_isinst</k>
-<v>56478</v>
+<v>56458</v>
 </e>
 <e>
 <k>@cil_conv_r_un</k>
@@ -1405,35 +1409,35 @@
 </e>
 <e>
 <k>@cil_throw</k>
-<v>381428</v>
+<v>381294</v>
 </e>
 <e>
 <k>@cil_ldfld</k>
-<v>1677585</v>
+<v>1676996</v>
 </e>
 <e>
 <k>@cil_ldflda</k>
-<v>300863</v>
+<v>300757</v>
 </e>
 <e>
 <k>@cil_stfld</k>
-<v>1073663</v>
+<v>1073286</v>
 </e>
 <e>
 <k>@cil_ldsfld</k>
-<v>407555</v>
+<v>407412</v>
 </e>
 <e>
 <k>@cil_ldsflda</k>
-<v>2532</v>
+<v>2531</v>
 </e>
 <e>
 <k>@cil_stsfld</k>
-<v>130989</v>
+<v>130943</v>
 </e>
 <e>
 <k>@cil_stobj</k>
-<v>7025</v>
+<v>7023</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1_un</k>
@@ -1477,19 +1481,19 @@
 </e>
 <e>
 <k>@cil_box</k>
-<v>79882</v>
+<v>79854</v>
 </e>
 <e>
 <k>@cil_newarr</k>
-<v>112171</v>
+<v>112131</v>
 </e>
 <e>
 <k>@cil_ldlen</k>
-<v>55361</v>
+<v>55341</v>
 </e>
 <e>
 <k>@cil_ldelema</k>
-<v>9874</v>
+<v>9871</v>
 </e>
 <e>
 <k>@cil_ldelem_i1</k>
@@ -1497,7 +1501,7 @@
 </e>
 <e>
 <k>@cil_ldelem_u1</k>
-<v>15583</v>
+<v>15577</v>
 </e>
 <e>
 <k>@cil_ldelem_i2</k>
@@ -1505,19 +1509,19 @@
 </e>
 <e>
 <k>@cil_ldelem_u2</k>
-<v>6093</v>
+<v>6091</v>
 </e>
 <e>
 <k>@cil_ldelem_i4</k>
-<v>17593</v>
+<v>17587</v>
 </e>
 <e>
 <k>@cil_ldelem_u4</k>
-<v>19125</v>
+<v>19118</v>
 </e>
 <e>
 <k>@cil_ldelem_i8</k>
-<v>11928</v>
+<v>11924</v>
 </e>
 <e>
 <k>@cil_ldelem_i</k>
@@ -1533,7 +1537,7 @@
 </e>
 <e>
 <k>@cil_ldelem_ref</k>
-<v>30717</v>
+<v>30706</v>
 </e>
 <e>
 <k>@cil_stelem_i</k>
@@ -1541,43 +1545,43 @@
 </e>
 <e>
 <k>@cil_stelem_i1</k>
-<v>8796</v>
+<v>8793</v>
 </e>
 <e>
 <k>@cil_stelem_i2</k>
-<v>8991</v>
+<v>8988</v>
 </e>
 <e>
 <k>@cil_stelem_i4</k>
-<v>22838</v>
+<v>22830</v>
 </e>
 <e>
 <k>@cil_stelem_i8</k>
-<v>9430</v>
+<v>9427</v>
 </e>
 <e>
 <k>@cil_stelem_r4</k>
-<v>200</v>
+<v>199</v>
 </e>
 <e>
 <k>@cil_stelem_r8</k>
-<v>478</v>
+<v>477</v>
 </e>
 <e>
 <k>@cil_stelem_ref</k>
-<v>363142</v>
+<v>363015</v>
 </e>
 <e>
 <k>@cil_ldelem</k>
-<v>2278</v>
+<v>2277</v>
 </e>
 <e>
 <k>@cil_stelem</k>
-<v>53648</v>
+<v>53629</v>
 </e>
 <e>
 <k>@cil_unbox_any</k>
-<v>14397</v>
+<v>14392</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1</k>
@@ -1625,19 +1629,19 @@
 </e>
 <e>
 <k>@cil_ldtoken</k>
-<v>71354</v>
+<v>71329</v>
 </e>
 <e>
 <k>@cil_conv_u2</k>
-<v>4342</v>
+<v>4340</v>
 </e>
 <e>
 <k>@cil_conv_u1</k>
-<v>11265</v>
+<v>11261</v>
 </e>
 <e>
 <k>@cil_conv_i</k>
-<v>3664</v>
+<v>3662</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i</k>
@@ -1649,7 +1653,7 @@
 </e>
 <e>
 <k>@cil_add_ovf</k>
-<v>1732</v>
+<v>1731</v>
 </e>
 <e>
 <k>@cil_add_ovf_un</k>
@@ -1673,15 +1677,15 @@
 </e>
 <e>
 <k>@cil_endfinally</k>
-<v>56932</v>
+<v>56912</v>
 </e>
 <e>
 <k>@cil_leave</k>
-<v>66899</v>
+<v>66876</v>
 </e>
 <e>
 <k>@cil_leave_s</k>
-<v>149426</v>
+<v>149374</v>
 </e>
 <e>
 <k>@cil_stind_i</k>
@@ -1689,7 +1693,7 @@
 </e>
 <e>
 <k>@cil_conv_u</k>
-<v>5811</v>
+<v>5809</v>
 </e>
 <e>
 <k>@cil_arglist</k>
@@ -1697,19 +1701,19 @@
 </e>
 <e>
 <k>@cil_ceq</k>
-<v>97023</v>
+<v>96985</v>
 </e>
 <e>
 <k>@cil_cgt</k>
-<v>11573</v>
+<v>11568</v>
 </e>
 <e>
 <k>@cil_cgt_un</k>
-<v>36728</v>
+<v>36714</v>
 </e>
 <e>
 <k>@cil_clt</k>
-<v>19532</v>
+<v>19524</v>
 </e>
 <e>
 <k>@cil_clt_un</k>
@@ -1717,7 +1721,7 @@
 </e>
 <e>
 <k>@cil_ldftn</k>
-<v>79975</v>
+<v>79947</v>
 </e>
 <e>
 <k>@cil_ldvirtftn</k>
@@ -1761,7 +1765,7 @@
 </e>
 <e>
 <k>@cil_volatile</k>
-<v>8542</v>
+<v>8539</v>
 </e>
 <e>
 <k>@cil_tail</k>
@@ -1769,11 +1773,11 @@
 </e>
 <e>
 <k>@cil_initobj</k>
-<v>101832</v>
+<v>101796</v>
 </e>
 <e>
 <k>@cil_constrained</k>
-<v>25326</v>
+<v>25317</v>
 </e>
 <e>
 <k>@cil_cpblk</k>
@@ -1785,11 +1789,11 @@
 </e>
 <e>
 <k>@cil_rethrow</k>
-<v>3771</v>
+<v>3770</v>
 </e>
 <e>
 <k>@cil_sizeof</k>
-<v>1732</v>
+<v>1731</v>
 </e>
 <e>
 <k>@cil_refanytype</k>
@@ -1801,15 +1805,15 @@
 </e>
 <e>
 <k>@cil_valueorreftype</k>
-<v>596227</v>
+<v>596018</v>
 </e>
 <e>
 <k>@cil_typeparameter</k>
-<v>185066</v>
+<v>185002</v>
 </e>
 <e>
 <k>@cil_array_type</k>
-<v>14192</v>
+<v>14187</v>
 </e>
 <e>
 <k>@cil_pointer_type</k>
@@ -1817,35 +1821,35 @@
 </e>
 <e>
 <k>@cil_method</k>
-<v>2315674</v>
+<v>2314861</v>
 </e>
 <e>
 <k>@cil_method_implementation</k>
-<v>1728633</v>
+<v>1728026</v>
 </e>
 <e>
 <k>@cil_field</k>
-<v>1010023</v>
+<v>1009668</v>
 </e>
 <e>
 <k>@cil_parameter</k>
-<v>4554173</v>
+<v>4552575</v>
 </e>
 <e>
 <k>@cil_property</k>
-<v>380540</v>
+<v>380407</v>
 </e>
 <e>
 <k>@cil_event</k>
-<v>20876</v>
+<v>20869</v>
 </e>
 <e>
 <k>@cil_local_variable</k>
-<v>1152560</v>
+<v>1152156</v>
 </e>
 <e>
 <k>@cil_catch_handler</k>
-<v>43880</v>
+<v>43865</v>
 </e>
 <e>
 <k>@cil_filter_handler</k>
@@ -1853,15 +1857,15 @@
 </e>
 <e>
 <k>@cil_finally_handler</k>
-<v>55458</v>
+<v>55439</v>
 </e>
 <e>
 <k>@cil_fault_handler</k>
-<v>1473</v>
+<v>1472</v>
 </e>
 <e>
 <k>@cil_attribute</k>
-<v>328819</v>
+<v>328703</v>
 </e>
 </typesizes>
   <stats><relation>
@@ -1919,7 +1923,7 @@
 </relation>
 <relation>
 <name>compilation_args</name>
-<cardinality>4630</cardinality>
+<cardinality>4896</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -1931,7 +1935,7 @@
 </e>
 <e>
 <k>arg</k>
-<v>1122</v>
+<v>1121</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1945,12 +1949,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>858</v>
+<v>590</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>239</v>
+<v>507</v>
 </b>
 </bs>
 </hist>
@@ -1966,12 +1970,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>858</v>
+<v>590</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>239</v>
+<v>507</v>
 </b>
 </bs>
 </hist>
@@ -1985,8 +1989,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>49</a>
-<b>50</b>
+<a>104</a>
+<b>105</b>
 <v>4</v>
 </b>
 <b>
@@ -2011,13 +2015,13 @@
 <v>14</v>
 </b>
 <b>
-<a>49</a>
-<b>50</b>
+<a>104</a>
+<b>105</b>
 <v>4</v>
 </b>
 <b>
-<a>177</a>
-<b>178</b>
+<a>122</a>
+<b>123</b>
 <v>4</v>
 </b>
 </bs>
@@ -2037,7 +2041,7 @@
 <v>1097</v>
 </b>
 <b>
-<a>49</a>
+<a>104</a>
 <b>226</b>
 <v>24</v>
 </b>
@@ -2070,7 +2074,7 @@
 </relation>
 <relation>
 <name>compilation_compiling_files</name>
-<cardinality>22623</cardinality>
+<cardinality>22615</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -2082,7 +2086,7 @@
 </e>
 <e>
 <k>file</k>
-<v>22618</v>
+<v>22610</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2420,7 +2424,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22613</v>
+<v>22605</v>
 </b>
 <b>
 <a>2</a>
@@ -2441,7 +2445,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22613</v>
+<v>22605</v>
 </b>
 <b>
 <a>2</a>
@@ -2456,7 +2460,7 @@
 </relation>
 <relation>
 <name>compilation_referencing_files</name>
-<cardinality>359873</cardinality>
+<cardinality>359747</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -2464,11 +2468,11 @@
 </e>
 <e>
 <k>num</k>
-<v>2746</v>
+<v>2745</v>
 </e>
 <e>
 <k>file</k>
-<v>3420</v>
+<v>3418</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2659,7 +2663,7 @@
 <b>
 <a>222</a>
 <b>223</b>
-<v>639</v>
+<v>638</v>
 </b>
 <b>
 <a>224</a>
@@ -2689,58 +2693,63 @@
 </b>
 <b>
 <a>4</a>
+<b>5</b>
+<v>9</v>
+</b>
+<b>
+<a>5</a>
 <b>6</b>
-<v>239</v>
+<v>575</v>
 </b>
 <b>
 <a>6</a>
-<b>7</b>
-<v>468</v>
-</b>
-<b>
-<a>7</a>
-<b>20</b>
-<v>219</v>
-</b>
-<b>
-<a>20</a>
-<b>25</b>
-<v>209</v>
-</b>
-<b>
-<a>25</a>
-<b>30</b>
+<b>16</b>
 <v>229</v>
 </b>
 <b>
+<a>16</a>
+<b>22</b>
+<v>219</v>
+</b>
+<b>
+<a>22</a>
+<b>30</b>
+<v>243</v>
+</b>
+<b>
 <a>30</a>
-<b>36</b>
+<b>34</b>
+<v>219</v>
+</b>
+<b>
+<a>34</a>
+<b>44</b>
 <v>209</v>
 </b>
 <b>
-<a>36</a>
-<b>47</b>
-<v>209</v>
+<a>44</a>
+<b>56</b>
+<v>214</v>
 </b>
 <b>
-<a>47</a>
-<b>59</b>
-<v>253</v>
+<a>56</a>
+<b>62</b>
+<v>204</v>
 </b>
 <b>
-<a>59</a>
-<b>61</b>
-<v>185</v>
-</b>
-<b>
-<a>61</a>
+<a>62</a>
 <b>64</b>
-<v>209</v>
+<v>175</v>
 </b>
 <b>
 <a>64</a>
-<b>69</b>
-<v>92</v>
+<b>68</b>
+<v>209</v>
+</b>
+<b>
+<a>68</a>
+<b>70</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -2801,12 +2810,12 @@
 <b>
 <a>222</a>
 <b>223</b>
-<v>483</v>
+<v>482</v>
 </b>
 <b>
 <a>224</a>
 <b>225</b>
-<v>717</v>
+<v>716</v>
 </b>
 </bs>
 </hist>
@@ -2822,67 +2831,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>561</v>
+<v>560</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>258</v>
+<v>302</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>190</v>
+<v>199</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>312</v>
+<v>258</v>
 </b>
 <b>
 <a>7</a>
-<b>10</b>
-<v>258</v>
-</b>
-<b>
-<a>10</a>
-<b>18</b>
-<v>268</v>
-</b>
-<b>
-<a>18</a>
-<b>22</b>
-<v>243</v>
-</b>
-<b>
-<a>22</a>
-<b>26</b>
-<v>268</v>
-</b>
-<b>
-<a>26</a>
-<b>38</b>
-<v>258</v>
-</b>
-<b>
-<a>38</a>
-<b>61</b>
-<v>253</v>
-</b>
-<b>
-<a>61</a>
-<b>64</b>
+<b>11</b>
 <v>273</v>
 </b>
 <b>
-<a>64</a>
-<b>69</b>
+<a>11</a>
+<b>20</b>
+<v>312</v>
+</b>
+<b>
+<a>20</a>
+<b>25</b>
 <v>258</v>
 </b>
 <b>
-<a>69</a>
-<b>72</b>
-<v>14</v>
+<a>25</a>
+<b>30</b>
+<v>297</v>
+</b>
+<b>
+<a>30</a>
+<b>60</b>
+<v>282</v>
+</b>
+<b>
+<a>60</a>
+<b>63</b>
+<v>278</v>
+</b>
+<b>
+<a>63</a>
+<b>66</b>
+<v>268</v>
+</b>
+<b>
+<a>66</a>
+<b>74</b>
+<v>126</v>
 </b>
 </bs>
 </hist>
@@ -2892,7 +2896,7 @@
 </relation>
 <relation>
 <name>compilation_time</name>
-<cardinality>7684</cardinality>
+<cardinality>7681</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -2908,7 +2912,7 @@
 </e>
 <e>
 <k>seconds</k>
-<v>5298</v>
+<v>5662</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2952,14 +2956,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>6</a>
-<b>7</b>
-<v>4</v>
-</b>
-<b>
 <a>7</a>
 <b>8</b>
-<v>1092</v>
+<v>1097</v>
 </b>
 </bs>
 </hist>
@@ -3005,8 +3004,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1086</a>
-<b>1087</b>
+<a>1161</a>
+<b>1162</b>
 <v>4</v>
 </b>
 </bs>
@@ -3053,23 +3052,23 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>149</a>
-<b>150</b>
+<a>165</a>
+<b>166</b>
 <v>4</v>
 </b>
 <b>
-<a>152</a>
-<b>153</b>
+<a>169</a>
+<b>170</b>
 <v>4</v>
 </b>
 <b>
-<a>167</a>
-<b>168</b>
+<a>174</a>
+<b>175</b>
 <v>4</v>
 </b>
 <b>
-<a>170</a>
-<b>171</b>
+<a>178</a>
+<b>179</b>
 <v>4</v>
 </b>
 <b>
@@ -3091,22 +3090,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4142</v>
+<v>4506</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>502</v>
+<v>599</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
-<v>351</v>
+<b>5</b>
+<v>507</v>
 </b>
 <b>
-<a>4</a>
-<b>10</b>
-<v>302</v>
+<a>5</a>
+<b>7</b>
+<v>48</v>
 </b>
 </bs>
 </hist>
@@ -3122,7 +3121,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5298</v>
+<v>5662</v>
 </b>
 </bs>
 </hist>
@@ -3138,17 +3137,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4376</v>
+<v>4818</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>756</v>
+<v>712</v>
 </b>
 <b>
 <a>3</a>
-<b>5</b>
-<v>165</v>
+<b>4</b>
+<v>131</v>
 </b>
 </bs>
 </hist>
@@ -4391,11 +4390,11 @@
 </relation>
 <relation>
 <name>extractor_messages</name>
-<cardinality>7682</cardinality>
+<cardinality>7617</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>7682</v>
+<v>7617</v>
 </e>
 <e>
 <k>severity</k>
@@ -4411,15 +4410,15 @@
 </e>
 <e>
 <k>entity</k>
-<v>5342</v>
+<v>5295</v>
 </e>
 <e>
 <k>location</k>
-<v>6759</v>
+<v>6703</v>
 </e>
 <e>
 <k>stack_trace</k>
-<v>279</v>
+<v>306</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -4433,7 +4432,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7682</v>
+<v>7617</v>
 </b>
 </bs>
 </hist>
@@ -4449,7 +4448,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7682</v>
+<v>7617</v>
 </b>
 </bs>
 </hist>
@@ -4465,7 +4464,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7682</v>
+<v>7617</v>
 </b>
 </bs>
 </hist>
@@ -4481,7 +4480,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7682</v>
+<v>7617</v>
 </b>
 </bs>
 </hist>
@@ -4497,7 +4496,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7682</v>
+<v>7617</v>
 </b>
 </bs>
 </hist>
@@ -4513,7 +4512,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7682</v>
+<v>7617</v>
 </b>
 </bs>
 </hist>
@@ -4537,8 +4536,8 @@
 <v>1</v>
 </b>
 <b>
-<a>7653</a>
-<b>7654</b>
+<a>7588</a>
+<b>7589</b>
 <v>1</v>
 </b>
 </bs>
@@ -4600,8 +4599,8 @@
 <v>1</v>
 </b>
 <b>
-<a>5336</a>
-<b>5337</b>
+<a>5289</a>
+<b>5290</b>
 <v>1</v>
 </b>
 </bs>
@@ -4626,8 +4625,8 @@
 <v>1</v>
 </b>
 <b>
-<a>6747</a>
-<b>6748</b>
+<a>6691</a>
+<b>6692</b>
 <v>1</v>
 </b>
 </bs>
@@ -4647,8 +4646,8 @@
 <v>2</v>
 </b>
 <b>
-<a>278</a>
-<b>279</b>
+<a>305</a>
+<b>306</b>
 <v>1</v>
 </b>
 </bs>
@@ -4663,8 +4662,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>7682</a>
-<b>7683</b>
+<a>7617</a>
+<b>7618</b>
 <v>1</v>
 </b>
 </bs>
@@ -4711,8 +4710,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>5342</a>
-<b>5343</b>
+<a>5295</a>
+<b>5296</b>
 <v>1</v>
 </b>
 </bs>
@@ -4727,8 +4726,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>6759</a>
-<b>6760</b>
+<a>6703</a>
+<b>6704</b>
 <v>1</v>
 </b>
 </bs>
@@ -4743,8 +4742,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>279</a>
-<b>280</b>
+<a>306</a>
+<b>307</b>
 <v>1</v>
 </b>
 </bs>
@@ -4779,6 +4778,11 @@
 <v>1</v>
 </b>
 <b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+<b>
 <a>24</a>
 <b>25</b>
 <v>1</v>
@@ -4789,11 +4793,6 @@
 <v>1</v>
 </b>
 <b>
-<a>87</a>
-<b>88</b>
-<v>1</v>
-</b>
-<b>
 <a>104</a>
 <b>105</b>
 <v>1</v>
@@ -4804,13 +4803,13 @@
 <v>1</v>
 </b>
 <b>
-<a>326</a>
-<b>327</b>
+<a>324</a>
+<b>325</b>
 <v>1</v>
 </b>
 <b>
-<a>2411</a>
-<b>2412</b>
+<a>2413</a>
+<b>2414</b>
 <v>1</v>
 </b>
 <b>
@@ -4882,6 +4881,11 @@
 <v>1</v>
 </b>
 <b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+<b>
 <a>47</a>
 <b>48</b>
 <v>1</v>
@@ -4892,18 +4896,13 @@
 <v>1</v>
 </b>
 <b>
-<a>69</a>
-<b>70</b>
+<a>274</a>
+<b>275</b>
 <v>1</v>
 </b>
 <b>
-<a>275</a>
-<b>276</b>
-<v>1</v>
-</b>
-<b>
-<a>1647</a>
-<b>1648</b>
+<a>1648</a>
+<b>1649</b>
 <v>1</v>
 </b>
 <b>
@@ -4943,8 +4942,8 @@
 <v>1</v>
 </b>
 <b>
-<a>78</a>
-<b>79</b>
+<a>22</a>
+<b>23</b>
 <v>1</v>
 </b>
 <b>
@@ -4958,13 +4957,13 @@
 <v>1</v>
 </b>
 <b>
-<a>326</a>
-<b>327</b>
+<a>324</a>
+<b>325</b>
 <v>1</v>
 </b>
 <b>
-<a>2017</a>
-<b>2018</b>
+<a>2019</a>
+<b>2020</b>
 <v>1</v>
 </b>
 <b>
@@ -4989,14 +4988,14 @@
 <v>4</v>
 </b>
 <b>
-<a>3</a>
-<b>4</b>
-<v>2</v>
+<a>2</a>
+<b>3</b>
+<v>1</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1</v>
+<v>2</v>
 </b>
 <b>
 <a>5</a>
@@ -5004,18 +5003,18 @@
 <v>1</v>
 </b>
 <b>
-<a>10</a>
-<b>11</b>
+<a>11</a>
+<b>12</b>
 <v>2</v>
 </b>
 <b>
-<a>71</a>
-<b>72</b>
+<a>70</a>
+<b>71</b>
 <v>1</v>
 </b>
 <b>
-<a>170</a>
-<b>171</b>
+<a>196</a>
+<b>197</b>
 <v>1</v>
 </b>
 </bs>
@@ -5032,17 +5031,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4254</v>
+<v>4214</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>797</v>
+<v>792</v>
 </b>
 <b>
 <a>3</a>
 <b>133</b>
-<v>291</v>
+<v>289</v>
 </b>
 </bs>
 </hist>
@@ -5058,7 +5057,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5342</v>
+<v>5295</v>
 </b>
 </bs>
 </hist>
@@ -5074,7 +5073,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5342</v>
+<v>5295</v>
 </b>
 </bs>
 </hist>
@@ -5090,7 +5089,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5333</v>
+<v>5286</v>
 </b>
 <b>
 <a>2</a>
@@ -5111,17 +5110,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4654</v>
+<v>4611</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>480</v>
+<v>478</v>
 </b>
 <b>
 <a>3</a>
 <b>67</b>
-<v>208</v>
+<v>206</v>
 </b>
 </bs>
 </hist>
@@ -5137,12 +5136,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5239</v>
+<v>5143</v>
 </b>
 <b>
 <a>2</a>
-<b>7</b>
-<v>103</v>
+<b>8</b>
+<v>152</v>
 </b>
 </bs>
 </hist>
@@ -5158,12 +5157,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5847</v>
+<v>5800</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>911</v>
+<v>902</v>
 </b>
 <b>
 <a>13</a>
@@ -5184,7 +5183,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6758</v>
+<v>6702</v>
 </b>
 <b>
 <a>2</a>
@@ -5205,7 +5204,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6759</v>
+<v>6703</v>
 </b>
 </bs>
 </hist>
@@ -5221,7 +5220,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6758</v>
+<v>6702</v>
 </b>
 <b>
 <a>2</a>
@@ -5242,7 +5241,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6758</v>
+<v>6702</v>
 </b>
 <b>
 <a>2</a>
@@ -5263,12 +5262,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6736</v>
+<v>6595</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>23</v>
+<v>108</v>
 </b>
 </bs>
 </hist>
@@ -5284,47 +5283,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85</v>
+<v>93</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48</v>
+<v>50</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>24</v>
+<v>23</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>23</v>
+<v>20</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>18</v>
-</b>
-<b>
-<a>8</a>
-<b>11</b>
 <v>23</v>
 </b>
 <b>
-<a>11</a>
-<b>30</b>
-<v>21</v>
+<a>8</a>
+<b>12</b>
+<v>25</v>
 </b>
 <b>
-<a>30</a>
-<b>88</b>
-<v>21</v>
+<a>12</a>
+<b>22</b>
+<v>23</v>
 </b>
 <b>
-<a>93</a>
-<b>1003</b>
-<v>16</v>
+<a>22</a>
+<b>61</b>
+<v>23</v>
+</b>
+<b>
+<a>63</a>
+<b>435</b>
+<v>23</v>
+</b>
+<b>
+<a>474</a>
+<b>722</b>
+<v>3</v>
 </b>
 </bs>
 </hist>
@@ -5340,7 +5344,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278</v>
+<v>305</v>
 </b>
 <b>
 <a>2</a>
@@ -5361,7 +5365,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>279</v>
+<v>306</v>
 </b>
 </bs>
 </hist>
@@ -5377,7 +5381,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278</v>
+<v>305</v>
 </b>
 <b>
 <a>2</a>
@@ -5398,42 +5402,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100</v>
+<v>107</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47</v>
+<v>46</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>26</v>
+<v>23</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>25</v>
+<v>26</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>25</v>
+<v>26</v>
 </b>
 <b>
 <a>9</a>
-<b>21</b>
-<v>21</v>
+<b>13</b>
+<v>26</v>
 </b>
 <b>
-<a>22</a>
-<b>70</b>
-<v>21</v>
+<a>13</a>
+<b>37</b>
+<v>23</v>
 </b>
 <b>
-<a>71</a>
-<b>808</b>
-<v>14</v>
+<a>38</a>
+<b>223</b>
+<v>23</v>
+</b>
+<b>
+<a>231</a>
+<b>577</b>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -5449,47 +5458,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94</v>
+<v>101</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44</v>
+<v>47</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>27</v>
+<v>26</v>
 </b>
 <b>
 <a>4</a>
-<b>6</b>
-<v>25</v>
+<b>7</b>
+<v>28</v>
 </b>
 <b>
-<a>6</a>
-<b>9</b>
-<v>22</v>
+<a>7</a>
+<b>11</b>
+<v>26</v>
 </b>
 <b>
-<a>9</a>
-<b>14</b>
-<v>24</v>
+<a>11</a>
+<b>17</b>
+<v>26</v>
 </b>
 <b>
-<a>14</a>
-<b>66</b>
-<v>21</v>
+<a>17</a>
+<b>55</b>
+<v>23</v>
 </b>
 <b>
-<a>68</a>
-<b>596</b>
-<v>21</v>
+<a>55</a>
+<b>275</b>
+<v>23</v>
 </b>
 <b>
-<a>1002</a>
-<b>1003</b>
-<v>1</v>
+<a>277</a>
+<b>722</b>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -5507,7 +5516,7 @@
 </e>
 <e>
 <k>cpu_seconds</k>
-<v>936</v>
+<v>985</v>
 </e>
 <e>
 <k>elapsed_seconds</k>
@@ -5557,17 +5566,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>805</v>
+<v>873</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>107</v>
-</b>
-<b>
-<a>3</a>
-<b>5</b>
-<v>24</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -5583,17 +5587,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>805</v>
+<v>873</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>107</v>
-</b>
-<b>
-<a>3</a>
-<b>5</b>
-<v>24</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -6335,19 +6334,19 @@
 </relation>
 <relation>
 <name>duplicateCode</name>
-<cardinality>22774</cardinality>
+<cardinality>22766</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>22774</v>
+<v>22766</v>
 </e>
 <e>
 <k>relativePath</k>
-<v>3810</v>
+<v>3809</v>
 </e>
 <e>
 <k>equivClass</k>
-<v>7020</v>
+<v>7018</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -6361,7 +6360,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22774</v>
+<v>22766</v>
 </b>
 </bs>
 </hist>
@@ -6377,7 +6376,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22774</v>
+<v>22766</v>
 </b>
 </bs>
 </hist>
@@ -6459,7 +6458,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>522</v>
+<v>521</v>
 </b>
 <b>
 <a>3</a>
@@ -6515,7 +6514,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3771</v>
+<v>3770</v>
 </b>
 <b>
 <a>3</a>
@@ -6556,22 +6555,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>678</v>
+<v>677</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3444</v>
+<v>3443</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1078</v>
+<v>1077</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>678</v>
+<v>677</v>
 </b>
 <b>
 <a>5</a>
@@ -8664,11 +8663,11 @@
 </relation>
 <relation>
 <name>locations_default</name>
-<cardinality>14071854</cardinality>
+<cardinality>14072002</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14071854</v>
+<v>14072002</v>
 </e>
 <e>
 <k>file</k>
@@ -8702,7 +8701,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071854</v>
+<v>14072002</v>
 </b>
 </bs>
 </hist>
@@ -8718,7 +8717,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071854</v>
+<v>14072002</v>
 </b>
 </bs>
 </hist>
@@ -8734,7 +8733,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071854</v>
+<v>14072002</v>
 </b>
 </bs>
 </hist>
@@ -8750,7 +8749,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071854</v>
+<v>14072002</v>
 </b>
 </bs>
 </hist>
@@ -8766,7 +8765,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071854</v>
+<v>14072002</v>
 </b>
 </bs>
 </hist>
@@ -8969,12 +8968,12 @@
 <b>
 <a>43</a>
 <b>53</b>
-<v>484</v>
+<v>482</v>
 </b>
 <b>
 <a>53</a>
 <b>64</b>
-<v>479</v>
+<v>481</v>
 </b>
 <b>
 <a>64</a>
@@ -9226,7 +9225,7 @@
 </b>
 <b>
 <a>301</a>
-<b>10788</b>
+<b>10777</b>
 <v>9050</v>
 </b>
 </bs>
@@ -9511,12 +9510,12 @@
 </b>
 <b>
 <a>5448</a>
-<b>74973</b>
+<b>74977</b>
 <v>110</v>
 </b>
 <b>
 <a>76216</a>
-<b>2221242</b>
+<b>2221250</b>
 <v>24</v>
 </b>
 </bs>
@@ -10111,7 +10110,7 @@
 </b>
 <b>
 <a>9617</a>
-<b>82628</b>
+<b>82632</b>
 <v>124</v>
 </b>
 <b>
@@ -10882,23 +10881,23 @@
 </relation>
 <relation>
 <name>assemblies</name>
-<cardinality>4205</cardinality>
+<cardinality>4204</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4205</v>
+<v>4204</v>
 </e>
 <e>
 <k>file</k>
-<v>4205</v>
+<v>4204</v>
 </e>
 <e>
 <k>fullname</k>
-<v>3444</v>
+<v>3443</v>
 </e>
 <e>
 <k>name</k>
-<v>3176</v>
+<v>3175</v>
 </e>
 <e>
 <k>version</k>
@@ -10916,7 +10915,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4205</v>
+<v>4204</v>
 </b>
 </bs>
 </hist>
@@ -10932,7 +10931,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4205</v>
+<v>4204</v>
 </b>
 </bs>
 </hist>
@@ -10948,7 +10947,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4205</v>
+<v>4204</v>
 </b>
 </bs>
 </hist>
@@ -10964,7 +10963,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4205</v>
+<v>4204</v>
 </b>
 </bs>
 </hist>
@@ -10980,7 +10979,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4205</v>
+<v>4204</v>
 </b>
 </bs>
 </hist>
@@ -10996,7 +10995,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4205</v>
+<v>4204</v>
 </b>
 </bs>
 </hist>
@@ -11012,7 +11011,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4205</v>
+<v>4204</v>
 </b>
 </bs>
 </hist>
@@ -11028,7 +11027,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4205</v>
+<v>4204</v>
 </b>
 </bs>
 </hist>
@@ -11044,12 +11043,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2683</v>
+<v>2682</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>761</v>
+<v>760</v>
 </b>
 </bs>
 </hist>
@@ -11065,12 +11064,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2683</v>
+<v>2682</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>761</v>
+<v>760</v>
 </b>
 </bs>
 </hist>
@@ -11086,7 +11085,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3444</v>
+<v>3443</v>
 </b>
 </bs>
 </hist>
@@ -11102,7 +11101,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3444</v>
+<v>3443</v>
 </b>
 </bs>
 </hist>
@@ -11118,7 +11117,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2190</v>
+<v>2189</v>
 </b>
 <b>
 <a>2</a>
@@ -11144,7 +11143,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2190</v>
+<v>2189</v>
 </b>
 <b>
 <a>2</a>
@@ -11170,7 +11169,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2951</v>
+<v>2950</v>
 </b>
 <b>
 <a>2</a>
@@ -11191,7 +11190,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2951</v>
+<v>2950</v>
 </b>
 <b>
 <a>2</a>
@@ -11370,19 +11369,19 @@
 </relation>
 <relation>
 <name>files</name>
-<cardinality>42539</cardinality>
+<cardinality>42524</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42539</v>
+<v>42524</v>
 </e>
 <e>
 <k>name</k>
-<v>42539</v>
+<v>42524</v>
 </e>
 <e>
 <k>simple</k>
-<v>22974</v>
+<v>22966</v>
 </e>
 <e>
 <k>ext</k>
@@ -11404,7 +11403,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42539</v>
+<v>42524</v>
 </b>
 </bs>
 </hist>
@@ -11420,7 +11419,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42539</v>
+<v>42524</v>
 </b>
 </bs>
 </hist>
@@ -11436,7 +11435,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42539</v>
+<v>42524</v>
 </b>
 </bs>
 </hist>
@@ -11452,7 +11451,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42539</v>
+<v>42524</v>
 </b>
 </bs>
 </hist>
@@ -11468,7 +11467,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42539</v>
+<v>42524</v>
 </b>
 </bs>
 </hist>
@@ -11484,7 +11483,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42539</v>
+<v>42524</v>
 </b>
 </bs>
 </hist>
@@ -11500,7 +11499,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42539</v>
+<v>42524</v>
 </b>
 </bs>
 </hist>
@@ -11516,7 +11515,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42539</v>
+<v>42524</v>
 </b>
 </bs>
 </hist>
@@ -11532,12 +11531,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21564</v>
+<v>21557</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>1410</v>
+<v>1409</v>
 </b>
 </bs>
 </hist>
@@ -11553,12 +11552,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21564</v>
+<v>21557</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>1410</v>
+<v>1409</v>
 </b>
 </bs>
 </hist>
@@ -11574,7 +11573,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22184</v>
+<v>22176</v>
 </b>
 <b>
 <a>2</a>
@@ -11595,7 +11594,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22974</v>
+<v>22966</v>
 </b>
 </bs>
 </hist>
@@ -11833,15 +11832,15 @@
 </relation>
 <relation>
 <name>folders</name>
-<cardinality>16968</cardinality>
+<cardinality>16962</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16968</v>
+<v>16962</v>
 </e>
 <e>
 <k>name</k>
-<v>14748</v>
+<v>14743</v>
 </e>
 <e>
 <k>simple</k>
@@ -11859,7 +11858,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16968</v>
+<v>16962</v>
 </b>
 </bs>
 </hist>
@@ -11875,7 +11874,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16968</v>
+<v>16962</v>
 </b>
 </bs>
 </hist>
@@ -11891,7 +11890,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14748</v>
+<v>14743</v>
 </b>
 </bs>
 </hist>
@@ -11907,7 +11906,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12529</v>
+<v>12524</v>
 </b>
 <b>
 <a>2</a>
@@ -11994,15 +11993,15 @@
 </relation>
 <relation>
 <name>containerparent</name>
-<cardinality>57278</cardinality>
+<cardinality>57258</cardinality>
 <columnsizes>
 <e>
 <k>parent</k>
-<v>14748</v>
+<v>14743</v>
 </e>
 <e>
 <k>child</k>
-<v>57278</v>
+<v>57258</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12016,7 +12015,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8269</v>
+<v>8266</v>
 </b>
 <b>
 <a>2</a>
@@ -12062,7 +12061,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>57278</v>
+<v>57258</v>
 </b>
 </bs>
 </hist>
@@ -12072,11 +12071,11 @@
 </relation>
 <relation>
 <name>file_extraction_mode</name>
-<cardinality>26824</cardinality>
+<cardinality>26814</cardinality>
 <columnsizes>
 <e>
 <k>file</k>
-<v>26824</v>
+<v>26814</v>
 </e>
 <e>
 <k>mode</k>
@@ -12094,7 +12093,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26824</v>
+<v>26814</v>
 </b>
 </bs>
 </hist>
@@ -12120,15 +12119,15 @@
 </relation>
 <relation>
 <name>namespaces</name>
-<cardinality>21979</cardinality>
+<cardinality>21971</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>21979</v>
+<v>21971</v>
 </e>
 <e>
 <k>name</k>
-<v>4898</v>
+<v>4896</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12142,7 +12141,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21979</v>
+<v>21971</v>
 </b>
 </bs>
 </hist>
@@ -12163,7 +12162,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3498</v>
+<v>3496</v>
 </b>
 <b>
 <a>3</a>
@@ -12198,15 +12197,15 @@
 </relation>
 <relation>
 <name>namespace_declarations</name>
-<cardinality>19793</cardinality>
+<cardinality>19786</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19793</v>
+<v>19786</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>3893</v>
+<v>3892</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12220,7 +12219,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19793</v>
+<v>19786</v>
 </b>
 </bs>
 </hist>
@@ -12236,12 +12235,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1400</v>
+<v>1399</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>800</v>
+<v>799</v>
 </b>
 <b>
 <a>3</a>
@@ -12281,15 +12280,15 @@
 </relation>
 <relation>
 <name>namespace_declaration_location</name>
-<cardinality>19793</cardinality>
+<cardinality>19786</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19793</v>
+<v>19786</v>
 </e>
 <e>
 <k>loc</k>
-<v>19793</v>
+<v>19786</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12303,7 +12302,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19793</v>
+<v>19786</v>
 </b>
 </bs>
 </hist>
@@ -12319,7 +12318,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19793</v>
+<v>19786</v>
 </b>
 </bs>
 </hist>
@@ -12329,15 +12328,15 @@
 </relation>
 <relation>
 <name>parent_namespace</name>
-<cardinality>778386</cardinality>
+<cardinality>778113</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>778386</v>
+<v>778113</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>13578</v>
+<v>13573</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12351,7 +12350,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>778386</v>
+<v>778113</v>
 </b>
 </bs>
 </hist>
@@ -12367,12 +12366,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3332</v>
+<v>3331</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1629</v>
+<v>1628</v>
 </b>
 <b>
 <a>3</a>
@@ -12382,7 +12381,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>917</v>
+<v>916</v>
 </b>
 <b>
 <a>5</a>
@@ -12427,15 +12426,15 @@
 </relation>
 <relation>
 <name>parent_namespace_declaration</name>
-<cardinality>88454</cardinality>
+<cardinality>88423</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>87937</v>
+<v>87906</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>19793</v>
+<v>19786</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12449,7 +12448,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87786</v>
+<v>87755</v>
 </b>
 <b>
 <a>2</a>
@@ -12470,17 +12469,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13802</v>
+<v>13797</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>1717</v>
+<v>1716</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>1278</v>
+<v>1277</v>
 </b>
 <b>
 <a>13</a>
@@ -12490,7 +12489,7 @@
 <b>
 <a>16</a>
 <b>32</b>
-<v>1512</v>
+<v>1511</v>
 </b>
 <b>
 <a>32</a>
@@ -12505,15 +12504,15 @@
 </relation>
 <relation>
 <name>using_namespace_directives</name>
-<cardinality>144498</cardinality>
+<cardinality>144448</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144498</v>
+<v>144448</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>4234</v>
+<v>4233</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12527,7 +12526,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144498</v>
+<v>144448</v>
 </b>
 </bs>
 </hist>
@@ -12558,7 +12557,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>5</a>
@@ -12573,7 +12572,7 @@
 <b>
 <a>14</a>
 <b>25</b>
-<v>322</v>
+<v>321</v>
 </b>
 <b>
 <a>25</a>
@@ -12583,7 +12582,7 @@
 <b>
 <a>64</a>
 <b>465</b>
-<v>322</v>
+<v>321</v>
 </b>
 <b>
 <a>510</a>
@@ -12686,15 +12685,15 @@
 </relation>
 <relation>
 <name>using_directive_location</name>
-<cardinality>144557</cardinality>
+<cardinality>144506</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144557</v>
+<v>144506</v>
 </e>
 <e>
 <k>loc</k>
-<v>144513</v>
+<v>144462</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12708,7 +12707,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144557</v>
+<v>144506</v>
 </b>
 </bs>
 </hist>
@@ -12724,7 +12723,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144469</v>
+<v>144418</v>
 </b>
 <b>
 <a>2</a>
@@ -12739,11 +12738,11 @@
 </relation>
 <relation>
 <name>types</name>
-<cardinality>868646</cardinality>
+<cardinality>868341</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>868646</v>
+<v>868341</v>
 </e>
 <e>
 <k>kind</k>
@@ -12751,7 +12750,7 @@
 </e>
 <e>
 <k>name</k>
-<v>367484</v>
+<v>367355</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12765,7 +12764,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>868646</v>
+<v>868341</v>
 </b>
 </bs>
 </hist>
@@ -12781,7 +12780,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>868646</v>
+<v>868341</v>
 </b>
 </bs>
 </hist>
@@ -12879,17 +12878,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>325164</v>
+<v>325050</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>28888</v>
+<v>28877</v>
 </b>
 <b>
 <a>5</a>
 <b>6356</b>
-<v>13431</v>
+<v>13426</v>
 </b>
 </bs>
 </hist>
@@ -12905,12 +12904,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>366045</v>
+<v>365916</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1439</v>
+<v>1438</v>
 </b>
 </bs>
 </hist>
@@ -12920,15 +12919,15 @@
 </relation>
 <relation>
 <name>typerefs</name>
-<cardinality>235192</cardinality>
+<cardinality>235110</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235192</v>
+<v>235110</v>
 </e>
 <e>
 <k>name</k>
-<v>177285</v>
+<v>177222</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12942,7 +12941,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235192</v>
+<v>235110</v>
 </b>
 </bs>
 </hist>
@@ -12958,12 +12957,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162711</v>
+<v>162654</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>13504</v>
+<v>13500</v>
 </b>
 <b>
 <a>7</a>
@@ -12978,15 +12977,15 @@
 </relation>
 <relation>
 <name>typeref_type</name>
-<cardinality>235012</cardinality>
+<cardinality>234929</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235012</v>
+<v>234929</v>
 </e>
 <e>
 <k>typeId</k>
-<v>235012</v>
+<v>234929</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13000,7 +12999,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235012</v>
+<v>234929</v>
 </b>
 </bs>
 </hist>
@@ -13016,7 +13015,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235012</v>
+<v>234929</v>
 </b>
 </bs>
 </hist>
@@ -13026,11 +13025,11 @@
 </relation>
 <relation>
 <name>array_element_type</name>
-<cardinality>9138</cardinality>
+<cardinality>9134</cardinality>
 <columnsizes>
 <e>
 <k>array</k>
-<v>9138</v>
+<v>9134</v>
 </e>
 <e>
 <k>dimension</k>
@@ -13042,7 +13041,7 @@
 </e>
 <e>
 <k>element</k>
-<v>9128</v>
+<v>9125</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13056,7 +13055,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9138</v>
+<v>9134</v>
 </b>
 </bs>
 </hist>
@@ -13072,7 +13071,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9138</v>
+<v>9134</v>
 </b>
 </bs>
 </hist>
@@ -13088,7 +13087,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9138</v>
+<v>9134</v>
 </b>
 </bs>
 </hist>
@@ -13230,7 +13229,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9118</v>
+<v>9115</v>
 </b>
 <b>
 <a>2</a>
@@ -13251,7 +13250,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9128</v>
+<v>9125</v>
 </b>
 </bs>
 </hist>
@@ -13267,7 +13266,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9118</v>
+<v>9115</v>
 </b>
 <b>
 <a>2</a>
@@ -13378,11 +13377,11 @@
 </relation>
 <relation>
 <name>enum_underlying_type</name>
-<cardinality>11972</cardinality>
+<cardinality>11968</cardinality>
 <columnsizes>
 <e>
 <k>enum_id</k>
-<v>11972</v>
+<v>11968</v>
 </e>
 <e>
 <k>underlying_type_id</k>
@@ -13400,7 +13399,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11972</v>
+<v>11968</v>
 </b>
 </bs>
 </hist>
@@ -13456,15 +13455,15 @@
 </relation>
 <relation>
 <name>delegate_return_type</name>
-<cardinality>107736</cardinality>
+<cardinality>107698</cardinality>
 <columnsizes>
 <e>
 <k>delegate_id</k>
-<v>107736</v>
+<v>107698</v>
 </e>
 <e>
 <k>return_type_id</k>
-<v>55604</v>
+<v>55585</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13478,7 +13477,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107736</v>
+<v>107698</v>
 </b>
 </bs>
 </hist>
@@ -13494,12 +13493,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52287</v>
+<v>52268</v>
 </b>
 <b>
 <a>2</a>
 <b>4178</b>
-<v>3317</v>
+<v>3316</v>
 </b>
 </bs>
 </hist>
@@ -13509,15 +13508,15 @@
 </relation>
 <relation>
 <name>extend</name>
-<cardinality>324037</cardinality>
+<cardinality>323924</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>324037</v>
+<v>323924</v>
 </e>
 <e>
 <k>super</k>
-<v>31620</v>
+<v>31609</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13531,7 +13530,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>324037</v>
+<v>323924</v>
 </b>
 </bs>
 </hist>
@@ -13547,12 +13546,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22667</v>
+<v>22659</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3986</v>
+<v>3984</v>
 </b>
 <b>
 <a>3</a>
@@ -13588,15 +13587,15 @@
 </relation>
 <relation>
 <name>implement</name>
-<cardinality>542549</cardinality>
+<cardinality>542359</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>226737</v>
+<v>226658</v>
 </e>
 <e>
 <k>super</k>
-<v>122753</v>
+<v>122710</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13610,27 +13609,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100944</v>
+<v>100909</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>57141</v>
+<v>57121</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>36172</v>
+<v>36159</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>19003</v>
+<v>18996</v>
 </b>
 <b>
 <a>7</a>
 <b>21</b>
-<v>13475</v>
+<v>13470</v>
 </b>
 </bs>
 </hist>
@@ -13646,27 +13645,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>67065</v>
+<v>67042</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29834</v>
+<v>29824</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10265</v>
+<v>10261</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>8708</v>
+<v>8705</v>
 </b>
 <b>
 <a>6</a>
 <b>21807</b>
-<v>6879</v>
+<v>6876</v>
 </b>
 </bs>
 </hist>
@@ -13676,15 +13675,15 @@
 </relation>
 <relation>
 <name>type_location</name>
-<cardinality>554634</cardinality>
+<cardinality>554440</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>467760</v>
+<v>467596</v>
 </e>
 <e>
 <k>loc</k>
-<v>29927</v>
+<v>29916</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13698,17 +13697,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>408082</v>
+<v>407938</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39299</v>
+<v>39285</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>20379</v>
+<v>20372</v>
 </b>
 </bs>
 </hist>
@@ -13724,17 +13723,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26048</v>
+<v>26039</v>
 </b>
 <b>
 <a>2</a>
 <b>26</b>
-<v>2273</v>
+<v>2272</v>
 </b>
 <b>
 <a>26</a>
 <b>12195</b>
-<v>1605</v>
+<v>1604</v>
 </b>
 </bs>
 </hist>
@@ -13782,7 +13781,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>644</v>
+<v>643</v>
 </b>
 <b>
 <a>2</a>
@@ -13802,7 +13801,7 @@
 </relation>
 <relation>
 <name>tuple_element</name>
-<cardinality>6801</cardinality>
+<cardinality>6798</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
@@ -13814,7 +13813,7 @@
 </e>
 <e>
 <k>field</k>
-<v>6801</v>
+<v>6798</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14152,7 +14151,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6801</v>
+<v>6798</v>
 </b>
 </bs>
 </hist>
@@ -14168,7 +14167,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6801</v>
+<v>6798</v>
 </b>
 </bs>
 </hist>
@@ -14178,19 +14177,19 @@
 </relation>
 <relation>
 <name>attributes</name>
-<cardinality>750562</cardinality>
+<cardinality>750284</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>750562</v>
+<v>750284</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1688</v>
+<v>1687</v>
 </e>
 <e>
 <k>target</k>
-<v>429793</v>
+<v>429632</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14204,7 +14203,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750562</v>
+<v>750284</v>
 </b>
 </bs>
 </hist>
@@ -14220,7 +14219,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750562</v>
+<v>750284</v>
 </b>
 </bs>
 </hist>
@@ -14295,7 +14294,7 @@
 </b>
 <b>
 <a>5204</a>
-<b>41859</b>
+<b>41857</b>
 <v>19</v>
 </b>
 </bs>
@@ -14366,7 +14365,7 @@
 </b>
 <b>
 <a>562</a>
-<b>39379</b>
+<b>39377</b>
 <v>117</v>
 </b>
 </bs>
@@ -14383,17 +14382,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>366196</v>
+<v>366063</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48896</v>
+<v>48874</v>
 </b>
 <b>
 <a>3</a>
 <b>957</b>
-<v>14700</v>
+<v>14695</v>
 </b>
 </bs>
 </hist>
@@ -14409,12 +14408,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>395465</v>
+<v>395316</v>
 </b>
 <b>
 <a>2</a>
 <b>15</b>
-<v>33503</v>
+<v>33491</v>
 </b>
 <b>
 <a>15</a>
@@ -14429,15 +14428,15 @@
 </relation>
 <relation>
 <name>attribute_location</name>
-<cardinality>818735</cardinality>
+<cardinality>818433</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>750562</v>
+<v>750284</v>
 </e>
 <e>
 <k>loc</k>
-<v>72451</v>
+<v>72426</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14451,12 +14450,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>682389</v>
+<v>682135</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>68173</v>
+<v>68149</v>
 </b>
 </bs>
 </hist>
@@ -14472,12 +14471,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68241</v>
+<v>68217</v>
 </b>
 <b>
 <a>4</a>
 <b>26710</b>
-<v>4210</v>
+<v>4209</v>
 </b>
 </bs>
 </hist>
@@ -14487,19 +14486,19 @@
 </relation>
 <relation>
 <name>type_mention</name>
-<cardinality>1269461</cardinality>
+<cardinality>1268966</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1269461</v>
+<v>1268966</v>
 </e>
 <e>
 <k>type_id</k>
-<v>34464</v>
+<v>34450</v>
 </e>
 <e>
 <k>parent</k>
-<v>1028868</v>
+<v>1028466</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14513,7 +14512,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1269461</v>
+<v>1268966</v>
 </b>
 </bs>
 </hist>
@@ -14529,7 +14528,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1269461</v>
+<v>1268966</v>
 </b>
 </bs>
 </hist>
@@ -14545,52 +14544,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4965</v>
+<v>4963</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6798</v>
+<v>6796</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3385</v>
+<v>3384</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4026</v>
+<v>4025</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2097</v>
+<v>2096</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>2904</v>
+<v>2903</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>2803</v>
+<v>2802</v>
 </b>
 <b>
 <a>12</a>
 <b>20</b>
-<v>2616</v>
+<v>2615</v>
 </b>
 <b>
 <a>20</a>
 <b>51</b>
-<v>2585</v>
+<v>2584</v>
 </b>
 <b>
 <a>51</a>
-<b>82736</b>
-<v>2280</v>
+<b>82737</b>
+<v>2279</v>
 </b>
 </bs>
 </hist>
@@ -14606,52 +14605,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9468</v>
+<v>9464</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5704</v>
+<v>5702</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3312</v>
+<v>3311</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>3001</v>
+<v>3000</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1947</v>
+<v>1946</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>2515</v>
+<v>2514</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>2762</v>
+<v>2761</v>
 </b>
 <b>
 <a>13</a>
 <b>29</b>
-<v>2630</v>
+<v>2629</v>
 </b>
 <b>
 <a>29</a>
 <b>206</b>
-<v>2588</v>
+<v>2587</v>
 </b>
 <b>
 <a>206</a>
-<b>67615</b>
-<v>533</v>
+<b>67616</b>
+<v>532</v>
 </b>
 </bs>
 </hist>
@@ -14667,17 +14666,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>871125</v>
+<v>870784</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137386</v>
+<v>137333</v>
 </b>
 <b>
 <a>3</a>
 <b>342</b>
-<v>20356</v>
+<v>20348</v>
 </b>
 </bs>
 </hist>
@@ -14693,12 +14692,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1008184</v>
+<v>1007790</v>
 </b>
 <b>
 <a>2</a>
 <b>22</b>
-<v>20683</v>
+<v>20675</v>
 </b>
 </bs>
 </hist>
@@ -14708,15 +14707,15 @@
 </relation>
 <relation>
 <name>type_mention_location</name>
-<cardinality>1269461</cardinality>
+<cardinality>1268966</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1269461</v>
+<v>1268966</v>
 </e>
 <e>
 <k>loc</k>
-<v>1139970</v>
+<v>1139537</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14730,7 +14729,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1269461</v>
+<v>1268966</v>
 </b>
 </bs>
 </hist>
@@ -14746,12 +14745,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1077465</v>
+<v>1077054</v>
 </b>
 <b>
 <a>2</a>
 <b>199</b>
-<v>62504</v>
+<v>62482</v>
 </b>
 </bs>
 </hist>
@@ -14761,11 +14760,11 @@
 </relation>
 <relation>
 <name>type_annotation</name>
-<cardinality>51013</cardinality>
+<cardinality>50996</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>51013</v>
+<v>50996</v>
 </e>
 <e>
 <k>annotation</k>
@@ -14783,7 +14782,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51013</v>
+<v>50996</v>
 </b>
 </bs>
 </hist>
@@ -14819,11 +14818,11 @@
 </relation>
 <relation>
 <name>nullability</name>
-<cardinality>2000</cardinality>
+<cardinality>1999</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>2000</v>
+<v>1999</v>
 </e>
 <e>
 <k>kind</k>
@@ -14841,7 +14840,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2000</v>
+<v>1999</v>
 </b>
 </bs>
 </hist>
@@ -14877,11 +14876,11 @@
 </relation>
 <relation>
 <name>nullability_parent</name>
-<cardinality>6288</cardinality>
+<cardinality>6286</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>522</v>
+<v>521</v>
 </e>
 <e>
 <k>index</k>
@@ -15142,7 +15141,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>161</v>
+<v>160</v>
 </b>
 </bs>
 </hist>
@@ -15163,7 +15162,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>722</v>
+<v>721</v>
 </b>
 <b>
 <a>3</a>
@@ -15198,11 +15197,11 @@
 </relation>
 <relation>
 <name>type_nullability</name>
-<cardinality>4610461</cardinality>
+<cardinality>4610773</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4535975</v>
+<v>4536326</v>
 </e>
 <e>
 <k>nullability</k>
@@ -15220,12 +15219,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4470328</v>
+<v>4470716</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>65647</v>
+<v>65610</v>
 </b>
 </bs>
 </hist>
@@ -15241,32 +15240,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>161</v>
+<v>163</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>147</v>
+<v>144</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>54</v>
+<v>55</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>70</v>
+<v>69</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>85</v>
+<v>86</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>65</v>
+<v>64</v>
 </b>
 <b>
 <a>10</a>
@@ -15280,23 +15279,23 @@
 </b>
 <b>
 <a>23</a>
-<b>45</b>
-<v>75</v>
-</b>
-<b>
-<a>45</a>
-<b>123</b>
-<v>74</v>
-</b>
-<b>
-<a>124</a>
-<b>4643</b>
+<b>43</b>
 <v>73</v>
 </b>
 <b>
-<a>5100</a>
-<b>3685112</b>
-<v>10</v>
+<a>44</a>
+<b>121</b>
+<v>73</v>
+</b>
+<b>
+<a>121</a>
+<b>2817</b>
+<v>73</v>
+</b>
+<b>
+<a>3109</a>
+<b>3682839</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -15306,11 +15305,11 @@
 </relation>
 <relation>
 <name>expr_flowstate</name>
-<cardinality>2994827</cardinality>
+<cardinality>2993769</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2994827</v>
+<v>2993769</v>
 </e>
 <e>
 <k>state</k>
@@ -15328,7 +15327,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2994827</v>
+<v>2993769</v>
 </b>
 </bs>
 </hist>
@@ -15342,13 +15341,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>205765</a>
-<b>205766</b>
+<a>205843</a>
+<b>205844</b>
 <v>1</v>
 </b>
 <b>
-<a>2254377</a>
-<b>2254378</b>
+<a>2254382</a>
+<b>2254383</b>
 <v>1</v>
 </b>
 </bs>
@@ -15359,11 +15358,11 @@
 </relation>
 <relation>
 <name>type_parameters</name>
-<cardinality>203031</cardinality>
+<cardinality>202959</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>203031</v>
+<v>202959</v>
 </e>
 <e>
 <k>index</k>
@@ -15371,7 +15370,7 @@
 </e>
 <e>
 <k>generic_id</k>
-<v>103881</v>
+<v>103845</v>
 </e>
 <e>
 <k>variance</k>
@@ -15389,7 +15388,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203031</v>
+<v>202959</v>
 </b>
 </bs>
 </hist>
@@ -15405,7 +15404,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203031</v>
+<v>202959</v>
 </b>
 </bs>
 </hist>
@@ -15421,7 +15420,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203031</v>
+<v>202959</v>
 </b>
 </bs>
 </hist>
@@ -15695,22 +15694,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80716</v>
+<v>80688</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10792</v>
+<v>10788</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8362</v>
+<v>8359</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>4010</v>
+<v>4009</v>
 </b>
 </bs>
 </hist>
@@ -15726,22 +15725,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80716</v>
+<v>80688</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10792</v>
+<v>10788</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8362</v>
+<v>8359</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>4010</v>
+<v>4009</v>
 </b>
 </bs>
 </hist>
@@ -15757,7 +15756,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>103730</v>
+<v>103694</v>
 </b>
 <b>
 <a>2</a>
@@ -15850,11 +15849,11 @@
 </relation>
 <relation>
 <name>type_arguments</name>
-<cardinality>644865</cardinality>
+<cardinality>644639</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>273716</v>
+<v>273620</v>
 </e>
 <e>
 <k>index</k>
@@ -15862,7 +15861,7 @@
 </e>
 <e>
 <k>constructed_id</k>
-<v>413580</v>
+<v>413435</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15876,17 +15875,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235061</v>
+<v>234978</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37177</v>
+<v>37164</v>
 </b>
 <b>
 <a>3</a>
 <b>21</b>
-<v>1478</v>
+<v>1477</v>
 </b>
 </bs>
 </hist>
@@ -15902,27 +15901,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>174226</v>
+<v>174164</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>56566</v>
+<v>56546</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>20603</v>
+<v>20596</v>
 </b>
 <b>
 <a>5</a>
 <b>23</b>
-<v>20686</v>
+<v>20679</v>
 </b>
 <b>
 <a>23</a>
 <b>2800</b>
-<v>1634</v>
+<v>1633</v>
 </b>
 </bs>
 </hist>
@@ -16150,17 +16149,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>290539</v>
+<v>290437</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>96392</v>
+<v>96358</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>26648</v>
+<v>26639</v>
 </b>
 </bs>
 </hist>
@@ -16176,17 +16175,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>288373</v>
+<v>288271</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>97392</v>
+<v>97358</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27814</v>
+<v>27804</v>
 </b>
 </bs>
 </hist>
@@ -16196,15 +16195,15 @@
 </relation>
 <relation>
 <name>constructed_generic</name>
-<cardinality>413580</cardinality>
+<cardinality>413435</cardinality>
 <columnsizes>
 <e>
 <k>constructed</k>
-<v>413580</v>
+<v>413435</v>
 </e>
 <e>
 <k>generic</k>
-<v>8591</v>
+<v>8588</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16218,7 +16217,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>413580</v>
+<v>413435</v>
 </b>
 </bs>
 </hist>
@@ -16234,12 +16233,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3449</v>
+<v>3448</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1156</v>
+<v>1155</v>
 </b>
 <b>
 <a>3</a>
@@ -16284,15 +16283,15 @@
 </relation>
 <relation>
 <name>type_parameter_constraints</name>
-<cardinality>611825</cardinality>
+<cardinality>611610</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>611825</v>
+<v>611610</v>
 </e>
 <e>
 <k>param_id</k>
-<v>202943</v>
+<v>202872</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16306,7 +16305,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>611825</v>
+<v>611610</v>
 </b>
 </bs>
 </hist>
@@ -16322,22 +16321,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>164497</v>
+<v>164439</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17715</v>
+<v>17709</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>16617</v>
+<v>16611</v>
 </b>
 <b>
 <a>11</a>
 <b>2108</b>
-<v>4112</v>
+<v>4111</v>
 </b>
 </bs>
 </hist>
@@ -16383,11 +16382,11 @@
 </relation>
 <relation>
 <name>general_type_parameter_constraints</name>
-<cardinality>119012</cardinality>
+<cardinality>119064</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>68415</v>
+<v>68463</v>
 </e>
 <e>
 <k>kind</k>
@@ -16405,12 +16404,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17818</v>
+<v>17862</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>50597</v>
+<v>50601</v>
 </b>
 </bs>
 </hist>
@@ -16434,18 +16433,18 @@
 <v>1</v>
 </b>
 <b>
-<a>5903</a>
-<b>5904</b>
+<a>5921</a>
+<b>5922</b>
 <v>1</v>
 </b>
 <b>
-<a>50476</a>
-<b>50477</b>
+<a>50480</a>
+<b>50481</b>
 <v>1</v>
 </b>
 <b>
-<a>62187</a>
-<b>62188</b>
+<a>62217</a>
+<b>62218</b>
 <v>1</v>
 </b>
 </bs>
@@ -16456,11 +16455,11 @@
 </relation>
 <relation>
 <name>specific_type_parameter_constraints</name>
-<cardinality>57192</cardinality>
+<cardinality>57258</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>56338</v>
+<v>56404</v>
 </e>
 <e>
 <k>base_id</k>
@@ -16478,7 +16477,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55532</v>
+<v>55598</v>
 </b>
 <b>
 <a>2</a>
@@ -16514,17 +16513,17 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>100</v>
+<v>97</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>54</v>
+<v>55</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>116</v>
+<v>117</v>
 </b>
 <b>
 <a>7</a>
@@ -16534,7 +16533,7 @@
 <b>
 <a>10</a>
 <b>13</b>
-<v>105</v>
+<v>106</v>
 </b>
 <b>
 <a>13</a>
@@ -16544,21 +16543,21 @@
 <b>
 <a>20</a>
 <b>26</b>
-<v>108</v>
+<v>107</v>
 </b>
 <b>
 <a>26</a>
 <b>51</b>
-<v>98</v>
+<v>99</v>
 </b>
 <b>
 <a>51</a>
-<b>194</b>
+<b>196</b>
 <v>97</v>
 </b>
 <b>
 <a>204</a>
-<b>8422</b>
+<b>8429</b>
 <v>41</v>
 </b>
 </bs>
@@ -16569,11 +16568,11 @@
 </relation>
 <relation>
 <name>specific_type_parameter_nullability</name>
-<cardinality>39909</cardinality>
+<cardinality>39980</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>39671</v>
+<v>39742</v>
 </e>
 <e>
 <k>base_id</k>
@@ -16595,7 +16594,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39433</v>
+<v>39504</v>
 </b>
 <b>
 <a>2</a>
@@ -16616,7 +16615,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39671</v>
+<v>39742</v>
 </b>
 </bs>
 </hist>
@@ -16647,12 +16646,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>52</v>
+<v>49</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>47</v>
+<v>49</v>
 </b>
 <b>
 <a>6</a>
@@ -16667,32 +16666,32 @@
 <b>
 <a>10</a>
 <b>12</b>
-<v>53</v>
+<v>56</v>
 </b>
 <b>
 <a>12</a>
 <b>16</b>
-<v>71</v>
+<v>69</v>
 </b>
 <b>
 <a>16</a>
-<b>22</b>
+<b>23</b>
+<v>83</v>
+</b>
+<b>
+<a>23</a>
+<b>37</b>
 <v>70</v>
 </b>
 <b>
-<a>22</a>
-<b>33</b>
-<v>74</v>
+<a>38</a>
+<b>103</b>
+<v>70</v>
 </b>
 <b>
-<a>33</a>
-<b>93</b>
-<v>72</v>
-</b>
-<b>
-<a>93</a>
-<b>6983</b>
-<v>56</v>
+<a>105</a>
+<b>6990</b>
+<v>49</v>
 </b>
 </bs>
 </hist>
@@ -16792,8 +16791,8 @@
 <v>1</v>
 </b>
 <b>
-<a>38744</a>
-<b>38745</b>
+<a>38815</a>
+<b>38816</b>
 <v>1</v>
 </b>
 </bs>
@@ -16908,11 +16907,11 @@
 </relation>
 <relation>
 <name>has_modifiers</name>
-<cardinality>5505244</cardinality>
+<cardinality>5503074</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3697119</v>
+<v>3695587</v>
 </e>
 <e>
 <k>mod_id</k>
@@ -16930,17 +16929,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2024705</v>
+<v>2023765</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1538546</v>
+<v>1538001</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>133867</v>
+<v>133820</v>
 </b>
 </bs>
 </hist>
@@ -16999,8 +16998,8 @@
 <v>4</v>
 </b>
 <b>
-<a>30699</a>
-<b>30700</b>
+<a>30651</a>
+<b>30652</b>
 <v>4</v>
 </b>
 <b>
@@ -17014,8 +17013,8 @@
 <v>4</v>
 </b>
 <b>
-<a>63917</a>
-<b>63918</b>
+<a>63916</a>
+<b>63917</b>
 <v>4</v>
 </b>
 <b>
@@ -17046,22 +17045,22 @@
 </relation>
 <relation>
 <name>compiler_generated</name>
-<cardinality>136072</cardinality>
+<cardinality>136025</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>136072</v>
+<v>136025</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>exprorstmt_name</name>
-<cardinality>3709</cardinality>
+<cardinality>3707</cardinality>
 <columnsizes>
 <e>
 <k>parent_id</k>
-<v>3709</v>
+<v>3707</v>
 </e>
 <e>
 <k>name</k>
@@ -17079,7 +17078,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3709</v>
+<v>3707</v>
 </b>
 </bs>
 </hist>
@@ -17145,19 +17144,19 @@
 </relation>
 <relation>
 <name>nested_types</name>
-<cardinality>112122</cardinality>
+<cardinality>112082</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>112122</v>
+<v>112082</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>40665</v>
+<v>40651</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>81253</v>
+<v>81224</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17171,7 +17170,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112122</v>
+<v>112082</v>
 </b>
 </bs>
 </hist>
@@ -17187,7 +17186,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112122</v>
+<v>112082</v>
 </b>
 </bs>
 </hist>
@@ -17203,27 +17202,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23526</v>
+<v>23517</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6347</v>
+<v>6345</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3234</v>
+<v>3233</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3361</v>
+<v>3360</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>3098</v>
+<v>3097</v>
 </b>
 <b>
 <a>12</a>
@@ -17244,27 +17243,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23560</v>
+<v>23552</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6430</v>
+<v>6428</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3151</v>
+<v>3150</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3390</v>
+<v>3389</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>3083</v>
+<v>3082</v>
 </b>
 <b>
 <a>12</a>
@@ -17285,12 +17284,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78233</v>
+<v>78205</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>3020</v>
+<v>3018</v>
 </b>
 </bs>
 </hist>
@@ -17306,12 +17305,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78974</v>
+<v>78947</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>2278</v>
+<v>2277</v>
 </b>
 </bs>
 </hist>
@@ -17321,27 +17320,27 @@
 </relation>
 <relation>
 <name>properties</name>
-<cardinality>424250</cardinality>
+<cardinality>424101</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>424250</v>
+<v>424101</v>
 </e>
 <e>
 <k>name</k>
-<v>84502</v>
+<v>84473</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>116571</v>
+<v>116530</v>
 </e>
 <e>
 <k>type_id</k>
-<v>52214</v>
+<v>52195</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>334410</v>
+<v>334293</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17355,7 +17354,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424250</v>
+<v>424101</v>
 </b>
 </bs>
 </hist>
@@ -17371,7 +17370,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424250</v>
+<v>424101</v>
 </b>
 </bs>
 </hist>
@@ -17387,7 +17386,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424250</v>
+<v>424101</v>
 </b>
 </bs>
 </hist>
@@ -17403,7 +17402,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424250</v>
+<v>424101</v>
 </b>
 </bs>
 </hist>
@@ -17419,32 +17418,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50838</v>
+<v>50820</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14017</v>
+<v>14012</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5761</v>
+<v>5759</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6659</v>
+<v>6657</v>
 </b>
 <b>
 <a>7</a>
 <b>49</b>
-<v>6347</v>
+<v>6345</v>
 </b>
 <b>
 <a>49</a>
 <b>2611</b>
-<v>878</v>
+<v>877</v>
 </b>
 </bs>
 </hist>
@@ -17460,32 +17459,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50838</v>
+<v>50820</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14085</v>
+<v>14080</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5747</v>
+<v>5745</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6693</v>
+<v>6691</v>
 </b>
 <b>
 <a>7</a>
 <b>51</b>
-<v>6342</v>
+<v>6340</v>
 </b>
 <b>
 <a>51</a>
 <b>2578</b>
-<v>795</v>
+<v>794</v>
 </b>
 </bs>
 </hist>
@@ -17501,17 +17500,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72959</v>
+<v>72933</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6942</v>
+<v>6940</v>
 </b>
 <b>
 <a>3</a>
 <b>524</b>
-<v>4600</v>
+<v>4599</v>
 </b>
 </bs>
 </hist>
@@ -17527,27 +17526,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51267</v>
+<v>51249</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14280</v>
+<v>14275</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5747</v>
+<v>5745</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6454</v>
+<v>6452</v>
 </b>
 <b>
 <a>7</a>
 <b>68</b>
-<v>6337</v>
+<v>6335</v>
 </b>
 <b>
 <a>68</a>
@@ -17568,42 +17567,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39450</v>
+<v>39437</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29917</v>
+<v>29907</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10919</v>
+<v>10915</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7855</v>
+<v>7852</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7142</v>
+<v>7140</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9343</v>
+<v>9339</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>9582</v>
+<v>9578</v>
 </b>
 <b>
 <a>16</a>
 <b>250</b>
-<v>2361</v>
+<v>2360</v>
 </b>
 </bs>
 </hist>
@@ -17619,42 +17618,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43968</v>
+<v>43953</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25477</v>
+<v>25468</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10914</v>
+<v>10910</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7874</v>
+<v>7871</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7157</v>
+<v>7154</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9299</v>
+<v>9295</v>
 </b>
 <b>
 <a>8</a>
 <b>14</b>
-<v>8757</v>
+<v>8754</v>
 </b>
 <b>
 <a>14</a>
 <b>250</b>
-<v>3122</v>
+<v>3121</v>
 </b>
 </bs>
 </hist>
@@ -17670,32 +17669,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>45525</v>
+<v>45509</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32669</v>
+<v>32657</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13860</v>
+<v>13856</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7557</v>
+<v>7554</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>9396</v>
+<v>9393</v>
 </b>
 <b>
 <a>7</a>
 <b>48</b>
-<v>7562</v>
+<v>7559</v>
 </b>
 </bs>
 </hist>
@@ -17711,42 +17710,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39450</v>
+<v>39437</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29917</v>
+<v>29907</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10919</v>
+<v>10915</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7855</v>
+<v>7852</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7142</v>
+<v>7140</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9343</v>
+<v>9339</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>9582</v>
+<v>9578</v>
 </b>
 <b>
 <a>16</a>
 <b>250</b>
-<v>2361</v>
+<v>2360</v>
 </b>
 </bs>
 </hist>
@@ -17762,27 +17761,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31468</v>
+<v>31457</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10797</v>
+<v>10793</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4639</v>
+<v>4638</v>
 </b>
 <b>
 <a>5</a>
 <b>21</b>
-<v>3951</v>
+<v>3950</v>
 </b>
 <b>
 <a>21</a>
 <b>12516</b>
-<v>1356</v>
+<v>1355</v>
 </b>
 </bs>
 </hist>
@@ -17798,17 +17797,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44149</v>
+<v>44133</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4405</v>
+<v>4404</v>
 </b>
 <b>
 <a>3</a>
 <b>3289</b>
-<v>3659</v>
+<v>3657</v>
 </b>
 </bs>
 </hist>
@@ -17824,22 +17823,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32654</v>
+<v>32643</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10499</v>
+<v>10495</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4430</v>
+<v>4428</v>
 </b>
 <b>
 <a>5</a>
 <b>33</b>
-<v>3917</v>
+<v>3916</v>
 </b>
 <b>
 <a>33</a>
@@ -17860,27 +17859,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31610</v>
+<v>31599</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10928</v>
+<v>10924</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4673</v>
+<v>4672</v>
 </b>
 <b>
 <a>5</a>
 <b>22</b>
-<v>3917</v>
+<v>3916</v>
 </b>
 <b>
 <a>22</a>
 <b>10632</b>
-<v>1083</v>
+<v>1082</v>
 </b>
 </bs>
 </hist>
@@ -17896,12 +17895,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>329229</v>
+<v>329113</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5181</v>
+<v>5179</v>
 </b>
 </bs>
 </hist>
@@ -17917,7 +17916,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>334410</v>
+<v>334293</v>
 </b>
 </bs>
 </hist>
@@ -17933,12 +17932,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>329229</v>
+<v>329113</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5181</v>
+<v>5179</v>
 </b>
 </bs>
 </hist>
@@ -17954,7 +17953,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>333200</v>
+<v>333083</v>
 </b>
 <b>
 <a>2</a>
@@ -17969,15 +17968,15 @@
 </relation>
 <relation>
 <name>property_location</name>
-<cardinality>535358</cardinality>
+<cardinality>535165</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>424250</v>
+<v>424101</v>
 </e>
 <e>
 <k>loc</k>
-<v>52985</v>
+<v>52966</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17991,17 +17990,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>338679</v>
+<v>338560</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>64211</v>
+<v>64193</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>21359</v>
+<v>21347</v>
 </b>
 </bs>
 </hist>
@@ -18017,12 +18016,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49496</v>
+<v>49479</v>
 </b>
 <b>
 <a>2</a>
 <b>7080</b>
-<v>3488</v>
+<v>3487</v>
 </b>
 </bs>
 </hist>
@@ -18032,11 +18031,11 @@
 </relation>
 <relation>
 <name>indexers</name>
-<cardinality>17071</cardinality>
+<cardinality>17065</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>17071</v>
+<v>17065</v>
 </e>
 <e>
 <k>name</k>
@@ -18044,15 +18043,15 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>13573</v>
+<v>13568</v>
 </e>
 <e>
 <k>type_id</k>
-<v>3976</v>
+<v>3974</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>4444</v>
+<v>4443</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18066,7 +18065,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17071</v>
+<v>17065</v>
 </b>
 </bs>
 </hist>
@@ -18082,7 +18081,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17071</v>
+<v>17065</v>
 </b>
 </bs>
 </hist>
@@ -18098,7 +18097,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17071</v>
+<v>17065</v>
 </b>
 </bs>
 </hist>
@@ -18114,7 +18113,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17071</v>
+<v>17065</v>
 </b>
 </bs>
 </hist>
@@ -18249,12 +18248,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10523</v>
+<v>10520</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2751</v>
+<v>2750</v>
 </b>
 <b>
 <a>3</a>
@@ -18275,7 +18274,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13563</v>
+<v>13558</v>
 </b>
 <b>
 <a>2</a>
@@ -18296,12 +18295,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11065</v>
+<v>11061</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2507</v>
+<v>2506</v>
 </b>
 </bs>
 </hist>
@@ -18317,12 +18316,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10523</v>
+<v>10520</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2751</v>
+<v>2750</v>
 </b>
 <b>
 <a>3</a>
@@ -18343,7 +18342,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>878</v>
+<v>877</v>
 </b>
 <b>
 <a>2</a>
@@ -18353,7 +18352,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>1629</v>
+<v>1628</v>
 </b>
 <b>
 <a>4</a>
@@ -18384,7 +18383,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3971</v>
+<v>3970</v>
 </b>
 <b>
 <a>2</a>
@@ -18405,7 +18404,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1034</v>
+<v>1033</v>
 </b>
 <b>
 <a>2</a>
@@ -18420,7 +18419,7 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>6</a>
@@ -18441,7 +18440,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>878</v>
+<v>877</v>
 </b>
 <b>
 <a>2</a>
@@ -18477,7 +18476,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4108</v>
+<v>4106</v>
 </b>
 <b>
 <a>2</a>
@@ -18498,7 +18497,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4444</v>
+<v>4443</v>
 </b>
 </bs>
 </hist>
@@ -18514,7 +18513,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4108</v>
+<v>4106</v>
 </b>
 <b>
 <a>2</a>
@@ -18535,7 +18534,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4254</v>
+<v>4252</v>
 </b>
 <b>
 <a>2</a>
@@ -18550,11 +18549,11 @@
 </relation>
 <relation>
 <name>indexer_location</name>
-<cardinality>23816</cardinality>
+<cardinality>23806</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12715</v>
+<v>12621</v>
 </e>
 <e>
 <k>loc</k>
@@ -18572,27 +18571,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4584</v>
+<v>4407</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6619</v>
+<v>6696</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>275</v>
+<v>288</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1124</v>
+<v>1116</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>113</v>
+<v>114</v>
 </b>
 </bs>
 </hist>
@@ -18613,22 +18612,22 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>22</v>
+<v>23</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>19</v>
+<v>17</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>12</v>
+<v>14</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>20</v>
+<v>18</v>
 </b>
 <b>
 <a>8</a>
@@ -18638,7 +18637,7 @@
 <b>
 <a>13</a>
 <b>21</b>
-<v>18</v>
+<v>19</v>
 </b>
 <b>
 <a>23</a>
@@ -18647,12 +18646,12 @@
 </b>
 <b>
 <a>47</a>
-<b>1716</b>
+<b>1552</b>
 <v>17</v>
 </b>
 <b>
-<a>2229</a>
-<b>5342</b>
+<a>2318</a>
+<b>5425</b>
 <v>4</v>
 </b>
 </bs>
@@ -18663,11 +18662,11 @@
 </relation>
 <relation>
 <name>accessors</name>
-<cardinality>568832</cardinality>
+<cardinality>568633</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>568832</v>
+<v>568633</v>
 </e>
 <e>
 <k>kind</k>
@@ -18675,15 +18674,15 @@
 </e>
 <e>
 <k>name</k>
-<v>121450</v>
+<v>121408</v>
 </e>
 <e>
 <k>declaring_member_id</k>
-<v>441322</v>
+<v>441167</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>441170</v>
+<v>441016</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18697,7 +18696,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568832</v>
+<v>568633</v>
 </b>
 </bs>
 </hist>
@@ -18713,7 +18712,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568832</v>
+<v>568633</v>
 </b>
 </bs>
 </hist>
@@ -18729,7 +18728,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568832</v>
+<v>568633</v>
 </b>
 </bs>
 </hist>
@@ -18745,7 +18744,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568832</v>
+<v>568633</v>
 </b>
 </bs>
 </hist>
@@ -18845,27 +18844,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75320</v>
+<v>75294</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19984</v>
+<v>19977</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7942</v>
+<v>7940</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10143</v>
+<v>10139</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8059</v>
+<v>8057</v>
 </b>
 </bs>
 </hist>
@@ -18881,7 +18880,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>121450</v>
+<v>121408</v>
 </b>
 </bs>
 </hist>
@@ -18897,27 +18896,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75330</v>
+<v>75304</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19974</v>
+<v>19967</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7942</v>
+<v>7940</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10143</v>
+<v>10139</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8059</v>
+<v>8057</v>
 </b>
 </bs>
 </hist>
@@ -18933,27 +18932,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75969</v>
+<v>75942</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20652</v>
+<v>20645</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7776</v>
+<v>7774</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>9670</v>
+<v>9666</v>
 </b>
 <b>
 <a>8</a>
 <b>1202</b>
-<v>7381</v>
+<v>7379</v>
 </b>
 </bs>
 </hist>
@@ -18969,12 +18968,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313821</v>
+<v>313711</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127495</v>
+<v>127451</v>
 </b>
 <b>
 <a>4</a>
@@ -18995,12 +18994,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313821</v>
+<v>313711</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127500</v>
+<v>127455</v>
 </b>
 </bs>
 </hist>
@@ -19016,12 +19015,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313821</v>
+<v>313711</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127500</v>
+<v>127455</v>
 </b>
 </bs>
 </hist>
@@ -19037,12 +19036,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313821</v>
+<v>313711</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127495</v>
+<v>127451</v>
 </b>
 <b>
 <a>4</a>
@@ -19063,12 +19062,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434496</v>
+<v>434344</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6674</v>
+<v>6672</v>
 </b>
 </bs>
 </hist>
@@ -19084,7 +19083,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441170</v>
+<v>441016</v>
 </b>
 </bs>
 </hist>
@@ -19100,7 +19099,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441170</v>
+<v>441016</v>
 </b>
 </bs>
 </hist>
@@ -19116,12 +19115,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434496</v>
+<v>434344</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6674</v>
+<v>6672</v>
 </b>
 </bs>
 </hist>
@@ -19142,15 +19141,15 @@
 </relation>
 <relation>
 <name>accessor_location</name>
-<cardinality>749045</cardinality>
+<cardinality>748772</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>568832</v>
+<v>568633</v>
 </e>
 <e>
 <k>loc</k>
-<v>93372</v>
+<v>93339</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19164,17 +19163,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>433442</v>
+<v>433290</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98563</v>
+<v>98538</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>36826</v>
+<v>36803</v>
 </b>
 </bs>
 </hist>
@@ -19190,12 +19189,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89762</v>
+<v>89730</v>
 </b>
 <b>
 <a>2</a>
 <b>8294</b>
-<v>3610</v>
+<v>3609</v>
 </b>
 </bs>
 </hist>
@@ -19205,15 +19204,15 @@
 </relation>
 <relation>
 <name>events</name>
-<cardinality>15256</cardinality>
+<cardinality>15251</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15256</v>
+<v>15251</v>
 </e>
 <e>
 <k>name</k>
-<v>13012</v>
+<v>13007</v>
 </e>
 <e>
 <k>declaring_type_id</k>
@@ -19221,11 +19220,11 @@
 </e>
 <e>
 <k>type_id</k>
-<v>6376</v>
+<v>6374</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>15246</v>
+<v>15241</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19239,7 +19238,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15256</v>
+<v>15251</v>
 </b>
 </bs>
 </hist>
@@ -19255,7 +19254,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15256</v>
+<v>15251</v>
 </b>
 </bs>
 </hist>
@@ -19271,7 +19270,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15256</v>
+<v>15251</v>
 </b>
 </bs>
 </hist>
@@ -19287,7 +19286,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15256</v>
+<v>15251</v>
 </b>
 </bs>
 </hist>
@@ -19303,7 +19302,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12021</v>
+<v>12017</v>
 </b>
 <b>
 <a>2</a>
@@ -19329,7 +19328,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12021</v>
+<v>12017</v>
 </b>
 <b>
 <a>2</a>
@@ -19355,7 +19354,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12870</v>
+<v>12866</v>
 </b>
 <b>
 <a>2</a>
@@ -19376,7 +19375,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12021</v>
+<v>12017</v>
 </b>
 <b>
 <a>2</a>
@@ -19448,7 +19447,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>3</a>
@@ -19489,7 +19488,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>200</v>
+<v>199</v>
 </b>
 <b>
 <a>3</a>
@@ -19561,17 +19560,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4420</v>
+<v>4418</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1166</v>
+<v>1165</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>517</v>
+<v>516</v>
 </b>
 <b>
 <a>6</a>
@@ -19592,12 +19591,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4810</v>
+<v>4808</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>917</v>
+<v>916</v>
 </b>
 <b>
 <a>3</a>
@@ -19623,12 +19622,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5761</v>
+<v>5759</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>522</v>
+<v>521</v>
 </b>
 <b>
 <a>4</a>
@@ -19649,17 +19648,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4420</v>
+<v>4418</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1166</v>
+<v>1165</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>517</v>
+<v>516</v>
 </b>
 <b>
 <a>6</a>
@@ -19680,7 +19679,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15236</v>
+<v>15231</v>
 </b>
 <b>
 <a>2</a>
@@ -19701,7 +19700,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15246</v>
+<v>15241</v>
 </b>
 </bs>
 </hist>
@@ -19717,7 +19716,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15236</v>
+<v>15231</v>
 </b>
 <b>
 <a>2</a>
@@ -19738,7 +19737,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15236</v>
+<v>15231</v>
 </b>
 <b>
 <a>2</a>
@@ -19753,11 +19752,11 @@
 </relation>
 <relation>
 <name>event_location</name>
-<cardinality>15895</cardinality>
+<cardinality>15889</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15256</v>
+<v>15251</v>
 </e>
 <e>
 <k>loc</k>
@@ -19775,12 +19774,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14617</v>
+<v>14612</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>639</v>
+<v>638</v>
 </b>
 </bs>
 </hist>
@@ -19856,11 +19855,11 @@
 </relation>
 <relation>
 <name>event_accessors</name>
-<cardinality>30512</cardinality>
+<cardinality>30502</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30512</v>
+<v>30502</v>
 </e>
 <e>
 <k>kind</k>
@@ -19868,15 +19867,15 @@
 </e>
 <e>
 <k>name</k>
-<v>26736</v>
+<v>26727</v>
 </e>
 <e>
 <k>declaring_event_id</k>
-<v>15256</v>
+<v>15251</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>30493</v>
+<v>30482</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19890,7 +19889,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30512</v>
+<v>30502</v>
 </b>
 </bs>
 </hist>
@@ -19906,7 +19905,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30512</v>
+<v>30502</v>
 </b>
 </bs>
 </hist>
@@ -19922,7 +19921,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30512</v>
+<v>30502</v>
 </b>
 </bs>
 </hist>
@@ -19938,7 +19937,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30512</v>
+<v>30502</v>
 </b>
 </bs>
 </hist>
@@ -20018,12 +20017,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24745</v>
+<v>24737</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1990</v>
+<v>1989</v>
 </b>
 </bs>
 </hist>
@@ -20039,7 +20038,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26736</v>
+<v>26727</v>
 </b>
 </bs>
 </hist>
@@ -20055,12 +20054,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24745</v>
+<v>24737</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1990</v>
+<v>1989</v>
 </b>
 </bs>
 </hist>
@@ -20076,12 +20075,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24745</v>
+<v>24737</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1990</v>
+<v>1989</v>
 </b>
 </bs>
 </hist>
@@ -20097,7 +20096,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15256</v>
+<v>15251</v>
 </b>
 </bs>
 </hist>
@@ -20113,7 +20112,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15256</v>
+<v>15251</v>
 </b>
 </bs>
 </hist>
@@ -20129,7 +20128,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15256</v>
+<v>15251</v>
 </b>
 </bs>
 </hist>
@@ -20145,7 +20144,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15256</v>
+<v>15251</v>
 </b>
 </bs>
 </hist>
@@ -20161,7 +20160,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30473</v>
+<v>30463</v>
 </b>
 <b>
 <a>2</a>
@@ -20182,7 +20181,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30493</v>
+<v>30482</v>
 </b>
 </bs>
 </hist>
@@ -20198,7 +20197,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30493</v>
+<v>30482</v>
 </b>
 </bs>
 </hist>
@@ -20214,7 +20213,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30473</v>
+<v>30463</v>
 </b>
 <b>
 <a>2</a>
@@ -20229,11 +20228,11 @@
 </relation>
 <relation>
 <name>event_accessor_location</name>
-<cardinality>31791</cardinality>
+<cardinality>31779</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30512</v>
+<v>30502</v>
 </e>
 <e>
 <k>loc</k>
@@ -20251,12 +20250,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29234</v>
+<v>29224</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1278</v>
+<v>1277</v>
 </b>
 </bs>
 </hist>
@@ -20332,11 +20331,11 @@
 </relation>
 <relation>
 <name>operators</name>
-<cardinality>12431</cardinality>
+<cardinality>12427</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12431</v>
+<v>12427</v>
 </e>
 <e>
 <k>name</k>
@@ -20348,7 +20347,7 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>3029</v>
+<v>3028</v>
 </e>
 <e>
 <k>type_id</k>
@@ -20356,7 +20355,7 @@
 </e>
 <e>
 <k>unbound_id</k>
-<v>11675</v>
+<v>11671</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20370,7 +20369,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12431</v>
+<v>12427</v>
 </b>
 </bs>
 </hist>
@@ -20386,7 +20385,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12431</v>
+<v>12427</v>
 </b>
 </bs>
 </hist>
@@ -20402,7 +20401,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12431</v>
+<v>12427</v>
 </b>
 </bs>
 </hist>
@@ -20418,7 +20417,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12431</v>
+<v>12427</v>
 </b>
 </bs>
 </hist>
@@ -20434,7 +20433,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12431</v>
+<v>12427</v>
 </b>
 </bs>
 </hist>
@@ -21060,7 +21059,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1571</v>
+<v>1570</v>
 </b>
 <b>
 <a>3</a>
@@ -21152,7 +21151,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>4</a>
@@ -21224,7 +21223,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1571</v>
+<v>1570</v>
 </b>
 <b>
 <a>3</a>
@@ -21265,7 +21264,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>795</v>
+<v>794</v>
 </b>
 <b>
 <a>2</a>
@@ -21347,7 +21346,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>161</v>
+<v>160</v>
 </b>
 <b>
 <a>3</a>
@@ -21409,7 +21408,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>795</v>
+<v>794</v>
 </b>
 <b>
 <a>2</a>
@@ -21450,7 +21449,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11528</v>
+<v>11524</v>
 </b>
 <b>
 <a>2</a>
@@ -21471,7 +21470,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11675</v>
+<v>11671</v>
 </b>
 </bs>
 </hist>
@@ -21487,7 +21486,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11675</v>
+<v>11671</v>
 </b>
 </bs>
 </hist>
@@ -21503,7 +21502,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11528</v>
+<v>11524</v>
 </b>
 <b>
 <a>2</a>
@@ -21524,7 +21523,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11616</v>
+<v>11612</v>
 </b>
 <b>
 <a>2</a>
@@ -21539,15 +21538,15 @@
 </relation>
 <relation>
 <name>operator_location</name>
-<cardinality>22294</cardinality>
+<cardinality>22285</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>5646</v>
+<v>5643</v>
 </e>
 <e>
 <k>loc</k>
-<v>3163</v>
+<v>3162</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21561,17 +21560,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>841</v>
+<v>840</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3155</v>
+<v>3154</v>
 </b>
 <b>
 <a>3</a>
 <b>9</b>
-<v>387</v>
+<v>386</v>
 </b>
 <b>
 <a>9</a>
@@ -21581,7 +21580,7 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>583</v>
+<v>582</v>
 </b>
 <b>
 <a>12</a>
@@ -21602,7 +21601,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2773</v>
+<v>2772</v>
 </b>
 <b>
 <a>2</a>
@@ -21622,15 +21621,15 @@
 </relation>
 <relation>
 <name>constant_value</name>
-<cardinality>185667</cardinality>
+<cardinality>185601</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>185554</v>
+<v>185489</v>
 </e>
 <e>
 <k>value</k>
-<v>47935</v>
+<v>47918</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21644,7 +21643,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185442</v>
+<v>185377</v>
 </b>
 <b>
 <a>2</a>
@@ -21665,22 +21664,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32947</v>
+<v>32935</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7230</v>
+<v>7228</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3893</v>
+<v>3892</v>
 </b>
 <b>
 <a>4</a>
 <b>61</b>
-<v>3595</v>
+<v>3594</v>
 </b>
 <b>
 <a>61</a>
@@ -21695,27 +21694,27 @@
 </relation>
 <relation>
 <name>methods</name>
-<cardinality>1118769</cardinality>
+<cardinality>1118142</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1118769</v>
+<v>1118142</v>
 </e>
 <e>
 <k>name</k>
-<v>134018</v>
+<v>133771</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>202592</v>
+<v>202306</v>
 </e>
 <e>
 <k>type_id</k>
-<v>113068</v>
+<v>113029</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>697977</v>
+<v>697498</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21729,7 +21728,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118769</v>
+<v>1118142</v>
 </b>
 </bs>
 </hist>
@@ -21745,7 +21744,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118769</v>
+<v>1118142</v>
 </b>
 </bs>
 </hist>
@@ -21761,7 +21760,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118769</v>
+<v>1118142</v>
 </b>
 </bs>
 </hist>
@@ -21777,7 +21776,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118769</v>
+<v>1118142</v>
 </b>
 </bs>
 </hist>
@@ -21793,32 +21792,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>69436</v>
+<v>69236</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23672</v>
+<v>23649</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10860</v>
+<v>10846</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10440</v>
+<v>10437</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>10587</v>
+<v>10583</v>
 </b>
 <b>
 <a>12</a>
 <b>5621</b>
-<v>9021</v>
+<v>9017</v>
 </b>
 </bs>
 </hist>
@@ -21834,32 +21833,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>79823</v>
+<v>79620</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19388</v>
+<v>19367</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11343</v>
+<v>11329</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>11065</v>
+<v>11061</v>
 </b>
 <b>
 <a>7</a>
 <b>33</b>
-<v>10123</v>
+<v>10120</v>
 </b>
 <b>
 <a>33</a>
 <b>4959</b>
-<v>2273</v>
+<v>2272</v>
 </b>
 </bs>
 </hist>
@@ -21875,22 +21874,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>113249</v>
+<v>113009</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10611</v>
+<v>10607</v>
 </b>
 <b>
 <a>3</a>
-<b>209</b>
-<v>10055</v>
+<b>174</b>
+<v>10037</v>
 </b>
 <b>
-<a>222</a>
+<a>177</a>
 <b>2703</b>
-<v>102</v>
+<v>117</v>
 </b>
 </bs>
 </hist>
@@ -21906,32 +21905,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71178</v>
+<v>70977</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24540</v>
+<v>24517</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10933</v>
+<v>10920</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10738</v>
+<v>10734</v>
 </b>
 <b>
 <a>6</a>
-<b>13</b>
-<v>10738</v>
+<b>12</b>
+<v>10042</v>
 </b>
 <b>
-<a>13</a>
+<a>12</a>
 <b>4958</b>
-<v>5888</v>
+<v>6579</v>
 </b>
 </bs>
 </hist>
@@ -21947,42 +21946,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60020</v>
+<v>59804</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43075</v>
+<v>43041</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31347</v>
+<v>31336</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14275</v>
+<v>14270</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14812</v>
+<v>14807</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>16124</v>
+<v>16119</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>15680</v>
+<v>15675</v>
 </b>
 <b>
 <a>23</a>
 <b>1309</b>
-<v>7254</v>
+<v>7252</v>
 </b>
 </bs>
 </hist>
@@ -21998,37 +21997,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>65094</v>
+<v>64876</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44764</v>
+<v>44728</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>34450</v>
+<v>34437</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18222</v>
+<v>18216</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>18188</v>
+<v>18182</v>
 </b>
 <b>
 <a>8</a>
 <b>18</b>
-<v>15275</v>
+<v>15270</v>
 </b>
 <b>
 <a>18</a>
 <b>457</b>
-<v>6596</v>
+<v>6593</v>
 </b>
 </bs>
 </hist>
@@ -22044,32 +22043,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98178</v>
+<v>97929</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48989</v>
+<v>48971</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22984</v>
+<v>22976</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11641</v>
+<v>11637</v>
 </b>
 <b>
 <a>5</a>
 <b>10</b>
-<v>15231</v>
+<v>15226</v>
 </b>
 <b>
 <a>10</a>
 <b>738</b>
-<v>5566</v>
+<v>5564</v>
 </b>
 </bs>
 </hist>
@@ -22085,42 +22084,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60127</v>
+<v>59911</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43153</v>
+<v>43119</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31347</v>
+<v>31336</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14309</v>
+<v>14304</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14831</v>
+<v>14826</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>16041</v>
+<v>16036</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>16139</v>
+<v>16133</v>
 </b>
 <b>
 <a>23</a>
 <b>698</b>
-<v>6640</v>
+<v>6637</v>
 </b>
 </bs>
 </hist>
@@ -22136,27 +22135,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75564</v>
+<v>75538</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14505</v>
+<v>14499</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8323</v>
+<v>8320</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8840</v>
+<v>8837</v>
 </b>
 <b>
 <a>10</a>
-<b>62181</b>
-<v>5835</v>
+<b>62149</b>
+<v>5833</v>
 </b>
 </bs>
 </hist>
@@ -22172,22 +22171,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>91723</v>
+<v>91691</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9630</v>
+<v>9627</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8679</v>
+<v>8676</v>
 </b>
 <b>
 <a>8</a>
-<b>7691</b>
-<v>3034</v>
+<b>7666</b>
+<v>3033</v>
 </b>
 </bs>
 </hist>
@@ -22203,22 +22202,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87542</v>
+<v>87511</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14002</v>
+<v>13997</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8816</v>
+<v>8813</v>
 </b>
 <b>
 <a>8</a>
-<b>19662</b>
-<v>2707</v>
+<b>19632</b>
+<v>2706</v>
 </b>
 </bs>
 </hist>
@@ -22234,27 +22233,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75676</v>
+<v>75650</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14563</v>
+<v>14558</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8396</v>
+<v>8393</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8777</v>
+<v>8774</v>
 </b>
 <b>
 <a>10</a>
-<b>44512</b>
-<v>5654</v>
+<b>44480</b>
+<v>5652</v>
 </b>
 </bs>
 </hist>
@@ -22270,12 +22269,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>671099</v>
+<v>670629</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>26877</v>
+<v>26868</v>
 </b>
 </bs>
 </hist>
@@ -22291,7 +22290,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>697977</v>
+<v>697498</v>
 </b>
 </bs>
 </hist>
@@ -22307,12 +22306,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>672968</v>
+<v>672497</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>25009</v>
+<v>25000</v>
 </b>
 </bs>
 </hist>
@@ -22328,12 +22327,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>687595</v>
+<v>687119</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>10382</v>
+<v>10378</v>
 </b>
 </bs>
 </hist>
@@ -22343,15 +22342,15 @@
 </relation>
 <relation>
 <name>method_location</name>
-<cardinality>1282783</cardinality>
+<cardinality>1282070</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1118769</v>
+<v>1118142</v>
 </e>
 <e>
 <k>loc</k>
-<v>40899</v>
+<v>40885</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22365,17 +22364,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>988175</v>
+<v>987594</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98402</v>
+<v>98397</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>32191</v>
+<v>32150</v>
 </b>
 </bs>
 </hist>
@@ -22391,12 +22390,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36279</v>
+<v>36266</v>
 </b>
 <b>
 <a>2</a>
 <b>51</b>
-<v>3083</v>
+<v>3082</v>
 </b>
 <b>
 <a>51</a>
@@ -22411,23 +22410,23 @@
 </relation>
 <relation>
 <name>constructors</name>
-<cardinality>278112</cardinality>
+<cardinality>278015</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>278112</v>
+<v>278015</v>
 </e>
 <e>
 <k>name</k>
-<v>133692</v>
+<v>133645</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>212340</v>
+<v>212265</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>223629</v>
+<v>223551</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22441,7 +22440,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278112</v>
+<v>278015</v>
 </b>
 </bs>
 </hist>
@@ -22457,7 +22456,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278112</v>
+<v>278015</v>
 </b>
 </bs>
 </hist>
@@ -22473,7 +22472,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278112</v>
+<v>278015</v>
 </b>
 </bs>
 </hist>
@@ -22489,17 +22488,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102359</v>
+<v>102323</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19203</v>
+<v>19196</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>10265</v>
+<v>10261</v>
 </b>
 <b>
 <a>8</a>
@@ -22520,12 +22519,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>122690</v>
+<v>122647</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>10099</v>
+<v>10095</v>
 </b>
 <b>
 <a>11</a>
@@ -22546,17 +22545,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>103242</v>
+<v>103206</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19359</v>
+<v>19352</v>
 </b>
 <b>
 <a>3</a>
 <b>10</b>
-<v>10104</v>
+<v>10100</v>
 </b>
 <b>
 <a>10</a>
@@ -22577,17 +22576,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179617</v>
+<v>179554</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19783</v>
+<v>19777</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12938</v>
+<v>12934</v>
 </b>
 </bs>
 </hist>
@@ -22603,7 +22602,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212340</v>
+<v>212265</v>
 </b>
 </bs>
 </hist>
@@ -22619,17 +22618,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179617</v>
+<v>179554</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19783</v>
+<v>19777</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12938</v>
+<v>12934</v>
 </b>
 </bs>
 </hist>
@@ -22645,12 +22644,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>221195</v>
+<v>221117</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2434</v>
+<v>2433</v>
 </b>
 </bs>
 </hist>
@@ -22666,7 +22665,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>223629</v>
+<v>223551</v>
 </b>
 </bs>
 </hist>
@@ -22682,12 +22681,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>221195</v>
+<v>221117</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2434</v>
+<v>2433</v>
 </b>
 </bs>
 </hist>
@@ -22697,15 +22696,15 @@
 </relation>
 <relation>
 <name>constructor_location</name>
-<cardinality>321983</cardinality>
+<cardinality>321870</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>278112</v>
+<v>278015</v>
 </e>
 <e>
 <k>loc</k>
-<v>24814</v>
+<v>24805</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22719,17 +22718,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>238725</v>
+<v>238641</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37635</v>
+<v>37622</v>
 </b>
 <b>
 <a>3</a>
 <b>87</b>
-<v>1751</v>
+<v>1750</v>
 </b>
 </bs>
 </hist>
@@ -22745,17 +22744,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19032</v>
+<v>19025</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3185</v>
+<v>3184</v>
 </b>
 <b>
 <a>3</a>
 <b>59</b>
-<v>1868</v>
+<v>1867</v>
 </b>
 <b>
 <a>59</a>
@@ -22890,7 +22889,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>400</v>
+<v>399</v>
 </b>
 <b>
 <a>2</a>
@@ -23114,15 +23113,15 @@
 </relation>
 <relation>
 <name>overrides</name>
-<cardinality>274395</cardinality>
+<cardinality>274298</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>274370</v>
+<v>274274</v>
 </e>
 <e>
 <k>base_id</k>
-<v>65514</v>
+<v>65491</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23136,7 +23135,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>274346</v>
+<v>274249</v>
 </b>
 <b>
 <a>2</a>
@@ -23157,27 +23156,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40319</v>
+<v>40305</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10489</v>
+<v>10485</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4293</v>
+<v>4291</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>5347</v>
+<v>5345</v>
 </b>
 <b>
 <a>7</a>
 <b>184</b>
-<v>4917</v>
+<v>4916</v>
 </b>
 <b>
 <a>215</a>
@@ -23192,15 +23191,15 @@
 </relation>
 <relation>
 <name>explicitly_implements</name>
-<cardinality>156208</cardinality>
+<cardinality>156153</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>156208</v>
+<v>156153</v>
 </e>
 <e>
 <k>interface_id</k>
-<v>13304</v>
+<v>13300</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23214,7 +23213,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>156208</v>
+<v>156153</v>
 </b>
 </bs>
 </hist>
@@ -23230,12 +23229,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6781</v>
+<v>6779</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2493</v>
+<v>2492</v>
 </b>
 <b>
 <a>3</a>
@@ -23255,7 +23254,7 @@
 <b>
 <a>7</a>
 <b>58</b>
-<v>1000</v>
+<v>999</v>
 </b>
 <b>
 <a>58</a>
@@ -23619,11 +23618,11 @@
 </relation>
 <relation>
 <name>fields</name>
-<cardinality>556630</cardinality>
+<cardinality>556435</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>556630</v>
+<v>556435</v>
 </e>
 <e>
 <k>kind</k>
@@ -23631,19 +23630,19 @@
 </e>
 <e>
 <k>name</k>
-<v>218589</v>
+<v>218513</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>103754</v>
+<v>103718</v>
 </e>
 <e>
 <k>type_id</k>
-<v>89664</v>
+<v>89633</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>548921</v>
+<v>548729</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23657,7 +23656,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556630</v>
+<v>556435</v>
 </b>
 </bs>
 </hist>
@@ -23673,7 +23672,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556630</v>
+<v>556435</v>
 </b>
 </bs>
 </hist>
@@ -23689,7 +23688,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556630</v>
+<v>556435</v>
 </b>
 </bs>
 </hist>
@@ -23705,7 +23704,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556630</v>
+<v>556435</v>
 </b>
 </bs>
 </hist>
@@ -23721,7 +23720,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556630</v>
+<v>556435</v>
 </b>
 </bs>
 </hist>
@@ -23842,22 +23841,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176470</v>
+<v>176408</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22604</v>
+<v>22596</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>16583</v>
+<v>16577</v>
 </b>
 <b>
 <a>14</a>
 <b>4800</b>
-<v>2932</v>
+<v>2931</v>
 </b>
 </bs>
 </hist>
@@ -23873,12 +23872,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>209217</v>
+<v>209144</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9372</v>
+<v>9369</v>
 </b>
 </bs>
 </hist>
@@ -23894,22 +23893,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176494</v>
+<v>176432</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22589</v>
+<v>22581</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>16573</v>
+<v>16567</v>
 </b>
 <b>
 <a>14</a>
 <b>4800</b>
-<v>2932</v>
+<v>2931</v>
 </b>
 </bs>
 </hist>
@@ -23925,17 +23924,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>188999</v>
+<v>188933</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17686</v>
+<v>17679</v>
 </b>
 <b>
 <a>3</a>
 <b>2459</b>
-<v>11904</v>
+<v>11900</v>
 </b>
 </bs>
 </hist>
@@ -23951,17 +23950,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176860</v>
+<v>176798</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22608</v>
+<v>22600</v>
 </b>
 <b>
 <a>3</a>
 <b>15</b>
-<v>16500</v>
+<v>16494</v>
 </b>
 <b>
 <a>15</a>
@@ -23982,42 +23981,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27365</v>
+<v>27356</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21184</v>
+<v>21176</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12592</v>
+<v>12588</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10118</v>
+<v>10115</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7947</v>
+<v>7944</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9289</v>
+<v>9286</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8162</v>
+<v>8159</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7093</v>
+<v>7091</v>
 </b>
 </bs>
 </hist>
@@ -24033,7 +24032,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102662</v>
+<v>102626</v>
 </b>
 <b>
 <a>2</a>
@@ -24054,42 +24053,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27365</v>
+<v>27356</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21189</v>
+<v>21181</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12597</v>
+<v>12592</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10113</v>
+<v>10110</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7947</v>
+<v>7944</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9294</v>
+<v>9291</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8162</v>
+<v>8159</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7084</v>
+<v>7081</v>
 </b>
 </bs>
 </hist>
@@ -24105,37 +24104,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44603</v>
+<v>44587</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21237</v>
+<v>21230</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>9450</v>
+<v>9447</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7376</v>
+<v>7374</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>6171</v>
+<v>6169</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>9606</v>
+<v>9603</v>
 </b>
 <b>
 <a>9</a>
 <b>132</b>
-<v>5308</v>
+<v>5306</v>
 </b>
 </bs>
 </hist>
@@ -24151,42 +24150,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27365</v>
+<v>27356</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21184</v>
+<v>21176</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12592</v>
+<v>12588</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10118</v>
+<v>10115</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7947</v>
+<v>7944</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9289</v>
+<v>9286</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8162</v>
+<v>8159</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7093</v>
+<v>7091</v>
 </b>
 </bs>
 </hist>
@@ -24202,32 +24201,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55892</v>
+<v>55873</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10899</v>
+<v>10895</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6220</v>
+<v>6218</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7981</v>
+<v>7979</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>6801</v>
+<v>6798</v>
 </b>
 <b>
 <a>27</a>
 <b>9290</b>
-<v>1868</v>
+<v>1867</v>
 </b>
 </bs>
 </hist>
@@ -24243,12 +24242,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87464</v>
+<v>87433</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2200</v>
+<v>2199</v>
 </b>
 </bs>
 </hist>
@@ -24264,22 +24263,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>63835</v>
+<v>63813</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9333</v>
+<v>9330</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>7898</v>
+<v>7896</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>6849</v>
+<v>6847</v>
 </b>
 <b>
 <a>18</a>
@@ -24300,22 +24299,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68426</v>
+<v>68402</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10055</v>
+<v>10051</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>7245</v>
+<v>7242</v>
 </b>
 <b>
 <a>7</a>
 <b>5746</b>
-<v>3937</v>
+<v>3935</v>
 </b>
 </bs>
 </hist>
@@ -24331,27 +24330,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55936</v>
+<v>55917</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11226</v>
+<v>11222</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5932</v>
+<v>5930</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7957</v>
+<v>7954</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>6757</v>
+<v>6754</v>
 </b>
 <b>
 <a>27</a>
@@ -24372,7 +24371,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548009</v>
+<v>547817</v>
 </b>
 <b>
 <a>2</a>
@@ -24393,7 +24392,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548921</v>
+<v>548729</v>
 </b>
 </bs>
 </hist>
@@ -24409,7 +24408,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548921</v>
+<v>548729</v>
 </b>
 </bs>
 </hist>
@@ -24425,7 +24424,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548009</v>
+<v>547817</v>
 </b>
 <b>
 <a>2</a>
@@ -24446,7 +24445,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548424</v>
+<v>548231</v>
 </b>
 <b>
 <a>2</a>
@@ -24461,15 +24460,15 @@
 </relation>
 <relation>
 <name>field_location</name>
-<cardinality>637522</cardinality>
+<cardinality>637299</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>549253</v>
+<v>549060</v>
 </e>
 <e>
 <k>loc</k>
-<v>52936</v>
+<v>52917</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24483,17 +24482,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>467009</v>
+<v>466845</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>78228</v>
+<v>78201</v>
 </b>
 <b>
 <a>3</a>
 <b>57</b>
-<v>4015</v>
+<v>4013</v>
 </b>
 </bs>
 </hist>
@@ -24509,12 +24508,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49423</v>
+<v>49406</v>
 </b>
 <b>
 <a>2</a>
 <b>8882</b>
-<v>3512</v>
+<v>3511</v>
 </b>
 </bs>
 </hist>
@@ -24524,11 +24523,11 @@
 </relation>
 <relation>
 <name>localvars</name>
-<cardinality>163698</cardinality>
+<cardinality>163706</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163698</v>
+<v>163706</v>
 </e>
 <e>
 <k>kind</k>
@@ -24536,7 +24535,7 @@
 </e>
 <e>
 <k>name</k>
-<v>22594</v>
+<v>22595</v>
 </e>
 <e>
 <k>implicitly_typed</k>
@@ -24544,11 +24543,11 @@
 </e>
 <e>
 <k>type_id</k>
-<v>7297</v>
+<v>7298</v>
 </e>
 <e>
 <k>parent_id</k>
-<v>163698</v>
+<v>163706</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24562,7 +24561,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -24578,7 +24577,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -24594,7 +24593,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -24610,7 +24609,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -24626,7 +24625,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -24650,8 +24649,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162444</a>
-<b>162445</b>
+<a>162452</a>
+<b>162453</b>
 <v>1</v>
 </b>
 </bs>
@@ -24676,8 +24675,8 @@
 <v>1</v>
 </b>
 <b>
-<a>22381</a>
-<b>22382</b>
+<a>22382</a>
+<b>22383</b>
 <v>1</v>
 </b>
 </bs>
@@ -24723,8 +24722,8 @@
 <v>1</v>
 </b>
 <b>
-<a>7292</a>
-<b>7293</b>
+<a>7293</a>
+<b>7294</b>
 <v>1</v>
 </b>
 </bs>
@@ -24749,8 +24748,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162879</a>
-<b>162880</b>
+<a>162887</a>
+<b>162888</b>
 <v>1</v>
 </b>
 </bs>
@@ -24767,17 +24766,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14114</v>
+<v>14115</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3485</v>
+<v>3484</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1460</v>
+<v>1461</v>
 </b>
 <b>
 <a>4</a>
@@ -24803,7 +24802,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22502</v>
+<v>22503</v>
 </b>
 <b>
 <a>2</a>
@@ -24829,7 +24828,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>2659</v>
+<v>2660</v>
 </b>
 </bs>
 </hist>
@@ -24850,7 +24849,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1908</v>
+<v>1909</v>
 </b>
 <b>
 <a>3</a>
@@ -24871,17 +24870,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14080</v>
+<v>14081</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3503</v>
+<v>3502</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1460</v>
+<v>1461</v>
 </b>
 <b>
 <a>4</a>
@@ -24905,13 +24904,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36617</a>
-<b>36618</b>
+<a>36624</a>
+<b>36625</b>
 <v>1</v>
 </b>
 <b>
-<a>126644</a>
-<b>126645</b>
+<a>126645</a>
+<b>126646</b>
 <v>1</v>
 </b>
 </bs>
@@ -24947,8 +24946,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>8547</a>
-<b>8548</b>
+<a>8549</a>
+<b>8550</b>
 <v>1</v>
 </b>
 <b>
@@ -24968,8 +24967,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>2802</a>
-<b>2803</b>
+<a>2804</a>
+<b>2805</b>
 <v>1</v>
 </b>
 <b>
@@ -24989,13 +24988,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36766</a>
-<b>36767</b>
+<a>36773</a>
+<b>36774</b>
 <v>1</v>
 </b>
 <b>
-<a>126932</a>
-<b>126933</b>
+<a>126933</a>
+<b>126934</b>
 <v>1</v>
 </b>
 </bs>
@@ -25017,7 +25016,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1136</v>
+<v>1137</v>
 </b>
 <b>
 <a>3</a>
@@ -25041,7 +25040,7 @@
 </b>
 <b>
 <a>35</a>
-<b>37235</b>
+<b>37236</b>
 <v>317</v>
 </b>
 </bs>
@@ -25058,7 +25057,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7268</v>
+<v>7269</v>
 </b>
 <b>
 <a>2</a>
@@ -25084,7 +25083,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1327</v>
+<v>1328</v>
 </b>
 <b>
 <a>3</a>
@@ -25125,7 +25124,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1684</v>
+<v>1685</v>
 </b>
 </bs>
 </hist>
@@ -25146,7 +25145,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1168</v>
+<v>1169</v>
 </b>
 <b>
 <a>3</a>
@@ -25170,7 +25169,7 @@
 </b>
 <b>
 <a>35</a>
-<b>37240</b>
+<b>37241</b>
 <v>319</v>
 </b>
 </bs>
@@ -25187,7 +25186,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -25203,7 +25202,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -25219,7 +25218,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -25235,7 +25234,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -25251,7 +25250,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163698</v>
+<v>163706</v>
 </b>
 </bs>
 </hist>
@@ -25261,15 +25260,15 @@
 </relation>
 <relation>
 <name>localvar_location</name>
-<cardinality>163261</cardinality>
+<cardinality>163269</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163261</v>
+<v>163269</v>
 </e>
 <e>
 <k>loc</k>
-<v>163182</v>
+<v>163189</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25283,7 +25282,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163261</v>
+<v>163269</v>
 </b>
 </bs>
 </hist>
@@ -25299,12 +25298,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163103</v>
+<v>163109</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79</v>
+<v>80</v>
 </b>
 </bs>
 </hist>
@@ -25314,23 +25313,23 @@
 </relation>
 <relation>
 <name>params</name>
-<cardinality>2421790</cardinality>
+<cardinality>2420706</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2421790</v>
+<v>2420706</v>
 </e>
 <e>
 <k>name</k>
-<v>80946</v>
+<v>80917</v>
 </e>
 <e>
 <k>type_id</k>
-<v>331136</v>
+<v>331020</v>
 </e>
 <e>
 <k>index</k>
-<v>200</v>
+<v>199</v>
 </e>
 <e>
 <k>mode</k>
@@ -25338,11 +25337,11 @@
 </e>
 <e>
 <k>parent_id</k>
-<v>1372160</v>
+<v>1371444</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>1437625</v>
+<v>1436887</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25356,7 +25355,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2421790</v>
+<v>2420706</v>
 </b>
 </bs>
 </hist>
@@ -25372,7 +25371,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2421790</v>
+<v>2420706</v>
 </b>
 </bs>
 </hist>
@@ -25388,7 +25387,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2421790</v>
+<v>2420706</v>
 </b>
 </bs>
 </hist>
@@ -25404,7 +25403,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2421790</v>
+<v>2420706</v>
 </b>
 </bs>
 </hist>
@@ -25420,7 +25419,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2421790</v>
+<v>2420706</v>
 </b>
 </bs>
 </hist>
@@ -25436,7 +25435,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2421790</v>
+<v>2420706</v>
 </b>
 </bs>
 </hist>
@@ -25452,42 +25451,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31166</v>
+<v>31155</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13875</v>
+<v>13870</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7069</v>
+<v>7067</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4844</v>
+<v>4843</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6659</v>
+<v>6657</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6903</v>
+<v>6906</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6093</v>
+<v>6086</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4332</v>
+<v>4330</v>
 </b>
 </bs>
 </hist>
@@ -25503,22 +25502,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64318</v>
+<v>64296</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8172</v>
+<v>8169</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>6181</v>
+<v>6179</v>
 </b>
 <b>
 <a>12</a>
 <b>6855</b>
-<v>2273</v>
+<v>2272</v>
 </b>
 </bs>
 </hist>
@@ -25534,22 +25533,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55097</v>
+<v>55078</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14587</v>
+<v>14582</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5522</v>
+<v>5520</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>5737</v>
+<v>5735</v>
 </b>
 </bs>
 </hist>
@@ -25565,12 +25564,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75906</v>
+<v>75879</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>5039</v>
+<v>5038</v>
 </b>
 </bs>
 </hist>
@@ -25586,42 +25585,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31166</v>
+<v>31155</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13875</v>
+<v>13870</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7069</v>
+<v>7067</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4844</v>
+<v>4843</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6659</v>
+<v>6657</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6903</v>
+<v>6906</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6093</v>
+<v>6086</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4332</v>
+<v>4330</v>
 </b>
 </bs>
 </hist>
@@ -25637,42 +25636,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31556</v>
+<v>31545</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14104</v>
+<v>14099</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7084</v>
+<v>7081</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4961</v>
+<v>4960</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6488</v>
+<v>6486</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6918</v>
+<v>6920</v>
 </b>
 <b>
 <a>13</a>
 <b>43</b>
-<v>6166</v>
+<v>6159</v>
 </b>
 <b>
 <a>43</a>
 <b>36753</b>
-<v>3664</v>
+<v>3662</v>
 </b>
 </bs>
 </hist>
@@ -25688,27 +25687,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>227947</v>
+<v>227867</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39006</v>
+<v>38993</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30132</v>
+<v>30121</v>
 </b>
 <b>
 <a>6</a>
 <b>24</b>
-<v>25102</v>
+<v>25093</v>
 </b>
 <b>
 <a>24</a>
-<b>48953</b>
-<v>8947</v>
+<b>48952</b>
+<v>8944</v>
 </b>
 </bs>
 </hist>
@@ -25724,17 +25723,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>289578</v>
+<v>289476</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>30542</v>
+<v>30531</v>
 </b>
 <b>
 <a>4</a>
 <b>2470</b>
-<v>11016</v>
+<v>11012</v>
 </b>
 </bs>
 </hist>
@@ -25750,17 +25749,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>292647</v>
+<v>292544</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25116</v>
+<v>25107</v>
 </b>
 <b>
 <a>3</a>
 <b>36</b>
-<v>13373</v>
+<v>13368</v>
 </b>
 </bs>
 </hist>
@@ -25776,12 +25775,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>322413</v>
+<v>322300</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>8723</v>
+<v>8720</v>
 </b>
 </bs>
 </hist>
@@ -25797,27 +25796,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>230450</v>
+<v>230369</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37045</v>
+<v>37032</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30546</v>
+<v>30536</v>
 </b>
 <b>
 <a>6</a>
 <b>25</b>
-<v>25062</v>
+<v>25054</v>
 </b>
 <b>
 <a>25</a>
-<b>40410</b>
-<v>8030</v>
+<b>40409</b>
+<v>8027</v>
 </b>
 </bs>
 </hist>
@@ -25833,27 +25832,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>233646</v>
+<v>233564</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34962</v>
+<v>34950</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>25785</v>
+<v>25776</v>
 </b>
 <b>
 <a>5</a>
 <b>16</b>
-<v>25345</v>
+<v>25341</v>
 </b>
 <b>
 <a>16</a>
-<b>33991</b>
-<v>11397</v>
+<b>33990</b>
+<v>11388</v>
 </b>
 </bs>
 </hist>
@@ -25928,7 +25927,7 @@
 </b>
 <b>
 <a>47756</a>
-<b>281050</b>
+<b>281002</b>
 <v>14</v>
 </b>
 </bs>
@@ -26212,7 +26211,7 @@
 </b>
 <b>
 <a>47756</a>
-<b>281050</b>
+<b>281002</b>
 <v>14</v>
 </b>
 </bs>
@@ -26288,7 +26287,7 @@
 </b>
 <b>
 <a>29619</a>
-<b>168470</b>
+<b>168422</b>
 <v>14</v>
 </b>
 </bs>
@@ -26328,8 +26327,8 @@
 <v>4</v>
 </b>
 <b>
-<a>473106</a>
-<b>473107</b>
+<a>473058</a>
+<b>473059</b>
 <v>4</v>
 </b>
 </bs>
@@ -26492,8 +26491,8 @@
 <v>4</v>
 </b>
 <b>
-<a>274248</a>
-<b>274249</b>
+<a>274200</a>
+<b>274201</b>
 <v>4</v>
 </b>
 </bs>
@@ -26533,8 +26532,8 @@
 <v>4</v>
 </b>
 <b>
-<a>275451</a>
-<b>275452</b>
+<a>275403</a>
+<b>275404</b>
 <v>4</v>
 </b>
 </bs>
@@ -26551,22 +26550,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806108</v>
+<v>805591</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333200</v>
+<v>333083</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129408</v>
+<v>129362</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102930</v>
+<v>102894</v>
 </b>
 <b>
 <a>17</a>
@@ -26587,22 +26586,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806108</v>
+<v>805591</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333200</v>
+<v>333083</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129408</v>
+<v>129362</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102930</v>
+<v>102894</v>
 </b>
 <b>
 <a>17</a>
@@ -26623,22 +26622,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>855741</v>
+<v>855207</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333498</v>
+<v>333381</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>113468</v>
+<v>113429</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>69451</v>
+<v>69426</v>
 </b>
 </bs>
 </hist>
@@ -26654,22 +26653,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806108</v>
+<v>805591</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333200</v>
+<v>333083</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129408</v>
+<v>129362</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102930</v>
+<v>102894</v>
 </b>
 <b>
 <a>17</a>
@@ -26690,12 +26689,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1303538</v>
+<v>1302847</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>68621</v>
+<v>68597</v>
 </b>
 </bs>
 </hist>
@@ -26711,22 +26710,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806108</v>
+<v>805591</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333200</v>
+<v>333083</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129408</v>
+<v>129362</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102930</v>
+<v>102894</v>
 </b>
 <b>
 <a>17</a>
@@ -26747,12 +26746,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1387260</v>
+<v>1386539</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50365</v>
+<v>50347</v>
 </b>
 </bs>
 </hist>
@@ -26768,7 +26767,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1437625</v>
+<v>1436887</v>
 </b>
 </bs>
 </hist>
@@ -26784,12 +26783,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1419490</v>
+<v>1418758</v>
 </b>
 <b>
 <a>2</a>
 <b>3718</b>
-<v>18134</v>
+<v>18128</v>
 </b>
 </bs>
 </hist>
@@ -26805,7 +26804,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1437625</v>
+<v>1436887</v>
 </b>
 </bs>
 </hist>
@@ -26821,7 +26820,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1437625</v>
+<v>1436887</v>
 </b>
 </bs>
 </hist>
@@ -26837,12 +26836,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1387260</v>
+<v>1386539</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50365</v>
+<v>50347</v>
 </b>
 </bs>
 </hist>
@@ -26852,15 +26851,15 @@
 </relation>
 <relation>
 <name>param_location</name>
-<cardinality>2691916</cardinality>
+<cardinality>2690693</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2418092</v>
+<v>2417009</v>
 </e>
 <e>
 <k>loc</k>
-<v>137770</v>
+<v>137722</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -26874,17 +26873,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2154479</v>
+<v>2153533</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>256796</v>
+<v>256662</v>
 </b>
 <b>
 <a>3</a>
 <b>60</b>
-<v>6815</v>
+<v>6813</v>
 </b>
 </bs>
 </hist>
@@ -26900,12 +26899,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133443</v>
+<v>133396</v>
 </b>
 <b>
 <a>2</a>
 <b>99581</b>
-<v>4327</v>
+<v>4326</v>
 </b>
 </bs>
 </hist>
@@ -26915,11 +26914,11 @@
 </relation>
 <relation>
 <name>statements</name>
-<cardinality>991566</cardinality>
+<cardinality>991182</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>991566</v>
+<v>991182</v>
 </e>
 <e>
 <k>kind</k>
@@ -26937,7 +26936,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>991566</v>
+<v>991182</v>
 </b>
 </bs>
 </hist>
@@ -27038,11 +27037,11 @@
 </relation>
 <relation>
 <name>stmt_parent</name>
-<cardinality>819904</cardinality>
+<cardinality>819587</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>819904</v>
+<v>819587</v>
 </e>
 <e>
 <k>index</k>
@@ -27050,7 +27049,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>434351</v>
+<v>434183</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27064,7 +27063,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>819904</v>
+<v>819587</v>
 </b>
 </bs>
 </hist>
@@ -27080,7 +27079,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>819904</v>
+<v>819587</v>
 </b>
 </bs>
 </hist>
@@ -27238,22 +27237,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>293533</v>
+<v>293419</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>75337</v>
+<v>75308</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>38120</v>
+<v>38106</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27359</v>
+<v>27349</v>
 </b>
 </bs>
 </hist>
@@ -27269,22 +27268,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>293533</v>
+<v>293419</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>75337</v>
+<v>75308</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>38120</v>
+<v>38106</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27359</v>
+<v>27349</v>
 </b>
 </bs>
 </hist>
@@ -27294,11 +27293,11 @@
 </relation>
 <relation>
 <name>stmt_parent_top_level</name>
-<cardinality>171661</cardinality>
+<cardinality>171595</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>171661</v>
+<v>171595</v>
 </e>
 <e>
 <k>index</k>
@@ -27306,7 +27305,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>123158</v>
+<v>123110</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27320,7 +27319,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171661</v>
+<v>171595</v>
 </b>
 </bs>
 </hist>
@@ -27336,7 +27335,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171661</v>
+<v>171595</v>
 </b>
 </bs>
 </hist>
@@ -27384,17 +27383,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>77129</v>
+<v>77099</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43658</v>
+<v>43641</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2370</v>
+<v>2369</v>
 </b>
 </bs>
 </hist>
@@ -27410,7 +27409,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>123158</v>
+<v>123110</v>
 </b>
 </bs>
 </hist>
@@ -27420,15 +27419,15 @@
 </relation>
 <relation>
 <name>stmt_location</name>
-<cardinality>991566</cardinality>
+<cardinality>991182</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>991566</v>
+<v>991182</v>
 </e>
 <e>
 <k>loc</k>
-<v>959912</v>
+<v>959540</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27442,7 +27441,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>991566</v>
+<v>991182</v>
 </b>
 </bs>
 </hist>
@@ -27458,12 +27457,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>928257</v>
+<v>927898</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31654</v>
+<v>31642</v>
 </b>
 </bs>
 </hist>
@@ -27473,11 +27472,11 @@
 </relation>
 <relation>
 <name>catch_type</name>
-<cardinality>3440</cardinality>
+<cardinality>3438</cardinality>
 <columnsizes>
 <e>
 <k>catch_id</k>
-<v>3440</v>
+<v>3438</v>
 </e>
 <e>
 <k>type_id</k>
@@ -27499,7 +27498,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3440</v>
+<v>3438</v>
 </b>
 </bs>
 </hist>
@@ -27515,7 +27514,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3440</v>
+<v>3438</v>
 </b>
 </bs>
 </hist>
@@ -27639,11 +27638,11 @@
 </relation>
 <relation>
 <name>expressions</name>
-<cardinality>4261141</cardinality>
+<cardinality>4259646</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4261141</v>
+<v>4259646</v>
 </e>
 <e>
 <k>kind</k>
@@ -27651,7 +27650,7 @@
 </e>
 <e>
 <k>type_id</k>
-<v>70422</v>
+<v>70397</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27665,7 +27664,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4261141</v>
+<v>4259646</v>
 </b>
 </bs>
 </hist>
@@ -27681,7 +27680,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4261141</v>
+<v>4259646</v>
 </b>
 </bs>
 </hist>
@@ -27829,47 +27828,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12855</v>
+<v>12851</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21672</v>
+<v>21664</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3342</v>
+<v>3340</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5605</v>
+<v>5603</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>5620</v>
+<v>5618</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>5596</v>
+<v>5594</v>
 </b>
 <b>
 <a>11</a>
 <b>20</b>
-<v>5552</v>
+<v>5550</v>
 </b>
 <b>
 <a>20</a>
 <b>51</b>
-<v>5318</v>
+<v>5316</v>
 </b>
 <b>
 <a>51</a>
 <b>139941</b>
-<v>4859</v>
+<v>4857</v>
 </b>
 </bs>
 </hist>
@@ -27885,27 +27884,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31234</v>
+<v>31223</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24984</v>
+<v>24976</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5278</v>
+<v>5277</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>5113</v>
+<v>5111</v>
 </b>
 <b>
 <a>6</a>
 <b>34</b>
-<v>3810</v>
+<v>3809</v>
 </b>
 </bs>
 </hist>
@@ -27915,19 +27914,19 @@
 </relation>
 <relation>
 <name>expr_parent</name>
-<cardinality>3939265</cardinality>
+<cardinality>3937895</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>3939265</v>
+<v>3937895</v>
 </e>
 <e>
 <k>index</k>
-<v>79789</v>
+<v>79758</v>
 </e>
 <e>
 <k>parent</k>
-<v>2585963</v>
+<v>2585040</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27941,7 +27940,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3939265</v>
+<v>3937895</v>
 </b>
 </bs>
 </hist>
@@ -27957,7 +27956,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3939265</v>
+<v>3937895</v>
 </b>
 </bs>
 </hist>
@@ -27973,22 +27972,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66169</v>
+<v>66144</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6195</v>
+<v>6192</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6039</v>
+<v>6036</v>
 </b>
 <b>
 <a>13</a>
-<b>1629890</b>
-<v>1385</v>
+<b>1629954</b>
+<v>1384</v>
 </b>
 </bs>
 </hist>
@@ -28004,22 +28003,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66169</v>
+<v>66144</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6195</v>
+<v>6192</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6039</v>
+<v>6036</v>
 </b>
 <b>
 <a>13</a>
-<b>1629890</b>
-<v>1385</v>
+<b>1629954</b>
+<v>1384</v>
 </b>
 </bs>
 </hist>
@@ -28035,17 +28034,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1623465</v>
+<v>1622839</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>833193</v>
+<v>832946</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>129304</v>
+<v>129254</v>
 </b>
 </bs>
 </hist>
@@ -28061,17 +28060,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1623465</v>
+<v>1622839</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>833193</v>
+<v>832946</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>129304</v>
+<v>129254</v>
 </b>
 </bs>
 </hist>
@@ -28081,11 +28080,11 @@
 </relation>
 <relation>
 <name>expr_parent_top_level</name>
-<cardinality>504665</cardinality>
+<cardinality>504488</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>504665</v>
+<v>504488</v>
 </e>
 <e>
 <k>index</k>
@@ -28093,7 +28092,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>436355</v>
+<v>436202</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28107,7 +28106,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>504665</v>
+<v>504488</v>
 </b>
 </bs>
 </hist>
@@ -28123,7 +28122,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>504665</v>
+<v>504488</v>
 </b>
 </bs>
 </hist>
@@ -28251,17 +28250,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396265</v>
+<v>396126</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35718</v>
+<v>35705</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4371</v>
+<v>4369</v>
 </b>
 </bs>
 </hist>
@@ -28277,17 +28276,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396445</v>
+<v>396306</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35596</v>
+<v>35584</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4312</v>
+<v>4311</v>
 </b>
 </bs>
 </hist>
@@ -28308,11 +28307,11 @@
 </relation>
 <relation>
 <name>explicitly_sized_array_creation</name>
-<cardinality>4356</cardinality>
+<cardinality>4355</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4356</v>
+<v>4355</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -28389,26 +28388,26 @@
 </relation>
 <relation>
 <name>expr_compiler_generated</name>
-<cardinality>1636465</cardinality>
+<cardinality>1635891</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1636465</v>
+<v>1635891</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_value</name>
-<cardinality>1402656</cardinality>
+<cardinality>1401346</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1402656</v>
+<v>1401346</v>
 </e>
 <e>
 <k>value</k>
-<v>102872</v>
+<v>102877</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28422,7 +28421,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1402656</v>
+<v>1401346</v>
 </b>
 </bs>
 </hist>
@@ -28438,27 +28437,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72270</v>
+<v>72269</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14976</v>
+<v>14980</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>7876</v>
+<v>7877</v>
 </b>
 <b>
 <a>6</a>
-<b>2345</b>
+<b>2295</b>
 <v>7716</v>
 </b>
 <b>
-<a>2360</a>
-<b>272221</b>
-<v>34</v>
+<a>2344</a>
+<b>270846</b>
+<v>35</v>
 </b>
 </bs>
 </hist>
@@ -28468,15 +28467,15 @@
 </relation>
 <relation>
 <name>expr_call</name>
-<cardinality>679349</cardinality>
+<cardinality>679354</cardinality>
 <columnsizes>
 <e>
 <k>caller_id</k>
-<v>679349</v>
+<v>679354</v>
 </e>
 <e>
 <k>target_id</k>
-<v>53845</v>
+<v>53851</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28490,7 +28489,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>679349</v>
+<v>679354</v>
 </b>
 </bs>
 </hist>
@@ -28506,22 +28505,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28345</v>
+<v>28346</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10445</v>
+<v>10447</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4322</v>
+<v>4324</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>4791</v>
+<v>4789</v>
 </b>
 <b>
 <a>7</a>
@@ -28531,7 +28530,7 @@
 <b>
 <a>24</a>
 <b>43831</b>
-<v>1855</v>
+<v>1858</v>
 </b>
 </bs>
 </hist>
@@ -28541,15 +28540,15 @@
 </relation>
 <relation>
 <name>expr_access</name>
-<cardinality>1388885</cardinality>
+<cardinality>1388349</cardinality>
 <columnsizes>
 <e>
 <k>accesser_id</k>
-<v>1388885</v>
+<v>1388349</v>
 </e>
 <e>
 <k>target_id</k>
-<v>331317</v>
+<v>331188</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28563,7 +28562,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1388885</v>
+<v>1388349</v>
 </b>
 </bs>
 </hist>
@@ -28579,37 +28578,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>104672</v>
+<v>104632</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70710</v>
+<v>70681</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>51571</v>
+<v>51552</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>33414</v>
+<v>33401</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>18848</v>
+<v>18840</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>27035</v>
+<v>27025</v>
 </b>
 <b>
 <a>9</a>
 <b>185</b>
-<v>24851</v>
+<v>24842</v>
 </b>
 <b>
 <a>185</a>
@@ -28624,15 +28623,15 @@
 </relation>
 <relation>
 <name>expr_location</name>
-<cardinality>4261141</cardinality>
+<cardinality>4259646</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4261141</v>
+<v>4259646</v>
 </e>
 <e>
 <k>loc</k>
-<v>2613278</v>
+<v>2612361</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28646,7 +28645,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4261141</v>
+<v>4259646</v>
 </b>
 </bs>
 </hist>
@@ -28662,17 +28661,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1993792</v>
+<v>1993093</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>610396</v>
+<v>610181</v>
 </b>
 <b>
 <a>3</a>
 <b>111245</b>
-<v>9089</v>
+<v>9086</v>
 </b>
 </bs>
 </hist>
@@ -28682,15 +28681,15 @@
 </relation>
 <relation>
 <name>dynamic_member_name</name>
-<cardinality>13651</cardinality>
+<cardinality>13646</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>13651</v>
+<v>13646</v>
 </e>
 <e>
 <k>name</k>
-<v>1410</v>
+<v>1409</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28704,7 +28703,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13651</v>
+<v>13646</v>
 </b>
 </bs>
 </hist>
@@ -28730,7 +28729,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>161</v>
+<v>160</v>
 </b>
 <b>
 <a>4</a>
@@ -28770,22 +28769,22 @@
 </relation>
 <relation>
 <name>conditional_access</name>
-<cardinality>3078</cardinality>
+<cardinality>3077</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3078</v>
+<v>3077</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_argument</name>
-<cardinality>875542</cardinality>
+<cardinality>875547</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>875542</v>
+<v>875547</v>
 </e>
 <e>
 <k>mode</k>
@@ -28803,7 +28802,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>875542</v>
+<v>875547</v>
 </b>
 </bs>
 </hist>
@@ -28832,8 +28831,8 @@
 <v>1</v>
 </b>
 <b>
-<a>865293</a>
-<b>865294</b>
+<a>865298</a>
+<b>865299</b>
 <v>1</v>
 </b>
 </bs>
@@ -33391,11 +33390,11 @@
 </relation>
 <relation>
 <name>commentline</name>
-<cardinality>410570</cardinality>
+<cardinality>410411</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>410570</v>
+<v>410411</v>
 </e>
 <e>
 <k>kind</k>
@@ -33403,11 +33402,11 @@
 </e>
 <e>
 <k>text</k>
-<v>196955</v>
+<v>196879</v>
 </e>
 <e>
 <k>rawtext</k>
-<v>199566</v>
+<v>199489</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33421,7 +33420,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410570</v>
+<v>410411</v>
 </b>
 </bs>
 </hist>
@@ -33437,7 +33436,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410570</v>
+<v>410411</v>
 </b>
 </bs>
 </hist>
@@ -33453,7 +33452,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410570</v>
+<v>410411</v>
 </b>
 </bs>
 </hist>
@@ -33547,17 +33546,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>161381</v>
+<v>161319</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23475</v>
+<v>23466</v>
 </b>
 <b>
 <a>3</a>
 <b>24462</b>
-<v>12099</v>
+<v>12094</v>
 </b>
 </bs>
 </hist>
@@ -33573,7 +33572,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>195866</v>
+<v>195790</v>
 </b>
 <b>
 <a>2</a>
@@ -33594,12 +33593,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>194880</v>
+<v>194804</v>
 </b>
 <b>
 <a>2</a>
 <b>51</b>
-<v>2075</v>
+<v>2074</v>
 </b>
 </bs>
 </hist>
@@ -33615,17 +33614,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>164703</v>
+<v>164639</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23008</v>
+<v>23000</v>
 </b>
 <b>
 <a>3</a>
 <b>24457</b>
-<v>11854</v>
+<v>11849</v>
 </b>
 </bs>
 </hist>
@@ -33641,7 +33640,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199566</v>
+<v>199489</v>
 </b>
 </bs>
 </hist>
@@ -33657,7 +33656,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199566</v>
+<v>199489</v>
 </b>
 </bs>
 </hist>
@@ -33667,15 +33666,15 @@
 </relation>
 <relation>
 <name>commentline_location</name>
-<cardinality>410570</cardinality>
+<cardinality>410411</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>410570</v>
+<v>410411</v>
 </e>
 <e>
 <k>loc</k>
-<v>410570</v>
+<v>410411</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33689,7 +33688,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410570</v>
+<v>410411</v>
 </b>
 </bs>
 </hist>
@@ -33705,7 +33704,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410570</v>
+<v>410411</v>
 </b>
 </bs>
 </hist>
@@ -33715,26 +33714,26 @@
 </relation>
 <relation>
 <name>commentblock</name>
-<cardinality>144309</cardinality>
+<cardinality>144253</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144309</v>
+<v>144253</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>commentblock_location</name>
-<cardinality>144309</cardinality>
+<cardinality>144253</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144309</v>
+<v>144253</v>
 </e>
 <e>
 <k>loc</k>
-<v>144309</v>
+<v>144253</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33748,7 +33747,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144309</v>
+<v>144253</v>
 </b>
 </bs>
 </hist>
@@ -33764,7 +33763,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144309</v>
+<v>144253</v>
 </b>
 </bs>
 </hist>
@@ -33774,15 +33773,15 @@
 </relation>
 <relation>
 <name>commentblock_binding</name>
-<cardinality>499821</cardinality>
+<cardinality>499627</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144251</v>
+<v>144195</v>
 </e>
 <e>
 <k>entity</k>
-<v>216022</v>
+<v>215939</v>
 </e>
 <e>
 <k>bindtype</k>
@@ -33800,17 +33799,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18055</v>
+<v>18048</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29051</v>
+<v>29040</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>96852</v>
+<v>96815</v>
 </b>
 <b>
 <a>4</a>
@@ -33831,22 +33830,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12954</v>
+<v>12949</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5221</v>
+<v>5219</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>29005</v>
+<v>28994</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>97069</v>
+<v>97031</v>
 </b>
 </bs>
 </hist>
@@ -33862,17 +33861,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>158312</v>
+<v>158251</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>42060</v>
+<v>42044</v>
 </b>
 <b>
 <a>3</a>
 <b>9895</b>
-<v>15650</v>
+<v>15644</v>
 </b>
 </bs>
 </hist>
@@ -33888,17 +33887,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94314</v>
+<v>94278</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>92762</v>
+<v>92726</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>28075</v>
+<v>28064</v>
 </b>
 <b>
 <a>4</a>
@@ -33975,19 +33974,19 @@
 </relation>
 <relation>
 <name>commentblock_child</name>
-<cardinality>543809</cardinality>
+<cardinality>543599</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144309</v>
+<v>144253</v>
 </e>
 <e>
 <k>commentline</k>
-<v>410484</v>
+<v>410325</v>
 </e>
 <e>
 <k>index</k>
-<v>4988</v>
+<v>4986</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -34001,32 +34000,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76894</v>
+<v>76864</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19916</v>
+<v>19909</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18977</v>
+<v>18969</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8964</v>
+<v>8961</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>11474</v>
+<v>11470</v>
 </b>
 <b>
 <a>8</a>
 <b>4098</b>
-<v>8081</v>
+<v>8078</v>
 </b>
 </bs>
 </hist>
@@ -34042,37 +34041,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4205</v>
+<v>4204</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>73590</v>
+<v>73562</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>21666</v>
+<v>21657</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>17224</v>
+<v>17217</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>8622</v>
+<v>8619</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>11194</v>
+<v>11190</v>
 </b>
 <b>
 <a>9</a>
 <b>4099</b>
-<v>7805</v>
+<v>7802</v>
 </b>
 </bs>
 </hist>
@@ -34088,7 +34087,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410475</v>
+<v>410317</v>
 </b>
 <b>
 <a>2</a>
@@ -34109,12 +34108,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>277167</v>
+<v>277060</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>133316</v>
+<v>133265</v>
 </b>
 </bs>
 </hist>
@@ -34130,17 +34129,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2226</v>
+<v>2225</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1379</v>
+<v>1378</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>398</v>
+<v>397</v>
 </b>
 <b>
 <a>7</a>
@@ -34171,17 +34170,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2226</v>
+<v>2225</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1379</v>
+<v>1378</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>398</v>
+<v>397</v>
 </b>
 <b>
 <a>7</a>
@@ -35051,23 +35050,23 @@
 </relation>
 <relation>
 <name>cil_instruction</name>
-<cardinality>32215327</cardinality>
+<cardinality>32204024</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32215327</v>
+<v>32204024</v>
 </e>
 <e>
 <k>opcode</k>
-<v>966</v>
+<v>965</v>
 </e>
 <e>
 <k>index</k>
-<v>332888</v>
+<v>332771</v>
 </e>
 <e>
 <k>impl</k>
-<v>1728633</v>
+<v>1728026</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35081,7 +35080,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32215327</v>
+<v>32204024</v>
 </b>
 </bs>
 </hist>
@@ -35097,7 +35096,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32215327</v>
+<v>32204024</v>
 </b>
 </bs>
 </hist>
@@ -35113,7 +35112,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32215327</v>
+<v>32204024</v>
 </b>
 </bs>
 </hist>
@@ -35367,22 +35366,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>260748</v>
+<v>260657</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30639</v>
+<v>30628</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25526</v>
+<v>25517</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15973</v>
+<v>15967</v>
 </b>
 </bs>
 </hist>
@@ -35398,22 +35397,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>261343</v>
+<v>261252</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17705</v>
+<v>17699</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>28770</v>
+<v>28760</v>
 </b>
 <b>
 <a>5</a>
 <b>160</b>
-<v>24970</v>
+<v>24961</v>
 </b>
 <b>
 <a>160</a>
@@ -35434,22 +35433,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>260748</v>
+<v>260657</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30639</v>
+<v>30628</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25526</v>
+<v>25517</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15973</v>
+<v>15967</v>
 </b>
 </bs>
 </hist>
@@ -35465,57 +35464,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84122</v>
+<v>84092</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252171</v>
+<v>252083</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>332776</v>
+<v>332659</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>196127</v>
+<v>196058</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>107204</v>
+<v>107166</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>158193</v>
+<v>158138</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>151192</v>
+<v>151139</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>134014</v>
+<v>133966</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131662</v>
+<v>131616</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129686</v>
+<v>129640</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51482</v>
+<v>51464</v>
 </b>
 </bs>
 </hist>
@@ -35531,57 +35530,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84122</v>
+<v>84092</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252459</v>
+<v>252370</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>338752</v>
+<v>338633</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>239769</v>
+<v>239685</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>132604</v>
+<v>132557</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>96451</v>
+<v>96417</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>147972</v>
+<v>147920</v>
 </b>
 <b>
 <a>9</a>
 <b>12</b>
-<v>129022</v>
+<v>128977</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>135980</v>
+<v>135932</v>
 </b>
 <b>
 <a>17</a>
 <b>33</b>
-<v>132257</v>
+<v>132211</v>
 </b>
 <b>
 <a>33</a>
 <b>74</b>
-<v>39241</v>
+<v>39227</v>
 </b>
 </bs>
 </hist>
@@ -35597,57 +35596,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84122</v>
+<v>84092</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252171</v>
+<v>252083</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>332776</v>
+<v>332659</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>196127</v>
+<v>196058</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>107204</v>
+<v>107166</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>158193</v>
+<v>158138</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>151192</v>
+<v>151139</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>134014</v>
+<v>133966</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131662</v>
+<v>131616</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129686</v>
+<v>129640</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51482</v>
+<v>51464</v>
 </b>
 </bs>
 </hist>
@@ -35657,15 +35656,15 @@
 </relation>
 <relation>
 <name>cil_jump</name>
-<cardinality>2006765</cardinality>
+<cardinality>2006061</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>2006765</v>
+<v>2006061</v>
 </e>
 <e>
 <k>target</k>
-<v>1607211</v>
+<v>1606647</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35679,7 +35678,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2006765</v>
+<v>2006061</v>
 </b>
 </bs>
 </hist>
@@ -35695,17 +35694,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1393251</v>
+<v>1392763</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>143927</v>
+<v>143877</v>
 </b>
 <b>
 <a>3</a>
 <b>360</b>
-<v>70031</v>
+<v>70007</v>
 </b>
 </bs>
 </hist>
@@ -35715,15 +35714,15 @@
 </relation>
 <relation>
 <name>cil_access</name>
-<cardinality>11945289</cardinality>
+<cardinality>11941098</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>11945289</v>
+<v>11941098</v>
 </e>
 <e>
 <k>target</k>
-<v>2669166</v>
+<v>2668229</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35737,7 +35736,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11945289</v>
+<v>11941098</v>
 </b>
 </bs>
 </hist>
@@ -35753,37 +35752,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>946548</v>
+<v>946216</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>741238</v>
+<v>740978</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>269511</v>
+<v>269416</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>187442</v>
+<v>187377</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>227074</v>
+<v>226994</v>
 </b>
 <b>
 <a>7</a>
 <b>14</b>
-<v>203884</v>
+<v>203813</v>
 </b>
 <b>
 <a>14</a>
 <b>25741</b>
-<v>93465</v>
+<v>93432</v>
 </b>
 </bs>
 </hist>
@@ -35793,15 +35792,15 @@
 </relation>
 <relation>
 <name>cil_value</name>
-<cardinality>1887212</cardinality>
+<cardinality>1886550</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>1887212</v>
+<v>1886550</v>
 </e>
 <e>
 <k>value</k>
-<v>495692</v>
+<v>495518</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35815,7 +35814,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1887212</v>
+<v>1886550</v>
 </b>
 </bs>
 </hist>
@@ -35831,27 +35830,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>334937</v>
+<v>334819</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79140</v>
+<v>79113</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>40777</v>
+<v>40763</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>37313</v>
+<v>37300</v>
 </b>
 <b>
 <a>33</a>
 <b>86799</b>
-<v>3522</v>
+<v>3521</v>
 </b>
 </bs>
 </hist>
@@ -35861,19 +35860,19 @@
 </relation>
 <relation>
 <name>cil_switch</name>
-<cardinality>194732</cardinality>
+<cardinality>194663</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>23892</v>
+<v>23883</v>
 </e>
 <e>
 <k>index</k>
-<v>2522</v>
+<v>2521</v>
 </e>
 <e>
 <k>target</k>
-<v>130828</v>
+<v>130782</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35887,42 +35886,42 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>7030</v>
+<v>7028</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4600</v>
+<v>4599</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3234</v>
+<v>3233</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>1688</v>
+<v>1687</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>1444</v>
+<v>1443</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>2161</v>
+<v>2160</v>
 </b>
 <b>
 <a>11</a>
 <b>17</b>
-<v>1849</v>
+<v>1848</v>
 </b>
 <b>
 <a>17</a>
 <b>128</b>
-<v>1795</v>
+<v>1794</v>
 </b>
 <b>
 <a>141</a>
@@ -35948,22 +35947,22 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>8260</v>
+<v>8257</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5498</v>
+<v>5496</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2576</v>
+<v>2575</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>1844</v>
+<v>1843</v>
 </b>
 <b>
 <a>7</a>
@@ -35973,7 +35972,7 @@
 <b>
 <a>9</a>
 <b>14</b>
-<v>1800</v>
+<v>1799</v>
 </b>
 <b>
 <a>14</a>
@@ -36009,7 +36008,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>361</v>
+<v>360</v>
 </b>
 <b>
 <a>6</a>
@@ -36029,7 +36028,7 @@
 <b>
 <a>25</a>
 <b>47</b>
-<v>200</v>
+<v>199</v>
 </b>
 <b>
 <a>47</a>
@@ -36116,12 +36115,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>129193</v>
+<v>129148</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>1634</v>
+<v>1633</v>
 </b>
 </bs>
 </hist>
@@ -36137,17 +36136,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118416</v>
+<v>118374</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>10016</v>
+<v>10012</v>
 </b>
 <b>
 <a>7</a>
 <b>253</b>
-<v>2395</v>
+<v>2394</v>
 </b>
 </bs>
 </hist>
@@ -36225,15 +36224,15 @@
 </relation>
 <relation>
 <name>cil_type_location</name>
-<cardinality>277815</cardinality>
+<cardinality>277717</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>255406</v>
+<v>255316</v>
 </e>
 <e>
 <k>loc</k>
-<v>3420</v>
+<v>3418</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36247,12 +36246,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>232997</v>
+<v>232915</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22408</v>
+<v>22400</v>
 </b>
 </bs>
 </hist>
@@ -36338,15 +36337,15 @@
 </relation>
 <relation>
 <name>cil_method_location</name>
-<cardinality>1887168</cardinality>
+<cardinality>1886506</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1799611</v>
+<v>1798980</v>
 </e>
 <e>
 <k>loc</k>
-<v>3132</v>
+<v>3131</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36360,12 +36359,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1712054</v>
+<v>1711454</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>87556</v>
+<v>87526</v>
 </b>
 </bs>
 </hist>
@@ -36401,12 +36400,12 @@
 <b>
 <a>53</a>
 <b>79</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>80</a>
 <b>107</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>107</a>
@@ -36421,22 +36420,22 @@
 <b>
 <a>204</a>
 <b>278</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>281</a>
 <b>385</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>388</a>
 <b>734</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>735</a>
 <b>1631</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>1646</a>
@@ -36451,15 +36450,15 @@
 </relation>
 <relation>
 <name>cil_type</name>
-<cardinality>796111</cardinality>
+<cardinality>795832</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>796111</v>
+<v>795832</v>
 </e>
 <e>
 <k>name</k>
-<v>179373</v>
+<v>179310</v>
 </e>
 <e>
 <k>kind</k>
@@ -36467,11 +36466,11 @@
 </e>
 <e>
 <k>parent</k>
-<v>155691</v>
+<v>155636</v>
 </e>
 <e>
 <k>sourceDecl</k>
-<v>465394</v>
+<v>465231</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36485,7 +36484,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796111</v>
+<v>795832</v>
 </b>
 </bs>
 </hist>
@@ -36501,7 +36500,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796111</v>
+<v>795832</v>
 </b>
 </bs>
 </hist>
@@ -36517,7 +36516,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796111</v>
+<v>795832</v>
 </b>
 </bs>
 </hist>
@@ -36533,7 +36532,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796111</v>
+<v>795832</v>
 </b>
 </bs>
 </hist>
@@ -36549,22 +36548,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>137892</v>
+<v>137844</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22530</v>
+<v>22522</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>14173</v>
+<v>14168</v>
 </b>
 <b>
 <a>7</a>
 <b>21324</b>
-<v>4776</v>
+<v>4774</v>
 </b>
 </bs>
 </hist>
@@ -36580,7 +36579,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179373</v>
+<v>179310</v>
 </b>
 </bs>
 </hist>
@@ -36596,17 +36595,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162697</v>
+<v>162640</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>13665</v>
+<v>13661</v>
 </b>
 <b>
 <a>4</a>
 <b>21324</b>
-<v>3010</v>
+<v>3009</v>
 </b>
 </bs>
 </hist>
@@ -36622,17 +36621,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>146367</v>
+<v>146316</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22555</v>
+<v>22547</v>
 </b>
 <b>
 <a>3</a>
 <b>21324</b>
-<v>10450</v>
+<v>10446</v>
 </b>
 </bs>
 </hist>
@@ -36772,22 +36771,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101949</v>
+<v>101914</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>26838</v>
+<v>26829</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13363</v>
+<v>13358</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>11719</v>
+<v>11715</v>
 </b>
 <b>
 <a>33</a>
@@ -36808,22 +36807,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102525</v>
+<v>102489</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27258</v>
+<v>27248</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13260</v>
+<v>13256</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11704</v>
+<v>11700</v>
 </b>
 <b>
 <a>38</a>
@@ -36844,12 +36843,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>152480</v>
+<v>152427</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>3210</v>
+<v>3209</v>
 </b>
 </bs>
 </hist>
@@ -36865,22 +36864,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102423</v>
+<v>102387</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27278</v>
+<v>27268</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13168</v>
+<v>13163</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11684</v>
+<v>11680</v>
 </b>
 <b>
 <a>38</a>
@@ -36901,12 +36900,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>438565</v>
+<v>438411</v>
 </b>
 <b>
 <a>2</a>
 <b>3705</b>
-<v>26829</v>
+<v>26819</v>
 </b>
 </bs>
 </hist>
@@ -36922,7 +36921,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>465394</v>
+<v>465231</v>
 </b>
 </bs>
 </hist>
@@ -36938,7 +36937,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>465394</v>
+<v>465231</v>
 </b>
 </bs>
 </hist>
@@ -36954,12 +36953,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>457056</v>
+<v>456896</v>
 </b>
 <b>
 <a>2</a>
 <b>225</b>
-<v>8338</v>
+<v>8335</v>
 </b>
 </bs>
 </hist>
@@ -37017,15 +37016,15 @@
 </relation>
 <relation>
 <name>cil_array_type</name>
-<cardinality>14192</cardinality>
+<cardinality>14187</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14192</v>
+<v>14187</v>
 </e>
 <e>
 <k>element_type</k>
-<v>14114</v>
+<v>14109</v>
 </e>
 <e>
 <k>rank</k>
@@ -37043,7 +37042,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14192</v>
+<v>14187</v>
 </b>
 </bs>
 </hist>
@@ -37059,7 +37058,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14192</v>
+<v>14187</v>
 </b>
 </bs>
 </hist>
@@ -37075,7 +37074,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14041</v>
+<v>14036</v>
 </b>
 <b>
 <a>2</a>
@@ -37096,7 +37095,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14041</v>
+<v>14036</v>
 </b>
 <b>
 <a>2</a>
@@ -37163,23 +37162,23 @@
 </relation>
 <relation>
 <name>cil_method</name>
-<cardinality>2315674</cardinality>
+<cardinality>2314861</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2315674</v>
+<v>2314861</v>
 </e>
 <e>
 <k>name</k>
-<v>440370</v>
+<v>440216</v>
 </e>
 <e>
 <k>parent</k>
-<v>380545</v>
+<v>380412</v>
 </e>
 <e>
 <k>return_type</k>
-<v>214213</v>
+<v>214138</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37193,7 +37192,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2315674</v>
+<v>2314861</v>
 </b>
 </bs>
 </hist>
@@ -37209,7 +37208,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2315674</v>
+<v>2314861</v>
 </b>
 </bs>
 </hist>
@@ -37225,7 +37224,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2315674</v>
+<v>2314861</v>
 </b>
 </bs>
 </hist>
@@ -37241,27 +37240,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>271321</v>
+<v>271226</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79697</v>
+<v>79669</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>25062</v>
+<v>25054</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>33532</v>
+<v>33521</v>
 </b>
 <b>
 <a>7</a>
 <b>64064</b>
-<v>30756</v>
+<v>30745</v>
 </b>
 </bs>
 </hist>
@@ -37277,27 +37276,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>285348</v>
+<v>285248</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>76652</v>
+<v>76625</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>39914</v>
+<v>39900</v>
 </b>
 <b>
 <a>5</a>
 <b>25</b>
-<v>33196</v>
+<v>33184</v>
 </b>
 <b>
 <a>25</a>
 <b>52725</b>
-<v>5259</v>
+<v>5257</v>
 </b>
 </bs>
 </hist>
@@ -37313,17 +37312,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>384536</v>
+<v>384401</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>40275</v>
+<v>40261</v>
 </b>
 <b>
 <a>4</a>
 <b>2803</b>
-<v>15558</v>
+<v>15553</v>
 </b>
 </bs>
 </hist>
@@ -37339,42 +37338,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>108092</v>
+<v>108054</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>84600</v>
+<v>84570</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50003</v>
+<v>49986</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28600</v>
+<v>28590</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>30903</v>
+<v>30892</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>32952</v>
+<v>32940</v>
 </b>
 <b>
 <a>11</a>
 <b>21</b>
-<v>28985</v>
+<v>28975</v>
 </b>
 <b>
 <a>21</a>
 <b>3536</b>
-<v>16407</v>
+<v>16402</v>
 </b>
 </bs>
 </hist>
@@ -37390,42 +37389,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>114488</v>
+<v>114448</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86756</v>
+<v>86726</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50560</v>
+<v>50542</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28946</v>
+<v>28936</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>32908</v>
+<v>32896</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>30044</v>
+<v>30033</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>28722</v>
+<v>28712</v>
 </b>
 <b>
 <a>26</a>
 <b>1885</b>
-<v>8118</v>
+<v>8115</v>
 </b>
 </bs>
 </hist>
@@ -37441,32 +37440,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162336</v>
+<v>162279</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>93792</v>
+<v>93759</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>46442</v>
+<v>46426</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23321</v>
+<v>23313</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>28424</v>
+<v>28414</v>
 </b>
 <b>
 <a>7</a>
 <b>1924</b>
-<v>26229</v>
+<v>26219</v>
 </b>
 </bs>
 </hist>
@@ -37482,27 +37481,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132106</v>
+<v>132060</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>38279</v>
+<v>38266</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>18861</v>
+<v>18855</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>16583</v>
+<v>16577</v>
 </b>
 <b>
 <a>13</a>
 <b>190707</b>
-<v>8381</v>
+<v>8379</v>
 </b>
 </bs>
 </hist>
@@ -37518,22 +37517,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>153700</v>
+<v>153646</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30376</v>
+<v>30365</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>19164</v>
+<v>19157</v>
 </b>
 <b>
 <a>6</a>
 <b>28461</b>
-<v>10972</v>
+<v>10968</v>
 </b>
 </bs>
 </hist>
@@ -37549,22 +37548,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145542</v>
+<v>145491</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>35425</v>
+<v>35413</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>17568</v>
+<v>17562</v>
 </b>
 <b>
 <a>5</a>
 <b>62018</b>
-<v>15675</v>
+<v>15670</v>
 </b>
 </bs>
 </hist>
@@ -37574,15 +37573,15 @@
 </relation>
 <relation>
 <name>cil_method_source_declaration</name>
-<cardinality>2109213</cardinality>
+<cardinality>2108473</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>2109213</v>
+<v>2108473</v>
 </e>
 <e>
 <k>source</k>
-<v>1866350</v>
+<v>1865695</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37596,7 +37595,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2109213</v>
+<v>2108473</v>
 </b>
 </bs>
 </hist>
@@ -37612,12 +37611,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1761302</v>
+<v>1760684</v>
 </b>
 <b>
 <a>2</a>
 <b>1021</b>
-<v>105047</v>
+<v>105011</v>
 </b>
 </bs>
 </hist>
@@ -37627,19 +37626,19 @@
 </relation>
 <relation>
 <name>cil_method_implementation</name>
-<cardinality>1728633</cardinality>
+<cardinality>1728026</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1728633</v>
+<v>1728026</v>
 </e>
 <e>
 <k>method</k>
-<v>1641720</v>
+<v>1641144</v>
 </e>
 <e>
 <k>location</k>
-<v>3098</v>
+<v>3097</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37653,7 +37652,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1728633</v>
+<v>1728026</v>
 </b>
 </bs>
 </hist>
@@ -37669,7 +37668,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1728633</v>
+<v>1728026</v>
 </b>
 </bs>
 </hist>
@@ -37685,12 +37684,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1554807</v>
+<v>1554261</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86912</v>
+<v>86882</v>
 </b>
 </bs>
 </hist>
@@ -37706,12 +37705,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1554807</v>
+<v>1554261</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86912</v>
+<v>86882</v>
 </b>
 </bs>
 </hist>
@@ -37732,12 +37731,12 @@
 <b>
 <a>11</a>
 <b>22</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>22</a>
 <b>36</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>36</a>
@@ -37757,7 +37756,7 @@
 <b>
 <a>104</a>
 <b>133</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>133</a>
@@ -37782,7 +37781,7 @@
 <b>
 <a>682</a>
 <b>1597</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>1599</a>
@@ -37808,12 +37807,12 @@
 <b>
 <a>11</a>
 <b>22</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>22</a>
 <b>36</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>36</a>
@@ -37833,7 +37832,7 @@
 <b>
 <a>104</a>
 <b>133</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>133</a>
@@ -37858,7 +37857,7 @@
 <b>
 <a>682</a>
 <b>1597</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>1599</a>
@@ -37873,15 +37872,15 @@
 </relation>
 <relation>
 <name>cil_implements</name>
-<cardinality>107233</cardinality>
+<cardinality>107196</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>106472</v>
+<v>106435</v>
 </e>
 <e>
 <k>decl</k>
-<v>17749</v>
+<v>17743</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37895,12 +37894,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>105711</v>
+<v>105674</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>761</v>
+<v>760</v>
 </b>
 </bs>
 </hist>
@@ -37916,12 +37915,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11553</v>
+<v>11549</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2707</v>
+<v>2706</v>
 </b>
 <b>
 <a>3</a>
@@ -37946,23 +37945,23 @@
 </relation>
 <relation>
 <name>cil_field</name>
-<cardinality>1010023</cardinality>
+<cardinality>1009668</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1010023</v>
+<v>1009668</v>
 </e>
 <e>
 <k>parent</k>
-<v>201455</v>
+<v>201384</v>
 </e>
 <e>
 <k>name</k>
-<v>361420</v>
+<v>361293</v>
 </e>
 <e>
 <k>field_type</k>
-<v>166117</v>
+<v>166058</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37976,7 +37975,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1010023</v>
+<v>1009668</v>
 </b>
 </bs>
 </hist>
@@ -37992,7 +37991,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1010023</v>
+<v>1009668</v>
 </b>
 </bs>
 </hist>
@@ -38008,7 +38007,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1010023</v>
+<v>1009668</v>
 </b>
 </bs>
 </hist>
@@ -38024,42 +38023,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60713</v>
+<v>60691</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41095</v>
+<v>41080</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22325</v>
+<v>22318</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15505</v>
+<v>15499</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11728</v>
+<v>11724</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16973</v>
+<v>16967</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17881</v>
+<v>17874</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15114</v>
+<v>15109</v>
 </b>
 <b>
 <a>237</a>
@@ -38080,42 +38079,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60713</v>
+<v>60691</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41095</v>
+<v>41080</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22325</v>
+<v>22318</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15505</v>
+<v>15499</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11728</v>
+<v>11724</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16973</v>
+<v>16967</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17881</v>
+<v>17874</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15114</v>
+<v>15109</v>
 </b>
 <b>
 <a>237</a>
@@ -38136,37 +38135,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70514</v>
+<v>70490</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>59849</v>
+<v>59828</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20452</v>
+<v>20445</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11480</v>
+<v>11476</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>15710</v>
+<v>15704</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>16080</v>
+<v>16075</v>
 </b>
 <b>
 <a>11</a>
 <b>132</b>
-<v>7367</v>
+<v>7364</v>
 </b>
 </bs>
 </hist>
@@ -38182,22 +38181,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>262256</v>
+<v>262164</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55439</v>
+<v>55419</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30117</v>
+<v>30106</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13607</v>
+<v>13602</v>
 </b>
 </bs>
 </hist>
@@ -38213,22 +38212,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>262256</v>
+<v>262164</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55439</v>
+<v>55419</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30117</v>
+<v>30106</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13607</v>
+<v>13602</v>
 </b>
 </bs>
 </hist>
@@ -38244,17 +38243,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>305873</v>
+<v>305766</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34108</v>
+<v>34096</v>
 </b>
 <b>
 <a>3</a>
 <b>2790</b>
-<v>21437</v>
+<v>21430</v>
 </b>
 </bs>
 </hist>
@@ -38270,32 +38269,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>82746</v>
+<v>82717</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43832</v>
+<v>43816</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8972</v>
+<v>8969</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>15280</v>
+<v>15275</v>
 </b>
 <b>
 <a>7</a>
 <b>31</b>
-<v>12558</v>
+<v>12553</v>
 </b>
 <b>
 <a>31</a>
 <b>21103</b>
-<v>2727</v>
+<v>2726</v>
 </b>
 </bs>
 </hist>
@@ -38311,22 +38310,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96846</v>
+<v>96812</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44559</v>
+<v>44543</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>14251</v>
+<v>14246</v>
 </b>
 <b>
 <a>6</a>
 <b>12257</b>
-<v>10460</v>
+<v>10456</v>
 </b>
 </bs>
 </hist>
@@ -38342,27 +38341,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>119996</v>
+<v>119954</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17988</v>
+<v>17982</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>13260</v>
+<v>13256</v>
 </b>
 <b>
 <a>5</a>
 <b>20</b>
-<v>12485</v>
+<v>12480</v>
 </b>
 <b>
 <a>20</a>
 <b>8901</b>
-<v>2385</v>
+<v>2384</v>
 </b>
 </bs>
 </hist>
@@ -38372,23 +38371,23 @@
 </relation>
 <relation>
 <name>cil_parameter</name>
-<cardinality>4554173</cardinality>
+<cardinality>4552575</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4554173</v>
+<v>4552575</v>
 </e>
 <e>
 <k>method</k>
-<v>2224018</v>
+<v>2223238</v>
 </e>
 <e>
 <k>index</k>
-<v>200</v>
+<v>199</v>
 </e>
 <e>
 <k>param_type</k>
-<v>553429</v>
+<v>553235</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38402,7 +38401,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4554173</v>
+<v>4552575</v>
 </b>
 </bs>
 </hist>
@@ -38418,7 +38417,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4554173</v>
+<v>4552575</v>
 </b>
 </bs>
 </hist>
@@ -38434,7 +38433,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4554173</v>
+<v>4552575</v>
 </b>
 </bs>
 </hist>
@@ -38450,27 +38449,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>902062</v>
+<v>901745</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>788720</v>
+<v>788443</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>325164</v>
+<v>325050</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>175216</v>
+<v>175154</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32854</v>
+<v>32843</v>
 </b>
 </bs>
 </hist>
@@ -38486,27 +38485,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>902062</v>
+<v>901745</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>788720</v>
+<v>788443</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>325164</v>
+<v>325050</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>175216</v>
+<v>175154</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32854</v>
+<v>32843</v>
 </b>
 </bs>
 </hist>
@@ -38522,22 +38521,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>950173</v>
+<v>949840</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>799244</v>
+<v>798963</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>313509</v>
+<v>313399</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>161091</v>
+<v>161035</v>
 </b>
 </bs>
 </hist>
@@ -38786,42 +38785,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185706</v>
+<v>185640</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137287</v>
+<v>137239</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45090</v>
+<v>45075</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>38514</v>
+<v>38500</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>43924</v>
+<v>43909</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42831</v>
+<v>42816</v>
 </b>
 <b>
 <a>11</a>
 <b>27</b>
-<v>41948</v>
+<v>41934</v>
 </b>
 <b>
 <a>27</a>
 <b>58010</b>
-<v>18125</v>
+<v>18118</v>
 </b>
 </bs>
 </hist>
@@ -38837,42 +38836,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>188916</v>
+<v>188850</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>135985</v>
+<v>135937</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45505</v>
+<v>45489</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>37294</v>
+<v>37281</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>44373</v>
+<v>44358</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42890</v>
+<v>42875</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>41787</v>
+<v>41773</v>
 </b>
 <b>
 <a>28</a>
 <b>46068</b>
-<v>16676</v>
+<v>16670</v>
 </b>
 </bs>
 </hist>
@@ -38888,22 +38887,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>386214</v>
+<v>386079</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>110009</v>
+<v>109971</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>44539</v>
+<v>44523</v>
 </b>
 <b>
 <a>4</a>
 <b>36</b>
-<v>12665</v>
+<v>12661</v>
 </b>
 </bs>
 </hist>
@@ -38913,37 +38912,37 @@
 </relation>
 <relation>
 <name>cil_parameter_in</name>
-<cardinality>32405</cardinality>
+<cardinality>32394</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32405</v>
+<v>32394</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_parameter_out</name>
-<cardinality>46100</cardinality>
+<cardinality>46084</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>46100</v>
+<v>46084</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_setter</name>
-<cardinality>106936</cardinality>
+<cardinality>106898</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>106936</v>
+<v>106898</v>
 </e>
 <e>
 <k>method</k>
-<v>106936</v>
+<v>106898</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38957,7 +38956,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106936</v>
+<v>106898</v>
 </b>
 </bs>
 </hist>
@@ -38973,7 +38972,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106936</v>
+<v>106898</v>
 </b>
 </bs>
 </hist>
@@ -38983,11 +38982,11 @@
 </relation>
 <relation>
 <name>cil_custom_modifiers</name>
-<cardinality>4112</cardinality>
+<cardinality>4111</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4112</v>
+<v>4111</v>
 </e>
 <e>
 <k>modifier</k>
@@ -39009,7 +39008,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4112</v>
+<v>4111</v>
 </b>
 </bs>
 </hist>
@@ -39025,7 +39024,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4112</v>
+<v>4111</v>
 </b>
 </bs>
 </hist>
@@ -39149,15 +39148,15 @@
 </relation>
 <relation>
 <name>cil_getter</name>
-<cardinality>379994</cardinality>
+<cardinality>379860</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>379994</v>
+<v>379860</v>
 </e>
 <e>
 <k>method</k>
-<v>379994</v>
+<v>379860</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39171,7 +39170,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>379994</v>
+<v>379860</v>
 </b>
 </bs>
 </hist>
@@ -39187,7 +39186,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>379994</v>
+<v>379860</v>
 </b>
 </bs>
 </hist>
@@ -39197,15 +39196,15 @@
 </relation>
 <relation>
 <name>cil_adder</name>
-<cardinality>20906</cardinality>
+<cardinality>20898</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20906</v>
+<v>20898</v>
 </e>
 <e>
 <k>method</k>
-<v>20906</v>
+<v>20898</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39219,7 +39218,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20906</v>
+<v>20898</v>
 </b>
 </bs>
 </hist>
@@ -39235,7 +39234,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20906</v>
+<v>20898</v>
 </b>
 </bs>
 </hist>
@@ -39245,15 +39244,15 @@
 </relation>
 <relation>
 <name>cil_remover</name>
-<cardinality>20906</cardinality>
+<cardinality>20898</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20906</v>
+<v>20898</v>
 </e>
 <e>
 <k>method</k>
-<v>20906</v>
+<v>20898</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39267,7 +39266,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20906</v>
+<v>20898</v>
 </b>
 </bs>
 </hist>
@@ -39283,7 +39282,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20906</v>
+<v>20898</v>
 </b>
 </bs>
 </hist>
@@ -39341,23 +39340,23 @@
 </relation>
 <relation>
 <name>cil_property</name>
-<cardinality>380540</cardinality>
+<cardinality>380407</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>380540</v>
+<v>380407</v>
 </e>
 <e>
 <k>parent</k>
-<v>93806</v>
+<v>93773</v>
 </e>
 <e>
 <k>name</k>
-<v>106409</v>
+<v>106371</v>
 </e>
 <e>
 <k>property_type</k>
-<v>49906</v>
+<v>49888</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39371,7 +39370,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380540</v>
+<v>380407</v>
 </b>
 </bs>
 </hist>
@@ -39387,7 +39386,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380540</v>
+<v>380407</v>
 </b>
 </bs>
 </hist>
@@ -39403,7 +39402,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380540</v>
+<v>380407</v>
 </b>
 </bs>
 </hist>
@@ -39419,42 +39418,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28912</v>
+<v>28902</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22311</v>
+<v>22303</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11431</v>
+<v>11427</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8464</v>
+<v>8461</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5747</v>
+<v>5745</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>8674</v>
+<v>8671</v>
 </b>
 <b>
 <a>9</a>
 <b>25</b>
-<v>7108</v>
+<v>7106</v>
 </b>
 <b>
 <a>25</a>
 <b>1883</b>
-<v>1156</v>
+<v>1155</v>
 </b>
 </bs>
 </hist>
@@ -39470,42 +39469,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33664</v>
+<v>33652</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17817</v>
+<v>17811</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11328</v>
+<v>11324</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8474</v>
+<v>8471</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5727</v>
+<v>5725</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>6635</v>
+<v>6632</v>
 </b>
 <b>
 <a>8</a>
 <b>15</b>
-<v>7225</v>
+<v>7223</v>
 </b>
 <b>
 <a>15</a>
 <b>1883</b>
-<v>2932</v>
+<v>2931</v>
 </b>
 </bs>
 </hist>
@@ -39521,32 +39520,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35113</v>
+<v>35101</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25799</v>
+<v>25790</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13495</v>
+<v>13490</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8113</v>
+<v>8110</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>7767</v>
+<v>7764</v>
 </b>
 <b>
 <a>8</a>
 <b>50</b>
-<v>3517</v>
+<v>3516</v>
 </b>
 </bs>
 </hist>
@@ -39562,27 +39561,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62733</v>
+<v>62711</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21467</v>
+<v>21459</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6488</v>
+<v>6486</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8772</v>
+<v>8769</v>
 </b>
 <b>
 <a>8</a>
 <b>2134</b>
-<v>6947</v>
+<v>6945</v>
 </b>
 </bs>
 </hist>
@@ -39598,27 +39597,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62733</v>
+<v>62711</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21540</v>
+<v>21532</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6464</v>
+<v>6462</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8786</v>
+<v>8783</v>
 </b>
 <b>
 <a>8</a>
 <b>1400</b>
-<v>6884</v>
+<v>6881</v>
 </b>
 </bs>
 </hist>
@@ -39634,17 +39633,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89552</v>
+<v>89521</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10987</v>
+<v>10983</v>
 </b>
 <b>
 <a>3</a>
 <b>568</b>
-<v>5869</v>
+<v>5867</v>
 </b>
 </bs>
 </hist>
@@ -39660,27 +39659,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31468</v>
+<v>31457</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7528</v>
+<v>7525</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3185</v>
+<v>3184</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>4371</v>
+<v>4369</v>
 </b>
 <b>
 <a>8</a>
 <b>15452</b>
-<v>3351</v>
+<v>3350</v>
 </b>
 </bs>
 </hist>
@@ -39696,27 +39695,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33259</v>
+<v>33247</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7040</v>
+<v>7037</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3049</v>
+<v>3048</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>3868</v>
+<v>3867</v>
 </b>
 <b>
 <a>8</a>
 <b>5858</b>
-<v>2688</v>
+<v>2687</v>
 </b>
 </bs>
 </hist>
@@ -39732,17 +39731,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39992</v>
+<v>39978</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5318</v>
+<v>5316</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>3805</v>
+<v>3804</v>
 </b>
 <b>
 <a>12</a>
@@ -39757,23 +39756,23 @@
 </relation>
 <relation>
 <name>cil_event</name>
-<cardinality>20876</cardinality>
+<cardinality>20869</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>20876</v>
+<v>20869</v>
 </e>
 <e>
 <k>parent</k>
-<v>6469</v>
+<v>6467</v>
 </e>
 <e>
 <k>name</k>
-<v>13085</v>
+<v>13080</v>
 </e>
 <e>
 <k>event_type</k>
-<v>6806</v>
+<v>6803</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39787,7 +39786,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20876</v>
+<v>20869</v>
 </b>
 </bs>
 </hist>
@@ -39803,7 +39802,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20876</v>
+<v>20869</v>
 </b>
 </bs>
 </hist>
@@ -39819,7 +39818,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20876</v>
+<v>20869</v>
 </b>
 </bs>
 </hist>
@@ -39835,7 +39834,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5752</v>
+<v>5750</v>
 </b>
 <b>
 <a>2</a>
@@ -39861,7 +39860,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5752</v>
+<v>5750</v>
 </b>
 <b>
 <a>2</a>
@@ -39887,7 +39886,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5927</v>
+<v>5925</v>
 </b>
 <b>
 <a>2</a>
@@ -39913,12 +39912,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11675</v>
+<v>11671</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>966</v>
+<v>965</v>
 </b>
 <b>
 <a>4</a>
@@ -39939,12 +39938,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11675</v>
+<v>11671</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>966</v>
+<v>965</v>
 </b>
 <b>
 <a>4</a>
@@ -39965,7 +39964,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12490</v>
+<v>12485</v>
 </b>
 <b>
 <a>2</a>
@@ -39991,7 +39990,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>4522</v>
+<v>4521</v>
 </b>
 <b>
 <a>3</a>
@@ -40027,7 +40026,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>5093</v>
+<v>5091</v>
 </b>
 <b>
 <a>3</a>
@@ -40048,12 +40047,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1312</v>
+<v>1311</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4351</v>
+<v>4350</v>
 </b>
 <b>
 <a>3</a>
@@ -40078,15 +40077,15 @@
 </relation>
 <relation>
 <name>cil_local_variable</name>
-<cardinality>1152560</cardinality>
+<cardinality>1152156</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1152560</v>
+<v>1152156</v>
 </e>
 <e>
 <k>impl</k>
-<v>349203</v>
+<v>349080</v>
 </e>
 <e>
 <k>index</k>
@@ -40094,7 +40093,7 @@
 </e>
 <e>
 <k>var_type</k>
-<v>154495</v>
+<v>154441</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40108,7 +40107,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1152560</v>
+<v>1152156</v>
 </b>
 </bs>
 </hist>
@@ -40124,7 +40123,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1152560</v>
+<v>1152156</v>
 </b>
 </bs>
 </hist>
@@ -40140,7 +40139,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1152560</v>
+<v>1152156</v>
 </b>
 </bs>
 </hist>
@@ -40156,37 +40155,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140127</v>
+<v>140078</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62132</v>
+<v>62111</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49399</v>
+<v>49381</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23511</v>
+<v>23503</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31927</v>
+<v>31916</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28902</v>
+<v>28892</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13202</v>
+<v>13197</v>
 </b>
 </bs>
 </hist>
@@ -40202,37 +40201,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140127</v>
+<v>140078</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62132</v>
+<v>62111</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49399</v>
+<v>49381</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23511</v>
+<v>23503</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31927</v>
+<v>31916</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28902</v>
+<v>28892</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13202</v>
+<v>13197</v>
 </b>
 </bs>
 </hist>
@@ -40248,32 +40247,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>168829</v>
+<v>168770</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70129</v>
+<v>70104</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>37894</v>
+<v>37881</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>20637</v>
+<v>20630</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>27736</v>
+<v>27726</v>
 </b>
 <b>
 <a>7</a>
 <b>47</b>
-<v>23974</v>
+<v>23966</v>
 </b>
 </bs>
 </hist>
@@ -40507,32 +40506,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>81414</v>
+<v>81385</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27302</v>
+<v>27292</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8381</v>
+<v>8379</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11846</v>
+<v>11841</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>12807</v>
+<v>12802</v>
 </b>
 <b>
 <a>8</a>
 <b>76</b>
-<v>11597</v>
+<v>11593</v>
 </b>
 <b>
 <a>76</a>
@@ -40553,32 +40552,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85454</v>
+<v>85424</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31049</v>
+<v>31038</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8396</v>
+<v>8393</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11714</v>
+<v>11710</v>
 </b>
 <b>
 <a>5</a>
 <b>14</b>
-<v>12041</v>
+<v>12036</v>
 </b>
 <b>
 <a>14</a>
 <b>21451</b>
-<v>5840</v>
+<v>5838</v>
 </b>
 </bs>
 </hist>
@@ -40594,27 +40593,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96773</v>
+<v>96739</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>28731</v>
+<v>28721</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13787</v>
+<v>13782</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>11894</v>
+<v>11890</v>
 </b>
 <b>
 <a>9</a>
 <b>122</b>
-<v>3307</v>
+<v>3306</v>
 </b>
 </bs>
 </hist>
@@ -40624,15 +40623,15 @@
 </relation>
 <relation>
 <name>cil_handler</name>
-<cardinality>101622</cardinality>
+<cardinality>101587</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>101622</v>
+<v>101587</v>
 </e>
 <e>
 <k>impl</k>
-<v>71544</v>
+<v>71519</v>
 </e>
 <e>
 <k>index</k>
@@ -40644,15 +40643,15 @@
 </e>
 <e>
 <k>try_start</k>
-<v>97778</v>
+<v>97744</v>
 </e>
 <e>
 <k>try_end</k>
-<v>99998</v>
+<v>99963</v>
 </e>
 <e>
 <k>handler_start</k>
-<v>101622</v>
+<v>101587</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40666,7 +40665,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -40682,7 +40681,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -40698,7 +40697,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -40714,7 +40713,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -40730,7 +40729,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -40746,7 +40745,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -40762,17 +40761,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53868</v>
+<v>53849</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11172</v>
+<v>11168</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5435</v>
+<v>5433</v>
 </b>
 <b>
 <a>5</a>
@@ -40793,17 +40792,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53868</v>
+<v>53849</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11172</v>
+<v>11168</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5435</v>
+<v>5433</v>
 </b>
 <b>
 <a>5</a>
@@ -40824,12 +40823,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>61967</v>
+<v>61945</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9352</v>
+<v>9349</v>
 </b>
 <b>
 <a>3</a>
@@ -40850,17 +40849,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54897</v>
+<v>54878</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10865</v>
+<v>10861</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>5537</v>
+<v>5535</v>
 </b>
 <b>
 <a>7</a>
@@ -40881,17 +40880,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54419</v>
+<v>54400</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11084</v>
+<v>11081</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>5532</v>
+<v>5530</v>
 </b>
 <b>
 <a>6</a>
@@ -40912,17 +40911,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53868</v>
+<v>53849</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11172</v>
+<v>11168</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5435</v>
+<v>5433</v>
 </b>
 <b>
 <a>5</a>
@@ -41590,12 +41589,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94475</v>
+<v>94442</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3303</v>
+<v>3301</v>
 </b>
 </bs>
 </hist>
@@ -41611,7 +41610,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97778</v>
+<v>97744</v>
 </b>
 </bs>
 </hist>
@@ -41627,12 +41626,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94475</v>
+<v>94442</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3303</v>
+<v>3301</v>
 </b>
 </bs>
 </hist>
@@ -41648,7 +41647,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95514</v>
+<v>95480</v>
 </b>
 <b>
 <a>2</a>
@@ -41669,7 +41668,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95558</v>
+<v>95524</v>
 </b>
 <b>
 <a>2</a>
@@ -41690,12 +41689,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94475</v>
+<v>94442</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3303</v>
+<v>3301</v>
 </b>
 </bs>
 </hist>
@@ -41711,7 +41710,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98768</v>
+<v>98734</v>
 </b>
 <b>
 <a>2</a>
@@ -41732,7 +41731,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99998</v>
+<v>99963</v>
 </b>
 </bs>
 </hist>
@@ -41748,7 +41747,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98768</v>
+<v>98734</v>
 </b>
 <b>
 <a>2</a>
@@ -41769,7 +41768,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99822</v>
+<v>99787</v>
 </b>
 <b>
 <a>2</a>
@@ -41790,7 +41789,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99998</v>
+<v>99963</v>
 </b>
 </bs>
 </hist>
@@ -41806,7 +41805,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98768</v>
+<v>98734</v>
 </b>
 <b>
 <a>2</a>
@@ -41827,7 +41826,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -41843,7 +41842,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -41859,7 +41858,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -41875,7 +41874,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -41891,7 +41890,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -41907,7 +41906,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101622</v>
+<v>101587</v>
 </b>
 </bs>
 </hist>
@@ -41965,11 +41964,11 @@
 </relation>
 <relation>
 <name>cil_handler_type</name>
-<cardinality>43880</cardinality>
+<cardinality>43865</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>43880</v>
+<v>43865</v>
 </e>
 <e>
 <k>catch_type</k>
@@ -41987,7 +41986,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43880</v>
+<v>43865</v>
 </b>
 </bs>
 </hist>
@@ -42003,7 +42002,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>439</v>
+<v>438</v>
 </b>
 <b>
 <a>2</a>
@@ -42048,15 +42047,15 @@
 </relation>
 <relation>
 <name>cil_method_stack_size</name>
-<cardinality>1728633</cardinality>
+<cardinality>1728026</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>1728633</v>
+<v>1728026</v>
 </e>
 <e>
 <k>size</k>
-<v>161</v>
+<v>160</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42070,7 +42069,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1728633</v>
+<v>1728026</v>
 </b>
 </bs>
 </hist>
@@ -42151,110 +42150,110 @@
 </relation>
 <relation>
 <name>cil_public</name>
-<cardinality>1913134</cardinality>
+<cardinality>1912463</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1913134</v>
+<v>1912463</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_private</name>
-<cardinality>929847</cardinality>
+<cardinality>929521</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>929847</v>
+<v>929521</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_protected</name>
-<cardinality>1820386</cardinality>
+<cardinality>1819747</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1820386</v>
+<v>1819747</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_internal</name>
-<cardinality>41734</cardinality>
+<cardinality>41719</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>41734</v>
+<v>41719</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_static</name>
-<cardinality>795833</cardinality>
+<cardinality>795554</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>795833</v>
+<v>795554</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_sealed</name>
-<cardinality>356970</cardinality>
+<cardinality>356845</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>356970</v>
+<v>356845</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_virtual</name>
-<cardinality>678388</cardinality>
+<cardinality>678150</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>678388</v>
+<v>678150</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_abstract</name>
-<cardinality>165375</cardinality>
+<cardinality>165317</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>165375</v>
+<v>165317</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_class</name>
-<cardinality>238837</cardinality>
+<cardinality>238753</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>238837</v>
+<v>238753</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_interface</name>
-<cardinality>16568</cardinality>
+<cardinality>16562</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16568</v>
+<v>16562</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -42283,37 +42282,37 @@
 </relation>
 <relation>
 <name>cil_specialname</name>
-<cardinality>811934</cardinality>
+<cardinality>811649</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>811934</v>
+<v>811649</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_newslot</name>
-<cardinality>422762</cardinality>
+<cardinality>422614</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>422762</v>
+<v>422614</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_base_class</name>
-<cardinality>235851</cardinality>
+<cardinality>235768</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235851</v>
+<v>235768</v>
 </e>
 <e>
 <k>base</k>
-<v>21433</v>
+<v>21425</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42327,7 +42326,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235851</v>
+<v>235768</v>
 </b>
 </bs>
 </hist>
@@ -42343,12 +42342,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12329</v>
+<v>12324</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3864</v>
+<v>3862</v>
 </b>
 <b>
 <a>3</a>
@@ -42358,12 +42357,12 @@
 <b>
 <a>4</a>
 <b>7</b>
-<v>1893</v>
+<v>1892</v>
 </b>
 <b>
 <a>7</a>
 <b>84</b>
-<v>1610</v>
+<v>1609</v>
 </b>
 <b>
 <a>86</a>
@@ -42378,15 +42377,15 @@
 </relation>
 <relation>
 <name>cil_base_interface</name>
-<cardinality>125349</cardinality>
+<cardinality>125305</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>68675</v>
+<v>68651</v>
 </e>
 <e>
 <k>base</k>
-<v>31229</v>
+<v>31218</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42400,22 +42399,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>47749</v>
+<v>47733</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8123</v>
+<v>8120</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>6269</v>
+<v>6267</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>5381</v>
+<v>5379</v>
 </b>
 <b>
 <a>9</a>
@@ -42436,22 +42435,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22501</v>
+<v>22493</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3434</v>
+<v>3433</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2522</v>
+<v>2521</v>
 </b>
 <b>
 <a>5</a>
 <b>30</b>
-<v>2346</v>
+<v>2345</v>
 </b>
 <b>
 <a>30</a>
@@ -42466,11 +42465,11 @@
 </relation>
 <relation>
 <name>cil_enum_underlying_type</name>
-<cardinality>14085</cardinality>
+<cardinality>14080</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14085</v>
+<v>14080</v>
 </e>
 <e>
 <k>underlying</k>
@@ -42488,7 +42487,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14085</v>
+<v>14080</v>
 </b>
 </bs>
 </hist>
@@ -42549,11 +42548,11 @@
 </relation>
 <relation>
 <name>cil_type_parameter</name>
-<cardinality>185066</cardinality>
+<cardinality>185002</cardinality>
 <columnsizes>
 <e>
 <k>unbound</k>
-<v>104033</v>
+<v>103996</v>
 </e>
 <e>
 <k>index</k>
@@ -42561,7 +42560,7 @@
 </e>
 <e>
 <k>param</k>
-<v>185066</v>
+<v>185002</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42575,22 +42574,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75071</v>
+<v>75045</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19022</v>
+<v>19016</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8167</v>
+<v>8164</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>1771</v>
+<v>1770</v>
 </b>
 </bs>
 </hist>
@@ -42606,22 +42605,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75071</v>
+<v>75045</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19022</v>
+<v>19016</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8167</v>
+<v>8164</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>1771</v>
+<v>1770</v>
 </b>
 </bs>
 </hist>
@@ -42869,7 +42868,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185066</v>
+<v>185002</v>
 </b>
 </bs>
 </hist>
@@ -42885,7 +42884,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185066</v>
+<v>185002</v>
 </b>
 </bs>
 </hist>
@@ -42895,11 +42894,11 @@
 </relation>
 <relation>
 <name>cil_type_argument</name>
-<cardinality>738228</cardinality>
+<cardinality>737969</cardinality>
 <columnsizes>
 <e>
 <k>bound</k>
-<v>482080</v>
+<v>481911</v>
 </e>
 <e>
 <k>index</k>
@@ -42907,7 +42906,7 @@
 </e>
 <e>
 <k>t</k>
-<v>252586</v>
+<v>252497</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42921,17 +42920,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>336693</v>
+<v>336575</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>117537</v>
+<v>117496</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27848</v>
+<v>27839</v>
 </b>
 </bs>
 </hist>
@@ -42947,17 +42946,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>341606</v>
+<v>341487</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>115420</v>
+<v>115379</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>25053</v>
+<v>25044</v>
 </b>
 </bs>
 </hist>
@@ -43185,27 +43184,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100471</v>
+<v>100436</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>72861</v>
+<v>72836</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>42553</v>
+<v>42538</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>20135</v>
+<v>20128</v>
 </b>
 <b>
 <a>6</a>
 <b>4208</b>
-<v>16563</v>
+<v>16558</v>
 </b>
 </bs>
 </hist>
@@ -43221,17 +43220,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>191097</v>
+<v>191030</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55570</v>
+<v>55551</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>5918</v>
+<v>5916</v>
 </b>
 </bs>
 </hist>
@@ -43332,19 +43331,19 @@
 </relation>
 <relation>
 <name>cil_attribute</name>
-<cardinality>328819</cardinality>
+<cardinality>328703</cardinality>
 <columnsizes>
 <e>
 <k>attributeid</k>
-<v>328819</v>
+<v>328703</v>
 </e>
 <e>
 <k>element</k>
-<v>248990</v>
+<v>248903</v>
 </e>
 <e>
 <k>constructor</k>
-<v>3381</v>
+<v>3379</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43358,7 +43357,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328819</v>
+<v>328703</v>
 </b>
 </bs>
 </hist>
@@ -43374,7 +43373,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328819</v>
+<v>328703</v>
 </b>
 </bs>
 </hist>
@@ -43390,17 +43389,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>197659</v>
+<v>197590</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36752</v>
+<v>36739</v>
 </b>
 <b>
 <a>3</a>
 <b>92</b>
-<v>14578</v>
+<v>14573</v>
 </b>
 </bs>
 </hist>
@@ -43416,17 +43415,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>213540</v>
+<v>213465</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31044</v>
+<v>31033</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>4405</v>
+<v>4404</v>
 </b>
 </bs>
 </hist>
@@ -43447,7 +43446,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>400</v>
+<v>399</v>
 </b>
 <b>
 <a>3</a>
@@ -43508,7 +43507,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>600</v>
+<v>599</v>
 </b>
 <b>
 <a>2</a>
@@ -43558,7 +43557,7 @@
 <b>
 <a>152</a>
 <b>15028</b>
-<v>239</v>
+<v>238</v>
 </b>
 </bs>
 </hist>
@@ -43568,11 +43567,11 @@
 </relation>
 <relation>
 <name>cil_attribute_named_argument</name>
-<cardinality>5566</cardinality>
+<cardinality>5564</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>4630</v>
+<v>4628</v>
 </e>
 <e>
 <k>param</k>
@@ -43594,7 +43593,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3766</v>
+<v>3765</v>
 </b>
 <b>
 <a>2</a>
@@ -43620,7 +43619,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4059</v>
+<v>4057</v>
 </b>
 <b>
 <a>2</a>
@@ -43768,12 +43767,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>722</v>
+<v>721</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>3</a>
@@ -43814,11 +43813,11 @@
 </relation>
 <relation>
 <name>cil_attribute_positional_argument</name>
-<cardinality>96309</cardinality>
+<cardinality>96275</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>90176</v>
+<v>90145</v>
 </e>
 <e>
 <k>index</k>
@@ -43826,7 +43825,7 @@
 </e>
 <e>
 <k>value</k>
-<v>17139</v>
+<v>17133</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43840,12 +43839,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85488</v>
+<v>85458</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4688</v>
+<v>4686</v>
 </b>
 </bs>
 </hist>
@@ -43861,12 +43860,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85498</v>
+<v>85468</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4678</v>
+<v>4677</v>
 </b>
 </bs>
 </hist>
@@ -43959,12 +43958,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12358</v>
+<v>12353</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2463</v>
+<v>2462</v>
 </b>
 <b>
 <a>3</a>
@@ -43990,7 +43989,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16812</v>
+<v>16806</v>
 </b>
 <b>
 <a>2</a>
@@ -44005,19 +44004,19 @@
 </relation>
 <relation>
 <name>metadata_handle</name>
-<cardinality>6186911</cardinality>
+<cardinality>6184463</cardinality>
 <columnsizes>
 <e>
 <k>entity</k>
-<v>5695317</v>
+<v>5693041</v>
 </e>
 <e>
 <k>location</k>
-<v>3420</v>
+<v>3418</v>
 </e>
 <e>
 <k>handle</k>
-<v>274487</v>
+<v>274391</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44031,17 +44030,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5221930</v>
+<v>5219820</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>464355</v>
+<v>464192</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>9030</v>
+<v>9027</v>
 </b>
 </bs>
 </hist>
@@ -44057,12 +44056,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5454186</v>
+<v>5451995</v>
 </b>
 <b>
 <a>2</a>
 <b>59</b>
-<v>241130</v>
+<v>241045</v>
 </b>
 </bs>
 </hist>
@@ -44235,62 +44234,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18959</v>
+<v>18952</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>45081</v>
+<v>45065</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>23945</v>
+<v>23937</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>17534</v>
+<v>17528</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>30176</v>
+<v>30165</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>18998</v>
+<v>18991</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>22116</v>
+<v>22108</v>
 </b>
 <b>
 <a>11</a>
 <b>13</b>
-<v>21062</v>
+<v>21054</v>
 </b>
 <b>
 <a>13</a>
 <b>21</b>
-<v>21491</v>
+<v>21484</v>
 </b>
 <b>
 <a>21</a>
 <b>39</b>
-<v>21154</v>
+<v>21147</v>
 </b>
 <b>
 <a>39</a>
 <b>83</b>
-<v>20598</v>
+<v>20591</v>
 </b>
 <b>
 <a>83</a>
-<b>1062</b>
-<v>13368</v>
+<b>1061</b>
+<v>13363</v>
 </b>
 </bs>
 </hist>
@@ -44306,52 +44305,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62986</v>
+<v>62964</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21120</v>
+<v>21113</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>47047</v>
+<v>47030</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18959</v>
+<v>18952</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>19422</v>
+<v>19416</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>22091</v>
+<v>22083</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>23321</v>
+<v>23313</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>22023</v>
+<v>22015</v>
 </b>
 <b>
 <a>19</a>
 <b>41</b>
-<v>20881</v>
+<v>20874</v>
 </b>
 <b>
 <a>41</a>
 <b>702</b>
-<v>16632</v>
+<v>16626</v>
 </b>
 </bs>
 </hist>

From c106b09d49452cbac6e2a662887e40233c95cbff Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 14 Jan 2021 14:17:32 +0100
Subject: [PATCH 119/343] change-note

---
 javascript/change-notes/2021-01-14-polynomial-redos.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 javascript/change-notes/2021-01-14-polynomial-redos.md

diff --git a/javascript/change-notes/2021-01-14-polynomial-redos.md b/javascript/change-notes/2021-01-14-polynomial-redos.md
new file mode 100644
index 00000000000..8bbc16386ac
--- /dev/null
+++ b/javascript/change-notes/2021-01-14-polynomial-redos.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The `js/polynomial-redos` query now flags uses of expensive regular expressions where the source is library input.

From b7b4ed8774961e52f433506e5e34f2fa836419a9 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 14 Jan 2021 14:26:40 +0100
Subject: [PATCH 120/343] Add DB upgrade folder

---
 .../old.dbscheme                              | 1914 ++++++++++++++++
 .../semmlecode.csharp.dbscheme                | 1917 +++++++++++++++++
 .../upgrade.properties                        |    0
 3 files changed, 3831 insertions(+)
 create mode 100644 csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/old.dbscheme
 create mode 100644 csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/semmlecode.csharp.dbscheme
 rename csharp/upgrades/{TO_CHANGE => e6442d16b7e3786d0918597c2c9fbd871ca06f77}/upgrade.properties (100%)

diff --git a/csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/old.dbscheme b/csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/old.dbscheme
new file mode 100644
index 00000000000..e6442d16b7e
--- /dev/null
+++ b/csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/old.dbscheme
@@ -0,0 +1,1914 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+
+#keyset[method, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int method: @cil_method ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/semmlecode.csharp.dbscheme b/csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/semmlecode.csharp.dbscheme
new file mode 100644
index 00000000000..5f6770a8a17
--- /dev/null
+++ b/csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/semmlecode.csharp.dbscheme
@@ -0,0 +1,1917 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 126 = @not_pattern_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+
+#keyset[method, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int method: @cil_method ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/TO_CHANGE/upgrade.properties b/csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/upgrade.properties
similarity index 100%
rename from csharp/upgrades/TO_CHANGE/upgrade.properties
rename to csharp/upgrades/e6442d16b7e3786d0918597c2c9fbd871ca06f77/upgrade.properties

From 4b32fd055687c3517ef4375395b58928e6f3ecaa Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 14 Jan 2021 14:29:13 +0100
Subject: [PATCH 121/343] Update change note date

---
 .../{2020-11-19-Unary-pattern.md => 2021-01-14-Unary-pattern.md}  | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename csharp/change-notes/{2020-11-19-Unary-pattern.md => 2021-01-14-Unary-pattern.md} (100%)

diff --git a/csharp/change-notes/2020-11-19-Unary-pattern.md b/csharp/change-notes/2021-01-14-Unary-pattern.md
similarity index 100%
rename from csharp/change-notes/2020-11-19-Unary-pattern.md
rename to csharp/change-notes/2021-01-14-Unary-pattern.md

From 1c4610c722952ad005beab3ae292f5717be5b724 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:15:36 +0300
Subject: [PATCH 122/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql        | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
index fd53478cce6..6fb8ea38316 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -38,10 +38,9 @@ class CompilerRemovaMemset extends FunctionCall {
   }
 
   predicate isExistsFreeForThisVariable() {
-    exists(FunctionCall free, Variable v |
-      free instanceof DeallocationExpr and
+    exists(DeallocationExpr free, Variable v |
       this.getArgument(0) = v.getAnAccess() and
-      free.getArgument(0) = v.getAnAccess() and
+      free.getFreedExpr() = v.getAnAccess() and
       this.getASuccessor+() = free
     )
   }

From b26a90e1e66e67f939dc4e4159c142fc744b1d2d Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:15:58 +0300
Subject: [PATCH 123/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql        | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
index 6fb8ea38316..56b1719c96e 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -1,8 +1,7 @@
 /**
  * @name Compiler Removal Of Code To Clear Buffers
- * @description --Using the memset function to clear private data as a final expression when working with a variable is potentially dangerous because the compiler can optimize this call.
- *              --For some compilers, optimization is also possible when using calls to free memory after the memset function.
- *              --To clear it, you need to use the RtlSecureZeroMemory or memset_s functions, or compilation flags that exclude optimization of memset calls (-fno-builtin-memset).
+ * @description Using <code>memset</code> the function to clear private data in a variable that has no subsequent use
+ *              is potentially dangerous because the compiler can remove the call.
  * @kind problem
  * @id cpp/compiler-removal-of-code-to-clear-buffers
  * @problem.severity warning

From 9e3b288f3374c6da4e8e2fb81ed40ee155642692 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:16:21 +0300
Subject: [PATCH 124/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
index ab1bae3ae21..0c71d6e5dab 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
@@ -1,4 +1,4 @@
-// BAD: the memset call will probably be optimized.
+// BAD: the memset call will probably be removed.
 void getPassword(void) {
   char pwd[64];
   if (GetPassword(pwd, sizeof(pwd))) {

From 4631658e5e4f2bdd26e61e891a11140722bf2a42 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:16:37 +0300
Subject: [PATCH 125/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
index 0c71d6e5dab..ce9be522a3c 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
@@ -6,7 +6,7 @@ void getPassword(void) {
   }
   memset(pwd, 0, sizeof(pwd));
 }
-// GOOD: in this case the memset will not be optimized.
+// GOOD: in this case the memset will not be removed.
 void getPassword(void) {
   char pwd[64];
  

From 76b768f7e0f8e31937665cd92ca21e4eb7af906e Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:16:53 +0300
Subject: [PATCH 126/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
index ce9be522a3c..3e92f5e4fa2 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
@@ -15,7 +15,7 @@ void getPassword(void) {
   }
   memset_s(pwd, 0, sizeof(pwd));
 }
-// GOOD: in this case the memset will not be optimized.
+// GOOD: in this case the memset will not be removed.
 void getPassword(void) {
   char pwd[64];
   if (retrievePassword(pwd, sizeof(pwd))) {

From 4ba4de3d41eecff5e8d30e9cfd65064bc585869e Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:17:08 +0300
Subject: [PATCH 127/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
index 3e92f5e4fa2..14dd07a573e 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
@@ -23,7 +23,7 @@ void getPassword(void) {
   }
   SecureZeroMemory(pwd, sizeof(pwd));
 }
-// GOOD: in this case the memset will not be optimized.
+// GOOD: in this case the memset will not be removed.
 void getPassword(void) {
   char pwd[64];
   if (retrievePassword(pwd, sizeof(pwd))) {

From 0d0ea0c5e15140d97f170b38f227e549487ea7f9 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:17:56 +0300
Subject: [PATCH 128/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
index 56b1719c96e..892350cecc2 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -14,7 +14,7 @@ import cpp
 import semmle.code.cpp.dataflow.DataFlow
 
 /**
- * A call to `memset` , for some local variable.
+ * A call to `memset` of the form `memset(ptr, value, num)`, for some local variable `ptr`.
  */
 class CompilerRemovaMemset extends FunctionCall {
   CompilerRemovaMemset() {

From 3e715ff52d0e70d87504d9d6fb6a633e61744f08 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:19:23 +0300
Subject: [PATCH 129/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
index 89b4189a100..d7d670ac9bf 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
@@ -4,7 +4,7 @@
 <qhelp>
 <overview>
 <p>Compiler optimization will exclude the cleaning of private information.
-Using the memset function to clear private data as a final expression when working with a variable is potentially dangerous, since the compiler can optimize this call.
+Using the <code>memset</code> function to clear private data in a variable that has no subsequent use is potentially dangerous, since the compiler can remove the call.
 For some compilers, optimization is also possible when using calls to free memory after the <code>memset</codee> function.</p>
 
 <p>It is possible to miss detection of vulnerabilities if used to clear fields of structures or parts of a buffer.</p>

From 7f5e5fcb99b309c296b3d3140b5b9b3cd0eb7490 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:19:57 +0300
Subject: [PATCH 130/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
index d7d670ac9bf..a739c12ef8b 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
@@ -12,7 +12,7 @@ For some compilers, optimization is also possible when using calls to free memor
 </overview>
 <recommendation>
 
-<p>We recommend to use the <code>RtlSecureZeroMemory</code> or <code>memset_s</code> functions, or compilation flags that exclude optimization of <code>memset</code> calls (-fno-builtin-memset).</p>
+<p>We recommend to use the <code>RtlSecureZeroMemory</code> or <code>memset_s</code> functions, or compilation flags that exclude optimization of <code>memset</code> calls (e.g. -fno-builtin-memset).</p>
 
 </recommendation>
 <example>

From cd0d2a569259a13290ecd5cb2de873470bff4cc3 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:21:19 +0300
Subject: [PATCH 131/343] Update
 cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql     | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
index 892350cecc2..ca0240ad218 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -98,10 +98,10 @@ class CompilerRemovaMemset extends FunctionCall {
     exists(Compilation c |
       c.getAFileCompiled() = this.getFile() and
       (
-        c.getArgument(2).toString().matches("%gcc%") or
-        c.getArgument(2).toString().matches("%g++%") or
-        c.getArgument(2).toString().matches("%clang%") or
-        c.getArgument(2).toString() = "--force-recompute"
+        c.getArgument(2).matches("%gcc%") or
+        c.getArgument(2).matches("%g++%") or
+        c.getArgument(2).matches("%clang%") or
+        c.getArgument(2) = "--force-recompute"
       )
     )
   }

From 10ab1d9b549b01e65b6a00535952009280d8b96e Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:24:49 +0300
Subject: [PATCH 132/343] Update CompilerRemovalOfCodeToClearBuffers.ql

---
 .../Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
index ca0240ad218..3f6e47ee891 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -29,7 +29,7 @@ class CompilerRemovaMemset extends FunctionCall {
   }
 
   predicate isExistsAllocForThisVariable() {
-    exists(FunctionCall alloc, Variable v |
+    exists(AllocationExpr alloc, Variable v |
       alloc = v.getAnAssignedValue() and
       this.getArgument(0) = v.getAnAccess() and
       alloc.getASuccessor+() = this

From 805352945ede85170b1dc14fcd72bf45c41196e3 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:27:58 +0300
Subject: [PATCH 133/343] Update CompilerRemovalOfCodeToClearBuffers.ql

---
 .../Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
index 3f6e47ee891..96ecc30a95e 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -18,7 +18,7 @@ import semmle.code.cpp.dataflow.DataFlow
  */
 class CompilerRemovaMemset extends FunctionCall {
   CompilerRemovaMemset() {
-    this.getTarget().hasName("memset") and
+    this.getTarget().hasGlobalOrStdName("memset") and
     exists(DataFlow::Node source, DataFlow::Node sink, LocalVariable isv, Expr exp |
       DataFlow::localFlow(source, sink) and
       this.getArgument(0) = isv.getAnAccess() and

From 6cf684f61598900a21131f9408b45fbe60aef5fd Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 14 Jan 2021 15:59:22 +0100
Subject: [PATCH 134/343] C#: Fix QL doc

---
 csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index 6b243fb619d..bb4856a0de0 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -18,10 +18,7 @@ module Ssa {
         this instanceof Property
       }
 
-      /**
-       * Holds if this field or any of the fields part of the qualifier
-       * are volatile.
-       */
+      /** Holds if this is a volatile field. */
       predicate isVolatile() { this.(Field).isVolatile() }
     }
 

From 13d0efe96da809a64f6ff55e91682fd30606b3a9 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 13 Jan 2021 18:08:15 +0000
Subject: [PATCH 135/343] C++: Change to more natural expressions without use
 of weird predicates or 'any'. The classes for string objects now match
 instantiations directly rather than the template.

---
 .../cpp/models/implementations/StdString.qll  | 121 +++++++++---------
 1 file changed, 57 insertions(+), 64 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index d17fb39a79e..078310d2b35 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -11,13 +11,8 @@ import semmle.code.cpp.models.interfaces.DataFlow
 /**
  * The `std::basic_string` template class.
  */
-private class StdBasicString extends TemplateClass {
-  StdBasicString() { this.hasQualifiedName("std", "basic_string") }
-
-  Declaration getAnInstMemberNamed(string name) {
-    result = getAnInstantiation().getAMember() and
-    result.hasName(name)
-  }
+private class StdBasicString extends ClassTemplateInstantiation {
+  StdBasicString() { this.getTemplate().hasQualifiedName("std", "basic_string") }
 }
 
 /**
@@ -29,7 +24,7 @@ private class StdBasicString extends TemplateClass {
  * ```
  */
 private class StdStringConstructor extends Constructor, TaintFunction {
-  StdStringConstructor() { this = any(StdBasicString s).getAnInstantiation().getAMember() }
+  StdStringConstructor() { this.getDeclaringType() instanceof StdBasicString }
 
   /**
    * Gets the index of a parameter to this function that is a string (or
@@ -74,7 +69,7 @@ private class StdStringConstructor extends Constructor, TaintFunction {
  * The `std::string` function `c_str`.
  */
 private class StdStringCStr extends TaintFunction {
-  StdStringCStr() { this = any(StdBasicString s).getAnInstMemberNamed("c_str") }
+  StdStringCStr() { this.getDeclaringType() instanceof StdBasicString and this.hasName("c_str") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value
@@ -87,7 +82,7 @@ private class StdStringCStr extends TaintFunction {
  * The `std::string` function `data`.
  */
 private class StdStringData extends TaintFunction {
-  StdStringData() { this = any(StdBasicString s).getAnInstMemberNamed("data") }
+  StdStringData() { this.getDeclaringType() instanceof StdBasicString and this.hasName("data") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value
@@ -105,7 +100,10 @@ private class StdStringData extends TaintFunction {
  * The `std::string` function `push_back`.
  */
 private class StdStringPush extends TaintFunction {
-  StdStringPush() { this = any(StdBasicString s).getAnInstMemberNamed("push_back") }
+  StdStringPush() {
+    this.getDeclaringType().(ClassTemplateInstantiation) instanceof StdBasicString and
+    this.hasName("push_back")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from parameter to qualifier
@@ -118,7 +116,9 @@ private class StdStringPush extends TaintFunction {
  * The `std::string` functions `front` and `back`.
  */
 private class StdStringFrontBack extends TaintFunction {
-  StdStringFrontBack() { this = any(StdBasicString s).getAnInstMemberNamed(["front", "back"]) }
+  StdStringFrontBack() {
+    this.getDeclaringType() instanceof StdBasicString and this.hasName(["front", "back"])
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from object to returned reference
@@ -133,7 +133,7 @@ private class StdStringFrontBack extends TaintFunction {
 private class StdStringPlus extends TaintFunction {
   StdStringPlus() {
     this.hasQualifiedName("std", "operator+") and
-    this.getUnspecifiedType() = any(StdBasicString s).getAnInstantiation()
+    this.getUnspecifiedType() instanceof StdBasicString
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -153,7 +153,8 @@ private class StdStringPlus extends TaintFunction {
  */
 private class StdStringAppend extends TaintFunction {
   StdStringAppend() {
-    this = any(StdBasicString s).getAnInstMemberNamed(["operator+=", "append", "insert", "replace"])
+    this.getDeclaringType() instanceof StdBasicString and
+    this.hasName(["operator+=", "append", "insert", "replace"])
   }
 
   /**
@@ -195,7 +196,7 @@ private class StdStringAppend extends TaintFunction {
  * The standard function `std::string.assign`.
  */
 private class StdStringAssign extends TaintFunction {
-  StdStringAssign() { this = any(StdBasicString s).getAnInstMemberNamed("assign") }
+  StdStringAssign() { this.getDeclaringType() instanceof StdBasicString and this.hasName("assign") }
 
   /**
    * Gets the index of a parameter to this function that is a string (or
@@ -235,7 +236,7 @@ private class StdStringAssign extends TaintFunction {
  * The standard function `std::string.copy`.
  */
 private class StdStringCopy extends TaintFunction {
-  StdStringCopy() { this = any(StdBasicString s).getAnInstMemberNamed("copy") }
+  StdStringCopy() { this.getDeclaringType() instanceof StdBasicString and this.hasName("copy") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // copy(dest, num, pos)
@@ -248,7 +249,7 @@ private class StdStringCopy extends TaintFunction {
  * The standard function `std::string.substr`.
  */
 private class StdStringSubstr extends TaintFunction {
-  StdStringSubstr() { this = any(StdBasicString s).getAnInstMemberNamed("substr") }
+  StdStringSubstr() { this.getDeclaringType() instanceof StdBasicString and this.hasName("substr") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // substr(pos, num)
@@ -260,20 +261,17 @@ private class StdStringSubstr extends TaintFunction {
 /**
  * The `std::basic_stringstream` template class.
  */
-private class StdBasicStringStream extends TemplateClass {
-  StdBasicStringStream() { this.hasQualifiedName("std", "basic_stringstream") }
-
-  Declaration getAnInstMemberNamed(string name) {
-    result = getAnInstantiation().getAMember() and
-    result.hasName(name)
-  }
+private class StdBasicStringStream extends ClassTemplateInstantiation {
+  StdBasicStringStream() { this.getTemplate().hasQualifiedName("std", "basic_stringstream") }
 }
 
 /**
  * The `std::string` functions `at` and `operator[]`.
  */
 private class StdStringAt extends TaintFunction {
-  StdStringAt() { this = any(StdBasicString s).getAnInstMemberNamed(["at", "operator[]"]) }
+  StdStringAt() {
+    this.getDeclaringType() instanceof StdBasicString and this.hasName(["at", "operator[]"])
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to referenced return value
@@ -289,20 +287,17 @@ private class StdStringAt extends TaintFunction {
 /**
  * The `std::basic_istream` template class.
  */
-private class StdBasicIStream extends TemplateClass {
-  StdBasicIStream() { this.hasQualifiedName("std", "basic_istream") }
-
-  Declaration getAnInstMemberNamed(string name) {
-    result = getAnInstantiation().getAMember() and
-    result.hasName(name)
-  }
+private class StdBasicIStream extends ClassTemplateInstantiation {
+  StdBasicIStream() { this.getTemplate().hasQualifiedName("std", "basic_istream") }
 }
 
 /**
  * The `std::istream` function `operator>>` (defined as a member function).
  */
 private class StdIStreamIn extends DataFlowFunction, TaintFunction {
-  StdIStreamIn() { this = any(StdBasicIStream s).getAnInstMemberNamed("operator>>") }
+  StdIStreamIn() {
+    this.getDeclaringType() instanceof StdBasicIStream and this.hasName("operator>>")
+  }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -327,8 +322,7 @@ private class StdIStreamIn extends DataFlowFunction, TaintFunction {
 private class StdIStreamInNonMember extends DataFlowFunction, TaintFunction {
   StdIStreamInNonMember() {
     this.hasQualifiedName("std", "operator>>") and
-    this.getUnspecifiedType().(ReferenceType).getBaseType() =
-      any(StdBasicIStream s).getAnInstantiation()
+    this.getUnspecifiedType().(ReferenceType).getBaseType() instanceof StdBasicIStream
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -353,7 +347,8 @@ private class StdIStreamInNonMember extends DataFlowFunction, TaintFunction {
  */
 private class StdIStreamGet extends TaintFunction {
   StdIStreamGet() {
-    this = any(StdBasicIStream s).getAnInstMemberNamed(["get", "peek"]) and
+    this.getDeclaringType() instanceof StdBasicIStream and
+    this.hasName(["get", "peek"]) and
     this.getNumberOfParameters() = 0
   }
 
@@ -369,7 +364,8 @@ private class StdIStreamGet extends TaintFunction {
  */
 private class StdIStreamRead extends DataFlowFunction, TaintFunction {
   StdIStreamRead() {
-    this = any(StdBasicIStream s).getAnInstMemberNamed(["get", "read"]) and
+    this.getDeclaringType() instanceof StdBasicIStream and
+    this.hasName(["get", "read"]) and
     this.getNumberOfParameters() > 0
   }
 
@@ -394,7 +390,9 @@ private class StdIStreamRead extends DataFlowFunction, TaintFunction {
  * The `std::istream` function `readsome`.
  */
 private class StdIStreamReadSome extends TaintFunction {
-  StdIStreamReadSome() { this = any(StdBasicIStream s).getAnInstMemberNamed("readsome") }
+  StdIStreamReadSome() {
+    this.getDeclaringType() instanceof StdBasicIStream and this.hasName("readsome")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to first parameter
@@ -407,7 +405,9 @@ private class StdIStreamReadSome extends TaintFunction {
  * The `std::istream` function `putback`.
  */
 private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
-  StdIStreamPutBack() { this = any(StdBasicIStream s).getAnInstMemberNamed("putback") }
+  StdIStreamPutBack() {
+    this.getDeclaringType() instanceof StdBasicIStream and this.hasName("putback")
+  }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -440,7 +440,9 @@ private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
  * The `std::istream` function `getline`.
  */
 private class StdIStreamGetLine extends DataFlowFunction, TaintFunction {
-  StdIStreamGetLine() { this = any(StdBasicIStream s).getAnInstMemberNamed("getline") }
+  StdIStreamGetLine() {
+    this.getDeclaringType() instanceof StdBasicIStream and this.hasName("getline")
+  }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -485,13 +487,8 @@ private class StdGetLine extends DataFlowFunction, TaintFunction {
 /**
  * The `std::basic_ostream` template class.
  */
-private class StdBasicOStream extends TemplateClass {
-  StdBasicOStream() { this.hasQualifiedName("std", "basic_ostream") }
-
-  Declaration getAnInstMemberNamed(string name) {
-    result = getAnInstantiation().getAMember() and
-    result.hasName(name)
-  }
+private class StdBasicOStream extends ClassTemplateInstantiation {
+  StdBasicOStream() { this.getTemplate().hasQualifiedName("std", "basic_ostream") }
 }
 
 /**
@@ -500,7 +497,8 @@ private class StdBasicOStream extends TemplateClass {
  */
 private class StdOStreamOut extends DataFlowFunction, TaintFunction {
   StdOStreamOut() {
-    this = any(StdBasicOStream s).getAnInstMemberNamed(["operator<<", "put", "write"])
+    this.getDeclaringType() instanceof StdBasicOStream and
+    this.hasName(["operator<<", "put", "write"])
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -536,8 +534,7 @@ private class StdOStreamOut extends DataFlowFunction, TaintFunction {
 private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
   StdOStreamOutNonMember() {
     this.hasQualifiedName("std", "operator<<") and
-    this.getUnspecifiedType().(ReferenceType).getBaseType() =
-      any(StdBasicOStream s).getAnInstantiation()
+    this.getUnspecifiedType().(ReferenceType).getBaseType() instanceof StdBasicOStream
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -566,9 +563,7 @@ private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
  * input parameter.
  */
 private class StdStringStreamConstructor extends Constructor, TaintFunction {
-  StdStringStreamConstructor() {
-    this = any(StdBasicStringStream s).getAnInstantiation().getAMember()
-  }
+  StdStringStreamConstructor() { this.getDeclaringType() instanceof StdBasicStringStream }
 
   /**
    * Gets the index of a parameter to this function that is a string.
@@ -592,7 +587,9 @@ private class StdStringStreamConstructor extends Constructor, TaintFunction {
  * The `std::stringstream` function `str`.
  */
 private class StdStringStreamStr extends TaintFunction {
-  StdStringStreamStr() { this = any(StdBasicStringStream s).getAnInstMemberNamed("str") }
+  StdStringStreamStr() {
+    this.getDeclaringType() instanceof StdBasicStringStream and this.hasName("str")
+  }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to return value (if any)
@@ -608,13 +605,8 @@ private class StdStringStreamStr extends TaintFunction {
 /**
  * The `std::basic_ios` template class.
  */
-private class StdBasicIOS extends TemplateClass {
-  StdBasicIOS() { this.hasQualifiedName("std", "basic_ios") }
-
-  Declaration getAnInstMemberNamed(string name) {
-    result = getAnInstantiation().getAMember() and
-    result.hasName(name)
-  }
+private class StdBasicIOS extends ClassTemplateInstantiation {
+  StdBasicIOS() { this.getTemplate().hasQualifiedName("std", "basic_ios") }
 }
 
 /**
@@ -623,11 +615,12 @@ private class StdBasicIOS extends TemplateClass {
  */
 private class StdStreamFunction extends DataFlowFunction, TaintFunction {
   StdStreamFunction() {
-    this = any(StdBasicIStream s).getAnInstMemberNamed(["ignore", "unget", "seekg"])
+    this.getDeclaringType() instanceof StdBasicIStream and
+    this.hasName(["ignore", "unget", "seekg"])
     or
-    this = any(StdBasicOStream s).getAnInstMemberNamed(["seekp", "flush"])
+    this.getDeclaringType() instanceof StdBasicOStream and this.hasName(["seekp", "flush"])
     or
-    this = any(StdBasicIOS s).getAnInstMemberNamed("copyfmt")
+    this.getDeclaringType() instanceof StdBasicIOS and this.hasName("copyfmt")
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {

From 54bd36def2ba638eea99f163de0e696795b4d86f Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 14 Jan 2021 15:20:29 +0000
Subject: [PATCH 136/343] C++: Correct QLDoc comments.

---
 .../code/cpp/models/implementations/StdString.qll      | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 078310d2b35..397f4e3141c 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -9,7 +9,7 @@ import semmle.code.cpp.models.interfaces.Iterator
 import semmle.code.cpp.models.interfaces.DataFlow
 
 /**
- * The `std::basic_string` template class.
+ * The `std::basic_string` template class instantiations.
  */
 private class StdBasicString extends ClassTemplateInstantiation {
   StdBasicString() { this.getTemplate().hasQualifiedName("std", "basic_string") }
@@ -259,7 +259,7 @@ private class StdStringSubstr extends TaintFunction {
 }
 
 /**
- * The `std::basic_stringstream` template class.
+ * The `std::basic_stringstream` template class instantiations.
  */
 private class StdBasicStringStream extends ClassTemplateInstantiation {
   StdBasicStringStream() { this.getTemplate().hasQualifiedName("std", "basic_stringstream") }
@@ -285,7 +285,7 @@ private class StdStringAt extends TaintFunction {
 }
 
 /**
- * The `std::basic_istream` template class.
+ * The `std::basic_istream` template class instantiations.
  */
 private class StdBasicIStream extends ClassTemplateInstantiation {
   StdBasicIStream() { this.getTemplate().hasQualifiedName("std", "basic_istream") }
@@ -485,7 +485,7 @@ private class StdGetLine extends DataFlowFunction, TaintFunction {
 }
 
 /**
- * The `std::basic_ostream` template class.
+ * The `std::basic_ostream` template class instantiations.
  */
 private class StdBasicOStream extends ClassTemplateInstantiation {
   StdBasicOStream() { this.getTemplate().hasQualifiedName("std", "basic_ostream") }
@@ -603,7 +603,7 @@ private class StdStringStreamStr extends TaintFunction {
 }
 
 /**
- * The `std::basic_ios` template class.
+ * The `std::basic_ios` template class instantiations.
  */
 private class StdBasicIOS extends ClassTemplateInstantiation {
   StdBasicIOS() { this.getTemplate().hasQualifiedName("std", "basic_ios") }

From 7012bc05a2c5e29dd190aafb8777f1a454977dcf Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 14 Jan 2021 15:21:26 +0000
Subject: [PATCH 137/343] C++: Simplification.

---
 cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 397f4e3141c..effef9eef35 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -101,7 +101,7 @@ private class StdStringData extends TaintFunction {
  */
 private class StdStringPush extends TaintFunction {
   StdStringPush() {
-    this.getDeclaringType().(ClassTemplateInstantiation) instanceof StdBasicString and
+    this.getDeclaringType() instanceof StdBasicString and
     this.hasName("push_back")
   }
 

From 27fd16ae87572b2f0cd65062622bbff72e8c6682 Mon Sep 17 00:00:00 2001
From: yo-h <55373593+yo-h@users.noreply.github.com>
Date: Thu, 14 Jan 2021 20:29:16 -0500
Subject: [PATCH 138/343] Java: update documentation on supported language
 versions

---
 docs/codeql/support/reusables/versions-compilers.rst | 4 ++--
 java/change-notes/2021-01-14-java-15-support.md      | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)
 create mode 100644 java/change-notes/2021-01-14-java-15-support.md

diff --git a/docs/codeql/support/reusables/versions-compilers.rst b/docs/codeql/support/reusables/versions-compilers.rst
index 9de6af6aa60..39e30bbc7cb 100644
--- a/docs/codeql/support/reusables/versions-compilers.rst
+++ b/docs/codeql/support/reusables/versions-compilers.rst
@@ -15,7 +15,7 @@
 
    .NET Core up to 3.1","``.sln``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
    Go (aka Golang), "Go up to 1.15", "Go 1.11 or more recent", ``.go``
-   Java,"Java 6 to 14 [3]_","javac (OpenJDK and Oracle JDK),
+   Java,"Java 7 to 15 [3]_","javac (OpenJDK and Oracle JDK),
 
    Eclipse compiler for Java (ECJ) [4]_",``.java``
    JavaScript,ECMAScript 2019 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhm``, ``.xhtml``, ``.vue``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [5]_"
@@ -26,7 +26,7 @@
 
     .. [1] Support for the clang-cl compiler is preliminary.
     .. [2] Support for the Arm Compiler (armcc) is preliminary.
-    .. [3] Builds that execute on Java 6 to 14 can be analyzed. The analysis understands Java 14 standard language features.
+    .. [3] Builds that execute on Java 7 to 15 can be analyzed. The analysis understands Java 15 standard language features.
     .. [4] ECJ is supported when the build invokes it via the Maven Compiler plugin or the Takari Lifecycle plugin.
     .. [5] JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files. 
     .. [6] TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default for LGTM.   
diff --git a/java/change-notes/2021-01-14-java-15-support.md b/java/change-notes/2021-01-14-java-15-support.md
new file mode 100644
index 00000000000..44f07c865d8
--- /dev/null
+++ b/java/change-notes/2021-01-14-java-15-support.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The Java extractor has been upgraded to support Java 15.

From 0c9d46a7f9c6db84dfc4214bc841e744e38d62f7 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 15 Jan 2021 13:36:34 +0100
Subject: [PATCH 139/343] changes based on review

Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
---
 javascript/ql/src/semmle/javascript/PackageExports.qll      | 2 +-
 .../UnsafeShellCommandConstructionCustomizations.qll        | 2 +-
 .../security/performance/PolynomialReDoSCustomizations.qll  | 6 +++---
 .../security/performance/SuperlinearBackTracking.qll        | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/PackageExports.qll b/javascript/ql/src/semmle/javascript/PackageExports.qll
index 1ec89dfa08b..7adf310f9f2 100644
--- a/javascript/ql/src/semmle/javascript/PackageExports.qll
+++ b/javascript/ql/src/semmle/javascript/PackageExports.qll
@@ -9,7 +9,7 @@ import javascript
 /**
  * Gets a parameter that is a library input to a top-level package.
  */
-DataFlow::ParameterNode getAnLibraryInputParameter() {
+DataFlow::ParameterNode getALibraryInputParameter() {
   exists(int bound, DataFlow::FunctionNode func |
     func = getAValueExportedBy(getTopmostPackageJSON()).getABoundFunctionValue(bound) and
     result = func.getParameter(any(int arg | arg >= bound))
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
index 6ae79b723ea..32eda1db8de 100644
--- a/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/UnsafeShellCommandConstructionCustomizations.qll
@@ -52,7 +52,7 @@ module UnsafeShellCommandConstruction {
    */
   class ExternalInputSource extends Source, DataFlow::ParameterNode {
     ExternalInputSource() {
-      this = Exports::getAnLibraryInputParameter() and
+      this = Exports::getALibraryInputParameter() and
       not this.getName() = ["cmd", "command"] // looks to be on purpose.
     }
   }
diff --git a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
index 67904a9bfe3..95136b32f04 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll
@@ -21,7 +21,7 @@ module PolynomialReDoS {
 
     /**
      * Gets a string that describes the source.
-     * For use in the alert message
+     * For use in the alert message.
      */
     string describe() { result = "a user-provided value" }
   }
@@ -93,7 +93,7 @@ module PolynomialReDoS {
   class StringLengthLimiter extends Sanitizer {
     StringLengthLimiter() {
       this.(StringReplaceCall).isGlobal() and
-      // not char classes - they don't remove any repeated pattern.
+      // not lone char classes - they don't remove any repeated pattern.
       not exists(RegExpTerm root | root = this.(StringReplaceCall).getRegExp().getRoot() |
         root instanceof RegExpCharacterClass
         or
@@ -136,7 +136,7 @@ module PolynomialReDoS {
    * A parameter of an exported function, seen as a source for polynomial-redos.
    */
   class ExternalInputSource extends Source, DataFlow::ParameterNode {
-    ExternalInputSource() { this = Exports::getAnLibraryInputParameter() }
+    ExternalInputSource() { this = Exports::getALibraryInputParameter() }
 
     override string getKind() { result = "library" }
 
diff --git a/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll b/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
index f604c3871c5..a753422f097 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
@@ -406,7 +406,7 @@ class PolynomialBackTrackingTerm extends InfiniteRepetitionQuantifier {
 
   PolynomialBackTrackingTerm() {
     reason = getReasonString(this, pump, prefixMsg, prev) and
-    // there might be many reasons for this term to have polynomial backtracking - we pick an arbitary one.
+    // there might be many reasons for this term to have polynomial backtracking - we pick the shortest one.
     reason = min(string msg | msg = getReasonString(this, _, _, _) | msg order by msg.length(), msg)
   }
 

From 0117a0fac1ddd461df76aabc65764a6f04a4b47c Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 15 Jan 2021 13:34:24 +0100
Subject: [PATCH 140/343] specialize the `getAValueExportedBy` predicate to
 only topmost `package.json`s

---
 .../src/semmle/javascript/PackageExports.qll  | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/PackageExports.qll b/javascript/ql/src/semmle/javascript/PackageExports.qll
index 7adf310f9f2..62681c47e81 100644
--- a/javascript/ql/src/semmle/javascript/PackageExports.qll
+++ b/javascript/ql/src/semmle/javascript/PackageExports.qll
@@ -11,7 +11,7 @@ import javascript
  */
 DataFlow::ParameterNode getALibraryInputParameter() {
   exists(int bound, DataFlow::FunctionNode func |
-    func = getAValueExportedBy(getTopmostPackageJSON()).getABoundFunctionValue(bound) and
+    func = getAValueExportedByPackage().getABoundFunctionValue(bound) and
     result = func.getParameter(any(int arg | arg >= bound))
   )
 }
@@ -28,7 +28,7 @@ private int countSlashes(string path) { result = count(path.splitAt("/")) - 1 }
  * There can be multiple results if the there exists multiple package.json that are equally deeply nested in the folder structure.
  * Results are limited to package.json files that are at most nested 2 directories deep.
  */
-PackageJSON getTopmostPackageJSON() {
+private PackageJSON getTopmostPackageJSON() {
   result =
     min(PackageJSON j |
       countSlashes(j.getFile().getRelativePath()) <= 3 and
@@ -39,33 +39,33 @@ PackageJSON getTopmostPackageJSON() {
 }
 
 /**
- * Gets a value exported by the main module from the package.json `packageJSON`.
+ * Gets a value exported by the main module from one of the topmost `package.json` files (see `getTopmostPackageJSON`).
  * The value is either directly the `module.exports` value, a nested property of `module.exports`, or a method on an exported class.
  */
-DataFlow::Node getAValueExportedBy(PackageJSON packageJSON) {
-  result = getAnExportFromModule(packageJSON.getMainModule())
+private DataFlow::Node getAValueExportedByPackage() {
+  result = getAnExportFromModule(getTopmostPackageJSON().getMainModule())
   or
-  result = getAValueExportedBy(packageJSON).(DataFlow::PropWrite).getRhs()
+  result = getAValueExportedByPackage().(DataFlow::PropWrite).getRhs()
   or
   exists(DataFlow::SourceNode callee |
-    callee = getAValueExportedBy(packageJSON).(DataFlow::NewNode).getCalleeNode().getALocalSource()
+    callee = getAValueExportedByPackage().(DataFlow::NewNode).getCalleeNode().getALocalSource()
   |
     result = callee.getAPropertyRead("prototype").getAPropertyWrite().getRhs()
     or
     result = callee.(DataFlow::ClassNode).getAnInstanceMethod()
   )
   or
-  result = getAValueExportedBy(packageJSON).getALocalSource()
+  result = getAValueExportedByPackage().getALocalSource()
   or
-  result = getAValueExportedBy(packageJSON).(DataFlow::SourceNode).getAPropertyReference()
+  result = getAValueExportedByPackage().(DataFlow::SourceNode).getAPropertyReference()
   or
   exists(Module mod |
-    mod = getAValueExportedBy(packageJSON).getEnclosingExpr().(Import).getImportedModule()
+    mod = getAValueExportedByPackage().getEnclosingExpr().(Import).getImportedModule()
   |
     result = getAnExportFromModule(mod)
   )
   or
-  exists(DataFlow::ClassNode cla | cla = getAValueExportedBy(packageJSON) |
+  exists(DataFlow::ClassNode cla | cla = getAValueExportedByPackage() |
     result = cla.getAnInstanceMethod() or
     result = cla.getAStaticMethod() or
     result = cla.getConstructor()

From 1506ac09e5d7efa80937dbc62230a3214564e7f0 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 15 Jan 2021 13:35:00 +0100
Subject: [PATCH 141/343] limit the number of characters produced by
 `getAThreewayIntersect`

---
 .../performance/SuperlinearBackTracking.qll       | 15 ++++++++++++---
 .../ReDoS/PolynomialBackTracking.expected         |  1 -
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll b/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
index a753422f097..153093e9664 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
@@ -209,11 +209,20 @@ predicate step(
  */
 pragma[noinline]
 string getAThreewayIntersect(InputSymbol s1, InputSymbol s2, InputSymbol s3) {
-  result = intersect(s1, s2) and result = [intersect(s2, s3), intersect(s1, s3)]
+  result = minAndMaxIntersect(s1, s2) and result = [intersect(s2, s3), intersect(s1, s3)]
   or
-  result = intersect(s1, s3) and result = [intersect(s2, s3), intersect(s1, s2)]
+  result = minAndMaxIntersect(s1, s3) and result = [intersect(s2, s3), intersect(s1, s2)]
   or
-  result = intersect(s2, s3) and result = [intersect(s1, s2), intersect(s1, s3)]
+  result = minAndMaxIntersect(s2, s3) and result = [intersect(s1, s2), intersect(s1, s3)]
+}
+
+/**
+ * Gets the minimum and maximum characters that intersect between `a` and `b`.
+ * This predicate is used to limit the size of `getAThreewayIntersect`.
+ */
+pragma[noinline]
+string minAndMaxIntersect(InputSymbol a, InputSymbol b) {
+  result = [min(intersect(a, b)), max(intersect(a, b))]
 }
 
 private newtype TTrace =
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
index ed016fed419..1c465b163dd 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
@@ -442,7 +442,6 @@
 | tst.js:221:15:221:22 | ([^X]b)+ | Strings with many repetitions of 'Wb' can start matching anywhere after the start of the preceeding (([^X]b)+)* |
 | tst.js:227:15:227:22 | ([^X]b)+ | Strings with many repetitions of 'Wb' can start matching anywhere after the start of the preceeding (([^X]b)+)* |
 | tst.js:239:15:239:19 | (ab)+ | Strings with many repetitions of 'ab' can start matching anywhere after the start of the preceeding ((ab)+)* |
-| tst.js:245:15:245:21 | [\\n\\s]+ | Strings with many repetitions of '\\n' can start matching anywhere after the start of the preceeding ([\\n\\s]+)* |
 | tst.js:248:18:248:19 | A* | Strings with many repetitions of 'A' can start matching anywhere after the start of the preceeding A* |
 | tst.js:254:15:254:17 | \\w* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding \\d* |
 | tst.js:254:27:254:29 | \\w* | Strings starting with 'foobarbaz' and with many repetitions of 'foobarbaz' can start matching anywhere after the start of the preceeding \\d* |

From f33630aab67a8625c00dba90bdfe16b82566db09 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 7 Dec 2020 13:02:06 +0000
Subject: [PATCH 142/343] JS: Reformat HTMLExtractor

---
 .../semmle/js/extractor/HTMLExtractor.java    | 415 ++++++++++--------
 1 file changed, 226 insertions(+), 189 deletions(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index 06bfda3728d..c1daab9ee43 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -22,221 +22,258 @@ import net.htmlparser.jericho.Segment;
 
 /** Extractor for handling HTML and XHTML files. */
 public class HTMLExtractor implements IExtractor {
-	private class JavaScriptHTMLElementHandler implements HtmlPopulator.ElementHandler {
-		private final ScopeManager scopeManager;
-		private final TextualExtractor textualExtractor;
-		private LoCInfo locInfo;
+  private class JavaScriptHTMLElementHandler implements HtmlPopulator.ElementHandler {
+    private final ScopeManager scopeManager;
+    private final TextualExtractor textualExtractor;
+    private LoCInfo locInfo;
 
-		public JavaScriptHTMLElementHandler(TextualExtractor textualExtractor) {
-			this.textualExtractor = textualExtractor;
+    public JavaScriptHTMLElementHandler(TextualExtractor textualExtractor) {
+      this.textualExtractor = textualExtractor;
 
-			this.locInfo = new LoCInfo(0, 0);
+      this.locInfo = new LoCInfo(0, 0);
 
-			this.scopeManager = new ScopeManager(textualExtractor.getTrapwriter(), config.getEcmaVersion());
-		}
+      this.scopeManager =
+          new ScopeManager(textualExtractor.getTrapwriter(), config.getEcmaVersion());
+    }
 
-		/*
-		 * Extract all JavaScript snippets appearing in (in-line) script elements and as
-		 * attribute values.
-		 */
-		@Override
-		public void handleElement(Element elt) {
-			LoCInfo snippetLoC = null;
-			if (elt.getName().equals(HTMLElementName.SCRIPT)) {
-				SourceType sourceType = getScriptSourceType(elt, textualExtractor.getExtractedFile());
-				if (sourceType != null) {
-					// Jericho sometimes misparses empty elements, which will show up as start tags
-					// ending in "/"; we manually exclude these cases to avoid spurious syntax
-					// errors
-					if (elt.getStartTag().getTagContent().toString().trim().endsWith("/"))
-						return;
+    /*
+     * Extract all JavaScript snippets appearing in (in-line) script elements and as
+     * attribute values.
+     */
+    @Override
+    public void handleElement(Element elt) {
+      LoCInfo snippetLoC = null;
+      if (elt.getName().equals(HTMLElementName.SCRIPT)) {
+        SourceType sourceType = getScriptSourceType(elt, textualExtractor.getExtractedFile());
+        if (sourceType != null) {
+          // Jericho sometimes misparses empty elements, which will show up as start tags
+          // ending in "/"; we manually exclude these cases to avoid spurious syntax
+          // errors
+          if (elt.getStartTag().getTagContent().toString().trim().endsWith("/")) return;
 
-					Segment content = elt.getContent();
-					String source = content.toString();
-					boolean isTypeScript = isTypeScriptTag(elt);
+          Segment content = elt.getContent();
+          String source = content.toString();
+          boolean isTypeScript = isTypeScriptTag(elt);
 
-					/*
-					 * Script blocks in XHTML files may wrap (parts of) their code inside CDATA
-					 * sections. We need to unwrap them in order not to confuse the JavaScript
-					 * parser.
-					 *
-					 * Note that CDATA sections do not nest, so they can be detected by a regular
-					 * expression.
-					 *
-					 * In order to preserve position information, we replace the CDATA section
-					 * markers with an equivalent number of whitespace characters. This will yield
-					 * surprising results for CDATA sections inside string literals, but those are
-					 * likely to be rare.
-					 */
-					source = source.replace("<![CDATA[", "         ").replace("]]>", "   ");
-					if (!source.trim().isEmpty()) {
-						RowColumnVector contentStart = content.getRowColumnVector();
-						snippetLoC = extractSnippet(1, config.withSourceType(sourceType), scopeManager,
-								textualExtractor, source, contentStart.getRow(), contentStart.getColumn(),
-								isTypeScript);
-					}
-				}
-			} else {
-				Attributes attributes = elt.getAttributes();
-				// attributes can be null for directives
-				if (attributes != null)
-					for (Attribute attr : attributes) {
-						// ignore empty attributes
-						if (attr.getValue() == null || attr.getValue().isEmpty())
-							continue;
+          /*
+           * Script blocks in XHTML files may wrap (parts of) their code inside CDATA
+           * sections. We need to unwrap them in order not to confuse the JavaScript
+           * parser.
+           *
+           * Note that CDATA sections do not nest, so they can be detected by a regular
+           * expression.
+           *
+           * In order to preserve position information, we replace the CDATA section
+           * markers with an equivalent number of whitespace characters. This will yield
+           * surprising results for CDATA sections inside string literals, but those are
+           * likely to be rare.
+           */
+          source = source.replace("<![CDATA[", "         ").replace("]]>", "   ");
+          if (!source.trim().isEmpty()) {
+            RowColumnVector contentStart = content.getRowColumnVector();
+            snippetLoC =
+                extractSnippet(
+                    1,
+                    config.withSourceType(sourceType),
+                    scopeManager,
+                    textualExtractor,
+                    source,
+                    contentStart.getRow(),
+                    contentStart.getColumn(),
+                    isTypeScript);
+          }
+        }
+      } else {
+        Attributes attributes = elt.getAttributes();
+        // attributes can be null for directives
+        if (attributes != null)
+          for (Attribute attr : attributes) {
+            // ignore empty attributes
+            if (attr.getValue() == null || attr.getValue().isEmpty()) continue;
 
-						String source = attr.getValue();
-						RowColumnVector valueStart = attr.getValueSegment().getRowColumnVector();
-						if (JS_ATTRIBUTE.matcher(attr.getName()).matches()) {
-							snippetLoC = extractSnippet(2, config, scopeManager, textualExtractor, source,
-									valueStart.getRow(), valueStart.getColumn(), false /* isTypeScript */);
-						} else if (source.startsWith("javascript:")) {
-							source = source.substring(11);
-							snippetLoC = extractSnippet(3, config, scopeManager, textualExtractor, source,
-									valueStart.getRow(), valueStart.getColumn() + 11, false /* isTypeScript */);
-						}
-					}
-			}
+            String source = attr.getValue();
+            RowColumnVector valueStart = attr.getValueSegment().getRowColumnVector();
+            if (JS_ATTRIBUTE.matcher(attr.getName()).matches()) {
+              snippetLoC =
+                  extractSnippet(
+                      2,
+                      config,
+                      scopeManager,
+                      textualExtractor,
+                      source,
+                      valueStart.getRow(),
+                      valueStart.getColumn(),
+                      false /* isTypeScript */);
+            } else if (source.startsWith("javascript:")) {
+              source = source.substring(11);
+              snippetLoC =
+                  extractSnippet(
+                      3,
+                      config,
+                      scopeManager,
+                      textualExtractor,
+                      source,
+                      valueStart.getRow(),
+                      valueStart.getColumn() + 11,
+                      false /* isTypeScript */);
+            }
+          }
+      }
 
-			if (snippetLoC != null)
-				locInfo.add(snippetLoC);
-		}
+      if (snippetLoC != null) locInfo.add(snippetLoC);
+    }
 
-		public LoCInfo getLoCInfo() {
-			return this.locInfo;
-		}
-	}
+    public LoCInfo getLoCInfo() {
+      return this.locInfo;
+    }
+  }
 
-	/** List of HTML attributes whose value is interpreted as JavaScript. */
-	private static final Pattern JS_ATTRIBUTE = Pattern.compile(
-			"^on(abort|blur|change|(dbl)?click|error|focus|key(down|press|up)|load|mouse(down|move|out|over|up)|re(set|size)|select|submit|unload)$",
-			Pattern.CASE_INSENSITIVE);
+  /** List of HTML attributes whose value is interpreted as JavaScript. */
+  private static final Pattern JS_ATTRIBUTE =
+      Pattern.compile(
+          "^on(abort|blur|change|(dbl)?click|error|focus|key(down|press|up)|load|mouse(down|move|out|over|up)|re(set|size)|select|submit|unload)$",
+          Pattern.CASE_INSENSITIVE);
 
-	private final ExtractorConfig config;
-	private final ExtractorState state;
+  private final ExtractorConfig config;
+  private final ExtractorState state;
 
-	public HTMLExtractor(ExtractorConfig config, ExtractorState state) {
-		this.config = config.withPlatform(Platform.WEB);
-		this.state = state;
-	}
+  public HTMLExtractor(ExtractorConfig config, ExtractorState state) {
+    this.config = config.withPlatform(Platform.WEB);
+    this.state = state;
+  }
 
-	@Override
-	public LoCInfo extract(TextualExtractor textualExtractor) {
-		JavaScriptHTMLElementHandler eltHandler = new JavaScriptHTMLElementHandler(textualExtractor);
+  @Override
+  public LoCInfo extract(TextualExtractor textualExtractor) {
+    JavaScriptHTMLElementHandler eltHandler = new JavaScriptHTMLElementHandler(textualExtractor);
 
-		HtmlPopulator extractor = new HtmlPopulator(this.config.getHtmlHandling(), textualExtractor.getSource(),
-				textualExtractor.getTrapwriter(), textualExtractor.getLocationManager().getFileLabel());
+    HtmlPopulator extractor =
+        new HtmlPopulator(
+            this.config.getHtmlHandling(),
+            textualExtractor.getSource(),
+            textualExtractor.getTrapwriter(),
+            textualExtractor.getLocationManager().getFileLabel());
 
-		extractor.doit(Option.some(eltHandler));
+    extractor.doit(Option.some(eltHandler));
 
-		return eltHandler.getLoCInfo();
-	}
+    return eltHandler.getLoCInfo();
+  }
 
-	/**
-	 * Deduce the {@link SourceType} with which the given <code>script</code>
-	 * element should be extracted, returning <code>null</code> if it cannot be
-	 * determined.
-	 */
-	private SourceType getScriptSourceType(Element script, File file) {
-		String scriptType = getAttributeValueLC(script, "type");
-		String scriptLanguage = getScriptLanguage(script);
+  /**
+   * Deduce the {@link SourceType} with which the given <code>script</code> element should be
+   * extracted, returning <code>null</code> if it cannot be determined.
+   */
+  private SourceType getScriptSourceType(Element script, File file) {
+    String scriptType = getAttributeValueLC(script, "type");
+    String scriptLanguage = getScriptLanguage(script);
 
-		SourceType fallbackSourceType = config.getSourceType();
-		if (file.getName().endsWith(".vue")) {
-			fallbackSourceType = SourceType.MODULE;
-		}
+    SourceType fallbackSourceType = config.getSourceType();
+    if (file.getName().endsWith(".vue")) {
+      fallbackSourceType = SourceType.MODULE;
+    }
 
-		if (isTypeScriptTag(script))
-			return fallbackSourceType;
+    if (isTypeScriptTag(script)) return fallbackSourceType;
 
-		// if `type` and `language` are both either missing, contain the
-		// string "javascript", or if `type` is the string "text/jsx", this is a plain
-		// script
-		if ((scriptType == null || scriptType.contains("javascript") || "text/jsx".equals(scriptType))
-				&& (scriptLanguage == null || scriptLanguage.contains("javascript")))
-			// use default source type
-			return fallbackSourceType;
+    // if `type` and `language` are both either missing, contain the
+    // string "javascript", or if `type` is the string "text/jsx", this is a plain
+    // script
+    if ((scriptType == null || scriptType.contains("javascript") || "text/jsx".equals(scriptType))
+        && (scriptLanguage == null || scriptLanguage.contains("javascript")))
+      // use default source type
+      return fallbackSourceType;
 
-		// if `type` is "text/babel", the source type depends on the `data-plugins`
-		// attribute
-		if ("text/babel".equals(scriptType)) {
-			String plugins = getAttributeValueLC(script, "data-plugins");
-			if (plugins != null && plugins.contains("transform-es2015-modules-umd")) {
-				return SourceType.MODULE;
-			}
-			return fallbackSourceType;
-		}
+    // if `type` is "text/babel", the source type depends on the `data-plugins`
+    // attribute
+    if ("text/babel".equals(scriptType)) {
+      String plugins = getAttributeValueLC(script, "data-plugins");
+      if (plugins != null && plugins.contains("transform-es2015-modules-umd")) {
+        return SourceType.MODULE;
+      }
+      return fallbackSourceType;
+    }
 
-		// if `type` is "module", extract as module
-		if ("module".equals(scriptType))
-			return SourceType.MODULE;
+    // if `type` is "module", extract as module
+    if ("module".equals(scriptType)) return SourceType.MODULE;
 
-		return null;
-	}
+    return null;
+  }
 
-	private String getScriptLanguage(Element script) {
-		String scriptLanguage = getAttributeValueLC(script, "language");
+  private String getScriptLanguage(Element script) {
+    String scriptLanguage = getAttributeValueLC(script, "language");
 
-		if (scriptLanguage == null) { // Vue templates use 'lang' instead of 'language'.
-			scriptLanguage = getAttributeValueLC(script, "lang");
-		}
-		return scriptLanguage;
-	}
+    if (scriptLanguage == null) { // Vue templates use 'lang' instead of 'language'.
+      scriptLanguage = getAttributeValueLC(script, "lang");
+    }
+    return scriptLanguage;
+  }
 
-	private boolean isTypeScriptTag(Element script) {
-		String language = getScriptLanguage(script);
-		if ("ts".equals(language) || "typescript".equals(language))
-			return true;
-		String type = getAttributeValueLC(script, "type");
-		if (type != null && type.contains("typescript"))
-			return true;
-		return false;
-	}
+  private boolean isTypeScriptTag(Element script) {
+    String language = getScriptLanguage(script);
+    if ("ts".equals(language) || "typescript".equals(language)) return true;
+    String type = getAttributeValueLC(script, "type");
+    if (type != null && type.contains("typescript")) return true;
+    return false;
+  }
 
-	/**
-	 * Get the value of attribute <code>attr</code> of element <code>elt</code> in
-	 * lower case; if the attribute has no value, <code>null</code> is returned.
-	 */
-	private String getAttributeValueLC(Element elt, String attr) {
-		String val = elt.getAttributeValue(attr);
-		return val == null ? val : StringUtil.lc(val);
-	}
+  /**
+   * Get the value of attribute <code>attr</code> of element <code>elt</code> in lower case; if the
+   * attribute has no value, <code>null</code> is returned.
+   */
+  private String getAttributeValueLC(Element elt, String attr) {
+    String val = elt.getAttributeValue(attr);
+    return val == null ? val : StringUtil.lc(val);
+  }
 
-	private LoCInfo extractSnippet(int toplevelKind, ExtractorConfig config, ScopeManager scopeManager,
-			TextualExtractor textualExtractor, String source, int line, int column, boolean isTypeScript) {
-		if (isTypeScript) {
-			Path file = textualExtractor.getExtractedFile().toPath();
-			FileSnippet snippet = new FileSnippet(file, line, column, toplevelKind, config.getSourceType());
-			VirtualSourceRoot vroot = config.getVirtualSourceRoot();
-			// Vue files are special in that they can be imported as modules, and may only
-			// contain one <script> tag.
-			// For .vue files we omit the usual snippet decoration to ensure the TypeScript
-			// compiler can find it.
-			Path virtualFile = file.getFileName().toString().endsWith(".vue")
-					? vroot.toVirtualFile(file.resolveSibling(file.getFileName() + ".ts"))
-					: vroot.getVirtualFileForSnippet(snippet, ".ts");
-			if (virtualFile != null) {
-				virtualFile = virtualFile.toAbsolutePath().normalize();
-				synchronized (vroot.getLock()) {
-					new WholeIO().strictwrite(virtualFile, source);
-				}
-				state.getSnippets().put(virtualFile, snippet);
-			}
-			return null; // LoC info is accounted for later
-		}
-		TrapWriter trapwriter = textualExtractor.getTrapwriter();
-		LocationManager locationManager = textualExtractor.getLocationManager();
-		LocationManager scriptLocationManager = new LocationManager(locationManager.getSourceFile(), trapwriter,
-				locationManager.getFileLabel());
-		scriptLocationManager.setStart(line, column);
-		JSExtractor extractor = new JSExtractor(config);
-		try {
-			TextualExtractor tx = new TextualExtractor(trapwriter, scriptLocationManager, source,
-					config.getExtractLines(), textualExtractor.getMetrics(), textualExtractor.getExtractedFile());
-			return extractor.extract(tx, source, toplevelKind, scopeManager).snd();
-		} catch (ParseError e) {
-			e.setPosition(scriptLocationManager.translatePosition(e.getPosition()));
-			throw e.asUserError();
-		}
-	}
+  private LoCInfo extractSnippet(
+      int toplevelKind,
+      ExtractorConfig config,
+      ScopeManager scopeManager,
+      TextualExtractor textualExtractor,
+      String source,
+      int line,
+      int column,
+      boolean isTypeScript) {
+    if (isTypeScript) {
+      Path file = textualExtractor.getExtractedFile().toPath();
+      FileSnippet snippet =
+          new FileSnippet(file, line, column, toplevelKind, config.getSourceType());
+      VirtualSourceRoot vroot = config.getVirtualSourceRoot();
+      // Vue files are special in that they can be imported as modules, and may only
+      // contain one <script> tag.
+      // For .vue files we omit the usual snippet decoration to ensure the TypeScript
+      // compiler can find it.
+      Path virtualFile =
+          file.getFileName().toString().endsWith(".vue")
+              ? vroot.toVirtualFile(file.resolveSibling(file.getFileName() + ".ts"))
+              : vroot.getVirtualFileForSnippet(snippet, ".ts");
+      if (virtualFile != null) {
+        virtualFile = virtualFile.toAbsolutePath().normalize();
+        synchronized (vroot.getLock()) {
+          new WholeIO().strictwrite(virtualFile, source);
+        }
+        state.getSnippets().put(virtualFile, snippet);
+      }
+      return null; // LoC info is accounted for later
+    }
+    TrapWriter trapwriter = textualExtractor.getTrapwriter();
+    LocationManager locationManager = textualExtractor.getLocationManager();
+    LocationManager scriptLocationManager =
+        new LocationManager(
+            locationManager.getSourceFile(), trapwriter, locationManager.getFileLabel());
+    scriptLocationManager.setStart(line, column);
+    JSExtractor extractor = new JSExtractor(config);
+    try {
+      TextualExtractor tx =
+          new TextualExtractor(
+              trapwriter,
+              scriptLocationManager,
+              source,
+              config.getExtractLines(),
+              textualExtractor.getMetrics(),
+              textualExtractor.getExtractedFile());
+      return extractor.extract(tx, source, toplevelKind, scopeManager).snd();
+    } catch (ParseError e) {
+      e.setPosition(scriptLocationManager.translatePosition(e.getPosition()));
+      throw e.asUserError();
+    }
+  }
 }

From 5fa3b1795685133cfc3164e509ccd11577265d4d Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 7 Dec 2020 13:02:53 +0000
Subject: [PATCH 143/343] JS: Tolerate Angular-specific HTML attribute names

---
 .../extractor/src/com/semmle/js/extractor/HTMLExtractor.java   | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index c1daab9ee43..9373be8dcce 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -144,6 +144,9 @@ public class HTMLExtractor implements IExtractor {
 
   @Override
   public LoCInfo extract(TextualExtractor textualExtractor) {
+    // Angular templates contain attribute names that are not valid HTML/XML, such as [foo], (foo), [(foo)], and *foo.
+    // Allow a large number of errors in attribute names, so the Jericho parser does not give up.
+    Attributes.setDefaultMaxErrorCount(100);
     JavaScriptHTMLElementHandler eltHandler = new JavaScriptHTMLElementHandler(textualExtractor);
 
     HtmlPopulator extractor =

From 9a9a57716c672a6aea64370d9dddfadc7eaaf6c5 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 14 Jan 2021 11:21:55 +0100
Subject: [PATCH 144/343] C#: Improved extraction of type nullability

---
 .../Entities/Constructor.cs                   |  8 +--
 .../Entities/Expression.cs                    | 51 ++++++++-----------
 .../Entities/Expressions/Access.cs            |  2 +-
 .../Entities/Expressions/ArrayCreation.cs     |  2 +-
 .../Entities/Expressions/Cast.cs              |  2 +-
 .../Entities/Expressions/Discard.cs           |  2 +-
 .../Entities/Expressions/ImplicitCast.cs      |  4 +-
 .../Entities/Expressions/Initializer.cs       |  6 +--
 .../Entities/Expressions/Invocation.cs        |  2 +-
 .../Entities/Expressions/Literal.cs           |  8 +--
 .../ObjectCreation/AnonymousObjectCreation.cs |  2 +-
 .../ObjectCreation/BaseObjectCreation.cs      |  4 +-
 .../Entities/Expressions/Patterns/Pattern.cs  |  4 +-
 .../Expressions/Patterns/PositionalPattern.cs |  2 +-
 .../Expressions/Patterns/PropertyPattern.cs   |  2 +-
 .../Expressions/Patterns/RecursivePattern.cs  |  4 +-
 .../Expressions/Patterns/UnaryPattern.cs      |  2 +-
 .../Entities/Expressions/Query.cs             | 40 +++++++++++++--
 .../Entities/Expressions/Switch.cs            |  2 +-
 .../Entities/Expressions/This.cs              |  4 +-
 .../Entities/Expressions/TypeAccess.cs        |  4 +-
 .../Entities/Expressions/TypeOf.cs            |  2 +-
 .../Expressions/VariableDeclaration.cs        | 25 +++++----
 .../Entities/Field.cs                         | 17 ++++---
 .../Entities/Indexer.cs                       |  2 +-
 .../Entities/LocalVariable.cs                 |  4 +-
 .../Entities/Property.cs                      |  4 +-
 .../Entities/Statements/Catch.cs              |  4 +-
 .../Entities/Statements/ForEach.cs            |  2 +-
 .../Entities/TypeMention.cs                   |  6 +--
 .../Entities/Types/ArrayType.cs               | 16 +++---
 .../Entities/Types/NamedType.cs               | 32 +-----------
 .../Entities/Types/NullType.cs                |  2 +-
 .../Entities/Types/TupleType.cs               |  2 +-
 .../Entities/Types/Type.cs                    | 35 ++-----------
 .../SymbolExtensions.cs                       |  7 ++-
 csharp/extractor/Semmle.Extraction/Context.cs |  2 +-
 csharp/extractor/Semmle.Extraction/Symbol.cs  |  4 +-
 38 files changed, 147 insertions(+), 176 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
index 35b3f2eb808..499e6ec418a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs
@@ -42,16 +42,16 @@ namespace Semmle.Extraction.CSharp.Entities
             if (initializer == null)
                 return;
 
-            Type initializerType;
+            ITypeSymbol initializerType;
             var symbolInfo = Context.GetSymbolInfo(initializer);
 
             switch (initializer.Kind())
             {
                 case SyntaxKind.BaseConstructorInitializer:
-                    initializerType = Type.Create(Context, symbol.ContainingType.BaseType);
+                    initializerType = symbol.ContainingType.BaseType;
                     break;
                 case SyntaxKind.ThisConstructorInitializer:
-                    initializerType = ContainingType;
+                    initializerType = symbol.ContainingType;
                     break;
                 default:
                     Context.ModelError(initializer, "Unknown initializer");
@@ -59,7 +59,7 @@ namespace Semmle.Extraction.CSharp.Entities
             }
 
             var initInfo = new ExpressionInfo(Context,
-                new AnnotatedType(initializerType, NullableAnnotation.None),
+                AnnotatedTypeSymbol.CreateNotAnnotated(initializerType),
                 Context.Create(initializer.ThisOrBaseKeyword.GetLocation()),
                 Kinds.ExprKind.CONSTRUCTOR_INIT,
                 this,
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
index 0c0fbca6489..7ac9d80cffb 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
@@ -22,7 +22,7 @@ namespace Semmle.Extraction.CSharp.Entities
     internal class Expression : FreshEntity, IExpressionParentEntity
     {
         private readonly IExpressionInfo info;
-        public AnnotatedType Type { get; }
+        public AnnotatedTypeSymbol? Type { get; }
         public Extraction.Entities.Location Location { get; }
         public ExprKind Kind { get; }
 
@@ -33,25 +33,23 @@ namespace Semmle.Extraction.CSharp.Entities
             Location = info.Location;
             Kind = info.Kind;
             Type = info.Type;
-            if (Type.Type is null)
-                Type = NullType.Create(cx);
 
             TryPopulate();
         }
 
         protected sealed override void Populate(TextWriter trapFile)
         {
-            trapFile.expressions(this, Kind, Type.Type.TypeRef);
+            var type = Type.HasValue ? Entities.Type.Create(cx, Type.Value) : NullType.Create(cx);
+            trapFile.expressions(this, Kind, type.TypeRef);
             if (info.Parent.IsTopLevelParent)
                 trapFile.expr_parent_top_level(this, info.Child, info.Parent);
             else
                 trapFile.expr_parent(this, info.Child, info.Parent);
             trapFile.expr_location(this, Location);
 
-            var annotatedType = Type.Symbol;
-            if (!annotatedType.HasObliviousNullability())
+            if (Type.HasValue && !Type.Value.HasObliviousNullability())
             {
-                var n = NullabilityEntity.Create(cx, Nullability.Create(annotatedType));
+                var n = NullabilityEntity.Create(cx, Nullability.Create(Type.Value));
                 trapFile.type_nullability(this, n);
             }
 
@@ -66,7 +64,7 @@ namespace Semmle.Extraction.CSharp.Entities
             if (info.ExprValue is string value)
                 trapFile.expr_value(this, value);
 
-            Type.Type.PopulateGenerics();
+            type.PopulateGenerics();
         }
 
         public override Microsoft.CodeAnalysis.Location ReportingLocation => Location.symbol;
@@ -367,7 +365,7 @@ namespace Semmle.Extraction.CSharp.Entities
         /// <summary>
         /// The type of the expression.
         /// </summary>
-        AnnotatedType Type { get; }
+        AnnotatedTypeSymbol? Type { get; }
 
         /// <summary>
         /// The location of the expression.
@@ -411,7 +409,7 @@ namespace Semmle.Extraction.CSharp.Entities
     internal class ExpressionInfo : IExpressionInfo
     {
         public Context Context { get; }
-        public AnnotatedType Type { get; }
+        public AnnotatedTypeSymbol? Type { get; }
         public Extraction.Entities.Location Location { get; }
         public ExprKind Kind { get; }
         public IExpressionParentEntity Parent { get; }
@@ -419,7 +417,7 @@ namespace Semmle.Extraction.CSharp.Entities
         public bool IsCompilerGenerated { get; }
         public string ExprValue { get; }
 
-        public ExpressionInfo(Context cx, AnnotatedType type, Extraction.Entities.Location location, ExprKind kind,
+        public ExpressionInfo(Context cx, AnnotatedTypeSymbol? type, Extraction.Entities.Location location, ExprKind kind,
             IExpressionParentEntity parent, int child, bool isCompilerGenerated, string value)
         {
             Context = cx;
@@ -466,10 +464,15 @@ namespace Semmle.Extraction.CSharp.Entities
         public AnnotatedTypeSymbol ResolvedType => new AnnotatedTypeSymbol(TypeInfo.Type.DisambiguateType(), TypeInfo.Nullability.Annotation);
         public AnnotatedTypeSymbol ConvertedType => new AnnotatedTypeSymbol(TypeInfo.ConvertedType.DisambiguateType(), TypeInfo.ConvertedNullability.Annotation);
 
-        public AnnotatedTypeSymbol ExpressionType
+        private AnnotatedTypeSymbol? cachedType;
+        private bool cachedTypeSet;
+        public AnnotatedTypeSymbol? Type
         {
             get
             {
+                if (cachedTypeSet)
+                    return cachedType;
+
                 var type = ResolvedType;
 
                 if (type.Symbol == null)
@@ -491,6 +494,9 @@ namespace Semmle.Extraction.CSharp.Entities
                     Context.ModelError(Node, "Failed to determine type");
                 }
 
+                cachedType = type;
+                cachedTypeSet = true;
+
                 return type;
             }
         }
@@ -522,22 +528,6 @@ namespace Semmle.Extraction.CSharp.Entities
             }
         }
 
-        private AnnotatedType cachedType;
-
-        public AnnotatedType Type
-        {
-            get
-            {
-                if (cachedType.Type == null)
-                    cachedType = Entities.Type.Create(Context, ExpressionType);
-                return cachedType;
-            }
-            set
-            {
-                cachedType = value;
-            }
-        }
-
         private Extraction.Entities.Location cachedLocation;
 
         public Extraction.Entities.Location Location
@@ -572,9 +562,10 @@ namespace Semmle.Extraction.CSharp.Entities
             return this;
         }
 
-        public ExpressionNodeInfo SetType(AnnotatedType type)
+        public ExpressionNodeInfo SetType(AnnotatedTypeSymbol? type)
         {
-            Type = type;
+            cachedType = type;
+            cachedTypeSet = true;
             return this;
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Access.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Access.cs
index e91b81a3d77..d4d4c86c507 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Access.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Access.cs
@@ -52,7 +52,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
             if (implicitThis && !symbol.IsStatic)
             {
-                This.CreateImplicit(cx, Entities.Type.Create(cx, symbol.ContainingType), Location, this, -1);
+                This.CreateImplicit(cx, symbol.ContainingType, Location, this, -1);
             }
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ArrayCreation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ArrayCreation.cs
index d8d12229f62..ea818862d80 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ArrayCreation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ArrayCreation.cs
@@ -90,7 +90,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             var info = new ExpressionInfo(
                 cx,
-                new AnnotatedType(Entities.Type.Create(cx, type), NullableAnnotation.None),
+                AnnotatedTypeSymbol.CreateNotAnnotated(type),
                 location,
                 ExprKind.ARRAY_CREATION,
                 parent,
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs
index 8048d4da2cd..6f2551ec904 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs
@@ -36,7 +36,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             var info = new ExpressionInfo(
                 cx,
-                new AnnotatedType(Entities.Type.Create(cx, type), Microsoft.CodeAnalysis.NullableAnnotation.None),
+                AnnotatedTypeSymbol.CreateNotAnnotated(type),
                 location,
                 ExprKind.CAST,
                 parent,
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Discard.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Discard.cs
index 194261c4614..ef35f901b92 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Discard.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Discard.cs
@@ -12,7 +12,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         }
 
         private Discard(Context cx, CSharpSyntaxNode syntax, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, Entities.Type.Create(cx, cx.GetType(syntax)), cx.Create(syntax.GetLocation()), ExprKind.DISCARD, parent, child, false, null))
+            base(new ExpressionInfo(cx, cx.GetType(syntax), cx.Create(syntax.GetLocation()), ExprKind.DISCARD, parent, child, false, null))
         {
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs
index a9884a5df5d..eccead4a4de 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ImplicitCast.cs
@@ -12,13 +12,13 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         }
 
         public ImplicitCast(ExpressionNodeInfo info)
-            : base(new ExpressionInfo(info.Context, Entities.Type.Create(info.Context, info.ConvertedType), info.Location, ExprKind.CAST, info.Parent, info.Child, true, info.ExprValue))
+            : base(new ExpressionInfo(info.Context, info.ConvertedType, info.Location, ExprKind.CAST, info.Parent, info.Child, true, info.ExprValue))
         {
             Expr = Factory.Create(new ExpressionNodeInfo(cx, info.Node, this, 0));
         }
 
         public ImplicitCast(ExpressionNodeInfo info, IMethodSymbol method)
-            : base(new ExpressionInfo(info.Context, Entities.Type.Create(info.Context, info.ConvertedType), info.Location, ExprKind.OPERATOR_INVOCATION, info.Parent, info.Child, true, info.ExprValue))
+            : base(new ExpressionInfo(info.Context, info.ConvertedType, info.Location, ExprKind.OPERATOR_INVOCATION, info.Parent, info.Child, true, info.ExprValue))
         {
             Expr = Factory.Create(info.SetParent(this, 0));
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Initializer.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Initializer.cs
index 7a7dd1b9170..d96a44527d8 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Initializer.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Initializer.cs
@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
     internal class ArrayInitializer : Expression<InitializerExpressionSyntax>
     {
-        private ArrayInitializer(ExpressionNodeInfo info) : base(info.SetType(NullType.Create(info.Context)).SetKind(ExprKind.ARRAY_INIT)) { }
+        private ArrayInitializer(ExpressionNodeInfo info) : base(info.SetType(null).SetKind(ExprKind.ARRAY_INIT)) { }
 
         public static Expression Create(ExpressionNodeInfo info) => new ArrayInitializer(info).TryPopulate();
 
@@ -40,7 +40,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             var info = new ExpressionInfo(
                 cx,
-                NullType.Create(cx),
+                null,
                 location,
                 ExprKind.ARRAY_INIT,
                 parent,
@@ -135,7 +135,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             {
                 var collectionInfo = cx.GetModel(Syntax).GetCollectionInitializerSymbolInfo(i);
                 var addMethod = Method.Create(cx, collectionInfo.Symbol as IMethodSymbol);
-                var voidType = Entities.Type.Create(cx, new AnnotatedTypeSymbol(cx.Compilation.GetSpecialType(SpecialType.System_Void), NullableAnnotation.None));
+                var voidType = AnnotatedTypeSymbol.CreateNotAnnotated(cx.Compilation.GetSpecialType(SpecialType.System_Void));
 
                 var invocation = new Expression(new ExpressionInfo(cx, voidType, cx.Create(i.GetLocation()), ExprKind.METHOD_INVOCATION, this, child++, false, null));
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
index 7a0e2fcc683..9efb5aec97f 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
@@ -55,7 +55,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                         // Implicit `this` qualifier; add explicitly
 
                         if (cx.GetModel(Syntax).GetEnclosingSymbol(Location.symbol.SourceSpan.Start) is IMethodSymbol callingMethod)
-                            This.CreateImplicit(cx, Entities.Type.Create(cx, callingMethod.ContainingType), Location, this, child++);
+                            This.CreateImplicit(cx, callingMethod.ContainingType, Location, this, child++);
                         else
                             cx.ModelError(Syntax, "Couldn't determine implicit this type");
                     }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Literal.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Literal.cs
index d31a75b33d4..ad63cc26ac6 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Literal.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Literal.cs
@@ -21,11 +21,11 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 case SyntaxKind.DefaultLiteralExpression:
                     return ExprKind.DEFAULT;
                 case SyntaxKind.NullLiteralExpression:
-                    info.Type = Entities.NullType.Create(info.Context);  // Don't use converted type.
+                    info.SetType(null);  // Don't use converted type.
                     return ExprKind.NULL_LITERAL;
             }
 
-            var type = info.Type.Type.symbol;
+            var type = info.Type?.Symbol;
             return GetExprKind(type, info.Node, info.Context);
         }
 
@@ -82,7 +82,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             var info = new ExpressionInfo(
                 cx,
-                new AnnotatedType(Entities.Type.Create(cx, type), NullableAnnotation.None),
+                AnnotatedTypeSymbol.CreateNotAnnotated(type),
                 location,
                 GetExprKind(type, null, cx),
                 parent,
@@ -97,7 +97,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             var info = new ExpressionInfo(
                 cx,
-                NullType.Create(cx),
+                null,
                 location,
                 ExprKind.NULL_LITERAL,
                 parent,
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/AnonymousObjectCreation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/AnonymousObjectCreation.cs
index 718217bb720..5703c3101a2 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/AnonymousObjectCreation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/AnonymousObjectCreation.cs
@@ -35,7 +35,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 // Create an "assignment"
                 var property = cx.GetModel(init).GetDeclaredSymbol(init);
                 var propEntity = Property.Create(cx, property);
-                var type = Entities.Type.Create(cx, property.GetAnnotatedType());
+                var type = property.GetAnnotatedType();
                 var loc = cx.Create(init.GetLocation());
 
                 var assignment = new Expression(new ExpressionInfo(cx, type, loc, ExprKind.SIMPLE_ASSIGN, objectInitializer, child++, false, null));
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/BaseObjectCreation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/BaseObjectCreation.cs
index 82b9899598d..10f4df8bf7f 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/BaseObjectCreation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/ObjectCreation/BaseObjectCreation.cs
@@ -46,10 +46,10 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 switch (Syntax.Initializer.Kind())
                 {
                     case SyntaxKind.CollectionInitializerExpression:
-                        CollectionInitializer.Create(new ExpressionNodeInfo(cx, Syntax.Initializer, this, -1) { Type = Type });
+                        CollectionInitializer.Create(new ExpressionNodeInfo(cx, Syntax.Initializer, this, -1).SetType(Type));
                         break;
                     case SyntaxKind.ObjectInitializerExpression:
-                        ObjectInitializer.Create(new ExpressionNodeInfo(cx, Syntax.Initializer, this, -1) { Type = Type });
+                        ObjectInitializer.Create(new ExpressionNodeInfo(cx, Syntax.Initializer, this, -1).SetType(Type));
                         break;
                     default:
                         cx.ModelError("Unhandled initializer in object creation");
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
index eef8f28b5fa..e51fb125b02 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
@@ -30,7 +30,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                         {
                             if (cx.GetModel(syntax).GetDeclaredSymbol(designation) is ILocalSymbol symbol)
                             {
-                                var type = Type.Create(cx, symbol.GetAnnotatedType());
+                                var type = symbol.GetAnnotatedType();
                                 return VariableDeclaration.Create(cx, symbol, type, declPattern.Type, cx.Create(syntax.GetLocation()), false, parent, child);
                             }
                             if (designation is DiscardDesignationSyntax)
@@ -53,7 +53,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                         case SingleVariableDesignationSyntax varDesignation:
                             if (cx.GetModel(syntax).GetDeclaredSymbol(varDesignation) is ILocalSymbol symbol)
                             {
-                                var type = Type.Create(cx, symbol.GetAnnotatedType());
+                                var type = symbol.GetAnnotatedType();
 
                                 return VariableDeclaration.Create(cx, symbol, type, null, cx.Create(syntax.GetLocation()), true, parent, child);
                             }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PositionalPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PositionalPattern.cs
index b65b9020743..0f3c2bf8800 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PositionalPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PositionalPattern.cs
@@ -7,7 +7,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     internal class PositionalPattern : Expression
     {
         internal PositionalPattern(Context cx, PositionalPatternClauseSyntax posPc, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, Entities.NullType.Create(cx), cx.Create(posPc.GetLocation()), ExprKind.POSITIONAL_PATTERN, parent, child, false, null))
+            base(new ExpressionInfo(cx, null, cx.Create(posPc.GetLocation()), ExprKind.POSITIONAL_PATTERN, parent, child, false, null))
         {
             child = 0;
             foreach (var sub in posPc.Subpatterns)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PropertyPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PropertyPattern.cs
index 147ac595c77..ed947990045 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PropertyPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/PropertyPattern.cs
@@ -7,7 +7,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     internal class PropertyPattern : Expression
     {
         internal PropertyPattern(Context cx, PropertyPatternClauseSyntax pp, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, Entities.NullType.Create(cx), cx.Create(pp.GetLocation()), ExprKind.PROPERTY_PATTERN, parent, child, false, null))
+            base(new ExpressionInfo(cx, null, cx.Create(pp.GetLocation()), ExprKind.PROPERTY_PATTERN, parent, child, false, null))
         {
             child = 0;
             var trapFile = cx.TrapWriter.Writer;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs
index 997c622c818..f49859b8d32 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs
@@ -17,7 +17,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         /// <param name="child">The child index of this pattern.</param>
         /// <param name="isTopLevel">If this pattern is in the top level of a case/is. In that case, the variable and type access are populated elsewhere.</param>
         public RecursivePattern(Context cx, RecursivePatternSyntax syntax, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, Entities.NullType.Create(cx), cx.Create(syntax.GetLocation()), ExprKind.RECURSIVE_PATTERN, parent, child, false, null))
+            base(new ExpressionInfo(cx, null, cx.Create(syntax.GetLocation()), ExprKind.RECURSIVE_PATTERN, parent, child, false, null))
         {
             // Extract the type access
             if (syntax.Type is TypeSyntax t)
@@ -26,7 +26,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             // Extract the local variable declaration
             if (syntax.Designation is VariableDesignationSyntax designation && cx.GetModel(syntax).GetDeclaredSymbol(designation) is ILocalSymbol symbol)
             {
-                var type = Entities.Type.Create(cx, symbol.GetAnnotatedType());
+                var type = symbol.GetAnnotatedType();
 
                 VariableDeclaration.Create(cx, symbol, type, null, cx.Create(syntax.GetLocation()), false, this, 0);
             }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs
index 14760e7331a..d80c390efff 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/UnaryPattern.cs
@@ -7,7 +7,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     internal class UnaryPattern : Expression
     {
         public UnaryPattern(Context cx, UnaryPatternSyntax syntax, IExpressionParentEntity parent, int child) :
-            base(new ExpressionInfo(cx, NullType.Create(cx), cx.Create(syntax.GetLocation()), ExprKind.NOT_PATTERN, parent, child, false, null))
+            base(new ExpressionInfo(cx, null, cx.Create(syntax.GetLocation()), ExprKind.NOT_PATTERN, parent, child, false, null))
         {
             Pattern.Create(cx, syntax.Pattern, this, 0);
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs
index 83c4a25d3a4..1db6c39fef2 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Query.cs
@@ -22,7 +22,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         private class QueryCall : Expression
         {
             public QueryCall(Context cx, IMethodSymbol method, SyntaxNode clause, IExpressionParentEntity parent, int child)
-                : base(new ExpressionInfo(cx, method is null ? NullType.Create(cx) : Entities.Type.Create(cx, method.GetAnnotatedReturnType()),
+                : base(new ExpressionInfo(cx, method?.GetAnnotatedReturnType(),
                         cx.Create(clause.GetLocation()),
                         ExprKind.METHOD_INVOCATION, parent, child, false, null))
             {
@@ -63,21 +63,21 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
             protected Expression DeclareRangeVariable(Context cx, IExpressionParentEntity parent, int child, bool getElement, ISymbol variableSymbol, SyntaxToken name)
             {
-                var type = Type.Create(cx, cx.GetType(Expr));
+                var type = cx.GetType(Expr);
 
-                AnnotatedType declType;
+                AnnotatedTypeSymbol? declType;
                 TypeSyntax declTypeSyntax = null;
                 if (getElement)
                 {
                     if (node is FromClauseSyntax from && from.Type != null)
                     {
                         declTypeSyntax = from.Type;
-                        declType = Type.Create(cx, cx.GetType(from.Type));
+                        declType = cx.GetType(from.Type);
                     }
                     else
                     {
                         declTypeSyntax = null;
-                        declType = type.Type.ElementType;
+                        declType = GetElementType(cx, type.Symbol);
                     }
                 }
                 else
@@ -104,6 +104,36 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 return decl;
             }
 
+            private static AnnotatedTypeSymbol? GetEnumerableType(Context cx, INamedTypeSymbol type)
+            {
+                return type.SpecialType == SpecialType.System_Collections_IEnumerable
+                    ? cx.Compilation.ObjectType.WithAnnotation(NullableAnnotation.NotAnnotated)
+                    : type.OriginalDefinition.SpecialType == SpecialType.System_Collections_Generic_IEnumerable_T
+                        ? type.GetAnnotatedTypeArguments().First()
+                        : (AnnotatedTypeSymbol?)null;
+            }
+
+            private static AnnotatedTypeSymbol? GetEnumerableElementType(Context cx, INamedTypeSymbol type)
+            {
+                var et = GetEnumerableType(cx, type);
+                if (et != null)
+                    return et;
+
+                return type.AllInterfaces
+                    .Where(i => i.OriginalDefinition.SpecialType == SpecialType.System_Collections_Generic_IEnumerable_T)
+                    .Concat(type.AllInterfaces.Where(i => i.SpecialType == SpecialType.System_Collections_IEnumerable))
+                    .Select(i => GetEnumerableType(cx, i))
+                    .FirstOrDefault();
+            }
+
+            private static AnnotatedTypeSymbol? GetElementType(Context cx, ITypeSymbol symbol) =>
+                symbol switch
+                {
+                    IArrayTypeSymbol a => a.GetAnnotatedElementType(),
+                    INamedTypeSymbol n => GetEnumerableElementType(cx, n),
+                    _ => null
+                };
+
             protected void PopulateArguments(Context cx, QueryCall callExpr, int child)
             {
                 foreach (var e in arguments)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Switch.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Switch.cs
index 3585996c7db..5fdc08c66d3 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Switch.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Switch.cs
@@ -29,7 +29,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     {
         internal SwitchCase(Context cx, SwitchExpressionArmSyntax arm, Switch parent, int child) :
             base(new ExpressionInfo(
-                cx, Entities.Type.Create(cx, cx.GetType(arm.Expression)), cx.Create(arm.GetLocation()),
+                cx, cx.GetType(arm.Expression), cx.Create(arm.GetLocation()),
                 ExprKind.SWITCH_CASE, parent, child, false, null))
         {
             Expressions.Pattern.Create(cx, arm.Pattern, this, 0);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/This.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/This.cs
index 838e494ff00..a13c2cb95bc 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/This.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/This.cs
@@ -7,8 +7,8 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     {
         private This(IExpressionInfo info) : base(info) { }
 
-        public static This CreateImplicit(Context cx, Type @class, Extraction.Entities.Location loc, IExpressionParentEntity parent, int child) =>
-            new This(new ExpressionInfo(cx, new AnnotatedType(@class, NullableAnnotation.None), loc, Kinds.ExprKind.THIS_ACCESS, parent, child, true, null));
+        public static This CreateImplicit(Context cx, ITypeSymbol @class, Extraction.Entities.Location loc, IExpressionParentEntity parent, int child) =>
+            new This(new ExpressionInfo(cx, AnnotatedTypeSymbol.CreateNotAnnotated(@class), loc, Kinds.ExprKind.THIS_ACCESS, parent, child, true, null));
 
         public static This CreateExplicit(ExpressionNodeInfo info) => new This(info.SetKind(ExprKind.THIS_ACCESS));
     }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeAccess.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeAccess.cs
index 334ae764d26..e5c0fd3ac66 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeAccess.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeAccess.cs
@@ -15,7 +15,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             {
                 case SyntaxKind.SimpleMemberAccessExpression:
                     var maes = (MemberAccessExpressionSyntax)Syntax;
-                    if (Type.Type.ContainingType == null)
+                    if (Type?.Symbol.ContainingType is null)
                     {
                         // namespace qualifier
                         TypeMention.Create(cx, maes.Name, this, Type, Syntax.GetLocation());
@@ -39,7 +39,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             var typeAccessInfo = new ExpressionInfo(
                 cx,
-                new AnnotatedType(Entities.Type.Create(cx, type), Microsoft.CodeAnalysis.NullableAnnotation.None),
+                AnnotatedTypeSymbol.CreateNotAnnotated(type),
                 location,
                 ExprKind.TYPE_ACCESS,
                 parent,
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeOf.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeOf.cs
index e99b7d8b324..686e4156528 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeOf.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/TypeOf.cs
@@ -21,7 +21,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             var info = new ExpressionInfo(
                 cx,
-                new AnnotatedType(Entities.Type.Create(cx, type), Microsoft.CodeAnalysis.NullableAnnotation.None),
+                AnnotatedTypeSymbol.CreateNotAnnotated(type),
                 location,
                 ExprKind.TYPEOF,
                 parent,
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/VariableDeclaration.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/VariableDeclaration.cs
index 84b61956ae6..349236e893a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/VariableDeclaration.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/VariableDeclaration.cs
@@ -11,7 +11,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     {
         private VariableDeclaration(IExpressionInfo info) : base(info) { }
 
-        public static VariableDeclaration Create(Context cx, ISymbol symbol, AnnotatedType type, TypeSyntax optionalSyntax, Extraction.Entities.Location exprLocation, bool isVar, IExpressionParentEntity parent, int child)
+        public static VariableDeclaration Create(Context cx, ISymbol symbol, AnnotatedTypeSymbol? type, TypeSyntax optionalSyntax, Extraction.Entities.Location exprLocation, bool isVar, IExpressionParentEntity parent, int child)
         {
             var ret = new VariableDeclaration(new ExpressionInfo(cx, type, exprLocation, ExprKind.LOCAL_VAR_DECL, parent, child, false, null));
             cx.Try(null, null, () =>
@@ -30,10 +30,10 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             if (variableSymbol == null)
             {
                 cx.ModelError(node, "Failed to determine local variable");
-                return Create(cx, node, NullType.Create(cx), parent, child);
+                return Create(cx, node, (AnnotatedTypeSymbol?)null, parent, child);
             }
 
-            var type = Entities.Type.Create(cx, variableSymbol.GetAnnotatedType());
+            var type = variableSymbol.GetAnnotatedType();
             var ret = Create(cx, designation, type, parent, child);
             cx.Try(null, null, () =>
             {
@@ -49,7 +49,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         /// </summary>
         public static Expression CreateParenthesized(Context cx, DeclarationExpressionSyntax node, ParenthesizedVariableDesignationSyntax designation, IExpressionParentEntity parent, int child)
         {
-            var type = Entities.NullType.Create(cx); // Should ideally be a corresponding tuple type
+            AnnotatedTypeSymbol? type = null; // Should ideally be a corresponding tuple type
             var tuple = new Expression(new ExpressionInfo(cx, type, cx.Create(node.GetLocation()), ExprKind.TUPLE, parent, child, false, null));
 
             cx.Try(null, null, () =>
@@ -64,7 +64,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         public static Expression CreateParenthesized(Context cx, VarPatternSyntax varPattern, ParenthesizedVariableDesignationSyntax designation, IExpressionParentEntity parent, int child)
         {
-            var type = NullType.Create(cx); // Should ideally be a corresponding tuple type
+            AnnotatedTypeSymbol? type = null; // Should ideally be a corresponding tuple type
             var tuple = new Expression(new ExpressionInfo(cx, type, cx.Create(varPattern.GetLocation()), ExprKind.TUPLE, parent, child, false, null));
 
             cx.Try(null, null, () =>
@@ -80,7 +80,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                         case SingleVariableDesignationSyntax single:
                             if (cx.GetModel(variable).GetDeclaredSymbol(single) is ILocalSymbol local)
                             {
-                                var decl = Create(cx, variable, Entities.Type.Create(cx, local.GetAnnotatedType()), tuple, child0++);
+                                var decl = Create(cx, variable, local.GetAnnotatedType(), tuple, child0++);
                                 var l = LocalVariable.Create(cx, local);
                                 l.PopulateManual(decl, true);
                             }
@@ -111,25 +111,24 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 case ParenthesizedVariableDesignationSyntax paren:
                     return CreateParenthesized(cx, node, paren, parent, child);
                 case DiscardDesignationSyntax discard:
-                    var ti = cx.GetType(discard);
-                    var type = Entities.Type.Create(cx, ti);
+                    var type = cx.GetType(discard);
                     return Create(cx, node, type, parent, child);
                 default:
                     cx.ModelError(node, "Failed to determine designation type");
-                    return Create(cx, node, NullType.Create(cx), parent, child);
+                    return Create(cx, node, null, parent, child);
             }
         }
 
         public static Expression Create(Context cx, DeclarationExpressionSyntax node, IExpressionParentEntity parent, int child) =>
             Create(cx, node, node.Designation, parent, child);
 
-        public static VariableDeclaration Create(Context cx, CSharpSyntaxNode c, AnnotatedType type, IExpressionParentEntity parent, int child) =>
+        public static VariableDeclaration Create(Context cx, CSharpSyntaxNode c, AnnotatedTypeSymbol? type, IExpressionParentEntity parent, int child) =>
             new VariableDeclaration(new ExpressionInfo(cx, type, cx.Create(c.FixedLocation()), ExprKind.LOCAL_VAR_DECL, parent, child, false, null));
 
         public static VariableDeclaration Create(Context cx, CatchDeclarationSyntax d, bool isVar, IExpressionParentEntity parent, int child)
         {
             var symbol = cx.GetModel(d).GetDeclaredSymbol(d);
-            var type = Entities.Type.Create(cx, symbol.GetAnnotatedType());
+            var type = symbol.GetAnnotatedType();
             var ret = Create(cx, d, type, parent, child);
             cx.Try(d, null, () =>
             {
@@ -141,7 +140,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             return ret;
         }
 
-        public static VariableDeclaration CreateDeclarator(Context cx, VariableDeclaratorSyntax d, AnnotatedType type, bool isVar, IExpressionParentEntity parent, int child)
+        public static VariableDeclaration CreateDeclarator(Context cx, VariableDeclaratorSyntax d, AnnotatedTypeSymbol type, bool isVar, IExpressionParentEntity parent, int child)
         {
             var ret = Create(cx, d, type, parent, child);
             cx.Try(d, null, () =>
@@ -170,7 +169,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     {
         public static void Populate(Context cx, VariableDeclarationSyntax decl, IExpressionParentEntity parent, int child, int childIncrement = 1)
         {
-            var type = Type.Create(cx, cx.GetType(decl.Type));
+            var type = cx.GetType(decl.Type);
 
             foreach (var v in decl.Variables)
             {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs
index 2990332648d..aadd9d2fbab 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs
@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp.Entities
         private Field(Context cx, IFieldSymbol init)
             : base(cx, init)
         {
-            type = new Lazy<AnnotatedType>(() => Entities.Type.Create(cx, symbol.GetAnnotatedType()));
+            type = new Lazy<Type>(() => Entities.Type.Create(cx, symbol.Type));
         }
 
         public static Field Create(Context cx, IFieldSymbol field) => FieldFactory.Instance.CreateEntityFromSymbol(cx, field);
@@ -32,7 +32,7 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulateNullability(trapFile, symbol.GetAnnotatedType());
 
             var unboundFieldKey = Field.Create(Context, symbol.OriginalDefinition);
-            trapFile.fields(this, (symbol.IsConst ? 2 : 1), symbol.Name, ContainingType, Type.Type.TypeRef, unboundFieldKey);
+            trapFile.fields(this, (symbol.IsConst ? 2 : 1), symbol.Name, ContainingType, Type.TypeRef, unboundFieldKey);
 
             PopulateModifiers(trapFile);
 
@@ -71,7 +71,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
                     if (!symbol.IsStatic)
                     {
-                        This.CreateImplicit(Context, Entities.Type.Create(Context, symbol.ContainingType), Location, fieldAccess, -1);
+                        This.CreateImplicit(Context, symbol.ContainingType, Location, fieldAccess, -1);
                     }
                 });
             }
@@ -107,19 +107,20 @@ namespace Semmle.Extraction.CSharp.Entities
         private Expression AddInitializerAssignment(TextWriter trapFile, ExpressionSyntax initializer, Extraction.Entities.Location loc,
             string constValue, ref int child)
         {
-            var simpleAssignExpr = new Expression(new ExpressionInfo(Context, Type, loc, ExprKind.SIMPLE_ASSIGN, this, child++, false, constValue));
+            var type = symbol.GetAnnotatedType();
+            var simpleAssignExpr = new Expression(new ExpressionInfo(Context, type, loc, ExprKind.SIMPLE_ASSIGN, this, child++, false, constValue));
             Expression.CreateFromNode(new ExpressionNodeInfo(Context, initializer, simpleAssignExpr, 0));
-            var access = new Expression(new ExpressionInfo(Context, Type, Location, ExprKind.FIELD_ACCESS, simpleAssignExpr, 1, false, constValue));
+            var access = new Expression(new ExpressionInfo(Context, type, Location, ExprKind.FIELD_ACCESS, simpleAssignExpr, 1, false, constValue));
             trapFile.expr_access(access, this);
             return access;
         }
 
-        private readonly Lazy<AnnotatedType> type;
-        public AnnotatedType Type => type.Value;
+        private readonly Lazy<Type> type;
+        public Type Type => type.Value;
 
         public override void WriteId(TextWriter trapFile)
         {
-            trapFile.WriteSubId(Type.Type);
+            trapFile.WriteSubId(Type);
             trapFile.Write(" ");
             trapFile.WriteSubId(ContainingType);
             trapFile.Write('.');
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs
index 5873d3e19f4..70b15a6fe16 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs
@@ -46,7 +46,7 @@ namespace Semmle.Extraction.CSharp.Entities
                 {
                     // The expression may need to reference parameters in the getter.
                     // So we need to arrange that the expression is populated after the getter.
-                    Context.PopulateLater(() => Expression.CreateFromNode(new ExpressionNodeInfo(Context, expressionBody, this, 0) { Type = Type.Create(Context, symbol.GetAnnotatedType()) }));
+                    Context.PopulateLater(() => Expression.CreateFromNode(new ExpressionNodeInfo(Context, expressionBody, this, 0).SetType(symbol.GetAnnotatedType())));
                 }
             }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalVariable.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalVariable.cs
index de44b16d69f..e988ec2c815 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalVariable.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalVariable.cs
@@ -24,9 +24,9 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             var trapFile = Context.TrapWriter.Writer;
             var (kind, type) = symbol is ILocalSymbol l
-                ? (l.IsRef ? 3 : l.IsConst ? 2 : 1, Type.Create(Context, l.GetAnnotatedType()))
+                ? (l.IsRef ? 3 : l.IsConst ? 2 : 1, l.GetAnnotatedType())
                 : (1, parent.Type);
-            trapFile.localvars(this, kind, symbol.Name, isVar ? 1 : 0, type.Type.TypeRef, parent);
+            trapFile.localvars(this, kind, symbol.Name, isVar ? 1 : 0, Type.Create(Context, type).TypeRef, parent);
 
             if (symbol is ILocalSymbol local)
             {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs
index 739708138ad..08d5ae47c5e 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs
@@ -85,14 +85,14 @@ namespace Semmle.Extraction.CSharp.Entities
                     Context.PopulateLater(() =>
                     {
                         var loc = Context.Create(initializer.GetLocation());
-                        var annotatedType = new AnnotatedType(type, NullableAnnotation.None);
+                        var annotatedType = AnnotatedTypeSymbol.CreateNotAnnotated(symbol.Type);
                         var simpleAssignExpr = new Expression(new ExpressionInfo(Context, annotatedType, loc, ExprKind.SIMPLE_ASSIGN, this, child++, false, null));
                         Expression.CreateFromNode(new ExpressionNodeInfo(Context, initializer.Value, simpleAssignExpr, 0));
                         var access = new Expression(new ExpressionInfo(Context, annotatedType, Location, ExprKind.PROPERTY_ACCESS, simpleAssignExpr, 1, false, null));
                         trapFile.expr_access(access, this);
                         if (!symbol.IsStatic)
                         {
-                            This.CreateImplicit(Context, Type.Create(Context, symbol.ContainingType), Location, access, -1);
+                            This.CreateImplicit(Context, symbol.ContainingType, Location, access, -1);
                         }
                     });
                 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Catch.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Catch.cs
index 13cc39f7fea..db1a0d413c1 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Catch.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/Catch.cs
@@ -20,11 +20,11 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
             if (hasVariableDeclaration) // A catch clause of the form 'catch(Ex ex) { ... }'
             {
                 var decl = Expressions.VariableDeclaration.Create(cx, Stmt.Declaration, false, this, 0);
-                trapFile.catch_type(this, decl.Type.Type.TypeRef, true);
+                trapFile.catch_type(this, Type.Create(cx, decl.Type).TypeRef, true);
             }
             else if (isSpecificCatchClause) // A catch clause of the form 'catch(Ex) { ... }'
             {
-                trapFile.catch_type(this, Type.Create(cx, cx.GetType(Stmt.Declaration.Type)).Type.TypeRef, true);
+                trapFile.catch_type(this, Type.Create(cx, cx.GetType(Stmt.Declaration.Type)).TypeRef, true);
             }
             else // A catch clause of the form 'catch { ... }'
             {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ForEach.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ForEach.cs
index 653ed384e7b..262b3f0e328 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ForEach.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Statements/ForEach.cs
@@ -23,7 +23,7 @@ namespace Semmle.Extraction.CSharp.Entities.Statements
             Expression.Create(cx, Stmt.Expression, this, 1);
 
             var typeSymbol = cx.GetModel(Stmt).GetDeclaredSymbol(Stmt);
-            var type = Type.Create(cx, typeSymbol.GetAnnotatedType());
+            var type = typeSymbol.GetAnnotatedType();
 
             var location = cx.Create(Stmt.Identifier.GetLocation());
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs
index 4f1e166b8dc..8d6074f3e8d 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs
@@ -47,7 +47,7 @@ namespace Semmle.Extraction.CSharp.Entities
             switch (type)
             {
                 case ArrayType at:
-                    return GetArrayElementType(at.ElementType.Type);
+                    return GetArrayElementType(at.ElementType);
                 case NamedType nt when nt.symbol.IsBoundSpan() ||
                                        nt.symbol.IsBoundReadOnlySpan():
                     return nt.TypeArguments.Single();
@@ -128,8 +128,8 @@ namespace Semmle.Extraction.CSharp.Entities
             return ret;
         }
 
-        public static TypeMention Create(Context cx, TypeSyntax syntax, IEntity parent, AnnotatedType type, Microsoft.CodeAnalysis.Location loc = null) =>
-            Create(cx, syntax, parent, type.Type, loc);
+        public static TypeMention Create(Context cx, TypeSyntax syntax, IEntity parent, AnnotatedTypeSymbol? type, Microsoft.CodeAnalysis.Location loc = null) =>
+            Create(cx, syntax, parent, Type.Create(cx, type?.Symbol), loc);
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.OptionalLabel;
     }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/ArrayType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/ArrayType.cs
index 2c617158219..4ec1db558e5 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/ArrayType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/ArrayType.cs
@@ -1,3 +1,4 @@
+using System;
 using System.IO;
 using Microsoft.CodeAnalysis;
 
@@ -8,16 +9,16 @@ namespace Semmle.Extraction.CSharp.Entities
         private ArrayType(Context cx, IArrayTypeSymbol init)
             : base(cx, init)
         {
-            element = Create(cx, symbol.GetAnnotatedElementType());
+            elementLazy = new Lazy<Type>(() => Create(cx, symbol.ElementType));
         }
 
-        private readonly AnnotatedType element;
+        private readonly Lazy<Type> elementLazy;
 
         public int Rank => symbol.Rank;
 
-        public override AnnotatedType ElementType => element;
+        public Type ElementType => elementLazy.Value;
 
-        public override int Dimension => 1 + element.Type.Dimension;
+        public override int Dimension => 1 + ElementType.Dimension;
 
         // All array types are extracted because they won't
         // be extracted in their defining assembly.
@@ -25,18 +26,19 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            trapFile.array_element_type(this, Dimension, Rank, element.Type.TypeRef);
+            trapFile.array_element_type(this, Dimension, Rank, ElementType.TypeRef);
             PopulateType(trapFile);
         }
 
         public override void WriteId(TextWriter trapFile)
         {
-            trapFile.WriteSubId(element.Type);
+            trapFile.WriteSubId(ElementType);
             symbol.BuildArraySuffix(trapFile);
             trapFile.Write(";type");
         }
 
-        public static ArrayType Create(Context cx, IArrayTypeSymbol symbol) => ArrayTypeFactory.Instance.CreateEntityFromSymbol(cx, symbol);
+        public static ArrayType Create(Context cx, IArrayTypeSymbol symbol) =>
+            ArrayTypeFactory.Instance.CreateEntityFromSymbol(cx, symbol);
 
         private class ArrayTypeFactory : ICachedEntityFactory<IArrayTypeSymbol, ArrayType>
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
index bc48b30091c..bded5f60c57 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
@@ -149,36 +149,6 @@ namespace Semmle.Extraction.CSharp.Entities
                 base.WriteQuotedId(trapFile);
         }
 
-        /// <summary>
-        /// Returns the element type in an Enumerable/IEnumerable
-        /// </summary>
-        /// <param name="cx">Extraction context.</param>
-        /// <param name="type">The enumerable type.</param>
-        /// <returns>The element type, or null.</returns>
-        private static AnnotatedTypeSymbol GetElementType(Context cx, INamedTypeSymbol type)
-        {
-            var et = GetEnumerableType(cx, type);
-            if (et.Symbol != null)
-                return et;
-
-            return type.AllInterfaces
-                .Where(i => i.OriginalDefinition.SpecialType == SpecialType.System_Collections_Generic_IEnumerable_T)
-                .Concat(type.AllInterfaces.Where(i => i.SpecialType == SpecialType.System_Collections_IEnumerable))
-                .Select(i => GetEnumerableType(cx, i))
-                .FirstOrDefault();
-        }
-
-        private static AnnotatedTypeSymbol GetEnumerableType(Context cx, INamedTypeSymbol type)
-        {
-            return type.SpecialType == SpecialType.System_Collections_IEnumerable
-                ? cx.Compilation.ObjectType.WithAnnotation(NullableAnnotation.NotAnnotated)
-                : type.OriginalDefinition.SpecialType == SpecialType.System_Collections_Generic_IEnumerable_T
-                    ? type.GetAnnotatedTypeArguments().First()
-                    : default(AnnotatedTypeSymbol);
-        }
-
-        public override AnnotatedType ElementType => Type.Create(Context, GetElementType(Context, symbol));
-
         private class NamedTypeFactory : ICachedEntityFactory<INamedTypeSymbol, NamedType>
         {
             public static NamedTypeFactory Instance { get; } = new NamedTypeFactory();
@@ -235,5 +205,5 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             trapFile.typerefs(this, symbol.Name);
         }
-    };
+    }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NullType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NullType.cs
index 2822e346384..33f7c44d21f 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NullType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NullType.cs
@@ -27,7 +27,7 @@ namespace Semmle.Extraction.CSharp.Entities
             return obj != null && obj.GetType() == typeof(NullType);
         }
 
-        public static AnnotatedType Create(Context cx) => new AnnotatedType(NullTypeFactory.Instance.CreateEntity(cx, typeof(NullType), null), NullableAnnotation.None);
+        public static Type Create(Context cx) => NullTypeFactory.Instance.CreateEntity(cx, typeof(NullType), null);
 
         private class NullTypeFactory : ICachedEntityFactory<ITypeSymbol, NullType>
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs
index af9c4bf4fa6..4ddc258f5c7 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs
@@ -59,6 +59,6 @@ namespace Semmle.Extraction.CSharp.Entities
         private readonly Lazy<Field[]> tupleElementsLazy;
         public Field[] TupleElements => tupleElementsLazy.Value;
 
-        public override IEnumerable<Type> TypeMentions => TupleElements.Select(e => e.Type.Type);
+        public override IEnumerable<Type> TypeMentions => TupleElements.Select(e => e.Type);
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
index 1b1d205b3d7..ef1e2909ebf 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
@@ -7,36 +7,11 @@ using System.Linq;
 
 namespace Semmle.Extraction.CSharp.Entities
 {
-    /// <summary>
-    /// Represents an annotated type consisting of a type entity and nullability information.
-    /// </summary>
-    public struct AnnotatedType
-    {
-        public AnnotatedType(Type t, NullableAnnotation n)
-        {
-            Type = t;
-            annotation = n;
-        }
-
-        /// <summary>
-        /// The underlying type.
-        /// </summary>
-        public Type Type { get; private set; }
-
-        private readonly NullableAnnotation annotation;
-
-        /// <summary>
-        /// Gets the annotated type symbol of this annotated type.
-        /// </summary>
-        public AnnotatedTypeSymbol Symbol => new AnnotatedTypeSymbol(Type.symbol, annotation);
-    }
-
     public abstract class Type : CachedSymbol<ITypeSymbol>
     {
         protected Type(Context cx, ITypeSymbol init)
             : base(cx, init) { }
 
-        public virtual AnnotatedType ElementType => default(AnnotatedType);
 
         public override bool NeedsPopulation =>
             base.NeedsPopulation || symbol.TypeKind == TypeKind.Dynamic || symbol.TypeKind == TypeKind.TypeParameter;
@@ -277,12 +252,12 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             type = type.DisambiguateType();
             return type == null
-                ? NullType.Create(cx).Type
+                ? NullType.Create(cx)
                 : (Type)cx.CreateEntity(type);
         }
 
-        public static AnnotatedType Create(Context cx, AnnotatedTypeSymbol type) =>
-            new AnnotatedType(Create(cx, type.Symbol), type.Nullability);
+        public static Type Create(Context cx, AnnotatedTypeSymbol? type) =>
+            Create(cx, type?.Symbol);
 
         public virtual int Dimension => 0;
 
@@ -331,10 +306,10 @@ namespace Semmle.Extraction.CSharp.Entities
         public override bool Equals(object obj)
         {
             var other = obj as Type;
-            return other?.GetType() == GetType() && SymbolEqualityComparer.IncludeNullability.Equals(other.symbol, symbol);
+            return other?.GetType() == GetType() && SymbolEqualityComparer.Default.Equals(other.symbol, symbol);
         }
 
-        public override int GetHashCode() => SymbolEqualityComparer.IncludeNullability.GetHashCode(symbol);
+        public override int GetHashCode() => SymbolEqualityComparer.Default.GetHashCode(symbol);
     }
 
     internal abstract class Type<T> : Type where T : ITypeSymbol
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs b/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
index 6ea04c7ca9f..574374a80f5 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
@@ -23,6 +23,9 @@ namespace Semmle.Extraction.CSharp
             Symbol = symbol;
             Nullability = nullability;
         }
+
+        public static AnnotatedTypeSymbol? CreateNotAnnotated(ITypeSymbol symbol) =>
+            symbol is null ? (AnnotatedTypeSymbol?)null : new AnnotatedTypeSymbol(symbol, NullableAnnotation.None);
     }
 
     internal static class SymbolExtensions
@@ -497,13 +500,13 @@ namespace Semmle.Extraction.CSharp
         /// <summary>
         /// Holds if this symbol is a source declaration.
         /// </summary>
-        public static bool IsSourceDeclaration(this ISymbol symbol) => SymbolEqualityComparer.IncludeNullability.Equals(symbol, symbol.OriginalDefinition);
+        public static bool IsSourceDeclaration(this ISymbol symbol) => SymbolEqualityComparer.Default.Equals(symbol, symbol.OriginalDefinition);
 
         /// <summary>
         /// Holds if this method is a source declaration.
         /// </summary>
         public static bool IsSourceDeclaration(this IMethodSymbol method) =>
-            IsSourceDeclaration((ISymbol)method) && SymbolEqualityComparer.IncludeNullability.Equals(method, method.ConstructedFrom) && method.ReducedFrom == null;
+            IsSourceDeclaration((ISymbol)method) && SymbolEqualityComparer.Default.Equals(method, method.ConstructedFrom) && method.ReducedFrom == null;
 
         /// <summary>
         /// Holds if this parameter is a source declaration.
diff --git a/csharp/extractor/Semmle.Extraction/Context.cs b/csharp/extractor/Semmle.Extraction/Context.cs
index fc50d01f113..cbb68e1a936 100644
--- a/csharp/extractor/Semmle.Extraction/Context.cs
+++ b/csharp/extractor/Semmle.Extraction/Context.cs
@@ -169,7 +169,7 @@ namespace Semmle.Extraction
 #endif
 
         private readonly IDictionary<object, ICachedEntity> objectEntityCache = new Dictionary<object, ICachedEntity>();
-        private readonly IDictionary<ISymbol, ICachedEntity> symbolEntityCache = new Dictionary<ISymbol, ICachedEntity>(10000, SymbolEqualityComparer.IncludeNullability);
+        private readonly IDictionary<ISymbol, ICachedEntity> symbolEntityCache = new Dictionary<ISymbol, ICachedEntity>(10000, SymbolEqualityComparer.Default);
         private readonly HashSet<Label> extractedGenerics = new HashSet<Label>();
 
         /// <summary>
diff --git a/csharp/extractor/Semmle.Extraction/Symbol.cs b/csharp/extractor/Semmle.Extraction/Symbol.cs
index 4366cff7f06..2585ffd037f 100644
--- a/csharp/extractor/Semmle.Extraction/Symbol.cs
+++ b/csharp/extractor/Semmle.Extraction/Symbol.cs
@@ -79,7 +79,7 @@ namespace Semmle.Extraction
     /// A class used to wrap an `ISymbol` object, which uses `SymbolEqualityComparer.Default`
     /// for comparison.
     /// </summary>
-    public sealed class SymbolEqualityWrapper
+    public struct SymbolEqualityWrapper
     {
         public ISymbol Symbol { get; }
 
@@ -88,6 +88,6 @@ namespace Semmle.Extraction
         public override bool Equals(object? other) =>
             other is SymbolEqualityWrapper sew && SymbolEqualityComparer.Default.Equals(Symbol, sew.Symbol);
 
-        public override int GetHashCode() => 11 * Symbol.GetHashCode();
+        public override int GetHashCode() => 11 * SymbolEqualityComparer.Default.GetHashCode(Symbol);
     }
 }

From 26783b6ab0a63e70c765606bdb05d1091df2df81 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 15 Jan 2021 16:05:49 +0100
Subject: [PATCH 145/343] make getTopmostPackageJSON public again, and update
 PackageExports test

---
 javascript/ql/src/semmle/javascript/PackageExports.qll   | 2 +-
 javascript/ql/test/library-tests/PackageExports/tests.ql | 4 +---
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/PackageExports.qll b/javascript/ql/src/semmle/javascript/PackageExports.qll
index 62681c47e81..09212bc8aa6 100644
--- a/javascript/ql/src/semmle/javascript/PackageExports.qll
+++ b/javascript/ql/src/semmle/javascript/PackageExports.qll
@@ -28,7 +28,7 @@ private int countSlashes(string path) { result = count(path.splitAt("/")) - 1 }
  * There can be multiple results if the there exists multiple package.json that are equally deeply nested in the folder structure.
  * Results are limited to package.json files that are at most nested 2 directories deep.
  */
-private PackageJSON getTopmostPackageJSON() {
+PackageJSON getTopmostPackageJSON() {
   result =
     min(PackageJSON j |
       countSlashes(j.getFile().getRelativePath()) <= 3 and
diff --git a/javascript/ql/test/library-tests/PackageExports/tests.ql b/javascript/ql/test/library-tests/PackageExports/tests.ql
index ce1f7499051..1a23e8d24d9 100644
--- a/javascript/ql/test/library-tests/PackageExports/tests.ql
+++ b/javascript/ql/test/library-tests/PackageExports/tests.ql
@@ -3,9 +3,7 @@ import semmle.javascript.PackageExports as Exports
 
 query PackageJSON getTopmostPackageJSON() { result = Exports::getTopmostPackageJSON() }
 
-query DataFlow::Node getAValueExportedBy(PackageJSON json) {
-  result = Exports::getAValueExportedBy(json)
-}
+query DataFlow::Node getALibraryInputParameter() { result = Exports::getALibraryInputParameter() }
 
 query DataFlow::Node getAnExportedValue(Module mod, string name) {
   result = mod.getAnExportedValue(name)

From 401e5166543d6986bf730ff7150ff17553c974dc Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 15 Jan 2021 17:40:47 +0100
Subject: [PATCH 146/343] update expected output, and update PackageExports
 test

---
 .../PackageExports/absent_main/package.json   |  1 +
 .../library-tests/PackageExports/lib1/foo.js  |  2 +-
 .../library-tests/PackageExports/lib1/main.js |  6 +--
 .../PackageExports/lib1/package.json          |  1 +
 .../PackageExports/tests.expected             | 48 ++++---------------
 5 files changed, 16 insertions(+), 42 deletions(-)

diff --git a/javascript/ql/test/library-tests/PackageExports/absent_main/package.json b/javascript/ql/test/library-tests/PackageExports/absent_main/package.json
index 16a46fa2349..c608e602842 100644
--- a/javascript/ql/test/library-tests/PackageExports/absent_main/package.json
+++ b/javascript/ql/test/library-tests/PackageExports/absent_main/package.json
@@ -1,3 +1,4 @@
 {
+    "name": "foo",
     "main": "dist/does-not-exist.js"
 }
diff --git a/javascript/ql/test/library-tests/PackageExports/lib1/foo.js b/javascript/ql/test/library-tests/PackageExports/lib1/foo.js
index 48c64d64bd1..8b4fe3d58c0 100644
--- a/javascript/ql/test/library-tests/PackageExports/lib1/foo.js
+++ b/javascript/ql/test/library-tests/PackageExports/lib1/foo.js
@@ -1,3 +1,3 @@
 module.exports = function thisIsRequiredFromMain() {}
 
-module.exports.foo = function alsoExported() {}
\ No newline at end of file
+module.exports.foo = function alsoExported(d) {}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/PackageExports/lib1/main.js b/javascript/ql/test/library-tests/PackageExports/lib1/main.js
index e2c92b0b323..214bec626cd 100644
--- a/javascript/ql/test/library-tests/PackageExports/lib1/main.js
+++ b/javascript/ql/test/library-tests/PackageExports/lib1/main.js
@@ -3,9 +3,9 @@ module.exports = function isExported() {}
 module.exports.foo = require("./foo.js")
 
 module.exports.bar = class Bar {
-    constructor() {} // all are exported
-    static staticMethod() {}
-    instanceMethod() {}
+    constructor(a) {} // all are exported
+    static staticMethod(b) {}
+    instanceMethod(c) {}
 }
 
 class Baz {
diff --git a/javascript/ql/test/library-tests/PackageExports/lib1/package.json b/javascript/ql/test/library-tests/PackageExports/lib1/package.json
index 1855dfc2f88..e71185c8228 100644
--- a/javascript/ql/test/library-tests/PackageExports/lib1/package.json
+++ b/javascript/ql/test/library-tests/PackageExports/lib1/package.json
@@ -1,3 +1,4 @@
 {
+    "name": "foo",
     "main": "main.js"
 }
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/PackageExports/tests.expected b/javascript/ql/test/library-tests/PackageExports/tests.expected
index 392c3f33d80..648226a0d13 100644
--- a/javascript/ql/test/library-tests/PackageExports/tests.expected
+++ b/javascript/ql/test/library-tests/PackageExports/tests.expected
@@ -1,48 +1,20 @@
 getTopmostPackageJSON
-getAValueExportedBy
-| absent_main/package.json:1:1:3:1 | {\\n    " ... t.js"\\n} | absent_main/index.js:1:1:1:0 | this |
-| absent_main/package.json:1:1:3:1 | {\\n    " ... t.js"\\n} | absent_main/index.js:1:1:1:14 | module.exports |
-| absent_main/package.json:1:1:3:1 | {\\n    " ... t.js"\\n} | absent_main/index.js:1:1:1:18 | module.exports.foo |
-| absent_main/package.json:1:1:3:1 | {\\n    " ... t.js"\\n} | absent_main/index.js:1:22:1:21 | this |
-| absent_main/package.json:1:1:3:1 | {\\n    " ... t.js"\\n} | absent_main/index.js:1:22:1:34 | function() {} |
-| esmodules/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | esmodules/main.js:1:8:1:29 | functio ... ed() {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/foo.js:1:1:1:0 | this |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/foo.js:1:1:1:53 | module. ... in() {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/foo.js:1:18:1:53 | functio ... in() {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/foo.js:3:1:3:14 | module.exports |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/foo.js:3:1:3:18 | module.exports.foo |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/foo.js:3:22:3:21 | this |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/foo.js:3:22:3:47 | functio ... ed() {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:1:1:1:0 | this |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:1:1:1:41 | module. ... ed() {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:1:18:1:41 | functio ... ed() {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:3:1:3:14 | module.exports |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:3:1:3:18 | module.exports.foo |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:3:1:3:40 | module. ... oo.js") |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:3:22:3:40 | require("./foo.js") |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:5:1:5:14 | module.exports |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:5:1:5:18 | module.exports.bar |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:5:22:9:1 | class B ... () {}\\n} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:6:16:6:20 | () {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:7:5:7:28 | static  ... od() {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:7:24:7:28 | () {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:8:19:8:23 | () {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:14:19:14:23 | () {} |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:17:1:17:14 | module.exports |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:17:1:17:18 | module.exports.Baz |
-| lib1/package.json:1:1:3:1 | {\\n    " ... n.js"\\n} | lib1/main.js:17:22:17:30 | new Baz() |
-| lib1/sublib/package.json:1:1:3:1 | {\\n    " ... b.js"\\n} | lib1/sublib/sublib.js:1:1:1:0 | this |
-| lib1/sublib/package.json:1:1:3:1 | {\\n    " ... b.js"\\n} | lib1/sublib/sublib.js:1:1:1:73 | module. ... rt() {} |
-| lib1/sublib/package.json:1:1:3:1 | {\\n    " ... b.js"\\n} | lib1/sublib/sublib.js:1:18:1:73 | functio ... rt() {} |
+| absent_main/package.json:1:1:4:1 | {\\n    " ... t.js"\\n} |
+| lib1/package.json:1:1:4:1 | {\\n    " ... n.js"\\n} |
+getALibraryInputParameter
+| lib1/foo.js:3:44:3:44 | d |
+| lib1/main.js:6:17:6:17 | a |
+| lib1/main.js:7:25:7:25 | b |
+| lib1/main.js:8:20:8:20 | c |
 getAnExportedValue
 | absent_main/index.js:1:1:2:0 | <toplevel> | foo | absent_main/index.js:1:22:1:34 | function() {} |
 | esmodules/main.js:1:1:4:0 | <toplevel> | exported | esmodules/main.js:1:8:1:29 | functio ... ed() {} |
 | lib1/baz.js:1:1:5:1 | <toplevel> | bar | lib1/baz.js:4:10:4:26 | function bar() {} |
 | lib1/baz.js:1:1:5:1 | <toplevel> | foo | lib1/baz.js:3:10:3:26 | function foo() {} |
-| lib1/foo.js:1:1:3:47 | <toplevel> | foo | lib1/foo.js:3:22:3:47 | functio ... ed() {} |
+| lib1/foo.js:1:1:3:48 | <toplevel> | foo | lib1/foo.js:3:22:3:48 | functio ... d(d) {} |
 | lib1/main.js:1:1:17:30 | <toplevel> | Baz | lib1/main.js:17:22:17:30 | new Baz() |
-| lib1/main.js:1:1:17:30 | <toplevel> | bar | lib1/main.js:5:22:9:1 | class B ... () {}\\n} |
+| lib1/main.js:1:1:17:30 | <toplevel> | bar | lib1/main.js:5:22:9:1 | class B ... c) {}\\n} |
 | lib1/main.js:1:1:17:30 | <toplevel> | foo | lib1/main.js:3:22:3:40 | require("./foo.js") |
 | lib1/reexport/a.js:1:1:3:1 | <toplevel> | reexported | lib1/reexport/a.js:2:17:2:40 | functio ... ed() {} |
 | lib1/reexport/b.js:1:1:6:1 | <toplevel> | base | lib1/reexport/b.js:4:11:4:28 | function base() {} |
-| lib1/reexport/b.js:1:1:6:1 | <toplevel> | reexported | lib1/reexport/a.js:2:17:2:40 | functio ... ed() {} |
\ No newline at end of file
+| lib1/reexport/b.js:1:1:6:1 | <toplevel> | reexported | lib1/reexport/a.js:2:17:2:40 | functio ... ed() {} |

From dcbae8b22bf77d68139e0897e561fb69daacec71 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 15 Jan 2021 19:47:09 +0100
Subject: [PATCH 147/343] Fix code tag.

---
 .../CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
index a739c12ef8b..df0ed151d8f 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp
@@ -5,7 +5,7 @@
 <overview>
 <p>Compiler optimization will exclude the cleaning of private information.
 Using the <code>memset</code> function to clear private data in a variable that has no subsequent use is potentially dangerous, since the compiler can remove the call.
-For some compilers, optimization is also possible when using calls to free memory after the <code>memset</codee> function.</p>
+For some compilers, optimization is also possible when using calls to free memory after the <code>memset</code> function.</p>
 
 <p>It is possible to miss detection of vulnerabilities if used to clear fields of structures or parts of a buffer.</p>
 

From f235a282959b5b6fe53fb1bf0535aba7fc3efe16 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 14 Jan 2021 11:50:20 +0100
Subject: [PATCH 148/343] C# Add relational patterns extraction

---
 .../2020-11-19-Relational-pattern.md          |  3 +
 .../Entities/Expressions/Patterns/Pattern.cs  |  3 +
 .../Expressions/Patterns/RecursivePattern.cs  |  1 -
 .../Expressions/Patterns/RelationalPattern.cs | 29 ++++++++++
 .../Kinds/ExprKind.cs                         |  4 ++
 .../ql/src/semmle/code/csharp/exprs/Expr.qll  | 39 +++++++++++++
 csharp/ql/src/semmlecode.csharp.dbscheme      |  5 ++
 .../library-tests/csharp9/PrintAst.expected   | 57 +++++++++++++++++++
 .../csharp9/RelationalPattern.cs              | 23 ++++++++
 .../csharp9/relationalPattern.expected        |  5 ++
 .../csharp9/relationalPattern.ql              |  4 ++
 csharp/upgrades/to_change/upgrade.properties  |  2 +
 12 files changed, 174 insertions(+), 1 deletion(-)
 create mode 100644 csharp/change-notes/2020-11-19-Relational-pattern.md
 create mode 100644 csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs
 create mode 100644 csharp/ql/test/library-tests/csharp9/RelationalPattern.cs
 create mode 100644 csharp/ql/test/library-tests/csharp9/relationalPattern.expected
 create mode 100644 csharp/ql/test/library-tests/csharp9/relationalPattern.ql
 create mode 100644 csharp/upgrades/to_change/upgrade.properties

diff --git a/csharp/change-notes/2020-11-19-Relational-pattern.md b/csharp/change-notes/2020-11-19-Relational-pattern.md
new file mode 100644
index 00000000000..77179884d12
--- /dev/null
+++ b/csharp/change-notes/2020-11-19-Relational-pattern.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* The `RelationalPatternExpr` and its 4 sub class have been added to support C# 9
+relational `<`, `>`, `<=`, and `>=` patterns.
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
index eef8f28b5fa..d2a8b6fde60 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/Pattern.cs
@@ -45,6 +45,9 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 case RecursivePatternSyntax recPattern:
                     return new RecursivePattern(cx, recPattern, parent, child);
 
+                case RelationalPatternSyntax relPattern:
+                    return new RelationalPattern(cx, relPattern, parent, child);
+
                 case VarPatternSyntax varPattern:
                     switch (varPattern.Designation)
                     {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs
index 997c622c818..c6045f8cb14 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RecursivePattern.cs
@@ -15,7 +15,6 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         /// <param name="syntax">The syntax node of the recursive pattern.</param>
         /// <param name="parent">The parent pattern/expression.</param>
         /// <param name="child">The child index of this pattern.</param>
-        /// <param name="isTopLevel">If this pattern is in the top level of a case/is. In that case, the variable and type access are populated elsewhere.</param>
         public RecursivePattern(Context cx, RecursivePatternSyntax syntax, IExpressionParentEntity parent, int child) :
             base(new ExpressionInfo(cx, Entities.NullType.Create(cx), cx.Create(syntax.GetLocation()), ExprKind.RECURSIVE_PATTERN, parent, child, false, null))
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs
new file mode 100644
index 00000000000..9dce7bf7c52
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs
@@ -0,0 +1,29 @@
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Microsoft.CodeAnalysis.CSharp;
+using Semmle.Extraction.Kinds;
+using Semmle.Extraction.Entities;
+
+namespace Semmle.Extraction.CSharp.Entities.Expressions
+{
+    internal class RelationalPattern : Expression
+    {
+        public RelationalPattern(Context cx, RelationalPatternSyntax syntax, IExpressionParentEntity parent, int child) :
+             base(new ExpressionInfo(cx, NullType.Create(cx), cx.Create(syntax.GetLocation()), GetKind(syntax.OperatorToken), parent, child, false, null))
+        {
+            Expression.Create(cx, syntax.Expression, this, 0);
+        }
+
+        private static ExprKind GetKind(SyntaxToken operatorToken)
+        {
+            return operatorToken.Kind() switch
+            {
+                SyntaxKind.LessThanEqualsToken => ExprKind.LE_PATTERN,
+                SyntaxKind.GreaterThanEqualsToken => ExprKind.GE_PATTERN,
+                SyntaxKind.LessThanToken => ExprKind.LT_PATTERN,
+                SyntaxKind.GreaterThanToken => ExprKind.GT_PATTERN,
+                _ => throw new InternalError(operatorToken.Parent, $"Relation pattern with operator token '{operatorToken.Kind()}' is not supported."),
+            };
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
index 31b69075231..9d99122ce90 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
@@ -116,6 +116,10 @@ namespace Semmle.Extraction.Kinds
         ASSIGN_COALESCE = 119,
         SUPPRESS_NULLABLE_WARNING = 120,
         NAMESPACE_ACCESS = 121,
+        LT_PATTERN = 122,
+        GT_PATTERN = 123,
+        LE_PATTERN = 124,
+        GE_PATTERN = 125,
         NOT_PATTERN = 126
     }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
index 411f75ba40c..e3dc50f52f2 100644
--- a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
+++ b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
@@ -345,6 +345,45 @@ class ConstantPatternExpr extends PatternExpr {
   override string getAPrimaryQlClass() { result = "ConstantPatternExpr" }
 }
 
+/** A relational pattern, for example `>1` in `x is >1`. */
+class RelationalPatternExpr extends PatternExpr, @relational_pattern_expr {
+  /** Gets the name of the operator in this pattern. */
+  string getOperator() { none() }
+
+  /** Gets the expression of this relational pattern. */
+  Expr getExpr() { result = this.getChild(0) }
+
+  override string toString() { result = getOperator() + " ..." }
+}
+
+/** A less-than pattern, for example `< 10` in `x is < 10`. */
+class LTPattern extends RelationalPatternExpr, @lt_pattern_expr {
+  override string getOperator() { result = "<" }
+
+  override string getAPrimaryQlClass() { result = "LTPattern" }
+}
+
+/** A greater-than pattern, for example `> 10` in `x is > 10`. */
+class GTPattern extends RelationalPatternExpr, @gt_pattern_expr {
+  override string getOperator() { result = ">" }
+
+  override string getAPrimaryQlClass() { result = "GTPattern" }
+}
+
+/** A less-than or equals pattern, for example `<= 10` in `x is <= 10`. */
+class LEPattern extends RelationalPatternExpr, @le_pattern_expr {
+  override string getOperator() { result = "<=" }
+
+  override string getAPrimaryQlClass() { result = "LEPattern" }
+}
+
+/** A greater-than or equals pattern, for example `>= 10` in `x is >= 10` */
+class GEPattern extends RelationalPatternExpr, @ge_pattern_expr {
+  override string getOperator() { result = ">=" }
+
+  override string getAPrimaryQlClass() { result = "GEPattern" }
+}
+
 /**
  * A type pattern, for example `string` in `x is string`, `string s` in
  * `x is string s`, or `string _` in `x is string _`.
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index 5f6770a8a17..98e37f65f0a 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -1010,6 +1010,10 @@ case @expr.kind of
 | 120 = @suppress_nullable_warning_expr
 | 121 = @namespace_access_expr
 /* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
 | 126 = @not_pattern_expr
 ;
 
@@ -1017,6 +1021,7 @@ case @expr.kind of
 @case = @case_stmt | @switch_case_expr;
 @pattern_match = @case | @is_expr;
 @unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
 
 @integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
 @real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
diff --git a/csharp/ql/test/library-tests/csharp9/PrintAst.expected b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
index 59dabf7e3ad..c3aabb85092 100644
--- a/csharp/ql/test/library-tests/csharp9/PrintAst.expected
+++ b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
@@ -473,6 +473,63 @@ ParenthesizedPattern.cs:
 #   27|               0: [TypeAccessPatternExpr] access to type String
 #   27|                 0: [TypeMention] string
 #   27|               2: [IntLiteral] 5
+RelationalPattern.cs:
+#    3| [Class] RelationalPattern
+#    5|   5: [Method] M1
+#    5|     -1: [TypeMention] bool
+#-----|     2: (Parameters)
+#    5|       0: [Parameter] c
+#    5|         -1: [TypeMention] char
+#    6|     4: [IsExpr] ... is ...
+#    6|       0: [ParameterAccess] access to parameter c
+#    6|       1: [GEPattern] >= ...
+#    6|         0: [CharLiteral] a
+#    7|   6: [Method] M2
+#    7|     -1: [TypeMention] bool
+#-----|     2: (Parameters)
+#    7|       0: [Parameter] c
+#    7|         -1: [TypeMention] char
+#    8|     4: [IsExpr] ... is ...
+#    8|       0: [ParameterAccess] access to parameter c
+#    8|       1: [GTPattern] > ...
+#    8|         0: [CharLiteral] a
+#    9|   7: [Method] M3
+#    9|     -1: [TypeMention] bool
+#-----|     2: (Parameters)
+#    9|       0: [Parameter] c
+#    9|         -1: [TypeMention] char
+#   10|     4: [IsExpr] ... is ...
+#   10|       0: [ParameterAccess] access to parameter c
+#   10|       1: [LEPattern] <= ...
+#   10|         0: [CharLiteral] a
+#   11|   8: [Method] M4
+#   11|     -1: [TypeMention] bool
+#-----|     2: (Parameters)
+#   11|       0: [Parameter] c
+#   11|         -1: [TypeMention] char
+#   12|     4: [IsExpr] ... is ...
+#   12|       0: [ParameterAccess] access to parameter c
+#   12|       1: [LTPattern] < ...
+#   12|         0: [CharLiteral] a
+#   14|   9: [Method] M5
+#   14|     -1: [TypeMention] string
+#-----|     2: (Parameters)
+#   14|       0: [Parameter] i
+#   14|         -1: [TypeMention] int
+#   15|     4: [BlockStmt] {...}
+#   16|       0: [ReturnStmt] return ...;
+#   16|         0: [SwitchExpr] ... switch { ... }
+#   16|           -1: [ParameterAccess] access to parameter i
+#   18|           0: [SwitchCaseExpr] ... => ...
+#   18|             0: [ConstantPatternExpr,IntLiteral] 1
+#   18|             2: [StringLiteral] "1"
+#   19|           1: [SwitchCaseExpr] ... => ...
+#   19|             0: [GTPattern] > ...
+#   19|               0: [IntLiteral] 1
+#   19|             2: [StringLiteral] ">1"
+#   20|           2: [SwitchCaseExpr] ... => ...
+#   20|             0: [DiscardPatternExpr] _
+#   20|             2: [StringLiteral] "other"
 TargetType.cs:
 #    5| [Class] TargetType
 #    7|   5: [Method] M2
diff --git a/csharp/ql/test/library-tests/csharp9/RelationalPattern.cs b/csharp/ql/test/library-tests/csharp9/RelationalPattern.cs
new file mode 100644
index 00000000000..d21f5044507
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/RelationalPattern.cs
@@ -0,0 +1,23 @@
+using System;
+
+public class RelationalPattern
+{
+    public static bool M1(char c) =>
+        c is >= 'a';
+    public static bool M2(char c) =>
+        c is > 'a';
+    public static bool M3(char c) =>
+        c is <= 'a';
+    public static bool M4(char c) =>
+        c is < 'a';
+
+    public static string M5(int i)
+    {
+        return i switch
+        {
+            1 => "1",
+            >1 => ">1",
+            _ => "other"
+        };
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/csharp9/relationalPattern.expected b/csharp/ql/test/library-tests/csharp9/relationalPattern.expected
new file mode 100644
index 00000000000..43dca825928
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/relationalPattern.expected
@@ -0,0 +1,5 @@
+| RelationalPattern.cs:6:14:6:19 | >= ... | >= |
+| RelationalPattern.cs:8:14:8:18 | > ... | > |
+| RelationalPattern.cs:10:14:10:19 | <= ... | <= |
+| RelationalPattern.cs:12:14:12:18 | < ... | < |
+| RelationalPattern.cs:19:13:19:14 | > ... | > |
diff --git a/csharp/ql/test/library-tests/csharp9/relationalPattern.ql b/csharp/ql/test/library-tests/csharp9/relationalPattern.ql
new file mode 100644
index 00000000000..50618e5bb7d
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/relationalPattern.ql
@@ -0,0 +1,4 @@
+import csharp
+
+from RelationalPatternExpr p
+select p, p.getOperator()
diff --git a/csharp/upgrades/to_change/upgrade.properties b/csharp/upgrades/to_change/upgrade.properties
new file mode 100644
index 00000000000..ff3b5413d2c
--- /dev/null
+++ b/csharp/upgrades/to_change/upgrade.properties
@@ -0,0 +1,2 @@
+description: Add 'relational_pattern_expr' and its four subtypes ('<', '>', '<=', '>=')
+compatibility: backwards

From c0b31cbfe78b2dc3324d213987afc2c286c6b5e8 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 15 Jan 2021 08:25:53 +0100
Subject: [PATCH 149/343] Add new stats file

---
 .../ql/src/semmlecode.csharp.dbscheme.stats   | 5528 ++++++++---------
 1 file changed, 2762 insertions(+), 2766 deletions(-)

diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme.stats b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
index 4f550902e34..7717e6d8d2b 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme.stats
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
@@ -1,7 +1,7 @@
 <dbstats>
   <typesizes><e>
 <k>@compilation</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 <e>
 <k>@diagnostic</k>
@@ -9,7 +9,7 @@
 </e>
 <e>
 <k>@extractor_message</k>
-<v>7617</v>
+<v>7615</v>
 </e>
 <e>
 <k>@externalDefect</k>
@@ -25,7 +25,7 @@
 </e>
 <e>
 <k>@duplication</k>
-<v>22766</v>
+<v>22785</v>
 </e>
 <e>
 <k>@similarity</k>
@@ -33,31 +33,31 @@
 </e>
 <e>
 <k>@location_default</k>
-<v>14072002</v>
+<v>14071972</v>
 </e>
 <e>
 <k>@assembly</k>
-<v>4204</v>
+<v>4207</v>
 </e>
 <e>
 <k>@file</k>
-<v>42524</v>
+<v>42559</v>
 </e>
 <e>
 <k>@folder</k>
-<v>16962</v>
+<v>16977</v>
 </e>
 <e>
 <k>@namespace</k>
-<v>21971</v>
+<v>21990</v>
 </e>
 <e>
 <k>@namespace_declaration</k>
-<v>19786</v>
+<v>19803</v>
 </e>
 <e>
 <k>@using_namespace_directive</k>
-<v>144448</v>
+<v>144569</v>
 </e>
 <e>
 <k>@using_static_directive</k>
@@ -117,23 +117,23 @@
 </e>
 <e>
 <k>@enum_type</k>
-<v>11968</v>
+<v>11978</v>
 </e>
 <e>
 <k>@struct_type</k>
-<v>49732</v>
+<v>49774</v>
 </e>
 <e>
 <k>@class_type</k>
-<v>305512</v>
+<v>305768</v>
 </e>
 <e>
 <k>@interface_type</k>
-<v>178354</v>
+<v>178503</v>
 </e>
 <e>
 <k>@delegate_type</k>
-<v>107713</v>
+<v>107803</v>
 </e>
 <e>
 <k>@null_type</k>
@@ -141,7 +141,7 @@
 </e>
 <e>
 <k>@type_parameter</k>
-<v>202872</v>
+<v>203041</v>
 </e>
 <e>
 <k>@pointer_type</k>
@@ -153,7 +153,7 @@
 </e>
 <e>
 <k>@array_type</k>
-<v>9134</v>
+<v>9142</v>
 </e>
 <e>
 <k>@void_type</k>
@@ -165,7 +165,7 @@
 </e>
 <e>
 <k>@tuple_type</k>
-<v>1785</v>
+<v>1786</v>
 </e>
 <e>
 <k>@uint_ptr_type</k>
@@ -185,19 +185,19 @@
 </e>
 <e>
 <k>@typeref</k>
-<v>235110</v>
+<v>235307</v>
 </e>
 <e>
 <k>@attribute</k>
-<v>750284</v>
+<v>750912</v>
 </e>
 <e>
 <k>@type_mention</k>
-<v>1268966</v>
+<v>1270028</v>
 </e>
 <e>
 <k>@oblivious</k>
-<v>1316</v>
+<v>1317</v>
 </e>
 <e>
 <k>@not_annotated</k>
@@ -209,7 +209,7 @@
 </e>
 <e>
 <k>@type_parameter_constraints</k>
-<v>611610</v>
+<v>612122</v>
 </e>
 <e>
 <k>@modifier</k>
@@ -217,47 +217,47 @@
 </e>
 <e>
 <k>@property</k>
-<v>424101</v>
+<v>424457</v>
 </e>
 <e>
 <k>@indexer</k>
-<v>17065</v>
+<v>17079</v>
 </e>
 <e>
 <k>@getter</k>
-<v>440933</v>
+<v>441302</v>
 </e>
 <e>
 <k>@setter</k>
-<v>127699</v>
+<v>127806</v>
 </e>
 <e>
 <k>@event</k>
-<v>15251</v>
+<v>15263</v>
 </e>
 <e>
 <k>@add_event_accessor</k>
-<v>15251</v>
+<v>15263</v>
 </e>
 <e>
 <k>@remove_event_accessor</k>
-<v>15251</v>
+<v>15263</v>
 </e>
 <e>
 <k>@operator</k>
-<v>12427</v>
+<v>12437</v>
 </e>
 <e>
 <k>@method</k>
-<v>1118142</v>
+<v>1119078</v>
 </e>
 <e>
 <k>@constructor</k>
-<v>278015</v>
+<v>278247</v>
 </e>
 <e>
 <k>@destructor</k>
-<v>443</v>
+<v>444</v>
 </e>
 <e>
 <k>@local_function</k>
@@ -265,15 +265,15 @@
 </e>
 <e>
 <k>@addressable_field</k>
-<v>370969</v>
+<v>371280</v>
 </e>
 <e>
 <k>@constant</k>
-<v>185465</v>
+<v>185620</v>
 </e>
 <e>
 <k>@addressable_local_variable</k>
-<v>162452</v>
+<v>162450</v>
 </e>
 <e>
 <k>@local_constant</k>
@@ -285,63 +285,63 @@
 </e>
 <e>
 <k>@parameter</k>
-<v>2420706</v>
+<v>2422733</v>
 </e>
 <e>
 <k>@block_stmt</k>
-<v>308455</v>
+<v>308713</v>
 </e>
 <e>
 <k>@expr_stmt</k>
-<v>367706</v>
+<v>368014</v>
 </e>
 <e>
 <k>@return_stmt</k>
-<v>96158</v>
+<v>96238</v>
 </e>
 <e>
 <k>@using_block_stmt</k>
-<v>1141</v>
+<v>1142</v>
 </e>
 <e>
 <k>@var_decl_stmt</k>
-<v>147916</v>
+<v>147913</v>
 </e>
 <e>
 <k>@if_stmt</k>
-<v>119127</v>
+<v>119227</v>
 </e>
 <e>
 <k>@switch_stmt</k>
-<v>3048</v>
+<v>3050</v>
 </e>
 <e>
 <k>@while_stmt</k>
-<v>4542</v>
+<v>4546</v>
 </e>
 <e>
 <k>@do_stmt</k>
-<v>1000</v>
+<v>1001</v>
 </e>
 <e>
 <k>@for_stmt</k>
-<v>6964</v>
+<v>6969</v>
 </e>
 <e>
 <k>@foreach_stmt</k>
-<v>5360</v>
+<v>5364</v>
 </e>
 <e>
 <k>@break_stmt</k>
-<v>10909</v>
+<v>10918</v>
 </e>
 <e>
 <k>@continue_stmt</k>
-<v>2186</v>
+<v>2188</v>
 </e>
 <e>
 <k>@goto_stmt</k>
-<v>2699</v>
+<v>2701</v>
 </e>
 <e>
 <k>@goto_case_stmt</k>
@@ -353,7 +353,7 @@
 </e>
 <e>
 <k>@throw_stmt</k>
-<v>74309</v>
+<v>74371</v>
 </e>
 <e>
 <k>@yield_stmt</k>
@@ -361,7 +361,7 @@
 </e>
 <e>
 <k>@try_stmt</k>
-<v>4323</v>
+<v>4327</v>
 </e>
 <e>
 <k>@checked_stmt</k>
@@ -373,7 +373,7 @@
 </e>
 <e>
 <k>@lock_stmt</k>
-<v>1659</v>
+<v>1661</v>
 </e>
 <e>
 <k>@const_decl_stmt</k>
@@ -381,27 +381,27 @@
 </e>
 <e>
 <k>@empty_stmt</k>
-<v>357</v>
+<v>358</v>
 </e>
 <e>
 <k>@unsafe_stmt</k>
-<v>178</v>
+<v>179</v>
 </e>
 <e>
 <k>@fixed_stmt</k>
-<v>1125</v>
+<v>1126</v>
 </e>
 <e>
 <k>@label_stmt</k>
-<v>1008</v>
+<v>1009</v>
 </e>
 <e>
 <k>@catch</k>
-<v>3438</v>
+<v>3441</v>
 </e>
 <e>
 <k>@case_stmt</k>
-<v>22437</v>
+<v>22456</v>
 </e>
 <e>
 <k>@local_function_stmt</k>
@@ -413,15 +413,15 @@
 </e>
 <e>
 <k>@bool_literal_expr</k>
-<v>69501</v>
+<v>69559</v>
 </e>
 <e>
 <k>@int_literal_expr</k>
-<v>754021</v>
+<v>756818</v>
 </e>
 <e>
 <k>@long_literal_expr</k>
-<v>324</v>
+<v>325</v>
 </e>
 <e>
 <k>@double_literal_expr</k>
@@ -429,63 +429,63 @@
 </e>
 <e>
 <k>@string_literal_expr</k>
-<v>412294</v>
+<v>412639</v>
 </e>
 <e>
 <k>@null_literal_expr</k>
-<v>107843</v>
+<v>107934</v>
 </e>
 <e>
 <k>@local_variable_access_expr</k>
-<v>524163</v>
+<v>524154</v>
 </e>
 <e>
 <k>@parameter_access_expr</k>
-<v>357439</v>
+<v>357738</v>
 </e>
 <e>
 <k>@field_access_expr</k>
-<v>460251</v>
+<v>460637</v>
 </e>
 <e>
 <k>@property_access_expr</k>
-<v>359591</v>
+<v>359892</v>
 </e>
 <e>
 <k>@type_access_expr</k>
-<v>347153</v>
+<v>347147</v>
 </e>
 <e>
 <k>@typeof_expr</k>
-<v>30087</v>
+<v>30112</v>
 </e>
 <e>
 <k>@method_invocation_expr</k>
-<v>548159</v>
+<v>548157</v>
 </e>
 <e>
 <k>@cast_expr</k>
-<v>262786</v>
+<v>263006</v>
 </e>
 <e>
 <k>@object_creation_expr</k>
-<v>62852</v>
+<v>62905</v>
 </e>
 <e>
 <k>@array_creation_expr</k>
-<v>179332</v>
+<v>179763</v>
 </e>
 <e>
 <k>@array_init_expr</k>
-<v>178872</v>
+<v>179303</v>
 </e>
 <e>
 <k>@local_var_decl_expr</k>
-<v>163758</v>
+<v>163756</v>
 </e>
 <e>
 <k>@char_literal_expr</k>
-<v>15893</v>
+<v>15906</v>
 </e>
 <e>
 <k>@decimal_literal_expr</k>
@@ -493,7 +493,7 @@
 </e>
 <e>
 <k>@uint_literal_expr</k>
-<v>2366</v>
+<v>2368</v>
 </e>
 <e>
 <k>@ulong_literal_expr</k>
@@ -505,11 +505,11 @@
 </e>
 <e>
 <k>@this_access_expr</k>
-<v>592619</v>
+<v>593115</v>
 </e>
 <e>
 <k>@base_access_expr</k>
-<v>2820</v>
+<v>2823</v>
 </e>
 <e>
 <k>@method_access_expr</k>
@@ -517,23 +517,23 @@
 </e>
 <e>
 <k>@event_access_expr</k>
-<v>430</v>
+<v>431</v>
 </e>
 <e>
 <k>@indexer_access_expr</k>
-<v>30799</v>
+<v>30825</v>
 </e>
 <e>
 <k>@array_access_expr</k>
-<v>19743</v>
+<v>19760</v>
 </e>
 <e>
 <k>@delegate_invocation_expr</k>
-<v>2139</v>
+<v>2141</v>
 </e>
 <e>
 <k>@operator_invocation_expr</k>
-<v>30001</v>
+<v>29999</v>
 </e>
 <e>
 <k>@explicit_delegate_creation_expr</k>
@@ -541,11 +541,11 @@
 </e>
 <e>
 <k>@implicit_delegate_creation_expr</k>
-<v>5116</v>
+<v>5120</v>
 </e>
 <e>
 <k>@default_expr</k>
-<v>6356</v>
+<v>6362</v>
 </e>
 <e>
 <k>@plus_expr</k>
@@ -553,7 +553,7 @@
 </e>
 <e>
 <k>@minus_expr</k>
-<v>7141</v>
+<v>7147</v>
 </e>
 <e>
 <k>@bit_not_expr</k>
@@ -561,19 +561,19 @@
 </e>
 <e>
 <k>@log_not_expr</k>
-<v>26419</v>
+<v>26441</v>
 </e>
 <e>
 <k>@post_incr_expr</k>
-<v>12562</v>
+<v>12573</v>
 </e>
 <e>
 <k>@post_decr_expr</k>
-<v>1738</v>
+<v>1740</v>
 </e>
 <e>
 <k>@pre_incr_expr</k>
-<v>1274</v>
+<v>1275</v>
 </e>
 <e>
 <k>@pre_decr_expr</k>
@@ -581,95 +581,95 @@
 </e>
 <e>
 <k>@mul_expr</k>
-<v>4625</v>
+<v>4629</v>
 </e>
 <e>
 <k>@div_expr</k>
-<v>1818</v>
+<v>1819</v>
 </e>
 <e>
 <k>@rem_expr</k>
-<v>716</v>
+<v>717</v>
 </e>
 <e>
 <k>@add_expr</k>
-<v>27874</v>
+<v>27898</v>
 </e>
 <e>
 <k>@sub_expr</k>
-<v>12839</v>
+<v>12849</v>
 </e>
 <e>
 <k>@lshift_expr</k>
-<v>4048</v>
+<v>4051</v>
 </e>
 <e>
 <k>@rshift_expr</k>
-<v>1764</v>
+<v>1765</v>
 </e>
 <e>
 <k>@lt_expr</k>
-<v>16292</v>
+<v>16306</v>
 </e>
 <e>
 <k>@gt_expr</k>
-<v>9585</v>
+<v>9593</v>
 </e>
 <e>
 <k>@le_expr</k>
-<v>3896</v>
+<v>3899</v>
 </e>
 <e>
 <k>@ge_expr</k>
-<v>6281</v>
+<v>6286</v>
 </e>
 <e>
 <k>@eq_expr</k>
-<v>53904</v>
+<v>53949</v>
 </e>
 <e>
 <k>@ne_expr</k>
-<v>37945</v>
+<v>37977</v>
 </e>
 <e>
 <k>@bit_and_expr</k>
-<v>6328</v>
+<v>6334</v>
 </e>
 <e>
 <k>@bit_xor_expr</k>
-<v>536</v>
+<v>537</v>
 </e>
 <e>
 <k>@bit_or_expr</k>
-<v>14985</v>
+<v>14998</v>
 </e>
 <e>
 <k>@log_and_expr</k>
-<v>20827</v>
+<v>20845</v>
 </e>
 <e>
 <k>@log_or_expr</k>
-<v>14076</v>
+<v>14088</v>
 </e>
 <e>
 <k>@is_expr</k>
-<v>6717</v>
+<v>6722</v>
 </e>
 <e>
 <k>@as_expr</k>
-<v>2758</v>
+<v>2760</v>
 </e>
 <e>
 <k>@null_coalescing_expr</k>
-<v>3682</v>
+<v>3685</v>
 </e>
 <e>
 <k>@conditional_expr</k>
-<v>9153</v>
+<v>9160</v>
 </e>
 <e>
 <k>@simple_assign_expr</k>
-<v>167429</v>
+<v>167569</v>
 </e>
 <e>
 <k>@assign_add_expr</k>
@@ -677,7 +677,7 @@
 </e>
 <e>
 <k>@assign_sub_expr</k>
-<v>1017</v>
+<v>1018</v>
 </e>
 <e>
 <k>@assign_mul_expr</k>
@@ -701,7 +701,7 @@
 </e>
 <e>
 <k>@assign_or_expr</k>
-<v>1392</v>
+<v>1393</v>
 </e>
 <e>
 <k>@assign_lshift_expr</k>
@@ -709,11 +709,11 @@
 </e>
 <e>
 <k>@assign_rshift_expr</k>
-<v>217</v>
+<v>218</v>
 </e>
 <e>
 <k>@object_init_expr</k>
-<v>7696</v>
+<v>7702</v>
 </e>
 <e>
 <k>@collection_init_expr</k>
@@ -725,11 +725,11 @@
 </e>
 <e>
 <k>@unchecked_expr</k>
-<v>1421</v>
+<v>1422</v>
 </e>
 <e>
 <k>@constructor_init_expr</k>
-<v>5819</v>
+<v>5823</v>
 </e>
 <e>
 <k>@add_event_expr</k>
@@ -745,7 +745,7 @@
 </e>
 <e>
 <k>@lambda_expr</k>
-<v>48835</v>
+<v>48876</v>
 </e>
 <e>
 <k>@anonymous_method_expr</k>
@@ -761,31 +761,31 @@
 </e>
 <e>
 <k>@dynamic_member_access_expr</k>
-<v>6852</v>
+<v>6858</v>
 </e>
 <e>
 <k>@pointer_indirection_expr</k>
-<v>4058</v>
+<v>4061</v>
 </e>
 <e>
 <k>@address_of_expr</k>
-<v>1250</v>
+<v>1251</v>
 </e>
 <e>
 <k>@sizeof_expr</k>
-<v>1040</v>
+<v>1041</v>
 </e>
 <e>
 <k>@await_expr</k>
-<v>54824</v>
+<v>54870</v>
 </e>
 <e>
 <k>@nameof_expr</k>
-<v>15930</v>
+<v>15943</v>
 </e>
 <e>
 <k>@interpolated_string_expr</k>
-<v>3045</v>
+<v>3047</v>
 </e>
 <e>
 <k>@unknown_expr</k>
@@ -793,7 +793,7 @@
 </e>
 <e>
 <k>@throw_expr</k>
-<v>1542</v>
+<v>1544</v>
 </e>
 <e>
 <k>@tuple_expr</k>
@@ -825,11 +825,11 @@
 </e>
 <e>
 <k>@recursive_pattern_expr</k>
-<v>1013</v>
+<v>1014</v>
 </e>
 <e>
 <k>@property_pattern_expr</k>
-<v>830</v>
+<v>831</v>
 </e>
 <e>
 <k>@positional_pattern_expr</k>
@@ -837,21 +837,37 @@
 </e>
 <e>
 <k>@switch_case_expr</k>
-<v>4351</v>
+<v>4355</v>
 </e>
 <e>
 <k>@assign_coalesce_expr</k>
-<v>543</v>
+<v>544</v>
 </e>
 <e>
 <k>@suppress_nullable_warning_expr</k>
-<v>14401</v>
+<v>14413</v>
 </e>
 <e>
 <k>@namespace_access_expr</k>
 <v>20</v>
 </e>
 <e>
+<k>@lt_pattern_expr</k>
+<v>1</v>
+</e>
+<e>
+<k>@gt_pattern_expr</k>
+<v>2</v>
+</e>
+<e>
+<k>@le_pattern_expr</k>
+<v>1</v>
+</e>
+<e>
+<k>@ge_pattern_expr</k>
+<v>1</v>
+</e>
+<e>
 <k>@not_pattern_expr</k>
 <v>74</v>
 </e>
@@ -881,19 +897,19 @@
 </e>
 <e>
 <k>@singlelinecomment</k>
-<v>184662</v>
+<v>184816</v>
 </e>
 <e>
 <k>@multilinecomment</k>
-<v>22100</v>
+<v>22119</v>
 </e>
 <e>
 <k>@xmldoccomment</k>
-<v>203648</v>
+<v>203819</v>
 </e>
 <e>
 <k>@commentblock</k>
-<v>144253</v>
+<v>144374</v>
 </e>
 <e>
 <k>@asp_close_tag</k>
@@ -933,7 +949,7 @@
 </e>
 <e>
 <k>@cil_nop</k>
-<v>820008</v>
+<v>820695</v>
 </e>
 <e>
 <k>@cil_break</k>
@@ -941,147 +957,147 @@
 </e>
 <e>
 <k>@cil_ldarg_0</k>
-<v>3975031</v>
+<v>3978359</v>
 </e>
 <e>
 <k>@cil_ldarg_1</k>
-<v>1216598</v>
+<v>1217617</v>
 </e>
 <e>
 <k>@cil_ldarg_2</k>
-<v>443854</v>
+<v>444226</v>
 </e>
 <e>
 <k>@cil_ldarg_3</k>
-<v>209153</v>
+<v>209329</v>
 </e>
 <e>
 <k>@cil_ldloc_0</k>
-<v>929209</v>
+<v>929987</v>
 </e>
 <e>
 <k>@cil_ldloc_1</k>
-<v>493899</v>
+<v>494313</v>
 </e>
 <e>
 <k>@cil_ldloc_2</k>
-<v>288705</v>
+<v>288947</v>
 </e>
 <e>
 <k>@cil_ldloc_3</k>
-<v>192049</v>
+<v>192210</v>
 </e>
 <e>
 <k>@cil_stloc_0</k>
-<v>524938</v>
+<v>525377</v>
 </e>
 <e>
 <k>@cil_stloc_1</k>
-<v>260496</v>
+<v>260714</v>
 </e>
 <e>
 <k>@cil_stloc_2</k>
-<v>198302</v>
+<v>198468</v>
 </e>
 <e>
 <k>@cil_stloc_3</k>
-<v>138293</v>
+<v>138408</v>
 </e>
 <e>
 <k>@cil_ldarg_s</k>
-<v>264505</v>
+<v>264726</v>
 </e>
 <e>
 <k>@cil_ldarga_s</k>
-<v>74767</v>
+<v>74830</v>
 </e>
 <e>
 <k>@cil_starg_s</k>
-<v>37174</v>
+<v>37205</v>
 </e>
 <e>
 <k>@cil_ldloc_s</k>
-<v>686344</v>
+<v>686918</v>
 </e>
 <e>
 <k>@cil_ldloca_s</k>
-<v>629222</v>
+<v>629749</v>
 </e>
 <e>
 <k>@cil_stloc_s</k>
-<v>480828</v>
+<v>481231</v>
 </e>
 <e>
 <k>@cil_ldnull</k>
-<v>603700</v>
+<v>604205</v>
 </e>
 <e>
 <k>@cil_ldc_i4_m1</k>
-<v>126197</v>
+<v>126303</v>
 </e>
 <e>
 <k>@cil_ldc_i4_0</k>
-<v>625564</v>
+<v>626088</v>
 </e>
 <e>
 <k>@cil_ldc_i4_1</k>
-<v>494640</v>
+<v>495055</v>
 </e>
 <e>
 <k>@cil_ldc_i4_2</k>
-<v>121027</v>
+<v>121129</v>
 </e>
 <e>
 <k>@cil_ldc_i4_3</k>
-<v>64149</v>
+<v>64203</v>
 </e>
 <e>
 <k>@cil_ldc_i4_4</k>
-<v>58877</v>
+<v>58926</v>
 </e>
 <e>
 <k>@cil_ldc_i4_5</k>
-<v>38681</v>
+<v>38713</v>
 </e>
 <e>
 <k>@cil_ldc_i4_6</k>
-<v>23264</v>
+<v>23283</v>
 </e>
 <e>
 <k>@cil_ldc_i4_7</k>
-<v>20752</v>
+<v>20769</v>
 </e>
 <e>
 <k>@cil_ldc_i4_8</k>
-<v>33481</v>
+<v>33510</v>
 </e>
 <e>
 <k>@cil_ldc_i4_s</k>
-<v>423321</v>
+<v>423676</v>
 </e>
 <e>
 <k>@cil_ldc_i4</k>
-<v>510838</v>
+<v>511265</v>
 </e>
 <e>
 <k>@cil_ldc_i8</k>
-<v>4886</v>
+<v>4891</v>
 </e>
 <e>
 <k>@cil_ldc_r4</k>
-<v>10261</v>
+<v>10270</v>
 </e>
 <e>
 <k>@cil_ldc_r8</k>
-<v>10329</v>
+<v>10338</v>
 </e>
 <e>
 <k>@cil_dup</k>
-<v>842166</v>
+<v>842871</v>
 </e>
 <e>
 <k>@cil_pop</k>
-<v>256457</v>
+<v>256672</v>
 </e>
 <e>
 <k>@cil_jmp</k>
@@ -1089,7 +1105,7 @@
 </e>
 <e>
 <k>@cil_call</k>
-<v>2741733</v>
+<v>2744029</v>
 </e>
 <e>
 <k>@cil_calli</k>
@@ -1097,95 +1113,95 @@
 </e>
 <e>
 <k>@cil_ret</k>
-<v>1786621</v>
+<v>1788117</v>
 </e>
 <e>
 <k>@cil_br_s</k>
-<v>345852</v>
+<v>346141</v>
 </e>
 <e>
 <k>@cil_brfalse_s</k>
-<v>466011</v>
+<v>466401</v>
 </e>
 <e>
 <k>@cil_brtrue_s</k>
-<v>430749</v>
+<v>431110</v>
 </e>
 <e>
 <k>@cil_beq_s</k>
-<v>82268</v>
+<v>82337</v>
 </e>
 <e>
 <k>@cil_bge_s</k>
-<v>34930</v>
+<v>34959</v>
 </e>
 <e>
 <k>@cil_bgt_s</k>
-<v>16499</v>
+<v>16513</v>
 </e>
 <e>
 <k>@cil_ble_s</k>
-<v>29204</v>
+<v>29229</v>
 </e>
 <e>
 <k>@cil_blt_s</k>
-<v>60940</v>
+<v>60991</v>
 </e>
 <e>
 <k>@cil_bne_un_s</k>
-<v>102669</v>
+<v>102755</v>
 </e>
 <e>
 <k>@cil_bge_un_s</k>
-<v>2184</v>
+<v>2186</v>
 </e>
 <e>
 <k>@cil_bgt_un_s</k>
-<v>8735</v>
+<v>8742</v>
 </e>
 <e>
 <k>@cil_ble_un_s</k>
-<v>6120</v>
+<v>6126</v>
 </e>
 <e>
 <k>@cil_blt_un_s</k>
-<v>1468</v>
+<v>1469</v>
 </e>
 <e>
 <k>@cil_br</k>
-<v>96168</v>
+<v>96249</v>
 </e>
 <e>
 <k>@cil_brfalse</k>
-<v>32399</v>
+<v>32426</v>
 </e>
 <e>
 <k>@cil_brtrue</k>
-<v>27336</v>
+<v>27359</v>
 </e>
 <e>
 <k>@cil_beq</k>
-<v>21513</v>
+<v>21531</v>
 </e>
 <e>
 <k>@cil_bge</k>
-<v>1390</v>
+<v>1391</v>
 </e>
 <e>
 <k>@cil_bgt</k>
-<v>1463</v>
+<v>1464</v>
 </e>
 <e>
 <k>@cil_ble</k>
-<v>4643</v>
+<v>4646</v>
 </e>
 <e>
 <k>@cil_blt</k>
-<v>7935</v>
+<v>7941</v>
 </e>
 <e>
 <k>@cil_bne_un</k>
-<v>7237</v>
+<v>7243</v>
 </e>
 <e>
 <k>@cil_bge_un</k>
@@ -1193,11 +1209,11 @@
 </e>
 <e>
 <k>@cil_bgt_un</k>
-<v>692</v>
+<v>693</v>
 </e>
 <e>
 <k>@cil_ble_un</k>
-<v>1102</v>
+<v>1103</v>
 </e>
 <e>
 <k>@cil_blt_un</k>
@@ -1205,7 +1221,7 @@
 </e>
 <e>
 <k>@cil_switch</k>
-<v>23883</v>
+<v>23903</v>
 </e>
 <e>
 <k>@cil_ldind_i1</k>
@@ -1213,7 +1229,7 @@
 </e>
 <e>
 <k>@cil_ldind_u1</k>
-<v>5511</v>
+<v>5515</v>
 </e>
 <e>
 <k>@cil_ldind_i2</k>
@@ -1221,19 +1237,19 @@
 </e>
 <e>
 <k>@cil_ldind_u2</k>
-<v>2444</v>
+<v>2446</v>
 </e>
 <e>
 <k>@cil_ldind_i4</k>
-<v>9778</v>
+<v>9786</v>
 </e>
 <e>
 <k>@cil_ldind_u4</k>
-<v>1482</v>
+<v>1483</v>
 </e>
 <e>
 <k>@cil_ldind_i8</k>
-<v>1970</v>
+<v>1972</v>
 </e>
 <e>
 <k>@cil_ldind_i</k>
@@ -1249,27 +1265,27 @@
 </e>
 <e>
 <k>@cil_ldind_ref</k>
-<v>6657</v>
+<v>6662</v>
 </e>
 <e>
 <k>@cil_stind_ref</k>
-<v>16938</v>
+<v>16952</v>
 </e>
 <e>
 <k>@cil_stind_i1</k>
-<v>8525</v>
+<v>8532</v>
 </e>
 <e>
 <k>@cil_stind_i2</k>
-<v>1376</v>
+<v>1377</v>
 </e>
 <e>
 <k>@cil_stind_i4</k>
-<v>10364</v>
+<v>10372</v>
 </e>
 <e>
 <k>@cil_stind_i8</k>
-<v>2345</v>
+<v>2347</v>
 </e>
 <e>
 <k>@cil_stind_r4</k>
@@ -1281,19 +1297,19 @@
 </e>
 <e>
 <k>@cil_add</k>
-<v>224014</v>
+<v>224202</v>
 </e>
 <e>
 <k>@cil_sub</k>
-<v>85297</v>
+<v>85368</v>
 </e>
 <e>
 <k>@cil_mul</k>
-<v>29955</v>
+<v>29980</v>
 </e>
 <e>
 <k>@cil_div</k>
-<v>9125</v>
+<v>9132</v>
 </e>
 <e>
 <k>@cil_div_un</k>
@@ -1301,7 +1317,7 @@
 </e>
 <e>
 <k>@cil_rem</k>
-<v>3409</v>
+<v>3412</v>
 </e>
 <e>
 <k>@cil_rem_un</k>
@@ -1309,71 +1325,71 @@
 </e>
 <e>
 <k>@cil_and</k>
-<v>59345</v>
+<v>59395</v>
 </e>
 <e>
 <k>@cil_or</k>
-<v>22152</v>
+<v>22170</v>
 </e>
 <e>
 <k>@cil_xor</k>
-<v>22718</v>
+<v>22737</v>
 </e>
 <e>
 <k>@cil_shl</k>
-<v>18972</v>
+<v>18988</v>
 </e>
 <e>
 <k>@cil_shr</k>
-<v>9178</v>
+<v>9186</v>
 </e>
 <e>
 <k>@cil_shr_un</k>
-<v>26112</v>
+<v>26134</v>
 </e>
 <e>
 <k>@cil_neg</k>
-<v>2336</v>
+<v>2338</v>
 </e>
 <e>
 <k>@cil_not</k>
-<v>1458</v>
+<v>1459</v>
 </e>
 <e>
 <k>@cil_conv_i1</k>
-<v>1385</v>
+<v>1386</v>
 </e>
 <e>
 <k>@cil_conv_i2</k>
-<v>1448</v>
+<v>1449</v>
 </e>
 <e>
 <k>@cil_conv_i4</k>
-<v>59789</v>
+<v>59839</v>
 </e>
 <e>
 <k>@cil_conv_i8</k>
-<v>50298</v>
+<v>50340</v>
 </e>
 <e>
 <k>@cil_conv_r4</k>
-<v>2467</v>
+<v>2469</v>
 </e>
 <e>
 <k>@cil_conv_r8</k>
-<v>5282</v>
+<v>5286</v>
 </e>
 <e>
 <k>@cil_conv_u4</k>
-<v>7832</v>
+<v>7839</v>
 </e>
 <e>
 <k>@cil_conv_u8</k>
-<v>19547</v>
+<v>19564</v>
 </e>
 <e>
 <k>@cil_callvirt</k>
-<v>2050775</v>
+<v>2052492</v>
 </e>
 <e>
 <k>@cil_cpobj</k>
@@ -1381,23 +1397,23 @@
 </e>
 <e>
 <k>@cil_ldobj</k>
-<v>12656</v>
+<v>12666</v>
 </e>
 <e>
 <k>@cil_ldstr</k>
-<v>926912</v>
+<v>927688</v>
 </e>
 <e>
 <k>@cil_newobj</k>
-<v>657188</v>
+<v>657738</v>
 </e>
 <e>
 <k>@cil_castclass</k>
-<v>97085</v>
+<v>97166</v>
 </e>
 <e>
 <k>@cil_isinst</k>
-<v>56458</v>
+<v>56505</v>
 </e>
 <e>
 <k>@cil_conv_r_un</k>
@@ -1409,35 +1425,35 @@
 </e>
 <e>
 <k>@cil_throw</k>
-<v>381294</v>
+<v>381613</v>
 </e>
 <e>
 <k>@cil_ldfld</k>
-<v>1676996</v>
+<v>1678400</v>
 </e>
 <e>
 <k>@cil_ldflda</k>
-<v>300757</v>
+<v>301009</v>
 </e>
 <e>
 <k>@cil_stfld</k>
-<v>1073286</v>
+<v>1074185</v>
 </e>
 <e>
 <k>@cil_ldsfld</k>
-<v>407412</v>
+<v>407753</v>
 </e>
 <e>
 <k>@cil_ldsflda</k>
-<v>2531</v>
+<v>2533</v>
 </e>
 <e>
 <k>@cil_stsfld</k>
-<v>130943</v>
+<v>131052</v>
 </e>
 <e>
 <k>@cil_stobj</k>
-<v>7023</v>
+<v>7029</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1_un</k>
@@ -1481,19 +1497,19 @@
 </e>
 <e>
 <k>@cil_box</k>
-<v>79854</v>
+<v>79921</v>
 </e>
 <e>
 <k>@cil_newarr</k>
-<v>112131</v>
+<v>112225</v>
 </e>
 <e>
 <k>@cil_ldlen</k>
-<v>55341</v>
+<v>55387</v>
 </e>
 <e>
 <k>@cil_ldelema</k>
-<v>9871</v>
+<v>9879</v>
 </e>
 <e>
 <k>@cil_ldelem_i1</k>
@@ -1501,7 +1517,7 @@
 </e>
 <e>
 <k>@cil_ldelem_u1</k>
-<v>15577</v>
+<v>15590</v>
 </e>
 <e>
 <k>@cil_ldelem_i2</k>
@@ -1509,19 +1525,19 @@
 </e>
 <e>
 <k>@cil_ldelem_u2</k>
-<v>6091</v>
+<v>6096</v>
 </e>
 <e>
 <k>@cil_ldelem_i4</k>
-<v>17587</v>
+<v>17601</v>
 </e>
 <e>
 <k>@cil_ldelem_u4</k>
-<v>19118</v>
+<v>19134</v>
 </e>
 <e>
 <k>@cil_ldelem_i8</k>
-<v>11924</v>
+<v>11934</v>
 </e>
 <e>
 <k>@cil_ldelem_i</k>
@@ -1529,7 +1545,7 @@
 </e>
 <e>
 <k>@cil_ldelem_r4</k>
-<v>282</v>
+<v>283</v>
 </e>
 <e>
 <k>@cil_ldelem_r8</k>
@@ -1537,7 +1553,7 @@
 </e>
 <e>
 <k>@cil_ldelem_ref</k>
-<v>30706</v>
+<v>30732</v>
 </e>
 <e>
 <k>@cil_stelem_i</k>
@@ -1545,43 +1561,43 @@
 </e>
 <e>
 <k>@cil_stelem_i1</k>
-<v>8793</v>
+<v>8800</v>
 </e>
 <e>
 <k>@cil_stelem_i2</k>
-<v>8988</v>
+<v>8996</v>
 </e>
 <e>
 <k>@cil_stelem_i4</k>
-<v>22830</v>
+<v>22849</v>
 </e>
 <e>
 <k>@cil_stelem_i8</k>
-<v>9427</v>
+<v>9435</v>
 </e>
 <e>
 <k>@cil_stelem_r4</k>
-<v>199</v>
+<v>200</v>
 </e>
 <e>
 <k>@cil_stelem_r8</k>
-<v>477</v>
+<v>478</v>
 </e>
 <e>
 <k>@cil_stelem_ref</k>
-<v>363015</v>
+<v>363318</v>
 </e>
 <e>
 <k>@cil_ldelem</k>
-<v>2277</v>
+<v>2279</v>
 </e>
 <e>
 <k>@cil_stelem</k>
-<v>53629</v>
+<v>53674</v>
 </e>
 <e>
 <k>@cil_unbox_any</k>
-<v>14392</v>
+<v>14404</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1</k>
@@ -1629,19 +1645,19 @@
 </e>
 <e>
 <k>@cil_ldtoken</k>
-<v>71329</v>
+<v>71388</v>
 </e>
 <e>
 <k>@cil_conv_u2</k>
-<v>4340</v>
+<v>4344</v>
 </e>
 <e>
 <k>@cil_conv_u1</k>
-<v>11261</v>
+<v>11270</v>
 </e>
 <e>
 <k>@cil_conv_i</k>
-<v>3662</v>
+<v>3665</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i</k>
@@ -1653,7 +1669,7 @@
 </e>
 <e>
 <k>@cil_add_ovf</k>
-<v>1731</v>
+<v>1732</v>
 </e>
 <e>
 <k>@cil_add_ovf_un</k>
@@ -1661,7 +1677,7 @@
 </e>
 <e>
 <k>@cil_mul_ovf</k>
-<v>443</v>
+<v>444</v>
 </e>
 <e>
 <k>@cil_mul_ovf_un</k>
@@ -1677,15 +1693,15 @@
 </e>
 <e>
 <k>@cil_endfinally</k>
-<v>56912</v>
+<v>56959</v>
 </e>
 <e>
 <k>@cil_leave</k>
-<v>66876</v>
+<v>66932</v>
 </e>
 <e>
 <k>@cil_leave_s</k>
-<v>149374</v>
+<v>149499</v>
 </e>
 <e>
 <k>@cil_stind_i</k>
@@ -1693,7 +1709,7 @@
 </e>
 <e>
 <k>@cil_conv_u</k>
-<v>5809</v>
+<v>5814</v>
 </e>
 <e>
 <k>@cil_arglist</k>
@@ -1701,27 +1717,27 @@
 </e>
 <e>
 <k>@cil_ceq</k>
-<v>96985</v>
+<v>97066</v>
 </e>
 <e>
 <k>@cil_cgt</k>
-<v>11568</v>
+<v>11578</v>
 </e>
 <e>
 <k>@cil_cgt_un</k>
-<v>36714</v>
+<v>36744</v>
 </e>
 <e>
 <k>@cil_clt</k>
-<v>19524</v>
+<v>19540</v>
 </e>
 <e>
 <k>@cil_clt_un</k>
-<v>1314</v>
+<v>1315</v>
 </e>
 <e>
 <k>@cil_ldftn</k>
-<v>79947</v>
+<v>80014</v>
 </e>
 <e>
 <k>@cil_ldvirtftn</k>
@@ -1753,11 +1769,11 @@
 </e>
 <e>
 <k>@cil_localloc</k>
-<v>978</v>
+<v>979</v>
 </e>
 <e>
 <k>@cil_endfilter</k>
-<v>809</v>
+<v>810</v>
 </e>
 <e>
 <k>@cil_unaligned</k>
@@ -1765,7 +1781,7 @@
 </e>
 <e>
 <k>@cil_volatile</k>
-<v>8539</v>
+<v>8547</v>
 </e>
 <e>
 <k>@cil_tail</k>
@@ -1773,11 +1789,11 @@
 </e>
 <e>
 <k>@cil_initobj</k>
-<v>101796</v>
+<v>101882</v>
 </e>
 <e>
 <k>@cil_constrained</k>
-<v>25317</v>
+<v>25338</v>
 </e>
 <e>
 <k>@cil_cpblk</k>
@@ -1789,11 +1805,11 @@
 </e>
 <e>
 <k>@cil_rethrow</k>
-<v>3770</v>
+<v>3773</v>
 </e>
 <e>
 <k>@cil_sizeof</k>
-<v>1731</v>
+<v>1732</v>
 </e>
 <e>
 <k>@cil_refanytype</k>
@@ -1805,15 +1821,15 @@
 </e>
 <e>
 <k>@cil_valueorreftype</k>
-<v>596018</v>
+<v>596517</v>
 </e>
 <e>
 <k>@cil_typeparameter</k>
-<v>185002</v>
+<v>185156</v>
 </e>
 <e>
 <k>@cil_array_type</k>
-<v>14187</v>
+<v>14199</v>
 </e>
 <e>
 <k>@cil_pointer_type</k>
@@ -1821,60 +1837,60 @@
 </e>
 <e>
 <k>@cil_method</k>
-<v>2314861</v>
+<v>2316799</v>
 </e>
 <e>
 <k>@cil_method_implementation</k>
-<v>1728026</v>
+<v>1729473</v>
 </e>
 <e>
 <k>@cil_field</k>
-<v>1009668</v>
+<v>1010513</v>
 </e>
 <e>
 <k>@cil_parameter</k>
-<v>4552575</v>
+<v>4556386</v>
 </e>
 <e>
 <k>@cil_property</k>
-<v>380407</v>
+<v>380725</v>
 </e>
 <e>
 <k>@cil_event</k>
-<v>20869</v>
+<v>20887</v>
 </e>
 <e>
 <k>@cil_local_variable</k>
-<v>1152156</v>
+<v>1153120</v>
 </e>
 <e>
 <k>@cil_catch_handler</k>
-<v>43865</v>
+<v>43902</v>
 </e>
 <e>
 <k>@cil_filter_handler</k>
-<v>809</v>
+<v>810</v>
 </e>
 <e>
 <k>@cil_finally_handler</k>
-<v>55439</v>
+<v>55485</v>
 </e>
 <e>
 <k>@cil_fault_handler</k>
-<v>1472</v>
+<v>1474</v>
 </e>
 <e>
 <k>@cil_attribute</k>
-<v>328703</v>
+<v>328979</v>
 </e>
 </typesizes>
   <stats><relation>
 <name>compilations</name>
-<cardinality>1097</cardinality>
+<cardinality>1098</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 <e>
 <k>cwd</k>
@@ -1892,7 +1908,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -1923,11 +1939,11 @@
 </relation>
 <relation>
 <name>compilation_args</name>
-<cardinality>4896</cardinality>
+<cardinality>4627</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 <e>
 <k>num</k>
@@ -1935,7 +1951,7 @@
 </e>
 <e>
 <k>arg</k>
-<v>1121</v>
+<v>1122</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1949,12 +1965,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>590</v>
+<v>863</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>507</v>
+<v>234</v>
 </b>
 </bs>
 </hist>
@@ -1970,12 +1986,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>590</v>
+<v>863</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>507</v>
+<v>234</v>
 </b>
 </bs>
 </hist>
@@ -1989,8 +2005,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>104</a>
-<b>105</b>
+<a>48</a>
+<b>49</b>
 <v>4</v>
 </b>
 <b>
@@ -2015,13 +2031,13 @@
 <v>14</v>
 </b>
 <b>
-<a>104</a>
-<b>105</b>
+<a>48</a>
+<b>49</b>
 <v>4</v>
 </b>
 <b>
-<a>122</a>
-<b>123</b>
+<a>178</a>
+<b>179</b>
 <v>4</v>
 </b>
 </bs>
@@ -2038,10 +2054,10 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 <b>
-<a>104</a>
+<a>48</a>
 <b>226</b>
 <v>24</v>
 </b>
@@ -2074,11 +2090,11 @@
 </relation>
 <relation>
 <name>compilation_compiling_files</name>
-<cardinality>22615</cardinality>
+<cardinality>22634</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 <e>
 <k>num</k>
@@ -2086,7 +2102,7 @@
 </e>
 <e>
 <k>file</k>
-<v>22610</v>
+<v>22629</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2424,7 +2440,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22605</v>
+<v>22624</v>
 </b>
 <b>
 <a>2</a>
@@ -2445,7 +2461,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22605</v>
+<v>22624</v>
 </b>
 <b>
 <a>2</a>
@@ -2460,19 +2476,19 @@
 </relation>
 <relation>
 <name>compilation_referencing_files</name>
-<cardinality>359747</cardinality>
+<cardinality>360048</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 <e>
 <k>num</k>
-<v>2745</v>
+<v>2748</v>
 </e>
 <e>
 <k>file</k>
-<v>3418</v>
+<v>3421</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2648,7 +2664,7 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>697</v>
+<v>698</v>
 </b>
 <b>
 <a>8</a>
@@ -2658,12 +2674,12 @@
 <b>
 <a>118</a>
 <b>214</b>
-<v>204</v>
+<v>205</v>
 </b>
 <b>
 <a>222</a>
 <b>223</b>
-<v>638</v>
+<v>639</v>
 </b>
 <b>
 <a>224</a>
@@ -2693,63 +2709,58 @@
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>9</v>
-</b>
-<b>
-<a>5</a>
 <b>6</b>
-<v>575</v>
+<v>39</v>
 </b>
 <b>
 <a>6</a>
-<b>16</b>
-<v>229</v>
+<b>7</b>
+<v>629</v>
 </b>
 <b>
-<a>16</a>
-<b>22</b>
-<v>219</v>
+<a>7</a>
+<b>20</b>
+<v>205</v>
 </b>
 <b>
-<a>22</a>
+<a>20</a>
+<b>24</b>
+<v>209</v>
+</b>
+<b>
+<a>24</a>
 <b>30</b>
-<v>243</v>
+<v>205</v>
 </b>
 <b>
 <a>30</a>
 <b>34</b>
-<v>219</v>
+<v>253</v>
 </b>
 <b>
 <a>34</a>
-<b>44</b>
-<v>209</v>
-</b>
-<b>
-<a>44</a>
-<b>56</b>
+<b>46</b>
 <v>214</v>
 </b>
 <b>
-<a>56</a>
-<b>62</b>
-<v>204</v>
+<a>46</a>
+<b>57</b>
+<v>205</v>
 </b>
 <b>
-<a>62</a>
-<b>64</b>
-<v>175</v>
+<a>57</a>
+<b>60</b>
+<v>180</v>
 </b>
 <b>
-<a>64</a>
-<b>68</b>
-<v>209</v>
+<a>60</a>
+<b>63</b>
+<v>239</v>
 </b>
 <b>
-<a>68</a>
-<b>70</b>
-<v>14</v>
+<a>63</a>
+<b>69</b>
+<v>146</v>
 </b>
 </bs>
 </hist>
@@ -2765,7 +2776,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>526</v>
+<v>527</v>
 </b>
 <b>
 <a>2</a>
@@ -2800,7 +2811,7 @@
 <b>
 <a>124</a>
 <b>214</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>220</a>
@@ -2810,12 +2821,12 @@
 <b>
 <a>222</a>
 <b>223</b>
-<v>482</v>
+<v>483</v>
 </b>
 <b>
 <a>224</a>
 <b>225</b>
-<v>716</v>
+<v>717</v>
 </b>
 </bs>
 </hist>
@@ -2831,62 +2842,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>560</v>
+<v>571</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>302</v>
+<v>253</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>199</v>
+<v>336</v>
 </b>
 <b>
 <a>6</a>
-<b>7</b>
-<v>258</v>
-</b>
-<b>
-<a>7</a>
-<b>11</b>
-<v>273</v>
-</b>
-<b>
-<a>11</a>
-<b>20</b>
-<v>312</v>
-</b>
-<b>
-<a>20</a>
-<b>25</b>
-<v>258</v>
-</b>
-<b>
-<a>25</a>
-<b>30</b>
+<b>8</b>
 <v>297</v>
 </b>
 <b>
-<a>30</a>
-<b>60</b>
-<v>282</v>
+<a>8</a>
+<b>14</b>
+<v>258</v>
 </b>
 <b>
-<a>60</a>
-<b>63</b>
+<a>14</a>
+<b>21</b>
+<v>297</v>
+</b>
+<b>
+<a>21</a>
+<b>26</b>
+<v>287</v>
+</b>
+<b>
+<a>26</a>
+<b>35</b>
+<v>263</v>
+</b>
+<b>
+<a>35</a>
+<b>61</b>
+<v>244</v>
+</b>
+<b>
+<a>61</a>
+<b>64</b>
+<v>258</v>
+</b>
+<b>
+<a>64</a>
+<b>68</b>
 <v>278</v>
 </b>
 <b>
-<a>63</a>
-<b>66</b>
-<v>268</v>
-</b>
-<b>
-<a>66</a>
-<b>74</b>
-<v>126</v>
+<a>68</a>
+<b>72</b>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -2896,11 +2907,11 @@
 </relation>
 <relation>
 <name>compilation_time</name>
-<cardinality>7681</cardinality>
+<cardinality>7688</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 <e>
 <k>num</k>
@@ -2912,7 +2923,7 @@
 </e>
 <e>
 <k>seconds</k>
-<v>5662</v>
+<v>5803</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2926,7 +2937,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -2942,7 +2953,7 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -2958,7 +2969,7 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -3004,8 +3015,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1161</a>
-<b>1162</b>
+<a>1189</a>
+<b>1190</b>
 <v>4</v>
 </b>
 </bs>
@@ -3052,23 +3063,18 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>165</a>
-<b>166</b>
+<a>177</a>
+<b>178</b>
+<v>9</v>
+</b>
+<b>
+<a>189</a>
+<b>190</b>
 <v>4</v>
 </b>
 <b>
-<a>169</a>
-<b>170</b>
-<v>4</v>
-</b>
-<b>
-<a>174</a>
-<b>175</b>
-<v>4</v>
-</b>
-<b>
-<a>178</a>
-<b>179</b>
+<a>190</a>
+<b>191</b>
 <v>4</v>
 </b>
 <b>
@@ -3090,22 +3096,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4506</v>
+<v>4539</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>599</v>
+<v>815</v>
 </b>
 <b>
 <a>3</a>
-<b>5</b>
-<v>507</v>
-</b>
-<b>
-<a>5</a>
-<b>7</b>
-<v>48</v>
+<b>6</b>
+<v>449</v>
 </b>
 </bs>
 </hist>
@@ -3121,7 +3122,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5662</v>
+<v>5803</v>
 </b>
 </bs>
 </hist>
@@ -3137,16 +3138,16 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4818</v>
+<v>4871</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>712</v>
+<v>800</v>
 </b>
 <b>
 <a>3</a>
-<b>4</b>
+<b>5</b>
 <v>131</v>
 </b>
 </bs>
@@ -4390,11 +4391,11 @@
 </relation>
 <relation>
 <name>extractor_messages</name>
-<cardinality>7617</cardinality>
+<cardinality>7615</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>7617</v>
+<v>7615</v>
 </e>
 <e>
 <k>severity</k>
@@ -4410,15 +4411,15 @@
 </e>
 <e>
 <k>entity</k>
-<v>5295</v>
+<v>5293</v>
 </e>
 <e>
 <k>location</k>
-<v>6703</v>
+<v>6701</v>
 </e>
 <e>
 <k>stack_trace</k>
-<v>306</v>
+<v>199</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -4432,7 +4433,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7617</v>
+<v>7615</v>
 </b>
 </bs>
 </hist>
@@ -4448,7 +4449,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7617</v>
+<v>7615</v>
 </b>
 </bs>
 </hist>
@@ -4464,7 +4465,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7617</v>
+<v>7615</v>
 </b>
 </bs>
 </hist>
@@ -4480,7 +4481,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7617</v>
+<v>7615</v>
 </b>
 </bs>
 </hist>
@@ -4496,7 +4497,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7617</v>
+<v>7615</v>
 </b>
 </bs>
 </hist>
@@ -4512,7 +4513,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7617</v>
+<v>7615</v>
 </b>
 </bs>
 </hist>
@@ -4536,8 +4537,8 @@
 <v>1</v>
 </b>
 <b>
-<a>7588</a>
-<b>7589</b>
+<a>7586</a>
+<b>7587</b>
 <v>1</v>
 </b>
 </bs>
@@ -4599,8 +4600,8 @@
 <v>1</v>
 </b>
 <b>
-<a>5289</a>
-<b>5290</b>
+<a>5287</a>
+<b>5288</b>
 <v>1</v>
 </b>
 </bs>
@@ -4625,8 +4626,8 @@
 <v>1</v>
 </b>
 <b>
-<a>6691</a>
-<b>6692</b>
+<a>6689</a>
+<b>6690</b>
 <v>1</v>
 </b>
 </bs>
@@ -4646,8 +4647,8 @@
 <v>2</v>
 </b>
 <b>
-<a>305</a>
-<b>306</b>
+<a>198</a>
+<b>199</b>
 <v>1</v>
 </b>
 </bs>
@@ -4662,8 +4663,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>7617</a>
-<b>7618</b>
+<a>7615</a>
+<b>7616</b>
 <v>1</v>
 </b>
 </bs>
@@ -4710,8 +4711,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>5295</a>
-<b>5296</b>
+<a>5293</a>
+<b>5294</b>
 <v>1</v>
 </b>
 </bs>
@@ -4726,8 +4727,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>6703</a>
-<b>6704</b>
+<a>6701</a>
+<b>6702</b>
 <v>1</v>
 </b>
 </bs>
@@ -4742,8 +4743,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>306</a>
-<b>307</b>
+<a>199</a>
+<b>200</b>
 <v>1</v>
 </b>
 </bs>
@@ -4778,8 +4779,8 @@
 <v>1</v>
 </b>
 <b>
-<a>22</a>
-<b>23</b>
+<a>20</a>
+<b>21</b>
 <v>1</v>
 </b>
 <b>
@@ -4881,8 +4882,8 @@
 <v>1</v>
 </b>
 <b>
-<a>22</a>
-<b>23</b>
+<a>20</a>
+<b>21</b>
 <v>1</v>
 </b>
 <b>
@@ -4942,8 +4943,8 @@
 <v>1</v>
 </b>
 <b>
-<a>22</a>
-<b>23</b>
+<a>20</a>
+<b>21</b>
 <v>1</v>
 </b>
 <b>
@@ -4993,8 +4994,8 @@
 <v>1</v>
 </b>
 <b>
-<a>4</a>
-<b>5</b>
+<a>3</a>
+<b>4</b>
 <v>2</v>
 </b>
 <b>
@@ -5003,18 +5004,23 @@
 <v>1</v>
 </b>
 <b>
-<a>11</a>
-<b>12</b>
-<v>2</v>
-</b>
-<b>
-<a>70</a>
-<b>71</b>
+<a>7</a>
+<b>8</b>
 <v>1</v>
 </b>
 <b>
-<a>196</a>
-<b>197</b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>52</a>
+<b>53</b>
+<v>1</v>
+</b>
+<b>
+<a>114</a>
+<b>115</b>
 <v>1</v>
 </b>
 </bs>
@@ -5031,7 +5037,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4214</v>
+<v>4212</v>
 </b>
 <b>
 <a>2</a>
@@ -5057,7 +5063,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5295</v>
+<v>5293</v>
 </b>
 </bs>
 </hist>
@@ -5073,7 +5079,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5295</v>
+<v>5293</v>
 </b>
 </bs>
 </hist>
@@ -5089,7 +5095,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5286</v>
+<v>5284</v>
 </b>
 <b>
 <a>2</a>
@@ -5110,7 +5116,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4611</v>
+<v>4609</v>
 </b>
 <b>
 <a>2</a>
@@ -5136,12 +5142,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5143</v>
+<v>5220</v>
 </b>
 <b>
 <a>2</a>
-<b>8</b>
-<v>152</v>
+<b>6</b>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -5157,7 +5163,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5800</v>
+<v>5798</v>
 </b>
 <b>
 <a>2</a>
@@ -5183,7 +5189,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6702</v>
+<v>6700</v>
 </b>
 <b>
 <a>2</a>
@@ -5204,7 +5210,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6703</v>
+<v>6701</v>
 </b>
 </bs>
 </hist>
@@ -5220,7 +5226,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6702</v>
+<v>6700</v>
 </b>
 <b>
 <a>2</a>
@@ -5241,7 +5247,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6702</v>
+<v>6700</v>
 </b>
 <b>
 <a>2</a>
@@ -5262,12 +5268,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6595</v>
+<v>6676</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>108</v>
+<v>25</v>
 </b>
 </bs>
 </hist>
@@ -5283,52 +5289,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>93</v>
+<v>54</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>50</v>
+<v>40</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>23</v>
+<v>16</v>
 </b>
 <b>
 <a>4</a>
-<b>6</b>
-<v>20</v>
+<b>5</b>
+<v>13</v>
 </b>
 <b>
-<a>6</a>
+<a>5</a>
 <b>8</b>
-<v>23</v>
+<v>15</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>25</v>
+<v>18</v>
 </b>
 <b>
 <a>12</a>
-<b>22</b>
-<v>23</v>
+<b>37</b>
+<v>15</v>
 </b>
 <b>
-<a>22</a>
-<b>61</b>
-<v>23</v>
+<a>38</a>
+<b>122</b>
+<v>15</v>
 </b>
 <b>
-<a>63</a>
-<b>435</b>
-<v>23</v>
-</b>
-<b>
-<a>474</a>
-<b>722</b>
-<v>3</v>
+<a>170</a>
+<b>1173</b>
+<v>13</v>
 </b>
 </bs>
 </hist>
@@ -5344,7 +5345,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>305</v>
+<v>198</v>
 </b>
 <b>
 <a>2</a>
@@ -5365,7 +5366,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>306</v>
+<v>199</v>
 </b>
 </bs>
 </hist>
@@ -5381,7 +5382,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>305</v>
+<v>198</v>
 </b>
 <b>
 <a>2</a>
@@ -5402,47 +5403,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107</v>
+<v>70</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>46</v>
+<v>36</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>23</v>
+<v>20</v>
 </b>
 <b>
 <a>4</a>
-<b>6</b>
-<v>26</v>
+<b>7</b>
+<v>17</v>
 </b>
 <b>
-<a>6</a>
-<b>9</b>
-<v>26</v>
+<a>7</a>
+<b>10</b>
+<v>16</v>
 </b>
 <b>
-<a>9</a>
-<b>13</b>
-<v>26</v>
+<a>11</a>
+<b>21</b>
+<v>15</v>
 </b>
 <b>
-<a>13</a>
-<b>37</b>
-<v>23</v>
+<a>25</a>
+<b>117</b>
+<v>15</v>
 </b>
 <b>
-<a>38</a>
-<b>223</b>
-<v>23</v>
-</b>
-<b>
-<a>231</a>
-<b>577</b>
-<v>6</v>
+<a>131</a>
+<b>946</b>
+<v>10</v>
 </b>
 </bs>
 </hist>
@@ -5458,47 +5454,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101</v>
+<v>62</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47</v>
+<v>36</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>26</v>
+<v>18</v>
 </b>
 <b>
 <a>4</a>
-<b>7</b>
-<v>28</v>
+<b>5</b>
+<v>13</v>
 </b>
 <b>
-<a>7</a>
-<b>11</b>
-<v>26</v>
+<a>5</a>
+<b>9</b>
+<v>18</v>
 </b>
 <b>
-<a>11</a>
-<b>17</b>
-<v>26</v>
+<a>9</a>
+<b>14</b>
+<v>17</v>
 </b>
 <b>
-<a>17</a>
-<b>55</b>
-<v>23</v>
+<a>14</a>
+<b>67</b>
+<v>15</v>
 </b>
 <b>
-<a>55</a>
-<b>275</b>
-<v>23</v>
+<a>79</a>
+<b>340</b>
+<v>15</v>
 </b>
 <b>
-<a>277</a>
-<b>722</b>
-<v>6</v>
+<a>360</a>
+<b>1173</b>
+<v>5</v>
 </b>
 </bs>
 </hist>
@@ -5508,19 +5504,19 @@
 </relation>
 <relation>
 <name>compilation_finished</name>
-<cardinality>1097</cardinality>
+<cardinality>1098</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 <e>
 <k>cpu_seconds</k>
-<v>985</v>
+<v>1000</v>
 </e>
 <e>
 <k>elapsed_seconds</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5534,7 +5530,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -5550,7 +5546,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -5566,12 +5562,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>873</v>
+<v>903</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>112</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -5587,12 +5583,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>873</v>
+<v>903</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>112</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -5608,7 +5604,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -5624,7 +5620,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -5634,15 +5630,15 @@
 </relation>
 <relation>
 <name>compilation_assembly</name>
-<cardinality>1097</cardinality>
+<cardinality>1098</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 <e>
 <k>assembly</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5656,7 +5652,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -5672,7 +5668,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -6334,19 +6330,19 @@
 </relation>
 <relation>
 <name>duplicateCode</name>
-<cardinality>22766</cardinality>
+<cardinality>22785</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>22766</v>
+<v>22785</v>
 </e>
 <e>
 <k>relativePath</k>
-<v>3809</v>
+<v>3812</v>
 </e>
 <e>
 <k>equivClass</k>
-<v>7018</v>
+<v>7024</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -6360,7 +6356,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22766</v>
+<v>22785</v>
 </b>
 </bs>
 </hist>
@@ -6376,7 +6372,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22766</v>
+<v>22785</v>
 </b>
 </bs>
 </hist>
@@ -6392,12 +6388,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1063</v>
+<v>1064</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>565</v>
+<v>566</v>
 </b>
 <b>
 <a>3</a>
@@ -6453,17 +6449,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1131</v>
+<v>1132</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>521</v>
+<v>522</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>443</v>
+<v>444</v>
 </b>
 <b>
 <a>4</a>
@@ -6478,7 +6474,7 @@
 <b>
 <a>6</a>
 <b>8</b>
-<v>326</v>
+<v>327</v>
 </b>
 <b>
 <a>8</a>
@@ -6514,12 +6510,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3770</v>
+<v>3773</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1146</v>
+<v>1147</v>
 </b>
 <b>
 <a>4</a>
@@ -6534,7 +6530,7 @@
 <b>
 <a>6</a>
 <b>8</b>
-<v>570</v>
+<v>571</v>
 </b>
 <b>
 <a>8</a>
@@ -6555,22 +6551,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>677</v>
+<v>678</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3443</v>
+<v>3446</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1077</v>
+<v>1078</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>677</v>
+<v>678</v>
 </b>
 <b>
 <a>5</a>
@@ -8663,11 +8659,11 @@
 </relation>
 <relation>
 <name>locations_default</name>
-<cardinality>14072002</cardinality>
+<cardinality>14071972</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14072002</v>
+<v>14071972</v>
 </e>
 <e>
 <k>file</k>
@@ -8701,7 +8697,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14072002</v>
+<v>14071972</v>
 </b>
 </bs>
 </hist>
@@ -8717,7 +8713,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14072002</v>
+<v>14071972</v>
 </b>
 </bs>
 </hist>
@@ -8733,7 +8729,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14072002</v>
+<v>14071972</v>
 </b>
 </bs>
 </hist>
@@ -8749,7 +8745,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14072002</v>
+<v>14071972</v>
 </b>
 </bs>
 </hist>
@@ -8765,7 +8761,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14072002</v>
+<v>14071972</v>
 </b>
 </bs>
 </hist>
@@ -9225,7 +9221,7 @@
 </b>
 <b>
 <a>301</a>
-<b>10777</b>
+<b>10778</b>
 <v>9050</v>
 </b>
 </bs>
@@ -10881,23 +10877,23 @@
 </relation>
 <relation>
 <name>assemblies</name>
-<cardinality>4204</cardinality>
+<cardinality>4207</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4204</v>
+<v>4207</v>
 </e>
 <e>
 <k>file</k>
-<v>4204</v>
+<v>4207</v>
 </e>
 <e>
 <k>fullname</k>
-<v>3443</v>
+<v>3446</v>
 </e>
 <e>
 <k>name</k>
-<v>3175</v>
+<v>3177</v>
 </e>
 <e>
 <k>version</k>
@@ -10915,7 +10911,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4204</v>
+<v>4207</v>
 </b>
 </bs>
 </hist>
@@ -10931,7 +10927,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4204</v>
+<v>4207</v>
 </b>
 </bs>
 </hist>
@@ -10947,7 +10943,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4204</v>
+<v>4207</v>
 </b>
 </bs>
 </hist>
@@ -10963,7 +10959,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4204</v>
+<v>4207</v>
 </b>
 </bs>
 </hist>
@@ -10979,7 +10975,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4204</v>
+<v>4207</v>
 </b>
 </bs>
 </hist>
@@ -10995,7 +10991,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4204</v>
+<v>4207</v>
 </b>
 </bs>
 </hist>
@@ -11011,7 +11007,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4204</v>
+<v>4207</v>
 </b>
 </bs>
 </hist>
@@ -11027,7 +11023,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4204</v>
+<v>4207</v>
 </b>
 </bs>
 </hist>
@@ -11043,12 +11039,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2682</v>
+<v>2684</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>760</v>
+<v>761</v>
 </b>
 </bs>
 </hist>
@@ -11064,12 +11060,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2682</v>
+<v>2684</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>760</v>
+<v>761</v>
 </b>
 </bs>
 </hist>
@@ -11085,7 +11081,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3443</v>
+<v>3446</v>
 </b>
 </bs>
 </hist>
@@ -11101,7 +11097,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3443</v>
+<v>3446</v>
 </b>
 </bs>
 </hist>
@@ -11117,12 +11113,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2189</v>
+<v>2191</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>941</v>
+<v>942</v>
 </b>
 <b>
 <a>3</a>
@@ -11143,12 +11139,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2189</v>
+<v>2191</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>941</v>
+<v>942</v>
 </b>
 <b>
 <a>3</a>
@@ -11169,7 +11165,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2950</v>
+<v>2953</v>
 </b>
 <b>
 <a>2</a>
@@ -11190,7 +11186,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2950</v>
+<v>2953</v>
 </b>
 <b>
 <a>2</a>
@@ -11211,7 +11207,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>204</v>
+<v>205</v>
 </b>
 <b>
 <a>2</a>
@@ -11252,7 +11248,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>204</v>
+<v>205</v>
 </b>
 <b>
 <a>2</a>
@@ -11369,19 +11365,19 @@
 </relation>
 <relation>
 <name>files</name>
-<cardinality>42524</cardinality>
+<cardinality>42559</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42524</v>
+<v>42559</v>
 </e>
 <e>
 <k>name</k>
-<v>42524</v>
+<v>42559</v>
 </e>
 <e>
 <k>simple</k>
-<v>22966</v>
+<v>22985</v>
 </e>
 <e>
 <k>ext</k>
@@ -11403,7 +11399,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42524</v>
+<v>42559</v>
 </b>
 </bs>
 </hist>
@@ -11419,7 +11415,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42524</v>
+<v>42559</v>
 </b>
 </bs>
 </hist>
@@ -11435,7 +11431,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42524</v>
+<v>42559</v>
 </b>
 </bs>
 </hist>
@@ -11451,7 +11447,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42524</v>
+<v>42559</v>
 </b>
 </bs>
 </hist>
@@ -11467,7 +11463,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42524</v>
+<v>42559</v>
 </b>
 </bs>
 </hist>
@@ -11483,7 +11479,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42524</v>
+<v>42559</v>
 </b>
 </bs>
 </hist>
@@ -11499,7 +11495,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42524</v>
+<v>42559</v>
 </b>
 </bs>
 </hist>
@@ -11515,7 +11511,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42524</v>
+<v>42559</v>
 </b>
 </bs>
 </hist>
@@ -11531,12 +11527,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21557</v>
+<v>21575</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>1409</v>
+<v>1410</v>
 </b>
 </bs>
 </hist>
@@ -11552,12 +11548,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21557</v>
+<v>21575</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>1409</v>
+<v>1410</v>
 </b>
 </bs>
 </hist>
@@ -11573,7 +11569,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22176</v>
+<v>22195</v>
 </b>
 <b>
 <a>2</a>
@@ -11594,7 +11590,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22966</v>
+<v>22985</v>
 </b>
 </bs>
 </hist>
@@ -11832,19 +11828,19 @@
 </relation>
 <relation>
 <name>folders</name>
-<cardinality>16962</cardinality>
+<cardinality>16977</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16962</v>
+<v>16977</v>
 </e>
 <e>
 <k>name</k>
-<v>14743</v>
+<v>14756</v>
 </e>
 <e>
 <k>simple</k>
-<v>2780</v>
+<v>2782</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -11858,7 +11854,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16962</v>
+<v>16977</v>
 </b>
 </bs>
 </hist>
@@ -11874,7 +11870,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16962</v>
+<v>16977</v>
 </b>
 </bs>
 </hist>
@@ -11890,7 +11886,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14743</v>
+<v>14756</v>
 </b>
 </bs>
 </hist>
@@ -11906,12 +11902,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12524</v>
+<v>12535</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2219</v>
+<v>2220</v>
 </b>
 </bs>
 </hist>
@@ -11927,7 +11923,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1824</v>
+<v>1825</v>
 </b>
 <b>
 <a>2</a>
@@ -11937,7 +11933,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>204</v>
+<v>205</v>
 </b>
 <b>
 <a>4</a>
@@ -11963,7 +11959,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1824</v>
+<v>1825</v>
 </b>
 <b>
 <a>2</a>
@@ -11973,7 +11969,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>204</v>
+<v>205</v>
 </b>
 <b>
 <a>4</a>
@@ -11993,15 +11989,15 @@
 </relation>
 <relation>
 <name>containerparent</name>
-<cardinality>57258</cardinality>
+<cardinality>57306</cardinality>
 <columnsizes>
 <e>
 <k>parent</k>
-<v>14743</v>
+<v>14756</v>
 </e>
 <e>
 <k>child</k>
-<v>57258</v>
+<v>57306</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12015,32 +12011,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8266</v>
+<v>8273</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1941</v>
+<v>1942</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>770</v>
+<v>771</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>970</v>
+<v>971</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>1107</v>
+<v>1108</v>
 </b>
 <b>
 <a>9</a>
 <b>18</b>
-<v>1141</v>
+<v>1142</v>
 </b>
 <b>
 <a>18</a>
@@ -12061,7 +12057,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>57258</v>
+<v>57306</v>
 </b>
 </bs>
 </hist>
@@ -12071,11 +12067,11 @@
 </relation>
 <relation>
 <name>file_extraction_mode</name>
-<cardinality>26814</cardinality>
+<cardinality>26837</cardinality>
 <columnsizes>
 <e>
 <k>file</k>
-<v>26814</v>
+<v>26837</v>
 </e>
 <e>
 <k>mode</k>
@@ -12093,7 +12089,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26814</v>
+<v>26837</v>
 </b>
 </bs>
 </hist>
@@ -12119,15 +12115,15 @@
 </relation>
 <relation>
 <name>namespaces</name>
-<cardinality>21971</cardinality>
+<cardinality>21990</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>21971</v>
+<v>21990</v>
 </e>
 <e>
 <k>name</k>
-<v>4896</v>
+<v>4900</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12141,7 +12137,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21971</v>
+<v>21990</v>
 </b>
 </bs>
 </hist>
@@ -12162,7 +12158,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3496</v>
+<v>3499</v>
 </b>
 <b>
 <a>3</a>
@@ -12197,15 +12193,15 @@
 </relation>
 <relation>
 <name>namespace_declarations</name>
-<cardinality>19786</cardinality>
+<cardinality>19803</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19786</v>
+<v>19803</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>3892</v>
+<v>3895</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12219,7 +12215,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19786</v>
+<v>19803</v>
 </b>
 </bs>
 </hist>
@@ -12235,12 +12231,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1399</v>
+<v>1400</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>799</v>
+<v>800</v>
 </b>
 <b>
 <a>3</a>
@@ -12280,15 +12276,15 @@
 </relation>
 <relation>
 <name>namespace_declaration_location</name>
-<cardinality>19786</cardinality>
+<cardinality>19803</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19786</v>
+<v>19803</v>
 </e>
 <e>
 <k>loc</k>
-<v>19786</v>
+<v>19803</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12302,7 +12298,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19786</v>
+<v>19803</v>
 </b>
 </bs>
 </hist>
@@ -12318,7 +12314,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19786</v>
+<v>19803</v>
 </b>
 </bs>
 </hist>
@@ -12328,15 +12324,15 @@
 </relation>
 <relation>
 <name>parent_namespace</name>
-<cardinality>778113</cardinality>
+<cardinality>778765</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>778113</v>
+<v>778765</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>13573</v>
+<v>13584</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12350,7 +12346,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>778113</v>
+<v>778765</v>
 </b>
 </bs>
 </hist>
@@ -12366,12 +12362,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3331</v>
+<v>3333</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1628</v>
+<v>1630</v>
 </b>
 <b>
 <a>3</a>
@@ -12381,27 +12377,27 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>916</v>
+<v>917</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>1253</v>
+<v>1254</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>1092</v>
+<v>1093</v>
 </b>
 <b>
 <a>10</a>
 <b>15</b>
-<v>1141</v>
+<v>1142</v>
 </b>
 <b>
 <a>15</a>
 <b>23</b>
-<v>1063</v>
+<v>1064</v>
 </b>
 <b>
 <a>23</a>
@@ -12411,7 +12407,7 @@
 <b>
 <a>51</a>
 <b>835</b>
-<v>1019</v>
+<v>1020</v>
 </b>
 <b>
 <a>900</a>
@@ -12426,15 +12422,15 @@
 </relation>
 <relation>
 <name>parent_namespace_declaration</name>
-<cardinality>88423</cardinality>
+<cardinality>88497</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>87906</v>
+<v>87980</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>19786</v>
+<v>19803</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12448,7 +12444,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87755</v>
+<v>87828</v>
 </b>
 <b>
 <a>2</a>
@@ -12469,27 +12465,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13797</v>
+<v>13809</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>1716</v>
+<v>1718</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>1277</v>
+<v>1278</v>
 </b>
 <b>
 <a>13</a>
 <b>16</b>
-<v>1429</v>
+<v>1430</v>
 </b>
 <b>
 <a>16</a>
 <b>32</b>
-<v>1511</v>
+<v>1513</v>
 </b>
 <b>
 <a>32</a>
@@ -12504,15 +12500,15 @@
 </relation>
 <relation>
 <name>using_namespace_directives</name>
-<cardinality>144448</cardinality>
+<cardinality>144569</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144448</v>
+<v>144569</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>4233</v>
+<v>4236</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12526,7 +12522,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144448</v>
+<v>144569</v>
 </b>
 </bs>
 </hist>
@@ -12542,7 +12538,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1497</v>
+<v>1498</v>
 </b>
 <b>
 <a>2</a>
@@ -12557,12 +12553,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>365</v>
+<v>366</v>
 </b>
 <b>
 <a>8</a>
@@ -12572,17 +12568,17 @@
 <b>
 <a>14</a>
 <b>25</b>
-<v>321</v>
+<v>322</v>
 </b>
 <b>
 <a>25</a>
 <b>63</b>
-<v>326</v>
+<v>327</v>
 </b>
 <b>
 <a>64</a>
 <b>465</b>
-<v>321</v>
+<v>322</v>
 </b>
 <b>
 <a>510</a>
@@ -12685,15 +12681,15 @@
 </relation>
 <relation>
 <name>using_directive_location</name>
-<cardinality>144506</cardinality>
+<cardinality>144627</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144506</v>
+<v>144627</v>
 </e>
 <e>
 <k>loc</k>
-<v>144462</v>
+<v>144583</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12707,7 +12703,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144506</v>
+<v>144627</v>
 </b>
 </bs>
 </hist>
@@ -12723,7 +12719,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144418</v>
+<v>144539</v>
 </b>
 <b>
 <a>2</a>
@@ -12738,11 +12734,11 @@
 </relation>
 <relation>
 <name>types</name>
-<cardinality>868341</cardinality>
+<cardinality>869068</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>868341</v>
+<v>869068</v>
 </e>
 <e>
 <k>kind</k>
@@ -12750,7 +12746,7 @@
 </e>
 <e>
 <k>name</k>
-<v>367355</v>
+<v>367663</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12764,7 +12760,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>868341</v>
+<v>869068</v>
 </b>
 </bs>
 </hist>
@@ -12780,7 +12776,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>868341</v>
+<v>869068</v>
 </b>
 </bs>
 </hist>
@@ -12878,17 +12874,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>325050</v>
+<v>325323</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>28877</v>
+<v>28902</v>
 </b>
 <b>
 <a>5</a>
 <b>6356</b>
-<v>13426</v>
+<v>13438</v>
 </b>
 </bs>
 </hist>
@@ -12904,12 +12900,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>365916</v>
+<v>366223</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1438</v>
+<v>1439</v>
 </b>
 </bs>
 </hist>
@@ -12919,15 +12915,15 @@
 </relation>
 <relation>
 <name>typerefs</name>
-<cardinality>235110</cardinality>
+<cardinality>235307</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235110</v>
+<v>235307</v>
 </e>
 <e>
 <k>name</k>
-<v>177222</v>
+<v>177371</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12941,7 +12937,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235110</v>
+<v>235307</v>
 </b>
 </bs>
 </hist>
@@ -12957,17 +12953,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162654</v>
+<v>162790</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>13500</v>
+<v>13511</v>
 </b>
 <b>
 <a>7</a>
 <b>2183</b>
-<v>1068</v>
+<v>1069</v>
 </b>
 </bs>
 </hist>
@@ -12977,15 +12973,15 @@
 </relation>
 <relation>
 <name>typeref_type</name>
-<cardinality>234929</cardinality>
+<cardinality>235126</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>234929</v>
+<v>235126</v>
 </e>
 <e>
 <k>typeId</k>
-<v>234929</v>
+<v>235126</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12999,7 +12995,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>234929</v>
+<v>235126</v>
 </b>
 </bs>
 </hist>
@@ -13015,7 +13011,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>234929</v>
+<v>235126</v>
 </b>
 </bs>
 </hist>
@@ -13025,11 +13021,11 @@
 </relation>
 <relation>
 <name>array_element_type</name>
-<cardinality>9134</cardinality>
+<cardinality>9142</cardinality>
 <columnsizes>
 <e>
 <k>array</k>
-<v>9134</v>
+<v>9142</v>
 </e>
 <e>
 <k>dimension</k>
@@ -13041,7 +13037,7 @@
 </e>
 <e>
 <k>element</k>
-<v>9125</v>
+<v>9132</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13055,7 +13051,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9134</v>
+<v>9142</v>
 </b>
 </bs>
 </hist>
@@ -13071,7 +13067,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9134</v>
+<v>9142</v>
 </b>
 </bs>
 </hist>
@@ -13087,7 +13083,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9134</v>
+<v>9142</v>
 </b>
 </bs>
 </hist>
@@ -13229,7 +13225,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9115</v>
+<v>9123</v>
 </b>
 <b>
 <a>2</a>
@@ -13250,7 +13246,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9125</v>
+<v>9132</v>
 </b>
 </bs>
 </hist>
@@ -13266,7 +13262,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9115</v>
+<v>9123</v>
 </b>
 <b>
 <a>2</a>
@@ -13377,11 +13373,11 @@
 </relation>
 <relation>
 <name>enum_underlying_type</name>
-<cardinality>11968</cardinality>
+<cardinality>11978</cardinality>
 <columnsizes>
 <e>
 <k>enum_id</k>
-<v>11968</v>
+<v>11978</v>
 </e>
 <e>
 <k>underlying_type_id</k>
@@ -13399,7 +13395,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11968</v>
+<v>11978</v>
 </b>
 </bs>
 </hist>
@@ -13455,15 +13451,15 @@
 </relation>
 <relation>
 <name>delegate_return_type</name>
-<cardinality>107698</cardinality>
+<cardinality>107788</cardinality>
 <columnsizes>
 <e>
 <k>delegate_id</k>
-<v>107698</v>
+<v>107788</v>
 </e>
 <e>
 <k>return_type_id</k>
-<v>55585</v>
+<v>55632</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13477,7 +13473,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107698</v>
+<v>107788</v>
 </b>
 </bs>
 </hist>
@@ -13493,12 +13489,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52268</v>
+<v>52312</v>
 </b>
 <b>
 <a>2</a>
 <b>4178</b>
-<v>3316</v>
+<v>3319</v>
 </b>
 </bs>
 </hist>
@@ -13508,15 +13504,15 @@
 </relation>
 <relation>
 <name>extend</name>
-<cardinality>323924</cardinality>
+<cardinality>324195</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>323924</v>
+<v>324195</v>
 </e>
 <e>
 <k>super</k>
-<v>31609</v>
+<v>31635</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13530,7 +13526,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>323924</v>
+<v>324195</v>
 </b>
 </bs>
 </hist>
@@ -13546,22 +13542,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22659</v>
+<v>22678</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3984</v>
+<v>3988</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2419</v>
+<v>2421</v>
 </b>
 <b>
 <a>5</a>
 <b>70</b>
-<v>2380</v>
+<v>2382</v>
 </b>
 <b>
 <a>70</a>
@@ -13576,26 +13572,26 @@
 </relation>
 <relation>
 <name>anonymous_types</name>
-<cardinality>1214</cardinality>
+<cardinality>1215</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1214</v>
+<v>1215</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>implement</name>
-<cardinality>542359</cardinality>
+<cardinality>542813</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>226658</v>
+<v>226847</v>
 </e>
 <e>
 <k>super</k>
-<v>122710</v>
+<v>122813</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13609,27 +13605,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100909</v>
+<v>100993</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>57121</v>
+<v>57169</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>36159</v>
+<v>36189</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>18996</v>
+<v>19012</v>
 </b>
 <b>
 <a>7</a>
 <b>21</b>
-<v>13470</v>
+<v>13482</v>
 </b>
 </bs>
 </hist>
@@ -13645,27 +13641,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>67042</v>
+<v>67098</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29824</v>
+<v>29849</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10261</v>
+<v>10270</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>8705</v>
+<v>8713</v>
 </b>
 <b>
 <a>6</a>
 <b>21807</b>
-<v>6876</v>
+<v>6882</v>
 </b>
 </bs>
 </hist>
@@ -13675,15 +13671,15 @@
 </relation>
 <relation>
 <name>type_location</name>
-<cardinality>554440</cardinality>
+<cardinality>554904</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>467596</v>
+<v>467988</v>
 </e>
 <e>
 <k>loc</k>
-<v>29916</v>
+<v>29941</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13697,17 +13693,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>407938</v>
+<v>408280</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39285</v>
+<v>39318</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>20372</v>
+<v>20389</v>
 </b>
 </bs>
 </hist>
@@ -13723,17 +13719,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26039</v>
+<v>26061</v>
 </b>
 <b>
 <a>2</a>
 <b>26</b>
-<v>2272</v>
+<v>2274</v>
 </b>
 <b>
 <a>26</a>
 <b>12195</b>
-<v>1604</v>
+<v>1605</v>
 </b>
 </bs>
 </hist>
@@ -13743,15 +13739,15 @@
 </relation>
 <relation>
 <name>tuple_underlying_type</name>
-<cardinality>1785</cardinality>
+<cardinality>1786</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>1785</v>
+<v>1786</v>
 </e>
 <e>
 <k>struct</k>
-<v>1141</v>
+<v>1142</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13765,7 +13761,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1785</v>
+<v>1786</v>
 </b>
 </bs>
 </hist>
@@ -13781,7 +13777,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>643</v>
+<v>644</v>
 </b>
 <b>
 <a>2</a>
@@ -13801,11 +13797,11 @@
 </relation>
 <relation>
 <name>tuple_element</name>
-<cardinality>6798</cardinality>
+<cardinality>6804</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>1780</v>
+<v>1781</v>
 </e>
 <e>
 <k>index</k>
@@ -13813,7 +13809,7 @@
 </e>
 <e>
 <k>field</k>
-<v>6798</v>
+<v>6804</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13832,7 +13828,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1136</v>
+<v>1137</v>
 </b>
 <b>
 <a>3</a>
@@ -13878,7 +13874,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1136</v>
+<v>1137</v>
 </b>
 <b>
 <a>3</a>
@@ -14151,7 +14147,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6798</v>
+<v>6804</v>
 </b>
 </bs>
 </hist>
@@ -14167,7 +14163,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6798</v>
+<v>6804</v>
 </b>
 </bs>
 </hist>
@@ -14177,19 +14173,19 @@
 </relation>
 <relation>
 <name>attributes</name>
-<cardinality>750284</cardinality>
+<cardinality>750912</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>750284</v>
+<v>750912</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1687</v>
+<v>1688</v>
 </e>
 <e>
 <k>target</k>
-<v>429632</v>
+<v>429992</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14203,7 +14199,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750284</v>
+<v>750912</v>
 </b>
 </bs>
 </hist>
@@ -14219,7 +14215,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750284</v>
+<v>750912</v>
 </b>
 </bs>
 </hist>
@@ -14382,17 +14378,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>366063</v>
+<v>366369</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48874</v>
+<v>48915</v>
 </b>
 <b>
 <a>3</a>
 <b>957</b>
-<v>14695</v>
+<v>14707</v>
 </b>
 </bs>
 </hist>
@@ -14408,12 +14404,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>395316</v>
+<v>395647</v>
 </b>
 <b>
 <a>2</a>
 <b>15</b>
-<v>33491</v>
+<v>33519</v>
 </b>
 <b>
 <a>15</a>
@@ -14428,15 +14424,15 @@
 </relation>
 <relation>
 <name>attribute_location</name>
-<cardinality>818433</cardinality>
+<cardinality>819118</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>750284</v>
+<v>750912</v>
 </e>
 <e>
 <k>loc</k>
-<v>72426</v>
+<v>72487</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14450,12 +14446,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>682135</v>
+<v>682706</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>68149</v>
+<v>68206</v>
 </b>
 </bs>
 </hist>
@@ -14471,12 +14467,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68217</v>
+<v>68274</v>
 </b>
 <b>
 <a>4</a>
 <b>26710</b>
-<v>4209</v>
+<v>4212</v>
 </b>
 </bs>
 </hist>
@@ -14486,19 +14482,19 @@
 </relation>
 <relation>
 <name>type_mention</name>
-<cardinality>1268966</cardinality>
+<cardinality>1270028</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1268966</v>
+<v>1270028</v>
 </e>
 <e>
 <k>type_id</k>
-<v>34450</v>
+<v>34479</v>
 </e>
 <e>
 <k>parent</k>
-<v>1028466</v>
+<v>1029327</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14512,7 +14508,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1268966</v>
+<v>1270028</v>
 </b>
 </bs>
 </hist>
@@ -14528,7 +14524,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1268966</v>
+<v>1270028</v>
 </b>
 </bs>
 </hist>
@@ -14544,52 +14540,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4963</v>
+<v>4967</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6796</v>
+<v>6801</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3384</v>
+<v>3386</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4025</v>
+<v>4028</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2096</v>
+<v>2098</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>2903</v>
+<v>2905</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>2802</v>
+<v>2804</v>
 </b>
 <b>
 <a>12</a>
 <b>20</b>
-<v>2615</v>
+<v>2617</v>
 </b>
 <b>
 <a>20</a>
 <b>51</b>
-<v>2584</v>
+<v>2586</v>
 </b>
 <b>
 <a>51</a>
 <b>82737</b>
-<v>2279</v>
+<v>2281</v>
 </b>
 </bs>
 </hist>
@@ -14605,52 +14601,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9464</v>
+<v>9472</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5702</v>
+<v>5707</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3311</v>
+<v>3313</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>3000</v>
+<v>3003</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1946</v>
+<v>1948</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>2514</v>
+<v>2516</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>2761</v>
+<v>2763</v>
 </b>
 <b>
 <a>13</a>
 <b>29</b>
-<v>2629</v>
+<v>2631</v>
 </b>
 <b>
 <a>29</a>
 <b>206</b>
-<v>2587</v>
+<v>2589</v>
 </b>
 <b>
 <a>206</a>
 <b>67616</b>
-<v>532</v>
+<v>533</v>
 </b>
 </bs>
 </hist>
@@ -14666,17 +14662,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>870784</v>
+<v>871513</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137333</v>
+<v>137448</v>
 </b>
 <b>
 <a>3</a>
 <b>342</b>
-<v>20348</v>
+<v>20365</v>
 </b>
 </bs>
 </hist>
@@ -14692,12 +14688,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1007790</v>
+<v>1008634</v>
 </b>
 <b>
 <a>2</a>
 <b>22</b>
-<v>20675</v>
+<v>20693</v>
 </b>
 </bs>
 </hist>
@@ -14707,15 +14703,15 @@
 </relation>
 <relation>
 <name>type_mention_location</name>
-<cardinality>1268966</cardinality>
+<cardinality>1270028</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1268966</v>
+<v>1270028</v>
 </e>
 <e>
 <k>loc</k>
-<v>1139537</v>
+<v>1140490</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14729,7 +14725,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1268966</v>
+<v>1270028</v>
 </b>
 </bs>
 </hist>
@@ -14745,12 +14741,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1077054</v>
+<v>1077956</v>
 </b>
 <b>
 <a>2</a>
 <b>199</b>
-<v>62482</v>
+<v>62533</v>
 </b>
 </bs>
 </hist>
@@ -14760,11 +14756,11 @@
 </relation>
 <relation>
 <name>type_annotation</name>
-<cardinality>50996</cardinality>
+<cardinality>51038</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>50996</v>
+<v>51038</v>
 </e>
 <e>
 <k>annotation</k>
@@ -14782,7 +14778,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50996</v>
+<v>51038</v>
 </b>
 </bs>
 </hist>
@@ -14818,11 +14814,11 @@
 </relation>
 <relation>
 <name>nullability</name>
-<cardinality>1999</cardinality>
+<cardinality>2001</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>1999</v>
+<v>2001</v>
 </e>
 <e>
 <k>kind</k>
@@ -14840,7 +14836,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1999</v>
+<v>2001</v>
 </b>
 </bs>
 </hist>
@@ -14876,11 +14872,11 @@
 </relation>
 <relation>
 <name>nullability_parent</name>
-<cardinality>6286</cardinality>
+<cardinality>6291</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>521</v>
+<v>522</v>
 </e>
 <e>
 <k>index</k>
@@ -14888,7 +14884,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>1985</v>
+<v>1986</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14933,7 +14929,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>2</a>
@@ -15136,12 +15132,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1229</v>
+<v>1230</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>160</v>
+<v>161</v>
 </b>
 </bs>
 </hist>
@@ -15162,7 +15158,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>721</v>
+<v>722</v>
 </b>
 <b>
 <a>3</a>
@@ -15197,11 +15193,11 @@
 </relation>
 <relation>
 <name>type_nullability</name>
-<cardinality>4610773</cardinality>
+<cardinality>4612058</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4536326</v>
+<v>4537587</v>
 </e>
 <e>
 <k>nullability</k>
@@ -15219,12 +15215,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4470716</v>
+<v>4471953</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>65610</v>
+<v>65634</v>
 </b>
 </bs>
 </hist>
@@ -15255,7 +15251,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>69</v>
+<v>68</v>
 </b>
 <b>
 <a>5</a>
@@ -15265,7 +15261,7 @@
 <b>
 <a>7</a>
 <b>10</b>
-<v>64</v>
+<v>65</v>
 </b>
 <b>
 <a>10</a>
@@ -15294,7 +15290,7 @@
 </b>
 <b>
 <a>3109</a>
-<b>3682839</b>
+<b>3683510</b>
 <v>14</v>
 </b>
 </bs>
@@ -15305,11 +15301,11 @@
 </relation>
 <relation>
 <name>expr_flowstate</name>
-<cardinality>2993769</cardinality>
+<cardinality>2996275</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2993769</v>
+<v>2996275</v>
 </e>
 <e>
 <k>state</k>
@@ -15327,7 +15323,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2993769</v>
+<v>2996275</v>
 </b>
 </bs>
 </hist>
@@ -15358,11 +15354,11 @@
 </relation>
 <relation>
 <name>type_parameters</name>
-<cardinality>202959</cardinality>
+<cardinality>203129</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>202959</v>
+<v>203129</v>
 </e>
 <e>
 <k>index</k>
@@ -15370,7 +15366,7 @@
 </e>
 <e>
 <k>generic_id</k>
-<v>103845</v>
+<v>103932</v>
 </e>
 <e>
 <k>variance</k>
@@ -15388,7 +15384,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>202959</v>
+<v>203129</v>
 </b>
 </bs>
 </hist>
@@ -15404,7 +15400,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>202959</v>
+<v>203129</v>
 </b>
 </bs>
 </hist>
@@ -15420,7 +15416,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>202959</v>
+<v>203129</v>
 </b>
 </bs>
 </hist>
@@ -15694,22 +15690,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80688</v>
+<v>80755</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10788</v>
+<v>10797</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8359</v>
+<v>8366</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>4009</v>
+<v>4012</v>
 </b>
 </bs>
 </hist>
@@ -15725,22 +15721,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80688</v>
+<v>80755</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10788</v>
+<v>10797</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8359</v>
+<v>8366</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>4009</v>
+<v>4012</v>
 </b>
 </bs>
 </hist>
@@ -15756,7 +15752,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>103694</v>
+<v>103781</v>
 </b>
 <b>
 <a>2</a>
@@ -15849,11 +15845,11 @@
 </relation>
 <relation>
 <name>type_arguments</name>
-<cardinality>644639</cardinality>
+<cardinality>645178</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>273620</v>
+<v>273849</v>
 </e>
 <e>
 <k>index</k>
@@ -15861,7 +15857,7 @@
 </e>
 <e>
 <k>constructed_id</k>
-<v>413435</v>
+<v>413781</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15875,17 +15871,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>234978</v>
+<v>235175</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37164</v>
+<v>37195</v>
 </b>
 <b>
 <a>3</a>
 <b>21</b>
-<v>1477</v>
+<v>1479</v>
 </b>
 </bs>
 </hist>
@@ -15901,27 +15897,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>174164</v>
+<v>174310</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>56546</v>
+<v>56593</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>20596</v>
+<v>20613</v>
 </b>
 <b>
 <a>5</a>
 <b>23</b>
-<v>20679</v>
+<v>20696</v>
 </b>
 <b>
 <a>23</a>
 <b>2800</b>
-<v>1633</v>
+<v>1635</v>
 </b>
 </bs>
 </hist>
@@ -16149,17 +16145,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>290437</v>
+<v>290680</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>96358</v>
+<v>96439</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>26639</v>
+<v>26661</v>
 </b>
 </bs>
 </hist>
@@ -16175,17 +16171,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>288271</v>
+<v>288513</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>97358</v>
+<v>97440</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27804</v>
+<v>27828</v>
 </b>
 </bs>
 </hist>
@@ -16195,15 +16191,15 @@
 </relation>
 <relation>
 <name>constructed_generic</name>
-<cardinality>413435</cardinality>
+<cardinality>413781</cardinality>
 <columnsizes>
 <e>
 <k>constructed</k>
-<v>413435</v>
+<v>413781</v>
 </e>
 <e>
 <k>generic</k>
-<v>8588</v>
+<v>8595</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16217,7 +16213,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>413435</v>
+<v>413781</v>
 </b>
 </bs>
 </hist>
@@ -16233,12 +16229,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3448</v>
+<v>3451</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1155</v>
+<v>1156</v>
 </b>
 <b>
 <a>3</a>
@@ -16248,17 +16244,17 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>653</v>
+<v>654</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>726</v>
+<v>727</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>648</v>
+<v>649</v>
 </b>
 <b>
 <a>26</a>
@@ -16268,7 +16264,7 @@
 <b>
 <a>63</a>
 <b>2866</b>
-<v>648</v>
+<v>649</v>
 </b>
 <b>
 <a>2964</a>
@@ -16283,15 +16279,15 @@
 </relation>
 <relation>
 <name>type_parameter_constraints</name>
-<cardinality>611610</cardinality>
+<cardinality>612122</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>611610</v>
+<v>612122</v>
 </e>
 <e>
 <k>param_id</k>
-<v>202872</v>
+<v>203041</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16305,7 +16301,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>611610</v>
+<v>612122</v>
 </b>
 </bs>
 </hist>
@@ -16321,22 +16317,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>164439</v>
+<v>164577</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17709</v>
+<v>17723</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>16611</v>
+<v>16625</v>
 </b>
 <b>
 <a>11</a>
 <b>2108</b>
-<v>4111</v>
+<v>4114</v>
 </b>
 </bs>
 </hist>
@@ -16382,11 +16378,11 @@
 </relation>
 <relation>
 <name>general_type_parameter_constraints</name>
-<cardinality>119064</cardinality>
+<cardinality>119043</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>68463</v>
+<v>68444</v>
 </e>
 <e>
 <k>kind</k>
@@ -16404,12 +16400,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17862</v>
+<v>17845</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>50601</v>
+<v>50599</v>
 </b>
 </bs>
 </hist>
@@ -16428,23 +16424,23 @@
 <v>1</v>
 </b>
 <b>
-<a>442</a>
-<b>443</b>
+<a>444</a>
+<b>445</b>
 <v>1</v>
 </b>
 <b>
-<a>5921</a>
-<b>5922</b>
+<a>5912</a>
+<b>5913</b>
 <v>1</v>
 </b>
 <b>
-<a>50480</a>
-<b>50481</b>
+<a>50478</a>
+<b>50479</b>
 <v>1</v>
 </b>
 <b>
-<a>62217</a>
-<b>62218</b>
+<a>62205</a>
+<b>62206</b>
 <v>1</v>
 </b>
 </bs>
@@ -16455,11 +16451,11 @@
 </relation>
 <relation>
 <name>specific_type_parameter_constraints</name>
-<cardinality>57258</cardinality>
+<cardinality>57247</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>56404</v>
+<v>56390</v>
 </e>
 <e>
 <k>base_id</k>
@@ -16477,12 +16473,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55598</v>
+<v>55581</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>806</v>
+<v>809</v>
 </b>
 </bs>
 </hist>
@@ -16518,22 +16514,22 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>55</v>
+<v>57</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>117</v>
+<v>115</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>106</v>
+<v>107</v>
 </b>
 <b>
 <a>10</a>
 <b>13</b>
-<v>106</v>
+<v>105</v>
 </b>
 <b>
 <a>13</a>
@@ -16543,12 +16539,12 @@
 <b>
 <a>20</a>
 <b>26</b>
-<v>107</v>
+<v>108</v>
 </b>
 <b>
 <a>26</a>
 <b>51</b>
-<v>99</v>
+<v>98</v>
 </b>
 <b>
 <a>51</a>
@@ -16557,7 +16553,7 @@
 </b>
 <b>
 <a>204</a>
-<b>8429</b>
+<b>8430</b>
 <v>41</v>
 </b>
 </bs>
@@ -16568,11 +16564,11 @@
 </relation>
 <relation>
 <name>specific_type_parameter_nullability</name>
-<cardinality>39980</cardinality>
+<cardinality>39962</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>39742</v>
+<v>39721</v>
 </e>
 <e>
 <k>base_id</k>
@@ -16594,12 +16590,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39504</v>
+<v>39480</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>238</v>
+<v>241</v>
 </b>
 </bs>
 </hist>
@@ -16615,7 +16611,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39742</v>
+<v>39721</v>
 </b>
 </bs>
 </hist>
@@ -16651,47 +16647,47 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>49</v>
+<v>50</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>81</v>
+<v>80</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>70</v>
+<v>71</v>
 </b>
 <b>
 <a>10</a>
 <b>12</b>
-<v>56</v>
+<v>53</v>
 </b>
 <b>
 <a>12</a>
 <b>16</b>
-<v>69</v>
+<v>71</v>
 </b>
 <b>
 <a>16</a>
-<b>23</b>
-<v>83</v>
-</b>
-<b>
-<a>23</a>
-<b>37</b>
+<b>22</b>
 <v>70</v>
 </b>
 <b>
-<a>38</a>
-<b>103</b>
-<v>70</v>
+<a>22</a>
+<b>33</b>
+<v>73</v>
 </b>
 <b>
-<a>105</a>
-<b>6990</b>
-<v>49</v>
+<a>33</a>
+<b>93</b>
+<v>73</v>
+</b>
+<b>
+<a>95</a>
+<b>6991</b>
+<v>56</v>
 </b>
 </bs>
 </hist>
@@ -16791,8 +16787,8 @@
 <v>1</v>
 </b>
 <b>
-<a>38815</a>
-<b>38816</b>
+<a>38794</a>
+<b>38795</b>
 <v>1</v>
 </b>
 </bs>
@@ -16907,11 +16903,11 @@
 </relation>
 <relation>
 <name>has_modifiers</name>
-<cardinality>5503074</cardinality>
+<cardinality>5507681</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3695587</v>
+<v>3698681</v>
 </e>
 <e>
 <k>mod_id</k>
@@ -16929,17 +16925,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2023765</v>
+<v>2025460</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1538001</v>
+<v>1539288</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>133820</v>
+<v>133932</v>
 </b>
 </bs>
 </hist>
@@ -17045,22 +17041,22 @@
 </relation>
 <relation>
 <name>compiler_generated</name>
-<cardinality>136025</cardinality>
+<cardinality>136139</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>136025</v>
+<v>136139</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>exprorstmt_name</name>
-<cardinality>3707</cardinality>
+<cardinality>3710</cardinality>
 <columnsizes>
 <e>
 <k>parent_id</k>
-<v>3707</v>
+<v>3710</v>
 </e>
 <e>
 <k>name</k>
@@ -17078,7 +17074,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3707</v>
+<v>3710</v>
 </b>
 </bs>
 </hist>
@@ -17129,7 +17125,7 @@
 <b>
 <a>21</a>
 <b>85</b>
-<v>27</v>
+<v>28</v>
 </b>
 <b>
 <a>118</a>
@@ -17144,19 +17140,19 @@
 </relation>
 <relation>
 <name>nested_types</name>
-<cardinality>112082</cardinality>
+<cardinality>112176</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>112082</v>
+<v>112176</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>40651</v>
+<v>40685</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>81224</v>
+<v>81292</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17170,7 +17166,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112082</v>
+<v>112176</v>
 </b>
 </bs>
 </hist>
@@ -17186,7 +17182,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112082</v>
+<v>112176</v>
 </b>
 </bs>
 </hist>
@@ -17202,32 +17198,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23517</v>
+<v>23537</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6345</v>
+<v>6350</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3233</v>
+<v>3236</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3360</v>
+<v>3363</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>3097</v>
+<v>3099</v>
 </b>
 <b>
 <a>12</a>
 <b>262</b>
-<v>1097</v>
+<v>1098</v>
 </b>
 </bs>
 </hist>
@@ -17243,32 +17239,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23552</v>
+<v>23571</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6428</v>
+<v>6433</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3150</v>
+<v>3153</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3389</v>
+<v>3392</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>3082</v>
+<v>3084</v>
 </b>
 <b>
 <a>12</a>
 <b>206</b>
-<v>1048</v>
+<v>1049</v>
 </b>
 </bs>
 </hist>
@@ -17284,12 +17280,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78205</v>
+<v>78271</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>3018</v>
+<v>3021</v>
 </b>
 </bs>
 </hist>
@@ -17305,12 +17301,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78947</v>
+<v>79013</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>2277</v>
+<v>2279</v>
 </b>
 </bs>
 </hist>
@@ -17320,27 +17316,27 @@
 </relation>
 <relation>
 <name>properties</name>
-<cardinality>424101</cardinality>
+<cardinality>424457</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>424101</v>
+<v>424457</v>
 </e>
 <e>
 <k>name</k>
-<v>84473</v>
+<v>84543</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>116530</v>
+<v>116628</v>
 </e>
 <e>
 <k>type_id</k>
-<v>52195</v>
+<v>52239</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>334293</v>
+<v>334573</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17354,7 +17350,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424101</v>
+<v>424457</v>
 </b>
 </bs>
 </hist>
@@ -17370,7 +17366,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424101</v>
+<v>424457</v>
 </b>
 </bs>
 </hist>
@@ -17386,7 +17382,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424101</v>
+<v>424457</v>
 </b>
 </bs>
 </hist>
@@ -17402,7 +17398,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424101</v>
+<v>424457</v>
 </b>
 </bs>
 </hist>
@@ -17418,32 +17414,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50820</v>
+<v>50862</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14012</v>
+<v>14023</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5759</v>
+<v>5764</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6657</v>
+<v>6662</v>
 </b>
 <b>
 <a>7</a>
 <b>49</b>
-<v>6345</v>
+<v>6350</v>
 </b>
 <b>
 <a>49</a>
 <b>2611</b>
-<v>877</v>
+<v>878</v>
 </b>
 </bs>
 </hist>
@@ -17459,32 +17455,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50820</v>
+<v>50862</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14080</v>
+<v>14092</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5745</v>
+<v>5750</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6691</v>
+<v>6697</v>
 </b>
 <b>
 <a>7</a>
 <b>51</b>
-<v>6340</v>
+<v>6345</v>
 </b>
 <b>
 <a>51</a>
 <b>2578</b>
-<v>794</v>
+<v>795</v>
 </b>
 </bs>
 </hist>
@@ -17500,17 +17496,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72933</v>
+<v>72994</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6940</v>
+<v>6946</v>
 </b>
 <b>
 <a>3</a>
 <b>524</b>
-<v>4599</v>
+<v>4603</v>
 </b>
 </bs>
 </hist>
@@ -17526,27 +17522,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51249</v>
+<v>51292</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14275</v>
+<v>14287</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5745</v>
+<v>5750</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6452</v>
+<v>6457</v>
 </b>
 <b>
 <a>7</a>
 <b>68</b>
-<v>6335</v>
+<v>6340</v>
 </b>
 <b>
 <a>68</a>
@@ -17567,42 +17563,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39437</v>
+<v>39470</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29907</v>
+<v>29932</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10915</v>
+<v>10924</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7852</v>
+<v>7858</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7140</v>
+<v>7146</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9339</v>
+<v>9347</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>9578</v>
+<v>9586</v>
 </b>
 <b>
 <a>16</a>
 <b>250</b>
-<v>2360</v>
+<v>2362</v>
 </b>
 </bs>
 </hist>
@@ -17618,42 +17614,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43953</v>
+<v>43990</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25468</v>
+<v>25490</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10910</v>
+<v>10919</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7871</v>
+<v>7878</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7154</v>
+<v>7160</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9295</v>
+<v>9303</v>
 </b>
 <b>
 <a>8</a>
 <b>14</b>
-<v>8754</v>
+<v>8761</v>
 </b>
 <b>
 <a>14</a>
 <b>250</b>
-<v>3121</v>
+<v>3124</v>
 </b>
 </bs>
 </hist>
@@ -17669,32 +17665,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>45509</v>
+<v>45547</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32657</v>
+<v>32685</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13856</v>
+<v>13867</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7554</v>
+<v>7561</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>9393</v>
+<v>9401</v>
 </b>
 <b>
 <a>7</a>
 <b>48</b>
-<v>7559</v>
+<v>7565</v>
 </b>
 </bs>
 </hist>
@@ -17710,42 +17706,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39437</v>
+<v>39470</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29907</v>
+<v>29932</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10915</v>
+<v>10924</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7852</v>
+<v>7858</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7140</v>
+<v>7146</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9339</v>
+<v>9347</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>9578</v>
+<v>9586</v>
 </b>
 <b>
 <a>16</a>
 <b>250</b>
-<v>2360</v>
+<v>2362</v>
 </b>
 </bs>
 </hist>
@@ -17761,27 +17757,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31457</v>
+<v>31484</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10793</v>
+<v>10802</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4638</v>
+<v>4642</v>
 </b>
 <b>
 <a>5</a>
 <b>21</b>
-<v>3950</v>
+<v>3953</v>
 </b>
 <b>
 <a>21</a>
 <b>12516</b>
-<v>1355</v>
+<v>1356</v>
 </b>
 </bs>
 </hist>
@@ -17797,17 +17793,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44133</v>
+<v>44170</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4404</v>
+<v>4407</v>
 </b>
 <b>
 <a>3</a>
 <b>3289</b>
-<v>3657</v>
+<v>3660</v>
 </b>
 </bs>
 </hist>
@@ -17823,22 +17819,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32643</v>
+<v>32670</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10495</v>
+<v>10504</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4428</v>
+<v>4432</v>
 </b>
 <b>
 <a>5</a>
 <b>33</b>
-<v>3916</v>
+<v>3919</v>
 </b>
 <b>
 <a>33</a>
@@ -17859,27 +17855,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31599</v>
+<v>31625</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10924</v>
+<v>10934</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4672</v>
+<v>4676</v>
 </b>
 <b>
 <a>5</a>
 <b>22</b>
-<v>3916</v>
+<v>3919</v>
 </b>
 <b>
 <a>22</a>
 <b>10632</b>
-<v>1082</v>
+<v>1083</v>
 </b>
 </bs>
 </hist>
@@ -17895,12 +17891,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>329113</v>
+<v>329389</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5179</v>
+<v>5183</v>
 </b>
 </bs>
 </hist>
@@ -17916,7 +17912,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>334293</v>
+<v>334573</v>
 </b>
 </bs>
 </hist>
@@ -17932,12 +17928,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>329113</v>
+<v>329389</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5179</v>
+<v>5183</v>
 </b>
 </bs>
 </hist>
@@ -17953,12 +17949,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>333083</v>
+<v>333362</v>
 </b>
 <b>
 <a>2</a>
 <b>439</b>
-<v>1209</v>
+<v>1210</v>
 </b>
 </bs>
 </hist>
@@ -17968,15 +17964,15 @@
 </relation>
 <relation>
 <name>property_location</name>
-<cardinality>535165</cardinality>
+<cardinality>535613</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>424101</v>
+<v>424457</v>
 </e>
 <e>
 <k>loc</k>
-<v>52966</v>
+<v>53010</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17990,17 +17986,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>338560</v>
+<v>338844</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>64193</v>
+<v>64247</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>21347</v>
+<v>21365</v>
 </b>
 </bs>
 </hist>
@@ -18016,12 +18012,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49479</v>
+<v>49520</v>
 </b>
 <b>
 <a>2</a>
 <b>7080</b>
-<v>3487</v>
+<v>3490</v>
 </b>
 </bs>
 </hist>
@@ -18031,11 +18027,11 @@
 </relation>
 <relation>
 <name>indexers</name>
-<cardinality>17065</cardinality>
+<cardinality>17079</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>17065</v>
+<v>17079</v>
 </e>
 <e>
 <k>name</k>
@@ -18043,15 +18039,15 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>13568</v>
+<v>13579</v>
 </e>
 <e>
 <k>type_id</k>
-<v>3974</v>
+<v>3978</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>4443</v>
+<v>4446</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18065,7 +18061,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17065</v>
+<v>17079</v>
 </b>
 </bs>
 </hist>
@@ -18081,7 +18077,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17065</v>
+<v>17079</v>
 </b>
 </bs>
 </hist>
@@ -18097,7 +18093,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17065</v>
+<v>17079</v>
 </b>
 </bs>
 </hist>
@@ -18113,7 +18109,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17065</v>
+<v>17079</v>
 </b>
 </bs>
 </hist>
@@ -18248,12 +18244,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10520</v>
+<v>10528</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2750</v>
+<v>2753</v>
 </b>
 <b>
 <a>3</a>
@@ -18274,7 +18270,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13558</v>
+<v>13569</v>
 </b>
 <b>
 <a>2</a>
@@ -18295,12 +18291,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11061</v>
+<v>11070</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2506</v>
+<v>2508</v>
 </b>
 </bs>
 </hist>
@@ -18316,12 +18312,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10520</v>
+<v>10528</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2750</v>
+<v>2753</v>
 </b>
 <b>
 <a>3</a>
@@ -18342,7 +18338,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>877</v>
+<v>878</v>
 </b>
 <b>
 <a>2</a>
@@ -18352,7 +18348,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>1628</v>
+<v>1630</v>
 </b>
 <b>
 <a>4</a>
@@ -18383,7 +18379,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3970</v>
+<v>3973</v>
 </b>
 <b>
 <a>2</a>
@@ -18404,22 +18400,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1033</v>
+<v>1034</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>780</v>
+<v>781</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1663</v>
+<v>1664</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>6</a>
@@ -18440,7 +18436,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>877</v>
+<v>878</v>
 </b>
 <b>
 <a>2</a>
@@ -18450,7 +18446,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>1653</v>
+<v>1654</v>
 </b>
 <b>
 <a>4</a>
@@ -18476,7 +18472,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4106</v>
+<v>4110</v>
 </b>
 <b>
 <a>2</a>
@@ -18497,7 +18493,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4443</v>
+<v>4446</v>
 </b>
 </bs>
 </hist>
@@ -18513,7 +18509,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4106</v>
+<v>4110</v>
 </b>
 <b>
 <a>2</a>
@@ -18534,7 +18530,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4252</v>
+<v>4256</v>
 </b>
 <b>
 <a>2</a>
@@ -18549,15 +18545,15 @@
 </relation>
 <relation>
 <name>indexer_location</name>
-<cardinality>23806</cardinality>
+<cardinality>23899</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12621</v>
+<v>12715</v>
 </e>
 <e>
 <k>loc</k>
-<v>221</v>
+<v>220</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18571,12 +18567,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4407</v>
+<v>4499</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6696</v>
+<v>6699</v>
 </b>
 <b>
 <a>3</a>
@@ -18586,7 +18582,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>1116</v>
+<v>1115</v>
 </b>
 <b>
 <a>5</a>
@@ -18607,17 +18603,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76</v>
+<v>75</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23</v>
+<v>22</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>17</v>
+<v>18</v>
 </b>
 <b>
 <a>4</a>
@@ -18627,12 +18623,12 @@
 <b>
 <a>5</a>
 <b>8</b>
-<v>18</v>
+<v>17</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>16</v>
+<v>17</v>
 </b>
 <b>
 <a>13</a>
@@ -18642,17 +18638,17 @@
 <b>
 <a>23</a>
 <b>45</b>
-<v>17</v>
+<v>18</v>
 </b>
 <b>
 <a>47</a>
-<b>1552</b>
+<b>2441</b>
 <v>17</v>
 </b>
 <b>
-<a>2318</a>
-<b>5425</b>
-<v>4</v>
+<a>3540</a>
+<b>5342</b>
+<v>3</v>
 </b>
 </bs>
 </hist>
@@ -18662,11 +18658,11 @@
 </relation>
 <relation>
 <name>accessors</name>
-<cardinality>568633</cardinality>
+<cardinality>569109</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>568633</v>
+<v>569109</v>
 </e>
 <e>
 <k>kind</k>
@@ -18674,15 +18670,15 @@
 </e>
 <e>
 <k>name</k>
-<v>121408</v>
+<v>121509</v>
 </e>
 <e>
 <k>declaring_member_id</k>
-<v>441167</v>
+<v>441536</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>441016</v>
+<v>441385</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18696,7 +18692,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568633</v>
+<v>569109</v>
 </b>
 </bs>
 </hist>
@@ -18712,7 +18708,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568633</v>
+<v>569109</v>
 </b>
 </bs>
 </hist>
@@ -18728,7 +18724,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568633</v>
+<v>569109</v>
 </b>
 </bs>
 </hist>
@@ -18744,7 +18740,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>568633</v>
+<v>569109</v>
 </b>
 </bs>
 </hist>
@@ -18844,27 +18840,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75294</v>
+<v>75357</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19977</v>
+<v>19993</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7940</v>
+<v>7946</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10139</v>
+<v>10148</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8057</v>
+<v>8063</v>
 </b>
 </bs>
 </hist>
@@ -18880,7 +18876,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>121408</v>
+<v>121509</v>
 </b>
 </bs>
 </hist>
@@ -18896,27 +18892,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75304</v>
+<v>75367</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19967</v>
+<v>19983</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7940</v>
+<v>7946</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10139</v>
+<v>10148</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8057</v>
+<v>8063</v>
 </b>
 </bs>
 </hist>
@@ -18932,27 +18928,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75942</v>
+<v>76006</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20645</v>
+<v>20662</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7774</v>
+<v>7780</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>9666</v>
+<v>9674</v>
 </b>
 <b>
 <a>8</a>
 <b>1202</b>
-<v>7379</v>
+<v>7385</v>
 </b>
 </bs>
 </hist>
@@ -18968,12 +18964,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313711</v>
+<v>313974</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127451</v>
+<v>127557</v>
 </b>
 <b>
 <a>4</a>
@@ -18994,12 +18990,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313711</v>
+<v>313974</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127455</v>
+<v>127562</v>
 </b>
 </bs>
 </hist>
@@ -19015,12 +19011,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313711</v>
+<v>313974</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127455</v>
+<v>127562</v>
 </b>
 </bs>
 </hist>
@@ -19036,12 +19032,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313711</v>
+<v>313974</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127451</v>
+<v>127557</v>
 </b>
 <b>
 <a>4</a>
@@ -19062,12 +19058,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434344</v>
+<v>434707</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6672</v>
+<v>6677</v>
 </b>
 </bs>
 </hist>
@@ -19083,7 +19079,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441016</v>
+<v>441385</v>
 </b>
 </bs>
 </hist>
@@ -19099,7 +19095,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441016</v>
+<v>441385</v>
 </b>
 </bs>
 </hist>
@@ -19115,12 +19111,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434344</v>
+<v>434707</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6672</v>
+<v>6677</v>
 </b>
 </bs>
 </hist>
@@ -19141,15 +19137,15 @@
 </relation>
 <relation>
 <name>accessor_location</name>
-<cardinality>748772</cardinality>
+<cardinality>749399</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>568633</v>
+<v>569109</v>
 </e>
 <e>
 <k>loc</k>
-<v>93339</v>
+<v>93418</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19163,17 +19159,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>433290</v>
+<v>433653</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98538</v>
+<v>98621</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>36803</v>
+<v>36834</v>
 </b>
 </bs>
 </hist>
@@ -19189,12 +19185,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89730</v>
+<v>89805</v>
 </b>
 <b>
 <a>2</a>
 <b>8294</b>
-<v>3609</v>
+<v>3612</v>
 </b>
 </bs>
 </hist>
@@ -19204,27 +19200,27 @@
 </relation>
 <relation>
 <name>events</name>
-<cardinality>15251</cardinality>
+<cardinality>15263</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15251</v>
+<v>15263</v>
 </e>
 <e>
 <k>name</k>
-<v>13007</v>
+<v>13018</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>1229</v>
+<v>1230</v>
 </e>
 <e>
 <k>type_id</k>
-<v>6374</v>
+<v>6379</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>15241</v>
+<v>15254</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19238,7 +19234,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15251</v>
+<v>15263</v>
 </b>
 </bs>
 </hist>
@@ -19254,7 +19250,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15251</v>
+<v>15263</v>
 </b>
 </bs>
 </hist>
@@ -19270,7 +19266,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15251</v>
+<v>15263</v>
 </b>
 </bs>
 </hist>
@@ -19286,7 +19282,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15251</v>
+<v>15263</v>
 </b>
 </bs>
 </hist>
@@ -19302,12 +19298,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12017</v>
+<v>12027</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>980</v>
+<v>981</v>
 </b>
 <b>
 <a>14</a>
@@ -19328,12 +19324,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12017</v>
+<v>12027</v>
 </b>
 <b>
 <a>2</a>
 <b>10</b>
-<v>980</v>
+<v>981</v>
 </b>
 <b>
 <a>14</a>
@@ -19354,7 +19350,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12866</v>
+<v>12876</v>
 </b>
 <b>
 <a>2</a>
@@ -19375,12 +19371,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12017</v>
+<v>12027</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>980</v>
+<v>981</v>
 </b>
 <b>
 <a>14</a>
@@ -19447,7 +19443,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>3</a>
@@ -19483,12 +19479,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>770</v>
+<v>771</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>199</v>
+<v>200</v>
 </b>
 <b>
 <a>3</a>
@@ -19560,17 +19556,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4418</v>
+<v>4422</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1165</v>
+<v>1166</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>516</v>
+<v>517</v>
 </b>
 <b>
 <a>6</a>
@@ -19591,12 +19587,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4808</v>
+<v>4812</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>916</v>
+<v>917</v>
 </b>
 <b>
 <a>3</a>
@@ -19622,12 +19618,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5759</v>
+<v>5764</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>521</v>
+<v>522</v>
 </b>
 <b>
 <a>4</a>
@@ -19648,17 +19644,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4418</v>
+<v>4422</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1165</v>
+<v>1166</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>516</v>
+<v>517</v>
 </b>
 <b>
 <a>6</a>
@@ -19679,7 +19675,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15231</v>
+<v>15244</v>
 </b>
 <b>
 <a>2</a>
@@ -19700,7 +19696,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15241</v>
+<v>15254</v>
 </b>
 </bs>
 </hist>
@@ -19716,7 +19712,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15231</v>
+<v>15244</v>
 </b>
 <b>
 <a>2</a>
@@ -19737,7 +19733,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15231</v>
+<v>15244</v>
 </b>
 <b>
 <a>2</a>
@@ -19752,15 +19748,15 @@
 </relation>
 <relation>
 <name>event_location</name>
-<cardinality>15889</cardinality>
+<cardinality>15903</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15251</v>
+<v>15263</v>
 </e>
 <e>
 <k>loc</k>
-<v>326</v>
+<v>327</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19774,12 +19770,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14612</v>
+<v>14624</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>638</v>
+<v>639</v>
 </b>
 </bs>
 </hist>
@@ -19855,11 +19851,11 @@
 </relation>
 <relation>
 <name>event_accessors</name>
-<cardinality>30502</cardinality>
+<cardinality>30527</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30502</v>
+<v>30527</v>
 </e>
 <e>
 <k>kind</k>
@@ -19867,15 +19863,15 @@
 </e>
 <e>
 <k>name</k>
-<v>26727</v>
+<v>26749</v>
 </e>
 <e>
 <k>declaring_event_id</k>
-<v>15251</v>
+<v>15263</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>30482</v>
+<v>30508</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19889,7 +19885,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30502</v>
+<v>30527</v>
 </b>
 </bs>
 </hist>
@@ -19905,7 +19901,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30502</v>
+<v>30527</v>
 </b>
 </bs>
 </hist>
@@ -19921,7 +19917,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30502</v>
+<v>30527</v>
 </b>
 </bs>
 </hist>
@@ -19937,7 +19933,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30502</v>
+<v>30527</v>
 </b>
 </bs>
 </hist>
@@ -20017,12 +20013,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24737</v>
+<v>24757</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1989</v>
+<v>1991</v>
 </b>
 </bs>
 </hist>
@@ -20038,7 +20034,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26727</v>
+<v>26749</v>
 </b>
 </bs>
 </hist>
@@ -20054,12 +20050,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24737</v>
+<v>24757</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1989</v>
+<v>1991</v>
 </b>
 </bs>
 </hist>
@@ -20075,12 +20071,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24737</v>
+<v>24757</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1989</v>
+<v>1991</v>
 </b>
 </bs>
 </hist>
@@ -20096,7 +20092,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15251</v>
+<v>15263</v>
 </b>
 </bs>
 </hist>
@@ -20112,7 +20108,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15251</v>
+<v>15263</v>
 </b>
 </bs>
 </hist>
@@ -20128,7 +20124,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15251</v>
+<v>15263</v>
 </b>
 </bs>
 </hist>
@@ -20144,7 +20140,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15251</v>
+<v>15263</v>
 </b>
 </bs>
 </hist>
@@ -20160,7 +20156,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30463</v>
+<v>30488</v>
 </b>
 <b>
 <a>2</a>
@@ -20181,7 +20177,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30482</v>
+<v>30508</v>
 </b>
 </bs>
 </hist>
@@ -20197,7 +20193,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30482</v>
+<v>30508</v>
 </b>
 </bs>
 </hist>
@@ -20213,7 +20209,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30463</v>
+<v>30488</v>
 </b>
 <b>
 <a>2</a>
@@ -20228,15 +20224,15 @@
 </relation>
 <relation>
 <name>event_accessor_location</name>
-<cardinality>31779</cardinality>
+<cardinality>31806</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30502</v>
+<v>30527</v>
 </e>
 <e>
 <k>loc</k>
-<v>326</v>
+<v>327</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20250,12 +20246,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29224</v>
+<v>29248</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1277</v>
+<v>1278</v>
 </b>
 </bs>
 </hist>
@@ -20331,11 +20327,11 @@
 </relation>
 <relation>
 <name>operators</name>
-<cardinality>12427</cardinality>
+<cardinality>12437</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12427</v>
+<v>12437</v>
 </e>
 <e>
 <k>name</k>
@@ -20347,15 +20343,15 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>3028</v>
+<v>3031</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1624</v>
+<v>1625</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>11671</v>
+<v>11680</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20369,7 +20365,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12427</v>
+<v>12437</v>
 </b>
 </bs>
 </hist>
@@ -20385,7 +20381,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12427</v>
+<v>12437</v>
 </b>
 </bs>
 </hist>
@@ -20401,7 +20397,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12427</v>
+<v>12437</v>
 </b>
 </bs>
 </hist>
@@ -20417,7 +20413,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12427</v>
+<v>12437</v>
 </b>
 </bs>
 </hist>
@@ -20433,7 +20429,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12427</v>
+<v>12437</v>
 </b>
 </bs>
 </hist>
@@ -21059,7 +21055,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1570</v>
+<v>1571</v>
 </b>
 <b>
 <a>3</a>
@@ -21105,12 +21101,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1541</v>
+<v>1542</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>4</a>
@@ -21120,7 +21116,7 @@
 <b>
 <a>5</a>
 <b>10</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>10</a>
@@ -21146,12 +21142,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1546</v>
+<v>1547</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>4</a>
@@ -21182,7 +21178,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2024</v>
+<v>2025</v>
 </b>
 <b>
 <a>2</a>
@@ -21197,7 +21193,7 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>8</a>
@@ -21223,7 +21219,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1570</v>
+<v>1571</v>
 </b>
 <b>
 <a>3</a>
@@ -21264,7 +21260,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>794</v>
+<v>795</v>
 </b>
 <b>
 <a>2</a>
@@ -21274,7 +21270,7 @@
 <b>
 <a>3</a>
 <b>5</b>
-<v>121</v>
+<v>122</v>
 </b>
 <b>
 <a>5</a>
@@ -21305,7 +21301,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1209</v>
+<v>1210</v>
 </b>
 <b>
 <a>2</a>
@@ -21341,12 +21337,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1209</v>
+<v>1210</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>160</v>
+<v>161</v>
 </b>
 <b>
 <a>3</a>
@@ -21356,7 +21352,7 @@
 <b>
 <a>5</a>
 <b>14</b>
-<v>121</v>
+<v>122</v>
 </b>
 <b>
 <a>15</a>
@@ -21377,12 +21373,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1268</v>
+<v>1269</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>121</v>
+<v>122</v>
 </b>
 <b>
 <a>3</a>
@@ -21408,7 +21404,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>794</v>
+<v>795</v>
 </b>
 <b>
 <a>2</a>
@@ -21418,7 +21414,7 @@
 <b>
 <a>3</a>
 <b>5</b>
-<v>121</v>
+<v>122</v>
 </b>
 <b>
 <a>5</a>
@@ -21449,7 +21445,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11524</v>
+<v>11534</v>
 </b>
 <b>
 <a>2</a>
@@ -21470,7 +21466,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11671</v>
+<v>11680</v>
 </b>
 </bs>
 </hist>
@@ -21486,7 +21482,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11671</v>
+<v>11680</v>
 </b>
 </bs>
 </hist>
@@ -21502,7 +21498,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11524</v>
+<v>11534</v>
 </b>
 <b>
 <a>2</a>
@@ -21523,7 +21519,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11612</v>
+<v>11622</v>
 </b>
 <b>
 <a>2</a>
@@ -21538,15 +21534,15 @@
 </relation>
 <relation>
 <name>operator_location</name>
-<cardinality>22285</cardinality>
+<cardinality>22304</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>5643</v>
+<v>5648</v>
 </e>
 <e>
 <k>loc</k>
-<v>3162</v>
+<v>3165</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21560,17 +21556,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>840</v>
+<v>841</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3154</v>
+<v>3156</v>
 </b>
 <b>
 <a>3</a>
 <b>9</b>
-<v>386</v>
+<v>387</v>
 </b>
 <b>
 <a>9</a>
@@ -21580,7 +21576,7 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>582</v>
+<v>583</v>
 </b>
 <b>
 <a>12</a>
@@ -21601,7 +21597,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2772</v>
+<v>2774</v>
 </b>
 <b>
 <a>2</a>
@@ -21621,15 +21617,15 @@
 </relation>
 <relation>
 <name>constant_value</name>
-<cardinality>185601</cardinality>
+<cardinality>185757</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>185489</v>
+<v>185645</v>
 </e>
 <e>
 <k>value</k>
-<v>47918</v>
+<v>47958</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21643,7 +21639,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185377</v>
+<v>185532</v>
 </b>
 <b>
 <a>2</a>
@@ -21664,22 +21660,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32935</v>
+<v>32963</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7228</v>
+<v>7234</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3892</v>
+<v>3895</v>
 </b>
 <b>
 <a>4</a>
 <b>61</b>
-<v>3594</v>
+<v>3597</v>
 </b>
 <b>
 <a>61</a>
@@ -21694,27 +21690,27 @@
 </relation>
 <relation>
 <name>methods</name>
-<cardinality>1118142</cardinality>
+<cardinality>1119078</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1118142</v>
+<v>1119078</v>
 </e>
 <e>
 <k>name</k>
-<v>133771</v>
+<v>133883</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>202306</v>
+<v>202475</v>
 </e>
 <e>
 <k>type_id</k>
-<v>113029</v>
+<v>113123</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>697498</v>
+<v>698082</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21728,7 +21724,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118142</v>
+<v>1119078</v>
 </b>
 </bs>
 </hist>
@@ -21744,7 +21740,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118142</v>
+<v>1119078</v>
 </b>
 </bs>
 </hist>
@@ -21760,7 +21756,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118142</v>
+<v>1119078</v>
 </b>
 </bs>
 </hist>
@@ -21776,7 +21772,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1118142</v>
+<v>1119078</v>
 </b>
 </bs>
 </hist>
@@ -21792,32 +21788,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>69236</v>
+<v>69294</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23649</v>
+<v>23669</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10846</v>
+<v>10855</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10437</v>
+<v>10445</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>10583</v>
+<v>10592</v>
 </b>
 <b>
 <a>12</a>
 <b>5621</b>
-<v>9017</v>
+<v>9025</v>
 </b>
 </bs>
 </hist>
@@ -21833,32 +21829,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>79620</v>
+<v>79686</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19367</v>
+<v>19383</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11329</v>
+<v>11339</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>11061</v>
+<v>11070</v>
 </b>
 <b>
 <a>7</a>
 <b>33</b>
-<v>10120</v>
+<v>10128</v>
 </b>
 <b>
 <a>33</a>
 <b>4959</b>
-<v>2272</v>
+<v>2274</v>
 </b>
 </bs>
 </hist>
@@ -21874,17 +21870,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>113009</v>
+<v>113104</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10607</v>
+<v>10616</v>
 </b>
 <b>
 <a>3</a>
 <b>174</b>
-<v>10037</v>
+<v>10045</v>
 </b>
 <b>
 <a>177</a>
@@ -21905,32 +21901,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70977</v>
+<v>71037</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24517</v>
+<v>24538</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10920</v>
+<v>10929</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10734</v>
+<v>10743</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>10042</v>
+<v>10050</v>
 </b>
 <b>
 <a>12</a>
 <b>4958</b>
-<v>6579</v>
+<v>6584</v>
 </b>
 </bs>
 </hist>
@@ -21946,42 +21942,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>59804</v>
+<v>59854</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43041</v>
+<v>43077</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31336</v>
+<v>31362</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14270</v>
+<v>14282</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14807</v>
+<v>14819</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>16119</v>
+<v>16132</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>15675</v>
+<v>15688</v>
 </b>
 <b>
 <a>23</a>
 <b>1309</b>
-<v>7252</v>
+<v>7258</v>
 </b>
 </bs>
 </hist>
@@ -21997,37 +21993,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64876</v>
+<v>64930</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44728</v>
+<v>44766</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>34437</v>
+<v>34466</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18216</v>
+<v>18231</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>18182</v>
+<v>18197</v>
 </b>
 <b>
 <a>8</a>
 <b>18</b>
-<v>15270</v>
+<v>15283</v>
 </b>
 <b>
 <a>18</a>
 <b>457</b>
-<v>6593</v>
+<v>6599</v>
 </b>
 </bs>
 </hist>
@@ -22043,32 +22039,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97929</v>
+<v>98011</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48971</v>
+<v>49012</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22976</v>
+<v>22995</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11637</v>
+<v>11646</v>
 </b>
 <b>
 <a>5</a>
 <b>10</b>
-<v>15226</v>
+<v>15239</v>
 </b>
 <b>
 <a>10</a>
 <b>738</b>
-<v>5564</v>
+<v>5569</v>
 </b>
 </bs>
 </hist>
@@ -22084,42 +22080,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>59911</v>
+<v>59961</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43119</v>
+<v>43155</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31336</v>
+<v>31362</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14304</v>
+<v>14316</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14826</v>
+<v>14839</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>16036</v>
+<v>16049</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>16133</v>
+<v>16147</v>
 </b>
 <b>
 <a>23</a>
 <b>698</b>
-<v>6637</v>
+<v>6643</v>
 </b>
 </bs>
 </hist>
@@ -22135,27 +22131,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75538</v>
+<v>75601</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14499</v>
+<v>14512</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8320</v>
+<v>8327</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8837</v>
+<v>8844</v>
 </b>
 <b>
 <a>10</a>
 <b>62149</b>
-<v>5833</v>
+<v>5838</v>
 </b>
 </bs>
 </hist>
@@ -22171,22 +22167,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>91691</v>
+<v>91768</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9627</v>
+<v>9635</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8676</v>
+<v>8683</v>
 </b>
 <b>
 <a>8</a>
 <b>7666</b>
-<v>3033</v>
+<v>3036</v>
 </b>
 </bs>
 </hist>
@@ -22202,22 +22198,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87511</v>
+<v>87584</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13997</v>
+<v>14009</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8813</v>
+<v>8820</v>
 </b>
 <b>
 <a>8</a>
 <b>19632</b>
-<v>2706</v>
+<v>2709</v>
 </b>
 </bs>
 </hist>
@@ -22233,27 +22229,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75650</v>
+<v>75713</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14558</v>
+<v>14570</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8393</v>
+<v>8400</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8774</v>
+<v>8781</v>
 </b>
 <b>
 <a>10</a>
 <b>44480</b>
-<v>5652</v>
+<v>5657</v>
 </b>
 </bs>
 </hist>
@@ -22269,12 +22265,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>670629</v>
+<v>671191</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>26868</v>
+<v>26891</v>
 </b>
 </bs>
 </hist>
@@ -22290,7 +22286,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>697498</v>
+<v>698082</v>
 </b>
 </bs>
 </hist>
@@ -22306,12 +22302,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>672497</v>
+<v>673060</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>25000</v>
+<v>25021</v>
 </b>
 </bs>
 </hist>
@@ -22327,12 +22323,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>687119</v>
+<v>687694</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>10378</v>
+<v>10387</v>
 </b>
 </bs>
 </hist>
@@ -22342,15 +22338,15 @@
 </relation>
 <relation>
 <name>method_location</name>
-<cardinality>1282070</cardinality>
+<cardinality>1283143</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1118142</v>
+<v>1119078</v>
 </e>
 <e>
 <k>loc</k>
-<v>40885</v>
+<v>40919</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22364,17 +22360,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>987594</v>
+<v>988421</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98397</v>
+<v>98479</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>32150</v>
+<v>32177</v>
 </b>
 </bs>
 </hist>
@@ -22390,17 +22386,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36266</v>
+<v>36297</v>
 </b>
 <b>
 <a>2</a>
 <b>51</b>
-<v>3082</v>
+<v>3084</v>
 </b>
 <b>
 <a>51</a>
 <b>27729</b>
-<v>1536</v>
+<v>1537</v>
 </b>
 </bs>
 </hist>
@@ -22410,23 +22406,23 @@
 </relation>
 <relation>
 <name>constructors</name>
-<cardinality>278015</cardinality>
+<cardinality>278247</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>278015</v>
+<v>278247</v>
 </e>
 <e>
 <k>name</k>
-<v>133645</v>
+<v>133756</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>212265</v>
+<v>212443</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>223551</v>
+<v>223738</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22440,7 +22436,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278015</v>
+<v>278247</v>
 </b>
 </bs>
 </hist>
@@ -22456,7 +22452,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278015</v>
+<v>278247</v>
 </b>
 </bs>
 </hist>
@@ -22472,7 +22468,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278015</v>
+<v>278247</v>
 </b>
 </bs>
 </hist>
@@ -22488,22 +22484,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102323</v>
+<v>102409</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19196</v>
+<v>19212</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>10261</v>
+<v>10270</v>
 </b>
 <b>
 <a>8</a>
 <b>2183</b>
-<v>1863</v>
+<v>1864</v>
 </b>
 </bs>
 </hist>
@@ -22519,17 +22515,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>122647</v>
+<v>122749</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>10095</v>
+<v>10104</v>
 </b>
 <b>
 <a>11</a>
 <b>2183</b>
-<v>902</v>
+<v>903</v>
 </b>
 </bs>
 </hist>
@@ -22545,22 +22541,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>103206</v>
+<v>103292</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19352</v>
+<v>19368</v>
 </b>
 <b>
 <a>3</a>
 <b>10</b>
-<v>10100</v>
+<v>10109</v>
 </b>
 <b>
 <a>10</a>
 <b>2183</b>
-<v>985</v>
+<v>986</v>
 </b>
 </bs>
 </hist>
@@ -22576,17 +22572,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179554</v>
+<v>179704</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19777</v>
+<v>19793</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12934</v>
+<v>12945</v>
 </b>
 </bs>
 </hist>
@@ -22602,7 +22598,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212265</v>
+<v>212443</v>
 </b>
 </bs>
 </hist>
@@ -22618,17 +22614,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179554</v>
+<v>179704</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19777</v>
+<v>19793</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12934</v>
+<v>12945</v>
 </b>
 </bs>
 </hist>
@@ -22644,12 +22640,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>221117</v>
+<v>221302</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2433</v>
+<v>2435</v>
 </b>
 </bs>
 </hist>
@@ -22665,7 +22661,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>223551</v>
+<v>223738</v>
 </b>
 </bs>
 </hist>
@@ -22681,12 +22677,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>221117</v>
+<v>221302</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2433</v>
+<v>2435</v>
 </b>
 </bs>
 </hist>
@@ -22696,15 +22692,15 @@
 </relation>
 <relation>
 <name>constructor_location</name>
-<cardinality>321870</cardinality>
+<cardinality>322140</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>278015</v>
+<v>278247</v>
 </e>
 <e>
 <k>loc</k>
-<v>24805</v>
+<v>24826</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22718,17 +22714,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>238641</v>
+<v>238841</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37622</v>
+<v>37654</v>
 </b>
 <b>
 <a>3</a>
 <b>87</b>
-<v>1750</v>
+<v>1752</v>
 </b>
 </bs>
 </hist>
@@ -22744,22 +22740,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19025</v>
+<v>19041</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3184</v>
+<v>3187</v>
 </b>
 <b>
 <a>3</a>
 <b>59</b>
-<v>1867</v>
+<v>1869</v>
 </b>
 <b>
 <a>59</a>
 <b>4796</b>
-<v>726</v>
+<v>727</v>
 </b>
 </bs>
 </hist>
@@ -22769,11 +22765,11 @@
 </relation>
 <relation>
 <name>destructors</name>
-<cardinality>443</cardinality>
+<cardinality>444</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>443</v>
+<v>444</v>
 </e>
 <e>
 <k>name</k>
@@ -22781,7 +22777,7 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>443</v>
+<v>444</v>
 </e>
 <e>
 <k>unbound_id</k>
@@ -22799,7 +22795,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>443</v>
+<v>444</v>
 </b>
 </bs>
 </hist>
@@ -22815,7 +22811,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>443</v>
+<v>444</v>
 </b>
 </bs>
 </hist>
@@ -22831,7 +22827,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>443</v>
+<v>444</v>
 </b>
 </bs>
 </hist>
@@ -22889,7 +22885,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>399</v>
+<v>400</v>
 </b>
 <b>
 <a>2</a>
@@ -22910,7 +22906,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>443</v>
+<v>444</v>
 </b>
 </bs>
 </hist>
@@ -22926,7 +22922,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>443</v>
+<v>444</v>
 </b>
 </bs>
 </hist>
@@ -22942,7 +22938,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>443</v>
+<v>444</v>
 </b>
 </bs>
 </hist>
@@ -23098,7 +23094,7 @@
 <b>
 <a>3</a>
 <b>5</b>
-<v>27</v>
+<v>28</v>
 </b>
 <b>
 <a>5</a>
@@ -23113,15 +23109,15 @@
 </relation>
 <relation>
 <name>overrides</name>
-<cardinality>274298</cardinality>
+<cardinality>274528</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>274274</v>
+<v>274503</v>
 </e>
 <e>
 <k>base_id</k>
-<v>65491</v>
+<v>65545</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23135,7 +23131,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>274249</v>
+<v>274479</v>
 </b>
 <b>
 <a>2</a>
@@ -23156,27 +23152,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40305</v>
+<v>40338</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10485</v>
+<v>10494</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4291</v>
+<v>4295</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>5345</v>
+<v>5349</v>
 </b>
 <b>
 <a>7</a>
 <b>184</b>
-<v>4916</v>
+<v>4920</v>
 </b>
 <b>
 <a>215</a>
@@ -23191,15 +23187,15 @@
 </relation>
 <relation>
 <name>explicitly_implements</name>
-<cardinality>156153</cardinality>
+<cardinality>156284</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>156153</v>
+<v>156284</v>
 </e>
 <e>
 <k>interface_id</k>
-<v>13300</v>
+<v>13311</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23213,7 +23209,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>156153</v>
+<v>156284</v>
 </b>
 </bs>
 </hist>
@@ -23229,17 +23225,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6779</v>
+<v>6784</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2492</v>
+<v>2494</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1185</v>
+<v>1186</v>
 </b>
 <b>
 <a>4</a>
@@ -23249,12 +23245,12 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>1209</v>
+<v>1210</v>
 </b>
 <b>
 <a>7</a>
 <b>58</b>
-<v>999</v>
+<v>1000</v>
 </b>
 <b>
 <a>58</a>
@@ -23618,11 +23614,11 @@
 </relation>
 <relation>
 <name>fields</name>
-<cardinality>556435</cardinality>
+<cardinality>556900</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>556435</v>
+<v>556900</v>
 </e>
 <e>
 <k>kind</k>
@@ -23630,19 +23626,19 @@
 </e>
 <e>
 <k>name</k>
-<v>218513</v>
+<v>218696</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>103718</v>
+<v>103805</v>
 </e>
 <e>
 <k>type_id</k>
-<v>89633</v>
+<v>89708</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>548729</v>
+<v>549188</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23656,7 +23652,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556435</v>
+<v>556900</v>
 </b>
 </bs>
 </hist>
@@ -23672,7 +23668,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556435</v>
+<v>556900</v>
 </b>
 </bs>
 </hist>
@@ -23688,7 +23684,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556435</v>
+<v>556900</v>
 </b>
 </bs>
 </hist>
@@ -23704,7 +23700,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556435</v>
+<v>556900</v>
 </b>
 </bs>
 </hist>
@@ -23720,7 +23716,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556435</v>
+<v>556900</v>
 </b>
 </bs>
 </hist>
@@ -23841,22 +23837,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176408</v>
+<v>176556</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22596</v>
+<v>22614</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>16577</v>
+<v>16591</v>
 </b>
 <b>
 <a>14</a>
 <b>4800</b>
-<v>2931</v>
+<v>2933</v>
 </b>
 </bs>
 </hist>
@@ -23872,12 +23868,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>209144</v>
+<v>209319</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9369</v>
+<v>9376</v>
 </b>
 </bs>
 </hist>
@@ -23893,64 +23889,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176432</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>22581</v>
-</b>
-<b>
-<a>3</a>
-<b>14</b>
-<v>16567</v>
-</b>
-<b>
-<a>14</a>
-<b>4800</b>
-<v>2931</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>188933</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>17679</v>
-</b>
-<b>
-<a>3</a>
-<b>2459</b>
-<v>11900</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>unbound_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>176798</v>
+<v>176580</v>
 </b>
 <b>
 <a>2</a>
@@ -23959,13 +23898,70 @@
 </b>
 <b>
 <a>3</a>
+<b>14</b>
+<v>16581</v>
+</b>
+<b>
+<a>14</a>
+<b>4800</b>
+<v>2933</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>189091</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>17694</v>
+</b>
+<b>
+<a>3</a>
+<b>2459</b>
+<v>11910</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>unbound_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>176946</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>22619</v>
+</b>
+<b>
+<a>3</a>
 <b>15</b>
-<v>16494</v>
+<v>16508</v>
 </b>
 <b>
 <a>15</a>
 <b>4800</b>
-<v>2619</v>
+<v>2621</v>
 </b>
 </bs>
 </hist>
@@ -23981,42 +23977,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27356</v>
+<v>27379</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21176</v>
+<v>21194</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12588</v>
+<v>12598</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10115</v>
+<v>10123</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7944</v>
+<v>7951</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9286</v>
+<v>9293</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8159</v>
+<v>8166</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7091</v>
+<v>7097</v>
 </b>
 </bs>
 </hist>
@@ -24032,12 +24028,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102626</v>
+<v>102712</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1092</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -24053,42 +24049,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27356</v>
+<v>27379</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21181</v>
+<v>21199</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12592</v>
+<v>12603</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10110</v>
+<v>10118</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7944</v>
+<v>7951</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9291</v>
+<v>9298</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8159</v>
+<v>8166</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7081</v>
+<v>7087</v>
 </b>
 </bs>
 </hist>
@@ -24104,37 +24100,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44587</v>
+<v>44624</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21230</v>
+<v>21248</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>9447</v>
+<v>9455</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7374</v>
+<v>7380</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>6169</v>
+<v>6174</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>9603</v>
+<v>9611</v>
 </b>
 <b>
 <a>9</a>
 <b>132</b>
-<v>5306</v>
+<v>5310</v>
 </b>
 </bs>
 </hist>
@@ -24150,42 +24146,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27356</v>
+<v>27379</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21176</v>
+<v>21194</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12588</v>
+<v>12598</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10115</v>
+<v>10123</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7944</v>
+<v>7951</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9286</v>
+<v>9293</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8159</v>
+<v>8166</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7091</v>
+<v>7097</v>
 </b>
 </bs>
 </hist>
@@ -24201,32 +24197,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55873</v>
+<v>55920</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10895</v>
+<v>10904</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6218</v>
+<v>6223</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7979</v>
+<v>7985</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>6798</v>
+<v>6804</v>
 </b>
 <b>
 <a>27</a>
 <b>9290</b>
-<v>1867</v>
+<v>1869</v>
 </b>
 </bs>
 </hist>
@@ -24242,12 +24238,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87433</v>
+<v>87506</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2199</v>
+<v>2201</v>
 </b>
 </bs>
 </hist>
@@ -24263,27 +24259,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>63813</v>
+<v>63866</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9330</v>
+<v>9337</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>7896</v>
+<v>7902</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>6847</v>
+<v>6853</v>
 </b>
 <b>
 <a>18</a>
 <b>5213</b>
-<v>1746</v>
+<v>1747</v>
 </b>
 </bs>
 </hist>
@@ -24299,22 +24295,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68402</v>
+<v>68460</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10051</v>
+<v>10060</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>7242</v>
+<v>7248</v>
 </b>
 <b>
 <a>7</a>
 <b>5746</b>
-<v>3935</v>
+<v>3939</v>
 </b>
 </bs>
 </hist>
@@ -24330,32 +24326,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55917</v>
+<v>55963</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11222</v>
+<v>11231</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5930</v>
+<v>5935</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7954</v>
+<v>7961</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>6754</v>
+<v>6760</v>
 </b>
 <b>
 <a>27</a>
 <b>9185</b>
-<v>1853</v>
+<v>1854</v>
 </b>
 </bs>
 </hist>
@@ -24371,7 +24367,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>547817</v>
+<v>548275</v>
 </b>
 <b>
 <a>2</a>
@@ -24392,7 +24388,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548729</v>
+<v>549188</v>
 </b>
 </bs>
 </hist>
@@ -24408,7 +24404,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548729</v>
+<v>549188</v>
 </b>
 </bs>
 </hist>
@@ -24424,7 +24420,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>547817</v>
+<v>548275</v>
 </b>
 <b>
 <a>2</a>
@@ -24445,7 +24441,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548231</v>
+<v>548690</v>
 </b>
 <b>
 <a>2</a>
@@ -24460,15 +24456,15 @@
 </relation>
 <relation>
 <name>field_location</name>
-<cardinality>637299</cardinality>
+<cardinality>637832</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>549060</v>
+<v>549520</v>
 </e>
 <e>
 <k>loc</k>
-<v>52917</v>
+<v>52961</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24482,17 +24478,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>466845</v>
+<v>467236</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>78201</v>
+<v>78266</v>
 </b>
 <b>
 <a>3</a>
 <b>57</b>
-<v>4013</v>
+<v>4017</v>
 </b>
 </bs>
 </hist>
@@ -24508,12 +24504,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49406</v>
+<v>49447</v>
 </b>
 <b>
 <a>2</a>
 <b>8882</b>
-<v>3511</v>
+<v>3514</v>
 </b>
 </bs>
 </hist>
@@ -24523,11 +24519,11 @@
 </relation>
 <relation>
 <name>localvars</name>
-<cardinality>163706</cardinality>
+<cardinality>163704</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163706</v>
+<v>163704</v>
 </e>
 <e>
 <k>kind</k>
@@ -24535,7 +24531,7 @@
 </e>
 <e>
 <k>name</k>
-<v>22595</v>
+<v>22594</v>
 </e>
 <e>
 <k>implicitly_typed</k>
@@ -24547,7 +24543,7 @@
 </e>
 <e>
 <k>parent_id</k>
-<v>163706</v>
+<v>163704</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24561,7 +24557,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -24577,7 +24573,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -24593,7 +24589,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -24609,7 +24605,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -24625,7 +24621,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -24649,8 +24645,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162452</a>
-<b>162453</b>
+<a>162450</a>
+<b>162451</b>
 <v>1</v>
 </b>
 </bs>
@@ -24675,8 +24671,8 @@
 <v>1</v>
 </b>
 <b>
-<a>22382</a>
-<b>22383</b>
+<a>22381</a>
+<b>22382</b>
 <v>1</v>
 </b>
 </bs>
@@ -24748,8 +24744,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162887</a>
-<b>162888</b>
+<a>162885</a>
+<b>162886</b>
 <v>1</v>
 </b>
 </bs>
@@ -24771,7 +24767,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3484</v>
+<v>3483</v>
 </b>
 <b>
 <a>3</a>
@@ -24802,7 +24798,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22503</v>
+<v>22502</v>
 </b>
 <b>
 <a>2</a>
@@ -24823,7 +24819,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19935</v>
+<v>19934</v>
 </b>
 <b>
 <a>2</a>
@@ -24844,7 +24840,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19225</v>
+<v>19224</v>
 </b>
 <b>
 <a>2</a>
@@ -24875,7 +24871,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3502</v>
+<v>3501</v>
 </b>
 <b>
 <a>3</a>
@@ -24904,13 +24900,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36624</a>
-<b>36625</b>
+<a>36623</a>
+<b>36624</b>
 <v>1</v>
 </b>
 <b>
-<a>126645</a>
-<b>126646</b>
+<a>126644</a>
+<b>126645</b>
 <v>1</v>
 </b>
 </bs>
@@ -24951,8 +24947,8 @@
 <v>1</v>
 </b>
 <b>
-<a>16706</a>
-<b>16707</b>
+<a>16705</a>
+<b>16706</b>
 <v>1</v>
 </b>
 </bs>
@@ -24988,13 +24984,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36773</a>
-<b>36774</b>
+<a>36772</a>
+<b>36773</b>
 <v>1</v>
 </b>
 <b>
-<a>126933</a>
-<b>126934</b>
+<a>126932</a>
+<b>126933</b>
 <v>1</v>
 </b>
 </bs>
@@ -25040,7 +25036,7 @@
 </b>
 <b>
 <a>35</a>
-<b>37236</b>
+<b>37235</b>
 <v>317</v>
 </b>
 </bs>
@@ -25102,7 +25098,7 @@
 </b>
 <b>
 <a>49</a>
-<b>1942</b>
+<b>1941</b>
 <v>84</v>
 </b>
 </bs>
@@ -25169,7 +25165,7 @@
 </b>
 <b>
 <a>35</a>
-<b>37241</b>
+<b>37240</b>
 <v>319</v>
 </b>
 </bs>
@@ -25186,7 +25182,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -25202,7 +25198,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -25218,7 +25214,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -25234,7 +25230,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -25250,7 +25246,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163706</v>
+<v>163704</v>
 </b>
 </bs>
 </hist>
@@ -25260,15 +25256,15 @@
 </relation>
 <relation>
 <name>localvar_location</name>
-<cardinality>163269</cardinality>
+<cardinality>163267</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163269</v>
+<v>163267</v>
 </e>
 <e>
 <k>loc</k>
-<v>163189</v>
+<v>163187</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25282,7 +25278,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163269</v>
+<v>163267</v>
 </b>
 </bs>
 </hist>
@@ -25298,7 +25294,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163109</v>
+<v>163107</v>
 </b>
 <b>
 <a>2</a>
@@ -25313,23 +25309,23 @@
 </relation>
 <relation>
 <name>params</name>
-<cardinality>2420706</cardinality>
+<cardinality>2422733</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2420706</v>
+<v>2422733</v>
 </e>
 <e>
 <k>name</k>
-<v>80917</v>
+<v>80985</v>
 </e>
 <e>
 <k>type_id</k>
-<v>331020</v>
+<v>331297</v>
 </e>
 <e>
 <k>index</k>
-<v>199</v>
+<v>200</v>
 </e>
 <e>
 <k>mode</k>
@@ -25337,11 +25333,11 @@
 </e>
 <e>
 <k>parent_id</k>
-<v>1371444</v>
+<v>1372592</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>1436887</v>
+<v>1438090</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25355,7 +25351,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2420706</v>
+<v>2422733</v>
 </b>
 </bs>
 </hist>
@@ -25371,7 +25367,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2420706</v>
+<v>2422733</v>
 </b>
 </bs>
 </hist>
@@ -25387,7 +25383,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2420706</v>
+<v>2422733</v>
 </b>
 </bs>
 </hist>
@@ -25403,7 +25399,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2420706</v>
+<v>2422733</v>
 </b>
 </bs>
 </hist>
@@ -25419,7 +25415,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2420706</v>
+<v>2422733</v>
 </b>
 </bs>
 </hist>
@@ -25435,7 +25431,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2420706</v>
+<v>2422733</v>
 </b>
 </bs>
 </hist>
@@ -25451,42 +25447,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31155</v>
+<v>31181</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13870</v>
+<v>13882</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7067</v>
+<v>7072</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4843</v>
+<v>4847</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6657</v>
+<v>6662</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6906</v>
+<v>6911</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6086</v>
+<v>6091</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4330</v>
+<v>4334</v>
 </b>
 </bs>
 </hist>
@@ -25502,22 +25498,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64296</v>
+<v>64349</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8169</v>
+<v>8176</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>6179</v>
+<v>6184</v>
 </b>
 <b>
 <a>12</a>
 <b>6855</b>
-<v>2272</v>
+<v>2274</v>
 </b>
 </bs>
 </hist>
@@ -25533,22 +25529,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55078</v>
+<v>55124</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14582</v>
+<v>14595</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5520</v>
+<v>5525</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>5735</v>
+<v>5740</v>
 </b>
 </bs>
 </hist>
@@ -25564,12 +25560,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75879</v>
+<v>75943</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>5038</v>
+<v>5042</v>
 </b>
 </bs>
 </hist>
@@ -25585,42 +25581,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31155</v>
+<v>31181</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13870</v>
+<v>13882</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7067</v>
+<v>7072</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4843</v>
+<v>4847</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6657</v>
+<v>6662</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6906</v>
+<v>6911</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6086</v>
+<v>6091</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4330</v>
+<v>4334</v>
 </b>
 </bs>
 </hist>
@@ -25636,42 +25632,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31545</v>
+<v>31572</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14099</v>
+<v>14111</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7081</v>
+<v>7087</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4960</v>
+<v>4964</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6486</v>
+<v>6492</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6920</v>
+<v>6926</v>
 </b>
 <b>
 <a>13</a>
 <b>43</b>
-<v>6159</v>
+<v>6165</v>
 </b>
 <b>
 <a>43</a>
 <b>36753</b>
-<v>3662</v>
+<v>3665</v>
 </b>
 </bs>
 </hist>
@@ -25687,27 +25683,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>227867</v>
+<v>228058</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>38993</v>
+<v>39025</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30121</v>
+<v>30146</v>
 </b>
 <b>
 <a>6</a>
 <b>24</b>
-<v>25093</v>
+<v>25114</v>
 </b>
 <b>
 <a>24</a>
 <b>48952</b>
-<v>8944</v>
+<v>8952</v>
 </b>
 </bs>
 </hist>
@@ -25723,17 +25719,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>289476</v>
+<v>289718</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>30531</v>
+<v>30556</v>
 </b>
 <b>
 <a>4</a>
 <b>2470</b>
-<v>11012</v>
+<v>11021</v>
 </b>
 </bs>
 </hist>
@@ -25749,17 +25745,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>292544</v>
+<v>292789</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25107</v>
+<v>25128</v>
 </b>
 <b>
 <a>3</a>
 <b>36</b>
-<v>13368</v>
+<v>13379</v>
 </b>
 </bs>
 </hist>
@@ -25775,12 +25771,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>322300</v>
+<v>322569</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>8720</v>
+<v>8727</v>
 </b>
 </bs>
 </hist>
@@ -25796,27 +25792,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>230369</v>
+<v>230562</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37032</v>
+<v>37063</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30536</v>
+<v>30561</v>
 </b>
 <b>
 <a>6</a>
 <b>25</b>
-<v>25054</v>
+<v>25075</v>
 </b>
 <b>
 <a>25</a>
 <b>40409</b>
-<v>8027</v>
+<v>8034</v>
 </b>
 </bs>
 </hist>
@@ -25832,27 +25828,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>233564</v>
+<v>233759</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34950</v>
+<v>34979</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>25776</v>
+<v>25797</v>
 </b>
 <b>
 <a>5</a>
 <b>16</b>
-<v>25341</v>
+<v>25363</v>
 </b>
 <b>
 <a>16</a>
 <b>33990</b>
-<v>11388</v>
+<v>11397</v>
 </b>
 </bs>
 </hist>
@@ -26550,22 +26546,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>805591</v>
+<v>806266</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333083</v>
+<v>333362</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129362</v>
+<v>129471</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102894</v>
+<v>102980</v>
 </b>
 <b>
 <a>17</a>
@@ -26586,22 +26582,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>805591</v>
+<v>806266</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333083</v>
+<v>333362</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129362</v>
+<v>129471</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102894</v>
+<v>102980</v>
 </b>
 <b>
 <a>17</a>
@@ -26622,22 +26618,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>855207</v>
+<v>855923</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333381</v>
+<v>333660</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>113429</v>
+<v>113524</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>69426</v>
+<v>69485</v>
 </b>
 </bs>
 </hist>
@@ -26653,22 +26649,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>805591</v>
+<v>806266</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333083</v>
+<v>333362</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129362</v>
+<v>129471</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102894</v>
+<v>102980</v>
 </b>
 <b>
 <a>17</a>
@@ -26689,12 +26685,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1302847</v>
+<v>1303937</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>68597</v>
+<v>68655</v>
 </b>
 </bs>
 </hist>
@@ -26710,22 +26706,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>805591</v>
+<v>806266</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333083</v>
+<v>333362</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129362</v>
+<v>129471</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102894</v>
+<v>102980</v>
 </b>
 <b>
 <a>17</a>
@@ -26746,12 +26742,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1386539</v>
+<v>1387700</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50347</v>
+<v>50389</v>
 </b>
 </bs>
 </hist>
@@ -26767,7 +26763,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1436887</v>
+<v>1438090</v>
 </b>
 </bs>
 </hist>
@@ -26783,12 +26779,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1418758</v>
+<v>1419946</v>
 </b>
 <b>
 <a>2</a>
 <b>3718</b>
-<v>18128</v>
+<v>18143</v>
 </b>
 </bs>
 </hist>
@@ -26804,7 +26800,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1436887</v>
+<v>1438090</v>
 </b>
 </bs>
 </hist>
@@ -26820,7 +26816,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1436887</v>
+<v>1438090</v>
 </b>
 </bs>
 </hist>
@@ -26836,12 +26832,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1386539</v>
+<v>1387700</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50347</v>
+<v>50389</v>
 </b>
 </bs>
 </hist>
@@ -26851,15 +26847,15 @@
 </relation>
 <relation>
 <name>param_location</name>
-<cardinality>2690693</cardinality>
+<cardinality>2692946</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2417009</v>
+<v>2419033</v>
 </e>
 <e>
 <k>loc</k>
-<v>137722</v>
+<v>137837</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -26873,17 +26869,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2153533</v>
+<v>2155336</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>256662</v>
+<v>256877</v>
 </b>
 <b>
 <a>3</a>
 <b>60</b>
-<v>6813</v>
+<v>6819</v>
 </b>
 </bs>
 </hist>
@@ -26899,12 +26895,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133396</v>
+<v>133508</v>
 </b>
 <b>
 <a>2</a>
 <b>99581</b>
-<v>4326</v>
+<v>4329</v>
 </b>
 </bs>
 </hist>
@@ -26914,11 +26910,11 @@
 </relation>
 <relation>
 <name>statements</name>
-<cardinality>991182</cardinality>
+<cardinality>992012</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>991182</v>
+<v>992012</v>
 </e>
 <e>
 <k>kind</k>
@@ -26936,7 +26932,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>991182</v>
+<v>992012</v>
 </b>
 </bs>
 </hist>
@@ -27037,11 +27033,11 @@
 </relation>
 <relation>
 <name>stmt_parent</name>
-<cardinality>819587</cardinality>
+<cardinality>820273</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>819587</v>
+<v>820273</v>
 </e>
 <e>
 <k>index</k>
@@ -27049,7 +27045,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>434183</v>
+<v>434546</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27063,7 +27059,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>819587</v>
+<v>820273</v>
 </b>
 </bs>
 </hist>
@@ -27079,7 +27075,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>819587</v>
+<v>820273</v>
 </b>
 </bs>
 </hist>
@@ -27095,7 +27091,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>111</v>
+<v>112</v>
 </b>
 <b>
 <a>2</a>
@@ -27166,7 +27162,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>111</v>
+<v>112</v>
 </b>
 <b>
 <a>2</a>
@@ -27237,22 +27233,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>293419</v>
+<v>293665</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>75308</v>
+<v>75371</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>38106</v>
+<v>38138</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27349</v>
+<v>27372</v>
 </b>
 </bs>
 </hist>
@@ -27268,22 +27264,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>293419</v>
+<v>293665</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>75308</v>
+<v>75371</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>38106</v>
+<v>38138</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27349</v>
+<v>27372</v>
 </b>
 </bs>
 </hist>
@@ -27293,11 +27289,11 @@
 </relation>
 <relation>
 <name>stmt_parent_top_level</name>
-<cardinality>171595</cardinality>
+<cardinality>171739</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>171595</v>
+<v>171739</v>
 </e>
 <e>
 <k>index</k>
@@ -27305,7 +27301,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>123110</v>
+<v>123213</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27319,7 +27315,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171595</v>
+<v>171739</v>
 </b>
 </bs>
 </hist>
@@ -27335,7 +27331,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171595</v>
+<v>171739</v>
 </b>
 </bs>
 </hist>
@@ -27383,17 +27379,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>77099</v>
+<v>77164</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43641</v>
+<v>43678</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2369</v>
+<v>2371</v>
 </b>
 </bs>
 </hist>
@@ -27409,7 +27405,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>123110</v>
+<v>123213</v>
 </b>
 </bs>
 </hist>
@@ -27419,15 +27415,15 @@
 </relation>
 <relation>
 <name>stmt_location</name>
-<cardinality>991182</cardinality>
+<cardinality>992012</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>991182</v>
+<v>992012</v>
 </e>
 <e>
 <k>loc</k>
-<v>959540</v>
+<v>960344</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27441,7 +27437,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>991182</v>
+<v>992012</v>
 </b>
 </bs>
 </hist>
@@ -27457,12 +27453,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>927898</v>
+<v>928675</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31642</v>
+<v>31668</v>
 </b>
 </bs>
 </hist>
@@ -27472,11 +27468,11 @@
 </relation>
 <relation>
 <name>catch_type</name>
-<cardinality>3438</cardinality>
+<cardinality>3441</cardinality>
 <columnsizes>
 <e>
 <k>catch_id</k>
-<v>3438</v>
+<v>3441</v>
 </e>
 <e>
 <k>type_id</k>
@@ -27498,7 +27494,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3438</v>
+<v>3441</v>
 </b>
 </bs>
 </hist>
@@ -27514,7 +27510,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3438</v>
+<v>3441</v>
 </b>
 </bs>
 </hist>
@@ -27638,19 +27634,19 @@
 </relation>
 <relation>
 <name>expressions</name>
-<cardinality>4259646</cardinality>
+<cardinality>4263212</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4259646</v>
+<v>4263212</v>
 </e>
 <e>
 <k>kind</k>
-<v>404</v>
+<v>405</v>
 </e>
 <e>
 <k>type_id</k>
-<v>70397</v>
+<v>70456</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27664,7 +27660,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4259646</v>
+<v>4263212</v>
 </b>
 </bs>
 </hist>
@@ -27680,7 +27676,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4259646</v>
+<v>4263212</v>
 </b>
 </bs>
 </hist>
@@ -27828,47 +27824,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12851</v>
+<v>12862</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21664</v>
+<v>21682</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3340</v>
+<v>3343</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5603</v>
+<v>5608</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>5618</v>
+<v>5623</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>5594</v>
+<v>5598</v>
 </b>
 <b>
 <a>11</a>
 <b>20</b>
-<v>5550</v>
+<v>5554</v>
 </b>
 <b>
 <a>20</a>
 <b>51</b>
-<v>5316</v>
+<v>5320</v>
 </b>
 <b>
 <a>51</a>
 <b>139941</b>
-<v>4857</v>
+<v>4861</v>
 </b>
 </bs>
 </hist>
@@ -27884,27 +27880,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31223</v>
+<v>31249</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24976</v>
+<v>24997</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5277</v>
+<v>5281</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>5111</v>
+<v>5115</v>
 </b>
 <b>
 <a>6</a>
 <b>34</b>
-<v>3809</v>
+<v>3812</v>
 </b>
 </bs>
 </hist>
@@ -27914,19 +27910,19 @@
 </relation>
 <relation>
 <name>expr_parent</name>
-<cardinality>3937895</cardinality>
+<cardinality>3941191</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>3937895</v>
+<v>3941191</v>
 </e>
 <e>
 <k>index</k>
-<v>79758</v>
+<v>79825</v>
 </e>
 <e>
 <k>parent</k>
-<v>2585040</v>
+<v>2587204</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27940,7 +27936,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3937895</v>
+<v>3941191</v>
 </b>
 </bs>
 </hist>
@@ -27956,7 +27952,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3937895</v>
+<v>3941191</v>
 </b>
 </bs>
 </hist>
@@ -27972,22 +27968,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66144</v>
+<v>66199</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6192</v>
+<v>6197</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6036</v>
+<v>6041</v>
 </b>
 <b>
 <a>13</a>
 <b>1629954</b>
-<v>1384</v>
+<v>1385</v>
 </b>
 </bs>
 </hist>
@@ -28003,22 +27999,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66144</v>
+<v>66199</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6192</v>
+<v>6197</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6036</v>
+<v>6041</v>
 </b>
 <b>
 <a>13</a>
 <b>1629954</b>
-<v>1384</v>
+<v>1385</v>
 </b>
 </bs>
 </hist>
@@ -28034,17 +28030,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1622839</v>
+<v>1624198</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>832946</v>
+<v>833643</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>129254</v>
+<v>129362</v>
 </b>
 </bs>
 </hist>
@@ -28060,17 +28056,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1622839</v>
+<v>1624198</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>832946</v>
+<v>833643</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>129254</v>
+<v>129362</v>
 </b>
 </bs>
 </hist>
@@ -28080,11 +28076,11 @@
 </relation>
 <relation>
 <name>expr_parent_top_level</name>
-<cardinality>504488</cardinality>
+<cardinality>504910</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>504488</v>
+<v>504910</v>
 </e>
 <e>
 <k>index</k>
@@ -28092,7 +28088,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>436202</v>
+<v>436567</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28106,7 +28102,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>504488</v>
+<v>504910</v>
 </b>
 </bs>
 </hist>
@@ -28122,7 +28118,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>504488</v>
+<v>504910</v>
 </b>
 </bs>
 </hist>
@@ -28250,17 +28246,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396126</v>
+<v>396457</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35705</v>
+<v>35735</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4369</v>
+<v>4373</v>
 </b>
 </bs>
 </hist>
@@ -28276,17 +28272,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396306</v>
+<v>396638</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35584</v>
+<v>35613</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4311</v>
+<v>4315</v>
 </b>
 </bs>
 </hist>
@@ -28307,11 +28303,11 @@
 </relation>
 <relation>
 <name>explicitly_sized_array_creation</name>
-<cardinality>4355</cardinality>
+<cardinality>4358</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4355</v>
+<v>4358</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -28388,22 +28384,22 @@
 </relation>
 <relation>
 <name>expr_compiler_generated</name>
-<cardinality>1635891</cardinality>
+<cardinality>1637261</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1635891</v>
+<v>1637261</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_value</name>
-<cardinality>1401346</cardinality>
+<cardinality>1404079</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1401346</v>
+<v>1404079</v>
 </e>
 <e>
 <k>value</k>
@@ -28421,7 +28417,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1401346</v>
+<v>1404079</v>
 </b>
 </bs>
 </hist>
@@ -28437,27 +28433,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72269</v>
+<v>72271</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14980</v>
+<v>14976</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>7877</v>
+<v>7876</v>
 </b>
 <b>
 <a>6</a>
-<b>2295</b>
+<b>2137</b>
 <v>7716</v>
 </b>
 <b>
-<a>2344</a>
-<b>270846</b>
-<v>35</v>
+<a>2251</a>
+<b>272752</b>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -28467,11 +28463,11 @@
 </relation>
 <relation>
 <name>expr_call</name>
-<cardinality>679354</cardinality>
+<cardinality>679346</cardinality>
 <columnsizes>
 <e>
 <k>caller_id</k>
-<v>679354</v>
+<v>679346</v>
 </e>
 <e>
 <k>target_id</k>
@@ -28489,7 +28485,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>679354</v>
+<v>679346</v>
 </b>
 </bs>
 </hist>
@@ -28505,32 +28501,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28346</v>
+<v>28347</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10447</v>
+<v>10445</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4324</v>
+<v>4326</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>4789</v>
+<v>4791</v>
 </b>
 <b>
 <a>7</a>
 <b>24</b>
-<v>4087</v>
+<v>4085</v>
 </b>
 <b>
 <a>24</a>
 <b>43831</b>
-<v>1858</v>
+<v>1857</v>
 </b>
 </bs>
 </hist>
@@ -28540,15 +28536,15 @@
 </relation>
 <relation>
 <name>expr_access</name>
-<cardinality>1388349</cardinality>
+<cardinality>1389511</cardinality>
 <columnsizes>
 <e>
 <k>accesser_id</k>
-<v>1388349</v>
+<v>1389511</v>
 </e>
 <e>
 <k>target_id</k>
-<v>331188</v>
+<v>331466</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28562,7 +28558,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1388349</v>
+<v>1389511</v>
 </b>
 </bs>
 </hist>
@@ -28578,37 +28574,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>104632</v>
+<v>104720</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70681</v>
+<v>70740</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>51552</v>
+<v>51595</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>33401</v>
+<v>33429</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>18840</v>
+<v>18856</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>27025</v>
+<v>27048</v>
 </b>
 <b>
 <a>9</a>
 <b>185</b>
-<v>24842</v>
+<v>24863</v>
 </b>
 <b>
 <a>185</a>
@@ -28623,15 +28619,15 @@
 </relation>
 <relation>
 <name>expr_location</name>
-<cardinality>4259646</cardinality>
+<cardinality>4263212</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4259646</v>
+<v>4263212</v>
 </e>
 <e>
 <k>loc</k>
-<v>2612361</v>
+<v>2614548</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28645,7 +28641,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4259646</v>
+<v>4263212</v>
 </b>
 </bs>
 </hist>
@@ -28661,17 +28657,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1993093</v>
+<v>1994761</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>610181</v>
+<v>610692</v>
 </b>
 <b>
 <a>3</a>
 <b>111245</b>
-<v>9086</v>
+<v>9093</v>
 </b>
 </bs>
 </hist>
@@ -28681,15 +28677,15 @@
 </relation>
 <relation>
 <name>dynamic_member_name</name>
-<cardinality>13646</cardinality>
+<cardinality>13657</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>13646</v>
+<v>13657</v>
 </e>
 <e>
 <k>name</k>
-<v>1409</v>
+<v>1410</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28703,7 +28699,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13646</v>
+<v>13657</v>
 </b>
 </bs>
 </hist>
@@ -28719,7 +28715,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>409</v>
+<v>410</v>
 </b>
 <b>
 <a>2</a>
@@ -28729,7 +28725,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>160</v>
+<v>161</v>
 </b>
 <b>
 <a>4</a>
@@ -28744,7 +28740,7 @@
 <b>
 <a>7</a>
 <b>11</b>
-<v>121</v>
+<v>122</v>
 </b>
 <b>
 <a>11</a>
@@ -28769,22 +28765,22 @@
 </relation>
 <relation>
 <name>conditional_access</name>
-<cardinality>3077</cardinality>
+<cardinality>3080</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3077</v>
+<v>3080</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_argument</name>
-<cardinality>875547</cardinality>
+<cardinality>875546</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>875547</v>
+<v>875546</v>
 </e>
 <e>
 <k>mode</k>
@@ -28802,7 +28798,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>875547</v>
+<v>875546</v>
 </b>
 </bs>
 </hist>
@@ -28831,8 +28827,8 @@
 <v>1</v>
 </b>
 <b>
-<a>865298</a>
-<b>865299</b>
+<a>865297</a>
+<b>865298</b>
 <v>1</v>
 </b>
 </bs>
@@ -33390,11 +33386,11 @@
 </relation>
 <relation>
 <name>commentline</name>
-<cardinality>410411</cardinality>
+<cardinality>410755</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>410411</v>
+<v>410755</v>
 </e>
 <e>
 <k>kind</k>
@@ -33402,11 +33398,11 @@
 </e>
 <e>
 <k>text</k>
-<v>196879</v>
+<v>197044</v>
 </e>
 <e>
 <k>rawtext</k>
-<v>199489</v>
+<v>199656</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33420,7 +33416,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410411</v>
+<v>410755</v>
 </b>
 </bs>
 </hist>
@@ -33436,7 +33432,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410411</v>
+<v>410755</v>
 </b>
 </bs>
 </hist>
@@ -33452,7 +33448,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410411</v>
+<v>410755</v>
 </b>
 </bs>
 </hist>
@@ -33546,17 +33542,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>161319</v>
+<v>161454</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23466</v>
+<v>23485</v>
 </b>
 <b>
 <a>3</a>
 <b>24462</b>
-<v>12094</v>
+<v>12104</v>
 </b>
 </bs>
 </hist>
@@ -33572,12 +33568,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>195790</v>
+<v>195954</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1089</v>
+<v>1090</v>
 </b>
 </bs>
 </hist>
@@ -33593,12 +33589,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>194804</v>
+<v>194967</v>
 </b>
 <b>
 <a>2</a>
 <b>51</b>
-<v>2074</v>
+<v>2076</v>
 </b>
 </bs>
 </hist>
@@ -33614,17 +33610,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>164639</v>
+<v>164777</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23000</v>
+<v>23019</v>
 </b>
 <b>
 <a>3</a>
 <b>24457</b>
-<v>11849</v>
+<v>11859</v>
 </b>
 </bs>
 </hist>
@@ -33640,7 +33636,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199489</v>
+<v>199656</v>
 </b>
 </bs>
 </hist>
@@ -33656,7 +33652,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199489</v>
+<v>199656</v>
 </b>
 </bs>
 </hist>
@@ -33666,15 +33662,15 @@
 </relation>
 <relation>
 <name>commentline_location</name>
-<cardinality>410411</cardinality>
+<cardinality>410755</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>410411</v>
+<v>410755</v>
 </e>
 <e>
 <k>loc</k>
-<v>410411</v>
+<v>410755</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33688,7 +33684,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410411</v>
+<v>410755</v>
 </b>
 </bs>
 </hist>
@@ -33704,7 +33700,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410411</v>
+<v>410755</v>
 </b>
 </bs>
 </hist>
@@ -33714,26 +33710,26 @@
 </relation>
 <relation>
 <name>commentblock</name>
-<cardinality>144253</cardinality>
+<cardinality>144374</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144253</v>
+<v>144374</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>commentblock_location</name>
-<cardinality>144253</cardinality>
+<cardinality>144374</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144253</v>
+<v>144374</v>
 </e>
 <e>
 <k>loc</k>
-<v>144253</v>
+<v>144374</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33747,7 +33743,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144253</v>
+<v>144374</v>
 </b>
 </bs>
 </hist>
@@ -33763,7 +33759,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144253</v>
+<v>144374</v>
 </b>
 </bs>
 </hist>
@@ -33773,15 +33769,15 @@
 </relation>
 <relation>
 <name>commentblock_binding</name>
-<cardinality>499627</cardinality>
+<cardinality>500046</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144195</v>
+<v>144315</v>
 </e>
 <e>
 <k>entity</k>
-<v>215939</v>
+<v>216120</v>
 </e>
 <e>
 <k>bindtype</k>
@@ -33799,22 +33795,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18048</v>
+<v>18063</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29040</v>
+<v>29064</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>96815</v>
+<v>96896</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>290</v>
+<v>291</v>
 </b>
 </bs>
 </hist>
@@ -33830,22 +33826,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12949</v>
+<v>12960</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5219</v>
+<v>5223</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>28994</v>
+<v>29018</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>97031</v>
+<v>97113</v>
 </b>
 </bs>
 </hist>
@@ -33861,17 +33857,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>158251</v>
+<v>158383</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>42044</v>
+<v>42079</v>
 </b>
 <b>
 <a>3</a>
 <b>9895</b>
-<v>15644</v>
+<v>15657</v>
 </b>
 </bs>
 </hist>
@@ -33887,17 +33883,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94278</v>
+<v>94357</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>92726</v>
+<v>92804</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>28064</v>
+<v>28088</v>
 </b>
 <b>
 <a>4</a>
@@ -33974,19 +33970,19 @@
 </relation>
 <relation>
 <name>commentblock_child</name>
-<cardinality>543599</cardinality>
+<cardinality>544054</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144253</v>
+<v>144374</v>
 </e>
 <e>
 <k>commentline</k>
-<v>410325</v>
+<v>410669</v>
 </e>
 <e>
 <k>index</k>
-<v>4986</v>
+<v>4990</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -34000,32 +33996,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76864</v>
+<v>76929</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19909</v>
+<v>19925</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18969</v>
+<v>18985</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8961</v>
+<v>8968</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>11470</v>
+<v>11479</v>
 </b>
 <b>
 <a>8</a>
 <b>4098</b>
-<v>8078</v>
+<v>8085</v>
 </b>
 </bs>
 </hist>
@@ -34041,37 +34037,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4204</v>
+<v>4207</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>73562</v>
+<v>73623</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>21657</v>
+<v>21675</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>17217</v>
+<v>17231</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>8619</v>
+<v>8626</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>11190</v>
+<v>11199</v>
 </b>
 <b>
 <a>9</a>
 <b>4099</b>
-<v>7802</v>
+<v>7809</v>
 </b>
 </bs>
 </hist>
@@ -34087,7 +34083,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410317</v>
+<v>410660</v>
 </b>
 <b>
 <a>2</a>
@@ -34108,12 +34104,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>277060</v>
+<v>277292</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>133265</v>
+<v>133376</v>
 </b>
 </bs>
 </hist>
@@ -34129,17 +34125,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2225</v>
+<v>2227</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1378</v>
+<v>1379</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>397</v>
+<v>398</v>
 </b>
 <b>
 <a>7</a>
@@ -34170,17 +34166,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2225</v>
+<v>2227</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1378</v>
+<v>1379</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>397</v>
+<v>398</v>
 </b>
 <b>
 <a>7</a>
@@ -35050,23 +35046,23 @@
 </relation>
 <relation>
 <name>cil_instruction</name>
-<cardinality>32204024</cardinality>
+<cardinality>32230984</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32204024</v>
+<v>32230984</v>
 </e>
 <e>
 <k>opcode</k>
-<v>965</v>
+<v>966</v>
 </e>
 <e>
 <k>index</k>
-<v>332771</v>
+<v>333050</v>
 </e>
 <e>
 <k>impl</k>
-<v>1728026</v>
+<v>1729473</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35080,7 +35076,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32204024</v>
+<v>32230984</v>
 </b>
 </bs>
 </hist>
@@ -35096,7 +35092,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32204024</v>
+<v>32230984</v>
 </b>
 </bs>
 </hist>
@@ -35112,7 +35108,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32204024</v>
+<v>32230984</v>
 </b>
 </bs>
 </hist>
@@ -35366,22 +35362,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>260657</v>
+<v>260875</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30628</v>
+<v>30654</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25517</v>
+<v>25538</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15967</v>
+<v>15981</v>
 </b>
 </bs>
 </hist>
@@ -35397,22 +35393,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>261252</v>
+<v>261470</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17699</v>
+<v>17714</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>28760</v>
+<v>28784</v>
 </b>
 <b>
 <a>5</a>
 <b>160</b>
-<v>24961</v>
+<v>24982</v>
 </b>
 <b>
 <a>160</a>
@@ -35433,22 +35429,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>260657</v>
+<v>260875</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30628</v>
+<v>30654</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25517</v>
+<v>25538</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15967</v>
+<v>15981</v>
 </b>
 </bs>
 </hist>
@@ -35464,57 +35460,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84092</v>
+<v>84163</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252083</v>
+<v>252294</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>332659</v>
+<v>332937</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>196058</v>
+<v>196222</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>107166</v>
+<v>107256</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>158138</v>
+<v>158270</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>151139</v>
+<v>151266</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>133966</v>
+<v>134079</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131616</v>
+<v>131726</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129640</v>
+<v>129749</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51464</v>
+<v>51507</v>
 </b>
 </bs>
 </hist>
@@ -35530,57 +35526,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84092</v>
+<v>84163</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252370</v>
+<v>252582</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>338633</v>
+<v>338917</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>239685</v>
+<v>239885</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>132557</v>
+<v>132668</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>96417</v>
+<v>96498</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>147920</v>
+<v>148044</v>
 </b>
 <b>
 <a>9</a>
 <b>12</b>
-<v>128977</v>
+<v>129085</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>135932</v>
+<v>136046</v>
 </b>
 <b>
 <a>17</a>
 <b>33</b>
-<v>132211</v>
+<v>132321</v>
 </b>
 <b>
 <a>33</a>
 <b>74</b>
-<v>39227</v>
+<v>39260</v>
 </b>
 </bs>
 </hist>
@@ -35596,57 +35592,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84092</v>
+<v>84163</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252083</v>
+<v>252294</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>332659</v>
+<v>332937</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>196058</v>
+<v>196222</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>107166</v>
+<v>107256</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>158138</v>
+<v>158270</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>151139</v>
+<v>151266</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>133966</v>
+<v>134079</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131616</v>
+<v>131726</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129640</v>
+<v>129749</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51464</v>
+<v>51507</v>
 </b>
 </bs>
 </hist>
@@ -35656,15 +35652,15 @@
 </relation>
 <relation>
 <name>cil_jump</name>
-<cardinality>2006061</cardinality>
+<cardinality>2007740</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>2006061</v>
+<v>2007740</v>
 </e>
 <e>
 <k>target</k>
-<v>1606647</v>
+<v>1607992</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35678,7 +35674,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2006061</v>
+<v>2007740</v>
 </b>
 </bs>
 </hist>
@@ -35694,17 +35690,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1392763</v>
+<v>1393929</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>143877</v>
+<v>143997</v>
 </b>
 <b>
 <a>3</a>
 <b>360</b>
-<v>70007</v>
+<v>70065</v>
 </b>
 </bs>
 </hist>
@@ -35714,15 +35710,15 @@
 </relation>
 <relation>
 <name>cil_access</name>
-<cardinality>11941098</cardinality>
+<cardinality>11951094</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>11941098</v>
+<v>11951094</v>
 </e>
 <e>
 <k>target</k>
-<v>2668229</v>
+<v>2670463</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35736,7 +35732,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11941098</v>
+<v>11951094</v>
 </b>
 </bs>
 </hist>
@@ -35752,37 +35748,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>946216</v>
+<v>947008</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>740978</v>
+<v>741599</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>269416</v>
+<v>269642</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>187377</v>
+<v>187534</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>226994</v>
+<v>227184</v>
 </b>
 <b>
 <a>7</a>
 <b>14</b>
-<v>203813</v>
+<v>203984</v>
 </b>
 <b>
 <a>14</a>
 <b>25741</b>
-<v>93432</v>
+<v>93510</v>
 </b>
 </bs>
 </hist>
@@ -35792,15 +35788,15 @@
 </relation>
 <relation>
 <name>cil_value</name>
-<cardinality>1886550</cardinality>
+<cardinality>1888129</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>1886550</v>
+<v>1888129</v>
 </e>
 <e>
 <k>value</k>
-<v>495518</v>
+<v>495933</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35814,7 +35810,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1886550</v>
+<v>1888129</v>
 </b>
 </bs>
 </hist>
@@ -35830,27 +35826,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>334819</v>
+<v>335100</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79113</v>
+<v>79179</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>40763</v>
+<v>40797</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>37300</v>
+<v>37332</v>
 </b>
 <b>
 <a>33</a>
 <b>86799</b>
-<v>3521</v>
+<v>3524</v>
 </b>
 </bs>
 </hist>
@@ -35860,19 +35856,19 @@
 </relation>
 <relation>
 <name>cil_switch</name>
-<cardinality>194663</cardinality>
+<cardinality>194826</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>23883</v>
+<v>23903</v>
 </e>
 <e>
 <k>index</k>
-<v>2521</v>
+<v>2523</v>
 </e>
 <e>
 <k>target</k>
-<v>130782</v>
+<v>130891</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35886,42 +35882,42 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>7028</v>
+<v>7033</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4599</v>
+<v>4603</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3233</v>
+<v>3236</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>1687</v>
+<v>1688</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>1443</v>
+<v>1444</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>2160</v>
+<v>2162</v>
 </b>
 <b>
 <a>11</a>
 <b>17</b>
-<v>1848</v>
+<v>1850</v>
 </b>
 <b>
 <a>17</a>
 <b>128</b>
-<v>1794</v>
+<v>1796</v>
 </b>
 <b>
 <a>141</a>
@@ -35942,37 +35938,37 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>1058</v>
+<v>1059</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8257</v>
+<v>8264</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5496</v>
+<v>5501</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2575</v>
+<v>2577</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>1843</v>
+<v>1845</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>1702</v>
+<v>1703</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>1799</v>
+<v>1801</v>
 </b>
 <b>
 <a>14</a>
@@ -36008,17 +36004,17 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>360</v>
+<v>361</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>204</v>
+<v>205</v>
 </b>
 <b>
 <a>11</a>
 <b>18</b>
-<v>204</v>
+<v>205</v>
 </b>
 <b>
 <a>18</a>
@@ -36028,7 +36024,7 @@
 <b>
 <a>25</a>
 <b>47</b>
-<v>199</v>
+<v>200</v>
 </b>
 <b>
 <a>47</a>
@@ -36059,7 +36055,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>975</v>
+<v>976</v>
 </b>
 <b>
 <a>3</a>
@@ -36074,7 +36070,7 @@
 <b>
 <a>5</a>
 <b>11</b>
-<v>204</v>
+<v>205</v>
 </b>
 <b>
 <a>11</a>
@@ -36084,7 +36080,7 @@
 <b>
 <a>18</a>
 <b>24</b>
-<v>204</v>
+<v>205</v>
 </b>
 <b>
 <a>24</a>
@@ -36115,12 +36111,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>129148</v>
+<v>129256</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>1633</v>
+<v>1635</v>
 </b>
 </bs>
 </hist>
@@ -36136,17 +36132,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118374</v>
+<v>118473</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>10012</v>
+<v>10021</v>
 </b>
 <b>
 <a>7</a>
 <b>253</b>
-<v>2394</v>
+<v>2396</v>
 </b>
 </bs>
 </hist>
@@ -36224,15 +36220,15 @@
 </relation>
 <relation>
 <name>cil_type_location</name>
-<cardinality>277717</cardinality>
+<cardinality>277950</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>255316</v>
+<v>255530</v>
 </e>
 <e>
 <k>loc</k>
-<v>3418</v>
+<v>3421</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36246,12 +36242,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>232915</v>
+<v>233110</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22400</v>
+<v>22419</v>
 </b>
 </bs>
 </hist>
@@ -36297,7 +36293,7 @@
 <b>
 <a>17</a>
 <b>23</b>
-<v>282</v>
+<v>283</v>
 </b>
 <b>
 <a>23</a>
@@ -36327,7 +36323,7 @@
 <b>
 <a>239</a>
 <b>2419</b>
-<v>243</v>
+<v>244</v>
 </b>
 </bs>
 </hist>
@@ -36337,15 +36333,15 @@
 </relation>
 <relation>
 <name>cil_method_location</name>
-<cardinality>1886506</cardinality>
+<cardinality>1888086</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1798980</v>
+<v>1800486</v>
 </e>
 <e>
 <k>loc</k>
-<v>3131</v>
+<v>3133</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36359,12 +36355,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1711454</v>
+<v>1712886</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>87526</v>
+<v>87599</v>
 </b>
 </bs>
 </hist>
@@ -36385,12 +36381,12 @@
 <b>
 <a>11</a>
 <b>23</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>23</a>
 <b>38</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>38</a>
@@ -36400,12 +36396,12 @@
 <b>
 <a>53</a>
 <b>79</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>80</a>
 <b>107</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>107</a>
@@ -36415,32 +36411,32 @@
 <b>
 <a>140</a>
 <b>204</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>204</a>
 <b>278</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>281</a>
 <b>385</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>388</a>
 <b>734</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>735</a>
 <b>1631</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>1646</a>
 <b>33686</b>
-<v>204</v>
+<v>205</v>
 </b>
 </bs>
 </hist>
@@ -36450,15 +36446,15 @@
 </relation>
 <relation>
 <name>cil_type</name>
-<cardinality>795832</cardinality>
+<cardinality>796498</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>795832</v>
+<v>796498</v>
 </e>
 <e>
 <k>name</k>
-<v>179310</v>
+<v>179460</v>
 </e>
 <e>
 <k>kind</k>
@@ -36466,11 +36462,11 @@
 </e>
 <e>
 <k>parent</k>
-<v>155636</v>
+<v>155766</v>
 </e>
 <e>
 <k>sourceDecl</k>
-<v>465231</v>
+<v>465620</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36484,7 +36480,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>795832</v>
+<v>796498</v>
 </b>
 </bs>
 </hist>
@@ -36500,7 +36496,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>795832</v>
+<v>796498</v>
 </b>
 </bs>
 </hist>
@@ -36516,7 +36512,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>795832</v>
+<v>796498</v>
 </b>
 </bs>
 </hist>
@@ -36532,7 +36528,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>795832</v>
+<v>796498</v>
 </b>
 </bs>
 </hist>
@@ -36548,22 +36544,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>137844</v>
+<v>137959</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22522</v>
+<v>22541</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>14168</v>
+<v>14180</v>
 </b>
 <b>
 <a>7</a>
 <b>21324</b>
-<v>4774</v>
+<v>4778</v>
 </b>
 </bs>
 </hist>
@@ -36579,7 +36575,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179310</v>
+<v>179460</v>
 </b>
 </bs>
 </hist>
@@ -36595,17 +36591,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162640</v>
+<v>162776</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>13661</v>
+<v>13672</v>
 </b>
 <b>
 <a>4</a>
 <b>21324</b>
-<v>3009</v>
+<v>3011</v>
 </b>
 </bs>
 </hist>
@@ -36621,17 +36617,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>146316</v>
+<v>146438</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22547</v>
+<v>22566</v>
 </b>
 <b>
 <a>3</a>
 <b>21324</b>
-<v>10446</v>
+<v>10455</v>
 </b>
 </bs>
 </hist>
@@ -36771,27 +36767,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101914</v>
+<v>101999</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>26829</v>
+<v>26851</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13358</v>
+<v>13369</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>11715</v>
+<v>11724</v>
 </b>
 <b>
 <a>33</a>
 <b>26080</b>
-<v>1819</v>
+<v>1820</v>
 </b>
 </bs>
 </hist>
@@ -36807,27 +36803,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102489</v>
+<v>102575</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27248</v>
+<v>27271</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13256</v>
+<v>13267</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11700</v>
+<v>11710</v>
 </b>
 <b>
 <a>38</a>
 <b>1430</b>
-<v>941</v>
+<v>942</v>
 </b>
 </bs>
 </hist>
@@ -36843,12 +36839,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>152427</v>
+<v>152554</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>3209</v>
+<v>3211</v>
 </b>
 </bs>
 </hist>
@@ -36864,27 +36860,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102387</v>
+<v>102472</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27268</v>
+<v>27291</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13163</v>
+<v>13174</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11680</v>
+<v>11690</v>
 </b>
 <b>
 <a>38</a>
 <b>3477</b>
-<v>1136</v>
+<v>1137</v>
 </b>
 </bs>
 </hist>
@@ -36900,12 +36896,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>438411</v>
+<v>438778</v>
 </b>
 <b>
 <a>2</a>
 <b>3705</b>
-<v>26819</v>
+<v>26842</v>
 </b>
 </bs>
 </hist>
@@ -36921,7 +36917,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>465231</v>
+<v>465620</v>
 </b>
 </bs>
 </hist>
@@ -36937,7 +36933,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>465231</v>
+<v>465620</v>
 </b>
 </bs>
 </hist>
@@ -36953,12 +36949,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>456896</v>
+<v>457278</v>
 </b>
 <b>
 <a>2</a>
 <b>225</b>
-<v>8335</v>
+<v>8342</v>
 </b>
 </bs>
 </hist>
@@ -37016,15 +37012,15 @@
 </relation>
 <relation>
 <name>cil_array_type</name>
-<cardinality>14187</cardinality>
+<cardinality>14199</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14187</v>
+<v>14199</v>
 </e>
 <e>
 <k>element_type</k>
-<v>14109</v>
+<v>14121</v>
 </e>
 <e>
 <k>rank</k>
@@ -37042,7 +37038,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14187</v>
+<v>14199</v>
 </b>
 </bs>
 </hist>
@@ -37058,7 +37054,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14187</v>
+<v>14199</v>
 </b>
 </bs>
 </hist>
@@ -37074,7 +37070,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14036</v>
+<v>14048</v>
 </b>
 <b>
 <a>2</a>
@@ -37095,7 +37091,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14036</v>
+<v>14048</v>
 </b>
 <b>
 <a>2</a>
@@ -37162,23 +37158,23 @@
 </relation>
 <relation>
 <name>cil_method</name>
-<cardinality>2314861</cardinality>
+<cardinality>2316799</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2314861</v>
+<v>2316799</v>
 </e>
 <e>
 <k>name</k>
-<v>440216</v>
+<v>440584</v>
 </e>
 <e>
 <k>parent</k>
-<v>380412</v>
+<v>380730</v>
 </e>
 <e>
 <k>return_type</k>
-<v>214138</v>
+<v>214317</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37192,7 +37188,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2314861</v>
+<v>2316799</v>
 </b>
 </bs>
 </hist>
@@ -37208,7 +37204,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2314861</v>
+<v>2316799</v>
 </b>
 </bs>
 </hist>
@@ -37224,7 +37220,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2314861</v>
+<v>2316799</v>
 </b>
 </bs>
 </hist>
@@ -37240,27 +37236,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>271226</v>
+<v>271453</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79669</v>
+<v>79735</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>25054</v>
+<v>25075</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>33521</v>
+<v>33549</v>
 </b>
 <b>
 <a>7</a>
 <b>64064</b>
-<v>30745</v>
+<v>30771</v>
 </b>
 </bs>
 </hist>
@@ -37276,27 +37272,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>285248</v>
+<v>285486</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>76625</v>
+<v>76689</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>39900</v>
+<v>39933</v>
 </b>
 <b>
 <a>5</a>
 <b>25</b>
-<v>33184</v>
+<v>33212</v>
 </b>
 <b>
 <a>25</a>
 <b>52725</b>
-<v>5257</v>
+<v>5262</v>
 </b>
 </bs>
 </hist>
@@ -37312,17 +37308,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>384401</v>
+<v>384723</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>40261</v>
+<v>40295</v>
 </b>
 <b>
 <a>4</a>
 <b>2803</b>
-<v>15553</v>
+<v>15566</v>
 </b>
 </bs>
 </hist>
@@ -37338,42 +37334,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>108054</v>
+<v>108144</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>84570</v>
+<v>84641</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49986</v>
+<v>50028</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28590</v>
+<v>28614</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>30892</v>
+<v>30918</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>32940</v>
+<v>32968</v>
 </b>
 <b>
 <a>11</a>
 <b>21</b>
-<v>28975</v>
+<v>28999</v>
 </b>
 <b>
 <a>21</a>
 <b>3536</b>
-<v>16402</v>
+<v>16415</v>
 </b>
 </bs>
 </hist>
@@ -37389,42 +37385,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>114448</v>
+<v>114544</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86726</v>
+<v>86799</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50542</v>
+<v>50584</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28936</v>
+<v>28960</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>32896</v>
+<v>32924</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>30033</v>
+<v>30058</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>28712</v>
+<v>28736</v>
 </b>
 <b>
 <a>26</a>
 <b>1885</b>
-<v>8115</v>
+<v>8122</v>
 </b>
 </bs>
 </hist>
@@ -37440,32 +37436,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162279</v>
+<v>162415</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>93759</v>
+<v>93837</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>46426</v>
+<v>46464</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23313</v>
+<v>23332</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>28414</v>
+<v>28438</v>
 </b>
 <b>
 <a>7</a>
 <b>1924</b>
-<v>26219</v>
+<v>26241</v>
 </b>
 </bs>
 </hist>
@@ -37481,27 +37477,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132060</v>
+<v>132170</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>38266</v>
+<v>38298</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>18855</v>
+<v>18871</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>16577</v>
+<v>16591</v>
 </b>
 <b>
 <a>13</a>
 <b>190707</b>
-<v>8379</v>
+<v>8386</v>
 </b>
 </bs>
 </hist>
@@ -37517,22 +37513,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>153646</v>
+<v>153775</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30365</v>
+<v>30390</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>19157</v>
+<v>19173</v>
 </b>
 <b>
 <a>6</a>
 <b>28461</b>
-<v>10968</v>
+<v>10978</v>
 </b>
 </bs>
 </hist>
@@ -37548,22 +37544,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145491</v>
+<v>145613</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>35413</v>
+<v>35443</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>17562</v>
+<v>17577</v>
 </b>
 <b>
 <a>5</a>
 <b>62018</b>
-<v>15670</v>
+<v>15683</v>
 </b>
 </bs>
 </hist>
@@ -37573,15 +37569,15 @@
 </relation>
 <relation>
 <name>cil_method_source_declaration</name>
-<cardinality>2108473</cardinality>
+<cardinality>2110238</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>2108473</v>
+<v>2110238</v>
 </e>
 <e>
 <k>source</k>
-<v>1865695</v>
+<v>1867257</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37595,7 +37591,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2108473</v>
+<v>2110238</v>
 </b>
 </bs>
 </hist>
@@ -37611,12 +37607,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1760684</v>
+<v>1762158</v>
 </b>
 <b>
 <a>2</a>
 <b>1021</b>
-<v>105011</v>
+<v>105098</v>
 </b>
 </bs>
 </hist>
@@ -37626,19 +37622,19 @@
 </relation>
 <relation>
 <name>cil_method_implementation</name>
-<cardinality>1728026</cardinality>
+<cardinality>1729473</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1728026</v>
+<v>1729473</v>
 </e>
 <e>
 <k>method</k>
-<v>1641144</v>
+<v>1642518</v>
 </e>
 <e>
 <k>location</k>
-<v>3097</v>
+<v>3099</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37652,7 +37648,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1728026</v>
+<v>1729473</v>
 </b>
 </bs>
 </hist>
@@ -37668,7 +37664,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1728026</v>
+<v>1729473</v>
 </b>
 </bs>
 </hist>
@@ -37684,12 +37680,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1554261</v>
+<v>1555563</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86882</v>
+<v>86955</v>
 </b>
 </bs>
 </hist>
@@ -37705,12 +37701,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1554261</v>
+<v>1555563</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86882</v>
+<v>86955</v>
 </b>
 </bs>
 </hist>
@@ -37731,12 +37727,12 @@
 <b>
 <a>11</a>
 <b>22</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>22</a>
 <b>36</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>36</a>
@@ -37746,7 +37742,7 @@
 <b>
 <a>50</a>
 <b>74</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>74</a>
@@ -37756,7 +37752,7 @@
 <b>
 <a>104</a>
 <b>133</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>133</a>
@@ -37781,7 +37777,7 @@
 <b>
 <a>682</a>
 <b>1597</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>1599</a>
@@ -37807,12 +37803,12 @@
 <b>
 <a>11</a>
 <b>22</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>22</a>
 <b>36</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>36</a>
@@ -37822,7 +37818,7 @@
 <b>
 <a>50</a>
 <b>74</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>74</a>
@@ -37832,7 +37828,7 @@
 <b>
 <a>104</a>
 <b>133</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>133</a>
@@ -37857,7 +37853,7 @@
 <b>
 <a>682</a>
 <b>1597</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>1599</a>
@@ -37872,15 +37868,15 @@
 </relation>
 <relation>
 <name>cil_implements</name>
-<cardinality>107196</cardinality>
+<cardinality>107285</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>106435</v>
+<v>106524</v>
 </e>
 <e>
 <k>decl</k>
-<v>17743</v>
+<v>17758</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37894,12 +37890,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>105674</v>
+<v>105762</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>760</v>
+<v>761</v>
 </b>
 </bs>
 </hist>
@@ -37915,22 +37911,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11549</v>
+<v>11558</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2706</v>
+<v>2709</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>1580</v>
+<v>1581</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>1331</v>
+<v>1332</v>
 </b>
 <b>
 <a>18</a>
@@ -37945,23 +37941,23 @@
 </relation>
 <relation>
 <name>cil_field</name>
-<cardinality>1009668</cardinality>
+<cardinality>1010513</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1009668</v>
+<v>1010513</v>
 </e>
 <e>
 <k>parent</k>
-<v>201384</v>
+<v>201553</v>
 </e>
 <e>
 <k>name</k>
-<v>361293</v>
+<v>361595</v>
 </e>
 <e>
 <k>field_type</k>
-<v>166058</v>
+<v>166197</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37975,7 +37971,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1009668</v>
+<v>1010513</v>
 </b>
 </bs>
 </hist>
@@ -37991,7 +37987,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1009668</v>
+<v>1010513</v>
 </b>
 </bs>
 </hist>
@@ -38007,7 +38003,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1009668</v>
+<v>1010513</v>
 </b>
 </bs>
 </hist>
@@ -38023,42 +38019,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60691</v>
+<v>60742</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41080</v>
+<v>41115</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22318</v>
+<v>22336</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15499</v>
+<v>15512</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11724</v>
+<v>11734</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16967</v>
+<v>16981</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17874</v>
+<v>17889</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15109</v>
+<v>15122</v>
 </b>
 <b>
 <a>237</a>
@@ -38079,42 +38075,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60691</v>
+<v>60742</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41080</v>
+<v>41115</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22318</v>
+<v>22336</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15499</v>
+<v>15512</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11724</v>
+<v>11734</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16967</v>
+<v>16981</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17874</v>
+<v>17889</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15109</v>
+<v>15122</v>
 </b>
 <b>
 <a>237</a>
@@ -38135,37 +38131,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70490</v>
+<v>70549</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>59828</v>
+<v>59878</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20445</v>
+<v>20462</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11476</v>
+<v>11485</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>15704</v>
+<v>15717</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>16075</v>
+<v>16088</v>
 </b>
 <b>
 <a>11</a>
 <b>132</b>
-<v>7364</v>
+<v>7370</v>
 </b>
 </bs>
 </hist>
@@ -38181,22 +38177,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>262164</v>
+<v>262383</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55419</v>
+<v>55466</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30106</v>
+<v>30132</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13602</v>
+<v>13613</v>
 </b>
 </bs>
 </hist>
@@ -38212,22 +38208,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>262164</v>
+<v>262383</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55419</v>
+<v>55466</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30106</v>
+<v>30132</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13602</v>
+<v>13613</v>
 </b>
 </bs>
 </hist>
@@ -38243,17 +38239,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>305766</v>
+<v>306022</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34096</v>
+<v>34125</v>
 </b>
 <b>
 <a>3</a>
 <b>2790</b>
-<v>21430</v>
+<v>21448</v>
 </b>
 </bs>
 </hist>
@@ -38269,32 +38265,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>82717</v>
+<v>82786</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43816</v>
+<v>43853</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8969</v>
+<v>8976</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>15275</v>
+<v>15288</v>
 </b>
 <b>
 <a>7</a>
 <b>31</b>
-<v>12553</v>
+<v>12564</v>
 </b>
 <b>
 <a>31</a>
 <b>21103</b>
-<v>2726</v>
+<v>2728</v>
 </b>
 </bs>
 </hist>
@@ -38310,22 +38306,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96812</v>
+<v>96893</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44543</v>
+<v>44580</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>14246</v>
+<v>14258</v>
 </b>
 <b>
 <a>6</a>
 <b>12257</b>
-<v>10456</v>
+<v>10465</v>
 </b>
 </bs>
 </hist>
@@ -38341,27 +38337,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>119954</v>
+<v>120055</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17982</v>
+<v>17997</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>13256</v>
+<v>13267</v>
 </b>
 <b>
 <a>5</a>
 <b>20</b>
-<v>12480</v>
+<v>12491</v>
 </b>
 <b>
 <a>20</a>
 <b>8901</b>
-<v>2384</v>
+<v>2386</v>
 </b>
 </bs>
 </hist>
@@ -38371,23 +38367,23 @@
 </relation>
 <relation>
 <name>cil_parameter</name>
-<cardinality>4552575</cardinality>
+<cardinality>4556386</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4552575</v>
+<v>4556386</v>
 </e>
 <e>
 <k>method</k>
-<v>2223238</v>
+<v>2225099</v>
 </e>
 <e>
 <k>index</k>
-<v>199</v>
+<v>200</v>
 </e>
 <e>
 <k>param_type</k>
-<v>553235</v>
+<v>553698</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38401,7 +38397,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4552575</v>
+<v>4556386</v>
 </b>
 </bs>
 </hist>
@@ -38417,7 +38413,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4552575</v>
+<v>4556386</v>
 </b>
 </bs>
 </hist>
@@ -38433,7 +38429,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4552575</v>
+<v>4556386</v>
 </b>
 </bs>
 </hist>
@@ -38449,27 +38445,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>901745</v>
+<v>902500</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>788443</v>
+<v>789103</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>325050</v>
+<v>325323</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>175154</v>
+<v>175301</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32843</v>
+<v>32870</v>
 </b>
 </bs>
 </hist>
@@ -38485,27 +38481,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>901745</v>
+<v>902500</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>788443</v>
+<v>789103</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>325050</v>
+<v>325323</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>175154</v>
+<v>175301</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32843</v>
+<v>32870</v>
 </b>
 </bs>
 </hist>
@@ -38521,22 +38517,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>949840</v>
+<v>950635</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>798963</v>
+<v>799632</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>313399</v>
+<v>313661</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>161035</v>
+<v>161170</v>
 </b>
 </bs>
 </hist>
@@ -38785,42 +38781,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185640</v>
+<v>185796</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137239</v>
+<v>137354</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45075</v>
+<v>45112</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>38500</v>
+<v>38532</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>43909</v>
+<v>43946</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42816</v>
+<v>42852</v>
 </b>
 <b>
 <a>11</a>
 <b>27</b>
-<v>41934</v>
+<v>41969</v>
 </b>
 <b>
 <a>27</a>
 <b>58010</b>
-<v>18118</v>
+<v>18133</v>
 </b>
 </bs>
 </hist>
@@ -38836,42 +38832,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>188850</v>
+<v>189008</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>135937</v>
+<v>136051</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45489</v>
+<v>45527</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>37281</v>
+<v>37312</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>44358</v>
+<v>44395</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42875</v>
+<v>42911</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>41773</v>
+<v>41808</v>
 </b>
 <b>
 <a>28</a>
 <b>46068</b>
-<v>16670</v>
+<v>16684</v>
 </b>
 </bs>
 </hist>
@@ -38887,22 +38883,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>386079</v>
+<v>386402</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>109971</v>
+<v>110063</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>44523</v>
+<v>44561</v>
 </b>
 <b>
 <a>4</a>
 <b>36</b>
-<v>12661</v>
+<v>12671</v>
 </b>
 </bs>
 </hist>
@@ -38912,37 +38908,37 @@
 </relation>
 <relation>
 <name>cil_parameter_in</name>
-<cardinality>32394</cardinality>
+<cardinality>32421</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32394</v>
+<v>32421</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_parameter_out</name>
-<cardinality>46084</cardinality>
+<cardinality>46123</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>46084</v>
+<v>46123</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_setter</name>
-<cardinality>106898</cardinality>
+<cardinality>106988</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>106898</v>
+<v>106988</v>
 </e>
 <e>
 <k>method</k>
-<v>106898</v>
+<v>106988</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38956,7 +38952,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106898</v>
+<v>106988</v>
 </b>
 </bs>
 </hist>
@@ -38972,7 +38968,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106898</v>
+<v>106988</v>
 </b>
 </bs>
 </hist>
@@ -38982,11 +38978,11 @@
 </relation>
 <relation>
 <name>cil_custom_modifiers</name>
-<cardinality>4111</cardinality>
+<cardinality>4114</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4111</v>
+<v>4114</v>
 </e>
 <e>
 <k>modifier</k>
@@ -39008,7 +39004,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4111</v>
+<v>4114</v>
 </b>
 </bs>
 </hist>
@@ -39024,7 +39020,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4111</v>
+<v>4114</v>
 </b>
 </bs>
 </hist>
@@ -39148,15 +39144,15 @@
 </relation>
 <relation>
 <name>cil_getter</name>
-<cardinality>379860</cardinality>
+<cardinality>380178</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>379860</v>
+<v>380178</v>
 </e>
 <e>
 <k>method</k>
-<v>379860</v>
+<v>380178</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39170,7 +39166,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>379860</v>
+<v>380178</v>
 </b>
 </bs>
 </hist>
@@ -39186,7 +39182,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>379860</v>
+<v>380178</v>
 </b>
 </bs>
 </hist>
@@ -39196,15 +39192,15 @@
 </relation>
 <relation>
 <name>cil_adder</name>
-<cardinality>20898</cardinality>
+<cardinality>20916</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20898</v>
+<v>20916</v>
 </e>
 <e>
 <k>method</k>
-<v>20898</v>
+<v>20916</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39218,7 +39214,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20898</v>
+<v>20916</v>
 </b>
 </bs>
 </hist>
@@ -39234,7 +39230,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20898</v>
+<v>20916</v>
 </b>
 </bs>
 </hist>
@@ -39244,15 +39240,15 @@
 </relation>
 <relation>
 <name>cil_remover</name>
-<cardinality>20898</cardinality>
+<cardinality>20916</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20898</v>
+<v>20916</v>
 </e>
 <e>
 <k>method</k>
-<v>20898</v>
+<v>20916</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39266,7 +39262,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20898</v>
+<v>20916</v>
 </b>
 </bs>
 </hist>
@@ -39282,7 +39278,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20898</v>
+<v>20916</v>
 </b>
 </bs>
 </hist>
@@ -39340,23 +39336,23 @@
 </relation>
 <relation>
 <name>cil_property</name>
-<cardinality>380407</cardinality>
+<cardinality>380725</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>380407</v>
+<v>380725</v>
 </e>
 <e>
 <k>parent</k>
-<v>93773</v>
+<v>93852</v>
 </e>
 <e>
 <k>name</k>
-<v>106371</v>
+<v>106460</v>
 </e>
 <e>
 <k>property_type</k>
-<v>49888</v>
+<v>49930</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39370,7 +39366,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380407</v>
+<v>380725</v>
 </b>
 </bs>
 </hist>
@@ -39386,7 +39382,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380407</v>
+<v>380725</v>
 </b>
 </bs>
 </hist>
@@ -39402,7 +39398,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380407</v>
+<v>380725</v>
 </b>
 </bs>
 </hist>
@@ -39418,42 +39414,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28902</v>
+<v>28926</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22303</v>
+<v>22322</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11427</v>
+<v>11436</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8461</v>
+<v>8469</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5745</v>
+<v>5750</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>8671</v>
+<v>8678</v>
 </b>
 <b>
 <a>9</a>
 <b>25</b>
-<v>7106</v>
+<v>7112</v>
 </b>
 <b>
 <a>25</a>
 <b>1883</b>
-<v>1155</v>
+<v>1156</v>
 </b>
 </bs>
 </hist>
@@ -39469,42 +39465,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33652</v>
+<v>33680</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17811</v>
+<v>17826</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11324</v>
+<v>11334</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8471</v>
+<v>8478</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5725</v>
+<v>5730</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>6632</v>
+<v>6638</v>
 </b>
 <b>
 <a>8</a>
 <b>15</b>
-<v>7223</v>
+<v>7229</v>
 </b>
 <b>
 <a>15</a>
 <b>1883</b>
-<v>2931</v>
+<v>2933</v>
 </b>
 </bs>
 </hist>
@@ -39520,32 +39516,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35101</v>
+<v>35130</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25790</v>
+<v>25812</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13490</v>
+<v>13501</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8110</v>
+<v>8117</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>7764</v>
+<v>7771</v>
 </b>
 <b>
 <a>8</a>
 <b>50</b>
-<v>3516</v>
+<v>3519</v>
 </b>
 </bs>
 </hist>
@@ -39561,27 +39557,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62711</v>
+<v>62763</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21459</v>
+<v>21477</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6486</v>
+<v>6492</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8769</v>
+<v>8776</v>
 </b>
 <b>
 <a>8</a>
 <b>2134</b>
-<v>6945</v>
+<v>6950</v>
 </b>
 </bs>
 </hist>
@@ -39597,27 +39593,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62711</v>
+<v>62763</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21532</v>
+<v>21550</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6462</v>
+<v>6467</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8783</v>
+<v>8791</v>
 </b>
 <b>
 <a>8</a>
 <b>1400</b>
-<v>6881</v>
+<v>6887</v>
 </b>
 </bs>
 </hist>
@@ -39633,17 +39629,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89521</v>
+<v>89595</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10983</v>
+<v>10992</v>
 </b>
 <b>
 <a>3</a>
 <b>568</b>
-<v>5867</v>
+<v>5872</v>
 </b>
 </bs>
 </hist>
@@ -39659,27 +39655,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31457</v>
+<v>31484</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7525</v>
+<v>7531</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3184</v>
+<v>3187</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>4369</v>
+<v>4373</v>
 </b>
 <b>
 <a>8</a>
 <b>15452</b>
-<v>3350</v>
+<v>3353</v>
 </b>
 </bs>
 </hist>
@@ -39695,27 +39691,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33247</v>
+<v>33275</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7037</v>
+<v>7043</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3048</v>
+<v>3050</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>3867</v>
+<v>3870</v>
 </b>
 <b>
 <a>8</a>
 <b>5858</b>
-<v>2687</v>
+<v>2689</v>
 </b>
 </bs>
 </hist>
@@ -39731,17 +39727,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39978</v>
+<v>40011</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5316</v>
+<v>5320</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>3804</v>
+<v>3807</v>
 </b>
 <b>
 <a>12</a>
@@ -39756,23 +39752,23 @@
 </relation>
 <relation>
 <name>cil_event</name>
-<cardinality>20869</cardinality>
+<cardinality>20887</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>20869</v>
+<v>20887</v>
 </e>
 <e>
 <k>parent</k>
-<v>6467</v>
+<v>6472</v>
 </e>
 <e>
 <k>name</k>
-<v>13080</v>
+<v>13091</v>
 </e>
 <e>
 <k>event_type</k>
-<v>6803</v>
+<v>6809</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39786,7 +39782,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20869</v>
+<v>20887</v>
 </b>
 </bs>
 </hist>
@@ -39802,7 +39798,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20869</v>
+<v>20887</v>
 </b>
 </bs>
 </hist>
@@ -39818,7 +39814,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20869</v>
+<v>20887</v>
 </b>
 </bs>
 </hist>
@@ -39834,12 +39830,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5750</v>
+<v>5755</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>492</v>
+<v>493</v>
 </b>
 <b>
 <a>7</a>
@@ -39860,12 +39856,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5750</v>
+<v>5755</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>492</v>
+<v>493</v>
 </b>
 <b>
 <a>7</a>
@@ -39886,12 +39882,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5925</v>
+<v>5930</v>
 </b>
 <b>
 <a>2</a>
 <b>20</b>
-<v>487</v>
+<v>488</v>
 </b>
 <b>
 <a>30</a>
@@ -39912,17 +39908,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11671</v>
+<v>11680</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>965</v>
+<v>966</v>
 </b>
 <b>
 <a>4</a>
 <b>566</b>
-<v>443</v>
+<v>444</v>
 </b>
 </bs>
 </hist>
@@ -39938,17 +39934,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11671</v>
+<v>11680</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>965</v>
+<v>966</v>
 </b>
 <b>
 <a>4</a>
 <b>566</b>
-<v>443</v>
+<v>444</v>
 </b>
 </bs>
 </hist>
@@ -39964,7 +39960,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12485</v>
+<v>12496</v>
 </b>
 <b>
 <a>2</a>
@@ -39990,7 +39986,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>4521</v>
+<v>4524</v>
 </b>
 <b>
 <a>3</a>
@@ -40021,12 +40017,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1424</v>
+<v>1425</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5091</v>
+<v>5096</v>
 </b>
 <b>
 <a>3</a>
@@ -40047,12 +40043,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1311</v>
+<v>1313</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4350</v>
+<v>4354</v>
 </b>
 <b>
 <a>3</a>
@@ -40062,7 +40058,7 @@
 <b>
 <a>4</a>
 <b>10</b>
-<v>531</v>
+<v>532</v>
 </b>
 <b>
 <a>10</a>
@@ -40077,23 +40073,23 @@
 </relation>
 <relation>
 <name>cil_local_variable</name>
-<cardinality>1152156</cardinality>
+<cardinality>1153120</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1152156</v>
+<v>1153120</v>
 </e>
 <e>
 <k>impl</k>
-<v>349080</v>
+<v>349373</v>
 </e>
 <e>
 <k>index</k>
-<v>692</v>
+<v>693</v>
 </e>
 <e>
 <k>var_type</k>
-<v>154441</v>
+<v>154570</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40107,7 +40103,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1152156</v>
+<v>1153120</v>
 </b>
 </bs>
 </hist>
@@ -40123,7 +40119,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1152156</v>
+<v>1153120</v>
 </b>
 </bs>
 </hist>
@@ -40139,7 +40135,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1152156</v>
+<v>1153120</v>
 </b>
 </bs>
 </hist>
@@ -40155,37 +40151,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140078</v>
+<v>140195</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62111</v>
+<v>62163</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49381</v>
+<v>49423</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23503</v>
+<v>23522</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31916</v>
+<v>31943</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28892</v>
+<v>28916</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13197</v>
+<v>13208</v>
 </b>
 </bs>
 </hist>
@@ -40201,37 +40197,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140078</v>
+<v>140195</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62111</v>
+<v>62163</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49381</v>
+<v>49423</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23503</v>
+<v>23522</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31916</v>
+<v>31943</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28892</v>
+<v>28916</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13197</v>
+<v>13208</v>
 </b>
 </bs>
 </hist>
@@ -40247,32 +40243,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>168770</v>
+<v>168911</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70104</v>
+<v>70163</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>37881</v>
+<v>37912</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>20630</v>
+<v>20647</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>27726</v>
+<v>27750</v>
 </b>
 <b>
 <a>7</a>
 <b>47</b>
-<v>23966</v>
+<v>23986</v>
 </b>
 </bs>
 </hist>
@@ -40506,37 +40502,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>81385</v>
+<v>81454</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27292</v>
+<v>27315</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8379</v>
+<v>8386</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11841</v>
+<v>11851</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>12802</v>
+<v>12813</v>
 </b>
 <b>
 <a>8</a>
 <b>76</b>
-<v>11593</v>
+<v>11602</v>
 </b>
 <b>
 <a>76</a>
 <b>35710</b>
-<v>1146</v>
+<v>1147</v>
 </b>
 </bs>
 </hist>
@@ -40552,32 +40548,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85424</v>
+<v>85495</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31038</v>
+<v>31064</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8393</v>
+<v>8400</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11710</v>
+<v>11719</v>
 </b>
 <b>
 <a>5</a>
 <b>14</b>
-<v>12036</v>
+<v>12047</v>
 </b>
 <b>
 <a>14</a>
 <b>21451</b>
-<v>5838</v>
+<v>5842</v>
 </b>
 </bs>
 </hist>
@@ -40593,27 +40589,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96739</v>
+<v>96820</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>28721</v>
+<v>28745</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13782</v>
+<v>13794</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>11890</v>
+<v>11900</v>
 </b>
 <b>
 <a>9</a>
 <b>122</b>
-<v>3306</v>
+<v>3309</v>
 </b>
 </bs>
 </hist>
@@ -40623,15 +40619,15 @@
 </relation>
 <relation>
 <name>cil_handler</name>
-<cardinality>101587</cardinality>
+<cardinality>101672</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>101587</v>
+<v>101672</v>
 </e>
 <e>
 <k>impl</k>
-<v>71519</v>
+<v>71579</v>
 </e>
 <e>
 <k>index</k>
@@ -40643,15 +40639,15 @@
 </e>
 <e>
 <k>try_start</k>
-<v>97744</v>
+<v>97825</v>
 </e>
 <e>
 <k>try_end</k>
-<v>99963</v>
+<v>100046</v>
 </e>
 <e>
 <k>handler_start</k>
-<v>101587</v>
+<v>101672</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40665,7 +40661,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -40681,7 +40677,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -40697,7 +40693,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -40713,7 +40709,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -40729,7 +40725,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -40745,7 +40741,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -40761,22 +40757,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53849</v>
+<v>53894</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11168</v>
+<v>11178</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5433</v>
+<v>5437</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>1068</v>
+<v>1069</v>
 </b>
 </bs>
 </hist>
@@ -40792,22 +40788,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53849</v>
+<v>53894</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11168</v>
+<v>11178</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5433</v>
+<v>5437</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>1068</v>
+<v>1069</v>
 </b>
 </bs>
 </hist>
@@ -40823,12 +40819,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>61945</v>
+<v>61997</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9349</v>
+<v>9357</v>
 </b>
 <b>
 <a>3</a>
@@ -40849,22 +40845,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54878</v>
+<v>54924</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10861</v>
+<v>10870</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>5535</v>
+<v>5540</v>
 </b>
 <b>
 <a>7</a>
 <b>15</b>
-<v>243</v>
+<v>244</v>
 </b>
 </bs>
 </hist>
@@ -40880,17 +40876,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54400</v>
+<v>54445</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11081</v>
+<v>11090</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>5530</v>
+<v>5535</v>
 </b>
 <b>
 <a>6</a>
@@ -40911,22 +40907,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53849</v>
+<v>53894</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11168</v>
+<v>11178</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5433</v>
+<v>5437</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>1068</v>
+<v>1069</v>
 </b>
 </bs>
 </hist>
@@ -41589,12 +41585,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94442</v>
+<v>94521</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3301</v>
+<v>3304</v>
 </b>
 </bs>
 </hist>
@@ -41610,7 +41606,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97744</v>
+<v>97825</v>
 </b>
 </bs>
 </hist>
@@ -41626,12 +41622,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94442</v>
+<v>94521</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3301</v>
+<v>3304</v>
 </b>
 </bs>
 </hist>
@@ -41647,12 +41643,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95480</v>
+<v>95560</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>2263</v>
+<v>2264</v>
 </b>
 </bs>
 </hist>
@@ -41668,12 +41664,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95524</v>
+<v>95604</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2219</v>
+<v>2220</v>
 </b>
 </bs>
 </hist>
@@ -41689,12 +41685,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94442</v>
+<v>94521</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3301</v>
+<v>3304</v>
 </b>
 </bs>
 </hist>
@@ -41710,12 +41706,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98734</v>
+<v>98816</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>1229</v>
+<v>1230</v>
 </b>
 </bs>
 </hist>
@@ -41731,7 +41727,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99963</v>
+<v>100046</v>
 </b>
 </bs>
 </hist>
@@ -41747,12 +41743,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98734</v>
+<v>98816</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>1229</v>
+<v>1230</v>
 </b>
 </bs>
 </hist>
@@ -41768,7 +41764,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99787</v>
+<v>99871</v>
 </b>
 <b>
 <a>2</a>
@@ -41789,7 +41785,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99963</v>
+<v>100046</v>
 </b>
 </bs>
 </hist>
@@ -41805,12 +41801,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98734</v>
+<v>98816</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>1229</v>
+<v>1230</v>
 </b>
 </bs>
 </hist>
@@ -41826,7 +41822,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -41842,7 +41838,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -41858,7 +41854,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -41874,7 +41870,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -41890,7 +41886,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -41906,7 +41902,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101587</v>
+<v>101672</v>
 </b>
 </bs>
 </hist>
@@ -41916,15 +41912,15 @@
 </relation>
 <relation>
 <name>cil_handler_filter</name>
-<cardinality>809</cardinality>
+<cardinality>810</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>809</v>
+<v>810</v>
 </e>
 <e>
 <k>filter_start</k>
-<v>809</v>
+<v>810</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41938,7 +41934,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>809</v>
+<v>810</v>
 </b>
 </bs>
 </hist>
@@ -41954,7 +41950,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>809</v>
+<v>810</v>
 </b>
 </bs>
 </hist>
@@ -41964,15 +41960,15 @@
 </relation>
 <relation>
 <name>cil_handler_type</name>
-<cardinality>43865</cardinality>
+<cardinality>43902</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>43865</v>
+<v>43902</v>
 </e>
 <e>
 <k>catch_type</k>
-<v>1263</v>
+<v>1264</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41986,7 +41982,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43865</v>
+<v>43902</v>
 </b>
 </bs>
 </hist>
@@ -42002,7 +41998,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>438</v>
+<v>439</v>
 </b>
 <b>
 <a>2</a>
@@ -42047,15 +42043,15 @@
 </relation>
 <relation>
 <name>cil_method_stack_size</name>
-<cardinality>1728026</cardinality>
+<cardinality>1729473</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>1728026</v>
+<v>1729473</v>
 </e>
 <e>
 <k>size</k>
-<v>160</v>
+<v>161</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42069,7 +42065,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1728026</v>
+<v>1729473</v>
 </b>
 </bs>
 </hist>
@@ -42150,110 +42146,110 @@
 </relation>
 <relation>
 <name>cil_public</name>
-<cardinality>1912463</cardinality>
+<cardinality>1914064</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1912463</v>
+<v>1914064</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_private</name>
-<cardinality>929521</cardinality>
+<cardinality>930299</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>929521</v>
+<v>930299</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_protected</name>
-<cardinality>1819747</cardinality>
+<cardinality>1821270</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1819747</v>
+<v>1821270</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_internal</name>
-<cardinality>41719</cardinality>
+<cardinality>41754</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>41719</v>
+<v>41754</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_static</name>
-<cardinality>795554</cardinality>
+<cardinality>796220</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>795554</v>
+<v>796220</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_sealed</name>
-<cardinality>356845</cardinality>
+<cardinality>357144</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>356845</v>
+<v>357144</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_virtual</name>
-<cardinality>678150</cardinality>
+<cardinality>678718</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>678150</v>
+<v>678718</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_abstract</name>
-<cardinality>165317</cardinality>
+<cardinality>165456</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>165317</v>
+<v>165456</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_class</name>
-<cardinality>238753</cardinality>
+<cardinality>238953</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>238753</v>
+<v>238953</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_interface</name>
-<cardinality>16562</cardinality>
+<cardinality>16576</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16562</v>
+<v>16576</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -42282,37 +42278,37 @@
 </relation>
 <relation>
 <name>cil_specialname</name>
-<cardinality>811649</cardinality>
+<cardinality>812328</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>811649</v>
+<v>812328</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_newslot</name>
-<cardinality>422614</cardinality>
+<cardinality>422968</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>422614</v>
+<v>422968</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_base_class</name>
-<cardinality>235768</cardinality>
+<cardinality>235966</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235768</v>
+<v>235966</v>
 </e>
 <e>
 <k>base</k>
-<v>21425</v>
+<v>21443</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42326,7 +42322,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235768</v>
+<v>235966</v>
 </b>
 </bs>
 </hist>
@@ -42342,32 +42338,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12324</v>
+<v>12335</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3862</v>
+<v>3865</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1614</v>
+<v>1615</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>1892</v>
+<v>1893</v>
 </b>
 <b>
 <a>7</a>
 <b>84</b>
-<v>1609</v>
+<v>1610</v>
 </b>
 <b>
 <a>86</a>
 <b>23834</b>
-<v>121</v>
+<v>122</v>
 </b>
 </bs>
 </hist>
@@ -42377,15 +42373,15 @@
 </relation>
 <relation>
 <name>cil_base_interface</name>
-<cardinality>125305</cardinality>
+<cardinality>125409</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>68651</v>
+<v>68708</v>
 </e>
 <e>
 <k>base</k>
-<v>31218</v>
+<v>31245</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42399,22 +42395,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>47733</v>
+<v>47773</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8120</v>
+<v>8127</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>6267</v>
+<v>6272</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>5379</v>
+<v>5384</v>
 </b>
 <b>
 <a>9</a>
@@ -42435,22 +42431,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22493</v>
+<v>22512</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3433</v>
+<v>3436</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2521</v>
+<v>2523</v>
 </b>
 <b>
 <a>5</a>
 <b>30</b>
-<v>2345</v>
+<v>2347</v>
 </b>
 <b>
 <a>30</a>
@@ -42465,11 +42461,11 @@
 </relation>
 <relation>
 <name>cil_enum_underlying_type</name>
-<cardinality>14080</cardinality>
+<cardinality>14092</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14080</v>
+<v>14092</v>
 </e>
 <e>
 <k>underlying</k>
@@ -42487,7 +42483,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14080</v>
+<v>14092</v>
 </b>
 </bs>
 </hist>
@@ -42548,11 +42544,11 @@
 </relation>
 <relation>
 <name>cil_type_parameter</name>
-<cardinality>185002</cardinality>
+<cardinality>185156</cardinality>
 <columnsizes>
 <e>
 <k>unbound</k>
-<v>103996</v>
+<v>104083</v>
 </e>
 <e>
 <k>index</k>
@@ -42560,7 +42556,7 @@
 </e>
 <e>
 <k>param</k>
-<v>185002</v>
+<v>185156</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42574,22 +42570,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75045</v>
+<v>75108</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19016</v>
+<v>19032</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8164</v>
+<v>8171</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>1770</v>
+<v>1771</v>
 </b>
 </bs>
 </hist>
@@ -42605,22 +42601,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75045</v>
+<v>75108</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19016</v>
+<v>19032</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8164</v>
+<v>8171</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>1770</v>
+<v>1771</v>
 </b>
 </bs>
 </hist>
@@ -42868,7 +42864,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185002</v>
+<v>185156</v>
 </b>
 </bs>
 </hist>
@@ -42884,7 +42880,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185002</v>
+<v>185156</v>
 </b>
 </bs>
 </hist>
@@ -42894,11 +42890,11 @@
 </relation>
 <relation>
 <name>cil_type_argument</name>
-<cardinality>737969</cardinality>
+<cardinality>738587</cardinality>
 <columnsizes>
 <e>
 <k>bound</k>
-<v>481911</v>
+<v>482314</v>
 </e>
 <e>
 <k>index</k>
@@ -42906,7 +42902,7 @@
 </e>
 <e>
 <k>t</k>
-<v>252497</v>
+<v>252709</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42920,17 +42916,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>336575</v>
+<v>336857</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>117496</v>
+<v>117595</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27839</v>
+<v>27862</v>
 </b>
 </bs>
 </hist>
@@ -42946,17 +42942,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>341487</v>
+<v>341772</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>115379</v>
+<v>115476</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>25044</v>
+<v>25065</v>
 </b>
 </bs>
 </hist>
@@ -43184,27 +43180,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100436</v>
+<v>100520</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>72836</v>
+<v>72897</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>42538</v>
+<v>42574</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>20128</v>
+<v>20145</v>
 </b>
 <b>
 <a>6</a>
 <b>4208</b>
-<v>16558</v>
+<v>16571</v>
 </b>
 </bs>
 </hist>
@@ -43220,17 +43216,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>191030</v>
+<v>191190</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55551</v>
+<v>55597</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>5916</v>
+<v>5920</v>
 </b>
 </bs>
 </hist>
@@ -43331,19 +43327,19 @@
 </relation>
 <relation>
 <name>cil_attribute</name>
-<cardinality>328703</cardinality>
+<cardinality>328979</cardinality>
 <columnsizes>
 <e>
 <k>attributeid</k>
-<v>328703</v>
+<v>328979</v>
 </e>
 <e>
 <k>element</k>
-<v>248903</v>
+<v>249111</v>
 </e>
 <e>
 <k>constructor</k>
-<v>3379</v>
+<v>3382</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43357,7 +43353,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328703</v>
+<v>328979</v>
 </b>
 </bs>
 </hist>
@@ -43373,7 +43369,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328703</v>
+<v>328979</v>
 </b>
 </bs>
 </hist>
@@ -43389,17 +43385,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>197590</v>
+<v>197755</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36739</v>
+<v>36770</v>
 </b>
 <b>
 <a>3</a>
 <b>92</b>
-<v>14573</v>
+<v>14585</v>
 </b>
 </bs>
 </hist>
@@ -43415,17 +43411,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>213465</v>
+<v>213644</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31033</v>
+<v>31059</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>4404</v>
+<v>4407</v>
 </b>
 </bs>
 </hist>
@@ -43446,7 +43442,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>399</v>
+<v>400</v>
 </b>
 <b>
 <a>3</a>
@@ -43507,7 +43503,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>599</v>
+<v>600</v>
 </b>
 <b>
 <a>2</a>
@@ -43517,7 +43513,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>282</v>
+<v>283</v>
 </b>
 <b>
 <a>4</a>
@@ -43527,12 +43523,12 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>243</v>
+<v>244</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>282</v>
+<v>283</v>
 </b>
 <b>
 <a>10</a>
@@ -43557,7 +43553,7 @@
 <b>
 <a>152</a>
 <b>15028</b>
-<v>238</v>
+<v>239</v>
 </b>
 </bs>
 </hist>
@@ -43567,11 +43563,11 @@
 </relation>
 <relation>
 <name>cil_attribute_named_argument</name>
-<cardinality>5564</cardinality>
+<cardinality>5569</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>4628</v>
+<v>4632</v>
 </e>
 <e>
 <k>param</k>
@@ -43579,7 +43575,7 @@
 </e>
 <e>
 <k>value</k>
-<v>1097</v>
+<v>1098</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43593,7 +43589,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3765</v>
+<v>3768</v>
 </b>
 <b>
 <a>2</a>
@@ -43619,7 +43615,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4057</v>
+<v>4061</v>
 </b>
 <b>
 <a>2</a>
@@ -43767,12 +43763,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>721</v>
+<v>722</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>238</v>
+<v>239</v>
 </b>
 <b>
 <a>3</a>
@@ -43798,7 +43794,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1068</v>
+<v>1069</v>
 </b>
 <b>
 <a>2</a>
@@ -43813,11 +43809,11 @@
 </relation>
 <relation>
 <name>cil_attribute_positional_argument</name>
-<cardinality>96275</cardinality>
+<cardinality>96356</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>90145</v>
+<v>90220</v>
 </e>
 <e>
 <k>index</k>
@@ -43825,7 +43821,7 @@
 </e>
 <e>
 <k>value</k>
-<v>17133</v>
+<v>17147</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43839,12 +43835,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85458</v>
+<v>85529</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4686</v>
+<v>4690</v>
 </b>
 </bs>
 </hist>
@@ -43860,12 +43856,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85468</v>
+<v>85539</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4677</v>
+<v>4681</v>
 </b>
 </bs>
 </hist>
@@ -43958,22 +43954,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12353</v>
+<v>12364</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2462</v>
+<v>2465</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>1429</v>
+<v>1430</v>
 </b>
 <b>
 <a>6</a>
 <b>5555</b>
-<v>887</v>
+<v>888</v>
 </b>
 </bs>
 </hist>
@@ -43989,12 +43985,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16806</v>
+<v>16820</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>326</v>
+<v>327</v>
 </b>
 </bs>
 </hist>
@@ -44004,19 +44000,19 @@
 </relation>
 <relation>
 <name>metadata_handle</name>
-<cardinality>6184463</cardinality>
+<cardinality>6189640</cardinality>
 <columnsizes>
 <e>
 <k>entity</k>
-<v>5693041</v>
+<v>5697807</v>
 </e>
 <e>
 <k>location</k>
-<v>3418</v>
+<v>3421</v>
 </e>
 <e>
 <k>handle</k>
-<v>274391</v>
+<v>274621</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44030,17 +44026,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5219820</v>
+<v>5224190</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>464192</v>
+<v>464581</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>9027</v>
+<v>9035</v>
 </b>
 </bs>
 </hist>
@@ -44056,12 +44052,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5451995</v>
+<v>5456559</v>
 </b>
 <b>
 <a>2</a>
 <b>59</b>
-<v>241045</v>
+<v>241247</v>
 </b>
 </bs>
 </hist>
@@ -44163,7 +44159,7 @@
 <b>
 <a>3</a>
 <b>20</b>
-<v>282</v>
+<v>283</v>
 </b>
 <b>
 <a>20</a>
@@ -44218,7 +44214,7 @@
 <b>
 <a>2710</a>
 <b>55264</b>
-<v>243</v>
+<v>244</v>
 </b>
 </bs>
 </hist>
@@ -44234,62 +44230,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18952</v>
+<v>18968</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>45065</v>
+<v>45103</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>23937</v>
+<v>23957</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>17528</v>
+<v>17543</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>30165</v>
+<v>30190</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>18991</v>
+<v>19007</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>22108</v>
+<v>22126</v>
 </b>
 <b>
 <a>11</a>
 <b>13</b>
-<v>21054</v>
+<v>21072</v>
 </b>
 <b>
 <a>13</a>
 <b>21</b>
-<v>21484</v>
+<v>21502</v>
 </b>
 <b>
 <a>21</a>
 <b>39</b>
-<v>21147</v>
+<v>21165</v>
 </b>
 <b>
 <a>39</a>
 <b>83</b>
-<v>20591</v>
+<v>20608</v>
 </b>
 <b>
 <a>83</a>
 <b>1061</b>
-<v>13363</v>
+<v>13374</v>
 </b>
 </bs>
 </hist>
@@ -44305,52 +44301,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62964</v>
+<v>63017</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21113</v>
+<v>21131</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>47030</v>
+<v>47070</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18952</v>
+<v>18968</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>19416</v>
+<v>19432</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>22083</v>
+<v>22102</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>23313</v>
+<v>23332</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>22015</v>
+<v>22034</v>
 </b>
 <b>
 <a>19</a>
 <b>41</b>
-<v>20874</v>
+<v>20891</v>
 </b>
 <b>
 <a>41</a>
 <b>702</b>
-<v>16626</v>
+<v>16640</v>
 </b>
 </bs>
 </hist>

From ce5851445369c99d86b1a8eecd7e6fcb6ff4ee79 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 15 Jan 2021 08:26:38 +0100
Subject: [PATCH 150/343] Change release note date

---
 ...-19-Relational-pattern.md => 2021-01-15-Relational-pattern.md} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename csharp/change-notes/{2020-11-19-Relational-pattern.md => 2021-01-15-Relational-pattern.md} (100%)

diff --git a/csharp/change-notes/2020-11-19-Relational-pattern.md b/csharp/change-notes/2021-01-15-Relational-pattern.md
similarity index 100%
rename from csharp/change-notes/2020-11-19-Relational-pattern.md
rename to csharp/change-notes/2021-01-15-Relational-pattern.md

From 8400a3862be289261bd94e19c1e0e4e54346e1f0 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 15 Jan 2021 08:29:44 +0100
Subject: [PATCH 151/343] Add DB upgrade folder

---
 .../old.dbscheme                              | 1917 ++++++++++++++++
 .../semmlecode.csharp.dbscheme                | 1922 +++++++++++++++++
 .../upgrade.properties                        |    2 +
 3 files changed, 3841 insertions(+)
 create mode 100644 csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/old.dbscheme
 create mode 100644 csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/semmlecode.csharp.dbscheme
 create mode 100644 csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/upgrade.properties

diff --git a/csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/old.dbscheme b/csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/old.dbscheme
new file mode 100644
index 00000000000..5f6770a8a17
--- /dev/null
+++ b/csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/old.dbscheme
@@ -0,0 +1,1917 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 126 = @not_pattern_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+
+#keyset[method, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int method: @cil_method ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/semmlecode.csharp.dbscheme b/csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/semmlecode.csharp.dbscheme
new file mode 100644
index 00000000000..98e37f65f0a
--- /dev/null
+++ b/csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/semmlecode.csharp.dbscheme
@@ -0,0 +1,1922 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+
+#keyset[method, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int method: @cil_method ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/upgrade.properties b/csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/upgrade.properties
new file mode 100644
index 00000000000..87219db2b0a
--- /dev/null
+++ b/csharp/upgrades/5f6770a8a174aa0b651375a847d9686533d3f528/upgrade.properties
@@ -0,0 +1,2 @@
+description: Add relational patterns to the list of 'expr' types.
+compatibility: backwards

From ff1d0cc4c7fc8afcf076b1afc5c64d15b565796e Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 18 Jan 2021 10:54:27 +0000
Subject: [PATCH 152/343] JS: Recognize DomSanitizer from @angular/core

---
 javascript/ql/src/semmle/javascript/frameworks/Angular2.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 199471e9a65..302cfade52e 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -120,7 +120,7 @@ module Angular2 {
 
   /** Gets a reference to a `DomSanitizer` object. */
   DataFlow::SourceNode domSanitizer() {
-    result.hasUnderlyingType("@angular/platform-browser", "DomSanitizer")
+    result.hasUnderlyingType(["@angular/platform-browser", "@angular/core"], "DomSanitizer")
   }
 
   /** A value that is about to be promoted to a trusted HTML or CSS value. */

From 2752b4ba649e495dbc9bd687d1f7721446539988 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 18 Jan 2021 10:54:39 +0000
Subject: [PATCH 153/343] JS: Shift line numbers in test

---
 .../Security/CWE-079/DomBasedXss/Xss.expected | 170 +++++++++---------
 .../XssWithAdditionalSources.expected         | 144 +++++++--------
 .../CWE-079/DomBasedXss/angular2-client.ts    |   7 +-
 3 files changed, 162 insertions(+), 159 deletions(-)

diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
index 9bafa0ee6ed..701157e6164 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
@@ -15,50 +15,50 @@ nodes
 | addEventListener.js:12:24:12:28 | event |
 | addEventListener.js:12:24:12:33 | event.data |
 | addEventListener.js:12:24:12:33 | event.data |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() |
-| angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params |
-| angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams |
-| angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:25:44:25:71 | this.ro ... ragment |
-| angular2-client.ts:25:44:25:71 | this.ro ... ragment |
-| angular2-client.ts:25:44:25:71 | this.ro ... ragment |
-| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
-| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
-| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
-| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
-| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
-| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
-| angular2-client.ts:29:46:29:59 | map.get('foo') |
-| angular2-client.ts:29:46:29:59 | map.get('foo') |
-| angular2-client.ts:29:46:29:59 | map.get('foo') |
-| angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
-| angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
-| angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters |
-| angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
-| angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
-| angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params |
-| angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:37:44:37:58 | this.router.url |
-| angular2-client.ts:37:44:37:58 | this.router.url |
-| angular2-client.ts:37:44:37:58 | this.router.url |
-| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
-| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
-| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() |
+| angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params |
+| angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams |
+| angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:26:44:26:71 | this.ro ... ragment |
+| angular2-client.ts:26:44:26:71 | this.ro ... ragment |
+| angular2-client.ts:26:44:26:71 | this.ro ... ragment |
+| angular2-client.ts:27:44:27:82 | this.ro ... ('foo') |
+| angular2-client.ts:27:44:27:82 | this.ro ... ('foo') |
+| angular2-client.ts:27:44:27:82 | this.ro ... ('foo') |
+| angular2-client.ts:28:44:28:87 | this.ro ... ('foo') |
+| angular2-client.ts:28:44:28:87 | this.ro ... ('foo') |
+| angular2-client.ts:28:44:28:87 | this.ro ... ('foo') |
+| angular2-client.ts:30:46:30:59 | map.get('foo') |
+| angular2-client.ts:30:46:30:59 | map.get('foo') |
+| angular2-client.ts:30:46:30:59 | map.get('foo') |
+| angular2-client.ts:33:44:33:74 | this.ro ... 1].path |
+| angular2-client.ts:33:44:33:74 | this.ro ... 1].path |
+| angular2-client.ts:33:44:33:74 | this.ro ... 1].path |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters |
+| angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:35:44:35:91 | this.ro ... et('x') |
+| angular2-client.ts:35:44:35:91 | this.ro ... et('x') |
+| angular2-client.ts:35:44:35:91 | this.ro ... et('x') |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params |
+| angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
+| angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
+| angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:47:7:69 | classNa ... w.name) |
@@ -670,34 +670,34 @@ edges
 | addEventListener.js:10:21:10:25 | event | addEventListener.js:12:24:12:28 | event |
 | addEventListener.js:12:24:12:28 | event | addEventListener.js:12:24:12:33 | event.data |
 | addEventListener.js:12:24:12:28 | event | addEventListener.js:12:24:12:33 | event.data |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:25:44:25:71 | this.ro ... ragment | angular2-client.ts:25:44:25:71 | this.ro ... ragment |
-| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') | angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
-| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') | angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
-| angular2-client.ts:29:46:29:59 | map.get('foo') | angular2-client.ts:29:46:29:59 | map.get('foo') |
-| angular2-client.ts:32:44:32:74 | this.ro ... 1].path | angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:34:44:34:91 | this.ro ... et('x') | angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:37:44:37:58 | this.router.url | angular2-client.ts:37:44:37:58 | this.router.url |
-| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') | angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params | angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params | angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params | angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params | angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams | angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams | angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams | angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams | angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:26:44:26:71 | this.ro ... ragment | angular2-client.ts:26:44:26:71 | this.ro ... ragment |
+| angular2-client.ts:27:44:27:82 | this.ro ... ('foo') | angular2-client.ts:27:44:27:82 | this.ro ... ('foo') |
+| angular2-client.ts:28:44:28:87 | this.ro ... ('foo') | angular2-client.ts:28:44:28:87 | this.ro ... ('foo') |
+| angular2-client.ts:30:46:30:59 | map.get('foo') | angular2-client.ts:30:46:30:59 | map.get('foo') |
+| angular2-client.ts:33:44:33:74 | this.ro ... 1].path | angular2-client.ts:33:44:33:74 | this.ro ... 1].path |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters | angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters | angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters | angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters | angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:35:44:35:91 | this.ro ... et('x') | angular2-client.ts:35:44:35:91 | this.ro ... et('x') |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:38:44:38:58 | this.router.url | angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:58:7:68 | window.name | classnames.js:7:47:7:69 | classNa ... w.name) |
@@ -1226,19 +1226,19 @@ edges
 | addEventListener.js:2:20:2:29 | event.data | addEventListener.js:1:43:1:47 | event | addEventListener.js:2:20:2:29 | event.data | Cross-site scripting vulnerability due to $@. | addEventListener.js:1:43:1:47 | event | user-provided value |
 | addEventListener.js:6:20:6:23 | data | addEventListener.js:5:43:5:48 | {data} | addEventListener.js:6:20:6:23 | data | Cross-site scripting vulnerability due to $@. | addEventListener.js:5:43:5:48 | {data} | user-provided value |
 | addEventListener.js:12:24:12:33 | event.data | addEventListener.js:10:21:10:25 | event | addEventListener.js:12:24:12:33 | event.data | Cross-site scripting vulnerability due to $@. | addEventListener.js:10:21:10:25 | event | user-provided value |
-| angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href | angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href | Cross-site scripting vulnerability due to $@. | angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | user-provided value |
-| angular2-client.ts:23:44:23:73 | this.ro ... ams.foo | angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo | Cross-site scripting vulnerability due to $@. | angular2-client.ts:23:44:23:69 | this.ro ... .params | user-provided value |
-| angular2-client.ts:24:44:24:78 | this.ro ... ams.foo | angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo | Cross-site scripting vulnerability due to $@. | angular2-client.ts:24:44:24:74 | this.ro ... yParams | user-provided value |
-| angular2-client.ts:25:44:25:71 | this.ro ... ragment | angular2-client.ts:25:44:25:71 | this.ro ... ragment | angular2-client.ts:25:44:25:71 | this.ro ... ragment | Cross-site scripting vulnerability due to $@. | angular2-client.ts:25:44:25:71 | this.ro ... ragment | user-provided value |
-| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') | angular2-client.ts:26:44:26:82 | this.ro ... ('foo') | angular2-client.ts:26:44:26:82 | this.ro ... ('foo') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:26:44:26:82 | this.ro ... ('foo') | user-provided value |
-| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') | angular2-client.ts:27:44:27:87 | this.ro ... ('foo') | angular2-client.ts:27:44:27:87 | this.ro ... ('foo') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:27:44:27:87 | this.ro ... ('foo') | user-provided value |
-| angular2-client.ts:29:46:29:59 | map.get('foo') | angular2-client.ts:29:46:29:59 | map.get('foo') | angular2-client.ts:29:46:29:59 | map.get('foo') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:29:46:29:59 | map.get('foo') | user-provided value |
-| angular2-client.ts:32:44:32:74 | this.ro ... 1].path | angular2-client.ts:32:44:32:74 | this.ro ... 1].path | angular2-client.ts:32:44:32:74 | this.ro ... 1].path | Cross-site scripting vulnerability due to $@. | angular2-client.ts:32:44:32:74 | this.ro ... 1].path | user-provided value |
-| angular2-client.ts:33:44:33:82 | this.ro ... eters.x | angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x | Cross-site scripting vulnerability due to $@. | angular2-client.ts:33:44:33:80 | this.ro ... ameters | user-provided value |
-| angular2-client.ts:34:44:34:91 | this.ro ... et('x') | angular2-client.ts:34:44:34:91 | this.ro ... et('x') | angular2-client.ts:34:44:34:91 | this.ro ... et('x') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:34:44:34:91 | this.ro ... et('x') | user-provided value |
-| angular2-client.ts:35:44:35:91 | this.ro ... arams.x | angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x | Cross-site scripting vulnerability due to $@. | angular2-client.ts:35:44:35:89 | this.ro ... .params | user-provided value |
-| angular2-client.ts:37:44:37:58 | this.router.url | angular2-client.ts:37:44:37:58 | this.router.url | angular2-client.ts:37:44:37:58 | this.router.url | Cross-site scripting vulnerability due to $@. | angular2-client.ts:37:44:37:58 | this.router.url | user-provided value |
-| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') | angular2-client.ts:41:44:41:76 | routeSn ... ('foo') | angular2-client.ts:41:44:41:76 | routeSn ... ('foo') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:41:44:41:76 | routeSn ... ('foo') | user-provided value |
+| angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href | angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href | Cross-site scripting vulnerability due to $@. | angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | user-provided value |
+| angular2-client.ts:24:44:24:73 | this.ro ... ams.foo | angular2-client.ts:24:44:24:69 | this.ro ... .params | angular2-client.ts:24:44:24:73 | this.ro ... ams.foo | Cross-site scripting vulnerability due to $@. | angular2-client.ts:24:44:24:69 | this.ro ... .params | user-provided value |
+| angular2-client.ts:25:44:25:78 | this.ro ... ams.foo | angular2-client.ts:25:44:25:74 | this.ro ... yParams | angular2-client.ts:25:44:25:78 | this.ro ... ams.foo | Cross-site scripting vulnerability due to $@. | angular2-client.ts:25:44:25:74 | this.ro ... yParams | user-provided value |
+| angular2-client.ts:26:44:26:71 | this.ro ... ragment | angular2-client.ts:26:44:26:71 | this.ro ... ragment | angular2-client.ts:26:44:26:71 | this.ro ... ragment | Cross-site scripting vulnerability due to $@. | angular2-client.ts:26:44:26:71 | this.ro ... ragment | user-provided value |
+| angular2-client.ts:27:44:27:82 | this.ro ... ('foo') | angular2-client.ts:27:44:27:82 | this.ro ... ('foo') | angular2-client.ts:27:44:27:82 | this.ro ... ('foo') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:27:44:27:82 | this.ro ... ('foo') | user-provided value |
+| angular2-client.ts:28:44:28:87 | this.ro ... ('foo') | angular2-client.ts:28:44:28:87 | this.ro ... ('foo') | angular2-client.ts:28:44:28:87 | this.ro ... ('foo') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:28:44:28:87 | this.ro ... ('foo') | user-provided value |
+| angular2-client.ts:30:46:30:59 | map.get('foo') | angular2-client.ts:30:46:30:59 | map.get('foo') | angular2-client.ts:30:46:30:59 | map.get('foo') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:30:46:30:59 | map.get('foo') | user-provided value |
+| angular2-client.ts:33:44:33:74 | this.ro ... 1].path | angular2-client.ts:33:44:33:74 | this.ro ... 1].path | angular2-client.ts:33:44:33:74 | this.ro ... 1].path | Cross-site scripting vulnerability due to $@. | angular2-client.ts:33:44:33:74 | this.ro ... 1].path | user-provided value |
+| angular2-client.ts:34:44:34:82 | this.ro ... eters.x | angular2-client.ts:34:44:34:80 | this.ro ... ameters | angular2-client.ts:34:44:34:82 | this.ro ... eters.x | Cross-site scripting vulnerability due to $@. | angular2-client.ts:34:44:34:80 | this.ro ... ameters | user-provided value |
+| angular2-client.ts:35:44:35:91 | this.ro ... et('x') | angular2-client.ts:35:44:35:91 | this.ro ... et('x') | angular2-client.ts:35:44:35:91 | this.ro ... et('x') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:35:44:35:91 | this.ro ... et('x') | user-provided value |
+| angular2-client.ts:36:44:36:91 | this.ro ... arams.x | angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x | Cross-site scripting vulnerability due to $@. | angular2-client.ts:36:44:36:89 | this.ro ... .params | user-provided value |
+| angular2-client.ts:38:44:38:58 | this.router.url | angular2-client.ts:38:44:38:58 | this.router.url | angular2-client.ts:38:44:38:58 | this.router.url | Cross-site scripting vulnerability due to $@. | angular2-client.ts:38:44:38:58 | this.router.url | user-provided value |
+| angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | user-provided value |
 | classnames.js:7:31:7:84 | `<span  ... <span>` | classnames.js:7:58:7:68 | window.name | classnames.js:7:31:7:84 | `<span  ... <span>` | Cross-site scripting vulnerability due to $@. | classnames.js:7:58:7:68 | window.name | user-provided value |
 | classnames.js:8:31:8:85 | `<span  ... <span>` | classnames.js:8:59:8:69 | window.name | classnames.js:8:31:8:85 | `<span  ... <span>` | Cross-site scripting vulnerability due to $@. | classnames.js:8:59:8:69 | window.name | user-provided value |
 | classnames.js:9:31:9:85 | `<span  ... <span>` | classnames.js:9:59:9:69 | window.name | classnames.js:9:31:9:85 | `<span  ... <span>` | Cross-site scripting vulnerability due to $@. | classnames.js:9:59:9:69 | window.name | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
index 2090fed75d2..70090d56718 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
@@ -15,50 +15,50 @@ nodes
 | addEventListener.js:12:24:12:28 | event |
 | addEventListener.js:12:24:12:33 | event.data |
 | addEventListener.js:12:24:12:33 | event.data |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() |
-| angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params |
-| angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams |
-| angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:25:44:25:71 | this.ro ... ragment |
-| angular2-client.ts:25:44:25:71 | this.ro ... ragment |
-| angular2-client.ts:25:44:25:71 | this.ro ... ragment |
-| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
-| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
-| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
-| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
-| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
-| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
-| angular2-client.ts:29:46:29:59 | map.get('foo') |
-| angular2-client.ts:29:46:29:59 | map.get('foo') |
-| angular2-client.ts:29:46:29:59 | map.get('foo') |
-| angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
-| angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
-| angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters |
-| angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
-| angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
-| angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params |
-| angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:37:44:37:58 | this.router.url |
-| angular2-client.ts:37:44:37:58 | this.router.url |
-| angular2-client.ts:37:44:37:58 | this.router.url |
-| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
-| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
-| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() |
+| angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params |
+| angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams |
+| angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:26:44:26:71 | this.ro ... ragment |
+| angular2-client.ts:26:44:26:71 | this.ro ... ragment |
+| angular2-client.ts:26:44:26:71 | this.ro ... ragment |
+| angular2-client.ts:27:44:27:82 | this.ro ... ('foo') |
+| angular2-client.ts:27:44:27:82 | this.ro ... ('foo') |
+| angular2-client.ts:27:44:27:82 | this.ro ... ('foo') |
+| angular2-client.ts:28:44:28:87 | this.ro ... ('foo') |
+| angular2-client.ts:28:44:28:87 | this.ro ... ('foo') |
+| angular2-client.ts:28:44:28:87 | this.ro ... ('foo') |
+| angular2-client.ts:30:46:30:59 | map.get('foo') |
+| angular2-client.ts:30:46:30:59 | map.get('foo') |
+| angular2-client.ts:30:46:30:59 | map.get('foo') |
+| angular2-client.ts:33:44:33:74 | this.ro ... 1].path |
+| angular2-client.ts:33:44:33:74 | this.ro ... 1].path |
+| angular2-client.ts:33:44:33:74 | this.ro ... 1].path |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters |
+| angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:35:44:35:91 | this.ro ... et('x') |
+| angular2-client.ts:35:44:35:91 | this.ro ... et('x') |
+| angular2-client.ts:35:44:35:91 | this.ro ... et('x') |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params |
+| angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
+| angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
+| angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:47:7:69 | classNa ... w.name) |
@@ -681,34 +681,34 @@ edges
 | addEventListener.js:10:21:10:25 | event | addEventListener.js:12:24:12:28 | event |
 | addEventListener.js:12:24:12:28 | event | addEventListener.js:12:24:12:33 | event.data |
 | addEventListener.js:12:24:12:28 | event | addEventListener.js:12:24:12:33 | event.data |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:21:44:21:66 | \\u0275getDOM ... ation() | angular2-client.ts:21:44:21:71 | \\u0275getDOM ... ().href |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:23:44:23:69 | this.ro ... .params | angular2-client.ts:23:44:23:73 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:24:44:24:74 | this.ro ... yParams | angular2-client.ts:24:44:24:78 | this.ro ... ams.foo |
-| angular2-client.ts:25:44:25:71 | this.ro ... ragment | angular2-client.ts:25:44:25:71 | this.ro ... ragment |
-| angular2-client.ts:26:44:26:82 | this.ro ... ('foo') | angular2-client.ts:26:44:26:82 | this.ro ... ('foo') |
-| angular2-client.ts:27:44:27:87 | this.ro ... ('foo') | angular2-client.ts:27:44:27:87 | this.ro ... ('foo') |
-| angular2-client.ts:29:46:29:59 | map.get('foo') | angular2-client.ts:29:46:29:59 | map.get('foo') |
-| angular2-client.ts:32:44:32:74 | this.ro ... 1].path | angular2-client.ts:32:44:32:74 | this.ro ... 1].path |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:33:44:33:80 | this.ro ... ameters | angular2-client.ts:33:44:33:82 | this.ro ... eters.x |
-| angular2-client.ts:34:44:34:91 | this.ro ... et('x') | angular2-client.ts:34:44:34:91 | this.ro ... et('x') |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:35:44:35:89 | this.ro ... .params | angular2-client.ts:35:44:35:91 | this.ro ... arams.x |
-| angular2-client.ts:37:44:37:58 | this.router.url | angular2-client.ts:37:44:37:58 | this.router.url |
-| angular2-client.ts:41:44:41:76 | routeSn ... ('foo') | angular2-client.ts:41:44:41:76 | routeSn ... ('foo') |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:22:44:22:66 | \\u0275getDOM ... ation() | angular2-client.ts:22:44:22:71 | \\u0275getDOM ... ().href |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params | angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params | angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params | angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:24:44:24:69 | this.ro ... .params | angular2-client.ts:24:44:24:73 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams | angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams | angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams | angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:25:44:25:74 | this.ro ... yParams | angular2-client.ts:25:44:25:78 | this.ro ... ams.foo |
+| angular2-client.ts:26:44:26:71 | this.ro ... ragment | angular2-client.ts:26:44:26:71 | this.ro ... ragment |
+| angular2-client.ts:27:44:27:82 | this.ro ... ('foo') | angular2-client.ts:27:44:27:82 | this.ro ... ('foo') |
+| angular2-client.ts:28:44:28:87 | this.ro ... ('foo') | angular2-client.ts:28:44:28:87 | this.ro ... ('foo') |
+| angular2-client.ts:30:46:30:59 | map.get('foo') | angular2-client.ts:30:46:30:59 | map.get('foo') |
+| angular2-client.ts:33:44:33:74 | this.ro ... 1].path | angular2-client.ts:33:44:33:74 | this.ro ... 1].path |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters | angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters | angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters | angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:34:44:34:80 | this.ro ... ameters | angular2-client.ts:34:44:34:82 | this.ro ... eters.x |
+| angular2-client.ts:35:44:35:91 | this.ro ... et('x') | angular2-client.ts:35:44:35:91 | this.ro ... et('x') |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
+| angular2-client.ts:38:44:38:58 | this.router.url | angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:58:7:68 | window.name | classnames.js:7:47:7:69 | classNa ... w.name) |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/angular2-client.ts b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/angular2-client.ts
index 5ed51722f10..569cde4ecdf 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/angular2-client.ts
+++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/angular2-client.ts
@@ -1,4 +1,4 @@
-import { Component, OnInit } from '@angular/core';
+import { Component, OnInit, DomSanitizer as DomSanitizer2 } from '@angular/core';
 import { ɵgetDOM } from '@angular/common';
 import { ActivatedRoute, ActivatedRouteSnapshot, Router } from '@angular/router';
 import { DomSanitizer } from '@angular/platform-browser';
@@ -14,7 +14,8 @@ export class AppComponent implements OnInit {
   constructor(
     private route: ActivatedRoute,
     private sanitizer: DomSanitizer,
-    private router: Router
+    private router: Router,
+    // private sanitizer2: DomSanitizer2
   ) {}
 
   ngOnInit() {
@@ -35,6 +36,8 @@ export class AppComponent implements OnInit {
     this.sanitizer.bypassSecurityTrustHtml(this.route.snapshot.url[1].parameterMap.params.x); // NOT OK
 
     this.sanitizer.bypassSecurityTrustHtml(this.router.url); // NOT OK
+
+    // this.sanitizer2.bypassSecurityTrustHtml(this.router.url); // NOT OK
   }
 
   someMethod(routeSnapshot: ActivatedRouteSnapshot) {

From 3db6069372504ac965ed9d02acc7bfb8e180a647 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 18 Jan 2021 10:55:34 +0000
Subject: [PATCH 154/343] JS: Add test for new sink

---
 .../query-tests/Security/CWE-079/DomBasedXss/Xss.expected    | 5 +++++
 .../CWE-079/DomBasedXss/XssWithAdditionalSources.expected    | 4 ++++
 .../Security/CWE-079/DomBasedXss/angular2-client.ts          | 4 ++--
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
index 701157e6164..400099525c8 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/Xss.expected
@@ -56,6 +56,9 @@ nodes
 | angular2-client.ts:38:44:38:58 | this.router.url |
 | angular2-client.ts:38:44:38:58 | this.router.url |
 | angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:40:45:40:59 | this.router.url |
+| angular2-client.ts:40:45:40:59 | this.router.url |
+| angular2-client.ts:40:45:40:59 | this.router.url |
 | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
@@ -697,6 +700,7 @@ edges
 | angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
 | angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
 | angular2-client.ts:38:44:38:58 | this.router.url | angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:40:45:40:59 | this.router.url | angular2-client.ts:40:45:40:59 | this.router.url |
 | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span  ... <span>` |
@@ -1238,6 +1242,7 @@ edges
 | angular2-client.ts:35:44:35:91 | this.ro ... et('x') | angular2-client.ts:35:44:35:91 | this.ro ... et('x') | angular2-client.ts:35:44:35:91 | this.ro ... et('x') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:35:44:35:91 | this.ro ... et('x') | user-provided value |
 | angular2-client.ts:36:44:36:91 | this.ro ... arams.x | angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x | Cross-site scripting vulnerability due to $@. | angular2-client.ts:36:44:36:89 | this.ro ... .params | user-provided value |
 | angular2-client.ts:38:44:38:58 | this.router.url | angular2-client.ts:38:44:38:58 | this.router.url | angular2-client.ts:38:44:38:58 | this.router.url | Cross-site scripting vulnerability due to $@. | angular2-client.ts:38:44:38:58 | this.router.url | user-provided value |
+| angular2-client.ts:40:45:40:59 | this.router.url | angular2-client.ts:40:45:40:59 | this.router.url | angular2-client.ts:40:45:40:59 | this.router.url | Cross-site scripting vulnerability due to $@. | angular2-client.ts:40:45:40:59 | this.router.url | user-provided value |
 | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | Cross-site scripting vulnerability due to $@. | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | user-provided value |
 | classnames.js:7:31:7:84 | `<span  ... <span>` | classnames.js:7:58:7:68 | window.name | classnames.js:7:31:7:84 | `<span  ... <span>` | Cross-site scripting vulnerability due to $@. | classnames.js:7:58:7:68 | window.name | user-provided value |
 | classnames.js:8:31:8:85 | `<span  ... <span>` | classnames.js:8:59:8:69 | window.name | classnames.js:8:31:8:85 | `<span  ... <span>` | Cross-site scripting vulnerability due to $@. | classnames.js:8:59:8:69 | window.name | user-provided value |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
index 70090d56718..524868273da 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/XssWithAdditionalSources.expected
@@ -56,6 +56,9 @@ nodes
 | angular2-client.ts:38:44:38:58 | this.router.url |
 | angular2-client.ts:38:44:38:58 | this.router.url |
 | angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:40:45:40:59 | this.router.url |
+| angular2-client.ts:40:45:40:59 | this.router.url |
+| angular2-client.ts:40:45:40:59 | this.router.url |
 | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
@@ -708,6 +711,7 @@ edges
 | angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
 | angular2-client.ts:36:44:36:89 | this.ro ... .params | angular2-client.ts:36:44:36:91 | this.ro ... arams.x |
 | angular2-client.ts:38:44:38:58 | this.router.url | angular2-client.ts:38:44:38:58 | this.router.url |
+| angular2-client.ts:40:45:40:59 | this.router.url | angular2-client.ts:40:45:40:59 | this.router.url |
 | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') | angular2-client.ts:44:44:44:76 | routeSn ... ('foo') |
 | classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span  ... <span>` |
 | classnames.js:7:47:7:69 | classNa ... w.name) | classnames.js:7:31:7:84 | `<span  ... <span>` |
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/angular2-client.ts b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/angular2-client.ts
index 569cde4ecdf..734a06da3bc 100644
--- a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/angular2-client.ts
+++ b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/angular2-client.ts
@@ -15,7 +15,7 @@ export class AppComponent implements OnInit {
     private route: ActivatedRoute,
     private sanitizer: DomSanitizer,
     private router: Router,
-    // private sanitizer2: DomSanitizer2
+    private sanitizer2: DomSanitizer2
   ) {}
 
   ngOnInit() {
@@ -37,7 +37,7 @@ export class AppComponent implements OnInit {
 
     this.sanitizer.bypassSecurityTrustHtml(this.router.url); // NOT OK
 
-    // this.sanitizer2.bypassSecurityTrustHtml(this.router.url); // NOT OK
+    this.sanitizer2.bypassSecurityTrustHtml(this.router.url); // NOT OK
   }
 
   someMethod(routeSnapshot: ActivatedRouteSnapshot) {

From 928a382ad5d309bbacb9d79ea90e9a3730bf4350 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 9 Dec 2020 09:50:59 +0000
Subject: [PATCH 155/343] JS: Add parser for angular expressions

---
 .../semmle/jcorn/AngularExpressionParser.java | 45 +++++++++++++++++++
 .../src/com/semmle/jcorn/Parser.java          | 29 ++++++------
 2 files changed, 59 insertions(+), 15 deletions(-)
 create mode 100644 javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java

diff --git a/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
new file mode 100644
index 00000000000..82bf626a0d0
--- /dev/null
+++ b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
@@ -0,0 +1,45 @@
+package com.semmle.jcorn;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import com.semmle.js.ast.CallExpression;
+import com.semmle.js.ast.Expression;
+import com.semmle.js.ast.Position;
+import com.semmle.js.ast.SourceLocation;
+
+/**
+ * Parser for Angular template expressions, based on the JS parser with
+ * modified handling of the pipe operator.
+ */
+public class AngularExpressionParser extends Parser {
+  public AngularExpressionParser(String input, int startPos) {
+    super(new Options(), input, startPos);
+  }
+
+  @Override
+  protected Expression buildBinary(
+      int startPos,
+      Position startLoc,
+      Expression left,
+      Expression right,
+      String op,
+      boolean logical) {
+    // Angular pipe expression: `x|f:a` is desugared to `f(x, a)`
+    if (op.equals("|")) {
+      DestructuringErrors refDestructuringErrors = new DestructuringErrors();
+      List<Expression> arguments = new ArrayList<>();
+      arguments.add(left);
+      while (this.type == TokenType.colon) {
+        this.next();
+        int argStartPos = this.pos;
+        Position argStartLocation = this.curPosition();
+        Expression arg = parseMaybeUnary(refDestructuringErrors, false);
+        arguments.add(parseExprOp(arg, argStartPos, argStartLocation, TokenType.plusMin.binop, true));
+      }
+      SourceLocation loc = new SourceLocation(startLoc);
+      return this.finishNode(new CallExpression(loc, right, null, arguments, false, false)); 
+    }
+    return super.buildBinary(startPos, startLoc, left, right, op, logical);
+  }
+}
diff --git a/javascript/extractor/src/com/semmle/jcorn/Parser.java b/javascript/extractor/src/com/semmle/jcorn/Parser.java
index 7c018b6a456..827b6d4ec03 100644
--- a/javascript/extractor/src/com/semmle/jcorn/Parser.java
+++ b/javascript/extractor/src/com/semmle/jcorn/Parser.java
@@ -3,9 +3,21 @@ package com.semmle.jcorn;
 import static com.semmle.jcorn.Whitespace.isNewLine;
 import static com.semmle.jcorn.Whitespace.lineBreak;
 
+import java.io.File;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.Stack;
+import java.util.function.Function;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
 import com.semmle.jcorn.Identifiers.Dialect;
 import com.semmle.jcorn.Options.AllowReserved;
-import com.semmle.jcorn.TokenType.Properties;
 import com.semmle.js.ast.ArrayExpression;
 import com.semmle.js.ast.ArrayPattern;
 import com.semmle.js.ast.ArrowFunctionExpression;
@@ -45,7 +57,6 @@ import com.semmle.js.ast.INode;
 import com.semmle.js.ast.IPattern;
 import com.semmle.js.ast.Identifier;
 import com.semmle.js.ast.IfStatement;
-import com.semmle.js.ast.FieldDefinition;
 import com.semmle.js.ast.ImportDeclaration;
 import com.semmle.js.ast.ImportDefaultSpecifier;
 import com.semmle.js.ast.ImportNamespaceSpecifier;
@@ -95,18 +106,6 @@ import com.semmle.util.data.StringUtil;
 import com.semmle.util.exception.CatastrophicError;
 import com.semmle.util.exception.Exceptions;
 import com.semmle.util.io.WholeIO;
-import java.io.File;
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.Stack;
-import java.util.function.Function;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
 /**
  * Java port of Acorn.
@@ -1462,7 +1461,7 @@ public class Parser {
     return left;
   }
 
-  private Expression buildBinary(
+  protected Expression buildBinary(
       int startPos,
       Position startLoc,
       Expression left,

From 16a2a60b9a01938d371d7f723428e7c199610e8f Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 9 Dec 2020 13:01:36 +0000
Subject: [PATCH 156/343] JS: Add AngularPipeRef

---
 .../semmle/jcorn/AngularExpressionParser.java |  7 ++++-
 .../src/com/semmle/js/ast/AngularPipeRef.java | 27 +++++++++++++++++++
 .../src/com/semmle/js/ast/DefaultVisitor.java |  5 ++++
 .../src/com/semmle/js/ast/NodeCopier.java     | 10 +++++--
 .../src/com/semmle/js/ast/Visitor.java        |  2 ++
 .../com/semmle/js/extractor/ASTExtractor.java |  8 ++++++
 .../com/semmle/js/extractor/ExprKinds.java    |  1 +
 .../semmle/javascript/frameworks/Angular2.qll | 21 +++++++++++++++
 .../ql/src/semmlecode.javascript.dbscheme     |  1 +
 9 files changed, 79 insertions(+), 3 deletions(-)
 create mode 100644 javascript/extractor/src/com/semmle/js/ast/AngularPipeRef.java

diff --git a/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
index 82bf626a0d0..a5e7fd9a956 100644
--- a/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
+++ b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
@@ -3,8 +3,10 @@ package com.semmle.jcorn;
 import java.util.ArrayList;
 import java.util.List;
 
+import com.semmle.js.ast.AngularPipeRef;
 import com.semmle.js.ast.CallExpression;
 import com.semmle.js.ast.Expression;
+import com.semmle.js.ast.Identifier;
 import com.semmle.js.ast.Position;
 import com.semmle.js.ast.SourceLocation;
 
@@ -38,7 +40,10 @@ public class AngularExpressionParser extends Parser {
         arguments.add(parseExprOp(arg, argStartPos, argStartLocation, TokenType.plusMin.binop, true));
       }
       SourceLocation loc = new SourceLocation(startLoc);
-      return this.finishNode(new CallExpression(loc, right, null, arguments, false, false)); 
+      if (right instanceof Identifier) {
+        right = new AngularPipeRef(right.getLoc(), (Identifier)right);
+      }
+      return this.finishNode(new CallExpression(loc, right, null, arguments, false, false));
     }
     return super.buildBinary(startPos, startLoc, left, right, op, logical);
   }
diff --git a/javascript/extractor/src/com/semmle/js/ast/AngularPipeRef.java b/javascript/extractor/src/com/semmle/js/ast/AngularPipeRef.java
new file mode 100644
index 00000000000..fbe8525b234
--- /dev/null
+++ b/javascript/extractor/src/com/semmle/js/ast/AngularPipeRef.java
@@ -0,0 +1,27 @@
+package com.semmle.js.ast;
+
+/**
+ * An identifier occurring as the right operand of an Angular pipe expression,
+ * which has been desugared to a function call with this expression as the callee.
+ * <p>
+ * For example, <code>x | f:y</code> is desugared to <code>f(x, y)</code> where the
+ * <code>f</code> is an instance of {@link AngularPipeRef}, and evaluates to the function
+ * being invoked.
+ */
+public class AngularPipeRef extends Expression {
+  private final Identifier identifier;
+
+  public AngularPipeRef(SourceLocation loc, Identifier identifier) {
+    super("AngularPipeRef", loc);
+    this.identifier = identifier;
+  }
+
+  @Override
+  public <Q, A> A accept(Visitor<Q, A> v, Q q) {
+    return v.visit(this, q);
+  }
+
+  public Identifier getIdentifier() {
+    return identifier;
+  }
+}
diff --git a/javascript/extractor/src/com/semmle/js/ast/DefaultVisitor.java b/javascript/extractor/src/com/semmle/js/ast/DefaultVisitor.java
index 151936f46dc..4db7dbc400f 100644
--- a/javascript/extractor/src/com/semmle/js/ast/DefaultVisitor.java
+++ b/javascript/extractor/src/com/semmle/js/ast/DefaultVisitor.java
@@ -93,6 +93,11 @@ public class DefaultVisitor<C, R> implements Visitor<C, R> {
     else return visit((Expression) nd, c);
   }
 
+  @Override
+  public R visit(AngularPipeRef nd, C c) {
+    return visit((Expression) nd, c);
+  }
+
   @Override
   public R visit(AssignmentExpression nd, C c) {
     return visit((Expression) nd, c);
diff --git a/javascript/extractor/src/com/semmle/js/ast/NodeCopier.java b/javascript/extractor/src/com/semmle/js/ast/NodeCopier.java
index c381a2d6b10..0a0895d6598 100644
--- a/javascript/extractor/src/com/semmle/js/ast/NodeCopier.java
+++ b/javascript/extractor/src/com/semmle/js/ast/NodeCopier.java
@@ -1,5 +1,8 @@
 package com.semmle.js.ast;
 
+import java.util.ArrayList;
+import java.util.List;
+
 import com.semmle.js.ast.jsx.JSXAttribute;
 import com.semmle.js.ast.jsx.JSXClosingElement;
 import com.semmle.js.ast.jsx.JSXElement;
@@ -48,8 +51,6 @@ import com.semmle.ts.ast.TypeofTypeExpr;
 import com.semmle.ts.ast.UnaryTypeExpr;
 import com.semmle.ts.ast.UnionTypeExpr;
 import com.semmle.util.data.IntList;
-import java.util.ArrayList;
-import java.util.List;
 
 /** Deep cloning of AST nodes. */
 public class NodeCopier implements Visitor<Void, INode> {
@@ -77,6 +78,11 @@ public class NodeCopier implements Visitor<Void, INode> {
     return new IntList(list);
   }
 
+  @Override
+  public INode visit(AngularPipeRef nd, Void q) {
+    return new AngularPipeRef(nd.getLoc(), copy(nd.getIdentifier()));
+  }
+
   @Override
   public AssignmentExpression visit(AssignmentExpression nd, Void q) {
     return new AssignmentExpression(
diff --git a/javascript/extractor/src/com/semmle/js/ast/Visitor.java b/javascript/extractor/src/com/semmle/js/ast/Visitor.java
index 98551d2e324..f2a65c83620 100644
--- a/javascript/extractor/src/com/semmle/js/ast/Visitor.java
+++ b/javascript/extractor/src/com/semmle/js/ast/Visitor.java
@@ -54,6 +54,8 @@ import com.semmle.ts.ast.UnionTypeExpr;
  * <p>Visit methods take a context argument of type {@link C} and return a result of type {@link R}.
  */
 public interface Visitor<C, R> {
+  public R visit(AngularPipeRef nd, C q);
+
   public R visit(AssignmentExpression nd, C q);
 
   public R visit(AssignmentPattern nd, C q);
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 62a1465aea5..7242a8933a5 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -9,6 +9,7 @@ import java.util.Stack;
 import com.semmle.js.ast.AClass;
 import com.semmle.js.ast.AFunction;
 import com.semmle.js.ast.AFunctionExpression;
+import com.semmle.js.ast.AngularPipeRef;
 import com.semmle.js.ast.ArrayExpression;
 import com.semmle.js.ast.ArrayPattern;
 import com.semmle.js.ast.ArrowFunctionExpression;
@@ -2126,6 +2127,13 @@ public class ASTExtractor {
           new ParseError("Unexpected assignment pattern.", nd.getLoc().getStart()));
       return super.visit(nd, c);
     }
+
+    @Override
+    public Label visit(AngularPipeRef nd, Context c) {
+      Label key = super.visit(nd, c);
+      visit(nd.getIdentifier(), key, 0, IdContext.label);
+      return key;
+    }
   }
 
   public List<ParseError> extract(
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ExprKinds.java b/javascript/extractor/src/com/semmle/js/extractor/ExprKinds.java
index 44216d6b8d0..f4acf6c57ec 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ExprKinds.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ExprKinds.java
@@ -148,6 +148,7 @@ public class ExprKinds {
     exprKinds.put("BindExpression", 97);
     exprKinds.put("ExternalModuleReference", 98);
     exprKinds.put("NonNullAssertion", 105);
+    exprKinds.put("AngularPipeRef", 119);
   }
 
   private static final Map<IdContext, Integer> idKinds =
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 199471e9a65..3c97ad52b41 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -218,4 +218,25 @@ module Angular2 {
   private class DomAdapterLocation extends DOM::LocationSource::Range {
     DomAdapterLocation() { this = domAdapter().getAMethodCall("getLocation") }
   }
+
+  /**
+   * A reference to a pipe function, occurring in an Angular pipe expression
+   * that has been desugared to a function call.
+   *
+   * For example, the expression `x | f: y` is desugared to `f(x, y)` where
+   * `f` is a `PipeRefExpr`.
+   */
+  class PipeRefExpr extends Expr, @angular_pipe_ref {
+    /** Gets the identifier node naming the pipe. */
+    Identifier getIdentifier() {
+      result = getChildExpr(0)
+    }
+
+    /** Gets the name of the pipe being referenced. */
+    string getName() { result = getIdentifier().getName() }
+
+    override string getAPrimaryQlClass() {
+      result = "Angular2::PipeRefExpr"
+    }
+  }
 }
diff --git a/javascript/ql/src/semmlecode.javascript.dbscheme b/javascript/ql/src/semmlecode.javascript.dbscheme
index c8859f3725d..16cee27e77d 100644
--- a/javascript/ql/src/semmlecode.javascript.dbscheme
+++ b/javascript/ql/src/semmlecode.javascript.dbscheme
@@ -354,6 +354,7 @@ case @expr.kind of
 | 116 = @assignlogandexpr
 | 117 = @assignlogorexpr
 | 118 = @assignnullishcoalescingexpr
+| 119 = @angular_pipe_ref
 ;
 
 @varaccess = @proper_varaccess | @export_varaccess;

From ed27c8b13f2180fdc1d146b7b06c6028954efeb0 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 14:47:21 +0000
Subject: [PATCH 157/343] JS: Add test and fix bug in pipe parser

---
 .../com/semmle/jcorn/AngularExpressionParser.java   |  4 ++--
 .../frameworks/Angular2/foo.component.html          |  4 ++++
 .../frameworks/Angular2/foo.component.ts            | 13 +++++++++++++
 .../library-tests/frameworks/Angular2/test.expected | 10 ++++++++++
 .../test/library-tests/frameworks/Angular2/test.ql  | 12 ++++++++++++
 5 files changed, 41 insertions(+), 2 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/test.expected
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/test.ql

diff --git a/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
index a5e7fd9a956..09fffdec0fe 100644
--- a/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
+++ b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
@@ -41,9 +41,9 @@ public class AngularExpressionParser extends Parser {
       }
       SourceLocation loc = new SourceLocation(startLoc);
       if (right instanceof Identifier) {
-        right = new AngularPipeRef(right.getLoc(), (Identifier)right);
+        right = new AngularPipeRef(new SourceLocation(right.getLoc()), (Identifier)right);
       }
-      return this.finishNode(new CallExpression(loc, right, null, arguments, false, false));
+      return this.finishNode(new CallExpression(loc, right, new ArrayList<>(), arguments, false, false));
     }
     return super.buildBinary(startPos, startLoc, left, right, op, logical);
   }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
new file mode 100644
index 00000000000..dc09bfd72d0
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
@@ -0,0 +1,4 @@
+<other-component
+    [prop]="foo | bar"
+    [prop2]="foo | bar:'baz'"
+></other-component>
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
new file mode 100644
index 00000000000..f654dc1c72d
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
@@ -0,0 +1,13 @@
+import { Component } from "@angular/core";
+
+@Component({
+    selector: "foo-component",
+    templateUrl: "./foo.component.html"
+})
+export class Foo {
+    foo: string;
+
+    constructor() {
+        this.foo = "hello";
+    }
+}
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
new file mode 100644
index 00000000000..53ec4e0914d
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -0,0 +1,10 @@
+pipeRef
+| foo.component.html:2:19:2:21 | bar |
+| foo.component.html:3:20:3:28 | bar:'baz' |
+pipeCall
+| foo.component.html:2:13:2:21 | foo \| bar |
+| foo.component.html:3:14:3:28 | foo \| bar:'baz' |
+pipeCallArg
+| 0 | foo.component.html:2:13:2:15 | foo | foo.component.html:2:13:2:21 | foo \| bar |
+| 0 | foo.component.html:3:14:3:16 | foo | foo.component.html:3:14:3:28 | foo \| bar:'baz' |
+| 1 | foo.component.html:3:24:3:28 | 'baz' | foo.component.html:3:14:3:28 | foo \| bar:'baz' |
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.ql b/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
new file mode 100644
index 00000000000..103f5ba3ac3
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
@@ -0,0 +1,12 @@
+import javascript
+
+query Angular2::PipeRefExpr pipeRef() { any() }
+
+query CallExpr pipeCall() {
+  result.getCallee() instanceof Angular2::PipeRefExpr
+}
+
+query CallExpr pipeCallArg(int i, Expr arg) {
+  result.getCallee() instanceof Angular2::PipeRefExpr and
+  result.getArgument(i) = arg
+}

From 9b99f56d4410b25f09d40e8fd15c03d415f673d7 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 10 Dec 2020 14:35:06 +0000
Subject: [PATCH 158/343] JS: isAngularTemplateAttributeName

---
 .../src/com/semmle/js/extractor/HTMLExtractor.java        | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index 9373be8dcce..71e5331f569 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -93,7 +93,7 @@ public class HTMLExtractor implements IExtractor {
 
             String source = attr.getValue();
             RowColumnVector valueStart = attr.getValueSegment().getRowColumnVector();
-            if (JS_ATTRIBUTE.matcher(attr.getName()).matches()) {
+            if (JS_ATTRIBUTE.matcher(attr.getName()).matches() || isAngularTemplateAttributeName(attr.getName())) {
               snippetLoC =
                   extractSnippet(
                       2,
@@ -128,6 +128,12 @@ public class HTMLExtractor implements IExtractor {
     }
   }
 
+  private boolean isAngularTemplateAttributeName(String name) {
+    return name.startsWith("[") && name.endsWith("]") ||
+        name.startsWith("(") && name.endsWith(")") ||
+        name.startsWith("*ng");
+  }
+
   /** List of HTML attributes whose value is interpreted as JavaScript. */
   private static final Pattern JS_ATTRIBUTE =
       Pattern.compile(

From 4b5a861ee6b7b1e0f25d4688adf2d1a1a17675f7 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 10 Dec 2020 11:13:03 +0000
Subject: [PATCH 159/343] JS: Add TopLevelKind enum

---
 .../com/semmle/js/extractor/ASTExtractor.java |  4 ++--
 .../com/semmle/js/extractor/FileSnippet.java  |  6 ++---
 .../semmle/js/extractor/HTMLExtractor.java    |  8 +++----
 .../com/semmle/js/extractor/JSExtractor.java  | 13 ++++++-----
 .../semmle/js/extractor/ScriptExtractor.java  |  6 ++---
 .../com/semmle/js/extractor/TopLevelKind.java | 22 +++++++++++++++++++
 .../js/extractor/TypeScriptExtractor.java     |  3 +--
 7 files changed, 41 insertions(+), 21 deletions(-)
 create mode 100644 javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java

diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 7242a8933a5..583ee57472a 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -2137,9 +2137,9 @@ public class ASTExtractor {
   }
 
   public List<ParseError> extract(
-      Node root, Platform platform, SourceType sourceType, int toplevelKind) {
+      Node root, Platform platform, SourceType sourceType, TopLevelKind toplevelKind) {
     lexicalExtractor.getMetrics().startPhase(ExtractionPhase.ASTExtractor_extract);
-    trapwriter.addTuple("toplevels", toplevelLabel, toplevelKind);
+    trapwriter.addTuple("toplevels", toplevelLabel, toplevelKind.getValue());
     locationManager.emitNodeLocation(root, toplevelLabel);
 
     V visitor = new V(platform, sourceType);
diff --git a/javascript/extractor/src/com/semmle/js/extractor/FileSnippet.java b/javascript/extractor/src/com/semmle/js/extractor/FileSnippet.java
index 12d74fcef3f..4e0a41a5218 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/FileSnippet.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/FileSnippet.java
@@ -11,10 +11,10 @@ public class FileSnippet {
   private Path originalFile;
   private int line;
   private int column;
-  private int topLevelKind;
+  private TopLevelKind topLevelKind;
   private SourceType sourceType;
 
-  public FileSnippet(Path originalFile, int line, int column, int topLevelKind, SourceType sourceType) {
+  public FileSnippet(Path originalFile, int line, int column, TopLevelKind topLevelKind, SourceType sourceType) {
     this.originalFile = originalFile;
     this.line = line;
     this.column = column;
@@ -34,7 +34,7 @@ public class FileSnippet {
     return column;
   }
 
-  public int getTopLevelKind() {
+  public TopLevelKind getTopLevelKind() {
     return topLevelKind;
   }
 
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index 71e5331f569..89ba98ee32d 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -73,7 +73,7 @@ public class HTMLExtractor implements IExtractor {
             RowColumnVector contentStart = content.getRowColumnVector();
             snippetLoC =
                 extractSnippet(
-                    1,
+                    TopLevelKind.inlineScript,
                     config.withSourceType(sourceType),
                     scopeManager,
                     textualExtractor,
@@ -96,7 +96,7 @@ public class HTMLExtractor implements IExtractor {
             if (JS_ATTRIBUTE.matcher(attr.getName()).matches() || isAngularTemplateAttributeName(attr.getName())) {
               snippetLoC =
                   extractSnippet(
-                      2,
+                      TopLevelKind.eventHandler,
                       config,
                       scopeManager,
                       textualExtractor,
@@ -108,7 +108,7 @@ public class HTMLExtractor implements IExtractor {
               source = source.substring(11);
               snippetLoC =
                   extractSnippet(
-                      3,
+                      TopLevelKind.javascriptUrl,
                       config,
                       scopeManager,
                       textualExtractor,
@@ -233,7 +233,7 @@ public class HTMLExtractor implements IExtractor {
   }
 
   private LoCInfo extractSnippet(
-      int toplevelKind,
+      TopLevelKind toplevelKind,
       ExtractorConfig config,
       ScopeManager scopeManager,
       TextualExtractor textualExtractor,
diff --git a/javascript/extractor/src/com/semmle/js/extractor/JSExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/JSExtractor.java
index c8ef8b32b49..3916b35c9da 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/JSExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/JSExtractor.java
@@ -1,5 +1,9 @@
 package com.semmle.js.extractor;
 
+import java.util.ArrayList;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
 import com.semmle.js.ast.Comment;
 import com.semmle.js.ast.Node;
 import com.semmle.js.ast.Token;
@@ -14,9 +18,6 @@ import com.semmle.util.exception.Exceptions;
 import com.semmle.util.exception.UserError;
 import com.semmle.util.trap.TrapWriter;
 import com.semmle.util.trap.TrapWriter.Label;
-import java.util.ArrayList;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
 /**
  * Extractor for populating JavaScript source code, including AST information, lexical information
@@ -36,7 +37,7 @@ public class JSExtractor {
       Pattern.compile("(?m)^([ \t]*)(import|export|goog\\.module)\\b");
 
   public Pair<Label, LoCInfo> extract(
-      TextualExtractor textualExtractor, String source, int toplevelKind, ScopeManager scopeManager)
+      TextualExtractor textualExtractor, String source, TopLevelKind toplevelKind, ScopeManager scopeManager)
       throws ParseError {
     // if the file starts with `{ "<string>":` it won't parse as JavaScript; try parsing as JSON
     // instead
@@ -84,7 +85,7 @@ public class JSExtractor {
   public Pair<Label, LoCInfo> extract(
       TextualExtractor textualExtractor,
       String source,
-      int toplevelKind,
+      TopLevelKind toplevelKind,
       ScopeManager scopeManager,
       SourceType sourceType,
       JSParser.Result parserRes)
@@ -121,7 +122,7 @@ public class JSExtractor {
       ASTExtractor scriptExtractor = new ASTExtractor(lexicalExtractor, null);
       toplevelLabel = scriptExtractor.getToplevelLabel();
 
-      trapwriter.addTuple("toplevels", toplevelLabel, toplevelKind);
+      trapwriter.addTuple("toplevels", toplevelLabel, toplevelKind.getValue());
       locationManager.emitSnippetLocation(toplevelLabel, 1, 1, 1, 1);
       loc = new LoCInfo(0, 0);
     }
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ScriptExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ScriptExtractor.java
index 7d8ccc6b3b1..637e461fdee 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ScriptExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ScriptExtractor.java
@@ -2,15 +2,13 @@ package com.semmle.js.extractor;
 
 import java.io.BufferedReader;
 import java.io.File;
-import java.io.FileNotFoundException;
 import java.io.FileReader;
 import java.io.IOException;
-import java.util.concurrent.ConcurrentMap;
 import java.util.Optional;
+import java.util.concurrent.ConcurrentMap;
 
 import com.google.gson.Gson;
 import com.google.gson.JsonSyntaxException;
-
 import com.semmle.js.extractor.ExtractorConfig.Platform;
 import com.semmle.js.extractor.ExtractorConfig.SourceType;
 import com.semmle.js.parser.ParseError;
@@ -84,7 +82,7 @@ public class ScriptExtractor implements IExtractor {
     LoCInfo loc;
     try {
       Pair<Label, LoCInfo> res =
-          new JSExtractor(config).extract(textualExtractor, source, 0, scopeManager);
+          new JSExtractor(config).extract(textualExtractor, source, TopLevelKind.script, scopeManager);
       toplevelLabel = res.fst();
       loc = res.snd();
     } catch (ParseError e) {
diff --git a/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java b/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java
new file mode 100644
index 00000000000..70fae82d1ff
--- /dev/null
+++ b/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java
@@ -0,0 +1,22 @@
+package com.semmle.js.extractor;
+
+/**
+ * A kind of top-level, corresponding to the <code>@toplevel</code> type in the dbscheme.
+ */
+public enum TopLevelKind {
+  script(0),
+  inlineScript(1),
+  eventHandler(2),
+  javascriptUrl(3);
+  
+  private int value;
+  
+  private TopLevelKind(int value) {
+    this.value = value;
+  }
+
+  /** Returns the value identifying this toplevel kind in the database. */
+  public int getValue() {
+    return value;
+  }
+}
diff --git a/javascript/extractor/src/com/semmle/js/extractor/TypeScriptExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/TypeScriptExtractor.java
index b12790cc9c3..c1940344862 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/TypeScriptExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/TypeScriptExtractor.java
@@ -5,7 +5,6 @@ import java.io.File;
 import com.semmle.js.extractor.ExtractorConfig.ECMAVersion;
 import com.semmle.js.extractor.ExtractorConfig.SourceType;
 import com.semmle.js.parser.JSParser.Result;
-import com.semmle.ts.extractor.TypeScriptParser;
 import com.semmle.js.parser.ParseError;
 
 public class TypeScriptExtractor implements IExtractor {
@@ -28,7 +27,7 @@ public class TypeScriptExtractor implements IExtractor {
     try {
       FileSnippet snippet = state.getSnippets().get(sourceFile.toPath());
       SourceType sourceType = snippet != null ? snippet.getSourceType() : jsExtractor.establishSourceType(source, false);
-      int toplevelKind = snippet != null ? snippet.getTopLevelKind() : 0;
+      TopLevelKind toplevelKind = snippet != null ? snippet.getTopLevelKind() : TopLevelKind.script;
       return jsExtractor.extract(textualExtractor, source, toplevelKind, scopeManager, sourceType, res).snd();
     } catch (ParseError e) {
       e.setPosition(locationManager.translatePosition(e.getPosition()));

From b1d45a6773a72faf5ae555add28bbaa5a2738015 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 10 Dec 2020 11:03:55 +0000
Subject: [PATCH 160/343] JS: Mark angular pipe refs as incomplete

---
 javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 54ac2548a7b..811c3b91c35 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -1592,7 +1592,8 @@ module DataFlow {
       e instanceof E4X::XMLAttributeSelector or
       e instanceof E4X::XMLDotDotExpression or
       e instanceof E4X::XMLFilterExpression or
-      e instanceof E4X::XMLQualifiedIdentifier
+      e instanceof E4X::XMLQualifiedIdentifier or
+      e instanceof Angular2::PipeRefExpr
     )
     or
     exists(Expr e | e = nd.asExpr() |

From c08ba1416dfa03a6013264593980299cc3d5093e Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 14:40:34 +0000
Subject: [PATCH 161/343] JS: Add new SourceType for angular templates

---
 .../semmle/jcorn/AngularExpressionParser.java |  6 +++---
 .../semmle/js/extractor/ExtractorConfig.java  | 19 +++++++++++++++++++
 .../semmle/js/extractor/HTMLExtractor.java    | 15 ++++++++++++++-
 .../com/semmle/js/parser/JcornWrapper.java    |  8 ++++----
 4 files changed, 40 insertions(+), 8 deletions(-)

diff --git a/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
index 09fffdec0fe..802523514d7 100644
--- a/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
+++ b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
@@ -14,9 +14,9 @@ import com.semmle.js.ast.SourceLocation;
  * Parser for Angular template expressions, based on the JS parser with
  * modified handling of the pipe operator.
  */
-public class AngularExpressionParser extends Parser {
-  public AngularExpressionParser(String input, int startPos) {
-    super(new Options(), input, startPos);
+public class AngularExpressionParser extends CustomParser {
+  public AngularExpressionParser(Options options, String input, int startPos) {
+    super(options, input, startPos);
   }
 
   @Override
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ExtractorConfig.java b/javascript/extractor/src/com/semmle/js/extractor/ExtractorConfig.java
index 825a031b62e..f9b5939a6f6 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ExtractorConfig.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ExtractorConfig.java
@@ -10,6 +10,10 @@ import java.util.LinkedHashSet;
 import java.util.Set;
 
 import com.semmle.extractor.html.HtmlPopulator;
+import com.semmle.jcorn.AngularExpressionParser;
+import com.semmle.jcorn.CustomParser;
+import com.semmle.jcorn.Options;
+import com.semmle.jcorn.Parser;
 import com.semmle.js.parser.JcornWrapper;
 import com.semmle.util.data.StringUtil;
 import com.semmle.util.exception.UserError;
@@ -78,6 +82,9 @@ public class ExtractorConfig {
     /** A CommonJS module that is not also an ES2015 module. */
     COMMONJS_MODULE,
 
+    /** An Angular template expression. */
+    ANGULAR_TEMPLATE,
+
     /** Automatically determined source type. */
     AUTO;
 
@@ -86,6 +93,18 @@ public class ExtractorConfig {
       return StringUtil.lc(name());
     }
 
+    /**
+     * Gets the parser to use for parsing this source type.
+     */
+    public Parser createParser(Options options, String input, int startPos) {
+      switch (this) {
+      case ANGULAR_TEMPLATE:
+        return new AngularExpressionParser(options, input, startPos);
+      default:
+        return new CustomParser(options, input, startPos);
+      }
+    }
+
     /**
      * Returns true if this source is executed directly in the global scope, or false if it has its
      * own local scope.
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index 89ba98ee32d..85eea2ae23e 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -93,7 +93,7 @@ public class HTMLExtractor implements IExtractor {
 
             String source = attr.getValue();
             RowColumnVector valueStart = attr.getValueSegment().getRowColumnVector();
-            if (JS_ATTRIBUTE.matcher(attr.getName()).matches() || isAngularTemplateAttributeName(attr.getName())) {
+            if (JS_ATTRIBUTE.matcher(attr.getName()).matches()) {
               snippetLoC =
                   extractSnippet(
                       TopLevelKind.eventHandler,
@@ -104,6 +104,19 @@ public class HTMLExtractor implements IExtractor {
                       valueStart.getRow(),
                       valueStart.getColumn(),
                       false /* isTypeScript */);
+            } else if (isAngularTemplateAttributeName(attr.getName())) {
+              // For an attribute *ngFor="let var of EXPR", start parsing at EXPR
+              int offset = attr.getName().equals("*ngFor") ? source.indexOf(" of ") + " of ".length() : 0;
+              snippetLoC =
+                  extractSnippet(
+                      TopLevelKind.eventHandler,
+                      config.withSourceType(SourceType.ANGULAR_TEMPLATE),
+                      scopeManager,
+                      textualExtractor,
+                      source,
+                      valueStart.getRow(),
+                      valueStart.getColumn() + offset,
+                      false /* isTypeScript */);
             } else if (source.startsWith("javascript:")) {
               source = source.substring(11);
               snippetLoC =
diff --git a/javascript/extractor/src/com/semmle/js/parser/JcornWrapper.java b/javascript/extractor/src/com/semmle/js/parser/JcornWrapper.java
index 519150bc2c4..3ce302d0982 100644
--- a/javascript/extractor/src/com/semmle/js/parser/JcornWrapper.java
+++ b/javascript/extractor/src/com/semmle/js/parser/JcornWrapper.java
@@ -1,6 +1,8 @@
 package com.semmle.js.parser;
 
-import com.semmle.jcorn.CustomParser;
+import java.util.ArrayList;
+import java.util.List;
+
 import com.semmle.jcorn.Options;
 import com.semmle.jcorn.SyntaxError;
 import com.semmle.jcorn.jsx.JSXOptions;
@@ -10,8 +12,6 @@ import com.semmle.js.ast.Token;
 import com.semmle.js.extractor.ExtractorConfig;
 import com.semmle.js.extractor.ExtractorConfig.ECMAVersion;
 import com.semmle.js.extractor.ExtractorConfig.SourceType;
-import java.util.ArrayList;
-import java.util.List;
 
 public class JcornWrapper {
   /** Parse source code as a program. */
@@ -41,7 +41,7 @@ public class JcornWrapper {
       if (config.isTolerateParseErrors())
         options.onRecoverableError((err) -> errors.add(mkParseError(err)));
 
-      program = new CustomParser(options, source, 0).parse();
+      program = sourceType.createParser(options, source, 0).parse();
     } catch (SyntaxError e) {
       errors.add(mkParseError(e));
     }

From 77fcf3d8a2a522f57b331b824ca9b3d017927b80 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 14:40:44 +0000
Subject: [PATCH 162/343] JS: Support postfix "!" operator in templates

---
 .../com/semmle/jcorn/AngularExpressionParser.java   | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
index 802523514d7..79c1a1e30db 100644
--- a/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
+++ b/javascript/extractor/src/com/semmle/jcorn/AngularExpressionParser.java
@@ -9,6 +9,7 @@ import com.semmle.js.ast.Expression;
 import com.semmle.js.ast.Identifier;
 import com.semmle.js.ast.Position;
 import com.semmle.js.ast.SourceLocation;
+import com.semmle.ts.ast.NonNullAssertion;
 
 /**
  * Parser for Angular template expressions, based on the JS parser with
@@ -47,4 +48,16 @@ public class AngularExpressionParser extends CustomParser {
     }
     return super.buildBinary(startPos, startLoc, left, right, op, logical);
   }
+
+  @Override
+  protected Expression parseExprAtom(DestructuringErrors refDestructuringErrors) {
+    // Parse postfix "!" operator
+    Position startLoc = this.startLoc;
+    Expression expr = super.parseExprAtom(refDestructuringErrors);
+    if (this.type == TokenType.prefix && "!".equals(this.value)) {
+      this.next(); // consume "!" token
+      return finishNode(new NonNullAssertion(new SourceLocation(startLoc), expr));
+    }
+    return expr;
+  }
 }

From 9ee893c9c13df1cd49ce9a4bc816d176232a4019 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 14:40:57 +0000
Subject: [PATCH 163/343] JS: Add data flow steps in Angular2 model

---
 .../src/semmle/javascript/dataflow/Nodes.qll  |  14 ++
 .../semmle/javascript/frameworks/Angular2.qll | 147 ++++++++++++++++++
 2 files changed, 161 insertions(+)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
index d7edc446f7e..29aa358b72d 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
@@ -1007,6 +1007,13 @@ class ClassNode extends DataFlow::SourceNode {
   TypeAnnotation getFieldTypeAnnotation(string fieldName) {
     result = impl.getFieldTypeAnnotation(fieldName)
   }
+
+  /**
+   * Gets a decorator applied to this class.
+   */
+  DataFlow::Node getADecorator() {
+    result = impl.getADecorator()
+  }
 }
 
 module ClassNode {
@@ -1064,6 +1071,9 @@ module ClassNode {
      * Gets the type annotation for the field `fieldName`, if any.
      */
     TypeAnnotation getFieldTypeAnnotation(string fieldName) { none() }
+
+    /** Gets a decorator applied to this class. */
+    DataFlow::Node getADecorator() { none() }
   }
 
   /**
@@ -1131,6 +1141,10 @@ module ClassNode {
         result = field.getTypeAnnotation()
       )
     }
+
+    override DataFlow::Node getADecorator() {
+      result = astNode.getADecorator().getExpression().flow()
+    }
   }
 
   private DataFlow::PropRef getAPrototypeReferenceInFile(string name, File f) {
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 3c97ad52b41..22b9390c096 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -7,6 +7,7 @@ private import semmle.javascript.security.dataflow.Xss
 private import semmle.javascript.security.dataflow.CodeInjectionCustomizations
 private import semmle.javascript.security.dataflow.ClientSideUrlRedirectCustomizations
 private import semmle.javascript.DynamicPropertyAccess
+private import semmle.javascript.dataflow.internal.PreCallGraphStep
 
 /**
  * Provides classes for working with Angular (also known as Angular 2.x) applications.
@@ -239,4 +240,150 @@ module Angular2 {
       result = "Angular2::PipeRefExpr"
     }
   }
+
+  /** The RHS of a `templateUrl` property, seen as a path expression. */
+  private class TemplateUrlPath extends PathExpr {
+    TemplateUrlPath() {
+      exists(Property prop |
+        prop.getName() = "templateUrl" and
+        this = prop.getInit()
+      )
+    }
+
+    override string getValue() {
+      result = this.(Expr).getStringValue()
+    }
+  }
+
+  /**
+   * Holds if the value of `attrib` is interpreted as an Angular expression.
+   */
+  predicate isAngularExpressionAttribute(HTML::Attribute attrib) {
+    attrib.getName().matches("(%)") or
+    attrib.getName().matches("[%]") or
+    attrib.getName().matches("*ng%")
+  }
+
+  /**
+   * Gets a global variable access to `name` within the given attribute.
+   */
+  pragma[noinline]
+  private GlobalVarAccess getAGlobalVarAccessInAttribute(CodeInAttribute code, string name) {
+    exists(ComponentClass cls) and // do not materialize for non-Angular codebases
+    result.getTopLevel() = code and
+    result.getName() = name
+  }
+
+  /**
+   * The class for an Angular component.
+   */
+  class ComponentClass extends DataFlow::ClassNode {
+    DataFlow::CallNode decorator;
+
+    ComponentClass() {
+      decorator = getADecorator() and
+      decorator = DataFlow::moduleMember("@angular/core", "Component").getACall()
+    }
+
+    /**
+     * Gets a data flow node representing the value of the declared
+     * instance field of the given name.
+     */
+    DataFlow::Node getFieldNode(string name) {
+      exists(FieldDeclaration f |
+        f.getName() = name and
+        f.getDeclaringClass().flow() = this and
+        result = f.getNameExpr().flow()
+      )
+    }
+
+    /**
+     * Gets a data flow node representing data flowing into a field of
+     * this component.
+     */
+    DataFlow::Node getFieldInputNode(string name) {
+      result = getFieldNode(name)
+      or
+      result = getInstanceMember(name, DataFlow::MemberKind::setter()).getParameter(0)
+    }
+
+    /**
+     * Gets a data flow node representing data flowing out of a field
+     * of this component.
+     */
+    DataFlow::Node getFieldOutputNode(string name) {
+      result = getFieldNode(name)
+      or
+      result = getInstanceMember(name, DataFlow::MemberKind::getter()).getReturnNode()
+      or
+      result = getInstanceMethod(name)
+    }
+
+    /**
+     * Gets the `selector` property of the `@Component` decorator.
+     */
+    string getSelector() {
+      decorator.getOptionArgument(0, "selector").mayHaveStringValue(result)
+    }
+
+    /** Gets an HTML element that instantiates this component. */
+    HTML::Element getATemplateInstantiation() {
+      result.getName() = getSelector()
+    }
+
+    /** Gets an argument that flows into the `name` field of this component. */
+    DataFlow::Node getATemplateArgument(string name) {
+      result = getATemplateInstantiation().getAttributeByName("[" + name + "]").getCodeInAttribute().getChildStmt(0).(ExprStmt).getExpr().flow()
+    }
+
+    /** Gets the `templateUrl` property of the `@Component` decorator. */
+    string getTemplateUrl() {
+      decorator.getOptionArgument(0, "templateUrl").mayHaveStringValue(result)
+    }
+
+    /**
+     * Gets the file referred to by `templateUrl`.
+     *
+     * Has no result if the template is given inline via a `template` property.
+     */
+    pragma[noinline]
+    File getTemplateFile() {
+      result = decorator.getOptionArgument(0, "templateUrl").asExpr().(PathExpr).resolve()
+    }
+
+    /**
+     * Gets an access to the variable `name` in the template body.
+     */
+    DataFlow::Node getATemplateVarAccess(string name) {
+      exists(HTML::Attribute attrib |
+        attrib.getFile() = getTemplateFile() and
+        isAngularExpressionAttribute(attrib) and
+        result = getAGlobalVarAccessInAttribute(attrib.getCodeInAttribute(), name).flow()
+      )
+    }
+  }
+
+  private class ComponentSteps extends PreCallGraphStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(ComponentClass cls, string name |
+        // From <my-class [foo]="bar"/> to `foo` field in class
+        pred = cls.getATemplateArgument(name) and
+        succ = cls.getFieldInputNode(name)
+        or
+        // From `foo` field in class to <other-component [baz]="foo"/>
+        pred = cls.getFieldOutputNode(name) and
+        succ = cls.getATemplateVarAccess(name)
+        or
+        // From property write to the field input node
+        pred = cls.getAReceiverNode().getAPropertyWrite(name).getRhs() and
+        succ = cls.getFieldInputNode(name)
+        or
+        // From the field node to property read.
+        // We use `getFieldNode` instead of `getFieldOutputNode` as the other two cases
+        // from `getFieldOutputNode` are already handled by the general data flow library.
+        pred = cls.getFieldNode(name) and
+        succ = cls.getAReceiverNode().getAPropertyRead(name)
+      )
+    }
+  }
 }

From fcb8124376314a1bc95df40b7b6fb058063a6f4e Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Sat, 12 Dec 2020 20:50:55 +0000
Subject: [PATCH 164/343] JS: Expose data flow node for field declaration

---
 .../src/semmle/javascript/dataflow/DataFlow.qll  | 16 ++++++++++++++++
 .../semmle/javascript/frameworks/Angular2.qll    |  2 +-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 811c3b91c35..605eb6c4317 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -1308,6 +1308,22 @@ module DataFlow {
     nd = TFunctionReturnNode(function)
   }
 
+  /**
+   * INTERNAL: Do not use outside standard library.
+   *
+   * Gets a data flow node unique to the given field declaration.
+   *
+   * Note that this node defaults to being disconnected from the data flow
+   * graph, as the individual property reads and writes affecting the field are
+   * analyzed independently of the field declaration.
+   *
+   * Certain framework models may need this node to model the behavior of
+   * class and field decorators.
+   */
+  DataFlow::Node fieldDeclarationNode(FieldDeclaration field) {
+    result = TPropNode(field)
+  }
+
   /**
    * Gets the data flow node corresponding the given l-value expression, if
    * such a node exists.
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 22b9390c096..e4caedc5542 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -293,7 +293,7 @@ module Angular2 {
       exists(FieldDeclaration f |
         f.getName() = name and
         f.getDeclaringClass().flow() = this and
-        result = f.getNameExpr().flow()
+        result = DataFlow::fieldDeclarationNode(f)
       )
     }
 

From debb5691a104c10d7887bf5ef6260ac763a57bda Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 20:40:47 +0000
Subject: [PATCH 165/343] JS: Make PipeRefExpr a SourceNode

---
 javascript/ql/src/semmle/javascript/dataflow/Sources.qll | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/Sources.qll b/javascript/ql/src/semmle/javascript/dataflow/Sources.qll
index 25390f3c7f9..10347bfbfcb 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Sources.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Sources.qll
@@ -308,7 +308,8 @@ module SourceNode {
         astNode instanceof DynamicImportExpr or
         astNode instanceof ImportSpecifier or
         astNode instanceof ImportMetaExpr or
-        astNode instanceof TaggedTemplateExpr
+        astNode instanceof TaggedTemplateExpr or
+        astNode instanceof Angular2::PipeRefExpr
       )
       or
       DataFlow::parameterNode(this, _)

From d80313be4ff6a776a06adfbea04c2e71e7ebef78 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 20:44:31 +0000
Subject: [PATCH 166/343] JS: Model pipe classes

---
 .../semmle/javascript/frameworks/Angular2.qll | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index e4caedc5542..25944fc4c24 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -363,6 +363,26 @@ module Angular2 {
     }
   }
 
+  /** A class with the `@Pipe` decorator. */
+  class PipeClass extends DataFlow::ClassNode {
+    DataFlow::CallNode decorator;
+
+    PipeClass() {
+      decorator = DataFlow::moduleMember("@angular/core", "Pipe").getACall() and
+      decorator = getADecorator()
+    }
+
+    /** Gets the value of the `name` option passed to the `@Pipe` decorator. */
+    string getPipeName() {
+      decorator.getOptionArgument(0, "name").mayHaveStringValue(result)
+    }
+
+    /** Gets a reference to this pipe. */
+    DataFlow::Node getAPipeRef() {
+      result.asExpr().(PipeRefExpr).getName() = getPipeName()
+    }
+  }
+
   private class ComponentSteps extends PreCallGraphStep {
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
       exists(ComponentClass cls, string name |
@@ -386,4 +406,13 @@ module Angular2 {
       )
     }
   }
+
+  private class PipeSteps extends PreCallGraphStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(PipeClass cls |
+        pred = cls.getInstanceMethod("transform") and
+        succ = cls.getAPipeRef()
+      )
+    }
+  }
 }

From 0da207a5f99c26370245bc9b359a34996ccb709b Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 20:44:40 +0000
Subject: [PATCH 167/343] JS: Update test with pipes

---
 .../frameworks/Angular2/TestPipe.ts           |  9 ++++++
 .../frameworks/Angular2/foo.component.html    |  7 +++--
 .../frameworks/Angular2/foo.component.ts      |  2 +-
 .../frameworks/Angular2/other.component.ts    | 24 ++++++++++++++
 .../frameworks/Angular2/test.expected         | 31 ++++++++++++++-----
 .../library-tests/frameworks/Angular2/test.ql | 25 +++++++++++++++
 6 files changed, 88 insertions(+), 10 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/TestPipe.ts
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/other.component.ts

diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/TestPipe.ts b/javascript/ql/test/library-tests/frameworks/Angular2/TestPipe.ts
new file mode 100644
index 00000000000..279ed58bc37
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/TestPipe.ts
@@ -0,0 +1,9 @@
+import { Pipe, PipeTransform } from '@angular/core';
+
+@Pipe({name: 'testPipe'})
+export class TestPipe implements PipeTransform {
+  transform(value: string, arg?: string): string {
+    document.body.innerHTML = value;
+    return value + arg;
+  }
+}
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
index dc09bfd72d0..a2aa0b0d406 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
@@ -1,4 +1,7 @@
 <other-component
-    [prop]="foo | bar"
-    [prop2]="foo | bar:'baz'"
+    [prop1]="foo"
+    [prop2]="foo | unknownPipe"
+    [prop3]="foo | unknownPipe:'safe'"
+    [prop4]="foo | testPipe:'safe'"
+    [prop5]="42 | testPipe:foo"
 ></other-component>
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
index f654dc1c72d..90c7d5156e4 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
@@ -8,6 +8,6 @@ export class Foo {
     foo: string;
 
     constructor() {
-        this.foo = "hello";
+        this.foo = source();
     }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/other.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/other.component.ts
new file mode 100644
index 00000000000..2f6753224d2
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/other.component.ts
@@ -0,0 +1,24 @@
+import { Component } from "@angular/core";
+import { DomSanitizer } from '@angular/platform-browser';
+
+@Component({
+    selector: "other-component",
+    template: "not important"
+})
+export class OtherComponent {
+    prop1: string;
+    prop2: string;
+    prop3: string;
+    prop4: string;
+    prop5: string;
+
+    constructor(private sanitizer: DomSanitizer) {}
+
+    foo() {
+        this.sanitizer.bypassSecurityTrustHtml(this.prop1);
+        this.sanitizer.bypassSecurityTrustHtml(this.prop2);
+        this.sanitizer.bypassSecurityTrustHtml(this.prop3);
+        this.sanitizer.bypassSecurityTrustHtml(this.prop4);
+        this.sanitizer.bypassSecurityTrustHtml(this.prop5);
+    }
+}
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index 53ec4e0914d..baba3e894b0 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -1,10 +1,27 @@
 pipeRef
-| foo.component.html:2:19:2:21 | bar |
-| foo.component.html:3:20:3:28 | bar:'baz' |
+| foo.component.html:3:20:3:30 | unknownPipe |
+| foo.component.html:4:20:4:30 | unknownPipe |
+| foo.component.html:5:20:5:27 | testPipe |
+| foo.component.html:6:19:6:26 | testPipe |
 pipeCall
-| foo.component.html:2:13:2:21 | foo \| bar |
-| foo.component.html:3:14:3:28 | foo \| bar:'baz' |
+| foo.component.html:3:14:3:30 | foo \| unknownPipe |
+| foo.component.html:4:14:4:37 | foo \| u ... :'safe' |
+| foo.component.html:5:14:5:34 | foo \| t ... :'safe' |
+| foo.component.html:6:14:6:30 | 42 \| testPipe:foo |
 pipeCallArg
-| 0 | foo.component.html:2:13:2:15 | foo | foo.component.html:2:13:2:21 | foo \| bar |
-| 0 | foo.component.html:3:14:3:16 | foo | foo.component.html:3:14:3:28 | foo \| bar:'baz' |
-| 1 | foo.component.html:3:24:3:28 | 'baz' | foo.component.html:3:14:3:28 | foo \| bar:'baz' |
+| 0 | foo.component.html:3:14:3:16 | foo | foo.component.html:3:14:3:30 | foo \| unknownPipe |
+| 0 | foo.component.html:4:14:4:16 | foo | foo.component.html:4:14:4:37 | foo \| u ... :'safe' |
+| 0 | foo.component.html:5:14:5:16 | foo | foo.component.html:5:14:5:34 | foo \| t ... :'safe' |
+| 0 | foo.component.html:6:14:6:15 | 42 | foo.component.html:6:14:6:30 | 42 \| testPipe:foo |
+| 1 | foo.component.html:4:32:4:37 | 'safe' | foo.component.html:4:14:4:37 | foo \| u ... :'safe' |
+| 1 | foo.component.html:5:29:5:34 | 'safe' | foo.component.html:5:14:5:34 | foo \| t ... :'safe' |
+| 1 | foo.component.html:6:28:6:30 | foo | foo.component.html:6:14:6:30 | 42 \| testPipe:foo |
+pipeClass
+| TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} |
+pipeClassRef
+| TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | foo.component.html:5:20:5:27 | testPipe |
+| TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | foo.component.html:6:19:6:26 | testPipe |
+taintFlow
+| foo.component.ts:11:20:11:27 | source() | other.component.ts:18:48:18:57 | this.prop1 |
+| foo.component.ts:11:20:11:27 | source() | other.component.ts:21:48:21:57 | this.prop4 |
+| foo.component.ts:11:20:11:27 | source() | other.component.ts:22:48:22:57 | this.prop5 |
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.ql b/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
index 103f5ba3ac3..da318e08d29 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
@@ -1,4 +1,5 @@
 import javascript
+private import semmle.javascript.security.dataflow.Xss
 
 query Angular2::PipeRefExpr pipeRef() { any() }
 
@@ -10,3 +11,27 @@ query CallExpr pipeCallArg(int i, Expr arg) {
   result.getCallee() instanceof Angular2::PipeRefExpr and
   result.getArgument(i) = arg
 }
+
+query Angular2::PipeClass pipeClass() { any() }
+
+query DataFlow::Node pipeClassRef(Angular2::PipeClass cls) {
+  result = cls.getAPipeRef()
+}
+
+class TaintConfig extends TaintTracking::Configuration {
+  TaintConfig() {
+    this = "TaintConfig"
+  }
+
+  override predicate isSource(DataFlow::Node source) {
+    source.(DataFlow::CallNode).getCalleeName() = "source"
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    sink instanceof DomBasedXss::Sink
+  }
+}
+
+query predicate taintFlow(DataFlow::Node source, DataFlow::Node sink) {
+  any(TaintConfig c).hasFlow(source, sink)
+}

From 29dd8470d55d5fecd67f4c7e2e24af227c1216c8 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 21:44:28 +0000
Subject: [PATCH 168/343] JS: Fix offset of *ngFor snippet

---
 .../extractor/src/com/semmle/js/extractor/HTMLExtractor.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index 85eea2ae23e..672f526f23b 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -113,7 +113,7 @@ public class HTMLExtractor implements IExtractor {
                       config.withSourceType(SourceType.ANGULAR_TEMPLATE),
                       scopeManager,
                       textualExtractor,
-                      source,
+                      source.substring(offset),
                       valueStart.getRow(),
                       valueStart.getColumn() + offset,
                       false /* isTypeScript */);

From 1ab36dc81f053fdca24eb41e0049830a0a856073 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 21:50:09 +0000
Subject: [PATCH 169/343] JS: Flow through *ngFor loops

---
 .../semmle/js/extractor/HTMLExtractor.java    | 15 ++++-
 .../semmle/javascript/frameworks/Angular2.qll | 59 ++++++++++++++++++-
 .../frameworks/Angular2/foo.component.html    |  8 +++
 .../frameworks/Angular2/foo.component.ts      |  4 ++
 .../frameworks/Angular2/test.expected         |  7 ++-
 5 files changed, 87 insertions(+), 6 deletions(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index 672f526f23b..90f2cdf55d0 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -2,6 +2,7 @@ package com.semmle.js.extractor;
 
 import java.io.File;
 import java.nio.file.Path;
+import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import com.semmle.extractor.html.HtmlPopulator;
@@ -106,14 +107,22 @@ public class HTMLExtractor implements IExtractor {
                       false /* isTypeScript */);
             } else if (isAngularTemplateAttributeName(attr.getName())) {
               // For an attribute *ngFor="let var of EXPR", start parsing at EXPR
-              int offset = attr.getName().equals("*ngFor") ? source.indexOf(" of ") + " of ".length() : 0;
+              int offset = 0;
+              if (attr.getName().equals("*ngFor")) {
+                Matcher m = ANGULAR_FOR_LOOP_DECL.matcher(source);
+                if (m.matches()) {
+                  String expr = m.group(2);
+                  offset = m.end(2) - expr.length();
+                  source = expr;
+                }
+              }
               snippetLoC =
                   extractSnippet(
                       TopLevelKind.eventHandler,
                       config.withSourceType(SourceType.ANGULAR_TEMPLATE),
                       scopeManager,
                       textualExtractor,
-                      source.substring(offset),
+                      source,
                       valueStart.getRow(),
                       valueStart.getColumn() + offset,
                       false /* isTypeScript */);
@@ -147,6 +156,8 @@ public class HTMLExtractor implements IExtractor {
         name.startsWith("*ng");
   }
 
+  private static final Pattern ANGULAR_FOR_LOOP_DECL = Pattern.compile("^ *let +(\\w+) +of(?: +|(?!\\w))(.*)");
+
   /** List of HTML attributes whose value is interpreted as JavaScript. */
   private static final Pattern JS_ATTRIBUTE =
       Pattern.compile(
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 25944fc4c24..5918edeacc9 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -274,6 +274,10 @@ module Angular2 {
     result.getName() = name
   }
 
+  private DataFlow::Node getAttributeValueAsNode(HTML::Attribute attrib) {
+    result = attrib.getCodeInAttribute().getChildStmt(0).(ExprStmt).getExpr().flow()
+  }
+
   /**
    * The class for an Angular component.
    */
@@ -333,7 +337,7 @@ module Angular2 {
 
     /** Gets an argument that flows into the `name` field of this component. */
     DataFlow::Node getATemplateArgument(string name) {
-      result = getATemplateInstantiation().getAttributeByName("[" + name + "]").getCodeInAttribute().getChildStmt(0).(ExprStmt).getExpr().flow()
+      result = getAttributeValueAsNode(getATemplateInstantiation().getAttributeByName("[" + name + "]"))
     }
 
     /** Gets the `templateUrl` property of the `@Component` decorator. */
@@ -415,4 +419,57 @@ module Angular2 {
       )
     }
   }
+
+  /**
+   * An attribute of form `*ngFor="let var of EXPR"`.
+   *
+   * The `EXPR` has been extracted as the sole `CodeInAttribute` top-level for this
+   * attribute. There is no AST node for the implied for-of loop.
+   */
+  private class ForLoopAttribute extends HTML::Attribute {
+    ForLoopAttribute() {
+      getName() = "*ngFor"
+    }
+
+    /** Gets a data-flow node holding the value being iterated over. */
+    DataFlow::Node getIterationDomain() {
+      result = getAttributeValueAsNode(this)
+    }
+
+    /** Gets the name of the variable holding the element of the current iteration. */
+    string getIteratorName() {
+      result = getValue().regexpCapture("^ *let (\\w+) .*", 1)
+    }
+
+    /** Gets an HTML element in which the iterator variable is in scope. */
+    HTML::Element getAnElementInScope() {
+      result.getParent*() = getElement()
+    }
+
+    /** Gets a reference to the iterator variable. */
+    DataFlow::Node getAnIteratorAccess() {
+      exists(HTML::Attribute attrib |
+        attrib = getAnElementInScope().getAnAttribute() and
+        isAngularExpressionAttribute(attrib) and
+        result = getAGlobalVarAccessInAttribute(attrib.getCodeInAttribute(), getIteratorName()).flow()
+      )
+    }
+  }
+
+  /**
+   * A taint step `array -> elem` in `*ngFor="let elem of array"`, or more precisely,
+   * a step from `array` to each access to `elem`.
+   */
+  private class ForLoopStep extends TaintTracking::AdditionalTaintStep {
+    ForLoopAttribute attrib;
+
+    ForLoopStep() {
+      this = attrib.getIterationDomain()
+    }
+
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      pred = this and
+      succ = attrib.getAnIteratorAccess()
+    }
+  }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
index a2aa0b0d406..fa6729eb5ed 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
@@ -5,3 +5,11 @@
     [prop4]="foo | testPipe:'safe'"
     [prop5]="42 | testPipe:foo"
 ></other-component>
+
+<div *ngFor="let element of taintedArray">
+    <other-component [prop1]="element"></other-component>
+</div>
+
+<div *ngFor="let element of safeArray">
+    <other-component [prop2]="element"></other-component>
+</div>
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
index 90c7d5156e4..a3258af0f8c 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
@@ -6,8 +6,12 @@ import { Component } from "@angular/core";
 })
 export class Foo {
     foo: string;
+    taintedArray: string[];
+    safeArray: string[];
 
     constructor() {
         this.foo = source();
+        this.taintedArray = [...source()];
+        this.safeArray = ['a', 'b'];
     }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index baba3e894b0..d6142ba9093 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -22,6 +22,7 @@ pipeClassRef
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | foo.component.html:5:20:5:27 | testPipe |
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | foo.component.html:6:19:6:26 | testPipe |
 taintFlow
-| foo.component.ts:11:20:11:27 | source() | other.component.ts:18:48:18:57 | this.prop1 |
-| foo.component.ts:11:20:11:27 | source() | other.component.ts:21:48:21:57 | this.prop4 |
-| foo.component.ts:11:20:11:27 | source() | other.component.ts:22:48:22:57 | this.prop5 |
+| foo.component.ts:13:20:13:27 | source() | other.component.ts:18:48:18:57 | this.prop1 |
+| foo.component.ts:13:20:13:27 | source() | other.component.ts:21:48:21:57 | this.prop4 |
+| foo.component.ts:13:20:13:27 | source() | other.component.ts:22:48:22:57 | this.prop5 |
+| foo.component.ts:14:33:14:40 | source() | other.component.ts:18:48:18:57 | this.prop1 |

From cc952bd2a4efcfb9b8eaa8db88f5dba63a1d13ec Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 21:57:14 +0000
Subject: [PATCH 170/343] JS: Reorganize test a bit

---
 .../frameworks/Angular2/foo.component.html    | 15 -------
 .../frameworks/Angular2/other.component.ts    | 24 -----------
 .../frameworks/Angular2/sink.component.ts     | 24 +++++++++++
 .../frameworks/Angular2/source.component.html | 15 +++++++
 .../{foo.component.ts => source.component.ts} | 10 ++---
 .../frameworks/Angular2/test.expected         | 42 +++++++++----------
 6 files changed, 65 insertions(+), 65 deletions(-)
 delete mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
 delete mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/other.component.ts
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
 rename javascript/ql/test/library-tests/frameworks/Angular2/{foo.component.ts => source.component.ts} (59%)

diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html b/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
deleted file mode 100644
index fa6729eb5ed..00000000000
--- a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<other-component
-    [prop1]="foo"
-    [prop2]="foo | unknownPipe"
-    [prop3]="foo | unknownPipe:'safe'"
-    [prop4]="foo | testPipe:'safe'"
-    [prop5]="42 | testPipe:foo"
-></other-component>
-
-<div *ngFor="let element of taintedArray">
-    <other-component [prop1]="element"></other-component>
-</div>
-
-<div *ngFor="let element of safeArray">
-    <other-component [prop2]="element"></other-component>
-</div>
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/other.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/other.component.ts
deleted file mode 100644
index 2f6753224d2..00000000000
--- a/javascript/ql/test/library-tests/frameworks/Angular2/other.component.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import { Component } from "@angular/core";
-import { DomSanitizer } from '@angular/platform-browser';
-
-@Component({
-    selector: "other-component",
-    template: "not important"
-})
-export class OtherComponent {
-    prop1: string;
-    prop2: string;
-    prop3: string;
-    prop4: string;
-    prop5: string;
-
-    constructor(private sanitizer: DomSanitizer) {}
-
-    foo() {
-        this.sanitizer.bypassSecurityTrustHtml(this.prop1);
-        this.sanitizer.bypassSecurityTrustHtml(this.prop2);
-        this.sanitizer.bypassSecurityTrustHtml(this.prop3);
-        this.sanitizer.bypassSecurityTrustHtml(this.prop4);
-        this.sanitizer.bypassSecurityTrustHtml(this.prop5);
-    }
-}
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
new file mode 100644
index 00000000000..a3464b9212a
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
@@ -0,0 +1,24 @@
+import { Component } from "@angular/core";
+import { DomSanitizer } from '@angular/platform-browser';
+
+@Component({
+    selector: "sink-component",
+    template: "not important"
+})
+export class SinkComponent {
+    sink1: string;
+    sink2: string;
+    sink3: string;
+    sink4: string;
+    sink5: string;
+
+    constructor(private sanitizer: DomSanitizer) {}
+
+    foo() {
+        this.sanitizer.bypassSecurityTrustHtml(this.sink1);
+        this.sanitizer.bypassSecurityTrustHtml(this.sink2);
+        this.sanitizer.bypassSecurityTrustHtml(this.sink3);
+        this.sanitizer.bypassSecurityTrustHtml(this.sink4);
+        this.sanitizer.bypassSecurityTrustHtml(this.sink5);
+    }
+}
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
new file mode 100644
index 00000000000..ba33720aae5
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
@@ -0,0 +1,15 @@
+<sink-component
+    [sink1]="taint"
+    [sink2]="taint | unknownPipe"
+    [sink3]="taint | unknownPipe:'safe'"
+    [sink4]="taint | testPipe:'safe'"
+    [sink5]="42 | testPipe:taint"
+></sink-component>
+
+<div *ngFor="let element of taintedArray">
+    <sink-component [sink1]="element"></sink-component>
+</div>
+
+<div *ngFor="let element of safeArray">
+    <sink-component [sink2]="element"></sink-component>
+</div>
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.ts
similarity index 59%
rename from javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
rename to javascript/ql/test/library-tests/frameworks/Angular2/source.component.ts
index a3258af0f8c..bd296c7a298 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/foo.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.ts
@@ -1,16 +1,16 @@
 import { Component } from "@angular/core";
 
 @Component({
-    selector: "foo-component",
-    templateUrl: "./foo.component.html"
+    selector: "source-component",
+    templateUrl: "./source.component.html"
 })
-export class Foo {
-    foo: string;
+export class Source {
+    taint: string;
     taintedArray: string[];
     safeArray: string[];
 
     constructor() {
-        this.foo = source();
+        this.taint = source();
         this.taintedArray = [...source()];
         this.safeArray = ['a', 'b'];
     }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index d6142ba9093..24286fe9058 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -1,28 +1,28 @@
 pipeRef
-| foo.component.html:3:20:3:30 | unknownPipe |
-| foo.component.html:4:20:4:30 | unknownPipe |
-| foo.component.html:5:20:5:27 | testPipe |
-| foo.component.html:6:19:6:26 | testPipe |
+| source.component.html:3:22:3:32 | unknownPipe |
+| source.component.html:4:22:4:32 | unknownPipe |
+| source.component.html:5:22:5:29 | testPipe |
+| source.component.html:6:19:6:26 | testPipe |
 pipeCall
-| foo.component.html:3:14:3:30 | foo \| unknownPipe |
-| foo.component.html:4:14:4:37 | foo \| u ... :'safe' |
-| foo.component.html:5:14:5:34 | foo \| t ... :'safe' |
-| foo.component.html:6:14:6:30 | 42 \| testPipe:foo |
+| source.component.html:3:14:3:32 | taint \| unknownPipe |
+| source.component.html:4:14:4:39 | taint \| ... :'safe' |
+| source.component.html:5:14:5:36 | taint \| ... :'safe' |
+| source.component.html:6:14:6:32 | 42 \| testPipe:taint |
 pipeCallArg
-| 0 | foo.component.html:3:14:3:16 | foo | foo.component.html:3:14:3:30 | foo \| unknownPipe |
-| 0 | foo.component.html:4:14:4:16 | foo | foo.component.html:4:14:4:37 | foo \| u ... :'safe' |
-| 0 | foo.component.html:5:14:5:16 | foo | foo.component.html:5:14:5:34 | foo \| t ... :'safe' |
-| 0 | foo.component.html:6:14:6:15 | 42 | foo.component.html:6:14:6:30 | 42 \| testPipe:foo |
-| 1 | foo.component.html:4:32:4:37 | 'safe' | foo.component.html:4:14:4:37 | foo \| u ... :'safe' |
-| 1 | foo.component.html:5:29:5:34 | 'safe' | foo.component.html:5:14:5:34 | foo \| t ... :'safe' |
-| 1 | foo.component.html:6:28:6:30 | foo | foo.component.html:6:14:6:30 | 42 \| testPipe:foo |
+| 0 | source.component.html:3:14:3:18 | taint | source.component.html:3:14:3:32 | taint \| unknownPipe |
+| 0 | source.component.html:4:14:4:18 | taint | source.component.html:4:14:4:39 | taint \| ... :'safe' |
+| 0 | source.component.html:5:14:5:18 | taint | source.component.html:5:14:5:36 | taint \| ... :'safe' |
+| 0 | source.component.html:6:14:6:15 | 42 | source.component.html:6:14:6:32 | 42 \| testPipe:taint |
+| 1 | source.component.html:4:34:4:39 | 'safe' | source.component.html:4:14:4:39 | taint \| ... :'safe' |
+| 1 | source.component.html:5:31:5:36 | 'safe' | source.component.html:5:14:5:36 | taint \| ... :'safe' |
+| 1 | source.component.html:6:28:6:32 | taint | source.component.html:6:14:6:32 | 42 \| testPipe:taint |
 pipeClass
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} |
 pipeClassRef
-| TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | foo.component.html:5:20:5:27 | testPipe |
-| TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | foo.component.html:6:19:6:26 | testPipe |
+| TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:5:22:5:29 | testPipe |
+| TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:6:19:6:26 | testPipe |
 taintFlow
-| foo.component.ts:13:20:13:27 | source() | other.component.ts:18:48:18:57 | this.prop1 |
-| foo.component.ts:13:20:13:27 | source() | other.component.ts:21:48:21:57 | this.prop4 |
-| foo.component.ts:13:20:13:27 | source() | other.component.ts:22:48:22:57 | this.prop5 |
-| foo.component.ts:14:33:14:40 | source() | other.component.ts:18:48:18:57 | this.prop1 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:18:48:18:57 | this.sink1 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:21:48:21:57 | this.sink4 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:22:48:22:57 | this.sink5 |
+| source.component.ts:14:33:14:40 | source() | sink.component.ts:18:48:18:57 | this.sink1 |

From 6bf93452584835faea1371e8309b90507a1d8667 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Sat, 12 Dec 2020 20:27:03 +0000
Subject: [PATCH 171/343] JS: Add test for class with locally-unused field

---
 .../library-tests/frameworks/Angular2/mid.component.html | 1 +
 .../library-tests/frameworks/Angular2/mid.component.ts   | 9 +++++++++
 .../library-tests/frameworks/Angular2/sink.component.ts  | 2 ++
 .../frameworks/Angular2/source.component.html            | 2 ++
 .../test/library-tests/frameworks/Angular2/test.expected | 9 +++++----
 5 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/mid.component.html
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/mid.component.ts

diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/mid.component.html b/javascript/ql/test/library-tests/frameworks/Angular2/mid.component.html
new file mode 100644
index 00000000000..d71ed261393
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/mid.component.html
@@ -0,0 +1 @@
+<sink-component [sink6]="field"></sink-component>
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/mid.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/mid.component.ts
new file mode 100644
index 00000000000..767ee692424
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/mid.component.ts
@@ -0,0 +1,9 @@
+import { Input, Component } from '@angular/core';
+
+@Component({
+    selector: 'mid-component',
+    templateUrl: './mid.component.html'
+})
+export class MidComponent {
+    @Input() field: string;
+}
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
index a3464b9212a..e286cac9910 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
@@ -11,6 +11,7 @@ export class SinkComponent {
     sink3: string;
     sink4: string;
     sink5: string;
+    sink6: string;
 
     constructor(private sanitizer: DomSanitizer) {}
 
@@ -20,5 +21,6 @@ export class SinkComponent {
         this.sanitizer.bypassSecurityTrustHtml(this.sink3);
         this.sanitizer.bypassSecurityTrustHtml(this.sink4);
         this.sanitizer.bypassSecurityTrustHtml(this.sink5);
+        this.sanitizer.bypassSecurityTrustHtml(this.sink6);
     }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
index ba33720aae5..c26664f8d85 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
@@ -13,3 +13,5 @@
 <div *ngFor="let element of safeArray">
     <sink-component [sink2]="element"></sink-component>
 </div>
+
+<mid-component [field]="taint"></mid-component>
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index 24286fe9058..7253c4b6dfb 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -22,7 +22,8 @@ pipeClassRef
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:5:22:5:29 | testPipe |
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:6:19:6:26 | testPipe |
 taintFlow
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:18:48:18:57 | this.sink1 |
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:21:48:21:57 | this.sink4 |
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:22:48:22:57 | this.sink5 |
-| source.component.ts:14:33:14:40 | source() | sink.component.ts:18:48:18:57 | this.sink1 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:19:48:19:57 | this.sink1 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:22:48:22:57 | this.sink4 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:23:48:23:57 | this.sink5 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:24:48:24:57 | this.sink6 |
+| source.component.ts:14:33:14:40 | source() | sink.component.ts:19:48:19:57 | this.sink1 |

From 8848ee2d101f2f4091a1375833e6e55fd6f1906b Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 14 Dec 2020 10:37:38 +0000
Subject: [PATCH 172/343] JS: Extract HTML from inline templates

---
 .../com/semmle/js/extractor/ASTExtractor.java | 66 ++++++++++++++++++-
 .../semmle/js/extractor/HTMLExtractor.java    | 21 +++++-
 .../com/semmle/js/extractor/JSExtractor.java  |  4 +-
 .../semmle/js/extractor/LexicalExtractor.java |  9 ++-
 javascript/ql/src/semmle/javascript/HTML.qll  | 59 +++++++++--------
 .../semmle/javascript/frameworks/Angular2.qll | 22 ++++++-
 .../frameworks/Angular2/inline.component.ts   | 17 +++++
 .../frameworks/Angular2/sink.component.ts     |  2 +
 .../frameworks/Angular2/test.expected         | 11 ++--
 9 files changed, 170 insertions(+), 41 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/frameworks/Angular2/inline.component.ts

diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 583ee57472a..e337f2efd8e 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -1,5 +1,6 @@
 package com.semmle.js.extractor;
 
+import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
@@ -166,8 +167,10 @@ public class ASTExtractor {
   private final Label toplevelLabel;
   private final LexicalExtractor lexicalExtractor;
   private final RegExpExtractor regexpExtractor;
+  private final ExtractorConfig config;
 
-  public ASTExtractor(LexicalExtractor lexicalExtractor, ScopeManager scopeManager) {
+  public ASTExtractor(ExtractorConfig config, LexicalExtractor lexicalExtractor, ScopeManager scopeManager) {
+    this.config = config;
     this.trapwriter = lexicalExtractor.getTrapwriter();
     this.locationManager = lexicalExtractor.getLocationManager();
     this.contextManager = new SyntacticContextManager();
@@ -1136,9 +1139,70 @@ public class ASTExtractor {
       visit(nd.getDefaultValue(), propkey, 2, IdContext.varBind);
       if (nd.isComputed()) trapwriter.addTuple("is_computed", propkey);
       if (nd.isMethod()) trapwriter.addTuple("is_method", propkey);
+
+      // Extract the value of a property named `template` as HTML, in order to support
+      // Angular2 components with an inline template.
+      if (!nd.isComputed() && "template".equals(tryGetIdentifierName(nd.getKey()))) {
+        extractStringValueAsHtml(nd.getValue());
+      }
+      
       return propkey;
     }
 
+    /**
+     * Extracts the string value of <code>expr</code> as an HTML snippet.
+     */
+    private void extractStringValueAsHtml(Expression expr) {
+      TextualExtractor textualExtractor = lexicalExtractor.getTextualExtractor();
+      if (textualExtractor.isSnippet()) {
+        return; // do not create nested snippets
+      }
+      String source = tryGetStringValueFromExpression(expr);
+      if (source == null) {
+        return;
+      }
+      SourceLocation loc = expr.getLoc();
+      Path originalFile = textualExtractor.getExtractedFile().toPath();
+      Path vfile = originalFile.resolveSibling(originalFile.getFileName().toString() + "." + loc.getStart().getLine() + "." + loc.getStart().getColumn() + ".html");
+      LocationManager innerLocationManager = new LocationManager(
+          locationManager.getSourceFile(),
+          locationManager.getTrapWriter(),
+          locationManager.getFileLabel());
+      innerLocationManager.setStart(loc.getStart().getLine(), loc.getStart().getColumn());
+      TextualExtractor innerTextualExtractor = new TextualExtractor(
+          trapwriter,
+          innerLocationManager,
+          source,
+          false,
+          getMetrics(),
+          vfile.toFile());
+      HTMLExtractor html = HTMLExtractor.forEmbeddedHtml(config);
+      html.extract(innerTextualExtractor);
+    }
+
+    private String tryGetIdentifierName(Expression e) {
+      return e instanceof Identifier ? ((Identifier)e).getName() : null;
+    }
+    
+    private String tryGetStringValueFromExpression(Expression e) {
+      if (e instanceof Literal) {
+        Literal lit = (Literal) e;
+        return lit.isStringLiteral() ? (String) lit.getValue() : null;
+      }
+      if (e instanceof TemplateLiteral) {
+        TemplateLiteral lit = (TemplateLiteral) e;
+        if (!lit.getExpressions().isEmpty()) {
+          return null;
+        }
+        StringBuilder sb = new StringBuilder();
+        for (TemplateElement elm : lit.getQuasis()) {
+          sb.append(elm.getCooked());
+        }
+        return sb.toString();
+      }
+      return null;
+    }
+
     @Override
     public Label visit(IfStatement nd, Context c) {
       Label key = super.visit(nd, c);
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index 90f2cdf55d0..bd5f7d33de6 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -166,10 +166,21 @@ public class HTMLExtractor implements IExtractor {
 
   private final ExtractorConfig config;
   private final ExtractorState state;
+  private final boolean isEmbedded;
 
-  public HTMLExtractor(ExtractorConfig config, ExtractorState state) {
+  public HTMLExtractor(ExtractorConfig config, ExtractorState state, boolean isEmbedded) {
     this.config = config.withPlatform(Platform.WEB);
     this.state = state;
+    this.isEmbedded = isEmbedded;
+  }
+
+  public HTMLExtractor(ExtractorConfig config, ExtractorState state) {
+    this(config, state, false);
+  }
+
+  /** Creates an HTML extractor for embedded HTML snippets. */
+  public static HTMLExtractor forEmbeddedHtml(ExtractorConfig config) {
+    return new HTMLExtractor(config, null, true);
   }
 
   @Override
@@ -179,12 +190,15 @@ public class HTMLExtractor implements IExtractor {
     Attributes.setDefaultMaxErrorCount(100);
     JavaScriptHTMLElementHandler eltHandler = new JavaScriptHTMLElementHandler(textualExtractor);
 
+    LocationManager locationManager = textualExtractor.getLocationManager();
     HtmlPopulator extractor =
         new HtmlPopulator(
             this.config.getHtmlHandling(),
             textualExtractor.getSource(),
             textualExtractor.getTrapwriter(),
-            textualExtractor.getLocationManager().getFileLabel());
+            locationManager.getFileLabel());
+    
+    extractor.setStartOffset(locationManager.getStartLine() - 1, locationManager.getStartColumn() - 1);
 
     extractor.doit(Option.some(eltHandler));
 
@@ -266,6 +280,9 @@ public class HTMLExtractor implements IExtractor {
       int column,
       boolean isTypeScript) {
     if (isTypeScript) {
+      if (isEmbedded) {
+        return null; // Do not extract files from HTML embedded in other files.
+      }
       Path file = textualExtractor.getExtractedFile().toPath();
       FileSnippet snippet =
           new FileSnippet(file, line, column, toplevelKind, config.getSourceType());
diff --git a/javascript/extractor/src/com/semmle/js/extractor/JSExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/JSExtractor.java
index 3916b35c9da..07c62e1baa3 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/JSExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/JSExtractor.java
@@ -106,7 +106,7 @@ public class JSExtractor {
 
       lexicalExtractor =
           new LexicalExtractor(textualExtractor, parserRes.getTokens(), parserRes.getComments());
-      ASTExtractor scriptExtractor = new ASTExtractor(lexicalExtractor, scopeManager);
+      ASTExtractor scriptExtractor = new ASTExtractor(config, lexicalExtractor, scopeManager);
       toplevelLabel = scriptExtractor.getToplevelLabel();
       lexicalExtractor.extractComments(toplevelLabel);
       loc = lexicalExtractor.extractLines(parserRes.getSource(), toplevelLabel);
@@ -119,7 +119,7 @@ public class JSExtractor {
     } else {
       lexicalExtractor =
           new LexicalExtractor(textualExtractor, new ArrayList<Token>(), new ArrayList<Comment>());
-      ASTExtractor scriptExtractor = new ASTExtractor(lexicalExtractor, null);
+      ASTExtractor scriptExtractor = new ASTExtractor(config, lexicalExtractor, null);
       toplevelLabel = scriptExtractor.getToplevelLabel();
 
       trapwriter.addTuple("toplevels", toplevelLabel, toplevelKind.getValue());
diff --git a/javascript/extractor/src/com/semmle/js/extractor/LexicalExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/LexicalExtractor.java
index 6ca47eb5f6e..4e40160b1e7 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/LexicalExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/LexicalExtractor.java
@@ -1,5 +1,7 @@
 package com.semmle.js.extractor;
 
+import java.util.List;
+
 import com.semmle.js.ast.Comment;
 import com.semmle.js.ast.Position;
 import com.semmle.js.ast.SourceElement;
@@ -7,7 +9,6 @@ import com.semmle.js.ast.Token;
 import com.semmle.js.extractor.ExtractionMetrics.ExtractionPhase;
 import com.semmle.util.trap.TrapWriter;
 import com.semmle.util.trap.TrapWriter.Label;
-import java.util.List;
 
 /**
  * Extractor for populating lexical information about a JavaScript file, including comments and
@@ -28,7 +29,11 @@ public class LexicalExtractor {
     this.tokens = tokens;
     this.comments = comments;
   }
-
+  
+  public TextualExtractor getTextualExtractor() {
+    return textualExtractor;
+  }
+  
   public TrapWriter getTrapwriter() {
     return trapwriter;
   }
diff --git a/javascript/ql/src/semmle/javascript/HTML.qll b/javascript/ql/src/semmle/javascript/HTML.qll
index 898c0d01697..36c7e967f88 100644
--- a/javascript/ql/src/semmle/javascript/HTML.qll
+++ b/javascript/ql/src/semmle/javascript/HTML.qll
@@ -84,6 +84,32 @@ module HTML {
     override string getAPrimaryQlClass() { result = "HTML::Element" }
   }
 
+  /**
+   * Gets the inline script of the given attribute, if any.
+   */
+  CodeInAttribute getCodeInAttribute(XMLAttribute attribute) {
+    exists(
+      string f, Location l1, int sl1, int sc1, int el1, int ec1, Location l2, int sl2, int sc2,
+      int el2, int ec2
+    |
+      l1 = attribute.getLocation() and
+      l2 = result.getLocation() and
+      l1.hasLocationInfo(f, sl1, sc1, el1, ec1) and
+      l2.hasLocationInfo(f, sl2, sc2, el2, ec2)
+    |
+      (
+        sl1 = sl2 and sc1 < sc2
+        or
+        sl1 < sl2
+      ) and
+      (
+        el1 = el2 and ec1 > ec2
+        or
+        el1 > el2
+      )
+    )
+  }
+
   /**
    * An attribute of an HTML element.
    *
@@ -101,6 +127,13 @@ module HTML {
 
     override Location getLocation() { xmllocations(this, result) }
 
+    /**
+     * Gets the inline script of this attribute, if any.
+     */
+    CodeInAttribute getCodeInAttribute() {
+      result = getCodeInAttribute(this)
+    }
+
     /**
      * Gets the element to which this attribute belongs.
      */
@@ -127,32 +160,6 @@ module HTML {
 
     override string toString() { result = getName() + "=" + getValue() }
 
-    /**
-     * Gets the inline script of this attribute, if any.
-     */
-    CodeInAttribute getCodeInAttribute() {
-      exists(
-        string f, Location l1, int sl1, int sc1, int el1, int ec1, Location l2, int sl2, int sc2,
-        int el2, int ec2
-      |
-        l1 = getLocation() and
-        l2 = result.getLocation() and
-        l1.hasLocationInfo(f, sl1, sc1, el1, ec1) and
-        l2.hasLocationInfo(f, sl2, sc2, el2, ec2)
-      |
-        (
-          sl1 = sl2 and sc1 < sc2
-          or
-          sl1 < sl2
-        ) and
-        (
-          el1 = el2 and ec1 > ec2
-          or
-          el1 > el2
-        )
-      )
-    }
-
     override string getAPrimaryQlClass() { result = "HTML::Attribute" }
   }
 
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 5918edeacc9..52e82d66660 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -355,14 +355,30 @@ module Angular2 {
       result = decorator.getOptionArgument(0, "templateUrl").asExpr().(PathExpr).resolve()
     }
 
+    pragma[noinline]
+    private Location getInlineTemplateLocation() {
+      result = decorator.getOptionArgument(0, "template").asExpr().getLocation()
+    }
+
+    private XMLAttribute getAnAttributeInInlineTemplate() {
+      exists(Location templateLoc, Location attribLoc |
+        templateLoc = getInlineTemplateLocation() and
+        attribLoc = result.getLocation() and
+        templateLoc.getFile() = attribLoc.getFile()
+        // TODO: check line/column - though in practice checking the file is enough
+      )
+    }
+
     /**
      * Gets an access to the variable `name` in the template body.
      */
     DataFlow::Node getATemplateVarAccess(string name) {
-      exists(HTML::Attribute attrib |
-        attrib.getFile() = getTemplateFile() and
+      exists(XMLAttribute attrib |
+        attrib.getLocation().getFile() = getTemplateFile() or
+        attrib = getAnAttributeInInlineTemplate()
+      |
         isAngularExpressionAttribute(attrib) and
-        result = getAGlobalVarAccessInAttribute(attrib.getCodeInAttribute(), name).flow()
+        result = getAGlobalVarAccessInAttribute(HTML::getCodeInAttribute(attrib), name).flow()
       )
     }
   }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/inline.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/inline.component.ts
new file mode 100644
index 00000000000..7bcae20cb8c
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/inline.component.ts
@@ -0,0 +1,17 @@
+import { Input, Component } from '@angular/core';
+
+@Component({
+    selector: 'mid-component',
+    template: `
+        <sink-component [sink7]="taint"></sink-component>
+
+        \n<sink-component [sink7]="taint"></sink-component>
+`
+})
+export class InlineComponent {
+    taint: string;
+
+    constructor() {
+        this.taint = source();
+    }
+}
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
index e286cac9910..9986a965ed6 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
@@ -12,6 +12,7 @@ export class SinkComponent {
     sink4: string;
     sink5: string;
     sink6: string;
+    sink7: string;
 
     constructor(private sanitizer: DomSanitizer) {}
 
@@ -22,5 +23,6 @@ export class SinkComponent {
         this.sanitizer.bypassSecurityTrustHtml(this.sink4);
         this.sanitizer.bypassSecurityTrustHtml(this.sink5);
         this.sanitizer.bypassSecurityTrustHtml(this.sink6);
+        this.sanitizer.bypassSecurityTrustHtml(this.sink7);
     }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index 7253c4b6dfb..44f5154b57a 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -22,8 +22,9 @@ pipeClassRef
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:5:22:5:29 | testPipe |
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:6:19:6:26 | testPipe |
 taintFlow
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:19:48:19:57 | this.sink1 |
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:22:48:22:57 | this.sink4 |
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:23:48:23:57 | this.sink5 |
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:24:48:24:57 | this.sink6 |
-| source.component.ts:14:33:14:40 | source() | sink.component.ts:19:48:19:57 | this.sink1 |
+| inline.component.ts:15:22:15:29 | source() | sink.component.ts:26:48:26:57 | this.sink7 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:20:48:20:57 | this.sink1 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:23:48:23:57 | this.sink4 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:24:48:24:57 | this.sink5 |
+| source.component.ts:13:22:13:29 | source() | sink.component.ts:25:48:25:57 | this.sink6 |
+| source.component.ts:14:33:14:40 | source() | sink.component.ts:20:48:20:57 | this.sink1 |

From 3b666a56468faf30177e45848f5ea661ed15a89a Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 14 Dec 2020 11:59:08 +0000
Subject: [PATCH 173/343] JS: Extract mapping from TopLevel to parent HTML node

---
 .../com/semmle/js/extractor/ASTExtractor.java |  24 ++-
 .../semmle/js/extractor/HTMLExtractor.java    | 144 ++++++++++--------
 javascript/ql/src/semmle/javascript/HTML.qll  |  42 +----
 .../ql/src/semmlecode.javascript.dbscheme     |   5 +
 4 files changed, 102 insertions(+), 113 deletions(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index e337f2efd8e..2b448ac54c5 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -177,14 +177,22 @@ public class ASTExtractor {
     this.scopeManager = scopeManager;
     this.lexicalExtractor = lexicalExtractor;
     this.regexpExtractor = new RegExpExtractor(trapwriter, locationManager);
-    this.toplevelLabel =
-        trapwriter.globalID(
-            "script;{"
-                + locationManager.getFileLabel()
-                + "},"
-                + locationManager.getStartLine()
-                + ','
-                + locationManager.getStartColumn());
+    this.toplevelLabel = makeTopLevelLabel(trapwriter, locationManager.getFileLabel(), locationManager.getStartLine(), locationManager.getStartColumn());
+  }
+
+  /**
+   * Returns the label for the top-level starting at the given location.
+   * <p>
+   * May be used to refer to the top-level before it has been extracted.
+   */
+  public static Label makeTopLevelLabel(TrapWriter trapWriter, Label fileLabel, int startLine, int startColumn) {
+    return trapWriter.globalID(
+        "script;{"
+            + fileLabel
+            + "},"
+            + startLine
+            + ','
+            + startColumn);
   }
 
   public TrapWriter getTrapwriter() {
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index bd5f7d33de6..f04ea325528 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -10,9 +10,11 @@ import com.semmle.js.extractor.ExtractorConfig.Platform;
 import com.semmle.js.extractor.ExtractorConfig.SourceType;
 import com.semmle.js.parser.ParseError;
 import com.semmle.util.data.Option;
+import com.semmle.util.data.Pair;
 import com.semmle.util.data.StringUtil;
 import com.semmle.util.io.WholeIO;
 import com.semmle.util.trap.TrapWriter;
+import com.semmle.util.trap.TrapWriter.Label;
 
 import net.htmlparser.jericho.Attribute;
 import net.htmlparser.jericho.Attributes;
@@ -23,16 +25,15 @@ import net.htmlparser.jericho.Segment;
 
 /** Extractor for handling HTML and XHTML files. */
 public class HTMLExtractor implements IExtractor {
+  private LoCInfo locInfo = new LoCInfo(0, 0);
+
   private class JavaScriptHTMLElementHandler implements HtmlPopulator.ElementHandler {
     private final ScopeManager scopeManager;
     private final TextualExtractor textualExtractor;
-    private LoCInfo locInfo;
-
+    
     public JavaScriptHTMLElementHandler(TextualExtractor textualExtractor) {
       this.textualExtractor = textualExtractor;
 
-      this.locInfo = new LoCInfo(0, 0);
-
       this.scopeManager =
           new ScopeManager(textualExtractor.getTrapwriter(), config.getEcmaVersion());
     }
@@ -42,8 +43,7 @@ public class HTMLExtractor implements IExtractor {
      * attribute values.
      */
     @Override
-    public void handleElement(Element elt) {
-      LoCInfo snippetLoC = null;
+    public void handleElement(Element elt, HtmlPopulator.Context context) {
       if (elt.getName().equals(HTMLElementName.SCRIPT)) {
         SourceType sourceType = getScriptSourceType(elt, textualExtractor.getExtractedFile());
         if (sourceType != null) {
@@ -72,16 +72,17 @@ public class HTMLExtractor implements IExtractor {
           source = source.replace("<![CDATA[", "         ").replace("]]>", "   ");
           if (!source.trim().isEmpty()) {
             RowColumnVector contentStart = content.getRowColumnVector();
-            snippetLoC =
-                extractSnippet(
-                    TopLevelKind.inlineScript,
-                    config.withSourceType(sourceType),
-                    scopeManager,
-                    textualExtractor,
-                    source,
-                    contentStart.getRow(),
-                    contentStart.getColumn(),
-                    isTypeScript);
+            extractSnippet(
+                TopLevelKind.inlineScript,
+                config.withSourceType(sourceType),
+                scopeManager,
+                textualExtractor,
+                source,
+                contentStart.getRow(),
+                contentStart.getColumn(),
+                isTypeScript,
+                elt,
+                context);
           }
         }
       } else {
@@ -95,16 +96,17 @@ public class HTMLExtractor implements IExtractor {
             String source = attr.getValue();
             RowColumnVector valueStart = attr.getValueSegment().getRowColumnVector();
             if (JS_ATTRIBUTE.matcher(attr.getName()).matches()) {
-              snippetLoC =
-                  extractSnippet(
-                      TopLevelKind.eventHandler,
-                      config,
-                      scopeManager,
-                      textualExtractor,
-                      source,
-                      valueStart.getRow(),
-                      valueStart.getColumn(),
-                      false /* isTypeScript */);
+              extractSnippet(
+                  TopLevelKind.eventHandler,
+                  config,
+                  scopeManager,
+                  textualExtractor,
+                  source,
+                  valueStart.getRow(),
+                  valueStart.getColumn(),
+                  false /* isTypeScript */,
+                  attr,
+                  context);
             } else if (isAngularTemplateAttributeName(attr.getName())) {
               // For an attribute *ngFor="let var of EXPR", start parsing at EXPR
               int offset = 0;
@@ -116,37 +118,33 @@ public class HTMLExtractor implements IExtractor {
                   source = expr;
                 }
               }
-              snippetLoC =
-                  extractSnippet(
-                      TopLevelKind.eventHandler,
-                      config.withSourceType(SourceType.ANGULAR_TEMPLATE),
-                      scopeManager,
-                      textualExtractor,
-                      source,
-                      valueStart.getRow(),
-                      valueStart.getColumn() + offset,
-                      false /* isTypeScript */);
+              extractSnippet(
+                  TopLevelKind.eventHandler,
+                  config.withSourceType(SourceType.ANGULAR_TEMPLATE),
+                  scopeManager,
+                  textualExtractor,
+                  source,
+                  valueStart.getRow(),
+                  valueStart.getColumn() + offset,
+                  false /* isTypeScript */,
+                  attr,
+                  context);
             } else if (source.startsWith("javascript:")) {
               source = source.substring(11);
-              snippetLoC =
-                  extractSnippet(
-                      TopLevelKind.javascriptUrl,
-                      config,
-                      scopeManager,
-                      textualExtractor,
-                      source,
-                      valueStart.getRow(),
-                      valueStart.getColumn() + 11,
-                      false /* isTypeScript */);
+              extractSnippet(
+                  TopLevelKind.javascriptUrl,
+                  config,
+                  scopeManager,
+                  textualExtractor,
+                  source,
+                  valueStart.getRow(),
+                  valueStart.getColumn() + 11,
+                  false /* isTypeScript */,
+                  attr,
+                  context);
             }
           }
       }
-
-      if (snippetLoC != null) locInfo.add(snippetLoC);
-    }
-
-    public LoCInfo getLoCInfo() {
-      return this.locInfo;
     }
   }
 
@@ -202,7 +200,7 @@ public class HTMLExtractor implements IExtractor {
 
     extractor.doit(Option.some(eltHandler));
 
-    return eltHandler.getLoCInfo();
+    return locInfo;
   }
 
   /**
@@ -270,7 +268,7 @@ public class HTMLExtractor implements IExtractor {
     return val == null ? val : StringUtil.lc(val);
   }
 
-  private LoCInfo extractSnippet(
+  private void extractSnippet(
       TopLevelKind toplevelKind,
       ExtractorConfig config,
       ScopeManager scopeManager,
@@ -278,10 +276,18 @@ public class HTMLExtractor implements IExtractor {
       String source,
       int line,
       int column,
-      boolean isTypeScript) {
+      boolean isTypeScript,
+      Segment parentHtmlNode,
+      HtmlPopulator.Context context) {
+    TrapWriter trapWriter = textualExtractor.getTrapwriter();
+    LocationManager locationManager = textualExtractor.getLocationManager();
+    LocationManager scriptLocationManager =
+        new LocationManager(
+            locationManager.getSourceFile(), trapWriter, locationManager.getFileLabel());
+    scriptLocationManager.setStart(line, column);
     if (isTypeScript) {
       if (isEmbedded) {
-        return null; // Do not extract files from HTML embedded in other files.
+        return; // Do not extract files from HTML embedded in other files.
       }
       Path file = textualExtractor.getExtractedFile().toPath();
       FileSnippet snippet =
@@ -302,28 +308,36 @@ public class HTMLExtractor implements IExtractor {
         }
         state.getSnippets().put(virtualFile, snippet);
       }
-      return null; // LoC info is accounted for later
+      Label topLevelLabel = ASTExtractor.makeTopLevelLabel(
+          textualExtractor.getTrapwriter(),
+          scriptLocationManager.getFileLabel(),
+          scriptLocationManager.getStartLine(),
+          scriptLocationManager.getStartColumn());
+      emitTopLevelXmlNodeBinding(parentHtmlNode, topLevelLabel, context, trapWriter);
+      // Note: LoC info is accounted for later, so not added here.
+      return;
     }
-    TrapWriter trapwriter = textualExtractor.getTrapwriter();
-    LocationManager locationManager = textualExtractor.getLocationManager();
-    LocationManager scriptLocationManager =
-        new LocationManager(
-            locationManager.getSourceFile(), trapwriter, locationManager.getFileLabel());
-    scriptLocationManager.setStart(line, column);
     JSExtractor extractor = new JSExtractor(config);
     try {
       TextualExtractor tx =
           new TextualExtractor(
-              trapwriter,
+              trapWriter,
               scriptLocationManager,
               source,
               config.getExtractLines(),
               textualExtractor.getMetrics(),
               textualExtractor.getExtractedFile());
-      return extractor.extract(tx, source, toplevelKind, scopeManager).snd();
+      Pair<Label, LoCInfo> result = extractor.extract(tx, source, toplevelKind, scopeManager);
+      emitTopLevelXmlNodeBinding(parentHtmlNode, result.fst(), context, trapWriter);
+      locInfo.add(result.snd());
     } catch (ParseError e) {
       e.setPosition(scriptLocationManager.translatePosition(e.getPosition()));
       throw e.asUserError();
     }
   }
+
+  private  void emitTopLevelXmlNodeBinding(Segment parentHtmlNode, Label topLevelLabel, HtmlPopulator.Context context, TrapWriter writer) {
+    Label htmlNodeLabel = context.getNodeLabel(parentHtmlNode);
+    writer.addTuple("toplevel_parent_xml_node", topLevelLabel, htmlNodeLabel);
+  }
 }
diff --git a/javascript/ql/src/semmle/javascript/HTML.qll b/javascript/ql/src/semmle/javascript/HTML.qll
index 36c7e967f88..d0e17e8ad61 100644
--- a/javascript/ql/src/semmle/javascript/HTML.qll
+++ b/javascript/ql/src/semmle/javascript/HTML.qll
@@ -88,26 +88,7 @@ module HTML {
    * Gets the inline script of the given attribute, if any.
    */
   CodeInAttribute getCodeInAttribute(XMLAttribute attribute) {
-    exists(
-      string f, Location l1, int sl1, int sc1, int el1, int ec1, Location l2, int sl2, int sc2,
-      int el2, int ec2
-    |
-      l1 = attribute.getLocation() and
-      l2 = result.getLocation() and
-      l1.hasLocationInfo(f, sl1, sc1, el1, ec1) and
-      l2.hasLocationInfo(f, sl2, sc2, el2, ec2)
-    |
-      (
-        sl1 = sl2 and sc1 < sc2
-        or
-        sl1 < sl2
-      ) and
-      (
-        el1 = el2 and ec1 > ec2
-        or
-        el1 > el2
-      )
-    )
+    toplevel_parent_xml_node(result, attribute)
   }
 
   /**
@@ -233,26 +214,7 @@ module HTML {
      * Gets the inline script of this script element, if any.
      */
     private InlineScript getInlineScript() {
-      exists(
-        string f, Location l1, int sl1, int sc1, int el1, int ec1, Location l2, int sl2, int sc2,
-        int el2, int ec2
-      |
-        l1 = getLocation() and
-        l2 = result.getLocation() and
-        l1.hasLocationInfo(f, sl1, sc1, el1, ec1) and
-        l2.hasLocationInfo(f, sl2, sc2, el2, ec2)
-      |
-        (
-          sl1 = sl2 and sc1 < sc2
-          or
-          sl1 < sl2
-        ) and
-        (
-          el1 = el2 and ec1 > ec2
-          or
-          el1 > el2
-        )
-      ) and
+      toplevel_parent_xml_node(result, this) and
       // the src attribute has precedence
       not exists(getSourcePath())
     }
diff --git a/javascript/ql/src/semmlecode.javascript.dbscheme b/javascript/ql/src/semmlecode.javascript.dbscheme
index 16cee27e77d..281ca4de940 100644
--- a/javascript/ql/src/semmlecode.javascript.dbscheme
+++ b/javascript/ql/src/semmlecode.javascript.dbscheme
@@ -131,6 +131,11 @@ is_nodejs (int tl: @toplevel ref);
 is_es2015_module (int tl: @toplevel ref);
 is_closure_module (int tl: @toplevel ref);
 
+@xml_node_with_code = @xmlelement | @xmlattribute;
+toplevel_parent_xml_node(
+  unique int toplevel: @toplevel ref,
+  int xmlnode: @xml_node_with_code ref);
+
 // statements
 #keyset[parent, idx]
 stmts (unique int id: @stmt, 

From f24af58a60eaa84b597ef177a69c0b9a3487df7e Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 14 Dec 2020 12:32:38 +0000
Subject: [PATCH 174/343] JS: Extract mapping from HTML node to parent
 Expression

---
 .../src/com/semmle/js/extractor/ASTExtractor.java  | 12 ++++++++----
 .../src/com/semmle/js/extractor/HTMLExtractor.java | 14 ++++++++++----
 javascript/ql/src/semmlecode.javascript.dbscheme   |  5 +++++
 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 2b448ac54c5..1e9100f8d83 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -1143,7 +1143,7 @@ public class ASTExtractor {
       locationManager.emitNodeLocation(nd, propkey);
       visitAll(nd.getDecorators(), propkey, IdContext.varBind, -1, -1);
       visit(nd.getKey(), propkey, 0, nd.isComputed() ? IdContext.varBind : IdContext.label);
-      visit(nd.getValue(), propkey, 1, c.idcontext);
+      Label valueLabel = visit(nd.getValue(), propkey, 1, c.idcontext);
       visit(nd.getDefaultValue(), propkey, 2, IdContext.varBind);
       if (nd.isComputed()) trapwriter.addTuple("is_computed", propkey);
       if (nd.isMethod()) trapwriter.addTuple("is_method", propkey);
@@ -1151,7 +1151,7 @@ public class ASTExtractor {
       // Extract the value of a property named `template` as HTML, in order to support
       // Angular2 components with an inline template.
       if (!nd.isComputed() && "template".equals(tryGetIdentifierName(nd.getKey()))) {
-        extractStringValueAsHtml(nd.getValue());
+        extractStringValueAsHtml(nd.getValue(), valueLabel);
       }
       
       return propkey;
@@ -1160,7 +1160,7 @@ public class ASTExtractor {
     /**
      * Extracts the string value of <code>expr</code> as an HTML snippet.
      */
-    private void extractStringValueAsHtml(Expression expr) {
+    private void extractStringValueAsHtml(Expression expr, Label exprLabel) {
       TextualExtractor textualExtractor = lexicalExtractor.getTextualExtractor();
       if (textualExtractor.isSnippet()) {
         return; // do not create nested snippets
@@ -1185,7 +1185,11 @@ public class ASTExtractor {
           getMetrics(),
           vfile.toFile());
       HTMLExtractor html = HTMLExtractor.forEmbeddedHtml(config);
-      html.extract(innerTextualExtractor);
+      List<Label> rootNodes = html.extractEx(innerTextualExtractor).fst();
+      int rootNodeIndex = 0;
+      for (Label rootNode : rootNodes) {
+        trapwriter.addTuple("xml_element_parent_expression", rootNode, exprLabel, rootNodeIndex++);
+      }
     }
 
     private String tryGetIdentifierName(Expression e) {
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index f04ea325528..df7eb9eacba 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -1,7 +1,9 @@
 package com.semmle.js.extractor;
 
 import java.io.File;
+import java.io.IOException;
 import java.nio.file.Path;
+import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -180,9 +182,13 @@ public class HTMLExtractor implements IExtractor {
   public static HTMLExtractor forEmbeddedHtml(ExtractorConfig config) {
     return new HTMLExtractor(config, null, true);
   }
-
+  
   @Override
-  public LoCInfo extract(TextualExtractor textualExtractor) {
+  public LoCInfo extract(TextualExtractor textualExtractor) throws IOException {
+    return extractEx(textualExtractor).snd();
+  }
+
+  public Pair<List<Label>, LoCInfo> extractEx(TextualExtractor textualExtractor) {
     // Angular templates contain attribute names that are not valid HTML/XML, such as [foo], (foo), [(foo)], and *foo.
     // Allow a large number of errors in attribute names, so the Jericho parser does not give up.
     Attributes.setDefaultMaxErrorCount(100);
@@ -198,9 +204,9 @@ public class HTMLExtractor implements IExtractor {
     
     extractor.setStartOffset(locationManager.getStartLine() - 1, locationManager.getStartColumn() - 1);
 
-    extractor.doit(Option.some(eltHandler));
+    List<Label> rootNodes = extractor.doit(Option.some(eltHandler));
 
-    return locInfo;
+    return Pair.make(rootNodes, locInfo);
   }
 
   /**
diff --git a/javascript/ql/src/semmlecode.javascript.dbscheme b/javascript/ql/src/semmlecode.javascript.dbscheme
index 281ca4de940..11b7de776be 100644
--- a/javascript/ql/src/semmlecode.javascript.dbscheme
+++ b/javascript/ql/src/semmlecode.javascript.dbscheme
@@ -136,6 +136,11 @@ toplevel_parent_xml_node(
   unique int toplevel: @toplevel ref,
   int xmlnode: @xml_node_with_code ref);
 
+xml_element_parent_expression(
+  unique int xmlnode: @xmlelement ref,
+  int expression: @expr ref,
+  int index: int ref);
+
 // statements
 #keyset[parent, idx]
 stmts (unique int id: @stmt, 

From 898d22d2f43ecfd623e33606e6c9a5fc450e6d16 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 14 Dec 2020 14:10:28 +0000
Subject: [PATCH 175/343] JS: Simplify HTML element access

---
 javascript/ql/src/semmle/javascript/HTML.qll  | 40 +++++++++++++------
 .../semmle/javascript/frameworks/Angular2.qll | 30 ++++----------
 2 files changed, 36 insertions(+), 34 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/HTML.qll b/javascript/ql/src/semmle/javascript/HTML.qll
index d0e17e8ad61..c92e89d1baf 100644
--- a/javascript/ql/src/semmle/javascript/HTML.qll
+++ b/javascript/ql/src/semmle/javascript/HTML.qll
@@ -10,6 +10,29 @@ module HTML {
     HtmlFile() { getFileType().isHtml() }
   }
 
+  /**
+   * A file that may contain HTML elements.
+   *
+   * This is either an `.html` file or a source code file containing
+   * embedded HTML snippets.
+   */
+  private class FileContainingHtml extends File {
+    FileContainingHtml() {
+      getFileType().isHtml()
+      or
+      // The file contains an expression containing an HTML element
+      exists(Expr e |
+        e.getFile() = this and
+        xml_element_parent_expression(_, e, _)
+      )
+    }
+  }
+
+  /** Gets `i`th root node of the HTML fragment embedded in the given expression, if any. */
+  Element getHtmlElementFromExpr(Expr e, int i) {
+    xml_element_parent_expression(result, e, i)
+  }
+
   /**
    * An HTML element.
    *
@@ -20,7 +43,7 @@ module HTML {
    * ```
    */
   class Element extends Locatable, @xmlelement {
-    Element() { exists(HtmlFile f | xmlElements(this, _, _, _, f)) }
+    Element() { exists(FileContainingHtml f | xmlElements(this, _, _, _, f)) }
 
     override Location getLocation() { xmllocations(this, result) }
 
@@ -84,13 +107,6 @@ module HTML {
     override string getAPrimaryQlClass() { result = "HTML::Element" }
   }
 
-  /**
-   * Gets the inline script of the given attribute, if any.
-   */
-  CodeInAttribute getCodeInAttribute(XMLAttribute attribute) {
-    toplevel_parent_xml_node(result, attribute)
-  }
-
   /**
    * An attribute of an HTML element.
    *
@@ -104,7 +120,7 @@ module HTML {
    * ```
    */
   class Attribute extends Locatable, @xmlattribute {
-    Attribute() { exists(HtmlFile f | xmlAttrs(this, _, _, _, _, f)) }
+    Attribute() { exists(FileContainingHtml f | xmlAttrs(this, _, _, _, _, f)) }
 
     override Location getLocation() { xmllocations(this, result) }
 
@@ -112,7 +128,7 @@ module HTML {
      * Gets the inline script of this attribute, if any.
      */
     CodeInAttribute getCodeInAttribute() {
-      result = getCodeInAttribute(this)
+      toplevel_parent_xml_node(result, this)
     }
 
     /**
@@ -264,7 +280,7 @@ module HTML {
    * Note that instances of this class are only available if extraction is done with `--html all` or `--experimental`.
    */
   class TextNode extends Locatable, @xmlcharacters {
-    TextNode() { exists(HtmlFile f | xmlChars(this, _, _, _, _, f)) }
+    TextNode() { exists(FileContainingHtml f | xmlChars(this, _, _, _, _, f)) }
 
     override string toString() { result = getText() }
 
@@ -303,7 +319,7 @@ module HTML {
    * ```
    */
   class CommentNode extends Locatable, @xmlcomment {
-    CommentNode() { exists(HtmlFile f | xmlComments(this, _, _, f)) }
+    CommentNode() { exists(FileContainingHtml f | xmlComments(this, _, _, f)) }
 
     /** Gets the element in which this comment occurs. */
     Element getParent() { xmlComments(this, _, result, _) }
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 52e82d66660..71cabd987c3 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -340,11 +340,6 @@ module Angular2 {
       result = getAttributeValueAsNode(getATemplateInstantiation().getAttributeByName("[" + name + "]"))
     }
 
-    /** Gets the `templateUrl` property of the `@Component` decorator. */
-    string getTemplateUrl() {
-      decorator.getOptionArgument(0, "templateUrl").mayHaveStringValue(result)
-    }
-
     /**
      * Gets the file referred to by `templateUrl`.
      *
@@ -355,30 +350,21 @@ module Angular2 {
       result = decorator.getOptionArgument(0, "templateUrl").asExpr().(PathExpr).resolve()
     }
 
-    pragma[noinline]
-    private Location getInlineTemplateLocation() {
-      result = decorator.getOptionArgument(0, "template").asExpr().getLocation()
-    }
-
-    private XMLAttribute getAnAttributeInInlineTemplate() {
-      exists(Location templateLoc, Location attribLoc |
-        templateLoc = getInlineTemplateLocation() and
-        attribLoc = result.getLocation() and
-        templateLoc.getFile() = attribLoc.getFile()
-        // TODO: check line/column - though in practice checking the file is enough
-      )
+    /** Gets an element in the HTML template of this component. */
+    HTML::Element getATemplateElement() {
+      result.getFile() = getTemplateFile()
+      or
+      result.getParent*() = HTML::getHtmlElementFromExpr(decorator.getOptionArgument(0, "template").asExpr(), _)
     }
 
     /**
      * Gets an access to the variable `name` in the template body.
      */
     DataFlow::Node getATemplateVarAccess(string name) {
-      exists(XMLAttribute attrib |
-        attrib.getLocation().getFile() = getTemplateFile() or
-        attrib = getAnAttributeInInlineTemplate()
-      |
+      exists(HTML::Attribute attrib |
+        attrib = getATemplateElement().getAnAttribute() and
         isAngularExpressionAttribute(attrib) and
-        result = getAGlobalVarAccessInAttribute(HTML::getCodeInAttribute(attrib), name).flow()
+        result = getAGlobalVarAccessInAttribute(attrib.getCodeInAttribute(), name).flow()
       )
     }
   }

From 97f7cb4dc16b3be94f1f8012d671e68e432d0826 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 14 Dec 2020 15:10:42 +0000
Subject: [PATCH 176/343] JS: Track location information using SourceMaps

---
 .../src/com/semmle/js/ast/Position.java       | 11 +++-
 .../com/semmle/js/extractor/ASTExtractor.java | 36 +++++++------
 .../semmle/js/extractor/HTMLExtractor.java    | 37 +++++++-------
 .../semmle/js/extractor/LocationManager.java  | 45 +++++++++++++++--
 .../js/extractor/OffsetTranslation.java       | 39 ---------------
 .../semmle/js/extractor/RegExpExtractor.java  |  6 ++-
 .../semmle/js/extractor/TextualExtractor.java | 36 +++++++++++++
 .../extractor/test/OffsetTranslationTest.java | 50 -------------------
 8 files changed, 129 insertions(+), 131 deletions(-)
 delete mode 100644 javascript/extractor/src/com/semmle/js/extractor/OffsetTranslation.java
 delete mode 100644 javascript/extractor/src/com/semmle/js/extractor/test/OffsetTranslationTest.java

diff --git a/javascript/extractor/src/com/semmle/js/ast/Position.java b/javascript/extractor/src/com/semmle/js/ast/Position.java
index 7d7ed274c3e..3bf14982e24 100644
--- a/javascript/extractor/src/com/semmle/js/ast/Position.java
+++ b/javascript/extractor/src/com/semmle/js/ast/Position.java
@@ -1,6 +1,13 @@
 package com.semmle.js.ast;
 
-/** A source position identifying a single character. */
+/**
+ * A source position identifying a single character.
+ * <p>
+ * Note that this class remains distinct from {@link com.semmle.util.locations.Position},
+ * due to the 1-based line number convention and the tendency for users of this class to provide
+ * dummy offset values. Although the classes are structurally identical, it is not always safe to
+ * convert one into the other.
+ */
 public class Position implements Comparable<Position> {
   private final int line, column, offset;
 
@@ -23,6 +30,8 @@ public class Position implements Comparable<Position> {
   /**
    * The offset (0-based) of this position from the start of the file, that is, the number of
    * characters that precede it.
+   * <p>
+   * Note that in some cases, a dummy value is filled in for the offset.
    */
   public int getOffset() {
     return offset;
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 1e9100f8d83..34429097207 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -155,6 +155,9 @@ import com.semmle.ts.ast.TypeofTypeExpr;
 import com.semmle.ts.ast.UnaryTypeExpr;
 import com.semmle.ts.ast.UnionTypeExpr;
 import com.semmle.util.collections.CollectionUtil;
+import com.semmle.util.data.Pair;
+import com.semmle.util.locations.OffsetTranslation;
+import com.semmle.util.locations.SourceMap;
 import com.semmle.util.trap.TrapWriter;
 import com.semmle.util.trap.TrapWriter.Label;
 
@@ -1165,25 +1168,23 @@ public class ASTExtractor {
       if (textualExtractor.isSnippet()) {
         return; // do not create nested snippets
       }
-      String source = tryGetStringValueFromExpression(expr);
-      if (source == null) {
+      Pair<String, OffsetTranslation> sourceAndOffset = tryGetStringValueFromExpression(expr);
+      if (sourceAndOffset == null) {
         return;
       }
+      String source = sourceAndOffset.fst();
       SourceLocation loc = expr.getLoc();
       Path originalFile = textualExtractor.getExtractedFile().toPath();
       Path vfile = originalFile.resolveSibling(originalFile.getFileName().toString() + "." + loc.getStart().getLine() + "." + loc.getStart().getColumn() + ".html");
-      LocationManager innerLocationManager = new LocationManager(
-          locationManager.getSourceFile(),
-          locationManager.getTrapWriter(),
-          locationManager.getFileLabel());
-      innerLocationManager.setStart(loc.getStart().getLine(), loc.getStart().getColumn());
+      SourceMap sourceMap = textualExtractor.getSourceMap().offsetBy(loc.getStart().getOffset(), sourceAndOffset.snd());
       TextualExtractor innerTextualExtractor = new TextualExtractor(
           trapwriter,
-          innerLocationManager,
+          locationManager,
           source,
           false,
           getMetrics(),
-          vfile.toFile());
+          vfile.toFile(),
+          sourceMap);
       HTMLExtractor html = HTMLExtractor.forEmbeddedHtml(config);
       List<Label> rootNodes = html.extractEx(innerTextualExtractor).fst();
       int rootNodeIndex = 0;
@@ -1195,22 +1196,25 @@ public class ASTExtractor {
     private String tryGetIdentifierName(Expression e) {
       return e instanceof Identifier ? ((Identifier)e).getName() : null;
     }
-    
-    private String tryGetStringValueFromExpression(Expression e) {
+
+    private Pair<String, OffsetTranslation> tryGetStringValueFromExpression(Expression e) {
       if (e instanceof Literal) {
         Literal lit = (Literal) e;
-        return lit.isStringLiteral() ? (String) lit.getValue() : null;
+        if (!lit.isStringLiteral()) {
+          return null;
+        }
+        return Pair.make((String) lit.getValue(), makeStringLiteralOffsets(lit.getRaw()));
       }
       if (e instanceof TemplateLiteral) {
         TemplateLiteral lit = (TemplateLiteral) e;
         if (!lit.getExpressions().isEmpty()) {
           return null;
         }
-        StringBuilder sb = new StringBuilder();
-        for (TemplateElement elm : lit.getQuasis()) {
-          sb.append(elm.getCooked());
+        if (lit.getQuasis().size() != 1) {
+          return null;
         }
-        return sb.toString();
+        TemplateElement element = lit.getQuasis().get(0);
+        return Pair.make((String) element.getCooked(), makeStringLiteralOffsets("`" + element.getRaw() + "`"));
       }
       return null;
     }
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index df7eb9eacba..8cd41a19f38 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -15,6 +15,7 @@ import com.semmle.util.data.Option;
 import com.semmle.util.data.Pair;
 import com.semmle.util.data.StringUtil;
 import com.semmle.util.io.WholeIO;
+import com.semmle.util.locations.Position;
 import com.semmle.util.trap.TrapWriter;
 import com.semmle.util.trap.TrapWriter.Label;
 
@@ -22,7 +23,6 @@ import net.htmlparser.jericho.Attribute;
 import net.htmlparser.jericho.Attributes;
 import net.htmlparser.jericho.Element;
 import net.htmlparser.jericho.HTMLElementName;
-import net.htmlparser.jericho.RowColumnVector;
 import net.htmlparser.jericho.Segment;
 
 /** Extractor for handling HTML and XHTML files. */
@@ -73,15 +73,13 @@ public class HTMLExtractor implements IExtractor {
            */
           source = source.replace("<![CDATA[", "         ").replace("]]>", "   ");
           if (!source.trim().isEmpty()) {
-            RowColumnVector contentStart = content.getRowColumnVector();
             extractSnippet(
                 TopLevelKind.inlineScript,
                 config.withSourceType(sourceType),
                 scopeManager,
                 textualExtractor,
                 source,
-                contentStart.getRow(),
-                contentStart.getColumn(),
+                content.getBegin(),
                 isTypeScript,
                 elt,
                 context);
@@ -96,7 +94,7 @@ public class HTMLExtractor implements IExtractor {
             if (attr.getValue() == null || attr.getValue().isEmpty()) continue;
 
             String source = attr.getValue();
-            RowColumnVector valueStart = attr.getValueSegment().getRowColumnVector();
+            int valueStart = attr.getValueSegment().getBegin();
             if (JS_ATTRIBUTE.matcher(attr.getName()).matches()) {
               extractSnippet(
                   TopLevelKind.eventHandler,
@@ -104,8 +102,7 @@ public class HTMLExtractor implements IExtractor {
                   scopeManager,
                   textualExtractor,
                   source,
-                  valueStart.getRow(),
-                  valueStart.getColumn(),
+                  valueStart,
                   false /* isTypeScript */,
                   attr,
                   context);
@@ -126,8 +123,7 @@ public class HTMLExtractor implements IExtractor {
                   scopeManager,
                   textualExtractor,
                   source,
-                  valueStart.getRow(),
-                  valueStart.getColumn() + offset,
+                  valueStart + offset,
                   false /* isTypeScript */,
                   attr,
                   context);
@@ -139,8 +135,7 @@ public class HTMLExtractor implements IExtractor {
                   scopeManager,
                   textualExtractor,
                   source,
-                  valueStart.getRow(),
-                  valueStart.getColumn() + 11,
+                  valueStart + 11,
                   false /* isTypeScript */,
                   attr,
                   context);
@@ -201,8 +196,11 @@ public class HTMLExtractor implements IExtractor {
             textualExtractor.getSource(),
             textualExtractor.getTrapwriter(),
             locationManager.getFileLabel());
-    
-    extractor.setStartOffset(locationManager.getStartLine() - 1, locationManager.getStartColumn() - 1);
+
+    // For efficiency, avoid building the source map if not needed (i.e. for plain HTML files).
+    if (textualExtractor.hasNonTrivialSourceMap()) {
+      extractor.setSourceMap(textualExtractor.getSourceMap());
+    }
 
     List<Label> rootNodes = extractor.doit(Option.some(eltHandler));
 
@@ -280,24 +278,23 @@ public class HTMLExtractor implements IExtractor {
       ScopeManager scopeManager,
       TextualExtractor textualExtractor,
       String source,
-      int line,
-      int column,
+      int offset,
       boolean isTypeScript,
       Segment parentHtmlNode,
       HtmlPopulator.Context context) {
     TrapWriter trapWriter = textualExtractor.getTrapwriter();
     LocationManager locationManager = textualExtractor.getLocationManager();
-    LocationManager scriptLocationManager =
-        new LocationManager(
-            locationManager.getSourceFile(), trapWriter, locationManager.getFileLabel());
-    scriptLocationManager.setStart(line, column);
+    // JavaScript AST extraction does not currently support source maps, so just set
+    // line/column numbers on the location manager.
+    Position pos = textualExtractor.getSourceMap().getStart(offset);
+    LocationManager scriptLocationManager = locationManager.startingAt(pos.getLine(), pos.getColumn());
     if (isTypeScript) {
       if (isEmbedded) {
         return; // Do not extract files from HTML embedded in other files.
       }
       Path file = textualExtractor.getExtractedFile().toPath();
       FileSnippet snippet =
-          new FileSnippet(file, line, column, toplevelKind, config.getSourceType());
+          new FileSnippet(file, pos.getLine(), pos.getColumn(), toplevelKind, config.getSourceType());
       VirtualSourceRoot vroot = config.getVirtualSourceRoot();
       // Vue files are special in that they can be imported as modules, and may only
       // contain one <script> tag.
diff --git a/javascript/extractor/src/com/semmle/js/extractor/LocationManager.java b/javascript/extractor/src/com/semmle/js/extractor/LocationManager.java
index 66b2919f520..e3aa38acfa5 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/LocationManager.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/LocationManager.java
@@ -1,13 +1,15 @@
 package com.semmle.js.extractor;
 
+import java.io.File;
+import java.util.LinkedHashSet;
+import java.util.Set;
+
 import com.semmle.js.ast.Position;
 import com.semmle.js.ast.SourceElement;
 import com.semmle.util.files.FileUtil;
+import com.semmle.util.locations.SourceMap;
 import com.semmle.util.trap.TrapWriter;
 import com.semmle.util.trap.TrapWriter.Label;
-import java.io.File;
-import java.util.LinkedHashSet;
-import java.util.Set;
 
 /**
  * This class handles location information; in particular, it translates locations reported by the
@@ -30,6 +32,30 @@ public class LocationManager {
     this.startColumn = 1;
   }
 
+  public LocationManager(LocationManager other) {
+    this.sourceFile = other.sourceFile;
+    this.trapWriter = other.trapWriter;
+    this.fileLabel = other.fileLabel;
+    this.startLine = other.startLine;
+    this.startColumn = other.startColumn;
+  }
+
+  /**
+   * Returns a copy of this location manager whose locations are relative to the
+   * given 1-based line and column numbers (which themselves are relative to this location manager's
+   * starting point).
+   */
+  public LocationManager startingAt(int line, int column) {
+    LocationManager copy = new LocationManager(this);
+    if (line == 1) {
+      copy.startColumn += column - 1;
+    } else {
+      copy.startLine += line - 1;
+      copy.startColumn = column;
+    }
+    return copy;
+  }
+
   public File getSourceFile() {
     return sourceFile;
   }
@@ -63,6 +89,19 @@ public class LocationManager {
     this.hasLocation = hasLocation;
   }
 
+  /**
+   * Creates a source map adjusted for the line/column offset configured in this location manager.
+   * <p>
+   * Note that the absolute offset returned by the source map will be incorrect and should not be relied upon,
+   * only the line and column numbers are valid.
+   */
+  public SourceMap adjustSourceMap(final SourceMap map) {
+    // This method is a placeholder for a better solution in which the location manager has a SourceMap of its own.
+    // That solution requires all users of the location manager to track absolute offsets and defer line/column calculations
+    // to the location manager's source map.
+    return SourceMap.legacyWithStartPos(map, new com.semmle.util.locations.Position(startLine, startColumn, 0));
+  }
+
   /**
    * Emit location information for an AST node. The node's location is translated from the parser's
    * 0-based column numbering scheme with exclusive offsets into our 1-based scheme with inclusive
diff --git a/javascript/extractor/src/com/semmle/js/extractor/OffsetTranslation.java b/javascript/extractor/src/com/semmle/js/extractor/OffsetTranslation.java
deleted file mode 100644
index 88ebc80b9a9..00000000000
--- a/javascript/extractor/src/com/semmle/js/extractor/OffsetTranslation.java
+++ /dev/null
@@ -1,39 +0,0 @@
-package com.semmle.js.extractor;
-
-import com.semmle.util.data.IntList;
-
-/**
- * A mapping of some source range into a set of intervals in an output source range.
- *
- * <p>The mapping is constructed by adding "anchors": input/output pairs that correspond to the
- * beginning of an interval, which is assumed to end at the next anchor.
- */
-public class OffsetTranslation {
-  private IntList anchors = IntList.create();
-  private IntList deltas = IntList.create();
-
-  /** Returns the mapping of x. */
-  public int get(int x) {
-    int index = anchors.binarySearch(x);
-    if (index < 0) {
-      // The insertion point is -index - 1.
-      // Get the index immediately before that.
-      index = -index - 2;
-      if (index < 0) {
-        // If queried before the first anchor, use the first anchor anyway.
-        index = 0;
-      }
-    }
-    return x + deltas.get(index);
-  }
-
-  /**
-   * Maps the given input offset to the given output offset.
-   *
-   * <p>This is added as an anchor. Any offset is mapped based on its closest preceding anchor.
-   */
-  public void set(int from, int to) {
-    anchors.add(from);
-    deltas.add(to - from);
-  }
-}
diff --git a/javascript/extractor/src/com/semmle/js/extractor/RegExpExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/RegExpExtractor.java
index e1a5f9a706b..72f0e48bec0 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/RegExpExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/RegExpExtractor.java
@@ -1,5 +1,8 @@
 package com.semmle.js.extractor;
 
+import java.util.LinkedHashMap;
+import java.util.Map;
+
 import com.semmle.js.ast.Node;
 import com.semmle.js.ast.Position;
 import com.semmle.js.ast.SourceElement;
@@ -40,10 +43,9 @@ import com.semmle.js.ast.regexp.ZeroWidthPositiveLookahead;
 import com.semmle.js.ast.regexp.ZeroWidthPositiveLookbehind;
 import com.semmle.js.parser.RegExpParser;
 import com.semmle.js.parser.RegExpParser.Result;
+import com.semmle.util.locations.OffsetTranslation;
 import com.semmle.util.trap.TrapWriter;
 import com.semmle.util.trap.TrapWriter.Label;
-import java.util.LinkedHashMap;
-import java.util.Map;
 
 /** Extractor for populating regular expressions. */
 public class RegExpExtractor {
diff --git a/javascript/extractor/src/com/semmle/js/extractor/TextualExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/TextualExtractor.java
index b4225ac897f..6cd3a8838dc 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/TextualExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/TextualExtractor.java
@@ -6,6 +6,7 @@ import java.util.regex.Pattern;
 
 import com.semmle.js.ast.Position;
 import com.semmle.js.ast.SourceElement;
+import com.semmle.util.locations.SourceMap;
 import com.semmle.util.trap.TrapWriter;
 import com.semmle.util.trap.TrapWriter.Label;
 
@@ -24,6 +25,7 @@ public class TextualExtractor {
   private final boolean extractLines;
   private final ExtractionMetrics metrics;
   private final File extractedFile;
+  private SourceMap sourceMap;
 
   public TextualExtractor(
       TrapWriter trapwriter,
@@ -32,6 +34,17 @@ public class TextualExtractor {
       boolean extractLines,
       ExtractionMetrics metrics,
       File extractedFile) {
+    this(trapwriter, locationManager, source, extractLines, metrics, extractedFile, null);
+  }
+
+  public TextualExtractor(
+      TrapWriter trapwriter,
+      LocationManager locationManager,
+      String source,
+      boolean extractLines,
+      ExtractionMetrics metrics,
+      File extractedFile,
+      SourceMap sourceMap) {
     this.trapwriter = trapwriter;
     this.locationManager = locationManager;
     this.source = source;
@@ -39,6 +52,29 @@ public class TextualExtractor {
     this.extractLines = extractLines;
     this.metrics = metrics;
     this.extractedFile = extractedFile;
+    this.sourceMap = sourceMap;
+  }
+
+  /**
+   * Returns the source map mapping the characters of {@link #getSource()} back to the
+   * original file locations.
+   */
+  public SourceMap getSourceMap() {
+    // The SourceMap should ideally be owned by the location manager, but the location manager does not
+    // have access to the source code. We construct a source map lazily since, at the time of writing,
+    // most code does not operate with source maps.
+    if (sourceMap == null) {
+      sourceMap = locationManager.adjustSourceMap(SourceMap.fromString(source));
+    }
+    return sourceMap;
+  }
+
+  /**
+   * Returns true if the source map that would be returned by {@link #getSourceMap()} might not be a 1:1 mapping
+   * to the original source file.
+   */
+  public boolean hasNonTrivialSourceMap() {
+    return sourceMap != null || locationManager.getStartLine() != 1 || locationManager.getStartColumn() != 1;
   }
 
   /**
diff --git a/javascript/extractor/src/com/semmle/js/extractor/test/OffsetTranslationTest.java b/javascript/extractor/src/com/semmle/js/extractor/test/OffsetTranslationTest.java
deleted file mode 100644
index 8b8a65aa14d..00000000000
--- a/javascript/extractor/src/com/semmle/js/extractor/test/OffsetTranslationTest.java
+++ /dev/null
@@ -1,50 +0,0 @@
-package com.semmle.js.extractor.test;
-
-import com.semmle.js.extractor.OffsetTranslation;
-import org.junit.Assert;
-import org.junit.Test;
-
-public class OffsetTranslationTest {
-  @Test
-  public void testBasic() {
-    OffsetTranslation table = new OffsetTranslation();
-    table.set(0, 10);
-    table.set(100, 250);
-    Assert.assertEquals(10, table.get(0));
-    Assert.assertEquals(15, table.get(5));
-    Assert.assertEquals(85, table.get(75));
-    Assert.assertEquals(109, table.get(99));
-    Assert.assertEquals(250, table.get(100));
-    Assert.assertEquals(251, table.get(101));
-  }
-
-  @Test
-  public void testLookupBefore() {
-    OffsetTranslation table = new OffsetTranslation();
-    table.set(0, 10);
-    table.set(100, 250);
-    Assert.assertEquals(9, table.get(-1));
-  }
-
-  @Test
-  public void testIdentity() {
-    OffsetTranslation table = new OffsetTranslation();
-    table.set(0, 0);
-    Assert.assertEquals(0, table.get(0));
-    Assert.assertEquals(75, table.get(75));
-  }
-
-  @Test
-  public void testDuplicateAnchor() {
-    OffsetTranslation table = new OffsetTranslation();
-    table.set(0, 0);
-    table.set(10, 100);
-    table.set(10, 100);
-    table.set(20, 150);
-    Assert.assertEquals(1, table.get(1));
-    Assert.assertEquals(100, table.get(10));
-    Assert.assertEquals(101, table.get(11));
-    Assert.assertEquals(150, table.get(20));
-    Assert.assertEquals(151, table.get(21));
-  }
-}

From 3c0867125b90df034bb0b3d9424b6a6aaa583d3a Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 17 Dec 2020 15:26:34 +0000
Subject: [PATCH 177/343] JS: Remove FP in TargetBlank

---
 javascript/ql/src/DOM/TargetBlank.ql | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/javascript/ql/src/DOM/TargetBlank.ql b/javascript/ql/src/DOM/TargetBlank.ql
index c925000159f..cf6b7969d3d 100644
--- a/javascript/ql/src/DOM/TargetBlank.ql
+++ b/javascript/ql/src/DOM/TargetBlank.ql
@@ -16,6 +16,13 @@ import javascript
 import semmle.javascript.frameworks.Templating
 import semmle.javascript.RestrictedLocations
 
+/**
+ * Holds if the `rel` attribute may be injected by an Angular2 directive.
+ */
+predicate maybeInjectedByAngular() {
+  DataFlow::moduleMember("@angular/core", "HostBinding").getACall().getArgument(0).mayHaveStringValue("attr.rel")
+}
+
 /**
  * Holds if the href attribute contains a host that we cannot determine statically.
  */
@@ -44,6 +51,8 @@ where
   e.getName() = "a" and
   // and the host in the href is not hard-coded
   hasDynamicHrefHostAttributeValue(e) and
+  // disable for Angular applications that dynamically inject the 'rel' attribute
+  not maybeInjectedByAngular() and
   e.getAttributeByName("target").getStringValue() = "_blank" and
   // there is no `rel` attribute specifying link type `noopener`/`noreferrer`;
   // `rel` attributes with non-constant value are handled conservatively

From 07cfceee191dffba72ee45235e8b14d29e87c780 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 17 Dec 2020 15:31:33 +0000
Subject: [PATCH 178/343] JS: TRAP test for angular templates

---
 .../tests/ng-templates/input/component.js     |  10 +
 .../extractor/tests/ng-templates/options.json |   3 +
 .../output/trap/component.js.trap             | 666 ++++++++++++++++++
 3 files changed, 679 insertions(+)
 create mode 100644 javascript/extractor/tests/ng-templates/input/component.js
 create mode 100644 javascript/extractor/tests/ng-templates/options.json
 create mode 100644 javascript/extractor/tests/ng-templates/output/trap/component.js.trap

diff --git a/javascript/extractor/tests/ng-templates/input/component.js b/javascript/extractor/tests/ng-templates/input/component.js
new file mode 100644
index 00000000000..c63bffa0769
--- /dev/null
+++ b/javascript/extractor/tests/ng-templates/input/component.js
@@ -0,0 +1,10 @@
+import { Component } from "@angular/core";
+
+@Component({
+	template: `
+	<foo [prop]="expr + expr"/>
+	<foo [baz]="expr!" />
+	<foo [baz]="expr?.bar" />
+	`
+})
+export class MyComponent {}
diff --git a/javascript/extractor/tests/ng-templates/options.json b/javascript/extractor/tests/ng-templates/options.json
new file mode 100644
index 00000000000..075583ca1f6
--- /dev/null
+++ b/javascript/extractor/tests/ng-templates/options.json
@@ -0,0 +1,3 @@
+{
+    "experimental": true
+}
diff --git a/javascript/extractor/tests/ng-templates/output/trap/component.js.trap b/javascript/extractor/tests/ng-templates/output/trap/component.js.trap
new file mode 100644
index 00000000000..ed7ea4db967
--- /dev/null
+++ b/javascript/extractor/tests/ng-templates/output/trap/component.js.trap
@@ -0,0 +1,666 @@
+#10000=@"/component.js;sourcefile"
+files(#10000,"/component.js","component","js",0)
+#10001=@"/;folder"
+folders(#10001,"/","")
+containerparent(#10001,#10000)
+#10002=@"loc,{#10000},0,0,0,0"
+locations_default(#10002,#10000,0,0,0,0)
+hasLocation(#10000,#10002)
+#20000=@"global_scope"
+scopes(#20000,0)
+#20001=@"script;{#10000},1,1"
+#20002=*
+lines(#20002,#20001,"import { Component } from ""@angular/core"";","
+")
+#20003=@"loc,{#10000},1,1,1,42"
+locations_default(#20003,#10000,1,1,1,42)
+hasLocation(#20002,#20003)
+#20004=*
+lines(#20004,#20001,"","
+")
+#20005=@"loc,{#10000},2,1,2,0"
+locations_default(#20005,#10000,2,1,2,0)
+hasLocation(#20004,#20005)
+#20006=*
+lines(#20006,#20001,"@Component({","
+")
+#20007=@"loc,{#10000},3,1,3,12"
+locations_default(#20007,#10000,3,1,3,12)
+hasLocation(#20006,#20007)
+#20008=*
+lines(#20008,#20001,"	template: `","
+")
+#20009=@"loc,{#10000},4,1,4,12"
+locations_default(#20009,#10000,4,1,4,12)
+hasLocation(#20008,#20009)
+indentation(#10000,4,"	",1)
+#20010=*
+lines(#20010,#20001,"	<foo [prop]=""expr + expr""/>","
+")
+#20011=@"loc,{#10000},5,1,5,28"
+locations_default(#20011,#10000,5,1,5,28)
+hasLocation(#20010,#20011)
+indentation(#10000,5,"	",1)
+#20012=*
+lines(#20012,#20001,"	<foo [baz]=""expr!"" />","
+")
+#20013=@"loc,{#10000},6,1,6,22"
+locations_default(#20013,#10000,6,1,6,22)
+hasLocation(#20012,#20013)
+indentation(#10000,6,"	",1)
+#20014=*
+lines(#20014,#20001,"	<foo [baz]=""expr?.bar"" />","
+")
+#20015=@"loc,{#10000},7,1,7,26"
+locations_default(#20015,#10000,7,1,7,26)
+hasLocation(#20014,#20015)
+indentation(#10000,7,"	",1)
+#20016=*
+lines(#20016,#20001,"	`","
+")
+#20017=@"loc,{#10000},8,1,8,2"
+locations_default(#20017,#10000,8,1,8,2)
+hasLocation(#20016,#20017)
+indentation(#10000,8,"	",1)
+#20018=*
+lines(#20018,#20001,"})","
+")
+#20019=@"loc,{#10000},9,1,9,2"
+locations_default(#20019,#10000,9,1,9,2)
+hasLocation(#20018,#20019)
+#20020=*
+lines(#20020,#20001,"export class MyComponent {}","
+")
+#20021=@"loc,{#10000},10,1,10,27"
+locations_default(#20021,#10000,10,1,10,27)
+hasLocation(#20020,#20021)
+numlines(#20001,10,9,0)
+#20022=*
+tokeninfo(#20022,7,#20001,0,"import")
+#20023=@"loc,{#10000},1,1,1,6"
+locations_default(#20023,#10000,1,1,1,6)
+hasLocation(#20022,#20023)
+#20024=*
+tokeninfo(#20024,8,#20001,1,"{")
+#20025=@"loc,{#10000},1,8,1,8"
+locations_default(#20025,#10000,1,8,1,8)
+hasLocation(#20024,#20025)
+#20026=*
+tokeninfo(#20026,6,#20001,2,"Component")
+#20027=@"loc,{#10000},1,10,1,18"
+locations_default(#20027,#10000,1,10,1,18)
+hasLocation(#20026,#20027)
+#20028=*
+tokeninfo(#20028,8,#20001,3,"}")
+#20029=@"loc,{#10000},1,20,1,20"
+locations_default(#20029,#10000,1,20,1,20)
+hasLocation(#20028,#20029)
+#20030=*
+tokeninfo(#20030,6,#20001,4,"from")
+#20031=@"loc,{#10000},1,22,1,25"
+locations_default(#20031,#10000,1,22,1,25)
+hasLocation(#20030,#20031)
+#20032=*
+tokeninfo(#20032,4,#20001,5,"""@angular/core""")
+#20033=@"loc,{#10000},1,27,1,41"
+locations_default(#20033,#10000,1,27,1,41)
+hasLocation(#20032,#20033)
+#20034=*
+tokeninfo(#20034,8,#20001,6,";")
+#20035=@"loc,{#10000},1,42,1,42"
+locations_default(#20035,#10000,1,42,1,42)
+hasLocation(#20034,#20035)
+#20036=*
+tokeninfo(#20036,8,#20001,7,"@")
+#20037=@"loc,{#10000},3,1,3,1"
+locations_default(#20037,#10000,3,1,3,1)
+hasLocation(#20036,#20037)
+#20038=*
+tokeninfo(#20038,6,#20001,8,"Component")
+#20039=@"loc,{#10000},3,2,3,10"
+locations_default(#20039,#10000,3,2,3,10)
+hasLocation(#20038,#20039)
+#20040=*
+tokeninfo(#20040,8,#20001,9,"(")
+#20041=@"loc,{#10000},3,11,3,11"
+locations_default(#20041,#10000,3,11,3,11)
+hasLocation(#20040,#20041)
+#20042=*
+tokeninfo(#20042,8,#20001,10,"{")
+#20043=@"loc,{#10000},3,12,3,12"
+locations_default(#20043,#10000,3,12,3,12)
+hasLocation(#20042,#20043)
+#20044=*
+tokeninfo(#20044,6,#20001,11,"template")
+#20045=@"loc,{#10000},4,2,4,9"
+locations_default(#20045,#10000,4,2,4,9)
+hasLocation(#20044,#20045)
+#20046=*
+tokeninfo(#20046,8,#20001,12,":")
+#20047=@"loc,{#10000},4,10,4,10"
+locations_default(#20047,#10000,4,10,4,10)
+hasLocation(#20046,#20047)
+#20048=*
+tokeninfo(#20048,8,#20001,13,"`")
+#20049=@"loc,{#10000},4,12,4,12"
+locations_default(#20049,#10000,4,12,4,12)
+hasLocation(#20048,#20049)
+#20050=*
+tokeninfo(#20050,4,#20001,14,"
+	<foo [prop]=""expr + expr""/>
+	<foo [baz]=""expr!"" />
+	<foo [baz]=""expr?.bar"" />
+	")
+#20051=@"loc,{#10000},4,13,8,1"
+locations_default(#20051,#10000,4,13,8,1)
+hasLocation(#20050,#20051)
+#20052=*
+tokeninfo(#20052,8,#20001,15,"`")
+#20053=@"loc,{#10000},8,2,8,2"
+locations_default(#20053,#10000,8,2,8,2)
+hasLocation(#20052,#20053)
+#20054=*
+tokeninfo(#20054,8,#20001,16,"}")
+#20055=@"loc,{#10000},9,1,9,1"
+locations_default(#20055,#10000,9,1,9,1)
+hasLocation(#20054,#20055)
+#20056=*
+tokeninfo(#20056,8,#20001,17,")")
+#20057=@"loc,{#10000},9,2,9,2"
+locations_default(#20057,#10000,9,2,9,2)
+hasLocation(#20056,#20057)
+#20058=*
+tokeninfo(#20058,7,#20001,18,"export")
+#20059=@"loc,{#10000},10,1,10,6"
+locations_default(#20059,#10000,10,1,10,6)
+hasLocation(#20058,#20059)
+#20060=*
+tokeninfo(#20060,7,#20001,19,"class")
+#20061=@"loc,{#10000},10,8,10,12"
+locations_default(#20061,#10000,10,8,10,12)
+hasLocation(#20060,#20061)
+#20062=*
+tokeninfo(#20062,6,#20001,20,"MyComponent")
+#20063=@"loc,{#10000},10,14,10,24"
+locations_default(#20063,#10000,10,14,10,24)
+hasLocation(#20062,#20063)
+#20064=*
+tokeninfo(#20064,8,#20001,21,"{")
+#20065=@"loc,{#10000},10,26,10,26"
+locations_default(#20065,#10000,10,26,10,26)
+hasLocation(#20064,#20065)
+#20066=*
+tokeninfo(#20066,8,#20001,22,"}")
+#20067=@"loc,{#10000},10,27,10,27"
+locations_default(#20067,#10000,10,27,10,27)
+hasLocation(#20066,#20067)
+#20068=*
+tokeninfo(#20068,0,#20001,23,"")
+#20069=@"loc,{#10000},11,1,11,0"
+locations_default(#20069,#10000,11,1,11,0)
+hasLocation(#20068,#20069)
+toplevels(#20001,0)
+#20070=@"loc,{#10000},1,1,11,0"
+locations_default(#20070,#10000,1,1,11,0)
+hasLocation(#20001,#20070)
+#20071=@"module;{#10000},1,1"
+scopes(#20071,3)
+scopenodes(#20001,#20071)
+scopenesting(#20071,#20000)
+is_module(#20001)
+is_es2015_module(#20001)
+#20072=@"var;{Component};{#20071}"
+variables(#20072,"Component",#20071)
+#20073=@"local_type_name;{Component};{#20071}"
+local_type_names(#20073,"Component",#20071)
+#20074=@"local_namespace_name;{Component};{#20071}"
+local_namespace_names(#20074,"Component",#20071)
+variables(#20072,"Component",#20071)
+#20075=@"var;{MyComponent};{#20071}"
+variables(#20075,"MyComponent",#20071)
+local_type_names(#20073,"Component",#20071)
+#20076=@"local_type_name;{MyComponent};{#20071}"
+local_type_names(#20076,"MyComponent",#20071)
+local_namespace_names(#20074,"Component",#20071)
+#20077=*
+stmts(#20077,27,#20001,0,"import  ... /core"";")
+hasLocation(#20077,#20003)
+stmt_containers(#20077,#20001)
+#20078=*
+exprs(#20078,4,#20077,-1,"""@angular/core""")
+hasLocation(#20078,#20033)
+enclosing_stmt(#20078,#20077)
+expr_containers(#20078,#20001)
+literals("@angular/core","""@angular/core""",#20078)
+#20079=*
+regexpterm(#20079,14,#20078,0,"@angular/core")
+#20080=@"loc,{#10000},1,28,1,40"
+locations_default(#20080,#10000,1,28,1,40)
+hasLocation(#20079,#20080)
+regexp_const_value(#20079,"@angular/core")
+#20081=*
+exprs(#20081,83,#20077,0,"Component")
+hasLocation(#20081,#20027)
+enclosing_stmt(#20081,#20077)
+expr_containers(#20081,#20001)
+#20082=*
+exprs(#20082,0,#20081,0,"Component")
+hasLocation(#20082,#20027)
+enclosing_stmt(#20082,#20077)
+expr_containers(#20082,#20001)
+literals("Component","Component",#20082)
+#20083=*
+exprs(#20083,78,#20081,1,"Component")
+hasLocation(#20083,#20027)
+enclosing_stmt(#20083,#20077)
+expr_containers(#20083,#20001)
+literals("Component","Component",#20083)
+decl(#20083,#20072)
+typedecl(#20083,#20073)
+namespacedecl(#20083,#20074)
+#20084=*
+stmts(#20084,30,#20001,1,"export  ... nent {}")
+hasLocation(#20084,#20021)
+stmt_containers(#20084,#20001)
+#20085=*
+stmts(#20085,26,#20084,-1,"class MyComponent {}")
+#20086=@"loc,{#10000},10,8,10,27"
+locations_default(#20086,#10000,10,8,10,27)
+hasLocation(#20085,#20086)
+stmt_containers(#20085,#20001)
+#20087=*
+exprs(#20087,94,#20085,-2,"@Compon ... >\n\t`\n})")
+#20088=@"loc,{#10000},3,1,9,2"
+locations_default(#20088,#10000,3,1,9,2)
+hasLocation(#20087,#20088)
+enclosing_stmt(#20087,#20085)
+expr_containers(#20087,#20001)
+#20089=*
+exprs(#20089,13,#20087,0,"Compone ... >\n\t`\n})")
+#20090=@"loc,{#10000},3,2,9,2"
+locations_default(#20090,#10000,3,2,9,2)
+hasLocation(#20089,#20090)
+enclosing_stmt(#20089,#20085)
+expr_containers(#20089,#20001)
+#20091=*
+exprs(#20091,79,#20089,-1,"Component")
+hasLocation(#20091,#20039)
+enclosing_stmt(#20091,#20085)
+expr_containers(#20091,#20001)
+literals("Component","Component",#20091)
+bind(#20091,#20072)
+#20092=*
+exprs(#20092,8,#20089,0,"{\n\ttemp ... />\n\t`\n}")
+#20093=@"loc,{#10000},3,12,9,1"
+locations_default(#20093,#10000,3,12,9,1)
+hasLocation(#20092,#20093)
+enclosing_stmt(#20092,#20085)
+expr_containers(#20092,#20001)
+#20094=*
+properties(#20094,#20092,0,0,"templat ... "" />\n\t`")
+#20095=@"loc,{#10000},4,2,8,2"
+locations_default(#20095,#10000,4,2,8,2)
+hasLocation(#20094,#20095)
+#20096=*
+exprs(#20096,0,#20094,0,"template")
+hasLocation(#20096,#20045)
+enclosing_stmt(#20096,#20085)
+expr_containers(#20096,#20001)
+literals("template","template",#20096)
+#20097=*
+exprs(#20097,71,#20094,1,"`\n\t<foo ... "" />\n\t`")
+#20098=@"loc,{#10000},4,12,8,2"
+locations_default(#20098,#10000,4,12,8,2)
+hasLocation(#20097,#20098)
+enclosing_stmt(#20097,#20085)
+expr_containers(#20097,#20001)
+#20099=*
+exprs(#20099,72,#20097,0,"\n\t<foo  ... r"" />\n\t")
+hasLocation(#20099,#20051)
+enclosing_stmt(#20099,#20085)
+expr_containers(#20099,#20001)
+literals("
+	<foo [prop]=""expr + expr""/>
+	<foo [baz]=""expr!"" />
+	<foo [baz]=""expr?.bar"" />
+	","
+	<foo [prop]=""expr + expr""/>
+	<foo [baz]=""expr!"" />
+	<foo [baz]=""expr?.bar"" />
+	",#20099)
+scopes(#20000,0)
+#20100=@"script;{#10000},5,15"
+#20101=*
+lines(#20101,#20100,"expr + expr","")
+#20102=@"loc,{#10000},5,15,5,25"
+locations_default(#20102,#10000,5,15,5,25)
+hasLocation(#20101,#20102)
+numlines(#20100,1,1,0)
+#20103=*
+tokeninfo(#20103,6,#20100,0,"expr")
+#20104=@"loc,{#10000},5,15,5,18"
+locations_default(#20104,#10000,5,15,5,18)
+hasLocation(#20103,#20104)
+#20105=*
+tokeninfo(#20105,8,#20100,1,"+")
+#20106=@"loc,{#10000},5,20,5,20"
+locations_default(#20106,#10000,5,20,5,20)
+hasLocation(#20105,#20106)
+#20107=*
+tokeninfo(#20107,6,#20100,2,"expr")
+#20108=@"loc,{#10000},5,22,5,25"
+locations_default(#20108,#10000,5,22,5,25)
+hasLocation(#20107,#20108)
+#20109=*
+tokeninfo(#20109,0,#20100,3,"")
+#20110=@"loc,{#10000},5,26,5,25"
+locations_default(#20110,#10000,5,26,5,25)
+hasLocation(#20109,#20110)
+toplevels(#20100,2)
+hasLocation(#20100,#20102)
+#20111=@"module;{#10000},5,15"
+scopes(#20111,3)
+scopenodes(#20100,#20111)
+scopenesting(#20111,#20000)
+is_module(#20100)
+#20112=*
+stmts(#20112,2,#20100,0,"expr + expr")
+hasLocation(#20112,#20102)
+stmt_containers(#20112,#20100)
+#20113=*
+exprs(#20113,34,#20112,0,"expr + expr")
+hasLocation(#20113,#20102)
+enclosing_stmt(#20113,#20112)
+expr_containers(#20113,#20100)
+#20114=*
+exprs(#20114,79,#20113,0,"expr")
+hasLocation(#20114,#20104)
+enclosing_stmt(#20114,#20112)
+expr_containers(#20114,#20100)
+literals("expr","expr",#20114)
+#20115=@"var;{expr};{#20000}"
+variables(#20115,"expr",#20000)
+bind(#20114,#20115)
+#20116=*
+exprs(#20116,79,#20113,1,"expr")
+hasLocation(#20116,#20108)
+enclosing_stmt(#20116,#20112)
+expr_containers(#20116,#20100)
+literals("expr","expr",#20116)
+bind(#20116,#20115)
+#20117=*
+entry_cfg_node(#20117,#20100)
+#20118=@"loc,{#10000},5,15,5,14"
+locations_default(#20118,#10000,5,15,5,14)
+hasLocation(#20117,#20118)
+#20119=*
+exit_cfg_node(#20119,#20100)
+hasLocation(#20119,#20110)
+successor(#20112,#20114)
+successor(#20116,#20113)
+successor(#20114,#20116)
+successor(#20113,#20119)
+successor(#20117,#20112)
+#20120=*
+toplevel_parent_xml_node(#20100,#20120)
+#20121=@"script;{#10000},6,14"
+#20122=*
+lines(#20122,#20121,"expr!","")
+#20123=@"loc,{#10000},6,14,6,18"
+locations_default(#20123,#10000,6,14,6,18)
+hasLocation(#20122,#20123)
+numlines(#20121,1,1,0)
+#20124=*
+tokeninfo(#20124,6,#20121,0,"expr")
+#20125=@"loc,{#10000},6,14,6,17"
+locations_default(#20125,#10000,6,14,6,17)
+hasLocation(#20124,#20125)
+#20126=*
+tokeninfo(#20126,8,#20121,1,"!")
+#20127=@"loc,{#10000},6,18,6,18"
+locations_default(#20127,#10000,6,18,6,18)
+hasLocation(#20126,#20127)
+#20128=*
+tokeninfo(#20128,0,#20121,2,"")
+#20129=@"loc,{#10000},6,19,6,18"
+locations_default(#20129,#10000,6,19,6,18)
+hasLocation(#20128,#20129)
+toplevels(#20121,2)
+hasLocation(#20121,#20123)
+#20130=@"module;{#10000},6,14"
+scopes(#20130,3)
+scopenodes(#20121,#20130)
+scopenesting(#20130,#20000)
+is_module(#20121)
+#20131=*
+stmts(#20131,2,#20121,0,"expr!")
+hasLocation(#20131,#20123)
+stmt_containers(#20131,#20121)
+#20132=*
+exprs(#20132,105,#20131,0,"expr!")
+hasLocation(#20132,#20123)
+enclosing_stmt(#20132,#20131)
+expr_containers(#20132,#20121)
+#20133=*
+exprs(#20133,79,#20132,0,"expr")
+hasLocation(#20133,#20125)
+enclosing_stmt(#20133,#20131)
+expr_containers(#20133,#20121)
+literals("expr","expr",#20133)
+bind(#20133,#20115)
+#20134=*
+entry_cfg_node(#20134,#20121)
+#20135=@"loc,{#10000},6,14,6,13"
+locations_default(#20135,#10000,6,14,6,13)
+hasLocation(#20134,#20135)
+#20136=*
+exit_cfg_node(#20136,#20121)
+hasLocation(#20136,#20129)
+successor(#20131,#20133)
+successor(#20133,#20132)
+successor(#20132,#20136)
+successor(#20134,#20131)
+#20137=*
+toplevel_parent_xml_node(#20121,#20137)
+#20138=@"script;{#10000},7,14"
+#20139=*
+lines(#20139,#20138,"expr?.bar","")
+#20140=@"loc,{#10000},7,14,7,22"
+locations_default(#20140,#10000,7,14,7,22)
+hasLocation(#20139,#20140)
+numlines(#20138,1,1,0)
+#20141=*
+tokeninfo(#20141,6,#20138,0,"expr")
+#20142=@"loc,{#10000},7,14,7,17"
+locations_default(#20142,#10000,7,14,7,17)
+hasLocation(#20141,#20142)
+#20143=*
+tokeninfo(#20143,8,#20138,1,"?.")
+#20144=@"loc,{#10000},7,18,7,19"
+locations_default(#20144,#10000,7,18,7,19)
+hasLocation(#20143,#20144)
+#20145=*
+tokeninfo(#20145,6,#20138,2,"bar")
+#20146=@"loc,{#10000},7,20,7,22"
+locations_default(#20146,#10000,7,20,7,22)
+hasLocation(#20145,#20146)
+#20147=*
+tokeninfo(#20147,0,#20138,3,"")
+#20148=@"loc,{#10000},7,23,7,22"
+locations_default(#20148,#10000,7,23,7,22)
+hasLocation(#20147,#20148)
+toplevels(#20138,2)
+hasLocation(#20138,#20140)
+#20149=@"module;{#10000},7,14"
+scopes(#20149,3)
+scopenodes(#20138,#20149)
+scopenesting(#20149,#20000)
+is_module(#20138)
+#20150=*
+stmts(#20150,2,#20138,0,"expr?.bar")
+hasLocation(#20150,#20140)
+stmt_containers(#20150,#20138)
+#20151=*
+exprs(#20151,14,#20150,0,"expr?.bar")
+hasLocation(#20151,#20140)
+enclosing_stmt(#20151,#20150)
+expr_containers(#20151,#20138)
+#20152=*
+exprs(#20152,79,#20151,0,"expr")
+hasLocation(#20152,#20142)
+enclosing_stmt(#20152,#20150)
+expr_containers(#20152,#20138)
+literals("expr","expr",#20152)
+bind(#20152,#20115)
+#20153=*
+exprs(#20153,0,#20151,1,"bar")
+hasLocation(#20153,#20146)
+enclosing_stmt(#20153,#20150)
+expr_containers(#20153,#20138)
+literals("bar","bar",#20153)
+isOptionalChaining(#20151)
+#20154=*
+entry_cfg_node(#20154,#20138)
+#20155=@"loc,{#10000},7,14,7,13"
+locations_default(#20155,#10000,7,14,7,13)
+hasLocation(#20154,#20155)
+#20156=*
+exit_cfg_node(#20156,#20138)
+hasLocation(#20156,#20148)
+successor(#20150,#20152)
+successor(#20153,#20151)
+successor(#20152,#20153)
+successor(#20151,#20156)
+successor(#20152,#20156)
+successor(#20154,#20150)
+#20157=*
+toplevel_parent_xml_node(#20138,#20157)
+#20158=*
+xmlChars(#20158,"
+	",#10000,0,0,#10000)
+#20159=@"loc,{#10000},4,13,5,2"
+locations_default(#20159,#10000,4,13,5,2)
+xmllocations(#20158,#20159)
+#20160=*
+xmlChars(#20160,"
+	",#10000,2,0,#10000)
+#20161=@"loc,{#10000},5,29,6,2"
+locations_default(#20161,#10000,5,29,6,2)
+xmllocations(#20160,#20161)
+#20162=*
+xmlChars(#20162,"
+	",#10000,4,0,#10000)
+#20163=@"loc,{#10000},6,23,7,2"
+locations_default(#20163,#10000,6,23,7,2)
+xmllocations(#20162,#20163)
+#20164=*
+xmlChars(#20164,"
+	",#10000,6,0,#10000)
+#20165=@"loc,{#10000},7,27,8,2"
+locations_default(#20165,#10000,7,27,8,2)
+xmllocations(#20164,#20165)
+#20166=*
+xmlElements(#20166,"foo",#10000,5,#10000)
+#20167=@"loc,{#10000},7,2,7,27"
+locations_default(#20167,#10000,7,2,7,27)
+xmllocations(#20166,#20167)
+xmlAttrs(#20157,#20166,"[baz]","expr?.bar",0,#10000)
+#20168=@"loc,{#10000},7,7,7,24"
+locations_default(#20168,#10000,7,7,7,24)
+xmllocations(#20157,#20168)
+#20169=*
+xmlElements(#20169,"foo",#10000,3,#10000)
+#20170=@"loc,{#10000},6,2,6,23"
+locations_default(#20170,#10000,6,2,6,23)
+xmllocations(#20169,#20170)
+xmlAttrs(#20137,#20169,"[baz]","expr!",0,#10000)
+#20171=@"loc,{#10000},6,7,6,20"
+locations_default(#20171,#10000,6,7,6,20)
+xmllocations(#20137,#20171)
+#20172=*
+xmlElements(#20172,"foo",#10000,1,#10000)
+#20173=@"loc,{#10000},5,2,5,29"
+locations_default(#20173,#10000,5,2,5,29)
+xmllocations(#20172,#20173)
+xmlAttrs(#20120,#20172,"[prop]","expr + expr",0,#10000)
+#20174=@"loc,{#10000},5,7,5,27"
+locations_default(#20174,#10000,5,7,5,27)
+xmllocations(#20120,#20174)
+xml_element_parent_expression(#20172,#20097,0)
+xml_element_parent_expression(#20169,#20097,1)
+xml_element_parent_expression(#20166,#20097,2)
+#20175=*
+exprs(#20175,78,#20085,0,"MyComponent")
+hasLocation(#20175,#20063)
+enclosing_stmt(#20175,#20085)
+expr_containers(#20175,#20001)
+literals("MyComponent","MyComponent",#20175)
+decl(#20175,#20075)
+typedecl(#20175,#20076)
+#20176=*
+scopes(#20176,10)
+scopenodes(#20085,#20176)
+scopenesting(#20176,#20071)
+#20177=*
+properties(#20177,#20085,2,0,"constructor() {}")
+#20178=@"loc,{#10000},10,26,10,25"
+locations_default(#20178,#10000,10,26,10,25)
+hasLocation(#20177,#20178)
+#20179=*
+exprs(#20179,0,#20177,0,"constructor")
+hasLocation(#20179,#20178)
+enclosing_stmt(#20179,#20085)
+expr_containers(#20179,#20001)
+literals("constructor","constructor",#20179)
+#20180=*
+exprs(#20180,9,#20177,1,"() {}")
+hasLocation(#20180,#20178)
+enclosing_stmt(#20180,#20085)
+expr_containers(#20180,#20001)
+#20181=*
+scopes(#20181,1)
+scopenodes(#20180,#20181)
+scopenesting(#20181,#20176)
+#20182=@"var;{arguments};{#20181}"
+variables(#20182,"arguments",#20181)
+is_arguments_object(#20182)
+#20183=*
+stmts(#20183,1,#20180,-2,"{}")
+hasLocation(#20183,#20178)
+stmt_containers(#20183,#20180)
+is_method(#20177)
+#20184=*
+entry_cfg_node(#20184,#20001)
+#20185=@"loc,{#10000},1,1,1,0"
+locations_default(#20185,#10000,1,1,1,0)
+hasLocation(#20184,#20185)
+#20186=*
+exit_cfg_node(#20186,#20001)
+hasLocation(#20186,#20069)
+successor(#20084,#20175)
+successor(#20180,#20177)
+#20187=*
+entry_cfg_node(#20187,#20180)
+hasLocation(#20187,#20178)
+#20188=*
+exit_cfg_node(#20188,#20180)
+hasLocation(#20188,#20178)
+successor(#20183,#20188)
+successor(#20187,#20183)
+successor(#20179,#20180)
+successor(#20177,#20085)
+successor(#20175,#20179)
+successor(#20092,#20096)
+successor(#20097,#20099)
+successor(#20099,#20094)
+successor(#20096,#20097)
+successor(#20094,#20089)
+successor(#20091,#20092)
+successor(#20089,#20087)
+successor(#20087,#20186)
+successor(#20085,#20091)
+successor(#20077,#20084)
+successor(#20081,#20077)
+successor(#20184,#20081)
+numlines(#10000,10,9,0)
+filetype(#10000,"javascript")

From faad466aa8923fe93ffdc847891244b9f9c54461 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 17 Dec 2020 21:19:00 +0000
Subject: [PATCH 179/343] JS: Add ScopeKind enum

---
 .../com/semmle/js/extractor/ASTExtractor.java |  2 +-
 .../com/semmle/js/extractor/ScopeKind.java    | 35 +++++++++
 .../com/semmle/js/extractor/ScopeManager.java | 71 ++++++++++---------
 3 files changed, 72 insertions(+), 36 deletions(-)
 create mode 100644 javascript/extractor/src/com/semmle/js/extractor/ScopeKind.java

diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 34429097207..830b9066e50 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -704,7 +704,7 @@ public class ASTExtractor {
                     + locationManager.getStartLine()
                     + ","
                     + locationManager.getStartColumn());
-        scopeManager.enterScope(3, moduleScopeKey, toplevelLabel);
+        scopeManager.enterScope(ScopeKind.module, moduleScopeKey, toplevelLabel);
         scopeManager.addVariables(
             sourceType.getPredefinedLocals(platform, locationManager.getSourceFileExtension()));
         trapwriter.addTuple("is_module", toplevelLabel);
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ScopeKind.java b/javascript/extractor/src/com/semmle/js/extractor/ScopeKind.java
new file mode 100644
index 00000000000..c20a5bcc265
--- /dev/null
+++ b/javascript/extractor/src/com/semmle/js/extractor/ScopeKind.java
@@ -0,0 +1,35 @@
+package com.semmle.js.extractor;
+
+/**
+ * A kind of scope, corresponding to the <code>@scope</code> type in the dbscheme.
+ */
+public enum ScopeKind {
+  global(0),
+  function(1),
+  catch_(2),
+  module(3),
+  block(4),
+  for_(5),
+  forIn(6),
+  comprehensionBlock(7),
+  classExpr(8),
+  namespace(9),
+  classDecl(10),
+  interface_(11),
+  typeAlias(12),
+  mappedType(13),
+  enum_(14),
+  externalModule(15),
+  conditionalType(16);
+  
+  private int value;
+  
+  private ScopeKind(int value) {
+    this.value = value;
+  }
+
+  /** Returns the value identifying this scope kind in the database. */
+  public int getValue() {
+    return value;
+  }
+}
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java b/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
index 109b73f2309..a7db92f52a1 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
@@ -1,5 +1,14 @@
 package com.semmle.js.extractor;
 
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
 import com.semmle.js.ast.ArrayPattern;
 import com.semmle.js.ast.BlockStatement;
 import com.semmle.js.ast.CatchClause;
@@ -54,14 +63,6 @@ import com.semmle.ts.ast.TypeAliasDeclaration;
 import com.semmle.ts.ast.UnionTypeExpr;
 import com.semmle.util.trap.TrapWriter;
 import com.semmle.util.trap.TrapWriter.Label;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.LinkedHashMap;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
 
 /** Class for maintaining scoping information during extraction. */
 public class ScopeManager {
@@ -104,7 +105,7 @@ public class ScopeManager {
 
   public ScopeManager(TrapWriter trapWriter, ECMAVersion ecmaVersion) {
     this.trapWriter = trapWriter;
-    this.toplevelScope = enterScope(0, trapWriter.globalID("global_scope"), null);
+    this.toplevelScope = enterScope(ScopeKind.global, trapWriter.globalID("global_scope"), null);
     this.ecmaVersion = ecmaVersion;
   }
 
@@ -115,12 +116,12 @@ public class ScopeManager {
    * @param scopeLabel the label of the scope itself
    * @param scopeNodeLabel the label of the AST node inducing this scope; may be null
    */
-  public Scope enterScope(int scopeKind, Label scopeLabel, Label scopeNodeLabel) {
+  public Scope enterScope(ScopeKind scopeKind, Label scopeLabel, Label scopeNodeLabel) {
     Label outerScopeLabel = curScope == null ? null : curScope.scopeLabel;
 
     curScope = new Scope(curScope, scopeLabel);
 
-    trapWriter.addTuple("scopes", curScope.scopeLabel, scopeKind);
+    trapWriter.addTuple("scopes", curScope.scopeLabel, scopeKind.getValue());
     if (scopeNodeLabel != null)
       trapWriter.addTuple("scopenodes", scopeNodeLabel, curScope.scopeLabel);
     if (outerScopeLabel != null)
@@ -162,32 +163,32 @@ public class ScopeManager {
     return toplevelScope;
   }
 
-  private static final Map<String, Integer> scopeKinds = new LinkedHashMap<String, Integer>();
+  private static final Map<String, ScopeKind> scopeKinds = new LinkedHashMap<String, ScopeKind>();
 
   static {
-    scopeKinds.put("Program", 0);
-    scopeKinds.put("FunctionDeclaration", 1);
-    scopeKinds.put("FunctionExpression", 1);
-    scopeKinds.put("ArrowFunctionExpression", 1);
-    scopeKinds.put("CatchClause", 2);
-    scopeKinds.put("Module", 3);
-    scopeKinds.put("BlockStatement", 4);
-    scopeKinds.put("SwitchStatement", 4);
-    scopeKinds.put("ForStatement", 5);
-    scopeKinds.put("ForInStatement", 6);
-    scopeKinds.put("ForOfStatement", 6);
-    scopeKinds.put("ComprehensionBlock", 7);
-    scopeKinds.put("LetStatement", 4);
-    scopeKinds.put("LetExpression", 4);
-    scopeKinds.put("ClassExpression", 8);
-    scopeKinds.put("NamespaceDeclaration", 9);
-    scopeKinds.put("ClassDeclaration", 10);
-    scopeKinds.put("InterfaceDeclaration", 11);
-    scopeKinds.put("TypeAliasDeclaration", 12);
-    scopeKinds.put("MappedTypeExpr", 13);
-    scopeKinds.put("EnumDeclaration", 14);
-    scopeKinds.put("ExternalModuleDeclaration", 15);
-    scopeKinds.put("ConditionalTypeExpr", 16);
+    scopeKinds.put("Program", ScopeKind.global);
+    scopeKinds.put("FunctionDeclaration", ScopeKind.function);
+    scopeKinds.put("FunctionExpression", ScopeKind.function);
+    scopeKinds.put("ArrowFunctionExpression", ScopeKind.function);
+    scopeKinds.put("CatchClause", ScopeKind.catch_);
+    scopeKinds.put("Module", ScopeKind.module);
+    scopeKinds.put("BlockStatement", ScopeKind.block);
+    scopeKinds.put("SwitchStatement", ScopeKind.block);
+    scopeKinds.put("ForStatement", ScopeKind.for_);
+    scopeKinds.put("ForInStatement", ScopeKind.forIn);
+    scopeKinds.put("ForOfStatement", ScopeKind.forIn);
+    scopeKinds.put("ComprehensionBlock", ScopeKind.comprehensionBlock);
+    scopeKinds.put("LetStatement", ScopeKind.block);
+    scopeKinds.put("LetExpression", ScopeKind.block);
+    scopeKinds.put("ClassExpression", ScopeKind.classExpr);
+    scopeKinds.put("NamespaceDeclaration", ScopeKind.namespace);
+    scopeKinds.put("ClassDeclaration", ScopeKind.classDecl);
+    scopeKinds.put("InterfaceDeclaration", ScopeKind.interface_);
+    scopeKinds.put("TypeAliasDeclaration", ScopeKind.typeAlias);
+    scopeKinds.put("MappedTypeExpr", ScopeKind.mappedType);
+    scopeKinds.put("EnumDeclaration", ScopeKind.enum_);
+    scopeKinds.put("ExternalModuleDeclaration", ScopeKind.externalModule);
+    scopeKinds.put("ConditionalTypeExpr", ScopeKind.conditionalType);
   }
 
   /**

From 2ba98da10724f29f3a289c3a9459b1fea3b5c46a Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 17 Dec 2020 23:16:26 +0000
Subject: [PATCH 180/343] JS: Only extract local vars in TemplateTopLevel

Angular template expressions cannot refer to global variables, any
unqualified identifier is a reference to a property provided by the
component.

We extract them as implicitly declared local variables which the
QL model can then connect with data flow steps.
---
 .../com/semmle/js/extractor/ASTExtractor.java |  5 +-
 .../semmle/js/extractor/ExtractorConfig.java  |  8 +++
 .../semmle/js/extractor/HTMLExtractor.java    |  2 +-
 .../com/semmle/js/extractor/ScopeManager.java | 14 ++++-
 .../com/semmle/js/extractor/TopLevelKind.java |  3 +-
 javascript/ql/src/semmle/javascript/AST.qll   |  2 +-
 .../semmle/javascript/dataflow/Sources.qll    |  3 +-
 .../internal/VariableTypeInference.qll        | 10 +++-
 .../semmle/javascript/frameworks/Angular2.qll | 60 ++++++++++++-------
 .../ql/src/semmlecode.javascript.dbscheme     |  3 +-
 .../frameworks/Angular2/source.component.html |  1 +
 .../frameworks/Angular2/source.component.ts   |  7 ++-
 .../frameworks/Angular2/test.expected         | 11 ++--
 13 files changed, 93 insertions(+), 36 deletions(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 830b9066e50..75b26223a2a 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -704,7 +704,10 @@ public class ASTExtractor {
                     + locationManager.getStartLine()
                     + ","
                     + locationManager.getStartColumn());
-        scopeManager.enterScope(ScopeKind.module, moduleScopeKey, toplevelLabel);
+        Scope moduleScope = scopeManager.enterScope(ScopeKind.module, moduleScopeKey, toplevelLabel);
+        if (sourceType.hasNoGlobalScope()) {
+          scopeManager.setImplicitVariableScope(moduleScope);
+        }
         scopeManager.addVariables(
             sourceType.getPredefinedLocals(platform, locationManager.getSourceFileExtension()));
         trapwriter.addTuple("is_module", toplevelLabel);
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ExtractorConfig.java b/javascript/extractor/src/com/semmle/js/extractor/ExtractorConfig.java
index f9b5939a6f6..8543ddf16da 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ExtractorConfig.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ExtractorConfig.java
@@ -113,6 +113,14 @@ public class ExtractorConfig {
       return this != SCRIPT;
     }
 
+    /**
+     * Returns true if this source type cannot access the global scope directly, and undeclared
+     * variables are implicitly declared in its local scope. Implies {@link #hasLocalScope()}.
+     */
+    public boolean hasNoGlobalScope() {
+      return this == ANGULAR_TEMPLATE;
+    }
+
     /** Returns true if this source is implicitly in strict mode. */
     public boolean isStrictMode() {
       return this == MODULE;
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index 8cd41a19f38..ce2a28969ea 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -118,7 +118,7 @@ public class HTMLExtractor implements IExtractor {
                 }
               }
               extractSnippet(
-                  TopLevelKind.eventHandler,
+                  TopLevelKind.angularTemplate,
                   config.withSourceType(SourceType.ANGULAR_TEMPLATE),
                   scopeManager,
                   textualExtractor,
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java b/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
index a7db92f52a1..eada6aa1d35 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
@@ -102,11 +102,21 @@ public class ScopeManager {
   private final Scope toplevelScope;
   private final ECMAVersion ecmaVersion;
   private final Set<String> implicitGlobals = new LinkedHashSet<String>();
+  private Scope implicitVariableScope;
 
   public ScopeManager(TrapWriter trapWriter, ECMAVersion ecmaVersion) {
     this.trapWriter = trapWriter;
     this.toplevelScope = enterScope(ScopeKind.global, trapWriter.globalID("global_scope"), null);
     this.ecmaVersion = ecmaVersion;
+    this.implicitVariableScope = toplevelScope; 
+  }
+
+  /**
+   * Sets the scope in which to declare variables that are referenced without
+   * being declared. This defaults to the global scope.
+   */
+  public void setImplicitVariableScope(Scope implicitVariableScope) {
+    this.implicitVariableScope = implicitVariableScope;
   }
 
   /**
@@ -193,12 +203,12 @@ public class ScopeManager {
 
   /**
    * Get the label for a given variable in the current scope; if it cannot be found, add it to the
-   * global scope.
+   * implicit variable scope (usually the global scope). 
    */
   public Label getVarKey(String name) {
     Label lbl = curScope.lookupVariable(name);
     if (lbl == null) {
-      lbl = addVariable(name, toplevelScope);
+      lbl = addVariable(name, implicitVariableScope);
       implicitGlobals.add(name);
     }
     return lbl;
diff --git a/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java b/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java
index 70fae82d1ff..2755329621b 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java
@@ -7,7 +7,8 @@ public enum TopLevelKind {
   script(0),
   inlineScript(1),
   eventHandler(2),
-  javascriptUrl(3);
+  javascriptUrl(3),
+  angularTemplate(4);
   
   private int value;
   
diff --git a/javascript/ql/src/semmle/javascript/AST.qll b/javascript/ql/src/semmle/javascript/AST.qll
index e87d5d92385..157aa30015f 100644
--- a/javascript/ql/src/semmle/javascript/AST.qll
+++ b/javascript/ql/src/semmle/javascript/AST.qll
@@ -300,7 +300,7 @@ class InlineScript extends @inline_script, Script { }
  * ```
  */
 class CodeInAttribute extends TopLevel {
-  CodeInAttribute() { this instanceof @event_handler or this instanceof @javascript_url }
+  CodeInAttribute() { this instanceof @event_handler or this instanceof @javascript_url or this instanceof @angular_template_toplevel }
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Sources.qll b/javascript/ql/src/semmle/javascript/dataflow/Sources.qll
index 10347bfbfcb..228810f6238 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Sources.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Sources.qll
@@ -309,7 +309,8 @@ module SourceNode {
         astNode instanceof ImportSpecifier or
         astNode instanceof ImportMetaExpr or
         astNode instanceof TaggedTemplateExpr or
-        astNode instanceof Angular2::PipeRefExpr
+        astNode instanceof Angular2::PipeRefExpr or
+        astNode instanceof Angular2::TemplateVarRefExpr
       )
       or
       DataFlow::parameterNode(this, _)
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/VariableTypeInference.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/VariableTypeInference.qll
index d3b950e71a6..8155ad81319 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/VariableTypeInference.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/VariableTypeInference.qll
@@ -307,6 +307,11 @@ class AnalyzedNegativeConditionGuard extends AnalyzedRefinement {
   }
 }
 
+/** Holds if `v` is a variable in an Angular template. */
+private predicate isAngularTemplateVariable(LocalVariable v) {
+  v = any(Angular2::TemplateTopLevel tl).getScope().getAVariable()
+}
+
 /**
  * Gets the abstract value representing the initial value of variable `v`.
  *
@@ -325,7 +330,10 @@ private AbstractValue getImplicitInitValue(LocalVariable v) {
       then
         // model hoisting
         result = TAbstractFunction(getAFunDecl(v))
-      else result = TAbstractUndefined()
+      else
+        if isAngularTemplateVariable(v)
+        then result = TIndefiniteAbstractValue("heap")
+        else result = TAbstractUndefined()
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 71cabd987c3..d301433181a 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -241,6 +241,33 @@ module Angular2 {
     }
   }
 
+  /**
+   * A reference to a variable in a template expression, corresponding
+   * to a property on the component class.
+   */
+  class TemplateVarRefExpr extends Expr {
+    TemplateVarRefExpr() {
+      this = any(TemplateTopLevel tl).getScope().getAVariable().getAnAccess()
+    }
+  }
+
+  /** The top-level containing an Angular expression. */
+  class TemplateTopLevel extends TopLevel, @angular_template_toplevel {
+    /** Gets the expression in this top-level. */
+    Expr getExpression() {
+      result = getChildStmt(0).(ExprStmt).getExpr()
+    }
+
+    /** Gets the data flow node representing the initialization of the given variable in this scope. */
+    DataFlow::Node getVariableInit(string name) {
+      result = DataFlow::ssaDefinitionNode(SSA::implicitInit(getScope().getVariable(name)))
+    }
+
+    DataFlow::SourceNode getAVariableUse(string name) {
+      result = getScope().getVariable(name).getAnAccess().flow()
+    }
+  }
+
   /** The RHS of a `templateUrl` property, seen as a path expression. */
   private class TemplateUrlPath extends PathExpr {
     TemplateUrlPath() {
@@ -264,18 +291,8 @@ module Angular2 {
     attrib.getName().matches("*ng%")
   }
 
-  /**
-   * Gets a global variable access to `name` within the given attribute.
-   */
-  pragma[noinline]
-  private GlobalVarAccess getAGlobalVarAccessInAttribute(CodeInAttribute code, string name) {
-    exists(ComponentClass cls) and // do not materialize for non-Angular codebases
-    result.getTopLevel() = code and
-    result.getName() = name
-  }
-
   private DataFlow::Node getAttributeValueAsNode(HTML::Attribute attrib) {
-    result = attrib.getCodeInAttribute().getChildStmt(0).(ExprStmt).getExpr().flow()
+    result = attrib.getCodeInAttribute().(TemplateTopLevel).getExpression().flow()
   }
 
   /**
@@ -361,11 +378,7 @@ module Angular2 {
      * Gets an access to the variable `name` in the template body.
      */
     DataFlow::Node getATemplateVarAccess(string name) {
-      exists(HTML::Attribute attrib |
-        attrib = getATemplateElement().getAnAttribute() and
-        isAngularExpressionAttribute(attrib) and
-        result = getAGlobalVarAccessInAttribute(attrib.getCodeInAttribute(), name).flow()
-      )
+      result = getATemplateElement().getAnAttribute().getCodeInAttribute().(TemplateTopLevel).getAVariableUse(name)
     }
   }
 
@@ -450,11 +463,7 @@ module Angular2 {
 
     /** Gets a reference to the iterator variable. */
     DataFlow::Node getAnIteratorAccess() {
-      exists(HTML::Attribute attrib |
-        attrib = getAnElementInScope().getAnAttribute() and
-        isAngularExpressionAttribute(attrib) and
-        result = getAGlobalVarAccessInAttribute(attrib.getCodeInAttribute(), getIteratorName()).flow()
-      )
+      result = getAnElementInScope().getAnAttribute().getCodeInAttribute().(TemplateTopLevel).getAVariableUse(getIteratorName())
     }
   }
 
@@ -474,4 +483,13 @@ module Angular2 {
       succ = attrib.getAnIteratorAccess()
     }
   }
+
+  private class AnyCastStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
+    AnyCastStep() { this = any(TemplateTopLevel tl).getAVariableUse("$any").getACall() }
+
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      pred = getArgument(0) and
+      succ = this
+    }
+  }
 }
diff --git a/javascript/ql/src/semmlecode.javascript.dbscheme b/javascript/ql/src/semmlecode.javascript.dbscheme
index 11b7de776be..930898a4fe0 100644
--- a/javascript/ql/src/semmlecode.javascript.dbscheme
+++ b/javascript/ql/src/semmlecode.javascript.dbscheme
@@ -124,7 +124,8 @@ case @toplevel.kind of
    0 = @script
 |  1 = @inline_script
 |  2 = @event_handler
-|  3 = @javascript_url;
+|  3 = @javascript_url
+|  4 = @angular_template_toplevel;
 
 is_module (int tl: @toplevel ref);
 is_nodejs (int tl: @toplevel ref);
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
index c26664f8d85..79491225b01 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
@@ -4,6 +4,7 @@
     [sink3]="taint | unknownPipe:'safe'"
     [sink4]="taint | testPipe:'safe'"
     [sink5]="42 | testPipe:taint"
+    (someEvent)="methodOnComponent(taint)"
 ></sink-component>
 
 <div *ngFor="let element of taintedArray">
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/source.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.ts
index bd296c7a298..63b981367b3 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/source.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.ts
@@ -1,4 +1,5 @@
 import { Component } from "@angular/core";
+import { DomSanitizer } from '@angular/platform-browser';
 
 @Component({
     selector: "source-component",
@@ -9,9 +10,13 @@ export class Source {
     taintedArray: string[];
     safeArray: string[];
 
-    constructor() {
+    constructor(private sanitizer: DomSanitizer) {
         this.taint = source();
         this.taintedArray = [...source()];
         this.safeArray = ['a', 'b'];
     }
+
+    methodOnComponent(x) {
+        this.sanitizer.bypassSecurityTrustHtml(x);
+    }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index 44f5154b57a..4eccd9feb15 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -23,8 +23,9 @@ pipeClassRef
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:6:19:6:26 | testPipe |
 taintFlow
 | inline.component.ts:15:22:15:29 | source() | sink.component.ts:26:48:26:57 | this.sink7 |
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:20:48:20:57 | this.sink1 |
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:23:48:23:57 | this.sink4 |
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:24:48:24:57 | this.sink5 |
-| source.component.ts:13:22:13:29 | source() | sink.component.ts:25:48:25:57 | this.sink6 |
-| source.component.ts:14:33:14:40 | source() | sink.component.ts:20:48:20:57 | this.sink1 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:20:48:20:57 | this.sink1 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:23:48:23:57 | this.sink4 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:24:48:24:57 | this.sink5 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:25:48:25:57 | this.sink6 |
+| source.component.ts:14:22:14:29 | source() | source.component.ts:20:48:20:48 | x |
+| source.component.ts:15:33:15:40 | source() | sink.component.ts:20:48:20:57 | this.sink1 |

From c8901b62f58856c7afd6e476d0b9606c83fd55f6 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 18 Dec 2020 10:25:22 +0000
Subject: [PATCH 181/343] JS: Add test for $any step

---
 .../frameworks/Angular2/sink.component.ts           |  2 ++
 .../frameworks/Angular2/source.component.html       |  1 +
 .../library-tests/frameworks/Angular2/test.expected | 13 +++++++------
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
index 9986a965ed6..48698860f70 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
@@ -13,6 +13,7 @@ export class SinkComponent {
     sink5: string;
     sink6: string;
     sink7: string;
+    sink8: string;
 
     constructor(private sanitizer: DomSanitizer) {}
 
@@ -24,5 +25,6 @@ export class SinkComponent {
         this.sanitizer.bypassSecurityTrustHtml(this.sink5);
         this.sanitizer.bypassSecurityTrustHtml(this.sink6);
         this.sanitizer.bypassSecurityTrustHtml(this.sink7);
+        this.sanitizer.bypassSecurityTrustHtml(this.sink8);
     }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
index 79491225b01..376551d9d15 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/source.component.html
@@ -5,6 +5,7 @@
     [sink4]="taint | testPipe:'safe'"
     [sink5]="42 | testPipe:taint"
     (someEvent)="methodOnComponent(taint)"
+    [sink8]="$any(taint)"
 ></sink-component>
 
 <div *ngFor="let element of taintedArray">
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index 4eccd9feb15..978d419086c 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -22,10 +22,11 @@ pipeClassRef
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:5:22:5:29 | testPipe |
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:6:19:6:26 | testPipe |
 taintFlow
-| inline.component.ts:15:22:15:29 | source() | sink.component.ts:26:48:26:57 | this.sink7 |
-| source.component.ts:14:22:14:29 | source() | sink.component.ts:20:48:20:57 | this.sink1 |
-| source.component.ts:14:22:14:29 | source() | sink.component.ts:23:48:23:57 | this.sink4 |
-| source.component.ts:14:22:14:29 | source() | sink.component.ts:24:48:24:57 | this.sink5 |
-| source.component.ts:14:22:14:29 | source() | sink.component.ts:25:48:25:57 | this.sink6 |
+| inline.component.ts:15:22:15:29 | source() | sink.component.ts:27:48:27:57 | this.sink7 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:21:48:21:57 | this.sink1 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:24:48:24:57 | this.sink4 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:25:48:25:57 | this.sink5 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:26:48:26:57 | this.sink6 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:28:48:28:57 | this.sink8 |
 | source.component.ts:14:22:14:29 | source() | source.component.ts:20:48:20:48 | x |
-| source.component.ts:15:33:15:40 | source() | sink.component.ts:20:48:20:57 | this.sink1 |
+| source.component.ts:15:33:15:40 | source() | sink.component.ts:21:48:21:57 | this.sink1 |

From 2f3cef177bdea61a770e96b9240698aed9c7e5b3 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 18 Dec 2020 12:12:30 +0000
Subject: [PATCH 182/343] JS: More steps in Angular2 model

---
 .../semmle/javascript/frameworks/Angular2.qll | 138 +++++++++++++++++-
 1 file changed, 132 insertions(+), 6 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index d301433181a..6af647a817a 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -241,6 +241,23 @@ module Angular2 {
     }
   }
 
+  /**
+   * A call derived from a pipe expression.
+   *
+   * For example, the expression `x | f: y` is desugared to `f(x, y)` where
+   * `f` is a `PipeRefExpr` and the call itself is a `PipeCallExpr`.
+   */
+  class PipeCallExpr extends CallExpr {
+    PipeCallExpr() {
+      getCallee() instanceof PipeRefExpr
+    }
+
+    /** Gets the name of the pipe being invoked, such as `f` in `x | f`. */
+    string getPipeName() {
+      result = getCallee().(PipeRefExpr).getName()
+    }
+  }
+
   /**
    * A reference to a variable in a template expression, corresponding
    * to a property on the component class.
@@ -263,6 +280,7 @@ module Angular2 {
       result = DataFlow::ssaDefinitionNode(SSA::implicitInit(getScope().getVariable(name)))
     }
 
+    /** Gets a data flow node corresponding to a use of the given template variable within this top-level. */
     DataFlow::SourceNode getAVariableUse(string name) {
       result = getScope().getVariable(name).getAnAccess().flow()
     }
@@ -375,9 +393,9 @@ module Angular2 {
     }
 
     /**
-     * Gets an access to the variable `name` in the template body.
+     * Gets an access to the given template variable within the template body of this component.
      */
-    DataFlow::Node getATemplateVarAccess(string name) {
+    DataFlow::SourceNode getATemplateVarAccess(string name) {
       result = getATemplateElement().getAnAttribute().getCodeInAttribute().(TemplateTopLevel).getAVariableUse(name)
     }
   }
@@ -453,7 +471,7 @@ module Angular2 {
 
     /** Gets the name of the variable holding the element of the current iteration. */
     string getIteratorName() {
-      result = getValue().regexpCapture("^ *let (\\w+) .*", 1)
+      result = getValue().regexpCapture(" *let +(\\w+).*", 1)
     }
 
     /** Gets an HTML element in which the iterator variable is in scope. */
@@ -484,11 +502,119 @@ module Angular2 {
     }
   }
 
-  private class AnyCastStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
-    AnyCastStep() { this = any(TemplateTopLevel tl).getAVariableUse("$any").getACall() }
+  private class AnyCastStep extends PreCallGraphStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(DataFlow::CallNode call |
+        call = any(TemplateTopLevel tl).getAVariableUse("$any").getACall() and
+        pred = call.getArgument(0) and
+        succ = call
+      )
+    }
+  }
+
+  /**
+   * Gets an invocation of the pipe of the given name.
+   *
+   * For example, the call generated from `items | async` would be found by `getAPipeCall("async")`.
+   */
+  DataFlow::CallNode getAPipeCall(string name) {
+    result.getCalleeNode().asExpr().(PipeRefExpr).getName() = name
+  }
+
+  private class BuiltinPipeStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
+    string name;
+
+    BuiltinPipeStep() {
+      this = getAPipeCall(name)
+    }
 
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
-      pred = getArgument(0) and
+      succ = this and
+      exists(int i | pred = getArgument(i) |
+        i = 0 and name = ["async", "i18nPlural", "json", "keyvalue", "lowercase", "uppercase", "titlecase", "slice"]
+        or
+        i = 1 and name = "date" // date format string
+      )
+      or
+      // Arguments to translate are assumed to be included in the result somewhere
+      name = "translate" and
+      succ = this and
+      pred = [getArgument(1), getOptionArgument(1, _)]
+    }
+  }
+
+  /**
+   * A `<mat-table>` element.
+   */
+  class MatTableElement extends HTML::Element {
+    MatTableElement() {
+      getName() = "mat-table"
+    }
+
+    /** Gets the data flow node corresponding to the `[dataSource]` attribute. */
+    DataFlow::Node getDataSourceNode() {
+      result = getAttributeValueAsNode(getAttributeByName("[dataSource]"))
+    }
+
+    /**
+     * Gets an element of form `<mat-cell *matCellDef="let rowBinding">` in this table.
+     */
+    HTML::Element getATableCell(string rowBinding) {
+      result.getName() = "mat-cell" and
+      result.getParent+() = this and
+      rowBinding = result.getAttributeByName("*matCellDef").getValue().regexpCapture(" *let +(\\w+).*", 1)
+    }
+
+    /** Gets a data flow node that refers to one of the rows from the data source. */
+    DataFlow::Node getARowRef() {
+      exists(string rowBinding |
+        result = getATableCell(rowBinding).getChild*().getAnAttribute().getCodeInAttribute().(TemplateTopLevel).getAVariableUse(rowBinding)
+      )
+    }
+  }
+
+  /**
+   * A taint step from `x -> y` in code of form:
+   * ```
+   * <mat-table [dataSource]="x">
+   *   <mat-cell *matCellDef="let y">
+   *     <foo [prop]="y"/>
+   *   </mat-cell>
+   * </mat-table>
+   * ```
+   */
+  private class MatTableTaintStep extends TaintTracking::AdditionalTaintStep {
+    MatTableElement table;
+
+    MatTableTaintStep() {
+      this = table.getDataSourceNode()
+    }
+
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      pred = this and
+      succ = table.getARowRef()
+    }
+  }
+
+  /** Like `MatTableTaintStep` but as a value-preserving load step. */
+  private class MatTableLoadStep extends PreCallGraphStep {
+    override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
+      exists(MatTableElement table |
+        pred = table.getDataSourceNode() and
+        succ = table.getARowRef() and
+        prop = DataFlow::PseudoProperties::arrayElement()
+      )
+    }
+  }
+
+  /** A taint step into the data array of a `MatTableDataSource` instance. */
+  private class MatTableDataSourceStep extends TaintTracking::AdditionalTaintStep, DataFlow::NewNode {
+    MatTableDataSourceStep() {
+      this = DataFlow::moduleMember("@angular/material/table", "MatTableDataSource").getAnInstantiation()
+    }
+
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      pred = [getArgument(0), getAPropertyWrite("data").getRhs()] and
       succ = this
     }
   }

From 00cd0644f02fd3ed0d7719ee580fabc9f869c498 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 18 Dec 2020 14:01:45 +0000
Subject: [PATCH 183/343] JS: Implement getAResponseDataNode

---
 javascript/ql/src/semmle/javascript/frameworks/Angular2.qll | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 6af647a817a..aee4f97cb7d 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -197,6 +197,10 @@ module Angular2 {
       or
       result = getOptionArgument(argumentOffset + 1, "body")
     }
+
+    override DataFlow::Node getAResponseDataNode(string responseType, boolean promise) {
+      result = this and responseType = "rxjs.observable" and promise = false
+    }
   }
 
   private string getInternalName(string name) {

From 44c5d36e837daf7d2b2f217c7f074676c16b8140 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 18 Dec 2020 14:17:03 +0000
Subject: [PATCH 184/343] JS: Simple RxJS model

---
 javascript/ql/src/javascript.qll              |  1 +
 .../src/semmle/javascript/frameworks/RxJS.qll | 74 +++++++++++++++++++
 2 files changed, 75 insertions(+)
 create mode 100644 javascript/ql/src/semmle/javascript/frameworks/RxJS.qll

diff --git a/javascript/ql/src/javascript.qll b/javascript/ql/src/javascript.qll
index 1bf3dd92156..9cc8e112b5b 100644
--- a/javascript/ql/src/javascript.qll
+++ b/javascript/ql/src/javascript.qll
@@ -98,6 +98,7 @@ import semmle.javascript.frameworks.PropertyProjection
 import semmle.javascript.frameworks.React
 import semmle.javascript.frameworks.ReactNative
 import semmle.javascript.frameworks.Request
+import semmle.javascript.frameworks.RxJS
 import semmle.javascript.frameworks.ServerLess
 import semmle.javascript.frameworks.ShellJS
 import semmle.javascript.frameworks.SystemCommandExecutors
diff --git a/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll b/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll
new file mode 100644
index 00000000000..ba09f7d087e
--- /dev/null
+++ b/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll
@@ -0,0 +1,74 @@
+/**
+ * Provides taint steps modeling flow through `rxjs` Observable objects.
+ */
+private import javascript
+
+/**
+ * A step `x -> y` in `x.subscribe(y => ...)`, modeling flow out of an rxjs Observable.
+ */
+private class RxJsSubscribeStep extends TaintTracking::AdditionalTaintStep, DataFlow::MethodCallNode {
+  RxJsSubscribeStep() {
+    getMethodName() = "subscribe"
+  }
+
+  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    pred = getReceiver() and
+    succ = getCallback(0).getParameter(0)
+  }
+}
+
+/**
+ * Holds if a tainted value sent into the given `pipe` should propagate to `arg`.
+ */
+private DataFlow::Node pipeInput(DataFlow::CallNode pipe) {
+  pipe = DataFlow::moduleMember("rxjs/operators", ["map", "filter"]).getACall() and
+  result = pipe.getCallback(0).getParameter(0)
+}
+
+/**
+ * Holds if a tainted value in `output` should propagate to the output of the given pipe.
+ */
+private DataFlow::Node pipeOutput(DataFlow::CallNode pipe) {
+  pipe = DataFlow::moduleMember("rxjs/operators", "map").getACall() and
+  result = pipe.getCallback(0).getReturnNode()
+  or
+  pipe = DataFlow::moduleMember("rxjs/operators", "filter").getACall() and
+  result = pipe.getCallback(0).getParameter(0)
+}
+
+/**
+ * Holds if `pipe` acts as the identity function for success values.
+ *
+ * We currently lack a data-flow node to represent its input/ouput so it must
+ * be special-cased.
+ */
+private predicate isIdentityPipe(DataFlow::CallNode pipe) {
+  pipe = DataFlow::moduleMember("rxjs/operators", "catchError").getACall()
+}
+
+/**
+ * A step in or out of the map callback in a call of form `x.pipe(map(y => ...))`.
+ */
+private class RxJsPipeMapStep extends TaintTracking::AdditionalTaintStep, DataFlow::MethodCallNode {
+  RxJsPipeMapStep() {
+    getMethodName() = "pipe"
+  }
+
+  override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+    pred = getReceiver() and
+    succ = pipeInput(getArgument(0).getALocalSource())
+    or
+    exists(int i |
+      pred = pipeOutput(getArgument(i).getALocalSource()) and
+      succ = pipeInput(getArgument(i + 1).getALocalSource())
+    )
+    or
+    pred = pipeOutput(getLastArgument().getALocalSource()) and
+    succ = this
+    or
+    // Handle a common case where the last step is `catchError`.
+    isIdentityPipe(getLastArgument().getALocalSource()) and
+    pred = pipeOutput(getArgument(getNumArgument() - 2)) and
+    succ = this
+  }
+}

From 1b4a4ea2fa82c12f79da3718162d682faa7c6915 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 11 Dec 2020 21:59:58 +0000
Subject: [PATCH 185/343] JS: Bump extractor version string

---
 javascript/extractor/src/com/semmle/js/extractor/Main.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/Main.java b/javascript/extractor/src/com/semmle/js/extractor/Main.java
index 769f6dc7907..fa4c138842a 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/Main.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/Main.java
@@ -43,7 +43,7 @@ public class Main {
    * A version identifier that should be updated every time the extractor changes in such a way that
    * it may produce different tuples for the same file under the same {@link ExtractorConfig}.
    */
-  public static final String EXTRACTOR_VERSION = "2020-12-05";
+  public static final String EXTRACTOR_VERSION = "2020-12-11";
 
   public static final Pattern NEWLINE = Pattern.compile("\n");
 

From c5f2c04f16563f669361aca74e487123fafd54d0 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 14 Jan 2021 15:05:42 +0000
Subject: [PATCH 186/343] JS: Add upgrade script

---
 .../src/semmlecode.javascript.dbscheme.stats  |   172 +
 .../old.dbscheme                              |  1194 +
 .../semmlecode.javascript.dbscheme            |  1206 +
 .../semmlecode.javascript.dbscheme.stats      | 31622 ++++++++++++++++
 .../toplevel_parent_xml_node.ql               |    32 +
 .../upgrade.properties                        |     4 +
 6 files changed, 34230 insertions(+)
 create mode 100644 javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/old.dbscheme
 create mode 100644 javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/semmlecode.javascript.dbscheme
 create mode 100644 javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/semmlecode.javascript.dbscheme.stats
 create mode 100644 javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql
 create mode 100644 javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/upgrade.properties

diff --git a/javascript/ql/src/semmlecode.javascript.dbscheme.stats b/javascript/ql/src/semmlecode.javascript.dbscheme.stats
index 460e30f82dc..f5520c0a9e2 100644
--- a/javascript/ql/src/semmlecode.javascript.dbscheme.stats
+++ b/javascript/ql/src/semmlecode.javascript.dbscheme.stats
@@ -50,6 +50,10 @@
 <v>3</v>
 </e>
 <e>
+<k>@angular_template_toplevel</k>
+<v>100</v>
+</e>
+<e>
 <k>@stmt</k>
 <v>1096691</v>
 </e>
@@ -434,6 +438,10 @@
 <v>1</v>
 </e>
 <e>
+<k>@angular_pipe_ref</k>
+<v>100</v>
+</e>
+<e>
 <k>@preinc_expr</k>
 <v>1792</v>
 </e>
@@ -9264,6 +9272,170 @@
 <dependencies/>
 </relation>
 <relation>
+<name>toplevel_parent_xml_node</name>
+<cardinality>43</cardinality>
+<columnsizes>
+<e>
+<k>toplevel</k>
+<v>43</v>
+</e>
+<e>
+<k>xmlnode</k>
+<v>43</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>toplevel</src>
+<trg>xmlnode</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>43</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>xmlnode</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>43</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xml_element_parent_expression</name>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>xmlnode</k>
+<v>1</v>
+</e>
+<e>
+<k>expression</k>
+<v>1</v>
+</e>
+<e>
+<k>index</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>xmlnode</src>
+<trg>expression</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>xmlnode</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>expression</src>
+<trg>xmlnode</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>expression</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>xmlnode</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>expression</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
 <name>is_nodejs</name>
 <cardinality>12</cardinality>
 <columnsizes>
diff --git a/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/old.dbscheme b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/old.dbscheme
new file mode 100644
index 00000000000..c8859f3725d
--- /dev/null
+++ b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/old.dbscheme
@@ -0,0 +1,1194 @@
+/*** Standard fragments ***/
+
+/** Files and folders **/
+
+@location = @location_default;
+ 
+locations_default(unique int id: @location_default,
+          int file: @file ref,
+          int beginLine: int ref,
+          int beginColumn: int ref,
+          int endLine: int ref,
+          int endColumn: int ref
+         );
+ 
+@sourceline = @locatable;
+ 
+numlines(int element_id: @sourceline ref,
+         int num_lines: int ref,
+         int num_code: int ref,
+         int num_comment: int ref
+        );
+ 
+ 
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(unique int id: @file,
+      varchar(900) name: string ref,
+      varchar(900) simple: string ref,
+      varchar(900) ext: string ref,
+      int fromSource: int ref);
+ 
+folders(unique int id: @folder,
+        varchar(900) name: string ref,
+        varchar(900) simple: string ref);
+ 
+ 
+@container = @folder | @file ;
+ 
+ 
+containerparent(int parent: @container ref,
+                unique int child: @container ref);
+
+/** Duplicate code **/
+
+duplicateCode(
+  unique int id : @duplication,
+  varchar(900) relativePath : string ref,
+  int equivClass : int ref);
+ 
+similarCode(
+  unique int id : @similarity,
+  varchar(900) relativePath : string ref,
+  int equivClass : int ref);
+ 
+@duplication_or_similarity = @duplication | @similarity;
+ 
+tokens(
+  int id : @duplication_or_similarity ref,
+  int offset : int ref,
+  int beginLine : int ref,
+  int beginColumn : int ref,
+  int endLine : int ref,
+  int endColumn : int ref);
+
+/** External data **/
+
+externalData(
+  int id : @externalDataElement,
+  varchar(900) path : string ref,
+  int column: int ref,
+  varchar(900) value : string ref
+);
+ 
+snapshotDate(unique date snapshotDate : date ref);
+ 
+sourceLocationPrefix(varchar(900) prefix : string ref);
+
+/** Version control data **/
+
+svnentries(
+  int id : @svnentry,
+  varchar(500) revision : string ref,
+  varchar(500) author : string ref,
+  date revisionDate : date ref,
+  int changeSize : int ref
+);
+ 
+svnaffectedfiles(
+  int id : @svnentry ref,
+  int file : @file ref,
+  varchar(500) action : string ref
+);
+ 
+svnentrymsg(
+  int id : @svnentry ref,
+  varchar(500) message : string ref
+);
+ 
+svnchurn(
+  int commit : @svnentry ref,
+  int file : @file ref,
+  int addedLines : int ref,
+  int deletedLines : int ref
+);
+
+
+/*** JavaScript-specific part ***/
+
+filetype(
+  int file: @file ref,
+  string filetype: string ref
+)
+
+// top-level code fragments
+toplevels (unique int id: @toplevel,
+           int kind: int ref);
+
+is_externs (int toplevel: @toplevel ref);
+
+case @toplevel.kind of
+   0 = @script
+|  1 = @inline_script
+|  2 = @event_handler
+|  3 = @javascript_url;
+
+is_module (int tl: @toplevel ref);
+is_nodejs (int tl: @toplevel ref);
+is_es2015_module (int tl: @toplevel ref);
+is_closure_module (int tl: @toplevel ref);
+
+// statements
+#keyset[parent, idx]
+stmts (unique int id: @stmt, 
+       int kind: int ref,
+       int parent: @stmt_parent ref, 
+       int idx: int ref,
+       varchar(900) tostring: string ref);
+
+stmt_containers (unique int stmt: @stmt ref,
+       int container: @stmt_container ref);
+       
+jump_targets (unique int jump: @stmt ref,
+       int target: @stmt ref);
+
+@stmt_parent = @stmt | @toplevel | @function_expr | @arrow_function_expr;
+@stmt_container = @toplevel | @function | @namespace_declaration | @external_module_declaration | @global_augmentation_declaration;
+
+case @stmt.kind of
+   0 = @empty_stmt
+|  1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @labeled_stmt
+|  5 = @break_stmt
+|  6 = @continue_stmt
+|  7 = @with_stmt
+|  8 = @switch_stmt
+|  9 = @return_stmt
+| 10 = @throw_stmt
+| 11 = @try_stmt
+| 12 = @while_stmt
+| 13 = @do_while_stmt
+| 14 = @for_stmt
+| 15 = @for_in_stmt
+| 16 = @debugger_stmt
+| 17 = @function_decl_stmt
+| 18 = @var_decl_stmt
+| 19 = @case
+| 20 = @catch_clause
+| 21 = @for_of_stmt
+| 22 = @const_decl_stmt
+| 23 = @let_stmt
+| 24 = @legacy_let_stmt
+| 25 = @for_each_stmt
+| 26 = @class_decl_stmt
+| 27 = @import_declaration
+| 28 = @export_all_declaration
+| 29 = @export_default_declaration
+| 30 = @export_named_declaration
+| 31 = @namespace_declaration
+| 32 = @import_equals_declaration
+| 33 = @export_assign_declaration
+| 34 = @interface_declaration
+| 35 = @type_alias_declaration
+| 36 = @enum_declaration
+| 37 = @external_module_declaration
+| 38 = @export_as_namespace_declaration
+| 39 = @global_augmentation_declaration
+;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @let_stmt | @legacy_let_stmt;
+
+@export_declaration = @export_all_declaration | @export_default_declaration | @export_named_declaration;
+
+@namespace_definition = @namespace_declaration | @enum_declaration;
+@type_definition = @class_definition | @interface_declaration | @enum_declaration | @type_alias_declaration | @enum_member;
+
+is_instantiated(unique int decl: @namespace_declaration ref);
+
+@declarable_node = @decl_stmt | @namespace_declaration | @class_decl_stmt | @function_decl_stmt | @enum_declaration | @external_module_declaration | @global_augmentation_declaration | @field;
+has_declare_keyword(unique int stmt: @declarable_node ref);
+
+is_for_await_of(unique int forof: @for_of_stmt ref);
+
+// expressions
+#keyset[parent, idx]
+exprs (unique int id: @expr,
+       int kind: int ref,
+       int parent: @expr_parent ref,
+       int idx: int ref,
+       varchar(900) tostring: string ref);
+
+literals (varchar(900) value: string ref,
+       varchar(900) raw: string ref,
+       unique int expr: @expr_or_type ref);
+       
+enclosing_stmt (unique int expr: @expr_or_type ref,
+       int stmt: @stmt ref);
+
+expr_containers (unique int expr: @expr_or_type ref,
+       int container: @stmt_container ref);
+
+array_size (unique int ae: @arraylike ref,
+       int sz: int ref);
+
+is_delegating (int yield: @yield_expr ref);
+
+@expr_or_stmt = @expr | @stmt;
+@expr_or_type = @expr | @typeexpr;
+@expr_parent = @expr_or_stmt | @property | @function_typeexpr;
+@arraylike = @array_expr | @array_pattern;
+@type_annotation = @typeexpr | @jsdoc_type_expr;
+@node_in_stmt_container = @cfg_node | @type_annotation | @toplevel;
+
+case @expr.kind of
+   0 = @label
+|  1 = @null_literal
+|  2 = @boolean_literal
+|  3 = @number_literal
+|  4 = @string_literal
+|  5 = @regexp_literal
+|  6 = @this_expr
+|  7 = @array_expr
+|  8 = @obj_expr
+|  9 = @function_expr
+| 10 = @seq_expr
+| 11 = @conditional_expr
+| 12 = @new_expr
+| 13 = @call_expr
+| 14 = @dot_expr
+| 15 = @index_expr
+| 16 = @neg_expr
+| 17 = @plus_expr
+| 18 = @log_not_expr
+| 19 = @bit_not_expr
+| 20 = @typeof_expr
+| 21 = @void_expr
+| 22 = @delete_expr
+| 23 = @eq_expr
+| 24 = @neq_expr
+| 25 = @eqq_expr
+| 26 = @neqq_expr
+| 27 = @lt_expr
+| 28 = @le_expr
+| 29 = @gt_expr
+| 30 = @ge_expr
+| 31 = @lshift_expr
+| 32 = @rshift_expr
+| 33 = @urshift_expr
+| 34 = @add_expr
+| 35 = @sub_expr
+| 36 = @mul_expr
+| 37 = @div_expr
+| 38 = @mod_expr
+| 39 = @bitor_expr
+| 40 = @xor_expr
+| 41 = @bitand_expr
+| 42 = @in_expr
+| 43 = @instanceof_expr
+| 44 = @logand_expr
+| 45 = @logor_expr
+| 47 = @assign_expr
+| 48 = @assign_add_expr
+| 49 = @assign_sub_expr
+| 50 = @assign_mul_expr
+| 51 = @assign_div_expr
+| 52 = @assign_mod_expr
+| 53 = @assign_lshift_expr
+| 54 = @assign_rshift_expr
+| 55 = @assign_urshift_expr
+| 56 = @assign_or_expr
+| 57 = @assign_xor_expr
+| 58 = @assign_and_expr
+| 59 = @preinc_expr
+| 60 = @postinc_expr
+| 61 = @predec_expr
+| 62 = @postdec_expr
+| 63 = @par_expr
+| 64 = @var_declarator
+| 65 = @arrow_function_expr
+| 66 = @spread_element
+| 67 = @array_pattern
+| 68 = @object_pattern
+| 69 = @yield_expr
+| 70 = @tagged_template_expr
+| 71 = @template_literal
+| 72 = @template_element
+| 73 = @array_comprehension_expr
+| 74 = @generator_expr
+| 75 = @for_in_comprehension_block
+| 76 = @for_of_comprehension_block
+| 77 = @legacy_letexpr
+| 78 = @var_decl
+| 79 = @proper_varaccess
+| 80 = @class_expr
+| 81 = @super_expr
+| 82 = @newtarget_expr
+| 83 = @named_import_specifier
+| 84 = @import_default_specifier
+| 85 = @import_namespace_specifier
+| 86 = @named_export_specifier
+| 87 = @exp_expr
+| 88 = @assign_exp_expr
+| 89 = @jsx_element
+| 90 = @jsx_qualified_name
+| 91 = @jsx_empty_expr
+| 92 = @await_expr
+| 93 = @function_sent_expr
+| 94 = @decorator
+| 95 = @export_default_specifier
+| 96 = @export_namespace_specifier
+| 97 = @bind_expr
+| 98 = @external_module_reference
+| 99 = @dynamic_import
+| 100 = @expression_with_type_arguments
+| 101 = @prefix_type_assertion
+| 102 = @as_type_assertion
+| 103 = @export_varaccess
+| 104 = @decorator_list
+| 105 = @non_null_assertion
+| 106 = @bigint_literal
+| 107 = @nullishcoalescing_expr
+| 108 = @e4x_xml_anyname
+| 109 = @e4x_xml_static_attribute_selector
+| 110 = @e4x_xml_dynamic_attribute_selector
+| 111 = @e4x_xml_filter_expression
+| 112 = @e4x_xml_static_qualident
+| 113 = @e4x_xml_dynamic_qualident
+| 114 = @e4x_xml_dotdotexpr
+| 115 = @import_meta_expr
+| 116 = @assignlogandexpr
+| 117 = @assignlogorexpr
+| 118 = @assignnullishcoalescingexpr
+;
+
+@varaccess = @proper_varaccess | @export_varaccess;
+@varref = @var_decl | @varaccess;
+
+@identifier = @label | @varref | @type_identifier;
+
+@literal = @null_literal | @boolean_literal | @number_literal | @string_literal | @regexp_literal | @bigint_literal;
+
+@propaccess = @dot_expr | @index_expr;
+
+@invokeexpr = @new_expr | @call_expr;
+
+@unaryexpr = @neg_expr | @plus_expr | @log_not_expr | @bit_not_expr | @typeof_expr | @void_expr | @delete_expr | @spread_element;
+
+@equality_test = @eq_expr | @neq_expr | @eqq_expr | @neqq_expr;
+
+@comparison = @equality_test | @lt_expr | @le_expr | @gt_expr | @ge_expr;
+
+@binaryexpr = @comparison | @lshift_expr | @rshift_expr | @urshift_expr | @add_expr | @sub_expr | @mul_expr | @div_expr | @mod_expr | @exp_expr | @bitor_expr | @xor_expr | @bitand_expr | @in_expr | @instanceof_expr | @logand_expr | @logor_expr | @nullishcoalescing_expr;
+
+@assignment = @assign_expr | @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr | @assign_mod_expr | @assign_exp_expr | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr | @assign_or_expr | @assign_xor_expr | @assign_and_expr | @assignlogandexpr | @assignlogorexpr | @assignnullishcoalescingexpr;
+
+@updateexpr = @preinc_expr | @postinc_expr | @predec_expr | @postdec_expr;
+
+@pattern = @varref | @array_pattern | @object_pattern;
+
+@comprehension_expr = @array_comprehension_expr | @generator_expr;
+
+@comprehension_block = @for_in_comprehension_block | @for_of_comprehension_block;
+
+@import_specifier = @named_import_specifier | @import_default_specifier | @import_namespace_specifier;
+
+@exportspecifier = @named_export_specifier | @export_default_specifier | @export_namespace_specifier;
+
+@import_or_export_declaration = @import_declaration | @export_declaration;
+
+@type_assertion = @as_type_assertion | @prefix_type_assertion;
+
+@class_definition = @class_decl_stmt | @class_expr;
+@interface_definition = @interface_declaration | @interface_typeexpr;
+@class_or_interface = @class_definition | @interface_definition;
+
+@lexical_decl = @var_decl | @type_decl;
+@lexical_access = @varaccess | @local_type_access | @local_var_type_access | @local_namespace_access;
+@lexical_ref = @lexical_decl | @lexical_access;
+
+@e4x_xml_attribute_selector = @e4x_xml_static_attribute_selector | @e4x_xml_dynamic_attribute_selector;
+@e4x_xml_qualident = @e4x_xml_static_qualident | @e4x_xml_dynamic_qualident;
+
+// scopes
+scopes (unique int id: @scope,
+        int kind: int ref);
+
+case @scope.kind of
+   0 = @global_scope
+|  1 = @function_scope
+|  2 = @catch_scope
+|  3 = @module_scope
+|  4 = @block_scope
+|  5 = @for_scope
+|  6 = @for_in_scope // for-of scopes work the same as for-in scopes
+|  7 = @comprehension_block_scope
+|  8 = @class_expr_scope
+|  9 = @namespace_scope
+| 10 = @class_decl_scope
+| 11 = @interface_scope
+| 12 = @type_alias_scope
+| 13 = @mapped_type_scope
+| 14 = @enum_scope
+| 15 = @external_module_scope
+| 16 = @conditional_type_scope;
+
+scopenodes (unique int node: @ast_node ref,
+            int scope: @scope ref);
+            
+scopenesting (unique int inner: @scope ref,
+              int outer: @scope ref);
+
+// functions
+@function = @function_decl_stmt | @function_expr | @arrow_function_expr;
+
+@parameterized = @function | @catch_clause;
+@type_parameterized = @function | @class_or_interface | @type_alias_declaration | @mapped_typeexpr | @infer_typeexpr;
+
+is_generator (int fun: @function ref);
+has_rest_parameter (int fun: @function ref);
+is_async (int fun: @function ref);
+
+// variables and lexically scoped type names
+#keyset[scope, name]
+variables (unique int id: @variable,
+           varchar(900) name: string ref,
+           int scope: @scope ref);
+
+#keyset[scope, name]
+local_type_names (unique int id: @local_type_name,
+                  varchar(900) name: string ref,
+                  int scope: @scope ref);
+
+#keyset[scope, name]
+local_namespace_names (unique int id: @local_namespace_name,
+                       varchar(900) name: string ref,
+                       int scope: @scope ref);
+
+is_arguments_object (int id: @variable ref);
+
+@lexical_name = @variable | @local_type_name | @local_namespace_name;
+
+@bind_id = @varaccess | @local_var_type_access;
+bind (unique int id: @bind_id ref,
+      int decl: @variable ref);
+
+decl (unique int id: @var_decl ref,
+      int decl: @variable ref);
+
+@typebind_id = @local_type_access | @export_varaccess;
+typebind (unique int id: @typebind_id ref,
+          int decl: @local_type_name ref);
+
+@typedecl_id = @type_decl | @var_decl;
+typedecl (unique int id: @typedecl_id ref,
+          int decl: @local_type_name ref);
+
+namespacedecl (unique int id: @var_decl ref,
+               int decl: @local_namespace_name ref);
+
+@namespacebind_id = @local_namespace_access | @export_varaccess;
+namespacebind (unique int id: @namespacebind_id ref,
+               int decl: @local_namespace_name ref);
+
+
+// properties in object literals, property patterns in object patterns, and method declarations in classes
+#keyset[parent, index]
+properties (unique int id: @property,
+            int parent: @property_parent ref,
+            int index: int ref,
+            int kind: int ref,
+            varchar(900) tostring: string ref);
+
+case @property.kind of
+  0 = @value_property
+| 1 = @property_getter
+| 2 = @property_setter
+| 3 = @jsx_attribute
+| 4 = @function_call_signature
+| 5 = @constructor_call_signature
+| 6 = @index_signature
+| 7 = @enum_member
+| 8 = @proper_field
+| 9 = @parameter_field
+;
+
+@property_parent = @obj_expr | @object_pattern | @class_definition | @jsx_element | @interface_definition | @enum_declaration;
+@property_accessor = @property_getter | @property_setter;
+@call_signature = @function_call_signature | @constructor_call_signature;
+@field = @proper_field | @parameter_field;
+@field_or_vardeclarator = @field | @var_declarator;
+
+is_computed (int id: @property ref);
+is_method   (int id: @property ref);
+is_static   (int id: @property ref);
+is_abstract_member (int id: @property ref);
+is_const_enum (int id: @enum_declaration ref);
+is_abstract_class (int id: @class_decl_stmt ref);
+
+has_public_keyword (int id: @property ref);
+has_private_keyword (int id: @property ref);
+has_protected_keyword (int id: @property ref);
+has_readonly_keyword (int id: @property ref);
+has_type_keyword (int id: @import_or_export_declaration ref);
+is_optional_member (int id: @property ref);
+has_definite_assignment_assertion (int id: @field_or_vardeclarator ref);
+is_optional_parameter_declaration (unique int parameter: @pattern ref);
+
+#keyset[constructor, param_index]
+parameter_fields(
+  unique int field: @parameter_field ref,
+  int constructor: @function_expr ref,
+  int param_index: int ref
+);
+
+// types
+#keyset[parent, idx]
+typeexprs (
+  unique int id: @typeexpr,
+  int kind: int ref,
+  int parent: @typeexpr_parent ref,
+  int idx: int ref,
+  varchar(900) tostring: string ref
+);
+
+case @typeexpr.kind of
+  0 = @local_type_access
+| 1 = @type_decl
+| 2 = @keyword_typeexpr
+| 3 = @string_literal_typeexpr
+| 4 = @number_literal_typeexpr
+| 5 = @boolean_literal_typeexpr
+| 6 = @array_typeexpr
+| 7 = @union_typeexpr
+| 8 = @indexed_access_typeexpr
+| 9 = @intersection_typeexpr
+| 10 = @parenthesized_typeexpr
+| 11 = @tuple_typeexpr
+| 12 = @keyof_typeexpr
+| 13 = @qualified_type_access
+| 14 = @generic_typeexpr
+| 15 = @type_label
+| 16 = @typeof_typeexpr
+| 17 = @local_var_type_access
+| 18 = @qualified_var_type_access
+| 19 = @this_var_type_access
+| 20 = @predicate_typeexpr
+| 21 = @interface_typeexpr
+| 22 = @type_parameter
+| 23 = @plain_function_typeexpr
+| 24 = @constructor_typeexpr
+| 25 = @local_namespace_access
+| 26 = @qualified_namespace_access
+| 27 = @mapped_typeexpr
+| 28 = @conditional_typeexpr
+| 29 = @infer_typeexpr
+| 30 = @import_type_access
+| 31 = @import_namespace_access
+| 32 = @import_var_type_access
+| 33 = @optional_typeexpr
+| 34 = @rest_typeexpr
+| 35 = @bigint_literal_typeexpr
+| 36 = @readonly_typeexpr
+| 37 = @template_literal_typeexpr
+;
+
+@typeref = @typeaccess | @type_decl;
+@type_identifier = @type_decl | @local_type_access | @type_label | @local_var_type_access | @local_namespace_access;
+@typeexpr_parent = @expr | @stmt | @property | @typeexpr;
+@literal_typeexpr = @string_literal_typeexpr | @number_literal_typeexpr | @boolean_literal_typeexpr | @bigint_literal_typeexpr;
+@typeaccess = @local_type_access | @qualified_type_access | @import_type_access;
+@vartypeaccess = @local_var_type_access | @qualified_var_type_access | @this_var_type_access | @import_var_type_access;
+@namespace_access = @local_namespace_access | @qualified_namespace_access | @import_namespace_access;
+@import_typeexpr = @import_type_access | @import_namespace_access | @import_var_type_access;
+
+@function_typeexpr = @plain_function_typeexpr | @constructor_typeexpr;
+
+// types
+types (
+  unique int id: @type,
+  int kind: int ref,
+  varchar(900) tostring: string ref
+);
+
+#keyset[parent, idx]
+type_child (
+  int child: @type ref,
+  int parent: @type ref,
+  int idx: int ref
+);
+
+case @type.kind of
+  0 = @any_type
+| 1 = @string_type
+| 2 = @number_type
+| 3 = @union_type
+| 4 = @true_type
+| 5 = @false_type
+| 6 = @type_reference
+| 7 = @object_type
+| 8 = @canonical_type_variable_type
+| 9 = @typeof_type
+| 10 = @void_type
+| 11 = @undefined_type
+| 12 = @null_type
+| 13 = @never_type
+| 14 = @plain_symbol_type
+| 15 = @unique_symbol_type
+| 16 = @objectkeyword_type
+| 17 = @intersection_type
+| 18 = @tuple_type
+| 19 = @lexical_type_variable_type
+| 20 = @this_type
+| 21 = @number_literal_type
+| 22 = @string_literal_type
+| 23 = @unknown_type
+| 24 = @bigint_type
+| 25 = @bigint_literal_type
+;
+
+@boolean_literal_type = @true_type | @false_type;
+@symbol_type = @plain_symbol_type | @unique_symbol_type;
+@union_or_intersection_type = @union_type | @intersection_type;
+@typevariable_type = @canonical_type_variable_type | @lexical_type_variable_type;
+
+has_asserts_keyword(int node: @predicate_typeexpr ref);
+
+@typed_ast_node = @expr | @typeexpr | @function;
+ast_node_type(
+  unique int node: @typed_ast_node ref, 
+  int typ: @type ref);
+
+declared_function_signature(
+  unique int node: @function ref,
+  int sig: @signature_type ref
+);
+
+invoke_expr_signature(
+  unique int node: @invokeexpr ref,
+  int sig: @signature_type ref
+);
+
+invoke_expr_overload_index(
+  unique int node: @invokeexpr ref,
+  int index: int ref
+);
+
+symbols (
+  unique int id: @symbol,
+  int kind: int ref,
+  varchar(900) name: string ref
+);
+
+symbol_parent (
+  unique int symbol: @symbol ref,
+  int parent: @symbol ref
+);
+
+symbol_module (
+  int symbol: @symbol ref,
+  varchar(900) moduleName: string ref
+);
+
+symbol_global (
+  int symbol: @symbol ref,
+  varchar(900) globalName: string ref
+);
+
+case @symbol.kind of
+  0 = @root_symbol
+| 1 = @member_symbol
+| 2 = @other_symbol
+;
+
+@type_with_symbol = @type_reference | @typevariable_type | @typeof_type | @unique_symbol_type;
+@ast_node_with_symbol = @type_definition | @namespace_definition | @toplevel | @typeaccess | @namespace_access | @var_decl | @function | @invokeexpr | @import_declaration | @external_module_reference;
+
+ast_node_symbol(
+  unique int node: @ast_node_with_symbol ref,
+  int symbol: @symbol ref);
+
+type_symbol(
+  unique int typ: @type_with_symbol ref,
+  int symbol: @symbol ref);
+
+#keyset[typ, name]
+type_property(
+  int typ: @type ref,
+  varchar(900) name: string ref,
+  int propertyType: @type ref);
+
+type_alias(
+  unique int aliasType: @type ref,
+  int underlyingType: @type ref);
+
+@literal_type = @string_literal_type | @number_literal_type | @boolean_literal_type | @bigint_literal_type;
+@type_with_literal_value = @string_literal_type | @number_literal_type | @bigint_literal_type;
+type_literal_value(
+  unique int typ: @type_with_literal_value ref,
+  varchar(900) value: string ref);
+
+signature_types (
+  unique int id: @signature_type,
+  int kind: int ref,
+  varchar(900) tostring: string ref,
+  int type_parameters: int ref,
+  int required_params: int ref
+);
+
+signature_rest_parameter(
+  unique int sig: @signature_type ref,
+  int rest_param_arra_type: @type ref
+);
+
+case @signature_type.kind of
+  0 = @function_signature_type
+| 1 = @constructor_signature_type
+;
+
+#keyset[typ, kind, index]
+type_contains_signature (
+  int typ: @type ref,
+  int kind: int ref,  // constructor/call/index
+  int index: int ref, // ordering of overloaded signatures
+  int sig: @signature_type ref
+);
+
+#keyset[parent, index]
+signature_contains_type (
+  int child: @type ref,
+  int parent: @signature_type ref,
+  int index: int ref
+);
+
+#keyset[sig, index]
+signature_parameter_name (
+  int sig: @signature_type ref,
+  int index: int ref,
+  varchar(900) name: string ref
+);
+
+number_index_type (
+  unique int baseType: @type ref,
+  int propertyType: @type ref
+);
+
+string_index_type (
+  unique int baseType: @type ref,
+  int propertyType: @type ref
+);
+
+base_type_names(
+  int typeName: @symbol ref,
+  int baseTypeName: @symbol ref
+);
+
+self_types(
+  int typeName: @symbol ref,
+  int selfType: @type_reference ref
+);
+
+tuple_type_min_length(
+  unique int typ: @type ref,
+  int minLength: int ref
+);
+
+tuple_type_rest(
+  unique int typ: @type ref
+);
+
+// comments
+comments (unique int id: @comment,
+          int kind: int ref,
+          int toplevel: @toplevel ref,
+          varchar(900) text: string ref,
+          varchar(900) tostring: string ref);
+
+case @comment.kind of
+  0 = @slashslash_comment
+| 1 = @slashstar_comment
+| 2 = @doc_comment
+| 3 = @html_comment_start
+| 4 = @htmlcommentend;
+
+@html_comment = @html_comment_start | @htmlcommentend;
+@line_comment = @slashslash_comment | @html_comment;
+@block_comment = @slashstar_comment | @doc_comment;
+
+// source lines
+lines (unique int id: @line,
+       int toplevel: @toplevel ref,
+       varchar(900) text: string ref,
+       varchar(2) terminator: string ref);
+indentation (int file: @file ref,
+            int lineno: int ref,
+            varchar(1) indentChar: string ref,
+            int indentDepth: int ref);
+
+// JavaScript parse errors
+js_parse_errors (unique int id: @js_parse_error,
+        int toplevel: @toplevel ref,
+        varchar(900) message: string ref,
+        varchar(900) line: string ref);
+  
+// regular expressions
+#keyset[parent, idx]
+regexpterm (unique int id: @regexpterm,
+        int kind: int ref,
+        int parent: @regexpparent ref,
+        int idx: int ref,
+        varchar(900) tostring: string ref);
+        
+@regexpparent = @regexpterm | @regexp_literal | @string_literal;
+
+case @regexpterm.kind of
+   0 = @regexp_alt
+|  1 = @regexp_seq
+|  2 = @regexp_caret
+|  3 = @regexp_dollar
+|  4 = @regexp_wordboundary
+|  5 = @regexp_nonwordboundary
+|  6 = @regexp_positive_lookahead
+|  7 = @regexp_negative_lookahead
+|  8 = @regexp_star
+|  9 = @regexp_plus
+| 10 = @regexp_opt
+| 11 = @regexp_range
+| 12 = @regexp_dot
+| 13 = @regexp_group
+| 14 = @regexp_normal_constant
+| 15 = @regexp_hex_escape
+| 16 = @regexp_unicode_escape
+| 17 = @regexp_dec_escape
+| 18 = @regexp_oct_escape
+| 19 = @regexp_ctrl_escape
+| 20 = @regexp_char_class_escape
+| 21 = @regexp_id_escape
+| 22 = @regexp_backref
+| 23 = @regexp_char_class
+| 24 = @regexp_char_range
+| 25 = @regexp_positive_lookbehind
+| 26 = @regexp_negative_lookbehind
+| 27 = @regexp_unicode_property_escape;
+
+regexp_parse_errors (unique int id: @regexp_parse_error,
+    int regexp: @regexpterm ref,
+    varchar(900) message: string ref);
+
+@regexp_quantifier = @regexp_star | @regexp_plus | @regexp_opt | @regexp_range;
+@regexp_escape = @regexp_char_escape | @regexp_char_class_escape | @regexp_unicode_property_escape;
+@regexp_char_escape = @regexp_hex_escape | @regexp_unicode_escape | @regexp_dec_escape | @regexp_oct_escape | @regexp_ctrl_escape | @regexp_id_escape;
+@regexp_constant = @regexp_normal_constant | @regexp_char_escape;
+@regexp_lookahead = @regexp_positive_lookahead | @regexp_negative_lookahead;
+@regexp_lookbehind = @regexp_positive_lookbehind | @regexp_negative_lookbehind;
+@regexp_subpattern = @regexp_lookahead | @regexp_lookbehind;
+@regexp_anchor = @regexp_dollar | @regexp_caret;
+
+is_greedy (int id: @regexp_quantifier ref);
+range_quantifier_lower_bound (unique int id: @regexp_range ref, int lo: int ref);
+range_quantifier_upper_bound (unique int id: @regexp_range ref, int hi: int ref);
+is_capture (unique int id: @regexp_group ref, int number: int ref);
+is_named_capture (unique int id: @regexp_group ref, string name: string ref);
+is_inverted (int id: @regexp_char_class ref);
+regexp_const_value (unique int id: @regexp_constant ref, varchar(1) value: string ref);
+char_class_escape (unique int id: @regexp_char_class_escape ref, varchar(1) value: string ref);
+backref (unique int id: @regexp_backref ref, int value: int ref);
+named_backref (unique int id: @regexp_backref ref, string name: string ref);
+unicode_property_escapename (unique int id: @regexp_unicode_property_escape ref, string name: string ref);
+unicode_property_escapevalue (unique int id: @regexp_unicode_property_escape ref, string value: string ref);
+
+// tokens
+#keyset[toplevel, idx]
+tokeninfo (unique int id: @token,
+    int kind: int ref,
+    int toplevel: @toplevel ref,
+    int idx: int ref,
+    varchar(900) value: string ref);
+
+case @token.kind of
+  0 = @token_eof
+| 1 = @token_null_literal
+| 2 = @token_boolean_literal
+| 3 = @token_numeric_literal
+| 4 = @token_string_literal
+| 5 = @token_regular_expression
+| 6 = @token_identifier
+| 7 = @token_keyword
+| 8 = @token_punctuator;
+
+// associate comments with the token immediately following them (which may be EOF)
+next_token (int comment: @comment ref, int token: @token ref);
+
+// JSON
+#keyset[parent, idx]
+json (unique int id: @json_value,
+      int kind: int ref,
+      int parent: @json_parent ref,
+      int idx: int ref,
+      varchar(900) tostring: string ref);
+
+json_literals (varchar(900) value: string ref,
+      varchar(900) raw: string ref,
+      unique int expr: @json_value ref);
+
+json_properties (int obj: @json_object ref,
+      varchar(900) property: string ref,
+      int value: @json_value ref);
+
+json_errors (unique int id: @json_parse_error,
+      varchar(900) message: string ref);
+
+json_locations(unique int locatable: @json_locatable ref,
+      int location: @location_default ref);
+
+case @json_value.kind of
+  0 = @json_null
+| 1 = @json_boolean
+| 2 = @json_number
+| 3 = @json_string
+| 4 = @json_array
+| 5 = @json_object;
+
+@json_parent = @json_object | @json_array | @file;
+
+@json_locatable = @json_value | @json_parse_error;
+
+// locations
+@ast_node = @toplevel | @stmt | @expr | @property | @typeexpr;
+
+@locatable = @file 
+    | @ast_node
+    | @comment
+    | @line
+    | @js_parse_error | @regexp_parse_error
+    | @regexpterm
+    | @json_locatable
+    | @token
+    | @cfg_node
+    | @jsdoc | @jsdoc_type_expr | @jsdoc_tag
+    | @yaml_locatable
+    | @xmllocatable
+    | @configLocatable;
+
+hasLocation (unique int locatable: @locatable ref,
+    int location: @location ref);
+
+// CFG
+entry_cfg_node (unique int id: @entry_node, int container: @stmt_container ref);
+exit_cfg_node (unique int id: @exit_node, int container: @stmt_container ref);
+guard_node (unique int id: @guard_node, int kind: int ref, int test: @expr ref);
+case @guard_node.kind of
+  0 = @falsy_guard
+| 1 = @truthy_guard;
+@condition_guard = @falsy_guard | @truthy_guard;
+
+@synthetic_cfg_node = @entry_node | @exit_node | @guard_node;
+@cfg_node = @synthetic_cfg_node | @expr_parent;
+
+successor (int pred: @cfg_node ref, int succ: @cfg_node ref);
+
+// JSDoc comments
+jsdoc (unique int id: @jsdoc, varchar(900) description: string ref, int comment: @comment ref);
+#keyset[parent, idx]
+jsdoc_tags (unique int id: @jsdoc_tag, varchar(900) title: string ref,
+            int parent: @jsdoc ref, int idx: int ref, varchar(900) tostring: string ref);
+jsdoc_tag_descriptions (unique int tag: @jsdoc_tag ref, varchar(900) text: string ref);
+jsdoc_tag_names (unique int tag: @jsdoc_tag ref, varchar(900) text: string ref);
+
+#keyset[parent, idx]
+jsdoc_type_exprs (unique int id: @jsdoc_type_expr,
+                  int kind: int ref,
+                  int parent: @jsdoc_type_expr_parent ref,
+                  int idx: int ref,
+                  varchar(900) tostring: string ref);
+case @jsdoc_type_expr.kind of
+    0 = @jsdoc_any_type_expr
+|   1 = @jsdoc_null_type_expr
+|   2 = @jsdoc_undefined_type_expr
+|   3 = @jsdoc_unknown_type_expr
+|   4 = @jsdoc_void_type_expr
+|   5 = @jsdoc_named_type_expr
+|   6 = @jsdoc_applied_type_expr
+|   7 = @jsdoc_nullable_type_expr
+|   8 = @jsdoc_non_nullable_type_expr
+|   9 = @jsdoc_record_type_expr
+|  10 = @jsdoc_array_type_expr
+|  11 = @jsdoc_union_type_expr
+|  12 = @jsdoc_function_type_expr
+|  13 = @jsdoc_optional_type_expr
+|  14 = @jsdoc_rest_type_expr
+;
+
+#keyset[id, idx]
+jsdoc_record_field_name (int id: @jsdoc_record_type_expr ref, int idx: int ref, varchar(900) name: string ref);
+jsdoc_prefix_qualifier (int id: @jsdoc_type_expr ref);
+jsdoc_has_new_parameter (int fn: @jsdoc_function_type_expr ref);
+
+@jsdoc_type_expr_parent = @jsdoc_type_expr | @jsdoc_tag;
+
+jsdoc_errors (unique int id: @jsdoc_error, int tag: @jsdoc_tag ref, varchar(900) message: string ref, varchar(900) tostring: string ref);
+
+// YAML
+#keyset[parent, idx]
+yaml (unique int id: @yaml_node,
+      int kind: int ref,
+      int parent: @yaml_node_parent ref,
+      int idx: int ref,
+      varchar(900) tag: string ref,
+      varchar(900) tostring: string ref);
+
+case @yaml_node.kind of
+  0 = @yaml_scalar_node
+| 1 = @yaml_mapping_node
+| 2 = @yaml_sequence_node
+| 3 = @yaml_alias_node
+;
+
+@yaml_collection_node = @yaml_mapping_node | @yaml_sequence_node;
+
+@yaml_node_parent = @yaml_collection_node | @file;
+
+yaml_anchors (unique int node: @yaml_node ref,
+              varchar(900) anchor: string ref);
+
+yaml_aliases (unique int alias: @yaml_alias_node ref,
+              varchar(900) target: string ref);
+
+yaml_scalars (unique int scalar: @yaml_scalar_node ref,
+              int style: int ref,
+              varchar(900) value: string ref);
+
+yaml_errors (unique int id: @yaml_error,
+             varchar(900) message: string ref);
+
+yaml_locations(unique int locatable: @yaml_locatable ref,
+             int location: @location_default ref);
+
+@yaml_locatable = @yaml_node | @yaml_error;
+
+/* XML Files */
+
+xmlEncoding(
+  unique int id: @file ref,
+  varchar(900) encoding: string ref
+);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  varchar(900) root: string ref,
+  varchar(900) publicId: string ref,
+  varchar(900) systemId: string ref,
+  int fileid: @file ref
+);
+
+xmlElements(
+  unique int id: @xmlelement,
+  varchar(900) name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref
+);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  varchar(900) name: string ref,
+  varchar(3600) value: string ref,
+  int idx: int ref,
+  int fileid: @file ref
+);
+
+xmlNs(
+  int id: @xmlnamespace,
+  varchar(900) prefixName: string ref,
+  varchar(900) URI: string ref,
+  int fileid: @file ref
+);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref
+);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  varchar(3600) text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref
+);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  varchar(3600) text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+@dataflownode = @expr | @function_decl_stmt | @class_decl_stmt | @namespace_declaration | @enum_declaration | @property;
+
+@optionalchainable = @call_expr | @propaccess;
+
+isOptionalChaining(int id: @optionalchainable ref);
+
+/*
+ * configuration files with key value pairs
+ */
+
+configs(
+  unique int id: @config
+);
+
+configNames(
+  unique int id: @configName,
+  int config: @config ref,
+  string name: string ref
+);
+
+configValues(
+  unique int id: @configValue,
+  int config: @config ref,
+  string value: string ref
+);
+
+configLocations(
+  int locatable: @configLocatable ref,
+  int location: @location_default ref
+);
+
+@configLocatable = @config | @configName | @configValue;
+
+/**
+ * The time taken for the extraction of a file.
+ * This table contains non-deterministic content.
+ *
+ * The sum of the `time` column for each (`file`, `timerKind`) pair
+ * is the total time taken for extraction of `file`.  The `extractionPhase`
+ * column provides a granular view of the extraction time of the file.
+ */
+extraction_time(
+   int file : @file ref,
+   // see `com.semmle.js.extractor.ExtractionMetrics.ExtractionPhase`.
+   int extractionPhase: int ref,
+   // 0 for the elapsed CPU time in nanoseconds, 1 for the elapsed wallclock time in nanoseconds
+   int timerKind: int ref,
+   float time: float ref
+)
+
+/**
+ * Non-timing related data for the extraction of a single file.
+ * This table contains non-deterministic content.
+ */
+extraction_data(
+   int file : @file ref,
+   // the absolute path to the cache file
+   varchar(900) cacheFile: string ref,
+   boolean fromCache: boolean ref,
+   int length: int ref
+)
diff --git a/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/semmlecode.javascript.dbscheme b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/semmlecode.javascript.dbscheme
new file mode 100644
index 00000000000..930898a4fe0
--- /dev/null
+++ b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/semmlecode.javascript.dbscheme
@@ -0,0 +1,1206 @@
+/*** Standard fragments ***/
+
+/** Files and folders **/
+
+@location = @location_default;
+ 
+locations_default(unique int id: @location_default,
+          int file: @file ref,
+          int beginLine: int ref,
+          int beginColumn: int ref,
+          int endLine: int ref,
+          int endColumn: int ref
+         );
+ 
+@sourceline = @locatable;
+ 
+numlines(int element_id: @sourceline ref,
+         int num_lines: int ref,
+         int num_code: int ref,
+         int num_comment: int ref
+        );
+ 
+ 
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(unique int id: @file,
+      varchar(900) name: string ref,
+      varchar(900) simple: string ref,
+      varchar(900) ext: string ref,
+      int fromSource: int ref);
+ 
+folders(unique int id: @folder,
+        varchar(900) name: string ref,
+        varchar(900) simple: string ref);
+ 
+ 
+@container = @folder | @file ;
+ 
+ 
+containerparent(int parent: @container ref,
+                unique int child: @container ref);
+
+/** Duplicate code **/
+
+duplicateCode(
+  unique int id : @duplication,
+  varchar(900) relativePath : string ref,
+  int equivClass : int ref);
+ 
+similarCode(
+  unique int id : @similarity,
+  varchar(900) relativePath : string ref,
+  int equivClass : int ref);
+ 
+@duplication_or_similarity = @duplication | @similarity;
+ 
+tokens(
+  int id : @duplication_or_similarity ref,
+  int offset : int ref,
+  int beginLine : int ref,
+  int beginColumn : int ref,
+  int endLine : int ref,
+  int endColumn : int ref);
+
+/** External data **/
+
+externalData(
+  int id : @externalDataElement,
+  varchar(900) path : string ref,
+  int column: int ref,
+  varchar(900) value : string ref
+);
+ 
+snapshotDate(unique date snapshotDate : date ref);
+ 
+sourceLocationPrefix(varchar(900) prefix : string ref);
+
+/** Version control data **/
+
+svnentries(
+  int id : @svnentry,
+  varchar(500) revision : string ref,
+  varchar(500) author : string ref,
+  date revisionDate : date ref,
+  int changeSize : int ref
+);
+ 
+svnaffectedfiles(
+  int id : @svnentry ref,
+  int file : @file ref,
+  varchar(500) action : string ref
+);
+ 
+svnentrymsg(
+  int id : @svnentry ref,
+  varchar(500) message : string ref
+);
+ 
+svnchurn(
+  int commit : @svnentry ref,
+  int file : @file ref,
+  int addedLines : int ref,
+  int deletedLines : int ref
+);
+
+
+/*** JavaScript-specific part ***/
+
+filetype(
+  int file: @file ref,
+  string filetype: string ref
+)
+
+// top-level code fragments
+toplevels (unique int id: @toplevel,
+           int kind: int ref);
+
+is_externs (int toplevel: @toplevel ref);
+
+case @toplevel.kind of
+   0 = @script
+|  1 = @inline_script
+|  2 = @event_handler
+|  3 = @javascript_url
+|  4 = @angular_template_toplevel;
+
+is_module (int tl: @toplevel ref);
+is_nodejs (int tl: @toplevel ref);
+is_es2015_module (int tl: @toplevel ref);
+is_closure_module (int tl: @toplevel ref);
+
+@xml_node_with_code = @xmlelement | @xmlattribute;
+toplevel_parent_xml_node(
+  unique int toplevel: @toplevel ref,
+  int xmlnode: @xml_node_with_code ref);
+
+xml_element_parent_expression(
+  unique int xmlnode: @xmlelement ref,
+  int expression: @expr ref,
+  int index: int ref);
+
+// statements
+#keyset[parent, idx]
+stmts (unique int id: @stmt, 
+       int kind: int ref,
+       int parent: @stmt_parent ref, 
+       int idx: int ref,
+       varchar(900) tostring: string ref);
+
+stmt_containers (unique int stmt: @stmt ref,
+       int container: @stmt_container ref);
+       
+jump_targets (unique int jump: @stmt ref,
+       int target: @stmt ref);
+
+@stmt_parent = @stmt | @toplevel | @function_expr | @arrow_function_expr;
+@stmt_container = @toplevel | @function | @namespace_declaration | @external_module_declaration | @global_augmentation_declaration;
+
+case @stmt.kind of
+   0 = @empty_stmt
+|  1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @labeled_stmt
+|  5 = @break_stmt
+|  6 = @continue_stmt
+|  7 = @with_stmt
+|  8 = @switch_stmt
+|  9 = @return_stmt
+| 10 = @throw_stmt
+| 11 = @try_stmt
+| 12 = @while_stmt
+| 13 = @do_while_stmt
+| 14 = @for_stmt
+| 15 = @for_in_stmt
+| 16 = @debugger_stmt
+| 17 = @function_decl_stmt
+| 18 = @var_decl_stmt
+| 19 = @case
+| 20 = @catch_clause
+| 21 = @for_of_stmt
+| 22 = @const_decl_stmt
+| 23 = @let_stmt
+| 24 = @legacy_let_stmt
+| 25 = @for_each_stmt
+| 26 = @class_decl_stmt
+| 27 = @import_declaration
+| 28 = @export_all_declaration
+| 29 = @export_default_declaration
+| 30 = @export_named_declaration
+| 31 = @namespace_declaration
+| 32 = @import_equals_declaration
+| 33 = @export_assign_declaration
+| 34 = @interface_declaration
+| 35 = @type_alias_declaration
+| 36 = @enum_declaration
+| 37 = @external_module_declaration
+| 38 = @export_as_namespace_declaration
+| 39 = @global_augmentation_declaration
+;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @let_stmt | @legacy_let_stmt;
+
+@export_declaration = @export_all_declaration | @export_default_declaration | @export_named_declaration;
+
+@namespace_definition = @namespace_declaration | @enum_declaration;
+@type_definition = @class_definition | @interface_declaration | @enum_declaration | @type_alias_declaration | @enum_member;
+
+is_instantiated(unique int decl: @namespace_declaration ref);
+
+@declarable_node = @decl_stmt | @namespace_declaration | @class_decl_stmt | @function_decl_stmt | @enum_declaration | @external_module_declaration | @global_augmentation_declaration | @field;
+has_declare_keyword(unique int stmt: @declarable_node ref);
+
+is_for_await_of(unique int forof: @for_of_stmt ref);
+
+// expressions
+#keyset[parent, idx]
+exprs (unique int id: @expr,
+       int kind: int ref,
+       int parent: @expr_parent ref,
+       int idx: int ref,
+       varchar(900) tostring: string ref);
+
+literals (varchar(900) value: string ref,
+       varchar(900) raw: string ref,
+       unique int expr: @expr_or_type ref);
+       
+enclosing_stmt (unique int expr: @expr_or_type ref,
+       int stmt: @stmt ref);
+
+expr_containers (unique int expr: @expr_or_type ref,
+       int container: @stmt_container ref);
+
+array_size (unique int ae: @arraylike ref,
+       int sz: int ref);
+
+is_delegating (int yield: @yield_expr ref);
+
+@expr_or_stmt = @expr | @stmt;
+@expr_or_type = @expr | @typeexpr;
+@expr_parent = @expr_or_stmt | @property | @function_typeexpr;
+@arraylike = @array_expr | @array_pattern;
+@type_annotation = @typeexpr | @jsdoc_type_expr;
+@node_in_stmt_container = @cfg_node | @type_annotation | @toplevel;
+
+case @expr.kind of
+   0 = @label
+|  1 = @null_literal
+|  2 = @boolean_literal
+|  3 = @number_literal
+|  4 = @string_literal
+|  5 = @regexp_literal
+|  6 = @this_expr
+|  7 = @array_expr
+|  8 = @obj_expr
+|  9 = @function_expr
+| 10 = @seq_expr
+| 11 = @conditional_expr
+| 12 = @new_expr
+| 13 = @call_expr
+| 14 = @dot_expr
+| 15 = @index_expr
+| 16 = @neg_expr
+| 17 = @plus_expr
+| 18 = @log_not_expr
+| 19 = @bit_not_expr
+| 20 = @typeof_expr
+| 21 = @void_expr
+| 22 = @delete_expr
+| 23 = @eq_expr
+| 24 = @neq_expr
+| 25 = @eqq_expr
+| 26 = @neqq_expr
+| 27 = @lt_expr
+| 28 = @le_expr
+| 29 = @gt_expr
+| 30 = @ge_expr
+| 31 = @lshift_expr
+| 32 = @rshift_expr
+| 33 = @urshift_expr
+| 34 = @add_expr
+| 35 = @sub_expr
+| 36 = @mul_expr
+| 37 = @div_expr
+| 38 = @mod_expr
+| 39 = @bitor_expr
+| 40 = @xor_expr
+| 41 = @bitand_expr
+| 42 = @in_expr
+| 43 = @instanceof_expr
+| 44 = @logand_expr
+| 45 = @logor_expr
+| 47 = @assign_expr
+| 48 = @assign_add_expr
+| 49 = @assign_sub_expr
+| 50 = @assign_mul_expr
+| 51 = @assign_div_expr
+| 52 = @assign_mod_expr
+| 53 = @assign_lshift_expr
+| 54 = @assign_rshift_expr
+| 55 = @assign_urshift_expr
+| 56 = @assign_or_expr
+| 57 = @assign_xor_expr
+| 58 = @assign_and_expr
+| 59 = @preinc_expr
+| 60 = @postinc_expr
+| 61 = @predec_expr
+| 62 = @postdec_expr
+| 63 = @par_expr
+| 64 = @var_declarator
+| 65 = @arrow_function_expr
+| 66 = @spread_element
+| 67 = @array_pattern
+| 68 = @object_pattern
+| 69 = @yield_expr
+| 70 = @tagged_template_expr
+| 71 = @template_literal
+| 72 = @template_element
+| 73 = @array_comprehension_expr
+| 74 = @generator_expr
+| 75 = @for_in_comprehension_block
+| 76 = @for_of_comprehension_block
+| 77 = @legacy_letexpr
+| 78 = @var_decl
+| 79 = @proper_varaccess
+| 80 = @class_expr
+| 81 = @super_expr
+| 82 = @newtarget_expr
+| 83 = @named_import_specifier
+| 84 = @import_default_specifier
+| 85 = @import_namespace_specifier
+| 86 = @named_export_specifier
+| 87 = @exp_expr
+| 88 = @assign_exp_expr
+| 89 = @jsx_element
+| 90 = @jsx_qualified_name
+| 91 = @jsx_empty_expr
+| 92 = @await_expr
+| 93 = @function_sent_expr
+| 94 = @decorator
+| 95 = @export_default_specifier
+| 96 = @export_namespace_specifier
+| 97 = @bind_expr
+| 98 = @external_module_reference
+| 99 = @dynamic_import
+| 100 = @expression_with_type_arguments
+| 101 = @prefix_type_assertion
+| 102 = @as_type_assertion
+| 103 = @export_varaccess
+| 104 = @decorator_list
+| 105 = @non_null_assertion
+| 106 = @bigint_literal
+| 107 = @nullishcoalescing_expr
+| 108 = @e4x_xml_anyname
+| 109 = @e4x_xml_static_attribute_selector
+| 110 = @e4x_xml_dynamic_attribute_selector
+| 111 = @e4x_xml_filter_expression
+| 112 = @e4x_xml_static_qualident
+| 113 = @e4x_xml_dynamic_qualident
+| 114 = @e4x_xml_dotdotexpr
+| 115 = @import_meta_expr
+| 116 = @assignlogandexpr
+| 117 = @assignlogorexpr
+| 118 = @assignnullishcoalescingexpr
+| 119 = @angular_pipe_ref
+;
+
+@varaccess = @proper_varaccess | @export_varaccess;
+@varref = @var_decl | @varaccess;
+
+@identifier = @label | @varref | @type_identifier;
+
+@literal = @null_literal | @boolean_literal | @number_literal | @string_literal | @regexp_literal | @bigint_literal;
+
+@propaccess = @dot_expr | @index_expr;
+
+@invokeexpr = @new_expr | @call_expr;
+
+@unaryexpr = @neg_expr | @plus_expr | @log_not_expr | @bit_not_expr | @typeof_expr | @void_expr | @delete_expr | @spread_element;
+
+@equality_test = @eq_expr | @neq_expr | @eqq_expr | @neqq_expr;
+
+@comparison = @equality_test | @lt_expr | @le_expr | @gt_expr | @ge_expr;
+
+@binaryexpr = @comparison | @lshift_expr | @rshift_expr | @urshift_expr | @add_expr | @sub_expr | @mul_expr | @div_expr | @mod_expr | @exp_expr | @bitor_expr | @xor_expr | @bitand_expr | @in_expr | @instanceof_expr | @logand_expr | @logor_expr | @nullishcoalescing_expr;
+
+@assignment = @assign_expr | @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr | @assign_mod_expr | @assign_exp_expr | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr | @assign_or_expr | @assign_xor_expr | @assign_and_expr | @assignlogandexpr | @assignlogorexpr | @assignnullishcoalescingexpr;
+
+@updateexpr = @preinc_expr | @postinc_expr | @predec_expr | @postdec_expr;
+
+@pattern = @varref | @array_pattern | @object_pattern;
+
+@comprehension_expr = @array_comprehension_expr | @generator_expr;
+
+@comprehension_block = @for_in_comprehension_block | @for_of_comprehension_block;
+
+@import_specifier = @named_import_specifier | @import_default_specifier | @import_namespace_specifier;
+
+@exportspecifier = @named_export_specifier | @export_default_specifier | @export_namespace_specifier;
+
+@import_or_export_declaration = @import_declaration | @export_declaration;
+
+@type_assertion = @as_type_assertion | @prefix_type_assertion;
+
+@class_definition = @class_decl_stmt | @class_expr;
+@interface_definition = @interface_declaration | @interface_typeexpr;
+@class_or_interface = @class_definition | @interface_definition;
+
+@lexical_decl = @var_decl | @type_decl;
+@lexical_access = @varaccess | @local_type_access | @local_var_type_access | @local_namespace_access;
+@lexical_ref = @lexical_decl | @lexical_access;
+
+@e4x_xml_attribute_selector = @e4x_xml_static_attribute_selector | @e4x_xml_dynamic_attribute_selector;
+@e4x_xml_qualident = @e4x_xml_static_qualident | @e4x_xml_dynamic_qualident;
+
+// scopes
+scopes (unique int id: @scope,
+        int kind: int ref);
+
+case @scope.kind of
+   0 = @global_scope
+|  1 = @function_scope
+|  2 = @catch_scope
+|  3 = @module_scope
+|  4 = @block_scope
+|  5 = @for_scope
+|  6 = @for_in_scope // for-of scopes work the same as for-in scopes
+|  7 = @comprehension_block_scope
+|  8 = @class_expr_scope
+|  9 = @namespace_scope
+| 10 = @class_decl_scope
+| 11 = @interface_scope
+| 12 = @type_alias_scope
+| 13 = @mapped_type_scope
+| 14 = @enum_scope
+| 15 = @external_module_scope
+| 16 = @conditional_type_scope;
+
+scopenodes (unique int node: @ast_node ref,
+            int scope: @scope ref);
+            
+scopenesting (unique int inner: @scope ref,
+              int outer: @scope ref);
+
+// functions
+@function = @function_decl_stmt | @function_expr | @arrow_function_expr;
+
+@parameterized = @function | @catch_clause;
+@type_parameterized = @function | @class_or_interface | @type_alias_declaration | @mapped_typeexpr | @infer_typeexpr;
+
+is_generator (int fun: @function ref);
+has_rest_parameter (int fun: @function ref);
+is_async (int fun: @function ref);
+
+// variables and lexically scoped type names
+#keyset[scope, name]
+variables (unique int id: @variable,
+           varchar(900) name: string ref,
+           int scope: @scope ref);
+
+#keyset[scope, name]
+local_type_names (unique int id: @local_type_name,
+                  varchar(900) name: string ref,
+                  int scope: @scope ref);
+
+#keyset[scope, name]
+local_namespace_names (unique int id: @local_namespace_name,
+                       varchar(900) name: string ref,
+                       int scope: @scope ref);
+
+is_arguments_object (int id: @variable ref);
+
+@lexical_name = @variable | @local_type_name | @local_namespace_name;
+
+@bind_id = @varaccess | @local_var_type_access;
+bind (unique int id: @bind_id ref,
+      int decl: @variable ref);
+
+decl (unique int id: @var_decl ref,
+      int decl: @variable ref);
+
+@typebind_id = @local_type_access | @export_varaccess;
+typebind (unique int id: @typebind_id ref,
+          int decl: @local_type_name ref);
+
+@typedecl_id = @type_decl | @var_decl;
+typedecl (unique int id: @typedecl_id ref,
+          int decl: @local_type_name ref);
+
+namespacedecl (unique int id: @var_decl ref,
+               int decl: @local_namespace_name ref);
+
+@namespacebind_id = @local_namespace_access | @export_varaccess;
+namespacebind (unique int id: @namespacebind_id ref,
+               int decl: @local_namespace_name ref);
+
+
+// properties in object literals, property patterns in object patterns, and method declarations in classes
+#keyset[parent, index]
+properties (unique int id: @property,
+            int parent: @property_parent ref,
+            int index: int ref,
+            int kind: int ref,
+            varchar(900) tostring: string ref);
+
+case @property.kind of
+  0 = @value_property
+| 1 = @property_getter
+| 2 = @property_setter
+| 3 = @jsx_attribute
+| 4 = @function_call_signature
+| 5 = @constructor_call_signature
+| 6 = @index_signature
+| 7 = @enum_member
+| 8 = @proper_field
+| 9 = @parameter_field
+;
+
+@property_parent = @obj_expr | @object_pattern | @class_definition | @jsx_element | @interface_definition | @enum_declaration;
+@property_accessor = @property_getter | @property_setter;
+@call_signature = @function_call_signature | @constructor_call_signature;
+@field = @proper_field | @parameter_field;
+@field_or_vardeclarator = @field | @var_declarator;
+
+is_computed (int id: @property ref);
+is_method   (int id: @property ref);
+is_static   (int id: @property ref);
+is_abstract_member (int id: @property ref);
+is_const_enum (int id: @enum_declaration ref);
+is_abstract_class (int id: @class_decl_stmt ref);
+
+has_public_keyword (int id: @property ref);
+has_private_keyword (int id: @property ref);
+has_protected_keyword (int id: @property ref);
+has_readonly_keyword (int id: @property ref);
+has_type_keyword (int id: @import_or_export_declaration ref);
+is_optional_member (int id: @property ref);
+has_definite_assignment_assertion (int id: @field_or_vardeclarator ref);
+is_optional_parameter_declaration (unique int parameter: @pattern ref);
+
+#keyset[constructor, param_index]
+parameter_fields(
+  unique int field: @parameter_field ref,
+  int constructor: @function_expr ref,
+  int param_index: int ref
+);
+
+// types
+#keyset[parent, idx]
+typeexprs (
+  unique int id: @typeexpr,
+  int kind: int ref,
+  int parent: @typeexpr_parent ref,
+  int idx: int ref,
+  varchar(900) tostring: string ref
+);
+
+case @typeexpr.kind of
+  0 = @local_type_access
+| 1 = @type_decl
+| 2 = @keyword_typeexpr
+| 3 = @string_literal_typeexpr
+| 4 = @number_literal_typeexpr
+| 5 = @boolean_literal_typeexpr
+| 6 = @array_typeexpr
+| 7 = @union_typeexpr
+| 8 = @indexed_access_typeexpr
+| 9 = @intersection_typeexpr
+| 10 = @parenthesized_typeexpr
+| 11 = @tuple_typeexpr
+| 12 = @keyof_typeexpr
+| 13 = @qualified_type_access
+| 14 = @generic_typeexpr
+| 15 = @type_label
+| 16 = @typeof_typeexpr
+| 17 = @local_var_type_access
+| 18 = @qualified_var_type_access
+| 19 = @this_var_type_access
+| 20 = @predicate_typeexpr
+| 21 = @interface_typeexpr
+| 22 = @type_parameter
+| 23 = @plain_function_typeexpr
+| 24 = @constructor_typeexpr
+| 25 = @local_namespace_access
+| 26 = @qualified_namespace_access
+| 27 = @mapped_typeexpr
+| 28 = @conditional_typeexpr
+| 29 = @infer_typeexpr
+| 30 = @import_type_access
+| 31 = @import_namespace_access
+| 32 = @import_var_type_access
+| 33 = @optional_typeexpr
+| 34 = @rest_typeexpr
+| 35 = @bigint_literal_typeexpr
+| 36 = @readonly_typeexpr
+| 37 = @template_literal_typeexpr
+;
+
+@typeref = @typeaccess | @type_decl;
+@type_identifier = @type_decl | @local_type_access | @type_label | @local_var_type_access | @local_namespace_access;
+@typeexpr_parent = @expr | @stmt | @property | @typeexpr;
+@literal_typeexpr = @string_literal_typeexpr | @number_literal_typeexpr | @boolean_literal_typeexpr | @bigint_literal_typeexpr;
+@typeaccess = @local_type_access | @qualified_type_access | @import_type_access;
+@vartypeaccess = @local_var_type_access | @qualified_var_type_access | @this_var_type_access | @import_var_type_access;
+@namespace_access = @local_namespace_access | @qualified_namespace_access | @import_namespace_access;
+@import_typeexpr = @import_type_access | @import_namespace_access | @import_var_type_access;
+
+@function_typeexpr = @plain_function_typeexpr | @constructor_typeexpr;
+
+// types
+types (
+  unique int id: @type,
+  int kind: int ref,
+  varchar(900) tostring: string ref
+);
+
+#keyset[parent, idx]
+type_child (
+  int child: @type ref,
+  int parent: @type ref,
+  int idx: int ref
+);
+
+case @type.kind of
+  0 = @any_type
+| 1 = @string_type
+| 2 = @number_type
+| 3 = @union_type
+| 4 = @true_type
+| 5 = @false_type
+| 6 = @type_reference
+| 7 = @object_type
+| 8 = @canonical_type_variable_type
+| 9 = @typeof_type
+| 10 = @void_type
+| 11 = @undefined_type
+| 12 = @null_type
+| 13 = @never_type
+| 14 = @plain_symbol_type
+| 15 = @unique_symbol_type
+| 16 = @objectkeyword_type
+| 17 = @intersection_type
+| 18 = @tuple_type
+| 19 = @lexical_type_variable_type
+| 20 = @this_type
+| 21 = @number_literal_type
+| 22 = @string_literal_type
+| 23 = @unknown_type
+| 24 = @bigint_type
+| 25 = @bigint_literal_type
+;
+
+@boolean_literal_type = @true_type | @false_type;
+@symbol_type = @plain_symbol_type | @unique_symbol_type;
+@union_or_intersection_type = @union_type | @intersection_type;
+@typevariable_type = @canonical_type_variable_type | @lexical_type_variable_type;
+
+has_asserts_keyword(int node: @predicate_typeexpr ref);
+
+@typed_ast_node = @expr | @typeexpr | @function;
+ast_node_type(
+  unique int node: @typed_ast_node ref, 
+  int typ: @type ref);
+
+declared_function_signature(
+  unique int node: @function ref,
+  int sig: @signature_type ref
+);
+
+invoke_expr_signature(
+  unique int node: @invokeexpr ref,
+  int sig: @signature_type ref
+);
+
+invoke_expr_overload_index(
+  unique int node: @invokeexpr ref,
+  int index: int ref
+);
+
+symbols (
+  unique int id: @symbol,
+  int kind: int ref,
+  varchar(900) name: string ref
+);
+
+symbol_parent (
+  unique int symbol: @symbol ref,
+  int parent: @symbol ref
+);
+
+symbol_module (
+  int symbol: @symbol ref,
+  varchar(900) moduleName: string ref
+);
+
+symbol_global (
+  int symbol: @symbol ref,
+  varchar(900) globalName: string ref
+);
+
+case @symbol.kind of
+  0 = @root_symbol
+| 1 = @member_symbol
+| 2 = @other_symbol
+;
+
+@type_with_symbol = @type_reference | @typevariable_type | @typeof_type | @unique_symbol_type;
+@ast_node_with_symbol = @type_definition | @namespace_definition | @toplevel | @typeaccess | @namespace_access | @var_decl | @function | @invokeexpr | @import_declaration | @external_module_reference;
+
+ast_node_symbol(
+  unique int node: @ast_node_with_symbol ref,
+  int symbol: @symbol ref);
+
+type_symbol(
+  unique int typ: @type_with_symbol ref,
+  int symbol: @symbol ref);
+
+#keyset[typ, name]
+type_property(
+  int typ: @type ref,
+  varchar(900) name: string ref,
+  int propertyType: @type ref);
+
+type_alias(
+  unique int aliasType: @type ref,
+  int underlyingType: @type ref);
+
+@literal_type = @string_literal_type | @number_literal_type | @boolean_literal_type | @bigint_literal_type;
+@type_with_literal_value = @string_literal_type | @number_literal_type | @bigint_literal_type;
+type_literal_value(
+  unique int typ: @type_with_literal_value ref,
+  varchar(900) value: string ref);
+
+signature_types (
+  unique int id: @signature_type,
+  int kind: int ref,
+  varchar(900) tostring: string ref,
+  int type_parameters: int ref,
+  int required_params: int ref
+);
+
+signature_rest_parameter(
+  unique int sig: @signature_type ref,
+  int rest_param_arra_type: @type ref
+);
+
+case @signature_type.kind of
+  0 = @function_signature_type
+| 1 = @constructor_signature_type
+;
+
+#keyset[typ, kind, index]
+type_contains_signature (
+  int typ: @type ref,
+  int kind: int ref,  // constructor/call/index
+  int index: int ref, // ordering of overloaded signatures
+  int sig: @signature_type ref
+);
+
+#keyset[parent, index]
+signature_contains_type (
+  int child: @type ref,
+  int parent: @signature_type ref,
+  int index: int ref
+);
+
+#keyset[sig, index]
+signature_parameter_name (
+  int sig: @signature_type ref,
+  int index: int ref,
+  varchar(900) name: string ref
+);
+
+number_index_type (
+  unique int baseType: @type ref,
+  int propertyType: @type ref
+);
+
+string_index_type (
+  unique int baseType: @type ref,
+  int propertyType: @type ref
+);
+
+base_type_names(
+  int typeName: @symbol ref,
+  int baseTypeName: @symbol ref
+);
+
+self_types(
+  int typeName: @symbol ref,
+  int selfType: @type_reference ref
+);
+
+tuple_type_min_length(
+  unique int typ: @type ref,
+  int minLength: int ref
+);
+
+tuple_type_rest(
+  unique int typ: @type ref
+);
+
+// comments
+comments (unique int id: @comment,
+          int kind: int ref,
+          int toplevel: @toplevel ref,
+          varchar(900) text: string ref,
+          varchar(900) tostring: string ref);
+
+case @comment.kind of
+  0 = @slashslash_comment
+| 1 = @slashstar_comment
+| 2 = @doc_comment
+| 3 = @html_comment_start
+| 4 = @htmlcommentend;
+
+@html_comment = @html_comment_start | @htmlcommentend;
+@line_comment = @slashslash_comment | @html_comment;
+@block_comment = @slashstar_comment | @doc_comment;
+
+// source lines
+lines (unique int id: @line,
+       int toplevel: @toplevel ref,
+       varchar(900) text: string ref,
+       varchar(2) terminator: string ref);
+indentation (int file: @file ref,
+            int lineno: int ref,
+            varchar(1) indentChar: string ref,
+            int indentDepth: int ref);
+
+// JavaScript parse errors
+js_parse_errors (unique int id: @js_parse_error,
+        int toplevel: @toplevel ref,
+        varchar(900) message: string ref,
+        varchar(900) line: string ref);
+  
+// regular expressions
+#keyset[parent, idx]
+regexpterm (unique int id: @regexpterm,
+        int kind: int ref,
+        int parent: @regexpparent ref,
+        int idx: int ref,
+        varchar(900) tostring: string ref);
+        
+@regexpparent = @regexpterm | @regexp_literal | @string_literal;
+
+case @regexpterm.kind of
+   0 = @regexp_alt
+|  1 = @regexp_seq
+|  2 = @regexp_caret
+|  3 = @regexp_dollar
+|  4 = @regexp_wordboundary
+|  5 = @regexp_nonwordboundary
+|  6 = @regexp_positive_lookahead
+|  7 = @regexp_negative_lookahead
+|  8 = @regexp_star
+|  9 = @regexp_plus
+| 10 = @regexp_opt
+| 11 = @regexp_range
+| 12 = @regexp_dot
+| 13 = @regexp_group
+| 14 = @regexp_normal_constant
+| 15 = @regexp_hex_escape
+| 16 = @regexp_unicode_escape
+| 17 = @regexp_dec_escape
+| 18 = @regexp_oct_escape
+| 19 = @regexp_ctrl_escape
+| 20 = @regexp_char_class_escape
+| 21 = @regexp_id_escape
+| 22 = @regexp_backref
+| 23 = @regexp_char_class
+| 24 = @regexp_char_range
+| 25 = @regexp_positive_lookbehind
+| 26 = @regexp_negative_lookbehind
+| 27 = @regexp_unicode_property_escape;
+
+regexp_parse_errors (unique int id: @regexp_parse_error,
+    int regexp: @regexpterm ref,
+    varchar(900) message: string ref);
+
+@regexp_quantifier = @regexp_star | @regexp_plus | @regexp_opt | @regexp_range;
+@regexp_escape = @regexp_char_escape | @regexp_char_class_escape | @regexp_unicode_property_escape;
+@regexp_char_escape = @regexp_hex_escape | @regexp_unicode_escape | @regexp_dec_escape | @regexp_oct_escape | @regexp_ctrl_escape | @regexp_id_escape;
+@regexp_constant = @regexp_normal_constant | @regexp_char_escape;
+@regexp_lookahead = @regexp_positive_lookahead | @regexp_negative_lookahead;
+@regexp_lookbehind = @regexp_positive_lookbehind | @regexp_negative_lookbehind;
+@regexp_subpattern = @regexp_lookahead | @regexp_lookbehind;
+@regexp_anchor = @regexp_dollar | @regexp_caret;
+
+is_greedy (int id: @regexp_quantifier ref);
+range_quantifier_lower_bound (unique int id: @regexp_range ref, int lo: int ref);
+range_quantifier_upper_bound (unique int id: @regexp_range ref, int hi: int ref);
+is_capture (unique int id: @regexp_group ref, int number: int ref);
+is_named_capture (unique int id: @regexp_group ref, string name: string ref);
+is_inverted (int id: @regexp_char_class ref);
+regexp_const_value (unique int id: @regexp_constant ref, varchar(1) value: string ref);
+char_class_escape (unique int id: @regexp_char_class_escape ref, varchar(1) value: string ref);
+backref (unique int id: @regexp_backref ref, int value: int ref);
+named_backref (unique int id: @regexp_backref ref, string name: string ref);
+unicode_property_escapename (unique int id: @regexp_unicode_property_escape ref, string name: string ref);
+unicode_property_escapevalue (unique int id: @regexp_unicode_property_escape ref, string value: string ref);
+
+// tokens
+#keyset[toplevel, idx]
+tokeninfo (unique int id: @token,
+    int kind: int ref,
+    int toplevel: @toplevel ref,
+    int idx: int ref,
+    varchar(900) value: string ref);
+
+case @token.kind of
+  0 = @token_eof
+| 1 = @token_null_literal
+| 2 = @token_boolean_literal
+| 3 = @token_numeric_literal
+| 4 = @token_string_literal
+| 5 = @token_regular_expression
+| 6 = @token_identifier
+| 7 = @token_keyword
+| 8 = @token_punctuator;
+
+// associate comments with the token immediately following them (which may be EOF)
+next_token (int comment: @comment ref, int token: @token ref);
+
+// JSON
+#keyset[parent, idx]
+json (unique int id: @json_value,
+      int kind: int ref,
+      int parent: @json_parent ref,
+      int idx: int ref,
+      varchar(900) tostring: string ref);
+
+json_literals (varchar(900) value: string ref,
+      varchar(900) raw: string ref,
+      unique int expr: @json_value ref);
+
+json_properties (int obj: @json_object ref,
+      varchar(900) property: string ref,
+      int value: @json_value ref);
+
+json_errors (unique int id: @json_parse_error,
+      varchar(900) message: string ref);
+
+json_locations(unique int locatable: @json_locatable ref,
+      int location: @location_default ref);
+
+case @json_value.kind of
+  0 = @json_null
+| 1 = @json_boolean
+| 2 = @json_number
+| 3 = @json_string
+| 4 = @json_array
+| 5 = @json_object;
+
+@json_parent = @json_object | @json_array | @file;
+
+@json_locatable = @json_value | @json_parse_error;
+
+// locations
+@ast_node = @toplevel | @stmt | @expr | @property | @typeexpr;
+
+@locatable = @file 
+    | @ast_node
+    | @comment
+    | @line
+    | @js_parse_error | @regexp_parse_error
+    | @regexpterm
+    | @json_locatable
+    | @token
+    | @cfg_node
+    | @jsdoc | @jsdoc_type_expr | @jsdoc_tag
+    | @yaml_locatable
+    | @xmllocatable
+    | @configLocatable;
+
+hasLocation (unique int locatable: @locatable ref,
+    int location: @location ref);
+
+// CFG
+entry_cfg_node (unique int id: @entry_node, int container: @stmt_container ref);
+exit_cfg_node (unique int id: @exit_node, int container: @stmt_container ref);
+guard_node (unique int id: @guard_node, int kind: int ref, int test: @expr ref);
+case @guard_node.kind of
+  0 = @falsy_guard
+| 1 = @truthy_guard;
+@condition_guard = @falsy_guard | @truthy_guard;
+
+@synthetic_cfg_node = @entry_node | @exit_node | @guard_node;
+@cfg_node = @synthetic_cfg_node | @expr_parent;
+
+successor (int pred: @cfg_node ref, int succ: @cfg_node ref);
+
+// JSDoc comments
+jsdoc (unique int id: @jsdoc, varchar(900) description: string ref, int comment: @comment ref);
+#keyset[parent, idx]
+jsdoc_tags (unique int id: @jsdoc_tag, varchar(900) title: string ref,
+            int parent: @jsdoc ref, int idx: int ref, varchar(900) tostring: string ref);
+jsdoc_tag_descriptions (unique int tag: @jsdoc_tag ref, varchar(900) text: string ref);
+jsdoc_tag_names (unique int tag: @jsdoc_tag ref, varchar(900) text: string ref);
+
+#keyset[parent, idx]
+jsdoc_type_exprs (unique int id: @jsdoc_type_expr,
+                  int kind: int ref,
+                  int parent: @jsdoc_type_expr_parent ref,
+                  int idx: int ref,
+                  varchar(900) tostring: string ref);
+case @jsdoc_type_expr.kind of
+    0 = @jsdoc_any_type_expr
+|   1 = @jsdoc_null_type_expr
+|   2 = @jsdoc_undefined_type_expr
+|   3 = @jsdoc_unknown_type_expr
+|   4 = @jsdoc_void_type_expr
+|   5 = @jsdoc_named_type_expr
+|   6 = @jsdoc_applied_type_expr
+|   7 = @jsdoc_nullable_type_expr
+|   8 = @jsdoc_non_nullable_type_expr
+|   9 = @jsdoc_record_type_expr
+|  10 = @jsdoc_array_type_expr
+|  11 = @jsdoc_union_type_expr
+|  12 = @jsdoc_function_type_expr
+|  13 = @jsdoc_optional_type_expr
+|  14 = @jsdoc_rest_type_expr
+;
+
+#keyset[id, idx]
+jsdoc_record_field_name (int id: @jsdoc_record_type_expr ref, int idx: int ref, varchar(900) name: string ref);
+jsdoc_prefix_qualifier (int id: @jsdoc_type_expr ref);
+jsdoc_has_new_parameter (int fn: @jsdoc_function_type_expr ref);
+
+@jsdoc_type_expr_parent = @jsdoc_type_expr | @jsdoc_tag;
+
+jsdoc_errors (unique int id: @jsdoc_error, int tag: @jsdoc_tag ref, varchar(900) message: string ref, varchar(900) tostring: string ref);
+
+// YAML
+#keyset[parent, idx]
+yaml (unique int id: @yaml_node,
+      int kind: int ref,
+      int parent: @yaml_node_parent ref,
+      int idx: int ref,
+      varchar(900) tag: string ref,
+      varchar(900) tostring: string ref);
+
+case @yaml_node.kind of
+  0 = @yaml_scalar_node
+| 1 = @yaml_mapping_node
+| 2 = @yaml_sequence_node
+| 3 = @yaml_alias_node
+;
+
+@yaml_collection_node = @yaml_mapping_node | @yaml_sequence_node;
+
+@yaml_node_parent = @yaml_collection_node | @file;
+
+yaml_anchors (unique int node: @yaml_node ref,
+              varchar(900) anchor: string ref);
+
+yaml_aliases (unique int alias: @yaml_alias_node ref,
+              varchar(900) target: string ref);
+
+yaml_scalars (unique int scalar: @yaml_scalar_node ref,
+              int style: int ref,
+              varchar(900) value: string ref);
+
+yaml_errors (unique int id: @yaml_error,
+             varchar(900) message: string ref);
+
+yaml_locations(unique int locatable: @yaml_locatable ref,
+             int location: @location_default ref);
+
+@yaml_locatable = @yaml_node | @yaml_error;
+
+/* XML Files */
+
+xmlEncoding(
+  unique int id: @file ref,
+  varchar(900) encoding: string ref
+);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  varchar(900) root: string ref,
+  varchar(900) publicId: string ref,
+  varchar(900) systemId: string ref,
+  int fileid: @file ref
+);
+
+xmlElements(
+  unique int id: @xmlelement,
+  varchar(900) name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref
+);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  varchar(900) name: string ref,
+  varchar(3600) value: string ref,
+  int idx: int ref,
+  int fileid: @file ref
+);
+
+xmlNs(
+  int id: @xmlnamespace,
+  varchar(900) prefixName: string ref,
+  varchar(900) URI: string ref,
+  int fileid: @file ref
+);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref
+);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  varchar(3600) text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref
+);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  varchar(3600) text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+@dataflownode = @expr | @function_decl_stmt | @class_decl_stmt | @namespace_declaration | @enum_declaration | @property;
+
+@optionalchainable = @call_expr | @propaccess;
+
+isOptionalChaining(int id: @optionalchainable ref);
+
+/*
+ * configuration files with key value pairs
+ */
+
+configs(
+  unique int id: @config
+);
+
+configNames(
+  unique int id: @configName,
+  int config: @config ref,
+  string name: string ref
+);
+
+configValues(
+  unique int id: @configValue,
+  int config: @config ref,
+  string value: string ref
+);
+
+configLocations(
+  int locatable: @configLocatable ref,
+  int location: @location_default ref
+);
+
+@configLocatable = @config | @configName | @configValue;
+
+/**
+ * The time taken for the extraction of a file.
+ * This table contains non-deterministic content.
+ *
+ * The sum of the `time` column for each (`file`, `timerKind`) pair
+ * is the total time taken for extraction of `file`.  The `extractionPhase`
+ * column provides a granular view of the extraction time of the file.
+ */
+extraction_time(
+   int file : @file ref,
+   // see `com.semmle.js.extractor.ExtractionMetrics.ExtractionPhase`.
+   int extractionPhase: int ref,
+   // 0 for the elapsed CPU time in nanoseconds, 1 for the elapsed wallclock time in nanoseconds
+   int timerKind: int ref,
+   float time: float ref
+)
+
+/**
+ * Non-timing related data for the extraction of a single file.
+ * This table contains non-deterministic content.
+ */
+extraction_data(
+   int file : @file ref,
+   // the absolute path to the cache file
+   varchar(900) cacheFile: string ref,
+   boolean fromCache: boolean ref,
+   int length: int ref
+)
diff --git a/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/semmlecode.javascript.dbscheme.stats b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/semmlecode.javascript.dbscheme.stats
new file mode 100644
index 00000000000..f5520c0a9e2
--- /dev/null
+++ b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/semmlecode.javascript.dbscheme.stats
@@ -0,0 +1,31622 @@
+<dbstats>
+<typesizes>
+<e>
+<k>@svnentry</k>
+<v>575525</v>
+</e>
+
+<e>
+<k>@location_default</k>
+<v>15664049</v>
+</e>
+<e>
+<k>@file</k>
+<v>6457</v>
+</e>
+<e>
+<k>@folder</k>
+<v>1590</v>
+</e>
+<e>
+<k>@duplication</k>
+<v>6210</v>
+</e>
+<e>
+<k>@similarity</k>
+<v>21595</v>
+</e>
+<e>
+<k>@externalDataElement</k>
+<v>950</v>
+</e>
+<e>
+<k>@toplevel</k>
+<v>5320</v>
+</e>
+<e>
+<k>@script</k>
+<v>5200</v>
+</e>
+<e>
+<k>@inline_script</k>
+<v>86</v>
+</e>
+<e>
+<k>@event_handler</k>
+<v>31</v>
+</e>
+<e>
+<k>@javascript_url</k>
+<v>3</v>
+</e>
+<e>
+<k>@angular_template_toplevel</k>
+<v>100</v>
+</e>
+<e>
+<k>@stmt</k>
+<v>1096691</v>
+</e>
+<e>
+<k>@empty_stmt</k>
+<v>1136</v>
+</e>
+<e>
+<k>@block_stmt</k>
+<v>204994</v>
+</e>
+<e>
+<k>@expr_stmt</k>
+<v>610340</v>
+</e>
+<e>
+<k>@if_stmt</k>
+<v>68214</v>
+</e>
+<e>
+<k>@labeled_stmt</k>
+<v>1378</v>
+</e>
+<e>
+<k>@break_stmt</k>
+<v>10149</v>
+</e>
+<e>
+<k>@continue_stmt</k>
+<v>1642</v>
+</e>
+<e>
+<k>@with_stmt</k>
+<v>4</v>
+</e>
+<e>
+<k>@switch_stmt</k>
+<v>1569</v>
+</e>
+<e>
+<k>@return_stmt</k>
+<v>48209</v>
+</e>
+<e>
+<k>@throw_stmt</k>
+<v>2305</v>
+</e>
+<e>
+<k>@try_stmt</k>
+<v>1316</v>
+</e>
+<e>
+<k>@while_stmt</k>
+<v>3120</v>
+</e>
+<e>
+<k>@do_while_stmt</k>
+<v>1471</v>
+</e>
+<e>
+<k>@for_stmt</k>
+<v>5385</v>
+</e>
+<e>
+<k>@for_in_stmt</k>
+<v>1315</v>
+</e>
+<e>
+<k>@debugger_stmt</k>
+<v>3</v>
+</e>
+<e>
+<k>@function_decl_stmt</k>
+<v>16771</v>
+</e>
+<e>
+<k>@var_decl_stmt</k>
+<v>105606</v>
+</e>
+<e>
+<k>@case</k>
+<v>8674</v>
+</e>
+<e>
+<k>@catch_clause</k>
+<v>1272</v>
+</e>
+<e>
+<k>@for_of_stmt</k>
+<v>61</v>
+</e>
+<e>
+<k>@const_decl_stmt</k>
+<v>1118</v>
+</e>
+<e>
+<k>@let_stmt</k>
+<v>551</v>
+</e>
+<e>
+<k>@legacy_let_stmt</k>
+<v>1</v>
+</e>
+<e>
+<k>@for_each_stmt</k>
+<v>1</v>
+</e>
+<e>
+<k>@class_decl_stmt</k>
+<v>41</v>
+</e>
+<e>
+<k>@import_declaration</k>
+<v>8</v>
+</e>
+<e>
+<k>@export_all_declaration</k>
+<v>1</v>
+</e>
+<e>
+<k>@export_as_namespace_declaration</k>
+<v>5</v>
+</e>
+<e>
+<k>@global_augmentation_declaration</k>
+<v>5</v>
+</e>
+<e>
+<k>@export_default_declaration</k>
+<v>5</v>
+</e>
+<e>
+<k>@export_named_declaration</k>
+<v>31</v>
+</e>
+<e>
+<k>@expr</k>
+<v>5495305</v>
+</e>
+<e>
+<k>@label</k>
+<v>722373</v>
+</e>
+<e>
+<k>@null_literal</k>
+<v>15525</v>
+</e>
+<e>
+<k>@boolean_literal</k>
+<v>31652</v>
+</e>
+<e>
+<k>@number_literal</k>
+<v>557620</v>
+</e>
+<e>
+<k>@string_literal</k>
+<v>268843</v>
+</e>
+<e>
+<k>@regexp_literal</k>
+<v>2773</v>
+</e>
+<e>
+<k>@this_expr</k>
+<v>128651</v>
+</e>
+<e>
+<k>@array_expr</k>
+<v>28131</v>
+</e>
+<e>
+<k>@obj_expr</k>
+<v>50958</v>
+</e>
+<e>
+<k>@function_expr</k>
+<v>95744</v>
+</e>
+<e>
+<k>@seq_expr</k>
+<v>2457</v>
+</e>
+<e>
+<k>@conditional_expr</k>
+<v>8111</v>
+</e>
+<e>
+<k>@new_expr</k>
+<v>19023</v>
+</e>
+<e>
+<k>@call_expr</k>
+<v>487075</v>
+</e>
+<e>
+<k>@dot_expr</k>
+<v>602582</v>
+</e>
+<e>
+<k>@index_expr</k>
+<v>105192</v>
+</e>
+<e>
+<k>@neg_expr</k>
+<v>11993</v>
+</e>
+<e>
+<k>@plus_expr</k>
+<v>731</v>
+</e>
+<e>
+<k>@log_not_expr</k>
+<v>19385</v>
+</e>
+<e>
+<k>@bit_not_expr</k>
+<v>403</v>
+</e>
+<e>
+<k>@typeof_expr</k>
+<v>4540</v>
+</e>
+<e>
+<k>@void_expr</k>
+<v>51</v>
+</e>
+<e>
+<k>@delete_expr</k>
+<v>1310</v>
+</e>
+<e>
+<k>@eq_expr</k>
+<v>13468</v>
+</e>
+<e>
+<k>@neq_expr</k>
+<v>5338</v>
+</e>
+<e>
+<k>@eqq_expr</k>
+<v>17758</v>
+</e>
+<e>
+<k>@neqq_expr</k>
+<v>5818</v>
+</e>
+<e>
+<k>@lt_expr</k>
+<v>10254</v>
+</e>
+<e>
+<k>@le_expr</k>
+<v>1503</v>
+</e>
+<e>
+<k>@gt_expr</k>
+<v>5438</v>
+</e>
+<e>
+<k>@ge_expr</k>
+<v>2527</v>
+</e>
+<e>
+<k>@lshift_expr</k>
+<v>5655</v>
+</e>
+<e>
+<k>@rshift_expr</k>
+<v>27749</v>
+</e>
+<e>
+<k>@urshift_expr</k>
+<v>4331</v>
+</e>
+<e>
+<k>@add_expr</k>
+<v>88032</v>
+</e>
+<e>
+<k>@sub_expr</k>
+<v>10789</v>
+</e>
+<e>
+<k>@mul_expr</k>
+<v>14075</v>
+</e>
+<e>
+<k>@div_expr</k>
+<v>2496</v>
+</e>
+<e>
+<k>@mod_expr</k>
+<v>655</v>
+</e>
+<e>
+<k>@bitor_expr</k>
+<v>42853</v>
+</e>
+<e>
+<k>@xor_expr</k>
+<v>503</v>
+</e>
+<e>
+<k>@bitand_expr</k>
+<v>8538</v>
+</e>
+<e>
+<k>@in_expr</k>
+<v>1135</v>
+</e>
+<e>
+<k>@instanceof_expr</k>
+<v>1184</v>
+</e>
+<e>
+<k>@logand_expr</k>
+<v>15892</v>
+</e>
+<e>
+<k>@logor_expr</k>
+<v>12711</v>
+</e>
+<e>
+<k>@assign_expr</k>
+<v>245084</v>
+</e>
+<e>
+<k>@assign_add_expr</k>
+<v>6231</v>
+</e>
+<e>
+<k>@assign_sub_expr</k>
+<v>823</v>
+</e>
+<e>
+<k>@assign_mul_expr</k>
+<v>143</v>
+</e>
+<e>
+<k>@assign_div_expr</k>
+<v>44</v>
+</e>
+<e>
+<k>@assign_mod_expr</k>
+<v>17</v>
+</e>
+<e>
+<k>@assign_lshift_expr</k>
+<v>57</v>
+</e>
+<e>
+<k>@assign_rshift_expr</k>
+<v>86</v>
+</e>
+<e>
+<k>@assign_urshift_expr</k>
+<v>96</v>
+</e>
+<e>
+<k>@assign_or_expr</k>
+<v>586</v>
+</e>
+<e>
+<k>@assign_xor_expr</k>
+<v>108</v>
+</e>
+<e>
+<k>@assign_and_expr</k>
+<v>222</v>
+</e>
+<e>
+<k>@assignlogandexpr</k>
+<v>1</v>
+</e>
+<e>
+<k>@assignlogorexpr</k>
+<v>1</v>
+</e>
+<e>
+<k>@assignnullishcoalescingexpr</k>
+<v>1</v>
+</e>
+<e>
+<k>@angular_pipe_ref</k>
+<v>100</v>
+</e>
+<e>
+<k>@preinc_expr</k>
+<v>1792</v>
+</e>
+<e>
+<k>@postinc_expr</k>
+<v>7103</v>
+</e>
+<e>
+<k>@predec_expr</k>
+<v>457</v>
+</e>
+<e>
+<k>@postdec_expr</k>
+<v>774</v>
+</e>
+<e>
+<k>@par_expr</k>
+<v>86199</v>
+</e>
+<e>
+<k>@var_declarator</k>
+<v>130843</v>
+</e>
+<e>
+<k>@arrow_function_expr</k>
+<v>3730</v>
+</e>
+<e>
+<k>@spread_element</k>
+<v>50</v>
+</e>
+<e>
+<k>@array_pattern</k>
+<v>57</v>
+</e>
+<e>
+<k>@object_pattern</k>
+<v>122</v>
+</e>
+<e>
+<k>@yield_expr</k>
+<v>81</v>
+</e>
+<e>
+<k>@tagged_template_expr</k>
+<v>27</v>
+</e>
+<e>
+<k>@template_literal</k>
+<v>408</v>
+</e>
+<e>
+<k>@template_literal_typeexpr</k>
+<v>100</v>
+</e>
+<e>
+<k>@template_element</k>
+<v>639</v>
+</e>
+<e>
+<k>@array_comprehension_expr</k>
+<v>3</v>
+</e>
+<e>
+<k>@generator_expr</k>
+<v>1</v>
+</e>
+<e>
+<k>@for_in_comprehension_block</k>
+<v>1</v>
+</e>
+<e>
+<k>@for_of_comprehension_block</k>
+<v>3</v>
+</e>
+<e>
+<k>@legacy_letexpr</k>
+<v>1</v>
+</e>
+<e>
+<k>@var_decl</k>
+<v>250257</v>
+</e>
+<e>
+<k>@proper_varaccess</k>
+<v>1295408</v>
+</e>
+<e>
+<k>@super_expr</k>
+<v>11</v>
+</e>
+<e>
+<k>@newtarget_expr</k>
+<v>1</v>
+</e>
+<e>
+<k>@import_meta_expr</k>
+<v>1</v>
+</e>
+<e>
+<k>@named_import_specifier</k>
+<v>4</v>
+</e>
+<e>
+<k>@import_default_specifier</k>
+<v>4</v>
+</e>
+<e>
+<k>@import_namespace_specifier</k>
+<v>2</v>
+</e>
+<e>
+<k>@named_export_specifier</k>
+<v>5</v>
+</e>
+<e>
+<k>@export_default_specifier</k>
+<v>5</v>
+</e>
+<e>
+<k>@export_namespace_specifier</k>
+<v>5</v>
+</e>
+<e>
+<k>@export_assign_declaration</k>
+<v>5</v>
+</e>
+<e>
+<k>@interface_declaration</k>
+<v>5</v>
+</e>
+<e>
+<k>@type_alias_declaration</k>
+<v>120</v>
+</e>
+<e>
+<k>@enum_declaration</k>
+<v>252</v>
+</e>
+<e>
+<k>@external_module_declaration</k>
+<v>100</v>
+</e>
+<e>
+<k>@external_module_reference</k>
+<v>5</v>
+</e>
+<e>
+<k>@expression_with_type_arguments</k>
+<v>45</v>
+</e>
+<e>
+<k>@prefix_type_assertion</k>
+<v>1721</v>
+</e>
+<e>
+<k>@as_type_assertion</k>
+<v>368</v>
+</e>
+<e>
+<k>@export_varaccess</k>
+<v>15</v>
+</e>
+<e>
+<k>@decorator_list</k>
+<v>2575</v>
+</e>
+<e>
+<k>@non_null_assertion</k>
+<v>2159</v>
+</e>
+<e>
+<k>@dynamic_import</k>
+<v>5</v>
+</e>
+<e>
+<k>@import_equals_declaration</k>
+<v>5</v>
+</e>
+<e>
+<k>@namespace_declaration</k>
+<v>5</v>
+</e>
+<e>
+<k>@namespace_scope</k>
+<v>5</v>
+</e>
+<e>
+<k>@exp_expr</k>
+<v>14075</v>
+</e>
+<e>
+<k>@assign_exp_expr</k>
+<v>143</v>
+</e>
+<e>
+<k>@class_expr</k>
+<v>41</v>
+</e>
+<e>
+<k>@scope</k>
+<v>118172</v>
+</e>
+<e>
+<k>@global_scope</k>
+<v>1</v>
+</e>
+<e>
+<k>@function_scope</k>
+<v>116245</v>
+</e>
+<e>
+<k>@catch_scope</k>
+<v>1272</v>
+</e>
+<e>
+<k>@module_scope</k>
+<v>21</v>
+</e>
+<e>
+<k>@block_scope</k>
+<v>584</v>
+</e>
+<e>
+<k>@for_scope</k>
+<v>17</v>
+</e>
+<e>
+<k>@for_in_scope</k>
+<v>28</v>
+</e>
+<e>
+<k>@comprehension_block_scope</k>
+<v>4</v>
+</e>
+<e>
+<k>@class_expr_scope</k>
+<v>41</v>
+</e>
+<e>
+<k>@class_decl_scope</k>
+<v>2693</v>
+</e>
+<e>
+<k>@interface_scope</k>
+<v>200</v>
+</e>
+<e>
+<k>@type_alias_scope</k>
+<v>11</v>
+</e>
+<e>
+<k>@enum_scope</k>
+<v>252</v>
+</e>
+<e>
+<k>@external_module_scope</k>
+<v>100</v>
+</e>
+<e>
+<k>@mapped_type_scope</k>
+<v>10</v>
+</e>
+<e>
+<k>@conditional_type_scope</k>
+<v>100</v>
+</e>
+<e>
+<k>@variable</k>
+<v>364388</v>
+</e>
+<e>
+<k>@local_type_name</k>
+<v>23565</v>
+</e>
+<e>
+<k>@local_namespace_name</k>
+<v>20832</v>
+</e>
+<e>
+<k>@property</k>
+<v>142723</v>
+</e>
+<e>
+<k>@value_property</k>
+<v>140856</v>
+</e>
+<e>
+<k>@property_getter</k>
+<v>1529</v>
+</e>
+<e>
+<k>@property_setter</k>
+<v>338</v>
+</e>
+<e>
+<k>@jsx_attribute</k>
+<v>100</v>
+</e>
+<e>
+<k>@function_call_signature</k>
+<v>2458</v>
+</e>
+<e>
+<k>@constructor_call_signature</k>
+<v>37</v>
+</e>
+<e>
+<k>@index_signature</k>
+<v>504</v>
+</e>
+<e>
+<k>@enum_member</k>
+<v>2026</v>
+</e>
+<e>
+<k>@proper_field</k>
+<v>16934</v>
+</e>
+<e>
+<k>@parameter_field</k>
+<v>2693</v>
+</e>
+<e>
+<k>@local_type_access</k>
+<v>25491</v>
+</e>
+<e>
+<k>@type_decl</k>
+<v>2513</v>
+</e>
+<e>
+<k>@keyword_typeexpr</k>
+<v>25306</v>
+</e>
+<e>
+<k>@string_literal_typeexpr</k>
+<v>733</v>
+</e>
+<e>
+<k>@number_literal_typeexpr</k>
+<v>3</v>
+</e>
+<e>
+<k>@boolean_literal_typeexpr</k>
+<v>4</v>
+</e>
+<e>
+<k>@array_typeexpr</k>
+<v>4579</v>
+</e>
+<e>
+<k>@union_typeexpr</k>
+<v>852</v>
+</e>
+<e>
+<k>@intersection_typeexpr</k>
+<v>27</v>
+</e>
+<e>
+<k>@parenthesized_typeexpr</k>
+<v>62</v>
+</e>
+<e>
+<k>@tuple_typeexpr</k>
+<v>98</v>
+</e>
+<e>
+<k>@keyof_typeexpr</k>
+<v>3</v>
+</e>
+<e>
+<k>@indexed_access_typeexpr</k>
+<v>3</v>
+</e>
+<e>
+<k>@qualified_type_access</k>
+<v>3559</v>
+</e>
+<e>
+<k>@import_namespace_access</k>
+<v>100</v>
+</e>
+<e>
+<k>@import_type_access</k>
+<v>100</v>
+</e>
+<e>
+<k>@import_var_type_access</k>
+<v>100</v>
+</e>
+<e>
+<k>@optional_typeexpr</k>
+<v>100</v>
+</e>
+<e>
+<k>@rest_typeexpr</k>
+<v>100</v>
+</e>
+<e>
+<k>@readonly_typeexpr</k>
+<v>100</v>
+</e>
+<e>
+<k>@bigint_literal_typeexpr</k>
+<v>100</v>
+</e>
+<e>
+<k>@generic_typeexpr</k>
+<v>5220</v>
+</e>
+<e>
+<k>@type_label</k>
+<v>3559</v>
+</e>
+<e>
+<k>@typeof_typeexpr</k>
+<v>24</v>
+</e>
+<e>
+<k>@local_var_type_access</k>
+<v>24</v>
+</e>
+<e>
+<k>@qualified_var_type_access</k>
+<v>15</v>
+</e>
+<e>
+<k>@this_var_type_access</k>
+<v>20</v>
+</e>
+<e>
+<k>@predicate_typeexpr</k>
+<v>86</v>
+</e>
+<e>
+<k>@interface_typeexpr</k>
+<v>1038</v>
+</e>
+<e>
+<k>@type_parameter</k>
+<v>3463</v>
+</e>
+<e>
+<k>@plain_function_typeexpr</k>
+<v>1674</v>
+</e>
+<e>
+<k>@local_namespace_access</k>
+<v>4671</v>
+</e>
+<e>
+<k>@qualified_namespace_access</k>
+<v>20</v>
+</e>
+<e>
+<k>@constructor_typeexpr</k>
+<v>20</v>
+</e>
+<e>
+<k>@mapped_typeexpr</k>
+<v>20</v>
+</e>
+<e>
+<k>@conditional_typeexpr</k>
+<v>100</v>
+</e>
+<e>
+<k>@infer_typeexpr</k>
+<v>100</v>
+</e>
+<e>
+<k>@comment</k>
+<v>104947</v>
+</e>
+<e>
+<k>@any_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@string_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@number_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@union_type</k>
+<v>1802</v>
+</e>
+<e>
+<k>@true_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@false_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@type_reference</k>
+<v>12383</v>
+</e>
+<e>
+<k>@object_type</k>
+<v>159099</v>
+</e>
+<e>
+<k>@canonical_type_variable_type</k>
+<v>650</v>
+</e>
+<e>
+<k>@typeof_type</k>
+<v>2903</v>
+</e>
+<e>
+<k>@void_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@undefined_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@null_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@never_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@plain_symbol_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@objectkeyword_type</k>
+<v>1</v>
+</e>
+<e>
+<k>@intersection_type</k>
+<v>369</v>
+</e>
+<e>
+<k>@tuple_type</k>
+<v>307</v>
+</e>
+<e>
+<k>@lexical_type_variable_type</k>
+<v>50</v>
+</e>
+<e>
+<k>@this_type</k>
+<v>2731</v>
+</e>
+<e>
+<k>@number_literal_type</k>
+<v>1244</v>
+</e>
+<e>
+<k>@string_literal_type</k>
+<v>30638</v>
+</e>
+<e>
+<k>@unknown_type</k>
+<v>100</v>
+</e>
+<e>
+<k>@bigint_type</k>
+<v>100</v>
+</e>
+<e>
+<k>@bigint_literal_type</k>
+<v>100</v>
+</e>
+<e>
+<k>@unique_symbol_type</k>
+<v>100</v>
+</e>
+<e>
+<k>@root_symbol</k>
+<v>2385</v>
+</e>
+<e>
+<k>@member_symbol</k>
+<v>7223</v>
+</e>
+<e>
+<k>@other_symbol</k>
+<v>584</v>
+</e>
+<e>
+<k>@function_signature_type</k>
+<v>34698</v>
+</e>
+<e>
+<k>@constructor_signature_type</k>
+<v>2646</v>
+</e>
+<e>
+<k>@slashslash_comment</k>
+<v>76841</v>
+</e>
+<e>
+<k>@slashstar_comment</k>
+<v>8834</v>
+</e>
+<e>
+<k>@doc_comment</k>
+<v>19270</v>
+</e>
+<e>
+<k>@html_comment_start</k>
+<v>1</v>
+</e>
+<e>
+<k>@htmlcommentend</k>
+<v>1</v>
+</e>
+<e>
+<k>@line</k>
+<v>1622184</v>
+</e>
+<e>
+<k>@js_parse_error</k>
+<v>8</v>
+</e>
+<e>
+<k>@regexpterm</k>
+<v>33197</v>
+</e>
+<e>
+<k>@regexp_alt</k>
+<v>641</v>
+</e>
+<e>
+<k>@regexp_seq</k>
+<v>3371</v>
+</e>
+<e>
+<k>@regexp_caret</k>
+<v>826</v>
+</e>
+<e>
+<k>@regexp_dollar</k>
+<v>637</v>
+</e>
+<e>
+<k>@regexp_wordboundary</k>
+<v>99</v>
+</e>
+<e>
+<k>@regexp_nonwordboundary</k>
+<v>3</v>
+</e>
+<e>
+<k>@regexp_positive_lookahead</k>
+<v>15</v>
+</e>
+<e>
+<k>@regexp_negative_lookahead</k>
+<v>12</v>
+</e>
+<e>
+<k>@regexp_star</k>
+<v>1057</v>
+</e>
+<e>
+<k>@regexp_plus</k>
+<v>1067</v>
+</e>
+<e>
+<k>@regexp_opt</k>
+<v>478</v>
+</e>
+<e>
+<k>@regexp_range</k>
+<v>146</v>
+</e>
+<e>
+<k>@regexp_dot</k>
+<v>445</v>
+</e>
+<e>
+<k>@regexp_group</k>
+<v>1692</v>
+</e>
+<e>
+<k>@regexp_normal_constant</k>
+<v>15489</v>
+</e>
+<e>
+<k>@regexp_hex_escape</k>
+<v>59</v>
+</e>
+<e>
+<k>@regexp_unicode_escape</k>
+<v>264</v>
+</e>
+<e>
+<k>@regexp_dec_escape</k>
+<v>7</v>
+</e>
+<e>
+<k>@regexp_oct_escape</k>
+<v>1</v>
+</e>
+<e>
+<k>@regexp_ctrl_escape</k>
+<v>599</v>
+</e>
+<e>
+<k>@regexp_char_class_escape</k>
+<v>1573</v>
+</e>
+<e>
+<k>@regexp_id_escape</k>
+<v>2613</v>
+</e>
+<e>
+<k>@regexp_backref</k>
+<v>11</v>
+</e>
+<e>
+<k>@regexp_char_class</k>
+<v>1473</v>
+</e>
+<e>
+<k>@regexp_char_range</k>
+<v>619</v>
+</e>
+<e>
+<k>@regexp_positive_lookbehind</k>
+<v>15</v>
+</e>
+<e>
+<k>@regexp_negative_lookbehind</k>
+<v>12</v>
+</e>
+<e>
+<k>@regexp_unicode_property_escape</k>
+<v>12</v>
+</e>
+<e>
+<k>@regexp_parse_error</k>
+<v>122</v>
+</e>
+<e>
+<k>@token</k>
+<v>8770869</v>
+</e>
+<e>
+<k>@token_eof</k>
+<v>5312</v>
+</e>
+<e>
+<k>@token_null_literal</k>
+<v>15526</v>
+</e>
+<e>
+<k>@token_boolean_literal</k>
+<v>31654</v>
+</e>
+<e>
+<k>@token_numeric_literal</k>
+<v>557620</v>
+</e>
+<e>
+<k>@token_string_literal</k>
+<v>269555</v>
+</e>
+<e>
+<k>@token_regular_expression</k>
+<v>2773</v>
+</e>
+<e>
+<k>@token_identifier</k>
+<v>2268328</v>
+</e>
+<e>
+<k>@token_keyword</k>
+<v>551767</v>
+</e>
+<e>
+<k>@token_punctuator</k>
+<v>5068334</v>
+</e>
+<e>
+<k>@json_value</k>
+<v>1643352</v>
+</e>
+<e>
+<k>@json_null</k>
+<v>24</v>
+</e>
+<e>
+<k>@json_boolean</k>
+<v>654</v>
+</e>
+<e>
+<k>@json_number</k>
+<v>273113</v>
+</e>
+<e>
+<k>@json_string</k>
+<v>752355</v>
+</e>
+<e>
+<k>@json_array</k>
+<v>175925</v>
+</e>
+<e>
+<k>@json_object</k>
+<v>441281</v>
+</e>
+<e>
+<k>@json_parse_error</k>
+<v>1</v>
+</e>
+<e>
+<k>@entry_node</k>
+<v>121542</v>
+</e>
+<e>
+<k>@exit_node</k>
+<v>121542</v>
+</e>
+<e>
+<k>@guard_node</k>
+<v>177785</v>
+</e>
+<e>
+<k>@jsdoc</k>
+<v>19270</v>
+</e>
+<e>
+<k>@falsy_guard</k>
+<v>86336</v>
+</e>
+<e>
+<k>@truthy_guard</k>
+<v>91449</v>
+</e>
+<e>
+<k>@jsdoc_tag</k>
+<v>29323</v>
+</e>
+<e>
+<k>@jsdoc_type_expr</k>
+<v>22481</v>
+</e>
+<e>
+<k>@jsdoc_any_type_expr</k>
+<v>292</v>
+</e>
+<e>
+<k>@jsdoc_null_type_expr</k>
+<v>35</v>
+</e>
+<e>
+<k>@jsdoc_undefined_type_expr</k>
+<v>287</v>
+</e>
+<e>
+<k>@jsdoc_unknown_type_expr</k>
+<v>27</v>
+</e>
+<e>
+<k>@jsdoc_void_type_expr</k>
+<v>8</v>
+</e>
+<e>
+<k>@jsdoc_named_type_expr</k>
+<v>18639</v>
+</e>
+<e>
+<k>@jsdoc_applied_type_expr</k>
+<v>303</v>
+</e>
+<e>
+<k>@jsdoc_nullable_type_expr</k>
+<v>310</v>
+</e>
+<e>
+<k>@jsdoc_non_nullable_type_expr</k>
+<v>536</v>
+</e>
+<e>
+<k>@jsdoc_record_type_expr</k>
+<v>91</v>
+</e>
+<e>
+<k>@jsdoc_array_type_expr</k>
+<v>19</v>
+</e>
+<e>
+<k>@jsdoc_union_type_expr</k>
+<v>668</v>
+</e>
+<e>
+<k>@jsdoc_function_type_expr</k>
+<v>316</v>
+</e>
+<e>
+<k>@jsdoc_optional_type_expr</k>
+<v>895</v>
+</e>
+<e>
+<k>@jsdoc_rest_type_expr</k>
+<v>55</v>
+</e>
+<e>
+<k>@jsdoc_error</k>
+<v>1658</v>
+</e>
+<e>
+<k>@yaml_node</k>
+<v>885</v>
+</e>
+<e>
+<k>@yaml_scalar_node</k>
+<v>700</v>
+</e>
+<e>
+<k>@yaml_mapping_node</k>
+<v>149</v>
+</e>
+<e>
+<k>@yaml_sequence_node</k>
+<v>35</v>
+</e>
+<e>
+<k>@yaml_alias_node</k>
+<v>1</v>
+</e>
+<e>
+<k>@yaml_error</k>
+<v>1</v>
+</e>
+<e>
+<k>@jsx_element</k>
+<v>1090</v>
+</e>
+<e>
+<k>@jsx_qualified_name</k>
+<v>100</v>
+</e>
+<e>
+<k>@jsx_empty_expr</k>
+<v>100</v>
+</e>
+<e>
+<k>@await_expr</k>
+<v>100</v>
+</e>
+<e>
+<k>@function_sent_expr</k>
+<v>100</v>
+</e>
+<e>
+<k>@decorator</k>
+<v>100</v>
+</e>
+<e>
+<k>@bind_expr</k>
+<v>100</v>
+</e>
+<e>
+<k>@bigint_literal</k>
+<v>100</v>
+</e>
+<e>
+<k>@nullishcoalescing_expr</k>
+<v>100</v>
+</e>
+<e>
+<k>@e4x_xml_anyname</k>
+<v>100</v>
+</e>
+<e>
+<k>@e4x_xml_static_attribute_selector</k>
+<v>100</v>
+</e>
+<e>
+<k>@e4x_xml_dynamic_attribute_selector</k>
+<v>100</v>
+</e>
+<e>
+<k>@e4x_xml_filter_expression</k>
+<v>100</v>
+</e>
+<e>
+<k>@e4x_xml_static_qualident</k>
+<v>100</v>
+</e>
+<e>
+<k>@e4x_xml_dynamic_qualident</k>
+<v>100</v>
+</e>
+<e>
+<k>@e4x_xml_dotdotexpr</k>
+<v>100</v>
+</e>
+<e>
+<k>@xmldtd</k>
+<v>1</v>
+</e>
+<e>
+<k>@xmlelement</k>
+<v>1270313</v>
+</e>
+<e>
+<k>@xmlattribute</k>
+<v>1202020</v>
+</e>
+<e>
+<k>@xmlnamespace</k>
+<v>4185</v>
+</e>
+<e>
+<k>@xmlcomment</k>
+<v>26812</v>
+</e>
+<e>
+<k>@xmlcharacters</k>
+<v>439958</v>
+</e>
+<e>
+<k>@optionalchainable</k>
+<v>100</v>
+</e>
+<e>
+<k>@nullishcoalescing_expr</k>
+<v>100</v>
+</e>
+<e>
+<k>@config</k>
+<v>69795</v>
+</e>
+<e>
+<k>@configName</k>
+<v>69794</v>
+</e>
+<e>
+<k>@configValue</k>
+<v>69691</v>
+</e>
+</typesizes>
+<stats>
+<relation>
+<name>svnentries</name>
+<cardinality>575525</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>575525</v>
+</e>
+<e>
+<k>revision</k>
+<v>575525</v>
+</e>
+<e>
+<k>author</k>
+<v>19539</v>
+</e>
+<e>
+<k>revisionDate</k>
+<v>547759</v>
+</e>
+<e>
+<k>changeSize</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>revision</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>575525</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>author</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>575525</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>revisionDate</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>575525</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>changeSize</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>575525</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>revision</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>575525</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>revision</src>
+<trg>author</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>575525</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>revision</src>
+<trg>revisionDate</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>575525</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>revision</src>
+<trg>changeSize</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>575525</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>author</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7913</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2531</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1388</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>1523</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>1529</v>
+</b>
+<b>
+<a>10</a>
+<b>20</b>
+<v>1509</v>
+</b>
+<b>
+<a>20</a>
+<b>52</b>
+<v>1488</v>
+</b>
+<b>
+<a>52</a>
+<b>568</b>
+<v>1466</v>
+</b>
+<b>
+<a>569</a>
+<b>16582</b>
+<v>192</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>author</src>
+<trg>revision</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7913</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2531</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1388</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>1523</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>1529</v>
+</b>
+<b>
+<a>10</a>
+<b>20</b>
+<v>1509</v>
+</b>
+<b>
+<a>20</a>
+<b>52</b>
+<v>1488</v>
+</b>
+<b>
+<a>52</a>
+<b>568</b>
+<v>1466</v>
+</b>
+<b>
+<a>569</a>
+<b>16582</b>
+<v>192</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>author</src>
+<trg>revisionDate</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7996</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2509</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1379</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>1520</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>1529</v>
+</b>
+<b>
+<a>10</a>
+<b>20</b>
+<v>1507</v>
+</b>
+<b>
+<a>20</a>
+<b>52</b>
+<v>1474</v>
+</b>
+<b>
+<a>52</a>
+<b>662</b>
+<v>1466</v>
+</b>
+<b>
+<a>663</a>
+<b>16573</b>
+<v>159</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>author</src>
+<trg>changeSize</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19539</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>revisionDate</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>531878</v>
+</b>
+<b>
+<a>2</a>
+<b>100</b>
+<v>15881</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>revisionDate</src>
+<trg>revision</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>531878</v>
+</b>
+<b>
+<a>2</a>
+<b>100</b>
+<v>15881</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>revisionDate</src>
+<trg>author</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>542505</v>
+</b>
+<b>
+<a>2</a>
+<b>17</b>
+<v>5254</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>revisionDate</src>
+<trg>changeSize</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>547759</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>changeSize</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>575525</a>
+<b>575526</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>changeSize</src>
+<trg>revision</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>575525</a>
+<b>575526</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>changeSize</src>
+<trg>author</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>19539</a>
+<b>19540</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>changeSize</src>
+<trg>revisionDate</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>547759</a>
+<b>547760</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>svnaffectedfiles</name>
+<cardinality>1314068</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>531628</v>
+</e>
+<e>
+<k>file</k>
+<v>90924</v>
+</e>
+<e>
+<k>action</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>337698</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>77525</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>43024</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>46689</v>
+</b>
+<b>
+<a>7</a>
+<b>16635</b>
+<v>26692</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>action</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>531628</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11819</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>18230</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>9501</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>6656</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>5012</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>7103</v>
+</b>
+<b>
+<a>8</a>
+<b>11</b>
+<v>6788</v>
+</b>
+<b>
+<a>11</a>
+<b>16</b>
+<v>6996</v>
+</b>
+<b>
+<a>16</a>
+<b>26</b>
+<v>7180</v>
+</b>
+<b>
+<a>26</a>
+<b>54</b>
+<v>6824</v>
+</b>
+<b>
+<a>54</a>
+<b>3572</b>
+<v>4815</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>action</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>90924</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>action</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>531628</a>
+<b>531629</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>action</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>90924</a>
+<b>90925</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>svnentrymsg</name>
+<cardinality>575525</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>575525</v>
+</e>
+<e>
+<k>message</k>
+<v>568305</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>575525</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>565381</v>
+</b>
+<b>
+<a>2</a>
+<b>142</b>
+<v>2924</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>svnchurn</name>
+<cardinality>46790</cardinality>
+<columnsizes>
+<e>
+<k>commit</k>
+<v>22361</v>
+</e>
+<e>
+<k>file</k>
+<v>16124</v>
+</e>
+<e>
+<k>addedLines</k>
+<v>910</v>
+</e>
+<e>
+<k>deletedLines</k>
+<v>787</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>commit</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15208</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3101</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1746</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>1774</v>
+</b>
+<b>
+<a>8</a>
+<b>246</b>
+<v>532</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>commit</src>
+<trg>addedLines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>16074</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3323</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1561</v>
+</b>
+<b>
+<a>4</a>
+<b>118</b>
+<v>1403</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>commit</src>
+<trg>deletedLines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>16799</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3286</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>1763</v>
+</b>
+<b>
+<a>5</a>
+<b>113</b>
+<v>513</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>commit</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8618</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2956</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1426</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>1364</v>
+</b>
+<b>
+<a>6</a>
+<b>12</b>
+<v>1210</v>
+</b>
+<b>
+<a>12</a>
+<b>448</b>
+<v>550</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>addedLines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>9240</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3129</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1393</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>1239</v>
+</b>
+<b>
+<a>6</a>
+<b>59</b>
+<v>1123</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>deletedLines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>9525</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3192</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1401</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>1387</v>
+</b>
+<b>
+<a>7</a>
+<b>70</b>
+<v>619</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>addedLines</src>
+<trg>commit</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>446</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>133</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>70</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>68</v>
+</b>
+<b>
+<a>6</a>
+<b>12</b>
+<v>70</v>
+</b>
+<b>
+<a>12</a>
+<b>57</b>
+<v>69</v>
+</b>
+<b>
+<a>57</a>
+<b>6874</b>
+<v>54</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>addedLines</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>445</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>132</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>69</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>68</v>
+</b>
+<b>
+<a>6</a>
+<b>12</b>
+<v>73</v>
+</b>
+<b>
+<a>12</a>
+<b>58</b>
+<v>69</v>
+</b>
+<b>
+<a>58</a>
+<b>6663</b>
+<v>54</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>addedLines</src>
+<trg>deletedLines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>621</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>96</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>81</v>
+</b>
+<b>
+<a>7</a>
+<b>34</b>
+<v>70</v>
+</b>
+<b>
+<a>34</a>
+<b>727</b>
+<v>42</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>deletedLines</src>
+<trg>commit</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>439</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>116</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>48</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>67</v>
+</b>
+<b>
+<a>8</a>
+<b>28</b>
+<v>60</v>
+</b>
+<b>
+<a>28</a>
+<b>6794</b>
+<v>57</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>deletedLines</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>437</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>113</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>49</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>61</v>
+</b>
+<b>
+<a>7</a>
+<b>19</b>
+<v>60</v>
+</b>
+<b>
+<a>19</a>
+<b>770</b>
+<v>60</v>
+</b>
+<b>
+<a>985</a>
+<b>7318</b>
+<v>7</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>deletedLines</src>
+<trg>addedLines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>545</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>72</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>69</v>
+</b>
+<b>
+<a>7</a>
+<b>30</b>
+<v>60</v>
+</b>
+<b>
+<a>30</a>
+<b>871</b>
+<v>41</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+
+<relation>
+<name>locations_default</name>
+<key>id</key>
+<cardinality>15664049</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>15664049</v>
+</e>
+<e>
+<k>file</k>
+<v>6457</v>
+</e>
+<e>
+<k>beginLine</k>
+<v>277405</v>
+</e>
+<e>
+<k>beginColumn</k>
+<v>117878</v>
+</e>
+<e>
+<k>endLine</k>
+<v>277405</v>
+</e>
+<e>
+<k>endColumn</k>
+<v>117868</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15664049</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15664049</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15664049</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15664049</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15664049</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>674</v>
+</b>
+<b>
+<a>2</a>
+<b>28</b>
+<v>501</v>
+</b>
+<b>
+<a>28</a>
+<b>105</b>
+<v>488</v>
+</b>
+<b>
+<a>105</a>
+<b>211</b>
+<v>488</v>
+</b>
+<b>
+<a>211</a>
+<b>335</b>
+<v>490</v>
+</b>
+<b>
+<a>335</a>
+<b>477</b>
+<v>485</v>
+</b>
+<b>
+<a>477</a>
+<b>637</b>
+<v>488</v>
+</b>
+<b>
+<a>637</a>
+<b>856</b>
+<v>486</v>
+</b>
+<b>
+<a>856</a>
+<b>1141</b>
+<v>485</v>
+</b>
+<b>
+<a>1141</a>
+<b>1602</b>
+<v>485</v>
+</b>
+<b>
+<a>1604</a>
+<b>2336</b>
+<v>486</v>
+</b>
+<b>
+<a>2336</a>
+<b>4472</b>
+<v>485</v>
+</b>
+<b>
+<a>4472</a>
+<b>2368854</b>
+<v>416</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>674</v>
+</b>
+<b>
+<a>2</a>
+<b>13</b>
+<v>509</v>
+</b>
+<b>
+<a>13</a>
+<b>23</b>
+<v>513</v>
+</b>
+<b>
+<a>23</a>
+<b>35</b>
+<v>516</v>
+</b>
+<b>
+<a>35</a>
+<b>50</b>
+<v>504</v>
+</b>
+<b>
+<a>50</a>
+<b>69</b>
+<v>506</v>
+</b>
+<b>
+<a>69</a>
+<b>92</b>
+<v>489</v>
+</b>
+<b>
+<a>92</a>
+<b>124</b>
+<v>504</v>
+</b>
+<b>
+<a>124</a>
+<b>165</b>
+<v>487</v>
+</b>
+<b>
+<a>165</a>
+<b>230</b>
+<v>490</v>
+</b>
+<b>
+<a>230</a>
+<b>357</b>
+<v>491</v>
+</b>
+<b>
+<a>357</a>
+<b>737</b>
+<v>485</v>
+</b>
+<b>
+<a>737</a>
+<b>277406</b>
+<v>289</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>674</v>
+</b>
+<b>
+<a>2</a>
+<b>12</b>
+<v>491</v>
+</b>
+<b>
+<a>12</a>
+<b>32</b>
+<v>495</v>
+</b>
+<b>
+<a>32</a>
+<b>46</b>
+<v>510</v>
+</b>
+<b>
+<a>46</a>
+<b>56</b>
+<v>498</v>
+</b>
+<b>
+<a>56</a>
+<b>62</b>
+<v>488</v>
+</b>
+<b>
+<a>62</a>
+<b>67</b>
+<v>500</v>
+</b>
+<b>
+<a>67</a>
+<b>71</b>
+<v>477</v>
+</b>
+<b>
+<a>71</a>
+<b>75</b>
+<v>583</v>
+</b>
+<b>
+<a>75</a>
+<b>78</b>
+<v>497</v>
+</b>
+<b>
+<a>78</a>
+<b>80</b>
+<v>403</v>
+</b>
+<b>
+<a>80</a>
+<b>82</b>
+<v>543</v>
+</b>
+<b>
+<a>82</a>
+<b>117856</b>
+<v>298</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>674</v>
+</b>
+<b>
+<a>2</a>
+<b>13</b>
+<v>509</v>
+</b>
+<b>
+<a>13</a>
+<b>23</b>
+<v>509</v>
+</b>
+<b>
+<a>23</a>
+<b>35</b>
+<v>520</v>
+</b>
+<b>
+<a>35</a>
+<b>50</b>
+<v>504</v>
+</b>
+<b>
+<a>50</a>
+<b>69</b>
+<v>506</v>
+</b>
+<b>
+<a>69</a>
+<b>92</b>
+<v>489</v>
+</b>
+<b>
+<a>92</a>
+<b>124</b>
+<v>504</v>
+</b>
+<b>
+<a>124</a>
+<b>165</b>
+<v>487</v>
+</b>
+<b>
+<a>165</a>
+<b>230</b>
+<v>490</v>
+</b>
+<b>
+<a>230</a>
+<b>357</b>
+<v>491</v>
+</b>
+<b>
+<a>357</a>
+<b>737</b>
+<v>485</v>
+</b>
+<b>
+<a>737</a>
+<b>277406</b>
+<v>289</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>682</v>
+</b>
+<b>
+<a>2</a>
+<b>18</b>
+<v>501</v>
+</b>
+<b>
+<a>18</a>
+<b>36</b>
+<v>487</v>
+</b>
+<b>
+<a>36</a>
+<b>51</b>
+<v>513</v>
+</b>
+<b>
+<a>51</a>
+<b>61</b>
+<v>532</v>
+</b>
+<b>
+<a>61</a>
+<b>67</b>
+<v>508</v>
+</b>
+<b>
+<a>67</a>
+<b>72</b>
+<v>568</v>
+</b>
+<b>
+<a>72</a>
+<b>75</b>
+<v>444</v>
+</b>
+<b>
+<a>75</a>
+<b>78</b>
+<v>514</v>
+</b>
+<b>
+<a>78</a>
+<b>80</b>
+<v>484</v>
+</b>
+<b>
+<a>80</a>
+<b>81</b>
+<v>283</v>
+</b>
+<b>
+<a>81</a>
+<b>82</b>
+<v>579</v>
+</b>
+<b>
+<a>82</a>
+<b>117837</b>
+<v>362</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>6</b>
+<v>666</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>116499</v>
+</b>
+<b>
+<a>8</a>
+<b>14</b>
+<v>19181</v>
+</b>
+<b>
+<a>14</a>
+<b>15</b>
+<v>29298</v>
+</b>
+<b>
+<a>15</a>
+<b>19</b>
+<v>25329</v>
+</b>
+<b>
+<a>19</a>
+<b>24</b>
+<v>17273</v>
+</b>
+<b>
+<a>24</a>
+<b>29</b>
+<v>22410</v>
+</b>
+<b>
+<a>29</a>
+<b>56</b>
+<v>21150</v>
+</b>
+<b>
+<a>56</a>
+<b>242</b>
+<v>20830</v>
+</b>
+<b>
+<a>242</a>
+<b>134468</b>
+<v>4769</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>117975</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>120803</v>
+</b>
+<b>
+<a>3</a>
+<b>8</b>
+<v>21079</v>
+</b>
+<b>
+<a>8</a>
+<b>6458</b>
+<v>17548</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>5</b>
+<v>667</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>116499</v>
+</b>
+<b>
+<a>6</a>
+<b>11</b>
+<v>19126</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>32612</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>18313</v>
+</b>
+<b>
+<a>15</a>
+<b>17</b>
+<v>18964</v>
+</b>
+<b>
+<a>17</a>
+<b>21</b>
+<v>21845</v>
+</b>
+<b>
+<a>21</a>
+<b>31</b>
+<v>21197</v>
+</b>
+<b>
+<a>31</a>
+<b>64</b>
+<v>20988</v>
+</b>
+<b>
+<a>64</a>
+<b>94454</b>
+<v>7194</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>238980</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>22312</v>
+</b>
+<b>
+<a>3</a>
+<b>890</b>
+<v>16113</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>5</b>
+<v>667</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>116499</v>
+</b>
+<b>
+<a>6</a>
+<b>12</b>
+<v>20939</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
+<v>28687</v>
+</b>
+<b>
+<a>13</a>
+<b>16</b>
+<v>19707</v>
+</b>
+<b>
+<a>16</a>
+<b>18</b>
+<v>20057</v>
+</b>
+<b>
+<a>18</a>
+<b>22</b>
+<v>21035</v>
+</b>
+<b>
+<a>22</a>
+<b>33</b>
+<v>21605</v>
+</b>
+<b>
+<a>33</a>
+<b>69</b>
+<v>21089</v>
+</b>
+<b>
+<a>69</a>
+<b>94455</b>
+<v>7120</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5117</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9246</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>13440</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>15857</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>13813</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>11696</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>8777</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>6887</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9723</v>
+</b>
+<b>
+<a>11</a>
+<b>14</b>
+<v>10392</v>
+</b>
+<b>
+<a>14</a>
+<b>20</b>
+<v>9364</v>
+</b>
+<b>
+<a>20</a>
+<b>2248970</b>
+<v>3566</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>68610</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>15842</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>7965</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>9221</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>8014</v>
+</b>
+<b>
+<a>6</a>
+<b>6458</b>
+<v>8226</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6868</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>15317</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>24725</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>25386</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>10178</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>6239</v>
+</b>
+<b>
+<a>7</a>
+<b>9</b>
+<v>10825</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9294</v>
+</b>
+<b>
+<a>11</a>
+<b>1255</b>
+<v>8841</v>
+</b>
+<b>
+<a>1258</a>
+<b>277405</b>
+<v>205</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6868</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>15317</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>24725</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>25386</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>10175</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>6232</v>
+</b>
+<b>
+<a>7</a>
+<b>9</b>
+<v>10827</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9299</v>
+</b>
+<b>
+<a>11</a>
+<b>1227</b>
+<v>8842</v>
+</b>
+<b>
+<a>1256</a>
+<b>277405</b>
+<v>207</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>24039</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21662</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>22809</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>17118</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>12038</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>7768</v>
+</b>
+<b>
+<a>7</a>
+<b>10</b>
+<v>9297</v>
+</b>
+<b>
+<a>10</a>
+<b>1064</b>
+<v>3147</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>6</b>
+<v>666</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>116499</v>
+</b>
+<b>
+<a>8</a>
+<b>14</b>
+<v>18715</v>
+</b>
+<b>
+<a>14</a>
+<b>15</b>
+<v>30262</v>
+</b>
+<b>
+<a>15</a>
+<b>19</b>
+<v>24946</v>
+</b>
+<b>
+<a>19</a>
+<b>24</b>
+<v>17066</v>
+</b>
+<b>
+<a>24</a>
+<b>29</b>
+<v>22451</v>
+</b>
+<b>
+<a>29</a>
+<b>56</b>
+<v>21060</v>
+</b>
+<b>
+<a>56</a>
+<b>237</b>
+<v>20821</v>
+</b>
+<b>
+<a>237</a>
+<b>134470</b>
+<v>4919</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>117975</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>120803</v>
+</b>
+<b>
+<a>3</a>
+<b>8</b>
+<v>21076</v>
+</b>
+<b>
+<a>8</a>
+<b>6458</b>
+<v>17551</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>243883</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>23431</v>
+</b>
+<b>
+<a>4</a>
+<b>71</b>
+<v>10091</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>5</b>
+<v>667</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>116499</v>
+</b>
+<b>
+<a>6</a>
+<b>11</b>
+<v>19057</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>32046</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>18779</v>
+</b>
+<b>
+<a>15</a>
+<b>17</b>
+<v>18710</v>
+</b>
+<b>
+<a>17</a>
+<b>21</b>
+<v>21785</v>
+</b>
+<b>
+<a>21</a>
+<b>31</b>
+<v>21103</v>
+</b>
+<b>
+<a>31</a>
+<b>63</b>
+<v>20930</v>
+</b>
+<b>
+<a>63</a>
+<b>94454</b>
+<v>7829</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>5</b>
+<v>667</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>116499</v>
+</b>
+<b>
+<a>6</a>
+<b>12</b>
+<v>21177</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
+<v>28718</v>
+</b>
+<b>
+<a>13</a>
+<b>16</b>
+<v>19585</v>
+</b>
+<b>
+<a>16</a>
+<b>18</b>
+<v>21210</v>
+</b>
+<b>
+<a>18</a>
+<b>23</b>
+<v>23344</v>
+</b>
+<b>
+<a>23</a>
+<b>35</b>
+<v>21013</v>
+</b>
+<b>
+<a>35</a>
+<b>80</b>
+<v>20938</v>
+</b>
+<b>
+<a>80</a>
+<b>94454</b>
+<v>4254</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4439</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8489</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>12884</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>16048</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>15554</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>12546</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>9231</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>6405</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9266</v>
+</b>
+<b>
+<a>11</a>
+<b>14</b>
+<v>10367</v>
+</b>
+<b>
+<a>14</a>
+<b>20</b>
+<v>9186</v>
+</b>
+<b>
+<a>20</a>
+<b>489713</b>
+<v>3453</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>68569</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>15919</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>7876</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>9221</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>8062</v>
+</b>
+<b>
+<a>6</a>
+<b>6458</b>
+<v>8221</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6848</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>15273</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>24807</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>25343</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>10180</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>6269</v>
+</b>
+<b>
+<a>7</a>
+<b>9</b>
+<v>10857</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9251</v>
+</b>
+<b>
+<a>11</a>
+<b>1768</b>
+<v>8841</v>
+</b>
+<b>
+<a>1780</a>
+<b>212575</b>
+<v>199</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15842</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>27460</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>26707</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>18639</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>11518</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>10766</v>
+</b>
+<b>
+<a>8</a>
+<b>265</b>
+<v>6936</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6850</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>15271</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>24807</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>25343</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>10180</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>6269</v>
+</b>
+<b>
+<a>7</a>
+<b>9</b>
+<v>10858</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>9252</v>
+</b>
+<b>
+<a>11</a>
+<b>1789</b>
+<v>8841</v>
+</b>
+<b>
+<a>1795</a>
+<b>212360</b>
+<v>197</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>numlines</name>
+<cardinality>122044</cardinality>
+<columnsizes>
+<e>
+<k>element_id</k>
+<v>122044</v>
+</e>
+<e>
+<k>num_lines</k>
+<v>1136</v>
+</e>
+<e>
+<k>num_code</k>
+<v>939</v>
+</e>
+<e>
+<k>num_comment</k>
+<v>418</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>element_id</src>
+<trg>num_lines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>122044</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>element_id</src>
+<trg>num_code</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>122044</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>element_id</src>
+<trg>num_comment</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>122044</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_lines</src>
+<trg>element_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>399</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>144</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>97</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>91</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>86</v>
+</b>
+<b>
+<a>9</a>
+<b>15</b>
+<v>90</v>
+</b>
+<b>
+<a>15</a>
+<b>36</b>
+<v>86</v>
+</b>
+<b>
+<a>36</a>
+<b>174</b>
+<v>86</v>
+</b>
+<b>
+<a>175</a>
+<b>21589</b>
+<v>57</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_lines</src>
+<trg>num_code</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>444</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>140</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>95</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>87</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>85</v>
+</b>
+<b>
+<a>9</a>
+<b>14</b>
+<v>88</v>
+</b>
+<b>
+<a>14</a>
+<b>24</b>
+<v>90</v>
+</b>
+<b>
+<a>24</a>
+<b>33</b>
+<v>89</v>
+</b>
+<b>
+<a>33</a>
+<b>38</b>
+<v>18</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_lines</src>
+<trg>num_comment</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>444</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>140</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>94</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>92</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>90</v>
+</b>
+<b>
+<a>9</a>
+<b>14</b>
+<v>90</v>
+</b>
+<b>
+<a>14</a>
+<b>20</b>
+<v>89</v>
+</b>
+<b>
+<a>20</a>
+<b>27</b>
+<v>89</v>
+</b>
+<b>
+<a>27</a>
+<b>30</b>
+<v>8</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_code</src>
+<trg>element_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>317</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>125</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>67</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>61</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>67</v>
+</b>
+<b>
+<a>8</a>
+<b>12</b>
+<v>73</v>
+</b>
+<b>
+<a>12</a>
+<b>26</b>
+<v>72</v>
+</b>
+<b>
+<a>26</a>
+<b>69</b>
+<v>71</v>
+</b>
+<b>
+<a>69</a>
+<b>1540</b>
+<v>71</v>
+</b>
+<b>
+<a>1747</a>
+<b>22000</b>
+<v>15</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_code</src>
+<trg>num_lines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>349</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>118</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>77</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>76</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>84</v>
+</b>
+<b>
+<a>10</a>
+<b>19</b>
+<v>78</v>
+</b>
+<b>
+<a>19</a>
+<b>31</b>
+<v>79</v>
+</b>
+<b>
+<a>31</a>
+<b>44</b>
+<v>73</v>
+</b>
+<b>
+<a>44</a>
+<b>52</b>
+<v>5</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_code</src>
+<trg>num_comment</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>347</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>121</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>79</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>74</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>74</v>
+</b>
+<b>
+<a>9</a>
+<b>16</b>
+<v>80</v>
+</b>
+<b>
+<a>16</a>
+<b>23</b>
+<v>72</v>
+</b>
+<b>
+<a>23</a>
+<b>31</b>
+<v>76</v>
+</b>
+<b>
+<a>31</a>
+<b>40</b>
+<v>16</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_comment</src>
+<trg>element_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>147</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>67</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>26</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>26</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>32</v>
+</b>
+<b>
+<a>7</a>
+<b>12</b>
+<v>34</v>
+</b>
+<b>
+<a>12</a>
+<b>32</b>
+<v>34</v>
+</b>
+<b>
+<a>33</a>
+<b>135</b>
+<v>32</v>
+</b>
+<b>
+<a>150</a>
+<b>93795</b>
+<v>20</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_comment</src>
+<trg>num_lines</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>171</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>57</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>32</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>24</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>33</v>
+</b>
+<b>
+<a>8</a>
+<b>18</b>
+<v>35</v>
+</b>
+<b>
+<a>19</a>
+<b>47</b>
+<v>32</v>
+</b>
+<b>
+<a>52</a>
+<b>253</b>
+<v>33</v>
+</b>
+<b>
+<a>362</a>
+<b>363</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num_comment</src>
+<trg>num_code</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>174</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>54</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>33</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>22</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>33</v>
+</b>
+<b>
+<a>8</a>
+<b>18</b>
+<v>36</v>
+</b>
+<b>
+<a>19</a>
+<b>47</b>
+<v>32</v>
+</b>
+<b>
+<a>51</a>
+<b>230</b>
+<v>32</v>
+</b>
+<b>
+<a>232</a>
+<b>346</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>files</name>
+<key>id</key>
+<cardinality>6457</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>6457</v>
+</e>
+<e>
+<k>name</k>
+<v>6457</v>
+</e>
+<e>
+<k>simple</k>
+<v>4188</v>
+</e>
+<e>
+<k>ext</k>
+<v>4</v>
+</e>
+<e>
+<k>fromSource</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6457</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>simple</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6457</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>ext</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6457</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>fromSource</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6457</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6457</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>simple</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6457</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>ext</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6457</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>fromSource</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6457</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>simple</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3423</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>507</v>
+</b>
+<b>
+<a>3</a>
+<b>305</b>
+<v>258</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>simple</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3423</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>507</v>
+</b>
+<b>
+<a>3</a>
+<b>305</b>
+<v>258</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>simple</src>
+<trg>ext</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3960</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>228</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>simple</src>
+<trg>fromSource</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4188</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>ext</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>21</a>
+<b>22</b>
+<v>1</v>
+</b>
+<b>
+<a>480</a>
+<b>481</b>
+<v>1</v>
+</b>
+<b>
+<a>756</a>
+<b>757</b>
+<v>1</v>
+</b>
+<b>
+<a>5200</a>
+<b>5201</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>ext</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>21</a>
+<b>22</b>
+<v>1</v>
+</b>
+<b>
+<a>480</a>
+<b>481</b>
+<v>1</v>
+</b>
+<b>
+<a>756</a>
+<b>757</b>
+<v>1</v>
+</b>
+<b>
+<a>5200</a>
+<b>5201</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>ext</src>
+<trg>simple</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>21</a>
+<b>22</b>
+<v>1</v>
+</b>
+<b>
+<a>118</a>
+<b>119</b>
+<v>1</v>
+</b>
+<b>
+<a>428</a>
+<b>429</b>
+<v>1</v>
+</b>
+<b>
+<a>3858</a>
+<b>3859</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>ext</src>
+<trg>fromSource</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fromSource</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>6457</a>
+<b>6458</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fromSource</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>6457</a>
+<b>6458</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fromSource</src>
+<trg>simple</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4188</a>
+<b>4189</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fromSource</src>
+<trg>ext</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>folders</name>
+<key>id</key>
+<cardinality>1590</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1590</v>
+</e>
+<e>
+<k>name</k>
+<v>1590</v>
+</e>
+<e>
+<k>simple</k>
+<v>645</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1590</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>simple</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1590</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1590</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>simple</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1590</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>simple</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>425</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>127</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>58</v>
+</b>
+<b>
+<a>6</a>
+<b>113</b>
+<v>35</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>simple</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>425</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>127</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>58</v>
+</b>
+<b>
+<a>6</a>
+<b>113</b>
+<v>35</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>containerparent</name>
+<key>child</key>
+<cardinality>8046</cardinality>
+<columnsizes>
+<e>
+<k>parent</k>
+<v>1590</v>
+</e>
+<e>
+<k>child</k>
+<v>8046</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>parent</src>
+<trg>child</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>525</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>326</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>207</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>128</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>138</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>132</v>
+</b>
+<b>
+<a>11</a>
+<b>53</b>
+<v>120</v>
+</b>
+<b>
+<a>60</a>
+<b>335</b>
+<v>14</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>child</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8046</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>duplicateCode</name>
+<key>id</key>
+<cardinality>6210</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>6210</v>
+</e>
+<e>
+<k>relativePath</k>
+<v>932</v>
+</e>
+<e>
+<k>equivClass</k>
+<v>2355</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>relativePath</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6210</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>equivClass</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6210</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>relativePath</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>377</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>182</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>92</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>78</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>84</v>
+</b>
+<b>
+<a>9</a>
+<b>18</b>
+<v>70</v>
+</b>
+<b>
+<a>18</a>
+<b>914</b>
+<v>49</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>relativePath</src>
+<trg>equivClass</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>439</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>147</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>105</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>85</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>75</v>
+</b>
+<b>
+<a>10</a>
+<b>60</b>
+<v>70</v>
+</b>
+<b>
+<a>63</a>
+<b>355</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>equivClass</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1669</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>311</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>166</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>183</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>20</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>equivClass</src>
+<trg>relativePath</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>825</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1111</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>202</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>177</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>40</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>similarCode</name>
+<key>id</key>
+<cardinality>21595</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>21595</v>
+</e>
+<e>
+<k>relativePath</k>
+<v>1742</v>
+</e>
+<e>
+<k>equivClass</k>
+<v>7221</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>relativePath</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21595</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>equivClass</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21595</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>relativePath</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>454</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>351</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>143</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>141</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>115</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>126</v>
+</b>
+<b>
+<a>8</a>
+<b>12</b>
+<v>147</v>
+</b>
+<b>
+<a>12</a>
+<b>23</b>
+<v>139</v>
+</b>
+<b>
+<a>23</a>
+<b>5898</b>
+<v>126</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>relativePath</src>
+<trg>equivClass</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>632</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>276</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>200</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>144</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>94</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>158</v>
+</b>
+<b>
+<a>9</a>
+<b>15</b>
+<v>139</v>
+</b>
+<b>
+<a>15</a>
+<b>1799</b>
+<v>99</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>equivClass</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>54</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4290</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1200</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>662</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>583</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>432</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>equivClass</src>
+<trg>relativePath</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4536</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1858</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>611</v>
+</b>
+<b>
+<a>5</a>
+<b>11</b>
+<v>216</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>tokens</name>
+<cardinality>5806732</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>27805</v>
+</e>
+<e>
+<k>offset</k>
+<v>56799</v>
+</e>
+<e>
+<k>beginLine</k>
+<v>167308</v>
+</e>
+<e>
+<k>beginColumn</k>
+<v>1853</v>
+</e>
+<e>
+<k>endLine</k>
+<v>167308</v>
+</e>
+<e>
+<k>endColumn</k>
+<v>1875</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>offset</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>100</a>
+<b>101</b>
+<v>2031</v>
+</b>
+<b>
+<a>101</a>
+<b>102</b>
+<v>1683</v>
+</b>
+<b>
+<a>102</a>
+<b>103</b>
+<v>1387</v>
+</b>
+<b>
+<a>103</a>
+<b>105</b>
+<v>2060</v>
+</b>
+<b>
+<a>105</a>
+<b>108</b>
+<v>2278</v>
+</b>
+<b>
+<a>108</a>
+<b>111</b>
+<v>2079</v>
+</b>
+<b>
+<a>111</a>
+<b>116</b>
+<v>2106</v>
+</b>
+<b>
+<a>116</a>
+<b>124</b>
+<v>2280</v>
+</b>
+<b>
+<a>124</a>
+<b>135</b>
+<v>2235</v>
+</b>
+<b>
+<a>135</a>
+<b>152</b>
+<v>2091</v>
+</b>
+<b>
+<a>152</a>
+<b>180</b>
+<v>2104</v>
+</b>
+<b>
+<a>180</a>
+<b>221</b>
+<v>2095</v>
+</b>
+<b>
+<a>221</a>
+<b>380</b>
+<v>2088</v>
+</b>
+<b>
+<a>381</a>
+<b>56800</b>
+<v>1288</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>10</b>
+<v>2063</v>
+</b>
+<b>
+<a>10</a>
+<b>12</b>
+<v>1754</v>
+</b>
+<b>
+<a>12</a>
+<b>14</b>
+<v>2423</v>
+</b>
+<b>
+<a>14</a>
+<b>15</b>
+<v>1299</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>1542</v>
+</b>
+<b>
+<a>16</a>
+<b>17</b>
+<v>1745</v>
+</b>
+<b>
+<a>17</a>
+<b>18</b>
+<v>1470</v>
+</b>
+<b>
+<a>18</a>
+<b>19</b>
+<v>1471</v>
+</b>
+<b>
+<a>19</a>
+<b>21</b>
+<v>2512</v>
+</b>
+<b>
+<a>21</a>
+<b>23</b>
+<v>2101</v>
+</b>
+<b>
+<a>23</a>
+<b>26</b>
+<v>2365</v>
+</b>
+<b>
+<a>26</a>
+<b>30</b>
+<v>2157</v>
+</b>
+<b>
+<a>30</a>
+<b>39</b>
+<v>2231</v>
+</b>
+<b>
+<a>39</a>
+<b>102</b>
+<v>2089</v>
+</b>
+<b>
+<a>102</a>
+<b>11362</b>
+<v>583</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>20</b>
+<v>2045</v>
+</b>
+<b>
+<a>20</a>
+<b>23</b>
+<v>2118</v>
+</b>
+<b>
+<a>23</a>
+<b>27</b>
+<v>2074</v>
+</b>
+<b>
+<a>27</a>
+<b>32</b>
+<v>2493</v>
+</b>
+<b>
+<a>32</a>
+<b>37</b>
+<v>2166</v>
+</b>
+<b>
+<a>37</a>
+<b>42</b>
+<v>2474</v>
+</b>
+<b>
+<a>42</a>
+<b>46</b>
+<v>2394</v>
+</b>
+<b>
+<a>46</a>
+<b>49</b>
+<v>2000</v>
+</b>
+<b>
+<a>49</a>
+<b>52</b>
+<v>2047</v>
+</b>
+<b>
+<a>52</a>
+<b>56</b>
+<v>2169</v>
+</b>
+<b>
+<a>56</a>
+<b>62</b>
+<v>2317</v>
+</b>
+<b>
+<a>62</a>
+<b>73</b>
+<v>2113</v>
+</b>
+<b>
+<a>73</a>
+<b>528</b>
+<v>1395</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>10</b>
+<v>2059</v>
+</b>
+<b>
+<a>10</a>
+<b>12</b>
+<v>1756</v>
+</b>
+<b>
+<a>12</a>
+<b>14</b>
+<v>2425</v>
+</b>
+<b>
+<a>14</a>
+<b>15</b>
+<v>1299</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>1519</v>
+</b>
+<b>
+<a>16</a>
+<b>17</b>
+<v>1758</v>
+</b>
+<b>
+<a>17</a>
+<b>18</b>
+<v>1476</v>
+</b>
+<b>
+<a>18</a>
+<b>19</b>
+<v>1472</v>
+</b>
+<b>
+<a>19</a>
+<b>21</b>
+<v>2515</v>
+</b>
+<b>
+<a>21</a>
+<b>23</b>
+<v>2101</v>
+</b>
+<b>
+<a>23</a>
+<b>26</b>
+<v>2362</v>
+</b>
+<b>
+<a>26</a>
+<b>30</b>
+<v>2158</v>
+</b>
+<b>
+<a>30</a>
+<b>39</b>
+<v>2225</v>
+</b>
+<b>
+<a>39</a>
+<b>101</b>
+<v>2089</v>
+</b>
+<b>
+<a>101</a>
+<b>11362</b>
+<v>591</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>21</b>
+<v>2155</v>
+</b>
+<b>
+<a>21</a>
+<b>24</b>
+<v>2138</v>
+</b>
+<b>
+<a>24</a>
+<b>30</b>
+<v>2470</v>
+</b>
+<b>
+<a>30</a>
+<b>35</b>
+<v>2169</v>
+</b>
+<b>
+<a>35</a>
+<b>41</b>
+<v>2390</v>
+</b>
+<b>
+<a>41</a>
+<b>45</b>
+<v>2025</v>
+</b>
+<b>
+<a>45</a>
+<b>49</b>
+<v>2451</v>
+</b>
+<b>
+<a>49</a>
+<b>52</b>
+<v>2070</v>
+</b>
+<b>
+<a>52</a>
+<b>55</b>
+<v>2094</v>
+</b>
+<b>
+<a>55</a>
+<b>59</b>
+<v>2200</v>
+</b>
+<b>
+<a>59</a>
+<b>65</b>
+<v>2223</v>
+</b>
+<b>
+<a>65</a>
+<b>76</b>
+<v>2124</v>
+</b>
+<b>
+<a>76</a>
+<b>528</b>
+<v>1296</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>offset</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>13</b>
+<v>2042</v>
+</b>
+<b>
+<a>16</a>
+<b>17</b>
+<v>37935</v>
+</b>
+<b>
+<a>18</a>
+<b>19</b>
+<v>3184</v>
+</b>
+<b>
+<a>20</a>
+<b>21</b>
+<v>3634</v>
+</b>
+<b>
+<a>22</a>
+<b>31</b>
+<v>4534</v>
+</b>
+<b>
+<a>32</a>
+<b>276</b>
+<v>4265</v>
+</b>
+<b>
+<a>277</a>
+<b>27806</b>
+<v>1205</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>offset</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2040</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>37937</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>3184</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
+<v>3634</v>
+</b>
+<b>
+<a>13</a>
+<b>18</b>
+<v>4342</v>
+</b>
+<b>
+<a>18</a>
+<b>131</b>
+<v>4269</v>
+</b>
+<b>
+<a>131</a>
+<b>10163</b>
+<v>1393</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>offset</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>40044</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4434</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3310</v>
+</b>
+<b>
+<a>4</a>
+<b>11</b>
+<v>4641</v>
+</b>
+<b>
+<a>11</a>
+<b>152</b>
+<v>4260</v>
+</b>
+<b>
+<a>152</a>
+<b>317</b>
+<v>110</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>offset</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2040</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>37937</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>3184</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
+<v>3634</v>
+</b>
+<b>
+<a>13</a>
+<b>18</b>
+<v>4342</v>
+</b>
+<b>
+<a>18</a>
+<b>131</b>
+<v>4269</v>
+</b>
+<b>
+<a>131</a>
+<b>10163</b>
+<v>1393</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>offset</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>40085</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3591</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3628</v>
+</b>
+<b>
+<a>4</a>
+<b>9</b>
+<v>4339</v>
+</b>
+<b>
+<a>9</a>
+<b>62</b>
+<v>4261</v>
+</b>
+<b>
+<a>62</a>
+<b>326</b>
+<v>895</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15579</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>110688</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>8065</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>13975</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>12842</v>
+</b>
+<b>
+<a>13</a>
+<b>1717</b>
+<v>6159</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>offset</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>5</b>
+<v>9257</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>90442</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>13474</v>
+</b>
+<b>
+<a>9</a>
+<b>12</b>
+<v>11463</v>
+</b>
+<b>
+<a>12</a>
+<b>19</b>
+<v>13584</v>
+</b>
+<b>
+<a>19</a>
+<b>33</b>
+<v>13154</v>
+</b>
+<b>
+<a>33</a>
+<b>89</b>
+<v>12558</v>
+</b>
+<b>
+<a>89</a>
+<b>646</b>
+<v>3376</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>4</b>
+<v>12049</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>4348</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>101350</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>13619</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>8078</v>
+</b>
+<b>
+<a>11</a>
+<b>15</b>
+<v>13132</v>
+</b>
+<b>
+<a>15</a>
+<b>50</b>
+<v>12597</v>
+</b>
+<b>
+<a>50</a>
+<b>581</b>
+<v>2135</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>167235</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>73</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginLine</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>4</b>
+<v>12051</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>4298</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>101396</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>13614</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>8126</v>
+</b>
+<b>
+<a>11</a>
+<b>15</b>
+<v>13109</v>
+</b>
+<b>
+<a>15</a>
+<b>51</b>
+<v>12592</v>
+</b>
+<b>
+<a>51</a>
+<b>589</b>
+<v>2122</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>588</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>318</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>151</v>
+</b>
+<b>
+<a>6</a>
+<b>12</b>
+<v>143</v>
+</b>
+<b>
+<a>12</a>
+<b>24</b>
+<v>145</v>
+</b>
+<b>
+<a>24</a>
+<b>36</b>
+<v>142</v>
+</b>
+<b>
+<a>36</a>
+<b>86</b>
+<v>139</v>
+</b>
+<b>
+<a>87</a>
+<b>1324</b>
+<v>139</v>
+</b>
+<b>
+<a>1373</a>
+<b>23504</b>
+<v>88</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>offset</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>590</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>319</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>144</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>139</v>
+</b>
+<b>
+<a>9</a>
+<b>13</b>
+<v>155</v>
+</b>
+<b>
+<a>13</a>
+<b>21</b>
+<v>145</v>
+</b>
+<b>
+<a>21</a>
+<b>59</b>
+<v>142</v>
+</b>
+<b>
+<a>59</a>
+<b>458</b>
+<v>139</v>
+</b>
+<b>
+<a>546</a>
+<b>15972</b>
+<v>80</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1018</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>119</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>157</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>146</v>
+</b>
+<b>
+<a>13</a>
+<b>24</b>
+<v>139</v>
+</b>
+<b>
+<a>24</a>
+<b>141</b>
+<v>140</v>
+</b>
+<b>
+<a>145</a>
+<b>127333</b>
+<v>134</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1018</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>119</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>157</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>146</v>
+</b>
+<b>
+<a>13</a>
+<b>24</b>
+<v>139</v>
+</b>
+<b>
+<a>24</a>
+<b>141</b>
+<v>140</v>
+</b>
+<b>
+<a>145</a>
+<b>127333</b>
+<v>134</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>beginColumn</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1101</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>190</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>146</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>164</v>
+</b>
+<b>
+<a>7</a>
+<b>19</b>
+<v>151</v>
+</b>
+<b>
+<a>19</a>
+<b>169</b>
+<v>101</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15579</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>110688</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>8065</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>13975</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>12842</v>
+</b>
+<b>
+<a>13</a>
+<b>1717</b>
+<v>6159</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>offset</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>5</b>
+<v>9257</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>90442</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>13474</v>
+</b>
+<b>
+<a>9</a>
+<b>12</b>
+<v>11463</v>
+</b>
+<b>
+<a>12</a>
+<b>19</b>
+<v>13584</v>
+</b>
+<b>
+<a>19</a>
+<b>33</b>
+<v>13154</v>
+</b>
+<b>
+<a>33</a>
+<b>89</b>
+<v>12558</v>
+</b>
+<b>
+<a>89</a>
+<b>646</b>
+<v>3376</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>167235</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>73</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>4</b>
+<v>12049</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>4348</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>101350</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>13619</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>8078</v>
+</b>
+<b>
+<a>11</a>
+<b>15</b>
+<v>13132</v>
+</b>
+<b>
+<a>15</a>
+<b>50</b>
+<v>12597</v>
+</b>
+<b>
+<a>50</a>
+<b>581</b>
+<v>2135</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endLine</src>
+<trg>endColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>4</b>
+<v>12051</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>4298</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>101396</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>13614</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>8126</v>
+</b>
+<b>
+<a>11</a>
+<b>15</b>
+<v>13111</v>
+</b>
+<b>
+<a>15</a>
+<b>51</b>
+<v>12590</v>
+</b>
+<b>
+<a>51</a>
+<b>589</b>
+<v>2122</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>594</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>327</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>150</v>
+</b>
+<b>
+<a>6</a>
+<b>12</b>
+<v>141</v>
+</b>
+<b>
+<a>12</a>
+<b>23</b>
+<v>144</v>
+</b>
+<b>
+<a>23</a>
+<b>36</b>
+<v>142</v>
+</b>
+<b>
+<a>36</a>
+<b>81</b>
+<v>142</v>
+</b>
+<b>
+<a>83</a>
+<b>1013</b>
+<v>141</v>
+</b>
+<b>
+<a>1068</a>
+<b>22526</b>
+<v>94</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>offset</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>594</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>331</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>148</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>147</v>
+</b>
+<b>
+<a>9</a>
+<b>14</b>
+<v>161</v>
+</b>
+<b>
+<a>14</a>
+<b>23</b>
+<v>151</v>
+</b>
+<b>
+<a>23</a>
+<b>72</b>
+<v>143</v>
+</b>
+<b>
+<a>72</a>
+<b>1221</b>
+<v>141</v>
+</b>
+<b>
+<a>1224</a>
+<b>16225</b>
+<v>59</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>beginLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1020</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>140</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>151</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>146</v>
+</b>
+<b>
+<a>13</a>
+<b>25</b>
+<v>143</v>
+</b>
+<b>
+<a>25</a>
+<b>158</b>
+<v>142</v>
+</b>
+<b>
+<a>160</a>
+<b>129820</b>
+<v>133</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>beginColumn</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1097</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>214</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>119</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>146</v>
+</b>
+<b>
+<a>6</a>
+<b>14</b>
+<v>141</v>
+</b>
+<b>
+<a>14</a>
+<b>56</b>
+<v>141</v>
+</b>
+<b>
+<a>57</a>
+<b>66</b>
+<v>17</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>endColumn</src>
+<trg>endLine</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1020</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>140</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>151</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>146</v>
+</b>
+<b>
+<a>13</a>
+<b>25</b>
+<v>143</v>
+</b>
+<b>
+<a>25</a>
+<b>158</b>
+<v>142</v>
+</b>
+<b>
+<a>160</a>
+<b>129820</b>
+<v>133</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>externalData</name>
+<cardinality>5684</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>950</v>
+</e>
+<e>
+<k>path</k>
+<v>3</v>
+</e>
+<e>
+<k>column</k>
+<v>6</v>
+</e>
+<e>
+<k>value</k>
+<v>790</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>path</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>950</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>column</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>946</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>6</b>
+<v>8</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>942</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>path</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>72</a>
+<b>73</b>
+<v>1</v>
+</b>
+<b>
+<a>874</a>
+<b>875</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>path</src>
+<trg>column</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>path</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>86</a>
+<b>87</b>
+<v>1</v>
+</b>
+<b>
+<a>722</a>
+<b>723</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>column</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>946</a>
+<b>947</b>
+<v>4</v>
+</b>
+<b>
+<a>950</a>
+<b>951</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>column</src>
+<trg>path</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>column</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>31</a>
+<b>32</b>
+<v>1</v>
+</b>
+<b>
+<a>93</a>
+<b>94</b>
+<v>1</v>
+</b>
+<b>
+<a>117</a>
+<b>118</b>
+<v>1</v>
+</b>
+<b>
+<a>620</a>
+<b>621</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>478</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>132</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>69</v>
+</b>
+<b>
+<a>5</a>
+<b>16</b>
+<v>61</v>
+</b>
+<b>
+<a>16</a>
+<b>928</b>
+<v>50</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>path</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>764</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>26</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>column</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>711</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>79</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>snapshotDate</name>
+<key>snapshotDate</key>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>snapshotDate</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>sourceLocationPrefix</name>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>prefix</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>toplevels</name>
+<key>id</key>
+<cardinality>5320</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>5320</v>
+</e>
+<e>
+<k>kind</k>
+<v>4</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5320</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>31</a>
+<b>32</b>
+<v>1</v>
+</b>
+<b>
+<a>86</a>
+<b>87</b>
+<v>1</v>
+</b>
+<b>
+<a>5200</a>
+<b>5201</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_externs</name>
+<cardinality>44</cardinality>
+<columnsizes>
+<e>
+<k>toplevel</k>
+<v>44</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_instantiated</name>
+<cardinality>5</cardinality>
+<columnsizes>
+<e>
+<k>decl</k>
+<v>5</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>has_declare_keyword</name>
+<cardinality>66</cardinality>
+<columnsizes>
+<e>
+<k>stmt</k>
+<v>66</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>has_asserts_keyword</name>
+<cardinality>66</cardinality>
+<columnsizes>
+<e>
+<k>node</k>
+<v>66</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_abstract_member</name>
+<cardinality>66</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>66</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>has_public_keyword</name>
+<cardinality>9297</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>9297</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>has_private_keyword</name>
+<cardinality>11391</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>11391</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>has_protected_keyword</name>
+<cardinality>1048</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1048</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>has_readonly_keyword</name>
+<cardinality>2338</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>2338</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>has_type_keyword</name>
+<cardinality>1000</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1000</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_optional_member</name>
+<cardinality>3668</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>3668</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>has_definite_assignment_assertion</name>
+<cardinality>100</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>100</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_optional_parameter_declaration</name>
+<cardinality>3966</cardinality>
+<columnsizes>
+<e>
+<k>parameter</k>
+<v>3966</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>parameter_fields</name>
+<cardinality>2693</cardinality>
+<columnsizes>
+<e>
+<k>field</k>
+<v>2693</v>
+</e>
+<e>
+<k>constructor</k>
+<v>1020</v>
+</e>
+<e>
+<k>param_index</k>
+<v>20</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>field</src>
+<trg>constructor</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2693</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>field</src>
+<trg>param_index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2693</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>constructor</src>
+<trg>field</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>439</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>233</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>118</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>78</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>83</v>
+</b>
+<b>
+<a>7</a>
+<b>21</b>
+<v>69</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>constructor</src>
+<trg>param_index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>439</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>233</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>118</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>78</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>83</v>
+</b>
+<b>
+<a>7</a>
+<b>21</b>
+<v>69</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>param_index</src>
+<trg>field</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>1</v>
+</b>
+<b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+<b>
+<a>29</a>
+<b>30</b>
+<v>1</v>
+</b>
+<b>
+<a>36</a>
+<b>37</b>
+<v>1</v>
+</b>
+<b>
+<a>48</a>
+<b>49</b>
+<v>1</v>
+</b>
+<b>
+<a>69</a>
+<b>70</b>
+<v>1</v>
+</b>
+<b>
+<a>104</a>
+<b>105</b>
+<v>1</v>
+</b>
+<b>
+<a>152</a>
+<b>153</b>
+<v>1</v>
+</b>
+<b>
+<a>230</a>
+<b>231</b>
+<v>1</v>
+</b>
+<b>
+<a>348</a>
+<b>349</b>
+<v>1</v>
+</b>
+<b>
+<a>581</a>
+<b>582</b>
+<v>1</v>
+</b>
+<b>
+<a>1020</a>
+<b>1021</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>param_index</src>
+<trg>constructor</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>1</v>
+</b>
+<b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+<b>
+<a>29</a>
+<b>30</b>
+<v>1</v>
+</b>
+<b>
+<a>36</a>
+<b>37</b>
+<v>1</v>
+</b>
+<b>
+<a>48</a>
+<b>49</b>
+<v>1</v>
+</b>
+<b>
+<a>69</a>
+<b>70</b>
+<v>1</v>
+</b>
+<b>
+<a>104</a>
+<b>105</b>
+<v>1</v>
+</b>
+<b>
+<a>152</a>
+<b>153</b>
+<v>1</v>
+</b>
+<b>
+<a>230</a>
+<b>231</b>
+<v>1</v>
+</b>
+<b>
+<a>348</a>
+<b>349</b>
+<v>1</v>
+</b>
+<b>
+<a>581</a>
+<b>582</b>
+<v>1</v>
+</b>
+<b>
+<a>1020</a>
+<b>1021</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_const_enum</name>
+<cardinality>62</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>62</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_abstract_class</name>
+<cardinality>116</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>116</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>typeexprs</name>
+<cardinality>54050</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>54050</v>
+</e>
+<e>
+<k>kind</k>
+<v>6</v>
+</e>
+<e>
+<k>parent</k>
+<v>29264</v>
+</e>
+<e>
+<k>idx</k>
+<v>26</v>
+</e>
+<e>
+<k>tostring</k>
+<v>3278</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>54050</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>54050</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>54050</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>54050</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>733</a>
+<b>734</b>
+<v>1</v>
+</b>
+<b>
+<a>2513</a>
+<b>2514</b>
+<v>1</v>
+</b>
+<b>
+<a>25306</a>
+<b>25307</b>
+<v>1</v>
+</b>
+<b>
+<a>25491</a>
+<b>25492</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>733</a>
+<b>734</b>
+<v>1</v>
+</b>
+<b>
+<a>2513</a>
+<b>2514</b>
+<v>1</v>
+</b>
+<b>
+<a>16661</a>
+<b>16662</b>
+<v>1</v>
+</b>
+<b>
+<a>17601</a>
+<b>17602</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>19</a>
+<b>20</b>
+<v>1</v>
+</b>
+<b>
+<a>25</a>
+<b>26</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>9</a>
+<b>10</b>
+<v>1</v>
+</b>
+<b>
+<a>242</a>
+<b>243</b>
+<v>1</v>
+</b>
+<b>
+<a>2075</a>
+<b>2076</b>
+<v>1</v>
+</b>
+<b>
+<a>2322</a>
+<b>2323</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15321</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>7887</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3725</v>
+</b>
+<b>
+<a>4</a>
+<b>9</b>
+<v>2229</v>
+</b>
+<b>
+<a>9</a>
+<b>24</b>
+<v>102</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21285</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>7707</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>272</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15321</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>7887</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3725</v>
+</b>
+<b>
+<a>4</a>
+<b>9</b>
+<v>2229</v>
+</b>
+<b>
+<a>9</a>
+<b>24</b>
+<v>102</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>16315</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8432</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3126</v>
+</b>
+<b>
+<a>4</a>
+<b>22</b>
+<v>1391</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>2</v>
+</b>
+<b>
+<a>10</a>
+<b>12</b>
+<v>2</v>
+</b>
+<b>
+<a>13</a>
+<b>22</b>
+<v>2</v>
+</b>
+<b>
+<a>27</a>
+<b>38</b>
+<v>2</v>
+</b>
+<b>
+<a>54</a>
+<b>61</b>
+<v>2</v>
+</b>
+<b>
+<a>101</a>
+<b>212</b>
+<v>2</v>
+</b>
+<b>
+<a>356</a>
+<b>530</b>
+<v>2</v>
+</b>
+<b>
+<a>859</a>
+<b>1645</b>
+<v>2</v>
+</b>
+<b>
+<a>2513</a>
+<b>2519</b>
+<v>2</v>
+</b>
+<b>
+<a>3330</a>
+<b>7198</b>
+<v>2</v>
+</b>
+<b>
+<a>15305</a>
+<b>19237</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>14</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>2</v>
+</b>
+<b>
+<a>10</a>
+<b>12</b>
+<v>2</v>
+</b>
+<b>
+<a>13</a>
+<b>22</b>
+<v>2</v>
+</b>
+<b>
+<a>27</a>
+<b>38</b>
+<v>2</v>
+</b>
+<b>
+<a>54</a>
+<b>61</b>
+<v>2</v>
+</b>
+<b>
+<a>101</a>
+<b>212</b>
+<v>2</v>
+</b>
+<b>
+<a>356</a>
+<b>530</b>
+<v>2</v>
+</b>
+<b>
+<a>859</a>
+<b>1645</b>
+<v>2</v>
+</b>
+<b>
+<a>2513</a>
+<b>2519</b>
+<v>2</v>
+</b>
+<b>
+<a>3330</a>
+<b>7198</b>
+<v>2</v>
+</b>
+<b>
+<a>15305</a>
+<b>19237</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>2</v>
+</b>
+<b>
+<a>9</a>
+<b>10</b>
+<v>2</v>
+</b>
+<b>
+<a>12</a>
+<b>17</b>
+<v>2</v>
+</b>
+<b>
+<a>18</a>
+<b>26</b>
+<v>2</v>
+</b>
+<b>
+<a>28</a>
+<b>31</b>
+<v>2</v>
+</b>
+<b>
+<a>37</a>
+<b>44</b>
+<v>2</v>
+</b>
+<b>
+<a>60</a>
+<b>71</b>
+<v>2</v>
+</b>
+<b>
+<a>108</a>
+<b>196</b>
+<v>2</v>
+</b>
+<b>
+<a>395</a>
+<b>667</b>
+<v>2</v>
+</b>
+<b>
+<a>746</a>
+<b>978</b>
+<v>2</v>
+</b>
+<b>
+<a>1522</a>
+<b>2076</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1085</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>627</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>344</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>322</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>292</v>
+</b>
+<b>
+<a>7</a>
+<b>12</b>
+<v>260</v>
+</b>
+<b>
+<a>12</a>
+<b>45</b>
+<v>247</v>
+</b>
+<b>
+<a>45</a>
+<b>7788</b>
+<v>101</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1903</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1375</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1097</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>631</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>341</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>327</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>292</v>
+</b>
+<b>
+<a>7</a>
+<b>12</b>
+<v>253</v>
+</b>
+<b>
+<a>12</a>
+<b>48</b>
+<v>246</v>
+</b>
+<b>
+<a>48</a>
+<b>6190</b>
+<v>91</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1450</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>939</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>481</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>289</v>
+</b>
+<b>
+<a>6</a>
+<b>19</b>
+<v>119</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_for_await_of</name>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>forof</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_module</name>
+<cardinality>21</cardinality>
+<columnsizes>
+<e>
+<k>tl</k>
+<v>21</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_es2015_module</name>
+<cardinality>21</cardinality>
+<columnsizes>
+<e>
+<k>tl</k>
+<v>21</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_closure_module</name>
+<cardinality>21</cardinality>
+<columnsizes>
+<e>
+<k>tl</k>
+<v>21</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>toplevel_parent_xml_node</name>
+<cardinality>43</cardinality>
+<columnsizes>
+<e>
+<k>toplevel</k>
+<v>43</v>
+</e>
+<e>
+<k>xmlnode</k>
+<v>43</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>toplevel</src>
+<trg>xmlnode</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>43</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>xmlnode</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>43</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xml_element_parent_expression</name>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>xmlnode</k>
+<v>1</v>
+</e>
+<e>
+<k>expression</k>
+<v>1</v>
+</e>
+<e>
+<k>index</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>xmlnode</src>
+<trg>expression</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>xmlnode</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>expression</src>
+<trg>xmlnode</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>expression</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>xmlnode</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>expression</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_nodejs</name>
+<cardinality>12</cardinality>
+<columnsizes>
+<e>
+<k>tl</k>
+<v>12</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>stmts</name>
+<key>id</key>
+<cardinality>1096691</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1096691</v>
+</e>
+<e>
+<k>kind</k>
+<v>31</v>
+</e>
+<e>
+<k>parent</k>
+<v>412140</v>
+</e>
+<e>
+<k>idx</k>
+<v>152947</v>
+</e>
+<e>
+<k>tostring</k>
+<v>284956</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1096691</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1096691</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1096691</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1096691</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>2</v>
+</b>
+<b>
+<a>31</a>
+<b>42</b>
+<v>2</v>
+</b>
+<b>
+<a>61</a>
+<b>552</b>
+<v>2</v>
+</b>
+<b>
+<a>1118</a>
+<b>1137</b>
+<v>2</v>
+</b>
+<b>
+<a>1272</a>
+<b>1316</b>
+<v>2</v>
+</b>
+<b>
+<a>1316</a>
+<b>1379</b>
+<v>2</v>
+</b>
+<b>
+<a>1471</a>
+<b>1570</b>
+<v>2</v>
+</b>
+<b>
+<a>1642</a>
+<b>2306</b>
+<v>2</v>
+</b>
+<b>
+<a>3120</a>
+<b>5386</b>
+<v>2</v>
+</b>
+<b>
+<a>8674</a>
+<b>10150</b>
+<v>2</v>
+</b>
+<b>
+<a>16771</a>
+<b>48210</b>
+<v>2</v>
+</b>
+<b>
+<a>68214</a>
+<b>105607</b>
+<v>2</v>
+</b>
+<b>
+<a>204994</a>
+<b>610341</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>2</v>
+</b>
+<b>
+<a>35</a>
+<b>59</b>
+<v>2</v>
+</b>
+<b>
+<a>298</a>
+<b>424</b>
+<v>2</v>
+</b>
+<b>
+<a>738</a>
+<b>1157</b>
+<v>2</v>
+</b>
+<b>
+<a>1253</a>
+<b>1263</b>
+<v>2</v>
+</b>
+<b>
+<a>1271</a>
+<b>1321</b>
+<v>2</v>
+</b>
+<b>
+<a>1495</a>
+<b>1568</b>
+<v>2</v>
+</b>
+<b>
+<a>1642</a>
+<b>2306</b>
+<v>2</v>
+</b>
+<b>
+<a>2999</a>
+<b>4416</b>
+<v>2</v>
+</b>
+<b>
+<a>4734</a>
+<b>10123</b>
+<v>2</v>
+</b>
+<b>
+<a>48139</a>
+<b>48347</b>
+<v>2</v>
+</b>
+<b>
+<a>50857</a>
+<b>162082</b>
+<v>2</v>
+</b>
+<b>
+<a>191077</a>
+<b>191078</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>2</v>
+</b>
+<b>
+<a>10</a>
+<b>12</b>
+<v>2</v>
+</b>
+<b>
+<a>16</a>
+<b>22</b>
+<v>2</v>
+</b>
+<b>
+<a>28</a>
+<b>32</b>
+<v>2</v>
+</b>
+<b>
+<a>36</a>
+<b>37</b>
+<v>2</v>
+</b>
+<b>
+<a>39</a>
+<b>51</b>
+<v>2</v>
+</b>
+<b>
+<a>54</a>
+<b>63</b>
+<v>2</v>
+</b>
+<b>
+<a>65</a>
+<b>67</b>
+<v>2</v>
+</b>
+<b>
+<a>116</a>
+<b>118</b>
+<v>2</v>
+</b>
+<b>
+<a>122</a>
+<b>138</b>
+<v>2</v>
+</b>
+<b>
+<a>251</a>
+<b>1564</b>
+<v>2</v>
+</b>
+<b>
+<a>1967</a>
+<b>152946</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>11</b>
+<v>2</v>
+</b>
+<b>
+<a>12</a>
+<b>17</b>
+<v>2</v>
+</b>
+<b>
+<a>88</a>
+<b>104</b>
+<v>2</v>
+</b>
+<b>
+<a>147</a>
+<b>168</b>
+<v>2</v>
+</b>
+<b>
+<a>239</a>
+<b>296</b>
+<v>2</v>
+</b>
+<b>
+<a>356</a>
+<b>428</b>
+<v>2</v>
+</b>
+<b>
+<a>591</a>
+<b>705</b>
+<v>2</v>
+</b>
+<b>
+<a>811</a>
+<b>829</b>
+<v>2</v>
+</b>
+<b>
+<a>1092</a>
+<b>2254</b>
+<v>2</v>
+</b>
+<b>
+<a>2665</a>
+<b>10292</b>
+<v>2</v>
+</b>
+<b>
+<a>18023</a>
+<b>21916</b>
+<v>2</v>
+</b>
+<b>
+<a>43911</a>
+<b>180066</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>265890</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>69435</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>25109</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>34966</v>
+</b>
+<b>
+<a>8</a>
+<b>152946</b>
+<v>16740</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>319546</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>67918</v>
+</b>
+<b>
+<a>3</a>
+<b>23</b>
+<v>24676</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>265890</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>69435</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>25109</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>34966</v>
+</b>
+<b>
+<a>8</a>
+<b>152946</b>
+<v>16740</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>275359</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>62818</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>25781</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>34293</v>
+</b>
+<b>
+<a>8</a>
+<b>19511</b>
+<v>13889</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>149939</v>
+</b>
+<b>
+<a>2</a>
+<b>220361</b>
+<v>3008</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>149940</v>
+</b>
+<b>
+<a>2</a>
+<b>28</b>
+<v>3007</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>149939</v>
+</b>
+<b>
+<a>2</a>
+<b>220361</b>
+<v>3008</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>149939</v>
+</b>
+<b>
+<a>2</a>
+<b>88922</b>
+<v>3008</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>186537</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>48494</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>24651</v>
+</b>
+<b>
+<a>5</a>
+<b>37</b>
+<v>21526</v>
+</b>
+<b>
+<a>37</a>
+<b>72175</b>
+<v>3748</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>284895</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>61</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>195596</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>45562</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>23127</v>
+</b>
+<b>
+<a>5</a>
+<b>66340</b>
+<v>20671</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>225945</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>33948</v>
+</b>
+<b>
+<a>3</a>
+<b>13</b>
+<v>21496</v>
+</b>
+<b>
+<a>13</a>
+<b>903</b>
+<v>3567</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>stmt_containers</name>
+<cardinality>1096691</cardinality>
+<columnsizes>
+<e>
+<k>stmt</k>
+<v>1096691</v>
+</e>
+<e>
+<k>container</k>
+<v>120740</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>stmt</src>
+<trg>container</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1096691</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>container</src>
+<trg>stmt</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6778</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>35010</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>16178</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>12184</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>9476</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>7569</v>
+</b>
+<b>
+<a>7</a>
+<b>9</b>
+<v>10084</v>
+</b>
+<b>
+<a>9</a>
+<b>13</b>
+<v>10057</v>
+</b>
+<b>
+<a>13</a>
+<b>27</b>
+<v>9196</v>
+</b>
+<b>
+<a>27</a>
+<b>152947</b>
+<v>4208</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>jump_targets</name>
+<cardinality>11791</cardinality>
+<columnsizes>
+<e>
+<k>jump</k>
+<v>11791</v>
+</e>
+<e>
+<k>target</k>
+<v>4873</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>jump</src>
+<trg>target</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11791</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>target</src>
+<trg>jump</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2542</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1106</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>505</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>410</v>
+</b>
+<b>
+<a>6</a>
+<b>260</b>
+<v>310</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>exprs</name>
+<key>id</key>
+<cardinality>5495305</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>5495305</v>
+</e>
+<e>
+<k>kind</k>
+<v>85</v>
+</e>
+<e>
+<k>parent</k>
+<v>3130204</v>
+</e>
+<e>
+<k>idx</k>
+<v>17698</v>
+</e>
+<e>
+<k>tostring</k>
+<v>834491</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5495305</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5495305</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5495305</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5495305</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>4</b>
+<v>7</v>
+</b>
+<b>
+<a>4</a>
+<b>45</b>
+<v>7</v>
+</b>
+<b>
+<a>50</a>
+<b>97</b>
+<v>7</v>
+</b>
+<b>
+<a>108</a>
+<b>458</b>
+<v>7</v>
+</b>
+<b>
+<a>503</a>
+<b>824</b>
+<v>7</v>
+</b>
+<b>
+<a>1135</a>
+<b>2497</b>
+<v>7</v>
+</b>
+<b>
+<a>2527</a>
+<b>5439</b>
+<v>7</v>
+</b>
+<b>
+<a>5655</a>
+<b>10255</b>
+<v>7</v>
+</b>
+<b>
+<a>10789</a>
+<b>15893</b>
+<v>7</v>
+</b>
+<b>
+<a>17758</a>
+<b>42854</b>
+<v>7</v>
+</b>
+<b>
+<a>50958</a>
+<b>130844</b>
+<v>7</v>
+</b>
+<b>
+<a>245084</a>
+<b>722374</b>
+<v>7</v>
+</b>
+<b>
+<a>1295408</a>
+<b>1295409</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>3</b>
+<v>7</v>
+</b>
+<b>
+<a>3</a>
+<b>45</b>
+<v>7</v>
+</b>
+<b>
+<a>47</a>
+<b>93</b>
+<v>7</v>
+</b>
+<b>
+<a>106</a>
+<b>407</b>
+<v>7</v>
+</b>
+<b>
+<a>457</a>
+<b>809</b>
+<v>7</v>
+</b>
+<b>
+<a>1108</a>
+<b>2420</b>
+<v>7</v>
+</b>
+<b>
+<a>2502</a>
+<b>5349</b>
+<v>7</v>
+</b>
+<b>
+<a>5453</a>
+<b>10133</b>
+<v>7</v>
+</b>
+<b>
+<a>10658</a>
+<b>15697</b>
+<v>7</v>
+</b>
+<b>
+<a>16273</a>
+<b>36888</b>
+<v>7</v>
+</b>
+<b>
+<a>41849</a>
+<b>128642</b>
+<v>7</v>
+</b>
+<b>
+<a>199566</a>
+<b>722374</b>
+<v>7</v>
+</b>
+<b>
+<a>1171898</a>
+<b>1171899</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>12</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>11</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>7</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>3</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>7</v>
+</b>
+<b>
+<a>8</a>
+<b>11</b>
+<v>6</v>
+</b>
+<b>
+<a>12</a>
+<b>18</b>
+<v>7</v>
+</b>
+<b>
+<a>20</a>
+<b>64</b>
+<v>7</v>
+</b>
+<b>
+<a>82</a>
+<b>395</b>
+<v>7</v>
+</b>
+<b>
+<a>431</a>
+<b>13375</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7</v>
+</b>
+<b>
+<a>2</a>
+<b>6</b>
+<v>7</v>
+</b>
+<b>
+<a>8</a>
+<b>37</b>
+<v>7</v>
+</b>
+<b>
+<a>38</a>
+<b>126</b>
+<v>7</v>
+</b>
+<b>
+<a>142</a>
+<b>304</b>
+<v>7</v>
+</b>
+<b>
+<a>358</a>
+<b>721</b>
+<v>7</v>
+</b>
+<b>
+<a>811</a>
+<b>1485</b>
+<v>7</v>
+</b>
+<b>
+<a>1523</a>
+<b>2918</b>
+<v>7</v>
+</b>
+<b>
+<a>3305</a>
+<b>5078</b>
+<v>7</v>
+</b>
+<b>
+<a>5422</a>
+<b>9940</b>
+<v>7</v>
+</b>
+<b>
+<a>10536</a>
+<b>40606</b>
+<v>7</v>
+</b>
+<b>
+<a>46227</a>
+<b>123090</b>
+<v>7</v>
+</b>
+<b>
+<a>128754</a>
+<b>128755</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1100280</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1876078</v>
+</b>
+<b>
+<a>3</a>
+<b>17692</b>
+<v>153846</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1300246</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1747609</v>
+</b>
+<b>
+<a>3</a>
+<b>8</b>
+<v>82349</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1100280</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1876078</v>
+</b>
+<b>
+<a>3</a>
+<b>17692</b>
+<v>153846</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1108803</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1870864</v>
+</b>
+<b>
+<a>3</a>
+<b>17526</b>
+<v>150537</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4092</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1365</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1995</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>283</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1681</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>5909</v>
+</b>
+<b>
+<a>7</a>
+<b>10</b>
+<v>1344</v>
+</b>
+<b>
+<a>10</a>
+<b>3049605</b>
+<v>1029</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>10648</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>6398</v>
+</b>
+<b>
+<a>3</a>
+<b>83</b>
+<v>652</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4092</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1365</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1995</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>283</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1681</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>5909</v>
+</b>
+<b>
+<a>7</a>
+<b>10</b>
+<v>1344</v>
+</b>
+<b>
+<a>10</a>
+<b>3049605</b>
+<v>1029</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4093</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1365</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2014</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1147</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1529</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>5401</v>
+</b>
+<b>
+<a>7</a>
+<b>10</b>
+<v>1499</v>
+</b>
+<b>
+<a>10</a>
+<b>573348</b>
+<v>650</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>466570</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>157949</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>55443</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>61411</v>
+</b>
+<b>
+<a>6</a>
+<b>17</b>
+<v>63412</v>
+</b>
+<b>
+<a>17</a>
+<b>128652</b>
+<v>29706</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>772624</v>
+</b>
+<b>
+<a>2</a>
+<b>24</b>
+<v>61867</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>467110</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>158201</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>55446</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>61061</v>
+</b>
+<b>
+<a>6</a>
+<b>17</b>
+<v>63168</v>
+</b>
+<b>
+<a>17</a>
+<b>128642</b>
+<v>29505</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>724438</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>86524</v>
+</b>
+<b>
+<a>3</a>
+<b>7765</b>
+<v>23529</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>literals</name>
+<key>expr</key>
+<cardinality>3145090</cardinality>
+<columnsizes>
+<e>
+<k>value</k>
+<v>216517</v>
+</e>
+<e>
+<k>raw</k>
+<v>234110</v>
+</e>
+<e>
+<k>expr</k>
+<v>3145090</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>value</src>
+<trg>raw</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>201221</v>
+</b>
+<b>
+<a>2</a>
+<b>25</b>
+<v>15296</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>expr</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>95821</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>41222</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>19627</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>16097</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>18825</v>
+</b>
+<b>
+<a>9</a>
+<b>31</b>
+<v>16474</v>
+</b>
+<b>
+<a>31</a>
+<b>122435</b>
+<v>8451</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>raw</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>234110</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>raw</src>
+<trg>expr</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>104635</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>47230</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>20082</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>16835</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>19610</v>
+</b>
+<b>
+<a>9</a>
+<b>34</b>
+<v>17695</v>
+</b>
+<b>
+<a>34</a>
+<b>120241</b>
+<v>8023</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>expr</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3145090</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>expr</src>
+<trg>raw</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3145090</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>enclosing_stmt</name>
+<cardinality>5372899</cardinality>
+<columnsizes>
+<e>
+<k>expr</k>
+<v>5372899</v>
+</e>
+<e>
+<k>stmt</k>
+<v>854574</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>expr</src>
+<trg>stmt</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5372899</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>stmt</src>
+<trg>expr</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>3</b>
+<v>74578</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>254844</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>57228</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>136234</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>44557</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>79401</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>55420</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>63155</v>
+</b>
+<b>
+<a>11</a>
+<b>17</b>
+<v>65146</v>
+</b>
+<b>
+<a>17</a>
+<b>88321</b>
+<v>24011</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>expr_containers</name>
+<cardinality>5495305</cardinality>
+<columnsizes>
+<e>
+<k>expr</k>
+<v>5495305</v>
+</e>
+<e>
+<k>container</k>
+<v>118511</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>expr</src>
+<trg>container</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5495305</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>container</src>
+<trg>expr</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>4</b>
+<v>7197</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>9110</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>9222</v>
+</b>
+<b>
+<a>8</a>
+<b>10</b>
+<v>8424</v>
+</b>
+<b>
+<a>10</a>
+<b>13</b>
+<v>10651</v>
+</b>
+<b>
+<a>13</a>
+<b>16</b>
+<v>8706</v>
+</b>
+<b>
+<a>16</a>
+<b>20</b>
+<v>9358</v>
+</b>
+<b>
+<a>20</a>
+<b>25</b>
+<v>9955</v>
+</b>
+<b>
+<a>25</a>
+<b>31</b>
+<v>8893</v>
+</b>
+<b>
+<a>31</a>
+<b>40</b>
+<v>9356</v>
+</b>
+<b>
+<a>40</a>
+<b>54</b>
+<v>9017</v>
+</b>
+<b>
+<a>54</a>
+<b>85</b>
+<v>8935</v>
+</b>
+<b>
+<a>85</a>
+<b>484</b>
+<v>8890</v>
+</b>
+<b>
+<a>484</a>
+<b>459128</b>
+<v>797</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>array_size</name>
+<cardinality>28188</cardinality>
+<columnsizes>
+<e>
+<k>ae</k>
+<v>28188</v>
+</e>
+<e>
+<k>sz</k>
+<v>118</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>ae</src>
+<trg>sz</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>28188</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>sz</src>
+<trg>ae</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>52</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>9</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>9</v>
+</b>
+<b>
+<a>9</a>
+<b>20</b>
+<v>9</v>
+</b>
+<b>
+<a>22</a>
+<b>181</b>
+<v>9</v>
+</b>
+<b>
+<a>231</a>
+<b>12345</b>
+<v>9</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_delegating</name>
+<cardinality>4</cardinality>
+<columnsizes>
+<e>
+<k>yield</k>
+<v>4</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>scopes</name>
+<key>id</key>
+<cardinality>118172</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>118172</v>
+</e>
+<e>
+<k>kind</k>
+<v>8</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>118172</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>17</a>
+<b>18</b>
+<v>1</v>
+</b>
+<b>
+<a>21</a>
+<b>22</b>
+<v>1</v>
+</b>
+<b>
+<a>28</a>
+<b>29</b>
+<v>1</v>
+</b>
+<b>
+<a>584</a>
+<b>585</b>
+<v>1</v>
+</b>
+<b>
+<a>1272</a>
+<b>1273</b>
+<v>1</v>
+</b>
+<b>
+<a>116245</a>
+<b>116246</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>scopenodes</name>
+<cardinality>118171</cardinality>
+<columnsizes>
+<e>
+<k>node</k>
+<v>118171</v>
+</e>
+<e>
+<k>scope</k>
+<v>118171</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>node</src>
+<trg>scope</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>118171</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>scope</src>
+<trg>node</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>118171</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>scopenesting</name>
+<cardinality>118171</cardinality>
+<columnsizes>
+<e>
+<k>inner</k>
+<v>118171</v>
+</e>
+<e>
+<k>outer</k>
+<v>33143</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>inner</src>
+<trg>outer</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>118171</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>outer</src>
+<trg>inner</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>17868</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>6196</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2666</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>2791</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>2584</v>
+</b>
+<b>
+<a>13</a>
+<b>17277</b>
+<v>1038</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_generator</name>
+<cardinality>62</cardinality>
+<columnsizes>
+<e>
+<k>fun</k>
+<v>62</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>has_rest_parameter</name>
+<cardinality>33</cardinality>
+<columnsizes>
+<e>
+<k>fun</k>
+<v>33</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_async</name>
+<cardinality>50</cardinality>
+<columnsizes>
+<e>
+<k>fun</k>
+<v>50</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>variables</name>
+<key>id</key>
+<cardinality>364388</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>364388</v>
+</e>
+<e>
+<k>name</k>
+<v>56559</v>
+</e>
+<e>
+<k>scope</k>
+<v>118168</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>364388</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>scope</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>364388</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>38013</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9547</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>4518</v>
+</b>
+<b>
+<a>5</a>
+<b>115</b>
+<v>4242</v>
+</b>
+<b>
+<a>115</a>
+<b>116259</b>
+<v>239</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>scope</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>38013</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9547</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>4518</v>
+</b>
+<b>
+<a>5</a>
+<b>115</b>
+<v>4242</v>
+</b>
+<b>
+<a>115</a>
+<b>116259</b>
+<v>239</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>scope</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>39907</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>32053</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>18882</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>9814</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>10909</v>
+</b>
+<b>
+<a>8</a>
+<b>8779</b>
+<v>6603</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>scope</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>39907</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>32053</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>18882</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>9814</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>10909</v>
+</b>
+<b>
+<a>8</a>
+<b>8779</b>
+<v>6603</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>local_type_names</name>
+<cardinality>23565</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>23565</v>
+</e>
+<e>
+<k>name</k>
+<v>6080</v>
+</e>
+<e>
+<k>scope</k>
+<v>1614</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>23565</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>scope</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>23565</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2821</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1362</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>641</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>508</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>485</v>
+</b>
+<b>
+<a>13</a>
+<b>533</b>
+<v>263</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>scope</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2821</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1362</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>641</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>508</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>485</v>
+</b>
+<b>
+<a>13</a>
+<b>533</b>
+<v>263</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>scope</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>138</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>109</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>116</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>108</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>140</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>89</v>
+</b>
+<b>
+<a>8</a>
+<b>10</b>
+<v>131</v>
+</b>
+<b>
+<a>10</a>
+<b>12</b>
+<v>112</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>144</v>
+</b>
+<b>
+<a>15</a>
+<b>19</b>
+<v>134</v>
+</b>
+<b>
+<a>19</a>
+<b>25</b>
+<v>132</v>
+</b>
+<b>
+<a>25</a>
+<b>37</b>
+<v>122</v>
+</b>
+<b>
+<a>37</a>
+<b>87</b>
+<v>122</v>
+</b>
+<b>
+<a>87</a>
+<b>221</b>
+<v>17</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>scope</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>138</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>109</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>116</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>108</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>140</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>89</v>
+</b>
+<b>
+<a>8</a>
+<b>10</b>
+<v>131</v>
+</b>
+<b>
+<a>10</a>
+<b>12</b>
+<v>112</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>144</v>
+</b>
+<b>
+<a>15</a>
+<b>19</b>
+<v>134</v>
+</b>
+<b>
+<a>19</a>
+<b>25</b>
+<v>132</v>
+</b>
+<b>
+<a>25</a>
+<b>37</b>
+<v>122</v>
+</b>
+<b>
+<a>37</a>
+<b>87</b>
+<v>122</v>
+</b>
+<b>
+<a>87</a>
+<b>221</b>
+<v>17</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>local_namespace_names</name>
+<cardinality>20832</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>20832</v>
+</e>
+<e>
+<k>name</k>
+<v>4078</v>
+</e>
+<e>
+<k>scope</k>
+<v>1543</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>20832</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>scope</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>20832</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1787</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>859</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>378</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>216</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>364</v>
+</b>
+<b>
+<a>8</a>
+<b>20</b>
+<v>310</v>
+</b>
+<b>
+<a>20</a>
+<b>533</b>
+<v>164</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>scope</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1787</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>859</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>378</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>216</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>364</v>
+</b>
+<b>
+<a>8</a>
+<b>20</b>
+<v>310</v>
+</b>
+<b>
+<a>20</a>
+<b>533</b>
+<v>164</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>scope</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>88</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>123</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>120</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>104</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>107</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>70</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>87</v>
+</b>
+<b>
+<a>8</a>
+<b>10</b>
+<v>137</v>
+</b>
+<b>
+<a>10</a>
+<b>12</b>
+<v>122</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>122</v>
+</b>
+<b>
+<a>15</a>
+<b>19</b>
+<v>124</v>
+</b>
+<b>
+<a>19</a>
+<b>26</b>
+<v>120</v>
+</b>
+<b>
+<a>26</a>
+<b>39</b>
+<v>117</v>
+</b>
+<b>
+<a>39</a>
+<b>136</b>
+<v>102</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>scope</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>88</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>123</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>120</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>104</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>107</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>70</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>87</v>
+</b>
+<b>
+<a>8</a>
+<b>10</b>
+<v>137</v>
+</b>
+<b>
+<a>10</a>
+<b>12</b>
+<v>122</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>122</v>
+</b>
+<b>
+<a>15</a>
+<b>19</b>
+<v>124</v>
+</b>
+<b>
+<a>19</a>
+<b>26</b>
+<v>120</v>
+</b>
+<b>
+<a>26</a>
+<b>39</b>
+<v>117</v>
+</b>
+<b>
+<a>39</a>
+<b>136</b>
+<v>102</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_arguments_object</name>
+<cardinality>116243</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>116243</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>bind</name>
+<cardinality>1295408</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1295408</v>
+</e>
+<e>
+<k>decl</k>
+<v>224900</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>decl</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1295408</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>decl</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>81789</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>50824</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>29919</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>17755</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>16901</v>
+</b>
+<b>
+<a>7</a>
+<b>14</b>
+<v>17790</v>
+</b>
+<b>
+<a>14</a>
+<b>98305</b>
+<v>9922</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>decl</name>
+<cardinality>250257</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>250257</v>
+</e>
+<e>
+<k>decl</k>
+<v>246998</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>decl</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>250257</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>decl</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>245772</v>
+</b>
+<b>
+<a>2</a>
+<b>283</b>
+<v>1226</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>typebind</name>
+<cardinality>36216</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>36216</v>
+</e>
+<e>
+<k>decl</k>
+<v>12650</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>decl</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>36216</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>decl</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6781</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2435</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1133</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>1127</v>
+</b>
+<b>
+<a>6</a>
+<b>17</b>
+<v>954</v>
+</b>
+<b>
+<a>17</a>
+<b>524</b>
+<v>220</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>typedecl</name>
+<cardinality>23573</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>23573</v>
+</e>
+<e>
+<k>decl</k>
+<v>23565</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>decl</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>23573</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>decl</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>23558</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>7</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>namespacedecl</name>
+<cardinality>20839</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>20839</v>
+</e>
+<e>
+<k>decl</k>
+<v>20832</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>decl</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>20839</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>decl</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>20828</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>namespacebind</name>
+<cardinality>4300</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>4300</v>
+</e>
+<e>
+<k>decl</k>
+<v>485</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>decl</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4300</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>decl</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>133</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>46</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>56</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>30</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>37</v>
+</b>
+<b>
+<a>7</a>
+<b>9</b>
+<v>44</v>
+</b>
+<b>
+<a>9</a>
+<b>12</b>
+<v>41</v>
+</b>
+<b>
+<a>12</a>
+<b>17</b>
+<v>38</v>
+</b>
+<b>
+<a>17</a>
+<b>31</b>
+<v>37</v>
+</b>
+<b>
+<a>32</a>
+<b>287</b>
+<v>23</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>properties</name>
+<key>id</key>
+<cardinality>142723</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>142723</v>
+</e>
+<e>
+<k>parent</k>
+<v>45129</v>
+</e>
+<e>
+<k>index</k>
+<v>4204</v>
+</e>
+<e>
+<k>kind</k>
+<v>3</v>
+</e>
+<e>
+<k>tostring</k>
+<v>67703</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>142723</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>142723</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>142723</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>142723</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15702</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>17715</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>4729</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>3778</v>
+</b>
+<b>
+<a>6</a>
+<b>4205</b>
+<v>3205</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15702</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>17715</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>4729</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>3778</v>
+</b>
+<b>
+<a>6</a>
+<b>4205</b>
+<v>3205</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>44603</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>526</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>15770</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>17763</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>4692</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>3759</v>
+</b>
+<b>
+<a>6</a>
+<b>4173</b>
+<v>3145</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2827</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>364</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>358</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>337</v>
+</b>
+<b>
+<a>8</a>
+<b>11713</b>
+<v>316</v>
+</b>
+<b>
+<a>29427</a>
+<b>45130</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2827</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>364</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>358</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>337</v>
+</b>
+<b>
+<a>8</a>
+<b>11713</b>
+<v>316</v>
+</b>
+<b>
+<a>29427</a>
+<b>45130</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4149</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>55</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2827</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>364</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>358</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>337</v>
+</b>
+<b>
+<a>7</a>
+<b>6233</b>
+<v>316</v>
+</b>
+<b>
+<a>16744</a>
+<b>16747</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>338</a>
+<b>339</b>
+<v>1</v>
+</b>
+<b>
+<a>1529</a>
+<b>1530</b>
+<v>1</v>
+</b>
+<b>
+<a>140856</a>
+<b>140857</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>204</a>
+<b>205</b>
+<v>1</v>
+</b>
+<b>
+<a>523</a>
+<b>524</b>
+<v>1</v>
+</b>
+<b>
+<a>45034</a>
+<b>45035</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>36</a>
+<b>37</b>
+<v>1</v>
+</b>
+<b>
+<a>55</a>
+<b>56</b>
+<v>1</v>
+</b>
+<b>
+<a>4204</a>
+<b>4205</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>174</a>
+<b>175</b>
+<v>1</v>
+</b>
+<b>
+<a>880</a>
+<b>881</b>
+<v>1</v>
+</b>
+<b>
+<a>66649</a>
+<b>66650</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>46301</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>13295</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>5112</v>
+</b>
+<b>
+<a>6</a>
+<b>2975</b>
+<v>2995</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>46926</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>13013</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>5466</v>
+</b>
+<b>
+<a>7</a>
+<b>2975</b>
+<v>2298</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>61480</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>5275</v>
+</b>
+<b>
+<a>4</a>
+<b>43</b>
+<v>948</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>67703</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_computed</name>
+<cardinality>27</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>27</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_method</name>
+<cardinality>392</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>392</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>is_static</name>
+<cardinality>36</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>36</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>type_alias</name>
+<cardinality>1386</cardinality>
+<columnsizes>
+<e>
+<k>aliasType</k>
+<v>1386</v>
+</e>
+<e>
+<k>underlyingType</k>
+<v>1361</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>underlyingType</src>
+<trg>aliasType</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>aliasType</src>
+<trg>underlyingType</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>type_literal_value</name>
+<cardinality>31882</cardinality>
+<columnsizes>
+<e>
+<k>typ</k>
+<v>31882</v>
+</e>
+<e>
+<k>value</k>
+<v>31828</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>typ</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>31882</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>typ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>31774</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>54</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>signature_types</name>
+<cardinality>46921</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>46921</v>
+</e>
+<e>
+<k>kind</k>
+<v>2</v>
+</e>
+<e>
+<k>tostring</k>
+<v>27460</v>
+</e>
+<e>
+<k>type_parameters</k>
+<v>11</v>
+</e>
+<e>
+<k>required_params</k>
+<v>22</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>46921</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>46921</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>type_parameters</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>46921</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>required_params</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>46921</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2639</a>
+<b>2640</b>
+<v>1</v>
+</b>
+<b>
+<a>44282</a>
+<b>44283</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2200</a>
+<b>2201</b>
+<v>1</v>
+</b>
+<b>
+<a>25260</a>
+<b>25261</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>type_parameters</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>required_params</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>18</a>
+<b>19</b>
+<v>1</v>
+</b>
+<b>
+<a>19</a>
+<b>20</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22069</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3061</v>
+</b>
+<b>
+<a>3</a>
+<b>13</b>
+<v>2112</v>
+</b>
+<b>
+<a>13</a>
+<b>277</b>
+<v>218</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>27460</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>type_parameters</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>27459</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>required_params</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>27134</v>
+</b>
+<b>
+<a>2</a>
+<b>10</b>
+<v>326</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_parameters</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>13</a>
+<b>14</b>
+<v>1</v>
+</b>
+<b>
+<a>25</a>
+<b>26</b>
+<v>1</v>
+</b>
+<b>
+<a>34</a>
+<b>35</b>
+<v>1</v>
+</b>
+<b>
+<a>42</a>
+<b>43</b>
+<v>1</v>
+</b>
+<b>
+<a>51</a>
+<b>52</b>
+<v>1</v>
+</b>
+<b>
+<a>74</a>
+<b>75</b>
+<v>1</v>
+</b>
+<b>
+<a>139</a>
+<b>140</b>
+<v>1</v>
+</b>
+<b>
+<a>274</a>
+<b>275</b>
+<v>1</v>
+</b>
+<b>
+<a>5367</a>
+<b>5368</b>
+<v>1</v>
+</b>
+<b>
+<a>40901</a>
+<b>40902</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_parameters</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_parameters</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>2</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>2</v>
+</b>
+<b>
+<a>17</a>
+<b>18</b>
+<v>1</v>
+</b>
+<b>
+<a>18</a>
+<b>19</b>
+<v>1</v>
+</b>
+<b>
+<a>158</a>
+<b>159</b>
+<v>1</v>
+</b>
+<b>
+<a>1805</a>
+<b>1806</b>
+<v>1</v>
+</b>
+<b>
+<a>25429</a>
+<b>25430</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_parameters</src>
+<trg>required_params</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>2</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>1</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>2</v>
+</b>
+<b>
+<a>9</a>
+<b>10</b>
+<v>1</v>
+</b>
+<b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>required_params</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>5</a>
+<b>11</b>
+<v>2</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>2</v>
+</b>
+<b>
+<a>44</a>
+<b>131</b>
+<v>2</v>
+</b>
+<b>
+<a>197</a>
+<b>373</b>
+<v>2</v>
+</b>
+<b>
+<a>645</a>
+<b>2439</b>
+<v>2</v>
+</b>
+<b>
+<a>2783</a>
+<b>6853</b>
+<v>2</v>
+</b>
+<b>
+<a>16407</a>
+<b>17002</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>required_params</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>15</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>required_params</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>2</v>
+</b>
+<b>
+<a>9</a>
+<b>12</b>
+<v>2</v>
+</b>
+<b>
+<a>39</a>
+<b>62</b>
+<v>2</v>
+</b>
+<b>
+<a>112</a>
+<b>205</b>
+<v>2</v>
+</b>
+<b>
+<a>432</a>
+<b>1404</b>
+<v>2</v>
+</b>
+<b>
+<a>1813</a>
+<b>3662</b>
+<v>2</v>
+</b>
+<b>
+<a>8431</a>
+<b>11659</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>required_params</src>
+<trg>type_parameters</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>12</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>2</v>
+</b>
+<b>
+<a>8</a>
+<b>10</b>
+<v>2</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>2</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>signature_rest_parameter</name>
+<cardinality>19521</cardinality>
+<columnsizes>
+<e>
+<k>sig</k>
+<v>19521</v>
+</e>
+<e>
+<k>rest_param_arra_type</k>
+<v>14259</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>rest_param_arra_type</src>
+<trg>sig</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>sig</src>
+<trg>rest_param_arra_type</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>type_contains_signature</name>
+<cardinality>87640</cardinality>
+<columnsizes>
+<e>
+<k>typ</k>
+<v>68964</v>
+</e>
+<e>
+<k>kind</k>
+<v>2</v>
+</e>
+<e>
+<k>index</k>
+<v>247</v>
+</e>
+<e>
+<k>sig</k>
+<v>37344</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>typ</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>68938</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>26</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>typ</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>59150</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>5394</v>
+</b>
+<b>
+<a>3</a>
+<b>248</b>
+<v>4420</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>typ</src>
+<trg>sig</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>60034</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4557</v>
+</b>
+<b>
+<a>3</a>
+<b>248</b>
+<v>4373</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>typ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2582</a>
+<b>2583</b>
+<v>1</v>
+</b>
+<b>
+<a>66408</a>
+<b>66409</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>247</a>
+<b>248</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>sig</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2646</a>
+<b>2647</b>
+<v>1</v>
+</b>
+<b>
+<a>34698</a>
+<b>34699</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>typ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>198</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21</v>
+</b>
+<b>
+<a>3</a>
+<b>265</b>
+<v>19</v>
+</b>
+<b>
+<a>449</a>
+<b>42171</b>
+<v>9</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>241</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>6</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>sig</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>198</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>24</v>
+</b>
+<b>
+<a>3</a>
+<b>90</b>
+<v>19</v>
+</b>
+<b>
+<a>309</a>
+<b>31688</b>
+<v>6</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>sig</src>
+<trg>typ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>35114</v>
+</b>
+<b>
+<a>2</a>
+<b>896</b>
+<v>2230</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>sig</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>37344</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>sig</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>36489</v>
+</b>
+<b>
+<a>2</a>
+<b>9</b>
+<v>855</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>signature_contains_type</name>
+<cardinality>107012</cardinality>
+<columnsizes>
+<e>
+<k>child</k>
+<v>26824</v>
+</e>
+<e>
+<k>parent</k>
+<v>37344</v>
+</e>
+<e>
+<k>index</k>
+<v>21</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>child</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19848</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3736</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>2017</v>
+</b>
+<b>
+<a>7</a>
+<b>10275</b>
+<v>1223</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>child</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22572</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3289</v>
+</b>
+<b>
+<a>3</a>
+<b>22</b>
+<v>963</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>child</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3594</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>18463</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>10057</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>3906</v>
+</b>
+<b>
+<a>5</a>
+<b>11</b>
+<v>1324</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2649</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>14810</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>12007</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>4294</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>3055</v>
+</b>
+<b>
+<a>8</a>
+<b>22</b>
+<v>529</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>child</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>6</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>9</a>
+<b>10</b>
+<v>1</v>
+</b>
+<b>
+<a>18</a>
+<b>19</b>
+<v>1</v>
+</b>
+<b>
+<a>106</a>
+<b>107</b>
+<v>1</v>
+</b>
+<b>
+<a>313</a>
+<b>314</b>
+<v>1</v>
+</b>
+<b>
+<a>455</a>
+<b>456</b>
+<v>1</v>
+</b>
+<b>
+<a>643</a>
+<b>644</b>
+<v>1</v>
+</b>
+<b>
+<a>1088</a>
+<b>1089</b>
+<v>1</v>
+</b>
+<b>
+<a>2051</a>
+<b>2052</b>
+<v>1</v>
+</b>
+<b>
+<a>6862</a>
+<b>6863</b>
+<v>1</v>
+</b>
+<b>
+<a>8789</a>
+<b>8790</b>
+<v>1</v>
+</b>
+<b>
+<a>12289</a>
+<b>12290</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>17</a>
+<b>18</b>
+<v>1</v>
+</b>
+<b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+<b>
+<a>26</a>
+<b>27</b>
+<v>1</v>
+</b>
+<b>
+<a>37</a>
+<b>38</b>
+<v>1</v>
+</b>
+<b>
+<a>45</a>
+<b>46</b>
+<v>1</v>
+</b>
+<b>
+<a>91</a>
+<b>92</b>
+<v>1</v>
+</b>
+<b>
+<a>219</a>
+<b>220</b>
+<v>1</v>
+</b>
+<b>
+<a>529</a>
+<b>530</b>
+<v>1</v>
+</b>
+<b>
+<a>1042</a>
+<b>1043</b>
+<v>1</v>
+</b>
+<b>
+<a>1574</a>
+<b>1575</b>
+<v>1</v>
+</b>
+<b>
+<a>3584</a>
+<b>3585</b>
+<v>1</v>
+</b>
+<b>
+<a>7878</a>
+<b>7879</b>
+<v>1</v>
+</b>
+<b>
+<a>19885</a>
+<b>19886</b>
+<v>1</v>
+</b>
+<b>
+<a>34695</a>
+<b>34696</b>
+<v>1</v>
+</b>
+<b>
+<a>37344</a>
+<b>37345</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>signature_parameter_name</name>
+<cardinality>69668</cardinality>
+<columnsizes>
+<e>
+<k>sig</k>
+<v>34695</v>
+</e>
+<e>
+<k>index</k>
+<v>20</v>
+</e>
+<e>
+<k>name</k>
+<v>4071</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>sig</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>14810</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>12007</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>4294</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>3055</v>
+</b>
+<b>
+<a>7</a>
+<b>21</b>
+<v>529</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>sig</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>14810</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>12007</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>4294</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>3055</v>
+</b>
+<b>
+<a>7</a>
+<b>21</b>
+<v>529</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>sig</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>17</a>
+<b>18</b>
+<v>1</v>
+</b>
+<b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+<b>
+<a>26</a>
+<b>27</b>
+<v>1</v>
+</b>
+<b>
+<a>37</a>
+<b>38</b>
+<v>1</v>
+</b>
+<b>
+<a>45</a>
+<b>46</b>
+<v>1</v>
+</b>
+<b>
+<a>91</a>
+<b>92</b>
+<v>1</v>
+</b>
+<b>
+<a>219</a>
+<b>220</b>
+<v>1</v>
+</b>
+<b>
+<a>529</a>
+<b>530</b>
+<v>1</v>
+</b>
+<b>
+<a>1042</a>
+<b>1043</b>
+<v>1</v>
+</b>
+<b>
+<a>1574</a>
+<b>1575</b>
+<v>1</v>
+</b>
+<b>
+<a>3584</a>
+<b>3585</b>
+<v>1</v>
+</b>
+<b>
+<a>7878</a>
+<b>7879</b>
+<v>1</v>
+</b>
+<b>
+<a>19885</a>
+<b>19886</b>
+<v>1</v>
+</b>
+<b>
+<a>34695</a>
+<b>34696</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>2</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>16</a>
+<b>17</b>
+<v>1</v>
+</b>
+<b>
+<a>18</a>
+<b>19</b>
+<v>1</v>
+</b>
+<b>
+<a>24</a>
+<b>25</b>
+<v>1</v>
+</b>
+<b>
+<a>30</a>
+<b>31</b>
+<v>1</v>
+</b>
+<b>
+<a>45</a>
+<b>46</b>
+<v>1</v>
+</b>
+<b>
+<a>63</a>
+<b>64</b>
+<v>1</v>
+</b>
+<b>
+<a>116</a>
+<b>117</b>
+<v>1</v>
+</b>
+<b>
+<a>188</a>
+<b>189</b>
+<v>1</v>
+</b>
+<b>
+<a>344</a>
+<b>345</b>
+<v>1</v>
+</b>
+<b>
+<a>605</a>
+<b>606</b>
+<v>1</v>
+</b>
+<b>
+<a>1092</a>
+<b>1093</b>
+<v>1</v>
+</b>
+<b>
+<a>1741</a>
+<b>1742</b>
+<v>1</v>
+</b>
+<b>
+<a>2122</a>
+<b>2123</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>sig</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1898</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>700</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>294</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>262</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>310</v>
+</b>
+<b>
+<a>8</a>
+<b>24</b>
+<v>309</v>
+</b>
+<b>
+<a>24</a>
+<b>3588</b>
+<v>298</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2804</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>738</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>290</v>
+</b>
+<b>
+<a>4</a>
+<b>15</b>
+<v>239</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>number_index_type</name>
+<cardinality>2038</cardinality>
+<columnsizes>
+<e>
+<k>baseType</k>
+<v>2038</v>
+</e>
+<e>
+<k>propertyType</k>
+<v>517</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>baseType</src>
+<trg>propertyType</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2038</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>propertyType</src>
+<trg>baseType</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>435</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>70</v>
+</b>
+<b>
+<a>3</a>
+<b>1259</b>
+<v>12</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>string_index_type</name>
+<cardinality>1102</cardinality>
+<columnsizes>
+<e>
+<k>baseType</k>
+<v>1102</v>
+</e>
+<e>
+<k>propertyType</k>
+<v>256</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>baseType</src>
+<trg>propertyType</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1102</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>propertyType</src>
+<trg>baseType</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>219</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>20</v>
+</b>
+<b>
+<a>3</a>
+<b>436</b>
+<v>17</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>base_type_names</name>
+<cardinality>941</cardinality>
+<columnsizes>
+<e>
+<k>typeName</k>
+<v>928</v>
+</e>
+<e>
+<k>baseTypeName</k>
+<v>369</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>typeName</src>
+<trg>baseTypeName</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>917</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>baseTypeName</src>
+<trg>typeName</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>175</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>101</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>29</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>29</v>
+</b>
+<b>
+<a>5</a>
+<b>11</b>
+<v>28</v>
+</b>
+<b>
+<a>15</a>
+<b>41</b>
+<v>7</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>self_types</name>
+<cardinality>19632</cardinality>
+<columnsizes>
+<e>
+<k>typeName</k>
+<v>14119</v>
+</e>
+<e>
+<k>selfType</k>
+<v>19632</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>typeName</src>
+<trg>selfType</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>10451</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1823</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1845</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>selfType</src>
+<trg>typeName</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19632</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>tuple_type_min_length</name>
+<cardinality>241</cardinality>
+<columnsizes>
+<e>
+<k>typ</k>
+<v>241</v>
+</e>
+<e>
+<k>minLength</k>
+<v>10</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>typ</src>
+<trg>minLength</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>241</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>minLength</src>
+<trg>typ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>1</v>
+</b>
+<b>
+<a>20</a>
+<b>21</b>
+<v>1</v>
+</b>
+<b>
+<a>42</a>
+<b>43</b>
+<v>1</v>
+</b>
+<b>
+<a>66</a>
+<b>67</b>
+<v>1</v>
+</b>
+<b>
+<a>93</a>
+<b>94</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>tuple_type_rest</name>
+<cardinality>100</cardinality>
+<columnsizes>
+<e>
+<k>typ</k>
+<v>100</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>comments</name>
+<key>id</key>
+<cardinality>104947</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>104947</v>
+</e>
+<e>
+<k>kind</k>
+<v>5</v>
+</e>
+<e>
+<k>toplevel</k>
+<v>4497</v>
+</e>
+<e>
+<k>text</k>
+<v>73454</v>
+</e>
+<e>
+<k>tostring</k>
+<v>57955</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>104947</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>104947</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>104947</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>104947</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>8834</a>
+<b>8835</b>
+<v>1</v>
+</b>
+<b>
+<a>19270</a>
+<b>19271</b>
+<v>1</v>
+</b>
+<b>
+<a>76841</a>
+<b>76842</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>1705</a>
+<b>1706</b>
+<v>1</v>
+</b>
+<b>
+<a>3107</a>
+<b>3108</b>
+<v>1</v>
+</b>
+<b>
+<a>3141</a>
+<b>3142</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>4893</a>
+<b>4894</b>
+<v>1</v>
+</b>
+<b>
+<a>12759</a>
+<b>12760</b>
+<v>1</v>
+</b>
+<b>
+<a>55810</a>
+<b>55811</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>1739</a>
+<b>1740</b>
+<v>1</v>
+</b>
+<b>
+<a>2536</a>
+<b>2537</b>
+<v>1</v>
+</b>
+<b>
+<a>53678</a>
+<b>53679</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1034</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>512</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>332</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>260</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>388</v>
+</b>
+<b>
+<a>7</a>
+<b>10</b>
+<v>401</v>
+</b>
+<b>
+<a>10</a>
+<b>14</b>
+<v>354</v>
+</b>
+<b>
+<a>14</a>
+<b>21</b>
+<v>365</v>
+</b>
+<b>
+<a>21</a>
+<b>36</b>
+<v>338</v>
+</b>
+<b>
+<a>36</a>
+<b>99</b>
+<v>339</v>
+</b>
+<b>
+<a>99</a>
+<b>6350</b>
+<v>174</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1856</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1824</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>817</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1043</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>533</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>341</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>266</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>396</v>
+</b>
+<b>
+<a>7</a>
+<b>9</b>
+<v>315</v>
+</b>
+<b>
+<a>9</a>
+<b>13</b>
+<v>388</v>
+</b>
+<b>
+<a>13</a>
+<b>20</b>
+<v>385</v>
+</b>
+<b>
+<a>20</a>
+<b>35</b>
+<v>344</v>
+</b>
+<b>
+<a>35</a>
+<b>103</b>
+<v>344</v>
+</b>
+<b>
+<a>103</a>
+<b>4413</b>
+<v>142</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1054</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>571</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>374</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>297</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>232</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>363</v>
+</b>
+<b>
+<a>8</a>
+<b>11</b>
+<v>345</v>
+</b>
+<b>
+<a>11</a>
+<b>16</b>
+<v>366</v>
+</b>
+<b>
+<a>16</a>
+<b>27</b>
+<v>352</v>
+</b>
+<b>
+<a>27</a>
+<b>60</b>
+<v>338</v>
+</b>
+<b>
+<a>60</a>
+<b>4394</b>
+<v>205</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>59626</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>10314</v>
+</b>
+<b>
+<a>3</a>
+<b>1417</b>
+<v>3514</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>73446</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>8</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>62696</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8455</v>
+</b>
+<b>
+<a>3</a>
+<b>257</b>
+<v>2303</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>73446</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>8</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>44781</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9203</v>
+</b>
+<b>
+<a>3</a>
+<b>4589</b>
+<v>3971</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>57955</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>48252</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>7233</v>
+</b>
+<b>
+<a>3</a>
+<b>513</b>
+<v>2470</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>55262</v>
+</b>
+<b>
+<a>2</a>
+<b>3403</b>
+<v>2693</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>types</name>
+<cardinality>179398</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>179398</v>
+</e>
+<e>
+<k>kind</k>
+<v>9</v>
+</e>
+<e>
+<k>tostring</k>
+<v>40918</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>179398</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>179398</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5</v>
+</b>
+<b>
+<a>1802</a>
+<b>1803</b>
+<v>1</v>
+</b>
+<b>
+<a>6109</a>
+<b>6110</b>
+<v>1</v>
+</b>
+<b>
+<a>12383</a>
+<b>12384</b>
+<v>1</v>
+</b>
+<b>
+<a>159099</a>
+<b>159100</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5</v>
+</b>
+<b>
+<a>50</a>
+<b>51</b>
+<v>1</v>
+</b>
+<b>
+<a>745</a>
+<b>746</b>
+<v>1</v>
+</b>
+<b>
+<a>7464</a>
+<b>7465</b>
+<v>1</v>
+</b>
+<b>
+<a>32936</a>
+<b>32937</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22482</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8025</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3362</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>3387</v>
+</b>
+<b>
+<a>7</a>
+<b>33</b>
+<v>3070</v>
+</b>
+<b>
+<a>33</a>
+<b>7284</b>
+<v>592</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>40638</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>280</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>type_child</name>
+<cardinality>17410</cardinality>
+<columnsizes>
+<e>
+<k>child</k>
+<v>9118</v>
+</e>
+<e>
+<k>parent</k>
+<v>7772</v>
+</e>
+<e>
+<k>idx</k>
+<v>296</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>child</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7113</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>978</v>
+</b>
+<b>
+<a>3</a>
+<b>8</b>
+<v>686</v>
+</b>
+<b>
+<a>8</a>
+<b>199</b>
+<v>341</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>child</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8255</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>726</v>
+</b>
+<b>
+<a>5</a>
+<b>19</b>
+<v>137</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>child</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5433</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1746</v>
+</b>
+<b>
+<a>3</a>
+<b>288</b>
+<v>583</v>
+</b>
+<b>
+<a>288</a>
+<b>297</b>
+<v>10</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5422</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1757</v>
+</b>
+<b>
+<a>3</a>
+<b>288</b>
+<v>583</v>
+</b>
+<b>
+<a>288</a>
+<b>297</b>
+<v>10</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>child</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>39</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>61</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>37</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>56</v>
+</b>
+<b>
+<a>7</a>
+<b>12</b>
+<v>22</v>
+</b>
+<b>
+<a>12</a>
+<b>14</b>
+<v>18</v>
+</b>
+<b>
+<a>14</a>
+<b>15</b>
+<v>44</v>
+</b>
+<b>
+<a>17</a>
+<b>6068</b>
+<v>15</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>15</b>
+<v>13</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>90</v>
+</b>
+<b>
+<a>19</a>
+<b>20</b>
+<v>81</v>
+</b>
+<b>
+<a>20</a>
+<b>23</b>
+<v>3</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>75</v>
+</b>
+<b>
+<a>24</a>
+<b>55</b>
+<v>23</v>
+</b>
+<b>
+<a>55</a>
+<b>7773</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>ast_node_type</name>
+<cardinality>1261889</cardinality>
+<columnsizes>
+<e>
+<k>node</k>
+<v>1261889</v>
+</e>
+<e>
+<k>typ</k>
+<v>72602</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>node</src>
+<trg>typ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1261889</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>typ</src>
+<trg>node</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>39248</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8371</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>7888</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>3053</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>6417</v>
+</b>
+<b>
+<a>8</a>
+<b>28</b>
+<v>5528</v>
+</b>
+<b>
+<a>28</a>
+<b>588233</b>
+<v>2097</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>declared_function_signature</name>
+<cardinality>62664</cardinality>
+<columnsizes>
+<e>
+<k>node</k>
+<v>62664</v>
+</e>
+<e>
+<k>sig</k>
+<v>21731</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>node</src>
+<trg>sig</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>62664</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>sig</src>
+<trg>node</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>16826</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2358</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>1683</v>
+</b>
+<b>
+<a>6</a>
+<b>10251</b>
+<v>864</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>invoke_expr_signature</name>
+<cardinality>140668</cardinality>
+<columnsizes>
+<e>
+<k>node</k>
+<v>140668</v>
+</e>
+<e>
+<k>sig</k>
+<v>9111</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>node</src>
+<trg>sig</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>140668</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>sig</src>
+<trg>node</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4612</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1819</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>737</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>696</v>
+</b>
+<b>
+<a>6</a>
+<b>14</b>
+<v>705</v>
+</b>
+<b>
+<a>14</a>
+<b>68351</b>
+<v>542</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>invoke_expr_overload_index</name>
+<cardinality>73550</cardinality>
+<columnsizes>
+<e>
+<k>node</k>
+<v>73550</v>
+</e>
+<e>
+<k>index</k>
+<v>47</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>node</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>73550</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>node</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>17</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>7</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>4</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>4</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>3</v>
+</b>
+<b>
+<a>8</a>
+<b>16</b>
+<v>4</v>
+</b>
+<b>
+<a>27</a>
+<b>155</b>
+<v>4</v>
+</b>
+<b>
+<a>211</a>
+<b>68535</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>symbols</name>
+<cardinality>10192</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>10192</v>
+</e>
+<e>
+<k>kind</k>
+<v>3</v>
+</e>
+<e>
+<k>name</k>
+<v>7872</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>10192</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>10192</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>584</a>
+<b>585</b>
+<v>1</v>
+</b>
+<b>
+<a>2385</a>
+<b>2386</b>
+<v>1</v>
+</b>
+<b>
+<a>7223</a>
+<b>7224</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>30</a>
+<b>31</b>
+<v>1</v>
+</b>
+<b>
+<a>2385</a>
+<b>2386</b>
+<v>1</v>
+</b>
+<b>
+<a>5609</a>
+<b>5610</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6929</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>533</v>
+</b>
+<b>
+<a>3</a>
+<b>273</b>
+<v>410</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7730</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>142</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>symbol_parent</name>
+<cardinality>7807</cardinality>
+<columnsizes>
+<e>
+<k>symbol</k>
+<v>7807</v>
+</e>
+<e>
+<k>parent</k>
+<v>1727</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>symbol</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7807</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>symbol</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>778</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>304</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>212</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>111</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>152</v>
+</b>
+<b>
+<a>8</a>
+<b>26</b>
+<v>136</v>
+</b>
+<b>
+<a>26</a>
+<b>297</b>
+<v>34</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>symbol_module</name>
+<cardinality>100</cardinality>
+<columnsizes>
+<e>
+<k>symbol</k>
+<v>97</v>
+</e>
+<e>
+<k>moduleName</k>
+<v>98</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>symbol</src>
+<trg>moduleName</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>95</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>moduleName</src>
+<trg>symbol</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>96</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>symbol_global</name>
+<cardinality>354</cardinality>
+<columnsizes>
+<e>
+<k>symbol</k>
+<v>354</v>
+</e>
+<e>
+<k>globalName</k>
+<v>350</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>symbol</src>
+<trg>globalName</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>354</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>globalName</src>
+<trg>symbol</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>347</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>ast_node_symbol</name>
+<cardinality>8173</cardinality>
+<columnsizes>
+<e>
+<k>node</k>
+<v>8173</v>
+</e>
+<e>
+<k>symbol</k>
+<v>8155</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>node</src>
+<trg>symbol</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8173</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>symbol</src>
+<trg>node</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8147</v>
+</b>
+<b>
+<a>2</a>
+<b>12</b>
+<v>8</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>type_symbol</name>
+<cardinality>12383</cardinality>
+<columnsizes>
+<e>
+<k>typ</k>
+<v>12383</v>
+</e>
+<e>
+<k>symbol</k>
+<v>6743</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>typ</src>
+<trg>symbol</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>12383</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>symbol</src>
+<trg>typ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6240</v>
+</b>
+<b>
+<a>2</a>
+<b>3070</b>
+<v>503</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>type_property</name>
+<cardinality>331170</cardinality>
+<columnsizes>
+<e>
+<k>typ</k>
+<v>49305</v>
+</e>
+<e>
+<k>name</k>
+<v>22420</v>
+</e>
+<e>
+<k>propertyType</k>
+<v>130857</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>typ</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>10275</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>14770</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>6020</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>3153</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1700</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>4257</v>
+</b>
+<b>
+<a>7</a>
+<b>19</b>
+<v>3783</v>
+</b>
+<b>
+<a>19</a>
+<b>23</b>
+<v>3833</v>
+</b>
+<b>
+<a>23</a>
+<b>1390</b>
+<v>1514</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>typ</src>
+<trg>propertyType</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19351</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>10786</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>5073</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>2639</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>3864</v>
+</b>
+<b>
+<a>7</a>
+<b>22</b>
+<v>3334</v>
+</b>
+<b>
+<a>22</a>
+<b>33</b>
+<v>3710</v>
+</b>
+<b>
+<a>33</a>
+<b>1390</b>
+<v>548</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>typ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4735</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>7379</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2728</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1467</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>1481</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>1878</v>
+</b>
+<b>
+<a>11</a>
+<b>30</b>
+<v>1682</v>
+</b>
+<b>
+<a>30</a>
+<b>7825</b>
+<v>1070</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>propertyType</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>14690</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2698</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1925</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>1697</v>
+</b>
+<b>
+<a>8</a>
+<b>3373</b>
+<v>1410</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>propertyType</src>
+<trg>typ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>112801</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>12999</v>
+</b>
+<b>
+<a>3</a>
+<b>19440</b>
+<v>5057</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>propertyType</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>129508</v>
+</b>
+<b>
+<a>2</a>
+<b>3475</b>
+<v>1349</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>lines</name>
+<key>id</key>
+<cardinality>1622184</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1622184</v>
+</e>
+<e>
+<k>toplevel</k>
+<v>5312</v>
+</e>
+<e>
+<k>text</k>
+<v>648122</v>
+</e>
+<e>
+<k>terminator</k>
+<v>6</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1622184</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1622184</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>terminator</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1622184</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>12</b>
+<v>425</v>
+</b>
+<b>
+<a>12</a>
+<b>24</b>
+<v>415</v>
+</b>
+<b>
+<a>24</a>
+<b>37</b>
+<v>419</v>
+</b>
+<b>
+<a>37</a>
+<b>50</b>
+<v>404</v>
+</b>
+<b>
+<a>50</a>
+<b>66</b>
+<v>411</v>
+</b>
+<b>
+<a>66</a>
+<b>85</b>
+<v>400</v>
+</b>
+<b>
+<a>85</a>
+<b>108</b>
+<v>405</v>
+</b>
+<b>
+<a>108</a>
+<b>138</b>
+<v>402</v>
+</b>
+<b>
+<a>138</a>
+<b>174</b>
+<v>402</v>
+</b>
+<b>
+<a>174</a>
+<b>232</b>
+<v>405</v>
+</b>
+<b>
+<a>232</a>
+<b>331</b>
+<v>399</v>
+</b>
+<b>
+<a>331</a>
+<b>547</b>
+<v>399</v>
+</b>
+<b>
+<a>548</a>
+<b>4700</b>
+<v>399</v>
+</b>
+<b>
+<a>4783</a>
+<b>277404</b>
+<v>27</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>11</b>
+<v>441</v>
+</b>
+<b>
+<a>11</a>
+<b>21</b>
+<v>427</v>
+</b>
+<b>
+<a>21</a>
+<b>30</b>
+<v>414</v>
+</b>
+<b>
+<a>30</a>
+<b>40</b>
+<v>452</v>
+</b>
+<b>
+<a>40</a>
+<b>51</b>
+<v>435</v>
+</b>
+<b>
+<a>51</a>
+<b>64</b>
+<v>413</v>
+</b>
+<b>
+<a>64</a>
+<b>79</b>
+<v>404</v>
+</b>
+<b>
+<a>79</a>
+<b>96</b>
+<v>401</v>
+</b>
+<b>
+<a>96</a>
+<b>121</b>
+<v>400</v>
+</b>
+<b>
+<a>121</a>
+<b>158</b>
+<v>401</v>
+</b>
+<b>
+<a>158</a>
+<b>220</b>
+<v>399</v>
+</b>
+<b>
+<a>220</a>
+<b>387</b>
+<v>401</v>
+</b>
+<b>
+<a>388</a>
+<b>60934</b>
+<v>324</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>terminator</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5046</v>
+</b>
+<b>
+<a>2</a>
+<b>6</b>
+<v>266</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>513961</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>84265</v>
+</b>
+<b>
+<a>3</a>
+<b>49</b>
+<v>48993</v>
+</b>
+<b>
+<a>49</a>
+<b>175121</b>
+<v>903</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>569267</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>56143</v>
+</b>
+<b>
+<a>3</a>
+<b>5068</b>
+<v>22712</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>terminator</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>647931</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>191</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>terminator</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3</v>
+</b>
+<b>
+<a>349</a>
+<b>350</b>
+<v>1</v>
+</b>
+<b>
+<a>1830</a>
+<b>1831</b>
+<v>1</v>
+</b>
+<b>
+<a>1619996</a>
+<b>1619997</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>terminator</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>349</a>
+<b>350</b>
+<v>1</v>
+</b>
+<b>
+<a>5218</a>
+<b>5219</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>terminator</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+<b>
+<a>110</a>
+<b>111</b>
+<v>1</v>
+</b>
+<b>
+<a>1093</a>
+<b>1094</b>
+<v>1</v>
+</b>
+<b>
+<a>647111</a>
+<b>647112</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>indentation</name>
+<cardinality>1145010</cardinality>
+<columnsizes>
+<e>
+<k>file</k>
+<v>5728</v>
+</e>
+<e>
+<k>lineno</k>
+<v>40788</v>
+</e>
+<e>
+<k>indentChar</k>
+<v>2</v>
+</e>
+<e>
+<k>indentDepth</k>
+<v>72</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>file</src>
+<trg>lineno</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>9</b>
+<v>440</v>
+</b>
+<b>
+<a>9</a>
+<b>18</b>
+<v>471</v>
+</b>
+<b>
+<a>18</a>
+<b>29</b>
+<v>439</v>
+</b>
+<b>
+<a>29</a>
+<b>41</b>
+<v>451</v>
+</b>
+<b>
+<a>41</a>
+<b>54</b>
+<v>460</v>
+</b>
+<b>
+<a>54</a>
+<b>71</b>
+<v>442</v>
+</b>
+<b>
+<a>71</a>
+<b>91</b>
+<v>441</v>
+</b>
+<b>
+<a>91</a>
+<b>118</b>
+<v>430</v>
+</b>
+<b>
+<a>118</a>
+<b>152</b>
+<v>432</v>
+</b>
+<b>
+<a>152</a>
+<b>205</b>
+<v>434</v>
+</b>
+<b>
+<a>205</a>
+<b>295</b>
+<v>431</v>
+</b>
+<b>
+<a>295</a>
+<b>503</b>
+<v>430</v>
+</b>
+<b>
+<a>503</a>
+<b>38151</b>
+<v>427</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>indentChar</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5692</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>36</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>indentDepth</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>287</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>401</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>665</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>815</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>814</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>687</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>567</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>390</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>503</v>
+</b>
+<b>
+<a>11</a>
+<b>17</b>
+<v>462</v>
+</b>
+<b>
+<a>17</a>
+<b>67</b>
+<v>137</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>lineno</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>10935</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>5303</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>12061</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>3644</v>
+</b>
+<b>
+<a>6</a>
+<b>13</b>
+<v>3223</v>
+</b>
+<b>
+<a>13</a>
+<b>31</b>
+<v>3090</v>
+</b>
+<b>
+<a>31</a>
+<b>3986</b>
+<v>2532</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>lineno</src>
+<trg>indentChar</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>38720</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2068</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>lineno</src>
+<trg>indentDepth</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11626</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>7847</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>10434</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2688</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>3316</v>
+</b>
+<b>
+<a>8</a>
+<b>13</b>
+<v>3144</v>
+</b>
+<b>
+<a>13</a>
+<b>39</b>
+<v>1733</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>indentChar</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>42</a>
+<b>43</b>
+<v>1</v>
+</b>
+<b>
+<a>5722</a>
+<b>5723</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>indentChar</src>
+<trg>lineno</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2068</a>
+<b>2069</b>
+<v>1</v>
+</b>
+<b>
+<a>40788</a>
+<b>40789</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>indentChar</src>
+<trg>indentDepth</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>72</a>
+<b>73</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>indentDepth</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>6</b>
+<v>6</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>6</v>
+</b>
+<b>
+<a>9</a>
+<b>20</b>
+<v>6</v>
+</b>
+<b>
+<a>21</a>
+<b>30</b>
+<v>6</v>
+</b>
+<b>
+<a>38</a>
+<b>57</b>
+<v>6</v>
+</b>
+<b>
+<a>59</a>
+<b>90</b>
+<v>6</v>
+</b>
+<b>
+<a>90</a>
+<b>124</b>
+<v>6</v>
+</b>
+<b>
+<a>132</a>
+<b>160</b>
+<v>6</v>
+</b>
+<b>
+<a>165</a>
+<b>211</b>
+<v>6</v>
+</b>
+<b>
+<a>213</a>
+<b>337</b>
+<v>6</v>
+</b>
+<b>
+<a>377</a>
+<b>1532</b>
+<v>6</v>
+</b>
+<b>
+<a>1919</a>
+<b>5487</b>
+<v>6</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>indentDepth</src>
+<trg>lineno</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>8</b>
+<v>6</v>
+</b>
+<b>
+<a>11</a>
+<b>19</b>
+<v>6</v>
+</b>
+<b>
+<a>25</a>
+<b>44</b>
+<v>6</v>
+</b>
+<b>
+<a>53</a>
+<b>67</b>
+<v>6</v>
+</b>
+<b>
+<a>67</a>
+<b>89</b>
+<v>6</v>
+</b>
+<b>
+<a>102</a>
+<b>169</b>
+<v>6</v>
+</b>
+<b>
+<a>183</a>
+<b>239</b>
+<v>6</v>
+</b>
+<b>
+<a>269</a>
+<b>411</b>
+<v>6</v>
+</b>
+<b>
+<a>417</a>
+<b>971</b>
+<v>6</v>
+</b>
+<b>
+<a>1129</a>
+<b>2732</b>
+<v>6</v>
+</b>
+<b>
+<a>4374</a>
+<b>9301</b>
+<v>6</v>
+</b>
+<b>
+<a>11828</a>
+<b>21226</b>
+<v>6</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>indentDepth</src>
+<trg>indentChar</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>62</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>10</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>js_parse_errors</name>
+<cardinality>3</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>3</v>
+</e>
+<e>
+<k>toplevel</k>
+<v>3</v>
+</e>
+<e>
+<k>message</k>
+<v>1</v>
+</e>
+<e>
+<k>line</k>
+<v>3</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>line</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>line</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>line</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>line</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>line</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>line</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>regexpterm</name>
+<key>id</key>
+<cardinality>33197</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>33197</v>
+</e>
+<e>
+<k>kind</k>
+<v>25</v>
+</e>
+<e>
+<k>parent</k>
+<v>13313</v>
+</e>
+<e>
+<k>idx</k>
+<v>76</v>
+</e>
+<e>
+<k>tostring</k>
+<v>4610</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>33197</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>33197</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>33197</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>33197</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>7</a>
+<b>12</b>
+<v>2</v>
+</b>
+<b>
+<a>12</a>
+<b>16</b>
+<v>2</v>
+</b>
+<b>
+<a>59</a>
+<b>100</b>
+<v>2</v>
+</b>
+<b>
+<a>146</a>
+<b>265</b>
+<v>2</v>
+</b>
+<b>
+<a>445</a>
+<b>479</b>
+<v>2</v>
+</b>
+<b>
+<a>599</a>
+<b>620</b>
+<v>2</v>
+</b>
+<b>
+<a>637</a>
+<b>642</b>
+<v>2</v>
+</b>
+<b>
+<a>826</a>
+<b>1058</b>
+<v>2</v>
+</b>
+<b>
+<a>1067</a>
+<b>1474</b>
+<v>2</v>
+</b>
+<b>
+<a>1573</a>
+<b>1693</b>
+<v>2</v>
+</b>
+<b>
+<a>2613</a>
+<b>3372</b>
+<v>2</v>
+</b>
+<b>
+<a>15489</a>
+<b>15490</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>1</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>2</v>
+</b>
+<b>
+<a>15</a>
+<b>46</b>
+<v>2</v>
+</b>
+<b>
+<a>79</a>
+<b>132</b>
+<v>2</v>
+</b>
+<b>
+<a>132</a>
+<b>331</b>
+<v>2</v>
+</b>
+<b>
+<a>367</a>
+<b>381</b>
+<v>2</v>
+</b>
+<b>
+<a>437</a>
+<b>638</b>
+<v>2</v>
+</b>
+<b>
+<a>641</a>
+<b>737</b>
+<v>2</v>
+</b>
+<b>
+<a>825</a>
+<b>1005</b>
+<v>2</v>
+</b>
+<b>
+<a>1391</a>
+<b>1403</b>
+<v>2</v>
+</b>
+<b>
+<a>1465</a>
+<b>1645</b>
+<v>2</v>
+</b>
+<b>
+<a>2691</a>
+<b>3963</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>3</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>2</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>2</v>
+</b>
+<b>
+<a>17</a>
+<b>19</b>
+<v>2</v>
+</b>
+<b>
+<a>19</a>
+<b>21</b>
+<v>2</v>
+</b>
+<b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>2</v>
+</b>
+<b>
+<a>25</a>
+<b>27</b>
+<v>2</v>
+</b>
+<b>
+<a>27</a>
+<b>30</b>
+<v>2</v>
+</b>
+<b>
+<a>42</a>
+<b>49</b>
+<v>2</v>
+</b>
+<b>
+<a>73</a>
+<b>74</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>6</a>
+<b>11</b>
+<v>2</v>
+</b>
+<b>
+<a>13</a>
+<b>28</b>
+<v>2</v>
+</b>
+<b>
+<a>31</a>
+<b>59</b>
+<v>2</v>
+</b>
+<b>
+<a>65</a>
+<b>78</b>
+<v>2</v>
+</b>
+<b>
+<a>100</a>
+<b>118</b>
+<v>2</v>
+</b>
+<b>
+<a>149</a>
+<b>171</b>
+<v>2</v>
+</b>
+<b>
+<a>175</a>
+<b>391</b>
+<v>2</v>
+</b>
+<b>
+<a>433</a>
+<b>791</b>
+<v>2</v>
+</b>
+<b>
+<a>1992</a>
+<b>1993</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7691</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2568</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>924</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>1189</v>
+</b>
+<b>
+<a>7</a>
+<b>77</b>
+<v>941</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>10080</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2026</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>1068</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>139</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7691</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2568</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>924</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>1189</v>
+</b>
+<b>
+<a>7</a>
+<b>77</b>
+<v>941</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7733</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2644</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>940</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>1230</v>
+</b>
+<b>
+<a>7</a>
+<b>32</b>
+<v>766</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>7</v>
+</b>
+<b>
+<a>8</a>
+<b>13</b>
+<v>7</v>
+</b>
+<b>
+<a>15</a>
+<b>22</b>
+<v>6</v>
+</b>
+<b>
+<a>26</a>
+<b>35</b>
+<v>5</v>
+</b>
+<b>
+<a>37</a>
+<b>51</b>
+<v>6</v>
+</b>
+<b>
+<a>53</a>
+<b>75</b>
+<v>6</v>
+</b>
+<b>
+<a>79</a>
+<b>141</b>
+<v>6</v>
+</b>
+<b>
+<a>186</a>
+<b>325</b>
+<v>6</v>
+</b>
+<b>
+<a>385</a>
+<b>1182</b>
+<v>6</v>
+</b>
+<b>
+<a>1578</a>
+<b>13314</b>
+<v>5</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>18</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>15</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>8</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>6</v>
+</b>
+<b>
+<a>9</a>
+<b>13</b>
+<v>6</v>
+</b>
+<b>
+<a>13</a>
+<b>16</b>
+<v>7</v>
+</b>
+<b>
+<a>17</a>
+<b>20</b>
+<v>7</v>
+</b>
+<b>
+<a>21</a>
+<b>25</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>7</v>
+</b>
+<b>
+<a>8</a>
+<b>13</b>
+<v>7</v>
+</b>
+<b>
+<a>15</a>
+<b>22</b>
+<v>6</v>
+</b>
+<b>
+<a>26</a>
+<b>35</b>
+<v>5</v>
+</b>
+<b>
+<a>37</a>
+<b>51</b>
+<v>6</v>
+</b>
+<b>
+<a>53</a>
+<b>75</b>
+<v>6</v>
+</b>
+<b>
+<a>79</a>
+<b>141</b>
+<v>6</v>
+</b>
+<b>
+<a>186</a>
+<b>325</b>
+<v>6</v>
+</b>
+<b>
+<a>385</a>
+<b>1182</b>
+<v>6</v>
+</b>
+<b>
+<a>1578</a>
+<b>13314</b>
+<v>5</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>4</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>6</v>
+</b>
+<b>
+<a>7</a>
+<b>10</b>
+<v>6</v>
+</b>
+<b>
+<a>10</a>
+<b>15</b>
+<v>6</v>
+</b>
+<b>
+<a>16</a>
+<b>21</b>
+<v>7</v>
+</b>
+<b>
+<a>21</a>
+<b>26</b>
+<v>6</v>
+</b>
+<b>
+<a>29</a>
+<b>48</b>
+<v>6</v>
+</b>
+<b>
+<a>48</a>
+<b>75</b>
+<v>6</v>
+</b>
+<b>
+<a>82</a>
+<b>147</b>
+<v>6</v>
+</b>
+<b>
+<a>158</a>
+<b>940</b>
+<v>6</v>
+</b>
+<b>
+<a>3258</a>
+<b>3259</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3026</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>751</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>391</v>
+</b>
+<b>
+<a>5</a>
+<b>49</b>
+<v>346</v>
+</b>
+<b>
+<a>49</a>
+<b>1013</b>
+<v>96</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4605</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>5</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3041</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>746</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>389</v>
+</b>
+<b>
+<a>5</a>
+<b>53</b>
+<v>346</v>
+</b>
+<b>
+<a>54</a>
+<b>875</b>
+<v>88</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4102</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>351</v>
+</b>
+<b>
+<a>5</a>
+<b>58</b>
+<v>157</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>regexp_parse_errors</name>
+<key>id</key>
+<cardinality>122</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>122</v>
+</e>
+<e>
+<k>regexp</k>
+<v>41</v>
+</e>
+<e>
+<k>message</k>
+<v>5</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>regexp</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>122</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>122</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>regexp</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>12</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>5</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>7</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>regexp</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>18</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>19</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>1</v>
+</b>
+<b>
+<a>68</a>
+<b>69</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>regexp</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>22</a>
+<b>23</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>1</v>
+</b>
+<b>
+<a>35</a>
+<b>36</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_greedy</name>
+<cardinality>2629</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>2629</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>isOptionalChaining</name>
+<cardinality>100</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>100</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+
+<relation>
+<name>range_quantifier_lower_bound</name>
+<cardinality>146</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>146</v>
+</e>
+<e>
+<k>lo</k>
+<v>11</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>lo</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>146</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>lo</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>17</a>
+<b>18</b>
+<v>1</v>
+</b>
+<b>
+<a>20</a>
+<b>21</b>
+<v>1</v>
+</b>
+<b>
+<a>28</a>
+<b>29</b>
+<v>1</v>
+</b>
+<b>
+<a>33</a>
+<b>34</b>
+<v>1</v>
+</b>
+<b>
+<a>35</a>
+<b>36</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>range_quantifier_upper_bound</name>
+<cardinality>45</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>45</v>
+</e>
+<e>
+<k>hi</k>
+<v>13</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>hi</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>45</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>hi</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>9</a>
+<b>10</b>
+<v>1</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_capture</name>
+<cardinality>1280</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1280</v>
+</e>
+<e>
+<k>number</k>
+<v>14</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>number</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1280</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>number</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>2</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>1</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>1</v>
+</b>
+<b>
+<a>55</a>
+<b>56</b>
+<v>1</v>
+</b>
+<b>
+<a>108</a>
+<b>109</b>
+<v>1</v>
+</b>
+<b>
+<a>276</a>
+<b>277</b>
+<v>1</v>
+</b>
+<b>
+<a>774</a>
+<b>775</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_named_capture</name>
+<cardinality>1280</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1280</v>
+</e>
+<e>
+<k>name</k>
+<v>14</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1280</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>2</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>1</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>1</v>
+</b>
+<b>
+<a>55</a>
+<b>56</b>
+<v>1</v>
+</b>
+<b>
+<a>108</a>
+<b>109</b>
+<v>1</v>
+</b>
+<b>
+<a>276</a>
+<b>277</b>
+<v>1</v>
+</b>
+<b>
+<a>774</a>
+<b>775</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>is_inverted</name>
+<cardinality>458</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>458</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>regexp_const_value</name>
+<cardinality>19032</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>19032</v>
+</e>
+<e>
+<k>value</k>
+<v>237</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19032</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>80</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>12</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>10</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>20</v>
+</b>
+<b>
+<a>5</a>
+<b>17</b>
+<v>18</v>
+</b>
+<b>
+<a>17</a>
+<b>30</b>
+<v>18</v>
+</b>
+<b>
+<a>30</a>
+<b>66</b>
+<v>18</v>
+</b>
+<b>
+<a>68</a>
+<b>143</b>
+<v>18</v>
+</b>
+<b>
+<a>155</a>
+<b>242</b>
+<v>18</v>
+</b>
+<b>
+<a>251</a>
+<b>555</b>
+<v>18</v>
+</b>
+<b>
+<a>581</a>
+<b>1013</b>
+<v>7</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>char_class_escape</name>
+<cardinality>1573</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1573</v>
+</e>
+<e>
+<k>value</k>
+<v>6</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1573</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>14</a>
+<b>15</b>
+<v>1</v>
+</b>
+<b>
+<a>92</a>
+<b>93</b>
+<v>1</v>
+</b>
+<b>
+<a>199</a>
+<b>200</b>
+<v>1</v>
+</b>
+<b>
+<a>378</a>
+<b>379</b>
+<v>1</v>
+</b>
+<b>
+<a>879</a>
+<b>880</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>unicode_property_escapename</name>
+<cardinality>1573</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1573</v>
+</e>
+<e>
+<k>name</k>
+<v>6</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1573</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>14</a>
+<b>15</b>
+<v>1</v>
+</b>
+<b>
+<a>92</a>
+<b>93</b>
+<v>1</v>
+</b>
+<b>
+<a>199</a>
+<b>200</b>
+<v>1</v>
+</b>
+<b>
+<a>378</a>
+<b>379</b>
+<v>1</v>
+</b>
+<b>
+<a>879</a>
+<b>880</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>unicode_property_escapevalue</name>
+<cardinality>1573</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1573</v>
+</e>
+<e>
+<k>value</k>
+<v>6</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1573</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>14</a>
+<b>15</b>
+<v>1</v>
+</b>
+<b>
+<a>92</a>
+<b>93</b>
+<v>1</v>
+</b>
+<b>
+<a>199</a>
+<b>200</b>
+<v>1</v>
+</b>
+<b>
+<a>378</a>
+<b>379</b>
+<v>1</v>
+</b>
+<b>
+<a>879</a>
+<b>880</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>backref</name>
+<cardinality>11</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>11</v>
+</e>
+<e>
+<k>value</k>
+<v>4</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>named_backref</name>
+<cardinality>11</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>11</v>
+</e>
+<e>
+<k>name</k>
+<v>4</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>tokeninfo</name>
+<key>id</key>
+<cardinality>8770869</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>8770869</v>
+</e>
+<e>
+<k>kind</k>
+<v>9</v>
+</e>
+<e>
+<k>toplevel</k>
+<v>5312</v>
+</e>
+<e>
+<k>idx</k>
+<v>1581031</v>
+</e>
+<e>
+<k>value</k>
+<v>234179</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8770869</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8770869</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8770869</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8770869</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2773</a>
+<b>2774</b>
+<v>1</v>
+</b>
+<b>
+<a>5312</a>
+<b>5313</b>
+<v>1</v>
+</b>
+<b>
+<a>15526</a>
+<b>15527</b>
+<v>1</v>
+</b>
+<b>
+<a>31654</a>
+<b>31655</b>
+<v>1</v>
+</b>
+<b>
+<a>269555</a>
+<b>269556</b>
+<v>1</v>
+</b>
+<b>
+<a>551767</a>
+<b>551768</b>
+<v>1</v>
+</b>
+<b>
+<a>557620</a>
+<b>557621</b>
+<v>1</v>
+</b>
+<b>
+<a>2268328</a>
+<b>2268329</b>
+<v>1</v>
+</b>
+<b>
+<a>5068334</a>
+<b>5068335</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>471</a>
+<b>472</b>
+<v>1</v>
+</b>
+<b>
+<a>2204</a>
+<b>2205</b>
+<v>1</v>
+</b>
+<b>
+<a>2851</a>
+<b>2852</b>
+<v>1</v>
+</b>
+<b>
+<a>3204</a>
+<b>3205</b>
+<v>1</v>
+</b>
+<b>
+<a>5089</a>
+<b>5090</b>
+<v>1</v>
+</b>
+<b>
+<a>5219</a>
+<b>5220</b>
+<v>1</v>
+</b>
+<b>
+<a>5294</a>
+<b>5295</b>
+<v>1</v>
+</b>
+<b>
+<a>5300</a>
+<b>5301</b>
+<v>1</v>
+</b>
+<b>
+<a>5312</a>
+<b>5313</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1949</a>
+<b>1950</b>
+<v>1</v>
+</b>
+<b>
+<a>2130</a>
+<b>2131</b>
+<v>1</v>
+</b>
+<b>
+<a>8409</a>
+<b>8410</b>
+<v>1</v>
+</b>
+<b>
+<a>12883</a>
+<b>12884</b>
+<v>1</v>
+</b>
+<b>
+<a>51181</a>
+<b>51182</b>
+<v>1</v>
+</b>
+<b>
+<a>130388</a>
+<b>130389</b>
+<v>1</v>
+</b>
+<b>
+<a>409369</a>
+<b>409370</b>
+<v>1</v>
+</b>
+<b>
+<a>583910</a>
+<b>583911</b>
+<v>1</v>
+</b>
+<b>
+<a>1104589</a>
+<b>1104590</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>34</a>
+<b>35</b>
+<v>1</v>
+</b>
+<b>
+<a>52</a>
+<b>53</b>
+<v>1</v>
+</b>
+<b>
+<a>1596</a>
+<b>1597</b>
+<v>1</v>
+</b>
+<b>
+<a>59827</a>
+<b>59828</b>
+<v>1</v>
+</b>
+<b>
+<a>85214</a>
+<b>85215</b>
+<v>1</v>
+</b>
+<b>
+<a>87463</a>
+<b>87464</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>45</b>
+<v>403</v>
+</b>
+<b>
+<a>45</a>
+<b>95</b>
+<v>408</v>
+</b>
+<b>
+<a>95</a>
+<b>149</b>
+<v>399</v>
+</b>
+<b>
+<a>149</a>
+<b>212</b>
+<v>408</v>
+</b>
+<b>
+<a>212</a>
+<b>291</b>
+<v>405</v>
+</b>
+<b>
+<a>291</a>
+<b>362</b>
+<v>399</v>
+</b>
+<b>
+<a>362</a>
+<b>461</b>
+<v>401</v>
+</b>
+<b>
+<a>461</a>
+<b>585</b>
+<v>399</v>
+</b>
+<b>
+<a>585</a>
+<b>756</b>
+<v>399</v>
+</b>
+<b>
+<a>756</a>
+<b>1013</b>
+<v>399</v>
+</b>
+<b>
+<a>1013</a>
+<b>1389</b>
+<v>399</v>
+</b>
+<b>
+<a>1389</a>
+<b>2313</b>
+<v>400</v>
+</b>
+<b>
+<a>2320</a>
+<b>6681</b>
+<v>399</v>
+</b>
+<b>
+<a>6717</a>
+<b>1581032</b>
+<v>94</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>5</b>
+<v>174</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1046</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1326</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>1279</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1214</v>
+</b>
+<b>
+<a>9</a>
+<b>10</b>
+<v>273</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>45</b>
+<v>403</v>
+</b>
+<b>
+<a>45</a>
+<b>95</b>
+<v>408</v>
+</b>
+<b>
+<a>95</a>
+<b>149</b>
+<v>399</v>
+</b>
+<b>
+<a>149</a>
+<b>212</b>
+<v>408</v>
+</b>
+<b>
+<a>212</a>
+<b>291</b>
+<v>405</v>
+</b>
+<b>
+<a>291</a>
+<b>362</b>
+<v>399</v>
+</b>
+<b>
+<a>362</a>
+<b>461</b>
+<v>401</v>
+</b>
+<b>
+<a>461</a>
+<b>585</b>
+<v>399</v>
+</b>
+<b>
+<a>585</a>
+<b>756</b>
+<v>399</v>
+</b>
+<b>
+<a>756</a>
+<b>1013</b>
+<v>399</v>
+</b>
+<b>
+<a>1013</a>
+<b>1389</b>
+<v>399</v>
+</b>
+<b>
+<a>1389</a>
+<b>2313</b>
+<v>400</v>
+</b>
+<b>
+<a>2320</a>
+<b>6681</b>
+<v>399</v>
+</b>
+<b>
+<a>6717</a>
+<b>1581032</b>
+<v>94</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>toplevel</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>21</b>
+<v>423</v>
+</b>
+<b>
+<a>21</a>
+<b>33</b>
+<v>416</v>
+</b>
+<b>
+<a>33</a>
+<b>44</b>
+<v>424</v>
+</b>
+<b>
+<a>44</a>
+<b>55</b>
+<v>400</v>
+</b>
+<b>
+<a>55</a>
+<b>65</b>
+<v>426</v>
+</b>
+<b>
+<a>65</a>
+<b>76</b>
+<v>407</v>
+</b>
+<b>
+<a>76</a>
+<b>88</b>
+<v>426</v>
+</b>
+<b>
+<a>88</a>
+<b>102</b>
+<v>402</v>
+</b>
+<b>
+<a>102</a>
+<b>120</b>
+<v>405</v>
+</b>
+<b>
+<a>120</a>
+<b>144</b>
+<v>401</v>
+</b>
+<b>
+<a>144</a>
+<b>180</b>
+<v>400</v>
+</b>
+<b>
+<a>180</a>
+<b>260</b>
+<v>400</v>
+</b>
+<b>
+<a>260</a>
+<b>46630</b>
+<v>382</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1083847</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>166188</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>136823</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>123495</v>
+</b>
+<b>
+<a>9</a>
+<b>5313</b>
+<v>70678</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1175018</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>207984</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>120754</v>
+</b>
+<b>
+<a>4</a>
+<b>10</b>
+<v>77275</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1083847</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>166188</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>136823</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>123495</v>
+</b>
+<b>
+<a>9</a>
+<b>5313</b>
+<v>70678</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1089271</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>165753</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>104658</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>145624</v>
+</b>
+<b>
+<a>8</a>
+<b>1449</b>
+<v>75725</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>104636</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>47235</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>20077</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>16835</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>19608</v>
+</b>
+<b>
+<a>9</a>
+<b>34</b>
+<v>17687</v>
+</b>
+<b>
+<a>34</a>
+<b>789848</b>
+<v>8101</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>234168</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>toplevel</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>174552</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>34819</v>
+</b>
+<b>
+<a>3</a>
+<b>8</b>
+<v>18537</v>
+</b>
+<b>
+<a>8</a>
+<b>5313</b>
+<v>6271</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>105969</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>47057</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>19986</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>16682</v>
+</b>
+<b>
+<a>5</a>
+<b>9</b>
+<v>19402</v>
+</b>
+<b>
+<a>9</a>
+<b>36</b>
+<v>17686</v>
+</b>
+<b>
+<a>36</a>
+<b>347359</b>
+<v>7397</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>next_token</name>
+<cardinality>104943</cardinality>
+<columnsizes>
+<e>
+<k>comment</k>
+<v>104943</v>
+</e>
+<e>
+<k>token</k>
+<v>74457</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>comment</src>
+<trg>token</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>104943</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>token</src>
+<trg>comment</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>59983</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8628</v>
+</b>
+<b>
+<a>3</a>
+<b>12</b>
+<v>5601</v>
+</b>
+<b>
+<a>12</a>
+<b>141</b>
+<v>245</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>json</name>
+<key>id</key>
+<cardinality>1643352</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1643352</v>
+</e>
+<e>
+<k>kind</k>
+<v>6</v>
+</e>
+<e>
+<k>parent</k>
+<v>617634</v>
+</e>
+<e>
+<k>idx</k>
+<v>159429</v>
+</e>
+<e>
+<k>tostring</k>
+<v>768907</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1643352</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1643352</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1643352</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1643352</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>24</a>
+<b>25</b>
+<v>1</v>
+</b>
+<b>
+<a>654</a>
+<b>655</b>
+<v>1</v>
+</b>
+<b>
+<a>175925</a>
+<b>175926</b>
+<v>1</v>
+</b>
+<b>
+<a>273113</a>
+<b>273114</b>
+<v>1</v>
+</b>
+<b>
+<a>441281</a>
+<b>441282</b>
+<v>1</v>
+</b>
+<b>
+<a>752355</a>
+<b>752356</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>17</a>
+<b>18</b>
+<v>1</v>
+</b>
+<b>
+<a>411</a>
+<b>412</b>
+<v>1</v>
+</b>
+<b>
+<a>165183</a>
+<b>165184</b>
+<v>1</v>
+</b>
+<b>
+<a>167132</a>
+<b>167133</b>
+<v>1</v>
+</b>
+<b>
+<a>271547</a>
+<b>271548</b>
+<v>1</v>
+</b>
+<b>
+<a>452264</a>
+<b>452265</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>65</a>
+<b>66</b>
+<v>1</v>
+</b>
+<b>
+<a>152</a>
+<b>153</b>
+<v>1</v>
+</b>
+<b>
+<a>174</a>
+<b>175</b>
+<v>1</v>
+</b>
+<b>
+<a>198</a>
+<b>199</b>
+<v>1</v>
+</b>
+<b>
+<a>159429</a>
+<b>159430</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>2865</a>
+<b>2866</b>
+<v>1</v>
+</b>
+<b>
+<a>100735</a>
+<b>100736</b>
+<v>1</v>
+</b>
+<b>
+<a>271467</a>
+<b>271468</b>
+<v>1</v>
+</b>
+<b>
+<a>393837</a>
+<b>393838</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>127476</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>184044</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>285109</v>
+</b>
+<b>
+<a>4</a>
+<b>159430</b>
+<v>21005</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>179808</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>437119</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>707</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>127476</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>184044</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>285109</v>
+</b>
+<b>
+<a>4</a>
+<b>159430</b>
+<v>21005</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>173483</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>197229</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>240036</v>
+</b>
+<b>
+<a>4</a>
+<b>135127</b>
+<v>6886</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>158929</v>
+</b>
+<b>
+<a>3</a>
+<b>617635</b>
+<v>500</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>159178</v>
+</b>
+<b>
+<a>2</a>
+<b>7</b>
+<v>251</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>158929</v>
+</b>
+<b>
+<a>3</a>
+<b>617635</b>
+<v>500</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>158929</v>
+</b>
+<b>
+<a>2</a>
+<b>429145</b>
+<v>500</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>511110</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>165121</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>69702</v>
+</b>
+<b>
+<a>6</a>
+<b>63547</b>
+<v>22974</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>768907</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>562365</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>144455</v>
+</b>
+<b>
+<a>3</a>
+<b>10</b>
+<v>58431</v>
+</b>
+<b>
+<a>10</a>
+<b>63547</b>
+<v>3656</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>554379</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>185366</v>
+</b>
+<b>
+<a>3</a>
+<b>720</b>
+<v>29162</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>json_literals</name>
+<cardinality>1026146</cardinality>
+<columnsizes>
+<e>
+<k>value</k>
+<v>397229</v>
+</e>
+<e>
+<k>raw</k>
+<v>397431</v>
+</e>
+<e>
+<k>expr</k>
+<v>1026146</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>value</src>
+<trg>raw</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>397027</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>202</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>expr</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>216149</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>128106</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>28217</v>
+</b>
+<b>
+<a>5</a>
+<b>63547</b>
+<v>24757</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>raw</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>397431</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>raw</src>
+<trg>expr</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>216237</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>128277</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>28205</v>
+</b>
+<b>
+<a>5</a>
+<b>63547</b>
+<v>24712</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>expr</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1026146</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>expr</src>
+<trg>raw</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1026146</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>json_properties</name>
+<cardinality>1186648</cardinality>
+<columnsizes>
+<e>
+<k>obj</k>
+<v>441238</v>
+</e>
+<e>
+<k>property</k>
+<v>2285</v>
+</e>
+<e>
+<k>value</k>
+<v>1186648</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>obj</src>
+<trg>property</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>685</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>161803</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>272428</v>
+</b>
+<b>
+<a>4</a>
+<b>252</b>
+<v>6322</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>obj</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>685</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>161803</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>272428</v>
+</b>
+<b>
+<a>4</a>
+<b>252</b>
+<v>6322</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>property</src>
+<trg>obj</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1378</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>371</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>199</v>
+</b>
+<b>
+<a>4</a>
+<b>17</b>
+<v>174</v>
+</b>
+<b>
+<a>18</a>
+<b>429290</b>
+<v>163</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>property</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1378</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>371</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>199</v>
+</b>
+<b>
+<a>4</a>
+<b>17</b>
+<v>174</v>
+</b>
+<b>
+<a>18</a>
+<b>429290</b>
+<v>163</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>obj</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1186648</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>property</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1186648</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>json_errors</name>
+<key>id</key>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1</v>
+</e>
+<e>
+<k>message</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>json_locations</name>
+<cardinality>712</cardinality>
+<columnsizes>
+<e>
+<k>locatable</k>
+<v>712</v>
+</e>
+<e>
+<k>location</k>
+<v>712</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>locatable</src>
+<trg>location</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>712</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>location</src>
+<trg>locatable</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>712</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>hasLocation</name>
+<cardinality>19213780</cardinality>
+<columnsizes>
+<e>
+<k>locatable</k>
+<v>19213780</v>
+</e>
+<e>
+<k>location</k>
+<v>15664049</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>locatable</src>
+<trg>location</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19213780</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>location</src>
+<trg>locatable</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>12144311</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3490097</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>29641</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>entry_cfg_node</name>
+<key>id</key>
+<cardinality>121542</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>121542</v>
+</e>
+<e>
+<k>container</k>
+<v>121542</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>container</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>121542</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>container</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>121542</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>exit_cfg_node</name>
+<key>id</key>
+<cardinality>121542</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>121542</v>
+</e>
+<e>
+<k>container</k>
+<v>121542</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>container</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>121542</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>container</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>121542</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>guard_node</name>
+<cardinality>177785</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>177785</v>
+</e>
+<e>
+<k>kind</k>
+<v>2</v>
+</e>
+<e>
+<k>test</k>
+<v>91338</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>177785</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>test</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>177785</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>86336</a>
+<b>86337</b>
+<v>1</v>
+</b>
+<b>
+<a>91449</a>
+<b>91450</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>test</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>82430</a>
+<b>82431</b>
+<v>1</v>
+</b>
+<b>
+<a>89999</a>
+<b>90000</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>test</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>10245</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>76994</v>
+</b>
+<b>
+<a>3</a>
+<b>21</b>
+<v>4099</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>test</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>10247</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>81091</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>successor</name>
+<cardinality>6873752</cardinality>
+<columnsizes>
+<e>
+<k>pred</k>
+<v>6717415</v>
+</e>
+<e>
+<k>succ</k>
+<v>6718602</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>pred</src>
+<trg>succ</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6588118</v>
+</b>
+<b>
+<a>2</a>
+<b>21</b>
+<v>129297</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>succ</src>
+<trg>pred</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6617438</v>
+</b>
+<b>
+<a>2</a>
+<b>253</b>
+<v>101164</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>jsdoc</name>
+<key>id</key>
+<cardinality>19270</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>19270</v>
+</e>
+<e>
+<k>description</k>
+<v>9383</v>
+</e>
+<e>
+<k>comment</k>
+<v>19270</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>description</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19270</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>comment</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19270</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>description</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7588</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1387</v>
+</b>
+<b>
+<a>3</a>
+<b>5727</b>
+<v>408</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>description</src>
+<trg>comment</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>7588</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1387</v>
+</b>
+<b>
+<a>3</a>
+<b>5727</b>
+<v>408</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>comment</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19270</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>comment</src>
+<trg>description</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19270</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>jsdoc_tags</name>
+<key>id</key>
+<cardinality>29323</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>29323</v>
+</e>
+<e>
+<k>title</k>
+<v>92</v>
+</e>
+<e>
+<k>parent</k>
+<v>14226</v>
+</e>
+<e>
+<k>idx</k>
+<v>66</v>
+</e>
+<e>
+<k>tostring</k>
+<v>92</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>title</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>29323</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>29323</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>29323</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>29323</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>title</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>5</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>7</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>8</v>
+</b>
+<b>
+<a>8</a>
+<b>12</b>
+<v>7</v>
+</b>
+<b>
+<a>13</a>
+<b>17</b>
+<v>7</v>
+</b>
+<b>
+<a>20</a>
+<b>35</b>
+<v>7</v>
+</b>
+<b>
+<a>40</a>
+<b>55</b>
+<v>7</v>
+</b>
+<b>
+<a>58</a>
+<b>111</b>
+<v>7</v>
+</b>
+<b>
+<a>114</a>
+<b>167</b>
+<v>8</v>
+</b>
+<b>
+<a>170</a>
+<b>331</b>
+<v>7</v>
+</b>
+<b>
+<a>587</a>
+<b>913</b>
+<v>7</v>
+</b>
+<b>
+<a>2221</a>
+<b>10284</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>title</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>5</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>5</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>7</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>8</v>
+</b>
+<b>
+<a>10</a>
+<b>16</b>
+<v>7</v>
+</b>
+<b>
+<a>16</a>
+<b>26</b>
+<v>7</v>
+</b>
+<b>
+<a>26</a>
+<b>36</b>
+<v>7</v>
+</b>
+<b>
+<a>38</a>
+<b>67</b>
+<v>7</v>
+</b>
+<b>
+<a>68</a>
+<b>111</b>
+<v>7</v>
+</b>
+<b>
+<a>137</a>
+<b>213</b>
+<v>7</v>
+</b>
+<b>
+<a>232</a>
+<b>702</b>
+<v>7</v>
+</b>
+<b>
+<a>870</a>
+<b>6020</b>
+<v>7</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>title</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>35</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>7</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>8</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>8</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>5</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>4</v>
+</b>
+<b>
+<a>8</a>
+<b>10</b>
+<v>8</v>
+</b>
+<b>
+<a>10</a>
+<b>31</b>
+<v>7</v>
+</b>
+<b>
+<a>46</a>
+<b>59</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>title</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>92</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6064</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4452</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2064</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>913</v>
+</b>
+<b>
+<a>5</a>
+<b>67</b>
+<v>733</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>title</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6972</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4911</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1793</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>550</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6064</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4452</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2064</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>913</v>
+</b>
+<b>
+<a>5</a>
+<b>67</b>
+<v>733</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6972</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4911</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1793</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>550</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>29</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>6</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>5</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>6</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>5</v>
+</b>
+<b>
+<a>11</a>
+<b>53</b>
+<v>5</v>
+</b>
+<b>
+<a>89</a>
+<b>1647</b>
+<v>5</v>
+</b>
+<b>
+<a>3710</a>
+<b>14227</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>title</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>9</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>31</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>9</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>6</v>
+</b>
+<b>
+<a>8</a>
+<b>21</b>
+<v>5</v>
+</b>
+<b>
+<a>29</a>
+<b>61</b>
+<v>5</v>
+</b>
+<b>
+<a>70</a>
+<b>71</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>29</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>6</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>5</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>6</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>5</v>
+</b>
+<b>
+<a>11</a>
+<b>53</b>
+<v>5</v>
+</b>
+<b>
+<a>89</a>
+<b>1647</b>
+<v>5</v>
+</b>
+<b>
+<a>3710</a>
+<b>14227</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>9</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>31</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>9</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>6</v>
+</b>
+<b>
+<a>8</a>
+<b>21</b>
+<v>5</v>
+</b>
+<b>
+<a>29</a>
+<b>61</b>
+<v>5</v>
+</b>
+<b>
+<a>70</a>
+<b>71</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>5</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>7</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>8</v>
+</b>
+<b>
+<a>8</a>
+<b>12</b>
+<v>7</v>
+</b>
+<b>
+<a>13</a>
+<b>17</b>
+<v>7</v>
+</b>
+<b>
+<a>20</a>
+<b>35</b>
+<v>7</v>
+</b>
+<b>
+<a>40</a>
+<b>55</b>
+<v>7</v>
+</b>
+<b>
+<a>58</a>
+<b>111</b>
+<v>7</v>
+</b>
+<b>
+<a>114</a>
+<b>167</b>
+<v>8</v>
+</b>
+<b>
+<a>170</a>
+<b>331</b>
+<v>7</v>
+</b>
+<b>
+<a>587</a>
+<b>913</b>
+<v>7</v>
+</b>
+<b>
+<a>2221</a>
+<b>10284</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>title</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>92</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>5</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>5</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>7</v>
+</b>
+<b>
+<a>6</a>
+<b>10</b>
+<v>8</v>
+</b>
+<b>
+<a>10</a>
+<b>16</b>
+<v>7</v>
+</b>
+<b>
+<a>16</a>
+<b>26</b>
+<v>7</v>
+</b>
+<b>
+<a>26</a>
+<b>36</b>
+<v>7</v>
+</b>
+<b>
+<a>38</a>
+<b>67</b>
+<v>7</v>
+</b>
+<b>
+<a>68</a>
+<b>111</b>
+<v>7</v>
+</b>
+<b>
+<a>137</a>
+<b>213</b>
+<v>7</v>
+</b>
+<b>
+<a>232</a>
+<b>702</b>
+<v>7</v>
+</b>
+<b>
+<a>870</a>
+<b>6020</b>
+<v>7</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>35</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>8</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>7</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>8</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>8</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>5</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>4</v>
+</b>
+<b>
+<a>8</a>
+<b>10</b>
+<v>8</v>
+</b>
+<b>
+<a>10</a>
+<b>31</b>
+<v>7</v>
+</b>
+<b>
+<a>46</a>
+<b>59</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>jsdoc_tag_descriptions</name>
+<cardinality>13676</cardinality>
+<columnsizes>
+<e>
+<k>tag</k>
+<v>13676</v>
+</e>
+<e>
+<k>text</k>
+<v>7866</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>tag</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>13676</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>6089</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1025</v>
+</b>
+<b>
+<a>3</a>
+<b>8</b>
+<v>596</v>
+</b>
+<b>
+<a>8</a>
+<b>459</b>
+<v>156</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>jsdoc_tag_names</name>
+<cardinality>11506</cardinality>
+<columnsizes>
+<e>
+<k>tag</k>
+<v>11506</v>
+</e>
+<e>
+<k>text</k>
+<v>2647</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>tag</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11506</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1398</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>569</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>201</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>208</v>
+</b>
+<b>
+<a>7</a>
+<b>24</b>
+<v>200</v>
+</b>
+<b>
+<a>24</a>
+<b>498</b>
+<v>71</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>jsdoc_type_exprs</name>
+<key>id</key>
+<cardinality>22481</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>22481</v>
+</e>
+<e>
+<k>kind</k>
+<v>15</v>
+</e>
+<e>
+<k>parent</k>
+<v>21039</v>
+</e>
+<e>
+<k>idx</k>
+<v>17</v>
+</e>
+<e>
+<k>tostring</k>
+<v>1447</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22481</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22481</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22481</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22481</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>19</a>
+<b>20</b>
+<v>1</v>
+</b>
+<b>
+<a>27</a>
+<b>28</b>
+<v>1</v>
+</b>
+<b>
+<a>35</a>
+<b>36</b>
+<v>1</v>
+</b>
+<b>
+<a>55</a>
+<b>56</b>
+<v>1</v>
+</b>
+<b>
+<a>91</a>
+<b>92</b>
+<v>1</v>
+</b>
+<b>
+<a>287</a>
+<b>288</b>
+<v>1</v>
+</b>
+<b>
+<a>292</a>
+<b>293</b>
+<v>1</v>
+</b>
+<b>
+<a>303</a>
+<b>304</b>
+<v>1</v>
+</b>
+<b>
+<a>310</a>
+<b>311</b>
+<v>1</v>
+</b>
+<b>
+<a>316</a>
+<b>317</b>
+<v>1</v>
+</b>
+<b>
+<a>536</a>
+<b>537</b>
+<v>1</v>
+</b>
+<b>
+<a>668</a>
+<b>669</b>
+<v>1</v>
+</b>
+<b>
+<a>895</a>
+<b>896</b>
+<v>1</v>
+</b>
+<b>
+<a>18639</a>
+<b>18640</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>19</a>
+<b>20</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>1</v>
+</b>
+<b>
+<a>35</a>
+<b>36</b>
+<v>1</v>
+</b>
+<b>
+<a>55</a>
+<b>56</b>
+<v>1</v>
+</b>
+<b>
+<a>90</a>
+<b>91</b>
+<v>1</v>
+</b>
+<b>
+<a>287</a>
+<b>288</b>
+<v>2</v>
+</b>
+<b>
+<a>301</a>
+<b>302</b>
+<v>1</v>
+</b>
+<b>
+<a>310</a>
+<b>311</b>
+<v>1</v>
+</b>
+<b>
+<a>314</a>
+<b>315</b>
+<v>1</v>
+</b>
+<b>
+<a>524</a>
+<b>525</b>
+<v>1</v>
+</b>
+<b>
+<a>583</a>
+<b>584</b>
+<v>1</v>
+</b>
+<b>
+<a>890</a>
+<b>891</b>
+<v>1</v>
+</b>
+<b>
+<a>17717</a>
+<b>17718</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>5</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>13</a>
+<b>14</b>
+<v>1</v>
+</b>
+<b>
+<a>16</a>
+<b>17</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>51</a>
+<b>52</b>
+<v>1</v>
+</b>
+<b>
+<a>57</a>
+<b>58</b>
+<v>1</v>
+</b>
+<b>
+<a>86</a>
+<b>87</b>
+<v>1</v>
+</b>
+<b>
+<a>89</a>
+<b>90</b>
+<v>1</v>
+</b>
+<b>
+<a>104</a>
+<b>105</b>
+<v>1</v>
+</b>
+<b>
+<a>155</a>
+<b>156</b>
+<v>1</v>
+</b>
+<b>
+<a>194</a>
+<b>195</b>
+<v>1</v>
+</b>
+<b>
+<a>696</a>
+<b>697</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19985</v>
+</b>
+<b>
+<a>2</a>
+<b>16</b>
+<v>1054</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>20644</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>395</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19985</v>
+</b>
+<b>
+<a>2</a>
+<b>16</b>
+<v>1054</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>19997</v>
+</b>
+<b>
+<a>2</a>
+<b>7</b>
+<v>1042</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>3</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>4</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>1</v>
+</b>
+<b>
+<a>32</a>
+<b>33</b>
+<v>1</v>
+</b>
+<b>
+<a>93</a>
+<b>94</b>
+<v>1</v>
+</b>
+<b>
+<a>165</a>
+<b>166</b>
+<v>1</v>
+</b>
+<b>
+<a>340</a>
+<b>341</b>
+<v>1</v>
+</b>
+<b>
+<a>750</a>
+<b>751</b>
+<v>1</v>
+</b>
+<b>
+<a>21021</a>
+<b>21022</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>7</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>13</a>
+<b>14</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>3</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>4</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>1</v>
+</b>
+<b>
+<a>32</a>
+<b>33</b>
+<v>1</v>
+</b>
+<b>
+<a>93</a>
+<b>94</b>
+<v>1</v>
+</b>
+<b>
+<a>165</a>
+<b>166</b>
+<v>1</v>
+</b>
+<b>
+<a>340</a>
+<b>341</b>
+<v>1</v>
+</b>
+<b>
+<a>750</a>
+<b>751</b>
+<v>1</v>
+</b>
+<b>
+<a>21021</a>
+<b>21022</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>3</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>17</a>
+<b>18</b>
+<v>1</v>
+</b>
+<b>
+<a>21</a>
+<b>22</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>1</v>
+</b>
+<b>
+<a>42</a>
+<b>43</b>
+<v>1</v>
+</b>
+<b>
+<a>103</a>
+<b>104</b>
+<v>1</v>
+</b>
+<b>
+<a>1378</a>
+<b>1379</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>713</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>271</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>105</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>110</v>
+</b>
+<b>
+<a>6</a>
+<b>12</b>
+<v>111</v>
+</b>
+<b>
+<a>12</a>
+<b>77</b>
+<v>109</v>
+</b>
+<b>
+<a>77</a>
+<b>2754</b>
+<v>28</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1446</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>713</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>271</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>105</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>110</v>
+</b>
+<b>
+<a>6</a>
+<b>12</b>
+<v>112</v>
+</b>
+<b>
+<a>12</a>
+<b>78</b>
+<v>110</v>
+</b>
+<b>
+<a>78</a>
+<b>2747</b>
+<v>26</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1356</v>
+</b>
+<b>
+<a>2</a>
+<b>15</b>
+<v>91</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>jsdoc_record_field_name</name>
+<cardinality>241</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>90</v>
+</e>
+<e>
+<k>idx</k>
+<v>15</v>
+</e>
+<e>
+<k>name</k>
+<v>123</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>47</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>19</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>8</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>8</v>
+</b>
+<b>
+<a>7</a>
+<b>16</b>
+<v>8</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>47</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>19</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>8</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>8</v>
+</b>
+<b>
+<a>7</a>
+<b>16</b>
+<v>8</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>3</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>4</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
+<v>1</v>
+</b>
+<b>
+<a>16</a>
+<b>17</b>
+<v>1</v>
+</b>
+<b>
+<a>24</a>
+<b>25</b>
+<v>1</v>
+</b>
+<b>
+<a>43</a>
+<b>44</b>
+<v>1</v>
+</b>
+<b>
+<a>90</a>
+<b>91</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>3</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>1</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>12</a>
+<b>13</b>
+<v>1</v>
+</b>
+<b>
+<a>13</a>
+<b>14</b>
+<v>1</v>
+</b>
+<b>
+<a>18</a>
+<b>19</b>
+<v>1</v>
+</b>
+<b>
+<a>29</a>
+<b>30</b>
+<v>1</v>
+</b>
+<b>
+<a>37</a>
+<b>38</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>65</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>40</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>6</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>10</v>
+</b>
+<b>
+<a>9</a>
+<b>25</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>87</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>34</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>jsdoc_prefix_qualifier</name>
+<cardinality>823</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>823</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>jsdoc_has_new_parameter</name>
+<cardinality>22</cardinality>
+<columnsizes>
+<e>
+<k>fn</k>
+<v>22</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>jsdoc_errors</name>
+<key>id</key>
+<cardinality>1658</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1658</v>
+</e>
+<e>
+<k>tag</k>
+<v>1460</v>
+</e>
+<e>
+<k>message</k>
+<v>203</v>
+</e>
+<e>
+<k>tostring</k>
+<v>89</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1658</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1658</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1658</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tag</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1262</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>198</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tag</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1262</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>198</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tag</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1262</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>198</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>144</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>27</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>16</v>
+</b>
+<b>
+<a>7</a>
+<b>347</b>
+<v>16</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>144</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>27</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>16</v>
+</b>
+<b>
+<a>7</a>
+<b>347</b>
+<v>16</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>203</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>48</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>10</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>6</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>7</v>
+</b>
+<b>
+<a>11</a>
+<b>27</b>
+<v>7</v>
+</b>
+<b>
+<a>34</a>
+<b>347</b>
+<v>7</v>
+</b>
+<b>
+<a>477</a>
+<b>478</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>48</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>10</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>6</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>7</v>
+</b>
+<b>
+<a>11</a>
+<b>27</b>
+<v>7</v>
+</b>
+<b>
+<a>34</a>
+<b>347</b>
+<v>7</v>
+</b>
+<b>
+<a>477</a>
+<b>478</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>66</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>6</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>7</v>
+</b>
+<b>
+<a>8</a>
+<b>25</b>
+<v>7</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>yaml</name>
+<key>id</key>
+<cardinality>885</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>885</v>
+</e>
+<e>
+<k>kind</k>
+<v>4</v>
+</e>
+<e>
+<k>parent</k>
+<v>204</v>
+</e>
+<e>
+<k>idx</k>
+<v>25</v>
+</e>
+<e>
+<k>tag</k>
+<v>8</v>
+</e>
+<e>
+<k>tostring</k>
+<v>318</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>885</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>885</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>885</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>885</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>885</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>35</a>
+<b>36</b>
+<v>1</v>
+</b>
+<b>
+<a>149</a>
+<b>150</b>
+<v>1</v>
+</b>
+<b>
+<a>700</a>
+<b>701</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>33</a>
+<b>34</b>
+<v>1</v>
+</b>
+<b>
+<a>90</a>
+<b>91</b>
+<v>1</v>
+</b>
+<b>
+<a>183</a>
+<b>184</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>1</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>25</a>
+<b>26</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>67</a>
+<b>68</b>
+<v>1</v>
+</b>
+<b>
+<a>240</a>
+<b>241</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>33</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>72</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>35</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>29</v>
+</b>
+<b>
+<a>8</a>
+<b>11</b>
+<v>14</v>
+</b>
+<b>
+<a>12</a>
+<b>21</b>
+<v>17</v>
+</b>
+<b>
+<a>22</a>
+<b>25</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>131</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>43</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>30</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>33</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>72</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>35</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>29</v>
+</b>
+<b>
+<a>8</a>
+<b>11</b>
+<v>14</v>
+</b>
+<b>
+<a>12</a>
+<b>21</b>
+<v>17</v>
+</b>
+<b>
+<a>22</a>
+<b>25</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>120</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>41</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>36</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parent</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>33</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>72</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>35</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>5</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>24</v>
+</b>
+<b>
+<a>8</a>
+<b>11</b>
+<v>14</v>
+</b>
+<b>
+<a>12</a>
+<b>14</b>
+<v>16</v>
+</b>
+<b>
+<a>16</a>
+<b>23</b>
+<v>3</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7</v>
+</b>
+<b>
+<a>5</a>
+<b>20</b>
+<v>2</v>
+</b>
+<b>
+<a>20</a>
+<b>25</b>
+<v>2</v>
+</b>
+<b>
+<a>25</a>
+<b>33</b>
+<v>2</v>
+</b>
+<b>
+<a>33</a>
+<b>56</b>
+<v>2</v>
+</b>
+<b>
+<a>61</a>
+<b>64</b>
+<v>2</v>
+</b>
+<b>
+<a>95</a>
+<b>100</b>
+<v>2</v>
+</b>
+<b>
+<a>149</a>
+<b>172</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>14</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>4</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>6</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7</v>
+</b>
+<b>
+<a>5</a>
+<b>20</b>
+<v>2</v>
+</b>
+<b>
+<a>20</a>
+<b>25</b>
+<v>2</v>
+</b>
+<b>
+<a>25</a>
+<b>33</b>
+<v>2</v>
+</b>
+<b>
+<a>33</a>
+<b>56</b>
+<v>2</v>
+</b>
+<b>
+<a>61</a>
+<b>64</b>
+<v>2</v>
+</b>
+<b>
+<a>95</a>
+<b>100</b>
+<v>2</v>
+</b>
+<b>
+<a>149</a>
+<b>172</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>5</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>4</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>4</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>2</v>
+</b>
+<b>
+<a>7</a>
+<b>11</b>
+<v>2</v>
+</b>
+<b>
+<a>12</a>
+<b>15</b>
+<v>2</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>1</v>
+</b>
+<b>
+<a>18</a>
+<b>19</b>
+<v>2</v>
+</b>
+<b>
+<a>28</a>
+<b>31</b>
+<v>2</v>
+</b>
+<b>
+<a>52</a>
+<b>56</b>
+<v>2</v>
+</b>
+<b>
+<a>87</a>
+<b>88</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tag</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>15</a>
+<b>16</b>
+<v>1</v>
+</b>
+<b>
+<a>26</a>
+<b>27</b>
+<v>1</v>
+</b>
+<b>
+<a>35</a>
+<b>36</b>
+<v>1</v>
+</b>
+<b>
+<a>149</a>
+<b>150</b>
+<v>1</v>
+</b>
+<b>
+<a>654</a>
+<b>655</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tag</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tag</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>25</a>
+<b>26</b>
+<v>1</v>
+</b>
+<b>
+<a>33</a>
+<b>34</b>
+<v>1</v>
+</b>
+<b>
+<a>90</a>
+<b>91</b>
+<v>1</v>
+</b>
+<b>
+<a>183</a>
+<b>184</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tag</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>1</v>
+</b>
+<b>
+<a>9</a>
+<b>10</b>
+<v>1</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1</v>
+</b>
+<b>
+<a>23</a>
+<b>24</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tag</src>
+<trg>tostring</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1</v>
+</b>
+<b>
+<a>13</a>
+<b>14</b>
+<v>1</v>
+</b>
+<b>
+<a>67</a>
+<b>68</b>
+<v>1</v>
+</b>
+<b>
+<a>223</a>
+<b>224</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>209</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>42</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>29</v>
+</b>
+<b>
+<a>6</a>
+<b>15</b>
+<v>25</v>
+</b>
+<b>
+<a>15</a>
+<b>18</b>
+<v>13</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>318</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>parent</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>213</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>41</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>27</v>
+</b>
+<b>
+<a>6</a>
+<b>15</b>
+<v>25</v>
+</b>
+<b>
+<a>15</a>
+<b>18</b>
+<v>12</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>272</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>34</v>
+</b>
+<b>
+<a>3</a>
+<b>10</b>
+<v>12</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>tostring</src>
+<trg>tag</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>318</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>yaml_anchors</name>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>node</k>
+<v>1</v>
+</e>
+<e>
+<k>anchor</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>node</src>
+<trg>anchor</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>anchor</src>
+<trg>node</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>yaml_aliases</name>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>alias</k>
+<v>1</v>
+</e>
+<e>
+<k>target</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>alias</src>
+<trg>target</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>target</src>
+<trg>alias</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>yaml_scalars</name>
+<cardinality>700</cardinality>
+<columnsizes>
+<e>
+<k>scalar</k>
+<v>700</v>
+</e>
+<e>
+<k>style</k>
+<v>3</v>
+</e>
+<e>
+<k>value</k>
+<v>241</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>scalar</src>
+<trg>style</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>700</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>scalar</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>700</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>style</src>
+<trg>scalar</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>14</a>
+<b>15</b>
+<v>1</v>
+</b>
+<b>
+<a>97</a>
+<b>98</b>
+<v>1</v>
+</b>
+<b>
+<a>589</a>
+<b>590</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>style</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>12</a>
+<b>13</b>
+<v>1</v>
+</b>
+<b>
+<a>47</a>
+<b>48</b>
+<v>1</v>
+</b>
+<b>
+<a>183</a>
+<b>184</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>scalar</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>158</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>32</v>
+</b>
+<b>
+<a>3</a>
+<b>6</b>
+<v>19</v>
+</b>
+<b>
+<a>6</a>
+<b>15</b>
+<v>20</v>
+</b>
+<b>
+<a>15</a>
+<b>18</b>
+<v>12</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>style</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>240</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>yaml_errors</name>
+<key>id</key>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1</v>
+</e>
+<e>
+<k>message</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>message</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>message</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>yaml_locations</name>
+<cardinality>71</cardinality>
+<columnsizes>
+<e>
+<k>locatable</k>
+<v>71</v>
+</e>
+<e>
+<k>location</k>
+<v>71</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>locatable</src>
+<trg>location</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>71</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>location</src>
+<trg>locatable</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>71</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xmlEncoding</name>
+<cardinality>39724</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>39724</v>
+</e>
+<e>
+<k>encoding</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>encoding</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>39724</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>encoding</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>39724</a>
+<b>39725</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xmlDTDs</name>
+<cardinality>1</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1</v>
+</e>
+<e>
+<k>root</k>
+<v>1</v>
+</e>
+<e>
+<k>publicId</k>
+<v>1</v>
+</e>
+<e>
+<k>systemId</k>
+<v>1</v>
+</e>
+<e>
+<k>fileid</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>root</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>publicId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>systemId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>root</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>root</src>
+<trg>publicId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>root</src>
+<trg>systemId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>root</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>publicId</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>publicId</src>
+<trg>root</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>publicId</src>
+<trg>systemId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>publicId</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>systemId</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>systemId</src>
+<trg>root</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>systemId</src>
+<trg>publicId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>systemId</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>root</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>publicId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>systemId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xmlElements</name>
+<cardinality>1270313</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1270313</v>
+</e>
+<e>
+<k>name</k>
+<v>4655</v>
+</e>
+<e>
+<k>parentid</k>
+<v>578021</v>
+</e>
+<e>
+<k>idx</k>
+<v>35122</v>
+</e>
+<e>
+<k>fileid</k>
+<v>39721</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1270313</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1270313</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1270313</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1270313</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>420</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>156</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>3832</v>
+</b>
+<b>
+<a>6</a>
+<b>310317</b>
+<v>247</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>456</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>150</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>3829</v>
+</b>
+<b>
+<a>6</a>
+<b>161565</b>
+<v>220</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4358</v>
+</b>
+<b>
+<a>2</a>
+<b>35123</b>
+<v>297</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>486</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>133</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>3831</v>
+</b>
+<b>
+<a>6</a>
+<b>14503</b>
+<v>205</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>371969</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>62095</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>104113</v>
+</b>
+<b>
+<a>4</a>
+<b>35123</b>
+<v>39844</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>500482</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>17866</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>49117</v>
+</b>
+<b>
+<a>4</a>
+<b>45</b>
+<v>10556</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>371969</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>62095</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>104113</v>
+</b>
+<b>
+<a>4</a>
+<b>35123</b>
+<v>39844</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>578021</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>606</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>17851</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>6533</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>859</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>4471</v>
+</b>
+<b>
+<a>9</a>
+<b>16</b>
+<v>2719</v>
+</b>
+<b>
+<a>16</a>
+<b>578022</b>
+<v>2083</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>18457</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>6533</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>6178</v>
+</b>
+<b>
+<a>4</a>
+<b>8</b>
+<v>2624</v>
+</b>
+<b>
+<a>8</a>
+<b>4397</b>
+<v>1330</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>606</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>17851</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>6533</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>859</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>4471</v>
+</b>
+<b>
+<a>9</a>
+<b>16</b>
+<v>2719</v>
+</b>
+<b>
+<a>16</a>
+<b>578022</b>
+<v>2083</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>606</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>17851</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>6533</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>859</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>4471</v>
+</b>
+<b>
+<a>9</a>
+<b>16</b>
+<v>2719</v>
+</b>
+<b>
+<a>16</a>
+<b>39722</b>
+<v>2083</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>20457</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3115</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>3026</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>3588</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>2220</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>3099</v>
+</b>
+<b>
+<a>11</a>
+<b>19</b>
+<v>3087</v>
+</b>
+<b>
+<a>19</a>
+<b>114506</b>
+<v>1129</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>20459</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3458</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>2569</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>2172</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>6158</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>3501</v>
+</b>
+<b>
+<a>9</a>
+<b>46</b>
+<v>1404</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>20457</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>3870</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>2152</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>2876</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>2720</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>4132</v>
+</b>
+<b>
+<a>8</a>
+<b>14</b>
+<v>3096</v>
+</b>
+<b>
+<a>14</a>
+<b>31079</b>
+<v>418</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>25894</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>5301</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>3787</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>3268</v>
+</b>
+<b>
+<a>6</a>
+<b>35123</b>
+<v>1471</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xmlAttrs</name>
+<cardinality>1202020</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>1202020</v>
+</e>
+<e>
+<k>elementid</k>
+<v>760198</v>
+</e>
+<e>
+<k>name</k>
+<v>3649</v>
+</e>
+<e>
+<k>value</k>
+<v>121803</v>
+</e>
+<e>
+<k>idx</k>
+<v>2000</v>
+</e>
+<e>
+<k>fileid</k>
+<v>39448</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>elementid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1202020</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1202020</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1202020</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1202020</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1202020</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>elementid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>425697</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>249659</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>66474</v>
+</b>
+<b>
+<a>4</a>
+<b>2001</b>
+<v>18368</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>elementid</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>425778</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>249579</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>66475</v>
+</b>
+<b>
+<a>4</a>
+<b>2001</b>
+<v>18366</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>elementid</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>466237</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>266291</v>
+</b>
+<b>
+<a>3</a>
+<b>46</b>
+<v>27670</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>elementid</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>425697</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>249659</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>66474</v>
+</b>
+<b>
+<a>4</a>
+<b>2001</b>
+<v>18368</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>elementid</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>760198</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3467</v>
+</b>
+<b>
+<a>2</a>
+<b>262475</b>
+<v>182</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>elementid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3467</v>
+</b>
+<b>
+<a>2</a>
+<b>262475</b>
+<v>182</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3501</v>
+</b>
+<b>
+<a>2</a>
+<b>54146</b>
+<v>148</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3531</v>
+</b>
+<b>
+<a>2</a>
+<b>11</b>
+<v>118</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3491</v>
+</b>
+<b>
+<a>2</a>
+<b>21768</b>
+<v>158</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>72032</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>42366</v>
+</b>
+<b>
+<a>3</a>
+<b>199269</b>
+<v>7405</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>elementid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>72036</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>42374</v>
+</b>
+<b>
+<a>3</a>
+<b>199269</b>
+<v>7393</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>116722</v>
+</b>
+<b>
+<a>2</a>
+<b>2041</b>
+<v>5081</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>117957</v>
+</b>
+<b>
+<a>2</a>
+<b>2001</b>
+<v>3846</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>86306</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>28570</v>
+</b>
+<b>
+<a>3</a>
+<b>4175</b>
+<v>6927</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1955</v>
+</b>
+<b>
+<a>2</a>
+<b>760199</b>
+<v>45</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>elementid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1955</v>
+</b>
+<b>
+<a>2</a>
+<b>760199</b>
+<v>45</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1955</v>
+</b>
+<b>
+<a>2</a>
+<b>189</b>
+<v>45</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1955</v>
+</b>
+<b>
+<a>2</a>
+<b>116643</b>
+<v>45</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1955</v>
+</b>
+<b>
+<a>2</a>
+<b>39449</b>
+<v>45</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22884</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>2565</v>
+</b>
+<b>
+<a>4</a>
+<b>6</b>
+<v>2294</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>3299</v>
+</b>
+<b>
+<a>7</a>
+<b>9</b>
+<v>3272</v>
+</b>
+<b>
+<a>9</a>
+<b>16</b>
+<v>3143</v>
+</b>
+<b>
+<a>16</a>
+<b>129952</b>
+<v>1991</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>elementid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>23890</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>2131</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1971</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>4096</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>3519</v>
+</b>
+<b>
+<a>8</a>
+<b>16</b>
+<v>3137</v>
+</b>
+<b>
+<a>16</a>
+<b>106600</b>
+<v>704</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22946</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2338</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2726</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2824</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>2994</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>3876</v>
+</b>
+<b>
+<a>7</a>
+<b>2002</b>
+<v>1744</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>22916</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>2772</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>2112</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>3510</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>1993</v>
+</b>
+<b>
+<a>8</a>
+<b>11</b>
+<v>3365</v>
+</b>
+<b>
+<a>11</a>
+<b>50357</b>
+<v>2780</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26133</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9699</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>3511</v>
+</b>
+<b>
+<a>5</a>
+<b>2001</b>
+<v>105</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xmlNs</name>
+<cardinality>71201</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>4185</v>
+</e>
+<e>
+<k>prefixName</k>
+<v>958</v>
+</e>
+<e>
+<k>URI</k>
+<v>4185</v>
+</e>
+<e>
+<k>fileid</k>
+<v>39544</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>prefixName</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2602</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1553</v>
+</b>
+<b>
+<a>3</a>
+<b>872</b>
+<v>30</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>URI</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4185</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>6</b>
+<v>274</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>3825</v>
+</b>
+<b>
+<a>7</a>
+<b>24905</b>
+<v>86</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>prefixName</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>915</v>
+</b>
+<b>
+<a>2</a>
+<b>4054</b>
+<v>43</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>prefixName</src>
+<trg>URI</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>915</v>
+</b>
+<b>
+<a>2</a>
+<b>4054</b>
+<v>43</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>prefixName</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>828</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>73</v>
+</b>
+<b>
+<a>5</a>
+<b>24903</b>
+<v>57</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>URI</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4185</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>URI</src>
+<trg>prefixName</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2602</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1553</v>
+</b>
+<b>
+<a>3</a>
+<b>872</b>
+<v>30</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>URI</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>6</b>
+<v>274</v>
+</b>
+<b>
+<a>6</a>
+<b>7</b>
+<v>3825</v>
+</b>
+<b>
+<a>7</a>
+<b>24905</b>
+<v>86</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11655</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>26146</v>
+</b>
+<b>
+<a>3</a>
+<b>8</b>
+<v>1743</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>prefixName</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11653</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>25982</v>
+</b>
+<b>
+<a>3</a>
+<b>31</b>
+<v>1909</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>URI</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11655</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>26146</v>
+</b>
+<b>
+<a>3</a>
+<b>8</b>
+<v>1743</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xmlHasNs</name>
+<cardinality>1139730</cardinality>
+<columnsizes>
+<e>
+<k>elementId</k>
+<v>1139730</v>
+</e>
+<e>
+<k>nsId</k>
+<v>4136</v>
+</e>
+<e>
+<k>fileid</k>
+<v>39537</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>elementId</src>
+<trg>nsId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1139730</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>elementId</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1139730</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>nsId</src>
+<trg>elementId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>5</b>
+<v>234</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>3824</v>
+</b>
+<b>
+<a>6</a>
+<b>643289</b>
+<v>78</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>nsId</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>5</b>
+<v>257</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>3823</v>
+</b>
+<b>
+<a>6</a>
+<b>24759</b>
+<v>56</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>elementId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3669</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>20429</v>
+</b>
+<b>
+<a>3</a>
+<b>7</b>
+<v>2536</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>3473</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>2258</v>
+</b>
+<b>
+<a>9</a>
+<b>11</b>
+<v>3036</v>
+</b>
+<b>
+<a>11</a>
+<b>18</b>
+<v>2966</v>
+</b>
+<b>
+<a>18</a>
+<b>147552</b>
+<v>1170</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>nsId</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>18261</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21032</v>
+</b>
+<b>
+<a>3</a>
+<b>8</b>
+<v>244</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xmlComments</name>
+<cardinality>26812</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>26812</v>
+</e>
+<e>
+<k>text</k>
+<v>22933</v>
+</e>
+<e>
+<k>parentid</k>
+<v>26546</v>
+</e>
+<e>
+<k>fileid</k>
+<v>26368</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26812</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26812</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26812</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21517</v>
+</b>
+<b>
+<a>2</a>
+<b>62</b>
+<v>1416</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21519</v>
+</b>
+<b>
+<a>2</a>
+<b>62</b>
+<v>1414</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21522</v>
+</b>
+<b>
+<a>2</a>
+<b>62</b>
+<v>1411</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26379</v>
+</b>
+<b>
+<a>2</a>
+<b>17</b>
+<v>167</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26379</v>
+</b>
+<b>
+<a>2</a>
+<b>17</b>
+<v>167</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26546</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26161</v>
+</b>
+<b>
+<a>2</a>
+<b>17</b>
+<v>207</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26165</v>
+</b>
+<b>
+<a>2</a>
+<b>17</b>
+<v>203</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26223</v>
+</b>
+<b>
+<a>2</a>
+<b>10</b>
+<v>145</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xmlChars</name>
+<cardinality>439958</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>439958</v>
+</e>
+<e>
+<k>text</k>
+<v>100518</v>
+</e>
+<e>
+<k>parentid</k>
+<v>433851</v>
+</e>
+<e>
+<k>idx</k>
+<v>4</v>
+</e>
+<e>
+<k>isCDATA</k>
+<v>1</v>
+</e>
+<e>
+<k>fileid</k>
+<v>26494</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>439958</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>439958</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>439958</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>isCDATA</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>439958</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>439958</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>60389</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>3811</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>29257</v>
+</b>
+<b>
+<a>5</a>
+<b>23171</b>
+<v>7061</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>60389</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>3811</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>29257</v>
+</b>
+<b>
+<a>5</a>
+<b>23171</b>
+<v>7061</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>100517</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>isCDATA</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>100518</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>text</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>61284</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>4205</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>28328</v>
+</b>
+<b>
+<a>5</a>
+<b>351</b>
+<v>6701</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>429716</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>4135</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>429716</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>4135</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>429716</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>4135</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>isCDATA</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>433851</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>parentid</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>433851</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>80</a>
+<b>81</b>
+<v>1</v>
+</b>
+<b>
+<a>1892</a>
+<b>1893</b>
+<v>1</v>
+</b>
+<b>
+<a>4135</a>
+<b>4136</b>
+<v>1</v>
+</b>
+<b>
+<a>433851</a>
+<b>433852</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>16</a>
+<b>17</b>
+<v>1</v>
+</b>
+<b>
+<a>100499</a>
+<b>100500</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>80</a>
+<b>81</b>
+<v>1</v>
+</b>
+<b>
+<a>1892</a>
+<b>1893</b>
+<v>1</v>
+</b>
+<b>
+<a>4135</a>
+<b>4136</b>
+<v>1</v>
+</b>
+<b>
+<a>433851</a>
+<b>433852</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>isCDATA</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>idx</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+<b>
+<a>46</a>
+<b>47</b>
+<v>1</v>
+</b>
+<b>
+<a>97</a>
+<b>98</b>
+<v>1</v>
+</b>
+<b>
+<a>26494</a>
+<b>26495</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>isCDATA</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>439958</a>
+<b>439959</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>isCDATA</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>100518</a>
+<b>100519</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>isCDATA</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>433851</a>
+<b>433852</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>isCDATA</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>isCDATA</src>
+<trg>fileid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>26494</a>
+<b>26495</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>25303</v>
+</b>
+<b>
+<a>2</a>
+<b>35123</b>
+<v>1191</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>text</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>25765</v>
+</b>
+<b>
+<a>2</a>
+<b>35123</b>
+<v>729</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>parentid</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>25312</v>
+</b>
+<b>
+<a>2</a>
+<b>35123</b>
+<v>1182</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>idx</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26397</v>
+</b>
+<b>
+<a>2</a>
+<b>5</b>
+<v>97</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fileid</src>
+<trg>isCDATA</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>26494</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>xmllocations</name>
+<cardinality>3051056</cardinality>
+<columnsizes>
+<e>
+<k>xmlElement</k>
+<v>2982460</v>
+</e>
+<e>
+<k>location</k>
+<v>3051056</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>xmlElement</src>
+<trg>location</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>2978326</v>
+</b>
+<b>
+<a>2</a>
+<b>24903</b>
+<v>4134</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>location</src>
+<trg>xmlElement</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>3051056</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>filetype</name>
+<cardinality>1102</cardinality>
+<columnsizes>
+<e>
+<k>file</k>
+<v>1102</v>
+</e>
+<e>
+<k>filetype</k>
+<v>3</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>file</src>
+<trg>filetype</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1102</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>filetype</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>162</a>
+<b>163</b>
+<v>1</v>
+</b>
+<b>
+<a>939</a>
+<b>940</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>configs</name>
+<cardinality>69795</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>69795</v>
+</e>
+</columnsizes>
+<dependencies/>
+</relation>
+<relation>
+<name>configNames</name>
+<cardinality>69794</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>69794</v>
+</e>
+<e>
+<k>config</k>
+<v>69794</v>
+</e>
+<e>
+<k>name</k>
+<v>12859</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>config</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>69794</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>69794</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>config</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>69794</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>config</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>69794</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4858</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>593</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2806</v>
+</b>
+<b>
+<a>4</a>
+<b>10</b>
+<v>169</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1900</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1757</v>
+</b>
+<b>
+<a>12</a>
+<b>111</b>
+<v>776</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>config</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4858</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>593</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>2806</v>
+</b>
+<b>
+<a>4</a>
+<b>10</b>
+<v>169</v>
+</b>
+<b>
+<a>10</a>
+<b>11</b>
+<v>1900</v>
+</b>
+<b>
+<a>11</a>
+<b>12</b>
+<v>1757</v>
+</b>
+<b>
+<a>12</a>
+<b>111</b>
+<v>776</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>configValues</name>
+<cardinality>69691</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>69691</v>
+</e>
+<e>
+<k>config</k>
+<v>69691</v>
+</e>
+<e>
+<k>value</k>
+<v>54399</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>config</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>69691</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>69691</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>config</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>69691</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>config</src>
+<trg>value</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>69691</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>48220</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>4804</v>
+</b>
+<b>
+<a>4</a>
+<b>546</b>
+<v>1375</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>value</src>
+<trg>config</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>48220</v>
+</b>
+<b>
+<a>2</a>
+<b>4</b>
+<v>4804</v>
+</b>
+<b>
+<a>4</a>
+<b>546</b>
+<v>1375</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>configLocations</name>
+<cardinality>209280</cardinality>
+<columnsizes>
+<e>
+<k>locatable</k>
+<v>209280</v>
+</e>
+<e>
+<k>location</k>
+<v>209280</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>locatable</src>
+<trg>location</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>209280</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>location</src>
+<trg>locatable</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>209280</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>extraction_time</name>
+<cardinality>378</cardinality>
+<columnsizes>
+<e>
+<k>file</k>
+<v>21</v>
+</e>
+<e>
+<k>extractionPhase</k>
+<v>9</v>
+</e>
+<e>
+<k>timerKind</k>
+<v>2</v>
+</e>
+<e>
+<k>time</k>
+<v>43</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>file</src>
+<trg>extractionPhase</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>9</a>
+<b>10</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>timerKind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>time</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>3</a>
+<b>4</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>extractionPhase</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>21</a>
+<b>22</b>
+<v>9</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>extractionPhase</src>
+<trg>timerKind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>extractionPhase</src>
+<trg>time</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>8</v>
+</b>
+<b>
+<a>42</a>
+<b>43</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>timerKind</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>21</a>
+<b>22</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>timerKind</src>
+<trg>extractionPhase</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>9</a>
+<b>10</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>timerKind</src>
+<trg>time</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>22</a>
+<b>23</b>
+<v>2</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>time</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>42</v>
+</b>
+<b>
+<a>21</a>
+<b>22</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>time</src>
+<trg>extractionPhase</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>42</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>time</src>
+<trg>timerKind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>42</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>extraction_data</name>
+<cardinality>21</cardinality>
+<columnsizes>
+<e>
+<k>file</k>
+<v>21</v>
+</e>
+<e>
+<k>cacheFile</k>
+<v>21</v>
+</e>
+<e>
+<k>fromCache</k>
+<v>1</v>
+</e>
+<e>
+<k>length</k>
+<v>21</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>file</src>
+<trg>cacheFile</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>fromCache</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>file</src>
+<trg>length</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>cacheFile</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>cacheFile</src>
+<trg>fromCache</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>cacheFile</src>
+<trg>length</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fromCache</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>21</a>
+<b>22</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fromCache</src>
+<trg>cacheFile</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>21</a>
+<b>22</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>fromCache</src>
+<trg>length</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>21</a>
+<b>22</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>length</src>
+<trg>file</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>length</src>
+<trg>cacheFile</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>length</src>
+<trg>fromCache</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>21</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+</stats>
+</dbstats>
diff --git a/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql
new file mode 100644
index 00000000000..da9c88f5bb9
--- /dev/null
+++ b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql
@@ -0,0 +1,32 @@
+class TopLevel extends @toplevel {
+  string toString() { none() }
+}
+
+class XmlNode extends @xmllocatable {
+  string toString() { none() }
+}
+
+// Based on previous implementation on HTMLNode.getCodeInAttribute and getInlineScript
+from
+  TopLevel top, XmlNode xml,
+  @file f,
+  @location l1, int sl1, int sc1, int el1, int ec1,
+  @location l2, int sl2, int sc2, int el2, int ec2
+where
+  xmllocations(xml, l1) and
+  hasLocation(top, l2) and
+  locations_default(l1, f, sl1, sc1, el1, ec1) and
+  locations_default(l2, f, sl2, sc2, el2, ec2) and
+  (
+    (
+      sl1 = sl2 and sc1 < sc2
+      or
+      sl1 < sl2
+    ) and
+    (
+      el1 = el2 and ec1 > ec2
+      or
+      el1 > el2
+    )
+  )
+select top, xml
diff --git a/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/upgrade.properties b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/upgrade.properties
new file mode 100644
index 00000000000..9519ac3a906
--- /dev/null
+++ b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/upgrade.properties
@@ -0,0 +1,4 @@
+description: add support for angular templates
+compatibility: backwards
+
+toplevel_parent_xml_node.rel: run toplevel_parent_xml_node.qlo

From 5f4016be76ec8acad03d0324c563f3be65b53180 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 13 Jan 2021 10:55:16 +0000
Subject: [PATCH 187/343] JS: Cache Import.getImportedModule

---
 javascript/ql/src/semmle/javascript/Modules.qll | 1 +
 1 file changed, 1 insertion(+)

diff --git a/javascript/ql/src/semmle/javascript/Modules.qll b/javascript/ql/src/semmle/javascript/Modules.qll
index 96f0e41c6cd..068b3de8dca 100644
--- a/javascript/ql/src/semmle/javascript/Modules.qll
+++ b/javascript/ql/src/semmle/javascript/Modules.qll
@@ -236,6 +236,7 @@ abstract class Import extends ASTNode {
    * behavior of Node.js imports, which prefer core modules such as `fs` over any
    * source module of the same name.
    */
+  cached
   Module getImportedModule() {
     if exists(resolveExternsImport())
     then result = resolveExternsImport()

From d8c9dba99007d8475a55bfe67778f2e43be99203 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 14 Jan 2021 16:12:32 +0000
Subject: [PATCH 188/343] JS: Autoformat

---
 javascript/ql/src/DOM/TargetBlank.ql          |   5 +-
 javascript/ql/src/semmle/javascript/AST.qll   |   6 +-
 javascript/ql/src/semmle/javascript/HTML.qll  |   8 +-
 .../semmle/javascript/dataflow/DataFlow.qll   |   4 +-
 .../src/semmle/javascript/dataflow/Nodes.qll  |   4 +-
 .../semmle/javascript/frameworks/Angular2.qll | 117 ++++++++----------
 .../src/semmle/javascript/frameworks/RxJS.qll |   9 +-
 7 files changed, 68 insertions(+), 85 deletions(-)

diff --git a/javascript/ql/src/DOM/TargetBlank.ql b/javascript/ql/src/DOM/TargetBlank.ql
index cf6b7969d3d..82885c1d63c 100644
--- a/javascript/ql/src/DOM/TargetBlank.ql
+++ b/javascript/ql/src/DOM/TargetBlank.ql
@@ -20,7 +20,10 @@ import semmle.javascript.RestrictedLocations
  * Holds if the `rel` attribute may be injected by an Angular2 directive.
  */
 predicate maybeInjectedByAngular() {
-  DataFlow::moduleMember("@angular/core", "HostBinding").getACall().getArgument(0).mayHaveStringValue("attr.rel")
+  DataFlow::moduleMember("@angular/core", "HostBinding")
+      .getACall()
+      .getArgument(0)
+      .mayHaveStringValue("attr.rel")
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/AST.qll b/javascript/ql/src/semmle/javascript/AST.qll
index 157aa30015f..6fbabe89d66 100644
--- a/javascript/ql/src/semmle/javascript/AST.qll
+++ b/javascript/ql/src/semmle/javascript/AST.qll
@@ -300,7 +300,11 @@ class InlineScript extends @inline_script, Script { }
  * ```
  */
 class CodeInAttribute extends TopLevel {
-  CodeInAttribute() { this instanceof @event_handler or this instanceof @javascript_url or this instanceof @angular_template_toplevel }
+  CodeInAttribute() {
+    this instanceof @event_handler or
+    this instanceof @javascript_url or
+    this instanceof @angular_template_toplevel
+  }
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/HTML.qll b/javascript/ql/src/semmle/javascript/HTML.qll
index c92e89d1baf..53db9b4341f 100644
--- a/javascript/ql/src/semmle/javascript/HTML.qll
+++ b/javascript/ql/src/semmle/javascript/HTML.qll
@@ -29,9 +29,7 @@ module HTML {
   }
 
   /** Gets `i`th root node of the HTML fragment embedded in the given expression, if any. */
-  Element getHtmlElementFromExpr(Expr e, int i) {
-    xml_element_parent_expression(result, e, i)
-  }
+  Element getHtmlElementFromExpr(Expr e, int i) { xml_element_parent_expression(result, e, i) }
 
   /**
    * An HTML element.
@@ -127,9 +125,7 @@ module HTML {
     /**
      * Gets the inline script of this attribute, if any.
      */
-    CodeInAttribute getCodeInAttribute() {
-      toplevel_parent_xml_node(result, this)
-    }
+    CodeInAttribute getCodeInAttribute() { toplevel_parent_xml_node(result, this) }
 
     /**
      * Gets the element to which this attribute belongs.
diff --git a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
index 605eb6c4317..a2b2d2deb66 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/DataFlow.qll
@@ -1320,9 +1320,7 @@ module DataFlow {
    * Certain framework models may need this node to model the behavior of
    * class and field decorators.
    */
-  DataFlow::Node fieldDeclarationNode(FieldDeclaration field) {
-    result = TPropNode(field)
-  }
+  DataFlow::Node fieldDeclarationNode(FieldDeclaration field) { result = TPropNode(field) }
 
   /**
    * Gets the data flow node corresponding the given l-value expression, if
diff --git a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
index 29aa358b72d..4b5744d2453 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
@@ -1011,9 +1011,7 @@ class ClassNode extends DataFlow::SourceNode {
   /**
    * Gets a decorator applied to this class.
    */
-  DataFlow::Node getADecorator() {
-    result = impl.getADecorator()
-  }
+  DataFlow::Node getADecorator() { result = impl.getADecorator() }
 }
 
 module ClassNode {
diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index aee4f97cb7d..3f33a07ce3d 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -233,16 +233,12 @@ module Angular2 {
    */
   class PipeRefExpr extends Expr, @angular_pipe_ref {
     /** Gets the identifier node naming the pipe. */
-    Identifier getIdentifier() {
-      result = getChildExpr(0)
-    }
+    Identifier getIdentifier() { result = getChildExpr(0) }
 
     /** Gets the name of the pipe being referenced. */
     string getName() { result = getIdentifier().getName() }
 
-    override string getAPrimaryQlClass() {
-      result = "Angular2::PipeRefExpr"
-    }
+    override string getAPrimaryQlClass() { result = "Angular2::PipeRefExpr" }
   }
 
   /**
@@ -252,14 +248,10 @@ module Angular2 {
    * `f` is a `PipeRefExpr` and the call itself is a `PipeCallExpr`.
    */
   class PipeCallExpr extends CallExpr {
-    PipeCallExpr() {
-      getCallee() instanceof PipeRefExpr
-    }
+    PipeCallExpr() { getCallee() instanceof PipeRefExpr }
 
     /** Gets the name of the pipe being invoked, such as `f` in `x | f`. */
-    string getPipeName() {
-      result = getCallee().(PipeRefExpr).getName()
-    }
+    string getPipeName() { result = getCallee().(PipeRefExpr).getName() }
   }
 
   /**
@@ -267,17 +259,13 @@ module Angular2 {
    * to a property on the component class.
    */
   class TemplateVarRefExpr extends Expr {
-    TemplateVarRefExpr() {
-      this = any(TemplateTopLevel tl).getScope().getAVariable().getAnAccess()
-    }
+    TemplateVarRefExpr() { this = any(TemplateTopLevel tl).getScope().getAVariable().getAnAccess() }
   }
 
   /** The top-level containing an Angular expression. */
   class TemplateTopLevel extends TopLevel, @angular_template_toplevel {
     /** Gets the expression in this top-level. */
-    Expr getExpression() {
-      result = getChildStmt(0).(ExprStmt).getExpr()
-    }
+    Expr getExpression() { result = getChildStmt(0).(ExprStmt).getExpr() }
 
     /** Gets the data flow node representing the initialization of the given variable in this scope. */
     DataFlow::Node getVariableInit(string name) {
@@ -299,9 +287,7 @@ module Angular2 {
       )
     }
 
-    override string getValue() {
-      result = this.(Expr).getStringValue()
-    }
+    override string getValue() { result = this.(Expr).getStringValue() }
   }
 
   /**
@@ -365,18 +351,15 @@ module Angular2 {
     /**
      * Gets the `selector` property of the `@Component` decorator.
      */
-    string getSelector() {
-      decorator.getOptionArgument(0, "selector").mayHaveStringValue(result)
-    }
+    string getSelector() { decorator.getOptionArgument(0, "selector").mayHaveStringValue(result) }
 
     /** Gets an HTML element that instantiates this component. */
-    HTML::Element getATemplateInstantiation() {
-      result.getName() = getSelector()
-    }
+    HTML::Element getATemplateInstantiation() { result.getName() = getSelector() }
 
     /** Gets an argument that flows into the `name` field of this component. */
     DataFlow::Node getATemplateArgument(string name) {
-      result = getAttributeValueAsNode(getATemplateInstantiation().getAttributeByName("[" + name + "]"))
+      result =
+        getAttributeValueAsNode(getATemplateInstantiation().getAttributeByName("[" + name + "]"))
     }
 
     /**
@@ -393,14 +376,20 @@ module Angular2 {
     HTML::Element getATemplateElement() {
       result.getFile() = getTemplateFile()
       or
-      result.getParent*() = HTML::getHtmlElementFromExpr(decorator.getOptionArgument(0, "template").asExpr(), _)
+      result.getParent*() =
+        HTML::getHtmlElementFromExpr(decorator.getOptionArgument(0, "template").asExpr(), _)
     }
 
     /**
      * Gets an access to the given template variable within the template body of this component.
      */
     DataFlow::SourceNode getATemplateVarAccess(string name) {
-      result = getATemplateElement().getAnAttribute().getCodeInAttribute().(TemplateTopLevel).getAVariableUse(name)
+      result =
+        getATemplateElement()
+            .getAnAttribute()
+            .getCodeInAttribute()
+            .(TemplateTopLevel)
+            .getAVariableUse(name)
     }
   }
 
@@ -414,14 +403,10 @@ module Angular2 {
     }
 
     /** Gets the value of the `name` option passed to the `@Pipe` decorator. */
-    string getPipeName() {
-      decorator.getOptionArgument(0, "name").mayHaveStringValue(result)
-    }
+    string getPipeName() { decorator.getOptionArgument(0, "name").mayHaveStringValue(result) }
 
     /** Gets a reference to this pipe. */
-    DataFlow::Node getAPipeRef() {
-      result.asExpr().(PipeRefExpr).getName() = getPipeName()
-    }
+    DataFlow::Node getAPipeRef() { result.asExpr().(PipeRefExpr).getName() = getPipeName() }
   }
 
   private class ComponentSteps extends PreCallGraphStep {
@@ -464,28 +449,25 @@ module Angular2 {
    * attribute. There is no AST node for the implied for-of loop.
    */
   private class ForLoopAttribute extends HTML::Attribute {
-    ForLoopAttribute() {
-      getName() = "*ngFor"
-    }
+    ForLoopAttribute() { getName() = "*ngFor" }
 
     /** Gets a data-flow node holding the value being iterated over. */
-    DataFlow::Node getIterationDomain() {
-      result = getAttributeValueAsNode(this)
-    }
+    DataFlow::Node getIterationDomain() { result = getAttributeValueAsNode(this) }
 
     /** Gets the name of the variable holding the element of the current iteration. */
-    string getIteratorName() {
-      result = getValue().regexpCapture(" *let +(\\w+).*", 1)
-    }
+    string getIteratorName() { result = getValue().regexpCapture(" *let +(\\w+).*", 1) }
 
     /** Gets an HTML element in which the iterator variable is in scope. */
-    HTML::Element getAnElementInScope() {
-      result.getParent*() = getElement()
-    }
+    HTML::Element getAnElementInScope() { result.getParent*() = getElement() }
 
     /** Gets a reference to the iterator variable. */
     DataFlow::Node getAnIteratorAccess() {
-      result = getAnElementInScope().getAnAttribute().getCodeInAttribute().(TemplateTopLevel).getAVariableUse(getIteratorName())
+      result =
+        getAnElementInScope()
+            .getAnAttribute()
+            .getCodeInAttribute()
+            .(TemplateTopLevel)
+            .getAVariableUse(getIteratorName())
     }
   }
 
@@ -496,9 +478,7 @@ module Angular2 {
   private class ForLoopStep extends TaintTracking::AdditionalTaintStep {
     ForLoopAttribute attrib;
 
-    ForLoopStep() {
-      this = attrib.getIterationDomain()
-    }
+    ForLoopStep() { this = attrib.getIterationDomain() }
 
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
       pred = this and
@@ -528,14 +508,17 @@ module Angular2 {
   private class BuiltinPipeStep extends TaintTracking::AdditionalTaintStep, DataFlow::CallNode {
     string name;
 
-    BuiltinPipeStep() {
-      this = getAPipeCall(name)
-    }
+    BuiltinPipeStep() { this = getAPipeCall(name) }
 
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
       succ = this and
       exists(int i | pred = getArgument(i) |
-        i = 0 and name = ["async", "i18nPlural", "json", "keyvalue", "lowercase", "uppercase", "titlecase", "slice"]
+        i = 0 and
+        name =
+          [
+            "async", "i18nPlural", "json", "keyvalue", "lowercase", "uppercase", "titlecase",
+            "slice"
+          ]
         or
         i = 1 and name = "date" // date format string
       )
@@ -551,9 +534,7 @@ module Angular2 {
    * A `<mat-table>` element.
    */
   class MatTableElement extends HTML::Element {
-    MatTableElement() {
-      getName() = "mat-table"
-    }
+    MatTableElement() { getName() = "mat-table" }
 
     /** Gets the data flow node corresponding to the `[dataSource]` attribute. */
     DataFlow::Node getDataSourceNode() {
@@ -566,13 +547,20 @@ module Angular2 {
     HTML::Element getATableCell(string rowBinding) {
       result.getName() = "mat-cell" and
       result.getParent+() = this and
-      rowBinding = result.getAttributeByName("*matCellDef").getValue().regexpCapture(" *let +(\\w+).*", 1)
+      rowBinding =
+        result.getAttributeByName("*matCellDef").getValue().regexpCapture(" *let +(\\w+).*", 1)
     }
 
     /** Gets a data flow node that refers to one of the rows from the data source. */
     DataFlow::Node getARowRef() {
       exists(string rowBinding |
-        result = getATableCell(rowBinding).getChild*().getAnAttribute().getCodeInAttribute().(TemplateTopLevel).getAVariableUse(rowBinding)
+        result =
+          getATableCell(rowBinding)
+              .getChild*()
+              .getAnAttribute()
+              .getCodeInAttribute()
+              .(TemplateTopLevel)
+              .getAVariableUse(rowBinding)
       )
     }
   }
@@ -590,9 +578,7 @@ module Angular2 {
   private class MatTableTaintStep extends TaintTracking::AdditionalTaintStep {
     MatTableElement table;
 
-    MatTableTaintStep() {
-      this = table.getDataSourceNode()
-    }
+    MatTableTaintStep() { this = table.getDataSourceNode() }
 
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
       pred = this and
@@ -614,7 +600,8 @@ module Angular2 {
   /** A taint step into the data array of a `MatTableDataSource` instance. */
   private class MatTableDataSourceStep extends TaintTracking::AdditionalTaintStep, DataFlow::NewNode {
     MatTableDataSourceStep() {
-      this = DataFlow::moduleMember("@angular/material/table", "MatTableDataSource").getAnInstantiation()
+      this =
+        DataFlow::moduleMember("@angular/material/table", "MatTableDataSource").getAnInstantiation()
     }
 
     override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
diff --git a/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll b/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll
index ba09f7d087e..0016c05c41c 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll
@@ -1,15 +1,14 @@
 /**
  * Provides taint steps modeling flow through `rxjs` Observable objects.
  */
+
 private import javascript
 
 /**
  * A step `x -> y` in `x.subscribe(y => ...)`, modeling flow out of an rxjs Observable.
  */
 private class RxJsSubscribeStep extends TaintTracking::AdditionalTaintStep, DataFlow::MethodCallNode {
-  RxJsSubscribeStep() {
-    getMethodName() = "subscribe"
-  }
+  RxJsSubscribeStep() { getMethodName() = "subscribe" }
 
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     pred = getReceiver() and
@@ -50,9 +49,7 @@ private predicate isIdentityPipe(DataFlow::CallNode pipe) {
  * A step in or out of the map callback in a call of form `x.pipe(map(y => ...))`.
  */
 private class RxJsPipeMapStep extends TaintTracking::AdditionalTaintStep, DataFlow::MethodCallNode {
-  RxJsPipeMapStep() {
-    getMethodName() = "pipe"
-  }
+  RxJsPipeMapStep() { getMethodName() = "pipe" }
 
   override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
     pred = getReceiver() and

From 2a7b4487f123d277f57eab1d3bc733e4b0e5f763 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 15 Jan 2021 08:53:13 +0000
Subject: [PATCH 189/343] JS: More auto format

---
 .../library-tests/frameworks/Angular2/test.ql    | 16 ++++------------
 .../toplevel_parent_xml_node.ql                  |  4 +---
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.ql b/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
index da318e08d29..ba3b30649f0 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
@@ -3,9 +3,7 @@ private import semmle.javascript.security.dataflow.Xss
 
 query Angular2::PipeRefExpr pipeRef() { any() }
 
-query CallExpr pipeCall() {
-  result.getCallee() instanceof Angular2::PipeRefExpr
-}
+query CallExpr pipeCall() { result.getCallee() instanceof Angular2::PipeRefExpr }
 
 query CallExpr pipeCallArg(int i, Expr arg) {
   result.getCallee() instanceof Angular2::PipeRefExpr and
@@ -14,22 +12,16 @@ query CallExpr pipeCallArg(int i, Expr arg) {
 
 query Angular2::PipeClass pipeClass() { any() }
 
-query DataFlow::Node pipeClassRef(Angular2::PipeClass cls) {
-  result = cls.getAPipeRef()
-}
+query DataFlow::Node pipeClassRef(Angular2::PipeClass cls) { result = cls.getAPipeRef() }
 
 class TaintConfig extends TaintTracking::Configuration {
-  TaintConfig() {
-    this = "TaintConfig"
-  }
+  TaintConfig() { this = "TaintConfig" }
 
   override predicate isSource(DataFlow::Node source) {
     source.(DataFlow::CallNode).getCalleeName() = "source"
   }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink instanceof DomBasedXss::Sink
-  }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof DomBasedXss::Sink }
 }
 
 query predicate taintFlow(DataFlow::Node source, DataFlow::Node sink) {
diff --git a/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql
index da9c88f5bb9..d8de8b32916 100644
--- a/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql
+++ b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql
@@ -8,9 +8,7 @@ class XmlNode extends @xmllocatable {
 
 // Based on previous implementation on HTMLNode.getCodeInAttribute and getInlineScript
 from
-  TopLevel top, XmlNode xml,
-  @file f,
-  @location l1, int sl1, int sc1, int el1, int ec1,
+  TopLevel top, XmlNode xml, @file f, @location l1, int sl1, int sc1, int el1, int ec1,
   @location l2, int sl2, int sc2, int el2, int ec2
 where
   xmllocations(xml, l1) and

From bb6bd9168ef0b1bb42c72543b39d56d5c71076ac Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 15 Jan 2021 11:13:36 +0000
Subject: [PATCH 190/343] JS: Update HTML TRAP tests output

---
 .../tests/html/output/trap/entities.html.trap |  37 +-
 .../tests/html/output/trap/module.html.trap   |  39 +-
 .../tests/html/output/trap/tst.html.trap      | 599 +++++++++---------
 .../tests/html/output/trap/tst.xhtml.trap     |  49 +-
 .../tests/html/output/trap/tst2.html.trap     | 516 +++++++--------
 .../output/trap/component.js.trap             | 374 +++++------
 .../tests/node/output/trap/tst.html.trap      |  37 +-
 .../tests/shebang/output/trap/tst.html.trap   |  35 +-
 8 files changed, 852 insertions(+), 834 deletions(-)

diff --git a/javascript/extractor/tests/html/output/trap/entities.html.trap b/javascript/extractor/tests/html/output/trap/entities.html.trap
index 5d71d6b6620..66c12b952a4 100644
--- a/javascript/extractor/tests/html/output/trap/entities.html.trap
+++ b/javascript/extractor/tests/html/output/trap/entities.html.trap
@@ -117,27 +117,28 @@ successor(#20024,#20021)
 successor(#20021,#20033)
 successor(#20031,#20020)
 #20034=*
-xmlElements(#20034,"html",#10000,0,#10000)
-#20035=@"loc,{#10000},1,1,8,7"
-locations_default(#20035,#10000,1,1,8,7)
-xmllocations(#20034,#20035)
-#20036=*
-xmlElements(#20036,"body",#20034,1,#10000)
-#20037=@"loc,{#10000},5,5,7,11"
-locations_default(#20037,#10000,5,5,7,11)
-xmllocations(#20036,#20037)
-#20038=*
-xmlElements(#20038,"a",#20036,0,#10000)
-#20039=@"loc,{#10000},6,9,6,80"
-locations_default(#20039,#10000,6,9,6,80)
-xmllocations(#20038,#20039)
-#20040=*
-xmlAttrs(#20040,#20038,"href","javascript:void(alert(""Nope!""))",0,#10000)
+toplevel_parent_xml_node(#20001,#20034)
+#20035=*
+xmlElements(#20035,"html",#10000,0,#10000)
+#20036=@"loc,{#10000},1,1,8,7"
+locations_default(#20036,#10000,1,1,8,7)
+xmllocations(#20035,#20036)
+#20037=*
+xmlElements(#20037,"body",#20035,1,#10000)
+#20038=@"loc,{#10000},5,5,7,11"
+locations_default(#20038,#10000,5,5,7,11)
+xmllocations(#20037,#20038)
+#20039=*
+xmlElements(#20039,"a",#20037,0,#10000)
+#20040=@"loc,{#10000},6,9,6,80"
+locations_default(#20040,#10000,6,9,6,80)
+xmllocations(#20039,#20040)
+xmlAttrs(#20034,#20039,"href","javascript:void(alert(""Nope!""))",0,#10000)
 #20041=@"loc,{#10000},6,12,6,65"
 locations_default(#20041,#10000,6,12,6,65)
-xmllocations(#20040,#20041)
+xmllocations(#20034,#20041)
 #20042=*
-xmlElements(#20042,"head",#20034,0,#10000)
+xmlElements(#20042,"head",#20035,0,#10000)
 #20043=@"loc,{#10000},2,5,4,11"
 locations_default(#20043,#10000,2,5,4,11)
 xmllocations(#20042,#20043)
diff --git a/javascript/extractor/tests/html/output/trap/module.html.trap b/javascript/extractor/tests/html/output/trap/module.html.trap
index 2d23b4905b1..3932e850cbd 100644
--- a/javascript/extractor/tests/html/output/trap/module.html.trap
+++ b/javascript/extractor/tests/html/output/trap/module.html.trap
@@ -194,32 +194,33 @@ successor(#20039,#20046)
 successor(#20044,#20039)
 successor(#20054,#20044)
 #20056=*
-xmlElements(#20056,"html",#10000,0,#10000)
-#20057=@"loc,{#10000},1,1,11,7"
-locations_default(#20057,#10000,1,1,11,7)
-xmllocations(#20056,#20057)
-#20058=*
-xmlElements(#20058,"body",#20056,1,#10000)
-#20059=@"loc,{#10000},9,5,10,11"
-locations_default(#20059,#10000,9,5,10,11)
-xmllocations(#20058,#20059)
-#20060=*
-xmlElements(#20060,"head",#20056,0,#10000)
-#20061=@"loc,{#10000},2,5,8,11"
-locations_default(#20061,#10000,2,5,8,11)
-xmllocations(#20060,#20061)
-#20062=*
-xmlElements(#20062,"script",#20060,1,#10000)
+toplevel_parent_xml_node(#20001,#20056)
+#20057=*
+xmlElements(#20057,"html",#10000,0,#10000)
+#20058=@"loc,{#10000},1,1,11,7"
+locations_default(#20058,#10000,1,1,11,7)
+xmllocations(#20057,#20058)
+#20059=*
+xmlElements(#20059,"body",#20057,1,#10000)
+#20060=@"loc,{#10000},9,5,10,11"
+locations_default(#20060,#10000,9,5,10,11)
+xmllocations(#20059,#20060)
+#20061=*
+xmlElements(#20061,"head",#20057,0,#10000)
+#20062=@"loc,{#10000},2,5,8,11"
+locations_default(#20062,#10000,2,5,8,11)
+xmllocations(#20061,#20062)
+xmlElements(#20056,"script",#20061,1,#10000)
 #20063=@"loc,{#10000},4,9,7,17"
 locations_default(#20063,#10000,4,9,7,17)
-xmllocations(#20062,#20063)
+xmllocations(#20056,#20063)
 #20064=*
-xmlAttrs(#20064,#20062,"type","module",0,#10000)
+xmlAttrs(#20064,#20056,"type","module",0,#10000)
 #20065=@"loc,{#10000},4,17,4,29"
 locations_default(#20065,#10000,4,17,4,29)
 xmllocations(#20064,#20065)
 #20066=*
-xmlElements(#20066,"title",#20060,0,#10000)
+xmlElements(#20066,"title",#20061,0,#10000)
 #20067=@"loc,{#10000},3,9,3,32"
 locations_default(#20067,#10000,3,9,3,32)
 xmllocations(#20066,#20067)
diff --git a/javascript/extractor/tests/html/output/trap/tst.html.trap b/javascript/extractor/tests/html/output/trap/tst.html.trap
index b59a8233991..73ea3e0382f 100644
--- a/javascript/extractor/tests/html/output/trap/tst.html.trap
+++ b/javascript/extractor/tests/html/output/trap/tst.html.trap
@@ -107,355 +107,360 @@ successor(#20027,#20023)
 successor(#20025,#20027)
 successor(#20023,#20031)
 successor(#20030,#20021)
-#20032=@"script;{#10000},8,17"
-#20033=*
-lines(#20033,#20032,";","")
-#20034=@"loc,{#10000},8,17,8,17"
-locations_default(#20034,#10000,8,17,8,17)
-hasLocation(#20033,#20034)
-numlines(#20032,1,1,0)
-#20035=*
-tokeninfo(#20035,8,#20032,0,";")
-hasLocation(#20035,#20034)
+#20032=*
+toplevel_parent_xml_node(#20001,#20032)
+#20033=@"script;{#10000},8,17"
+#20034=*
+lines(#20034,#20033,";","")
+#20035=@"loc,{#10000},8,17,8,17"
+locations_default(#20035,#10000,8,17,8,17)
+hasLocation(#20034,#20035)
+numlines(#20033,1,1,0)
 #20036=*
-tokeninfo(#20036,0,#20032,1,"")
-#20037=@"loc,{#10000},8,18,8,17"
-locations_default(#20037,#10000,8,18,8,17)
-hasLocation(#20036,#20037)
-toplevels(#20032,1)
-hasLocation(#20032,#20034)
-#20038=*
-stmts(#20038,0,#20032,0,";")
-hasLocation(#20038,#20034)
-stmt_containers(#20038,#20032)
+tokeninfo(#20036,8,#20033,0,";")
+hasLocation(#20036,#20035)
+#20037=*
+tokeninfo(#20037,0,#20033,1,"")
+#20038=@"loc,{#10000},8,18,8,17"
+locations_default(#20038,#10000,8,18,8,17)
+hasLocation(#20037,#20038)
+toplevels(#20033,1)
+hasLocation(#20033,#20035)
 #20039=*
-entry_cfg_node(#20039,#20032)
-#20040=@"loc,{#10000},8,17,8,16"
-locations_default(#20040,#10000,8,17,8,16)
-hasLocation(#20039,#20040)
-#20041=*
-exit_cfg_node(#20041,#20032)
-hasLocation(#20041,#20037)
-successor(#20038,#20041)
-successor(#20039,#20038)
-#20042=@"script;{#10000},11,29"
+stmts(#20039,0,#20033,0,";")
+hasLocation(#20039,#20035)
+stmt_containers(#20039,#20033)
+#20040=*
+entry_cfg_node(#20040,#20033)
+#20041=@"loc,{#10000},8,17,8,16"
+locations_default(#20041,#10000,8,17,8,16)
+hasLocation(#20040,#20041)
+#20042=*
+exit_cfg_node(#20042,#20033)
+hasLocation(#20042,#20038)
+successor(#20039,#20042)
+successor(#20040,#20039)
 #20043=*
-lines(#20043,#20042,"void(alert('Nope!'))","")
-#20044=@"loc,{#10000},11,29,11,48"
-locations_default(#20044,#10000,11,29,11,48)
-hasLocation(#20043,#20044)
-numlines(#20042,1,1,0)
+toplevel_parent_xml_node(#20033,#20043)
+#20044=@"script;{#10000},11,29"
 #20045=*
-tokeninfo(#20045,7,#20042,0,"void")
-#20046=@"loc,{#10000},11,29,11,32"
-locations_default(#20046,#10000,11,29,11,32)
+lines(#20045,#20044,"void(alert('Nope!'))","")
+#20046=@"loc,{#10000},11,29,11,48"
+locations_default(#20046,#10000,11,29,11,48)
 hasLocation(#20045,#20046)
+numlines(#20044,1,1,0)
 #20047=*
-tokeninfo(#20047,8,#20042,1,"(")
-#20048=@"loc,{#10000},11,33,11,33"
-locations_default(#20048,#10000,11,33,11,33)
+tokeninfo(#20047,7,#20044,0,"void")
+#20048=@"loc,{#10000},11,29,11,32"
+locations_default(#20048,#10000,11,29,11,32)
 hasLocation(#20047,#20048)
 #20049=*
-tokeninfo(#20049,6,#20042,2,"alert")
-#20050=@"loc,{#10000},11,34,11,38"
-locations_default(#20050,#10000,11,34,11,38)
+tokeninfo(#20049,8,#20044,1,"(")
+#20050=@"loc,{#10000},11,33,11,33"
+locations_default(#20050,#10000,11,33,11,33)
 hasLocation(#20049,#20050)
 #20051=*
-tokeninfo(#20051,8,#20042,3,"(")
-#20052=@"loc,{#10000},11,39,11,39"
-locations_default(#20052,#10000,11,39,11,39)
+tokeninfo(#20051,6,#20044,2,"alert")
+#20052=@"loc,{#10000},11,34,11,38"
+locations_default(#20052,#10000,11,34,11,38)
 hasLocation(#20051,#20052)
 #20053=*
-tokeninfo(#20053,4,#20042,4,"'Nope!'")
-#20054=@"loc,{#10000},11,40,11,46"
-locations_default(#20054,#10000,11,40,11,46)
+tokeninfo(#20053,8,#20044,3,"(")
+#20054=@"loc,{#10000},11,39,11,39"
+locations_default(#20054,#10000,11,39,11,39)
 hasLocation(#20053,#20054)
 #20055=*
-tokeninfo(#20055,8,#20042,5,")")
-#20056=@"loc,{#10000},11,47,11,47"
-locations_default(#20056,#10000,11,47,11,47)
+tokeninfo(#20055,4,#20044,4,"'Nope!'")
+#20056=@"loc,{#10000},11,40,11,46"
+locations_default(#20056,#10000,11,40,11,46)
 hasLocation(#20055,#20056)
 #20057=*
-tokeninfo(#20057,8,#20042,6,")")
-#20058=@"loc,{#10000},11,48,11,48"
-locations_default(#20058,#10000,11,48,11,48)
+tokeninfo(#20057,8,#20044,5,")")
+#20058=@"loc,{#10000},11,47,11,47"
+locations_default(#20058,#10000,11,47,11,47)
 hasLocation(#20057,#20058)
 #20059=*
-tokeninfo(#20059,0,#20042,7,"")
-#20060=@"loc,{#10000},11,49,11,48"
-locations_default(#20060,#10000,11,49,11,48)
+tokeninfo(#20059,8,#20044,6,")")
+#20060=@"loc,{#10000},11,48,11,48"
+locations_default(#20060,#10000,11,48,11,48)
 hasLocation(#20059,#20060)
-toplevels(#20042,3)
-hasLocation(#20042,#20044)
 #20061=*
-stmts(#20061,2,#20042,0,"void(alert('Nope!'))")
-hasLocation(#20061,#20044)
-stmt_containers(#20061,#20042)
-#20062=*
-exprs(#20062,21,#20061,0,"void(alert('Nope!'))")
-hasLocation(#20062,#20044)
-enclosing_stmt(#20062,#20061)
-expr_containers(#20062,#20042)
+tokeninfo(#20061,0,#20044,7,"")
+#20062=@"loc,{#10000},11,49,11,48"
+locations_default(#20062,#10000,11,49,11,48)
+hasLocation(#20061,#20062)
+toplevels(#20044,3)
+hasLocation(#20044,#20046)
 #20063=*
-exprs(#20063,63,#20062,0,"(alert('Nope!'))")
-#20064=@"loc,{#10000},11,33,11,48"
-locations_default(#20064,#10000,11,33,11,48)
-hasLocation(#20063,#20064)
-enclosing_stmt(#20063,#20061)
-expr_containers(#20063,#20042)
+stmts(#20063,2,#20044,0,"void(alert('Nope!'))")
+hasLocation(#20063,#20046)
+stmt_containers(#20063,#20044)
+#20064=*
+exprs(#20064,21,#20063,0,"void(alert('Nope!'))")
+hasLocation(#20064,#20046)
+enclosing_stmt(#20064,#20063)
+expr_containers(#20064,#20044)
 #20065=*
-exprs(#20065,13,#20063,0,"alert('Nope!')")
-#20066=@"loc,{#10000},11,34,11,47"
-locations_default(#20066,#10000,11,34,11,47)
+exprs(#20065,63,#20064,0,"(alert('Nope!'))")
+#20066=@"loc,{#10000},11,33,11,48"
+locations_default(#20066,#10000,11,33,11,48)
 hasLocation(#20065,#20066)
-enclosing_stmt(#20065,#20061)
-expr_containers(#20065,#20042)
+enclosing_stmt(#20065,#20063)
+expr_containers(#20065,#20044)
 #20067=*
-exprs(#20067,79,#20065,-1,"alert")
-hasLocation(#20067,#20050)
-enclosing_stmt(#20067,#20061)
-expr_containers(#20067,#20042)
-literals("alert","alert",#20067)
-bind(#20067,#20026)
-#20068=*
-exprs(#20068,4,#20065,0,"'Nope!'")
-hasLocation(#20068,#20054)
-enclosing_stmt(#20068,#20061)
-expr_containers(#20068,#20042)
-literals("Nope!","'Nope!'",#20068)
+exprs(#20067,13,#20065,0,"alert('Nope!')")
+#20068=@"loc,{#10000},11,34,11,47"
+locations_default(#20068,#10000,11,34,11,47)
+hasLocation(#20067,#20068)
+enclosing_stmt(#20067,#20063)
+expr_containers(#20067,#20044)
 #20069=*
-regexpterm(#20069,14,#20068,0,"Nope!")
-#20070=@"loc,{#10000},11,41,11,45"
-locations_default(#20070,#10000,11,41,11,45)
-hasLocation(#20069,#20070)
-regexp_const_value(#20069,"Nope!")
+exprs(#20069,79,#20067,-1,"alert")
+hasLocation(#20069,#20052)
+enclosing_stmt(#20069,#20063)
+expr_containers(#20069,#20044)
+literals("alert","alert",#20069)
+bind(#20069,#20026)
+#20070=*
+exprs(#20070,4,#20067,0,"'Nope!'")
+hasLocation(#20070,#20056)
+enclosing_stmt(#20070,#20063)
+expr_containers(#20070,#20044)
+literals("Nope!","'Nope!'",#20070)
 #20071=*
-entry_cfg_node(#20071,#20042)
-#20072=@"loc,{#10000},11,29,11,28"
-locations_default(#20072,#10000,11,29,11,28)
+regexpterm(#20071,14,#20070,0,"Nope!")
+#20072=@"loc,{#10000},11,41,11,45"
+locations_default(#20072,#10000,11,41,11,45)
 hasLocation(#20071,#20072)
+regexp_const_value(#20071,"Nope!")
 #20073=*
-exit_cfg_node(#20073,#20042)
-hasLocation(#20073,#20060)
-successor(#20061,#20063)
-successor(#20063,#20067)
-successor(#20068,#20065)
-successor(#20067,#20068)
-successor(#20065,#20062)
-successor(#20062,#20073)
-successor(#20071,#20061)
-#20074=@"script;{#10000},12,23"
+entry_cfg_node(#20073,#20044)
+#20074=@"loc,{#10000},11,29,11,28"
+locations_default(#20074,#10000,11,29,11,28)
+hasLocation(#20073,#20074)
 #20075=*
-lines(#20075,#20074,"alert('I said don\'t click!')","")
-#20076=@"loc,{#10000},12,23,12,51"
-locations_default(#20076,#10000,12,23,12,51)
-hasLocation(#20075,#20076)
-numlines(#20074,1,1,0)
-#20077=*
-tokeninfo(#20077,6,#20074,0,"alert")
-#20078=@"loc,{#10000},12,23,12,27"
-locations_default(#20078,#10000,12,23,12,27)
-hasLocation(#20077,#20078)
-#20079=*
-tokeninfo(#20079,8,#20074,1,"(")
-#20080=@"loc,{#10000},12,28,12,28"
-locations_default(#20080,#10000,12,28,12,28)
-hasLocation(#20079,#20080)
-#20081=*
-tokeninfo(#20081,4,#20074,2,"'I said don\'t click!'")
-#20082=@"loc,{#10000},12,29,12,50"
-locations_default(#20082,#10000,12,29,12,50)
-hasLocation(#20081,#20082)
-#20083=*
-tokeninfo(#20083,8,#20074,3,")")
-#20084=@"loc,{#10000},12,51,12,51"
-locations_default(#20084,#10000,12,51,12,51)
-hasLocation(#20083,#20084)
-#20085=*
-tokeninfo(#20085,0,#20074,4,"")
-#20086=@"loc,{#10000},12,52,12,51"
-locations_default(#20086,#10000,12,52,12,51)
-hasLocation(#20085,#20086)
-toplevels(#20074,2)
-hasLocation(#20074,#20076)
-#20087=*
-stmts(#20087,2,#20074,0,"alert(' ... lick!')")
-hasLocation(#20087,#20076)
-stmt_containers(#20087,#20074)
+exit_cfg_node(#20075,#20044)
+hasLocation(#20075,#20062)
+successor(#20063,#20065)
+successor(#20065,#20069)
+successor(#20070,#20067)
+successor(#20069,#20070)
+successor(#20067,#20064)
+successor(#20064,#20075)
+successor(#20073,#20063)
+#20076=*
+toplevel_parent_xml_node(#20044,#20076)
+#20077=@"script;{#10000},12,23"
+#20078=*
+lines(#20078,#20077,"alert('I said don\'t click!')","")
+#20079=@"loc,{#10000},12,23,12,51"
+locations_default(#20079,#10000,12,23,12,51)
+hasLocation(#20078,#20079)
+numlines(#20077,1,1,0)
+#20080=*
+tokeninfo(#20080,6,#20077,0,"alert")
+#20081=@"loc,{#10000},12,23,12,27"
+locations_default(#20081,#10000,12,23,12,27)
+hasLocation(#20080,#20081)
+#20082=*
+tokeninfo(#20082,8,#20077,1,"(")
+#20083=@"loc,{#10000},12,28,12,28"
+locations_default(#20083,#10000,12,28,12,28)
+hasLocation(#20082,#20083)
+#20084=*
+tokeninfo(#20084,4,#20077,2,"'I said don\'t click!'")
+#20085=@"loc,{#10000},12,29,12,50"
+locations_default(#20085,#10000,12,29,12,50)
+hasLocation(#20084,#20085)
+#20086=*
+tokeninfo(#20086,8,#20077,3,")")
+#20087=@"loc,{#10000},12,51,12,51"
+locations_default(#20087,#10000,12,51,12,51)
+hasLocation(#20086,#20087)
 #20088=*
-exprs(#20088,13,#20087,0,"alert(' ... lick!')")
-hasLocation(#20088,#20076)
-enclosing_stmt(#20088,#20087)
-expr_containers(#20088,#20074)
-#20089=*
-exprs(#20089,79,#20088,-1,"alert")
-hasLocation(#20089,#20078)
-enclosing_stmt(#20089,#20087)
-expr_containers(#20089,#20074)
-literals("alert","alert",#20089)
-bind(#20089,#20026)
+tokeninfo(#20088,0,#20077,4,"")
+#20089=@"loc,{#10000},12,52,12,51"
+locations_default(#20089,#10000,12,52,12,51)
+hasLocation(#20088,#20089)
+toplevels(#20077,2)
+hasLocation(#20077,#20079)
 #20090=*
-exprs(#20090,4,#20088,0,"'I said ... click!'")
-hasLocation(#20090,#20082)
-enclosing_stmt(#20090,#20087)
-expr_containers(#20090,#20074)
-literals("I said don't click!","'I said don\'t click!'",#20090)
+stmts(#20090,2,#20077,0,"alert(' ... lick!')")
+hasLocation(#20090,#20079)
+stmt_containers(#20090,#20077)
 #20091=*
-regexpterm(#20091,14,#20090,0,"I said don't click!")
-#20092=@"loc,{#10000},12,30,12,49"
-locations_default(#20092,#10000,12,30,12,49)
-hasLocation(#20091,#20092)
-regexp_const_value(#20091,"I said don't click!")
+exprs(#20091,13,#20090,0,"alert(' ... lick!')")
+hasLocation(#20091,#20079)
+enclosing_stmt(#20091,#20090)
+expr_containers(#20091,#20077)
+#20092=*
+exprs(#20092,79,#20091,-1,"alert")
+hasLocation(#20092,#20081)
+enclosing_stmt(#20092,#20090)
+expr_containers(#20092,#20077)
+literals("alert","alert",#20092)
+bind(#20092,#20026)
 #20093=*
-entry_cfg_node(#20093,#20074)
-#20094=@"loc,{#10000},12,23,12,22"
-locations_default(#20094,#10000,12,23,12,22)
-hasLocation(#20093,#20094)
-#20095=*
-exit_cfg_node(#20095,#20074)
-hasLocation(#20095,#20086)
-successor(#20087,#20089)
-successor(#20090,#20088)
-successor(#20089,#20090)
-successor(#20088,#20095)
-successor(#20093,#20087)
-#20096=@"script;{#10000},13,21"
-#20097=*
-lines(#20097,#20096,"return false;","")
-#20098=@"loc,{#10000},13,21,13,33"
-locations_default(#20098,#10000,13,21,13,33)
-hasLocation(#20097,#20098)
-numlines(#20096,1,1,0)
+exprs(#20093,4,#20091,0,"'I said ... click!'")
+hasLocation(#20093,#20085)
+enclosing_stmt(#20093,#20090)
+expr_containers(#20093,#20077)
+literals("I said don't click!","'I said don\'t click!'",#20093)
+#20094=*
+regexpterm(#20094,14,#20093,0,"I said don't click!")
+#20095=@"loc,{#10000},12,30,12,49"
+locations_default(#20095,#10000,12,30,12,49)
+hasLocation(#20094,#20095)
+regexp_const_value(#20094,"I said don't click!")
+#20096=*
+entry_cfg_node(#20096,#20077)
+#20097=@"loc,{#10000},12,23,12,22"
+locations_default(#20097,#10000,12,23,12,22)
+hasLocation(#20096,#20097)
+#20098=*
+exit_cfg_node(#20098,#20077)
+hasLocation(#20098,#20089)
+successor(#20090,#20092)
+successor(#20093,#20091)
+successor(#20092,#20093)
+successor(#20091,#20098)
+successor(#20096,#20090)
 #20099=*
-tokeninfo(#20099,7,#20096,0,"return")
-#20100=@"loc,{#10000},13,21,13,26"
-locations_default(#20100,#10000,13,21,13,26)
-hasLocation(#20099,#20100)
+toplevel_parent_xml_node(#20077,#20099)
+#20100=@"script;{#10000},13,21"
 #20101=*
-tokeninfo(#20101,2,#20096,1,"false")
-#20102=@"loc,{#10000},13,28,13,32"
-locations_default(#20102,#10000,13,28,13,32)
+lines(#20101,#20100,"return false;","")
+#20102=@"loc,{#10000},13,21,13,33"
+locations_default(#20102,#10000,13,21,13,33)
 hasLocation(#20101,#20102)
+numlines(#20100,1,1,0)
 #20103=*
-tokeninfo(#20103,8,#20096,2,";")
-#20104=@"loc,{#10000},13,33,13,33"
-locations_default(#20104,#10000,13,33,13,33)
+tokeninfo(#20103,7,#20100,0,"return")
+#20104=@"loc,{#10000},13,21,13,26"
+locations_default(#20104,#10000,13,21,13,26)
 hasLocation(#20103,#20104)
 #20105=*
-tokeninfo(#20105,0,#20096,3,"")
-#20106=@"loc,{#10000},13,34,13,33"
-locations_default(#20106,#10000,13,34,13,33)
+tokeninfo(#20105,2,#20100,1,"false")
+#20106=@"loc,{#10000},13,28,13,32"
+locations_default(#20106,#10000,13,28,13,32)
 hasLocation(#20105,#20106)
-toplevels(#20096,2)
-hasLocation(#20096,#20098)
 #20107=*
-stmts(#20107,9,#20096,0,"return false;")
-hasLocation(#20107,#20098)
-stmt_containers(#20107,#20096)
-#20108=*
-exprs(#20108,2,#20107,0,"false")
-hasLocation(#20108,#20102)
-enclosing_stmt(#20108,#20107)
-expr_containers(#20108,#20096)
-literals("false","false",#20108)
+tokeninfo(#20107,8,#20100,2,";")
+#20108=@"loc,{#10000},13,33,13,33"
+locations_default(#20108,#10000,13,33,13,33)
+hasLocation(#20107,#20108)
 #20109=*
-entry_cfg_node(#20109,#20096)
-#20110=@"loc,{#10000},13,21,13,20"
-locations_default(#20110,#10000,13,21,13,20)
+tokeninfo(#20109,0,#20100,3,"")
+#20110=@"loc,{#10000},13,34,13,33"
+locations_default(#20110,#10000,13,34,13,33)
 hasLocation(#20109,#20110)
+toplevels(#20100,2)
+hasLocation(#20100,#20102)
 #20111=*
-exit_cfg_node(#20111,#20096)
-hasLocation(#20111,#20106)
-successor(#20108,#20107)
-successor(#20107,#20111)
-successor(#20109,#20108)
+stmts(#20111,9,#20100,0,"return false;")
+hasLocation(#20111,#20102)
+stmt_containers(#20111,#20100)
 #20112=*
-xmlElements(#20112,"html",#10000,0,#10000)
-#20113=@"loc,{#10000},1,1,18,7"
-locations_default(#20113,#10000,1,1,18,7)
-xmllocations(#20112,#20113)
-#20114=*
-xmlElements(#20114,"script",#20112,4,#10000)
-#20115=@"loc,{#10000},17,5,17,29"
-locations_default(#20115,#10000,17,5,17,29)
-xmllocations(#20114,#20115)
+exprs(#20112,2,#20111,0,"false")
+hasLocation(#20112,#20106)
+enclosing_stmt(#20112,#20111)
+expr_containers(#20112,#20100)
+literals("false","false",#20112)
+#20113=*
+entry_cfg_node(#20113,#20100)
+#20114=@"loc,{#10000},13,21,13,20"
+locations_default(#20114,#10000,13,21,13,20)
+hasLocation(#20113,#20114)
+#20115=*
+exit_cfg_node(#20115,#20100)
+hasLocation(#20115,#20110)
+successor(#20112,#20111)
+successor(#20111,#20115)
+successor(#20113,#20112)
 #20116=*
-xmlAttrs(#20116,#20114,"type","",0,#10000)
-#20117=@"loc,{#10000},17,13,17,19"
-locations_default(#20117,#10000,17,13,17,19)
-xmllocations(#20116,#20117)
-#20118=*
-xmlElements(#20118,"script",#20112,3,#10000)
-#20119=@"loc,{#10000},16,5,16,71"
-locations_default(#20119,#10000,16,5,16,71)
-xmllocations(#20118,#20119)
-#20120=*
-xmlAttrs(#20120,#20118,"TYPE","text/x-handlebars-template",0,#10000)
-#20121=@"loc,{#10000},16,13,16,45"
-locations_default(#20121,#10000,16,13,16,45)
-xmllocations(#20120,#20121)
-#20122=*
-xmlElements(#20122,"script",#20112,2,#10000)
-#20123=@"loc,{#10000},15,5,15,71"
-locations_default(#20123,#10000,15,5,15,71)
-xmllocations(#20122,#20123)
-#20124=*
-xmlAttrs(#20124,#20122,"type","text/x-handlebars-template",0,#10000)
-#20125=@"loc,{#10000},15,13,15,45"
-locations_default(#20125,#10000,15,13,15,45)
-xmllocations(#20124,#20125)
-#20126=*
-xmlElements(#20126,"body",#20112,1,#10000)
-#20127=@"loc,{#10000},10,5,14,11"
-locations_default(#20127,#10000,10,5,14,11)
-xmllocations(#20126,#20127)
-#20128=*
-xmlElements(#20128,"a",#20126,2,#10000)
-#20129=@"loc,{#10000},13,9,13,59"
-locations_default(#20129,#10000,13,9,13,59)
-xmllocations(#20128,#20129)
-#20130=*
-xmlAttrs(#20130,#20128,"onclick","return false;",0,#10000)
-#20131=@"loc,{#10000},13,12,13,34"
-locations_default(#20131,#10000,13,12,13,34)
-xmllocations(#20130,#20131)
-#20132=*
-xmlElements(#20132,"div",#20126,1,#10000)
-#20133=@"loc,{#10000},12,9,12,75"
-locations_default(#20133,#10000,12,9,12,75)
-xmllocations(#20132,#20133)
-#20134=*
-xmlAttrs(#20134,#20132,"onclick","alert('I said don\'t click!')",0,#10000)
-#20135=@"loc,{#10000},12,14,12,52"
-locations_default(#20135,#10000,12,14,12,52)
-xmllocations(#20134,#20135)
+toplevel_parent_xml_node(#20100,#20116)
+#20117=*
+xmlElements(#20117,"html",#10000,0,#10000)
+#20118=@"loc,{#10000},1,1,18,7"
+locations_default(#20118,#10000,1,1,18,7)
+xmllocations(#20117,#20118)
+#20119=*
+xmlElements(#20119,"script",#20117,4,#10000)
+#20120=@"loc,{#10000},17,5,17,29"
+locations_default(#20120,#10000,17,5,17,29)
+xmllocations(#20119,#20120)
+#20121=*
+xmlAttrs(#20121,#20119,"type","",0,#10000)
+#20122=@"loc,{#10000},17,13,17,19"
+locations_default(#20122,#10000,17,13,17,19)
+xmllocations(#20121,#20122)
+#20123=*
+xmlElements(#20123,"script",#20117,3,#10000)
+#20124=@"loc,{#10000},16,5,16,71"
+locations_default(#20124,#10000,16,5,16,71)
+xmllocations(#20123,#20124)
+#20125=*
+xmlAttrs(#20125,#20123,"TYPE","text/x-handlebars-template",0,#10000)
+#20126=@"loc,{#10000},16,13,16,45"
+locations_default(#20126,#10000,16,13,16,45)
+xmllocations(#20125,#20126)
+#20127=*
+xmlElements(#20127,"script",#20117,2,#10000)
+#20128=@"loc,{#10000},15,5,15,71"
+locations_default(#20128,#10000,15,5,15,71)
+xmllocations(#20127,#20128)
+#20129=*
+xmlAttrs(#20129,#20127,"type","text/x-handlebars-template",0,#10000)
+#20130=@"loc,{#10000},15,13,15,45"
+locations_default(#20130,#10000,15,13,15,45)
+xmllocations(#20129,#20130)
+#20131=*
+xmlElements(#20131,"body",#20117,1,#10000)
+#20132=@"loc,{#10000},10,5,14,11"
+locations_default(#20132,#10000,10,5,14,11)
+xmllocations(#20131,#20132)
+#20133=*
+xmlElements(#20133,"a",#20131,2,#10000)
+#20134=@"loc,{#10000},13,9,13,59"
+locations_default(#20134,#10000,13,9,13,59)
+xmllocations(#20133,#20134)
+xmlAttrs(#20116,#20133,"onclick","return false;",0,#10000)
+#20135=@"loc,{#10000},13,12,13,34"
+locations_default(#20135,#10000,13,12,13,34)
+xmllocations(#20116,#20135)
 #20136=*
-xmlElements(#20136,"a",#20126,0,#10000)
-#20137=@"loc,{#10000},11,9,11,64"
-locations_default(#20137,#10000,11,9,11,64)
+xmlElements(#20136,"div",#20131,1,#10000)
+#20137=@"loc,{#10000},12,9,12,75"
+locations_default(#20137,#10000,12,9,12,75)
 xmllocations(#20136,#20137)
-#20138=*
-xmlAttrs(#20138,#20136,"href","javascript:void(alert('Nope!'))",0,#10000)
-#20139=@"loc,{#10000},11,12,11,49"
-locations_default(#20139,#10000,11,12,11,49)
-xmllocations(#20138,#20139)
-#20140=*
-xmlElements(#20140,"head",#20112,0,#10000)
-#20141=@"loc,{#10000},2,5,9,11"
-locations_default(#20141,#10000,2,5,9,11)
-xmllocations(#20140,#20141)
+xmlAttrs(#20099,#20136,"onclick","alert('I said don\'t click!')",0,#10000)
+#20138=@"loc,{#10000},12,14,12,52"
+locations_default(#20138,#10000,12,14,12,52)
+xmllocations(#20099,#20138)
+#20139=*
+xmlElements(#20139,"a",#20131,0,#10000)
+#20140=@"loc,{#10000},11,9,11,64"
+locations_default(#20140,#10000,11,9,11,64)
+xmllocations(#20139,#20140)
+xmlAttrs(#20076,#20139,"href","javascript:void(alert('Nope!'))",0,#10000)
+#20141=@"loc,{#10000},11,12,11,49"
+locations_default(#20141,#10000,11,12,11,49)
+xmllocations(#20076,#20141)
 #20142=*
-xmlElements(#20142,"script",#20140,3,#10000)
-#20143=@"loc,{#10000},8,9,8,26"
-locations_default(#20143,#10000,8,9,8,26)
+xmlElements(#20142,"head",#20117,0,#10000)
+#20143=@"loc,{#10000},2,5,9,11"
+locations_default(#20143,#10000,2,5,9,11)
 xmllocations(#20142,#20143)
-#20144=*
-xmlElements(#20144,"script",#20140,2,#10000)
+xmlElements(#20043,"script",#20142,3,#10000)
+#20144=@"loc,{#10000},8,9,8,26"
+locations_default(#20144,#10000,8,9,8,26)
+xmllocations(#20043,#20144)
+xmlElements(#20032,"script",#20142,2,#10000)
 #20145=@"loc,{#10000},5,9,7,17"
 locations_default(#20145,#10000,5,9,7,17)
-xmllocations(#20144,#20145)
+xmllocations(#20032,#20145)
 #20146=*
-xmlElements(#20146,"script",#20140,1,#10000)
+xmlElements(#20146,"script",#20142,1,#10000)
 #20147=@"loc,{#10000},4,9,4,43"
 locations_default(#20147,#10000,4,9,4,43)
 xmllocations(#20146,#20147)
@@ -465,7 +470,7 @@ xmlAttrs(#20148,#20146,"src","external.js",0,#10000)
 locations_default(#20149,#10000,4,17,4,33)
 xmllocations(#20148,#20149)
 #20150=*
-xmlElements(#20150,"title",#20140,0,#10000)
+xmlElements(#20150,"title",#20142,0,#10000)
 #20151=@"loc,{#10000},3,9,3,32"
 locations_default(#20151,#10000,3,9,3,32)
 xmllocations(#20150,#20151)
diff --git a/javascript/extractor/tests/html/output/trap/tst.xhtml.trap b/javascript/extractor/tests/html/output/trap/tst.xhtml.trap
index e38c5d4d779..9b874e74b95 100644
--- a/javascript/extractor/tests/html/output/trap/tst.xhtml.trap
+++ b/javascript/extractor/tests/html/output/trap/tst.xhtml.trap
@@ -75,37 +75,38 @@ successor(#20017,#20019)
 successor(#20019,#20021)
 successor(#20020,#20017)
 #20022=*
-xmlElements(#20022,"html",#10000,0,#10000)
-#20023=@"loc,{#10000},2,1,12,7"
-locations_default(#20023,#10000,2,1,12,7)
-xmllocations(#20022,#20023)
-#20024=*
-xmlAttrs(#20024,#20022,"xmlns","http://www.w3.org/1999/xhtml",0,#10000)
-#20025=@"loc,{#10000},2,7,2,42"
-locations_default(#20025,#10000,2,7,2,42)
-xmllocations(#20024,#20025)
-#20026=*
-xmlAttrs(#20026,#20022,"xml:lang","en",1,#10000)
-#20027=@"loc,{#10000},2,44,2,56"
-locations_default(#20027,#10000,2,44,2,56)
-xmllocations(#20026,#20027)
-#20028=*
-xmlElements(#20028,"body",#20022,1,#10000)
-#20029=@"loc,{#10000},6,1,11,7"
-locations_default(#20029,#10000,6,1,11,7)
-xmllocations(#20028,#20029)
-#20030=*
-xmlElements(#20030,"script",#20028,0,#10000)
+toplevel_parent_xml_node(#20001,#20022)
+#20023=*
+xmlElements(#20023,"html",#10000,0,#10000)
+#20024=@"loc,{#10000},2,1,12,7"
+locations_default(#20024,#10000,2,1,12,7)
+xmllocations(#20023,#20024)
+#20025=*
+xmlAttrs(#20025,#20023,"xmlns","http://www.w3.org/1999/xhtml",0,#10000)
+#20026=@"loc,{#10000},2,7,2,42"
+locations_default(#20026,#10000,2,7,2,42)
+xmllocations(#20025,#20026)
+#20027=*
+xmlAttrs(#20027,#20023,"xml:lang","en",1,#10000)
+#20028=@"loc,{#10000},2,44,2,56"
+locations_default(#20028,#10000,2,44,2,56)
+xmllocations(#20027,#20028)
+#20029=*
+xmlElements(#20029,"body",#20023,1,#10000)
+#20030=@"loc,{#10000},6,1,11,7"
+locations_default(#20030,#10000,6,1,11,7)
+xmllocations(#20029,#20030)
+xmlElements(#20022,"script",#20029,0,#10000)
 #20031=@"loc,{#10000},7,5,10,16"
 locations_default(#20031,#10000,7,5,10,16)
-xmllocations(#20030,#20031)
+xmllocations(#20022,#20031)
 #20032=*
-xmlAttrs(#20032,#20030,"type","application/javascript",0,#10000)
+xmlAttrs(#20032,#20022,"type","application/javascript",0,#10000)
 #20033=@"loc,{#10000},7,13,7,41"
 locations_default(#20033,#10000,7,13,7,41)
 xmllocations(#20032,#20033)
 #20034=*
-xmlElements(#20034,"head",#20022,0,#10000)
+xmlElements(#20034,"head",#20023,0,#10000)
 #20035=@"loc,{#10000},3,1,5,7"
 locations_default(#20035,#10000,3,1,5,7)
 xmllocations(#20034,#20035)
diff --git a/javascript/extractor/tests/html/output/trap/tst2.html.trap b/javascript/extractor/tests/html/output/trap/tst2.html.trap
index 4db4a8ff3b0..050936eb14e 100644
--- a/javascript/extractor/tests/html/output/trap/tst2.html.trap
+++ b/javascript/extractor/tests/html/output/trap/tst2.html.trap
@@ -67,302 +67,306 @@ successor(#20013,#20015)
 successor(#20015,#20014)
 successor(#20014,#20018)
 successor(#20016,#20013)
-#20019=@"script;{#10000},3,29"
-#20020=*
-lines(#20020,#20019,"var world;","")
-#20021=@"loc,{#10000},3,29,3,38"
-locations_default(#20021,#10000,3,29,3,38)
-hasLocation(#20020,#20021)
-numlines(#20019,1,1,0)
-#20022=*
-tokeninfo(#20022,7,#20019,0,"var")
-#20023=@"loc,{#10000},3,29,3,31"
-locations_default(#20023,#10000,3,29,3,31)
-hasLocation(#20022,#20023)
-#20024=*
-tokeninfo(#20024,6,#20019,1,"world")
-#20025=@"loc,{#10000},3,33,3,37"
-locations_default(#20025,#10000,3,33,3,37)
-hasLocation(#20024,#20025)
-#20026=*
-tokeninfo(#20026,8,#20019,2,";")
-#20027=@"loc,{#10000},3,38,3,38"
-locations_default(#20027,#10000,3,38,3,38)
-hasLocation(#20026,#20027)
-#20028=*
-tokeninfo(#20028,0,#20019,3,"")
-#20029=@"loc,{#10000},3,39,3,38"
-locations_default(#20029,#10000,3,39,3,38)
-hasLocation(#20028,#20029)
-toplevels(#20019,1)
-hasLocation(#20019,#20021)
-#20030=@"var;{world};{#20000}"
-variables(#20030,"world",#20000)
-#20031=*
-stmts(#20031,18,#20019,0,"var world;")
-hasLocation(#20031,#20021)
-stmt_containers(#20031,#20019)
+#20019=*
+toplevel_parent_xml_node(#20001,#20019)
+#20020=@"script;{#10000},3,29"
+#20021=*
+lines(#20021,#20020,"var world;","")
+#20022=@"loc,{#10000},3,29,3,38"
+locations_default(#20022,#10000,3,29,3,38)
+hasLocation(#20021,#20022)
+numlines(#20020,1,1,0)
+#20023=*
+tokeninfo(#20023,7,#20020,0,"var")
+#20024=@"loc,{#10000},3,29,3,31"
+locations_default(#20024,#10000,3,29,3,31)
+hasLocation(#20023,#20024)
+#20025=*
+tokeninfo(#20025,6,#20020,1,"world")
+#20026=@"loc,{#10000},3,33,3,37"
+locations_default(#20026,#10000,3,33,3,37)
+hasLocation(#20025,#20026)
+#20027=*
+tokeninfo(#20027,8,#20020,2,";")
+#20028=@"loc,{#10000},3,38,3,38"
+locations_default(#20028,#10000,3,38,3,38)
+hasLocation(#20027,#20028)
+#20029=*
+tokeninfo(#20029,0,#20020,3,"")
+#20030=@"loc,{#10000},3,39,3,38"
+locations_default(#20030,#10000,3,39,3,38)
+hasLocation(#20029,#20030)
+toplevels(#20020,1)
+hasLocation(#20020,#20022)
+#20031=@"var;{world};{#20000}"
+variables(#20031,"world",#20000)
 #20032=*
-exprs(#20032,64,#20031,0,"world")
-hasLocation(#20032,#20025)
-enclosing_stmt(#20032,#20031)
-expr_containers(#20032,#20019)
+stmts(#20032,18,#20020,0,"var world;")
+hasLocation(#20032,#20022)
+stmt_containers(#20032,#20020)
 #20033=*
-exprs(#20033,78,#20032,0,"world")
-hasLocation(#20033,#20025)
-enclosing_stmt(#20033,#20031)
-expr_containers(#20033,#20019)
-literals("world","world",#20033)
-decl(#20033,#20030)
+exprs(#20033,64,#20032,0,"world")
+hasLocation(#20033,#20026)
+enclosing_stmt(#20033,#20032)
+expr_containers(#20033,#20020)
 #20034=*
-entry_cfg_node(#20034,#20019)
-#20035=@"loc,{#10000},3,29,3,28"
-locations_default(#20035,#10000,3,29,3,28)
-hasLocation(#20034,#20035)
-#20036=*
-exit_cfg_node(#20036,#20019)
-hasLocation(#20036,#20029)
-successor(#20031,#20033)
-successor(#20033,#20032)
-successor(#20032,#20036)
-successor(#20034,#20031)
-#20037=@"script;{#10000},4,75"
+exprs(#20034,78,#20033,0,"world")
+hasLocation(#20034,#20026)
+enclosing_stmt(#20034,#20032)
+expr_containers(#20034,#20020)
+literals("world","world",#20034)
+decl(#20034,#20031)
+#20035=*
+entry_cfg_node(#20035,#20020)
+#20036=@"loc,{#10000},3,29,3,28"
+locations_default(#20036,#10000,3,29,3,28)
+hasLocation(#20035,#20036)
+#20037=*
+exit_cfg_node(#20037,#20020)
+hasLocation(#20037,#20030)
+successor(#20032,#20034)
+successor(#20034,#20033)
+successor(#20033,#20037)
+successor(#20035,#20032)
 #20038=*
-lines(#20038,#20037,"","
-")
-#20039=@"loc,{#10000},4,75,4,74"
-locations_default(#20039,#10000,4,75,4,74)
-hasLocation(#20038,#20039)
+toplevel_parent_xml_node(#20020,#20038)
+#20039=@"script;{#10000},4,75"
 #20040=*
-lines(#20040,#20037,"      var inAModule;","
+lines(#20040,#20039,"","
 ")
-#20041=@"loc,{#10000},5,1,5,20"
-locations_default(#20041,#10000,5,1,5,20)
+#20041=@"loc,{#10000},4,75,4,74"
+locations_default(#20041,#10000,4,75,4,74)
 hasLocation(#20040,#20041)
-indentation(#10000,5," ",6)
 #20042=*
-lines(#20042,#20037,"    ","")
-#20043=@"loc,{#10000},6,1,6,4"
-locations_default(#20043,#10000,6,1,6,4)
+lines(#20042,#20039,"      var inAModule;","
+")
+#20043=@"loc,{#10000},5,1,5,20"
+locations_default(#20043,#10000,5,1,5,20)
 hasLocation(#20042,#20043)
-numlines(#20037,3,1,0)
+indentation(#10000,5," ",6)
 #20044=*
-tokeninfo(#20044,7,#20037,0,"var")
-#20045=@"loc,{#10000},5,7,5,9"
-locations_default(#20045,#10000,5,7,5,9)
+lines(#20044,#20039,"    ","")
+#20045=@"loc,{#10000},6,1,6,4"
+locations_default(#20045,#10000,6,1,6,4)
 hasLocation(#20044,#20045)
+numlines(#20039,3,1,0)
 #20046=*
-tokeninfo(#20046,6,#20037,1,"inAModule")
-#20047=@"loc,{#10000},5,11,5,19"
-locations_default(#20047,#10000,5,11,5,19)
+tokeninfo(#20046,7,#20039,0,"var")
+#20047=@"loc,{#10000},5,7,5,9"
+locations_default(#20047,#10000,5,7,5,9)
 hasLocation(#20046,#20047)
 #20048=*
-tokeninfo(#20048,8,#20037,2,";")
-#20049=@"loc,{#10000},5,20,5,20"
-locations_default(#20049,#10000,5,20,5,20)
+tokeninfo(#20048,6,#20039,1,"inAModule")
+#20049=@"loc,{#10000},5,11,5,19"
+locations_default(#20049,#10000,5,11,5,19)
 hasLocation(#20048,#20049)
 #20050=*
-tokeninfo(#20050,0,#20037,3,"")
-#20051=@"loc,{#10000},6,5,6,4"
-locations_default(#20051,#10000,6,5,6,4)
+tokeninfo(#20050,8,#20039,2,";")
+#20051=@"loc,{#10000},5,20,5,20"
+locations_default(#20051,#10000,5,20,5,20)
 hasLocation(#20050,#20051)
-toplevels(#20037,1)
-#20052=@"loc,{#10000},4,75,6,4"
-locations_default(#20052,#10000,4,75,6,4)
-hasLocation(#20037,#20052)
-#20053=@"module;{#10000},4,75"
-scopes(#20053,3)
-scopenodes(#20037,#20053)
-scopenesting(#20053,#20000)
-is_module(#20037)
-is_es2015_module(#20037)
-#20054=@"var;{inAModule};{#20053}"
-variables(#20054,"inAModule",#20053)
-#20055=*
-stmts(#20055,18,#20037,0,"var inAModule;")
-#20056=@"loc,{#10000},5,7,5,20"
-locations_default(#20056,#10000,5,7,5,20)
-hasLocation(#20055,#20056)
-stmt_containers(#20055,#20037)
+#20052=*
+tokeninfo(#20052,0,#20039,3,"")
+#20053=@"loc,{#10000},6,5,6,4"
+locations_default(#20053,#10000,6,5,6,4)
+hasLocation(#20052,#20053)
+toplevels(#20039,1)
+#20054=@"loc,{#10000},4,75,6,4"
+locations_default(#20054,#10000,4,75,6,4)
+hasLocation(#20039,#20054)
+#20055=@"module;{#10000},4,75"
+scopes(#20055,3)
+scopenodes(#20039,#20055)
+scopenesting(#20055,#20000)
+is_module(#20039)
+is_es2015_module(#20039)
+#20056=@"var;{inAModule};{#20055}"
+variables(#20056,"inAModule",#20055)
 #20057=*
-exprs(#20057,64,#20055,0,"inAModule")
-hasLocation(#20057,#20047)
-enclosing_stmt(#20057,#20055)
-expr_containers(#20057,#20037)
-#20058=*
-exprs(#20058,78,#20057,0,"inAModule")
-hasLocation(#20058,#20047)
-enclosing_stmt(#20058,#20055)
-expr_containers(#20058,#20037)
-literals("inAModule","inAModule",#20058)
-decl(#20058,#20054)
+stmts(#20057,18,#20039,0,"var inAModule;")
+#20058=@"loc,{#10000},5,7,5,20"
+locations_default(#20058,#10000,5,7,5,20)
+hasLocation(#20057,#20058)
+stmt_containers(#20057,#20039)
 #20059=*
-entry_cfg_node(#20059,#20037)
-hasLocation(#20059,#20039)
+exprs(#20059,64,#20057,0,"inAModule")
+hasLocation(#20059,#20049)
+enclosing_stmt(#20059,#20057)
+expr_containers(#20059,#20039)
 #20060=*
-exit_cfg_node(#20060,#20037)
-hasLocation(#20060,#20051)
-successor(#20055,#20058)
-successor(#20058,#20057)
-successor(#20057,#20060)
-successor(#20059,#20055)
-#20061=@"script;{#10000},7,75"
+exprs(#20060,78,#20059,0,"inAModule")
+hasLocation(#20060,#20049)
+enclosing_stmt(#20060,#20057)
+expr_containers(#20060,#20039)
+literals("inAModule","inAModule",#20060)
+decl(#20060,#20056)
+#20061=*
+entry_cfg_node(#20061,#20039)
+hasLocation(#20061,#20041)
 #20062=*
-lines(#20062,#20061,"","
+exit_cfg_node(#20062,#20039)
+hasLocation(#20062,#20053)
+successor(#20057,#20060)
+successor(#20060,#20059)
+successor(#20059,#20062)
+successor(#20061,#20057)
+#20063=*
+toplevel_parent_xml_node(#20039,#20063)
+#20064=@"script;{#10000},7,75"
+#20065=*
+lines(#20065,#20064,"","
 ")
-#20063=@"loc,{#10000},7,75,7,74"
-locations_default(#20063,#10000,7,75,7,74)
-hasLocation(#20062,#20063)
-#20064=*
-lines(#20064,#20061,"      import f from ""f""","
+#20066=@"loc,{#10000},7,75,7,74"
+locations_default(#20066,#10000,7,75,7,74)
+hasLocation(#20065,#20066)
+#20067=*
+lines(#20067,#20064,"      import f from ""f""","
 ")
-#20065=@"loc,{#10000},8,1,8,23"
-locations_default(#20065,#10000,8,1,8,23)
-hasLocation(#20064,#20065)
+#20068=@"loc,{#10000},8,1,8,23"
+locations_default(#20068,#10000,8,1,8,23)
+hasLocation(#20067,#20068)
 indentation(#10000,8," ",6)
-#20066=*
-lines(#20066,#20061,"    ","")
-#20067=@"loc,{#10000},9,1,9,4"
-locations_default(#20067,#10000,9,1,9,4)
-hasLocation(#20066,#20067)
-numlines(#20061,3,1,0)
-#20068=*
-tokeninfo(#20068,7,#20061,0,"import")
-#20069=@"loc,{#10000},8,7,8,12"
-locations_default(#20069,#10000,8,7,8,12)
-hasLocation(#20068,#20069)
-#20070=*
-tokeninfo(#20070,6,#20061,1,"f")
-#20071=@"loc,{#10000},8,14,8,14"
-locations_default(#20071,#10000,8,14,8,14)
-hasLocation(#20070,#20071)
-#20072=*
-tokeninfo(#20072,6,#20061,2,"from")
-#20073=@"loc,{#10000},8,16,8,19"
-locations_default(#20073,#10000,8,16,8,19)
-hasLocation(#20072,#20073)
-#20074=*
-tokeninfo(#20074,4,#20061,3,"""f""")
-#20075=@"loc,{#10000},8,21,8,23"
-locations_default(#20075,#10000,8,21,8,23)
-hasLocation(#20074,#20075)
-#20076=*
-tokeninfo(#20076,0,#20061,4,"")
-#20077=@"loc,{#10000},9,5,9,4"
-locations_default(#20077,#10000,9,5,9,4)
-hasLocation(#20076,#20077)
-toplevels(#20061,1)
-#20078=@"loc,{#10000},7,75,9,4"
-locations_default(#20078,#10000,7,75,9,4)
-hasLocation(#20061,#20078)
-#20079=@"module;{#10000},7,75"
-scopes(#20079,3)
-scopenodes(#20061,#20079)
-scopenesting(#20079,#20000)
-is_module(#20061)
-is_es2015_module(#20061)
-#20080=@"var;{f};{#20079}"
-variables(#20080,"f",#20079)
-#20081=@"local_type_name;{f};{#20079}"
-local_type_names(#20081,"f",#20079)
-#20082=@"local_namespace_name;{f};{#20079}"
-local_namespace_names(#20082,"f",#20079)
-variables(#20080,"f",#20079)
-local_type_names(#20081,"f",#20079)
-local_namespace_names(#20082,"f",#20079)
-#20083=*
-stmts(#20083,27,#20061,0,"import f from ""f""")
-#20084=@"loc,{#10000},8,7,8,23"
-locations_default(#20084,#10000,8,7,8,23)
-hasLocation(#20083,#20084)
-stmt_containers(#20083,#20061)
-#20085=*
-exprs(#20085,4,#20083,-1,"""f""")
-hasLocation(#20085,#20075)
-enclosing_stmt(#20085,#20083)
-expr_containers(#20085,#20061)
-literals("f","""f""",#20085)
+#20069=*
+lines(#20069,#20064,"    ","")
+#20070=@"loc,{#10000},9,1,9,4"
+locations_default(#20070,#10000,9,1,9,4)
+hasLocation(#20069,#20070)
+numlines(#20064,3,1,0)
+#20071=*
+tokeninfo(#20071,7,#20064,0,"import")
+#20072=@"loc,{#10000},8,7,8,12"
+locations_default(#20072,#10000,8,7,8,12)
+hasLocation(#20071,#20072)
+#20073=*
+tokeninfo(#20073,6,#20064,1,"f")
+#20074=@"loc,{#10000},8,14,8,14"
+locations_default(#20074,#10000,8,14,8,14)
+hasLocation(#20073,#20074)
+#20075=*
+tokeninfo(#20075,6,#20064,2,"from")
+#20076=@"loc,{#10000},8,16,8,19"
+locations_default(#20076,#10000,8,16,8,19)
+hasLocation(#20075,#20076)
+#20077=*
+tokeninfo(#20077,4,#20064,3,"""f""")
+#20078=@"loc,{#10000},8,21,8,23"
+locations_default(#20078,#10000,8,21,8,23)
+hasLocation(#20077,#20078)
+#20079=*
+tokeninfo(#20079,0,#20064,4,"")
+#20080=@"loc,{#10000},9,5,9,4"
+locations_default(#20080,#10000,9,5,9,4)
+hasLocation(#20079,#20080)
+toplevels(#20064,1)
+#20081=@"loc,{#10000},7,75,9,4"
+locations_default(#20081,#10000,7,75,9,4)
+hasLocation(#20064,#20081)
+#20082=@"module;{#10000},7,75"
+scopes(#20082,3)
+scopenodes(#20064,#20082)
+scopenesting(#20082,#20000)
+is_module(#20064)
+is_es2015_module(#20064)
+#20083=@"var;{f};{#20082}"
+variables(#20083,"f",#20082)
+#20084=@"local_type_name;{f};{#20082}"
+local_type_names(#20084,"f",#20082)
+#20085=@"local_namespace_name;{f};{#20082}"
+local_namespace_names(#20085,"f",#20082)
+variables(#20083,"f",#20082)
+local_type_names(#20084,"f",#20082)
+local_namespace_names(#20085,"f",#20082)
 #20086=*
-regexpterm(#20086,14,#20085,0,"f")
-#20087=@"loc,{#10000},8,22,8,22"
-locations_default(#20087,#10000,8,22,8,22)
+stmts(#20086,27,#20064,0,"import f from ""f""")
+#20087=@"loc,{#10000},8,7,8,23"
+locations_default(#20087,#10000,8,7,8,23)
 hasLocation(#20086,#20087)
-regexp_const_value(#20086,"f")
+stmt_containers(#20086,#20064)
 #20088=*
-exprs(#20088,84,#20083,0,"f")
-hasLocation(#20088,#20071)
-enclosing_stmt(#20088,#20083)
-expr_containers(#20088,#20061)
+exprs(#20088,4,#20086,-1,"""f""")
+hasLocation(#20088,#20078)
+enclosing_stmt(#20088,#20086)
+expr_containers(#20088,#20064)
+literals("f","""f""",#20088)
 #20089=*
-exprs(#20089,78,#20088,1,"f")
-hasLocation(#20089,#20071)
-enclosing_stmt(#20089,#20083)
-expr_containers(#20089,#20061)
-literals("f","f",#20089)
-decl(#20089,#20080)
-typedecl(#20089,#20081)
-namespacedecl(#20089,#20082)
-#20090=*
-entry_cfg_node(#20090,#20061)
-hasLocation(#20090,#20063)
+regexpterm(#20089,14,#20088,0,"f")
+#20090=@"loc,{#10000},8,22,8,22"
+locations_default(#20090,#10000,8,22,8,22)
+hasLocation(#20089,#20090)
+regexp_const_value(#20089,"f")
 #20091=*
-exit_cfg_node(#20091,#20061)
-hasLocation(#20091,#20077)
-successor(#20083,#20091)
-successor(#20088,#20083)
-successor(#20090,#20088)
+exprs(#20091,84,#20086,0,"f")
+hasLocation(#20091,#20074)
+enclosing_stmt(#20091,#20086)
+expr_containers(#20091,#20064)
 #20092=*
-xmlElements(#20092,"html",#10000,0,#10000)
-#20093=@"loc,{#10000},1,1,10,7"
-locations_default(#20093,#10000,1,1,10,7)
-xmllocations(#20092,#20093)
+exprs(#20092,78,#20091,1,"f")
+hasLocation(#20092,#20074)
+enclosing_stmt(#20092,#20086)
+expr_containers(#20092,#20064)
+literals("f","f",#20092)
+decl(#20092,#20083)
+typedecl(#20092,#20084)
+namespacedecl(#20092,#20085)
+#20093=*
+entry_cfg_node(#20093,#20064)
+hasLocation(#20093,#20066)
 #20094=*
-xmlElements(#20094,"script",#20092,3,#10000)
-#20095=@"loc,{#10000},7,5,9,13"
-locations_default(#20095,#10000,7,5,9,13)
-xmllocations(#20094,#20095)
+exit_cfg_node(#20094,#20064)
+hasLocation(#20094,#20080)
+successor(#20086,#20094)
+successor(#20091,#20086)
+successor(#20093,#20091)
+#20095=*
+toplevel_parent_xml_node(#20064,#20095)
 #20096=*
-xmlAttrs(#20096,#20094,"type","text/babel",0,#10000)
-#20097=@"loc,{#10000},7,13,7,29"
-locations_default(#20097,#10000,7,13,7,29)
+xmlElements(#20096,"html",#10000,0,#10000)
+#20097=@"loc,{#10000},1,1,10,7"
+locations_default(#20097,#10000,1,1,10,7)
 xmllocations(#20096,#20097)
-#20098=*
-xmlAttrs(#20098,#20094,"data-plugins","transform-es2015-modules-umd",1,#10000)
-#20099=@"loc,{#10000},7,31,7,73"
-locations_default(#20099,#10000,7,31,7,73)
-xmllocations(#20098,#20099)
-#20100=*
-xmlElements(#20100,"script",#20092,2,#10000)
-#20101=@"loc,{#10000},4,5,6,13"
-locations_default(#20101,#10000,4,5,6,13)
-xmllocations(#20100,#20101)
-#20102=*
-xmlAttrs(#20102,#20100,"type","text/babel",0,#10000)
-#20103=@"loc,{#10000},4,13,4,29"
-locations_default(#20103,#10000,4,13,4,29)
-xmllocations(#20102,#20103)
+xmlElements(#20095,"script",#20096,3,#10000)
+#20098=@"loc,{#10000},7,5,9,13"
+locations_default(#20098,#10000,7,5,9,13)
+xmllocations(#20095,#20098)
+#20099=*
+xmlAttrs(#20099,#20095,"type","text/babel",0,#10000)
+#20100=@"loc,{#10000},7,13,7,29"
+locations_default(#20100,#10000,7,13,7,29)
+xmllocations(#20099,#20100)
+#20101=*
+xmlAttrs(#20101,#20095,"data-plugins","transform-es2015-modules-umd",1,#10000)
+#20102=@"loc,{#10000},7,31,7,73"
+locations_default(#20102,#10000,7,31,7,73)
+xmllocations(#20101,#20102)
+xmlElements(#20063,"script",#20096,2,#10000)
+#20103=@"loc,{#10000},4,5,6,13"
+locations_default(#20103,#10000,4,5,6,13)
+xmllocations(#20063,#20103)
 #20104=*
-xmlAttrs(#20104,#20100,"data-plugins","transform-es2015-modules-umd",1,#10000)
-#20105=@"loc,{#10000},4,31,4,73"
-locations_default(#20105,#10000,4,31,4,73)
+xmlAttrs(#20104,#20063,"type","text/babel",0,#10000)
+#20105=@"loc,{#10000},4,13,4,29"
+locations_default(#20105,#10000,4,13,4,29)
 xmllocations(#20104,#20105)
 #20106=*
-xmlElements(#20106,"script",#20092,1,#10000)
-#20107=@"loc,{#10000},3,5,3,47"
-locations_default(#20107,#10000,3,5,3,47)
+xmlAttrs(#20106,#20063,"data-plugins","transform-es2015-modules-umd",1,#10000)
+#20107=@"loc,{#10000},4,31,4,73"
+locations_default(#20107,#10000,4,31,4,73)
 xmllocations(#20106,#20107)
-#20108=*
-xmlAttrs(#20108,#20106,"type","text/jsx",0,#10000)
-#20109=@"loc,{#10000},3,13,3,27"
-locations_default(#20109,#10000,3,13,3,27)
-xmllocations(#20108,#20109)
-#20110=*
-xmlElements(#20110,"script",#20092,0,#10000)
+xmlElements(#20038,"script",#20096,1,#10000)
+#20108=@"loc,{#10000},3,5,3,47"
+locations_default(#20108,#10000,3,5,3,47)
+xmllocations(#20038,#20108)
+#20109=*
+xmlAttrs(#20109,#20038,"type","text/jsx",0,#10000)
+#20110=@"loc,{#10000},3,13,3,27"
+locations_default(#20110,#10000,3,13,3,27)
+xmllocations(#20109,#20110)
+xmlElements(#20019,"script",#20096,0,#10000)
 #20111=@"loc,{#10000},2,5,2,49"
 locations_default(#20111,#10000,2,5,2,49)
-xmllocations(#20110,#20111)
+xmllocations(#20019,#20111)
 #20112=*
-xmlAttrs(#20112,#20110,"type","text/babel",0,#10000)
+xmlAttrs(#20112,#20019,"type","text/babel",0,#10000)
 #20113=@"loc,{#10000},2,13,2,29"
 locations_default(#20113,#10000,2,13,2,29)
 xmllocations(#20112,#20113)
diff --git a/javascript/extractor/tests/ng-templates/output/trap/component.js.trap b/javascript/extractor/tests/ng-templates/output/trap/component.js.trap
index ed7ea4db967..59104693168 100644
--- a/javascript/extractor/tests/ng-templates/output/trap/component.js.trap
+++ b/javascript/extractor/tests/ng-templates/output/trap/component.js.trap
@@ -356,7 +356,7 @@ tokeninfo(#20109,0,#20100,3,"")
 #20110=@"loc,{#10000},5,26,5,25"
 locations_default(#20110,#10000,5,26,5,25)
 hasLocation(#20109,#20110)
-toplevels(#20100,2)
+toplevels(#20100,4)
 hasLocation(#20100,#20102)
 #20111=@"module;{#10000},5,15"
 scopes(#20111,3)
@@ -378,8 +378,8 @@ hasLocation(#20114,#20104)
 enclosing_stmt(#20114,#20112)
 expr_containers(#20114,#20100)
 literals("expr","expr",#20114)
-#20115=@"var;{expr};{#20000}"
-variables(#20115,"expr",#20000)
+#20115=@"var;{expr};{#20111}"
+variables(#20115,"expr",#20111)
 bind(#20114,#20115)
 #20116=*
 exprs(#20116,79,#20113,1,"expr")
@@ -425,7 +425,7 @@ tokeninfo(#20128,0,#20121,2,"")
 #20129=@"loc,{#10000},6,19,6,18"
 locations_default(#20129,#10000,6,19,6,18)
 hasLocation(#20128,#20129)
-toplevels(#20121,2)
+toplevels(#20121,4)
 hasLocation(#20121,#20123)
 #20130=@"module;{#10000},6,14"
 scopes(#20130,3)
@@ -447,209 +447,213 @@ hasLocation(#20133,#20125)
 enclosing_stmt(#20133,#20131)
 expr_containers(#20133,#20121)
 literals("expr","expr",#20133)
-bind(#20133,#20115)
-#20134=*
-entry_cfg_node(#20134,#20121)
-#20135=@"loc,{#10000},6,14,6,13"
-locations_default(#20135,#10000,6,14,6,13)
-hasLocation(#20134,#20135)
-#20136=*
-exit_cfg_node(#20136,#20121)
-hasLocation(#20136,#20129)
+#20134=@"var;{expr};{#20130}"
+variables(#20134,"expr",#20130)
+bind(#20133,#20134)
+#20135=*
+entry_cfg_node(#20135,#20121)
+#20136=@"loc,{#10000},6,14,6,13"
+locations_default(#20136,#10000,6,14,6,13)
+hasLocation(#20135,#20136)
+#20137=*
+exit_cfg_node(#20137,#20121)
+hasLocation(#20137,#20129)
 successor(#20131,#20133)
 successor(#20133,#20132)
-successor(#20132,#20136)
-successor(#20134,#20131)
-#20137=*
-toplevel_parent_xml_node(#20121,#20137)
-#20138=@"script;{#10000},7,14"
-#20139=*
-lines(#20139,#20138,"expr?.bar","")
-#20140=@"loc,{#10000},7,14,7,22"
-locations_default(#20140,#10000,7,14,7,22)
-hasLocation(#20139,#20140)
-numlines(#20138,1,1,0)
-#20141=*
-tokeninfo(#20141,6,#20138,0,"expr")
-#20142=@"loc,{#10000},7,14,7,17"
-locations_default(#20142,#10000,7,14,7,17)
-hasLocation(#20141,#20142)
-#20143=*
-tokeninfo(#20143,8,#20138,1,"?.")
-#20144=@"loc,{#10000},7,18,7,19"
-locations_default(#20144,#10000,7,18,7,19)
-hasLocation(#20143,#20144)
-#20145=*
-tokeninfo(#20145,6,#20138,2,"bar")
-#20146=@"loc,{#10000},7,20,7,22"
-locations_default(#20146,#10000,7,20,7,22)
-hasLocation(#20145,#20146)
-#20147=*
-tokeninfo(#20147,0,#20138,3,"")
-#20148=@"loc,{#10000},7,23,7,22"
-locations_default(#20148,#10000,7,23,7,22)
-hasLocation(#20147,#20148)
-toplevels(#20138,2)
-hasLocation(#20138,#20140)
-#20149=@"module;{#10000},7,14"
-scopes(#20149,3)
-scopenodes(#20138,#20149)
-scopenesting(#20149,#20000)
-is_module(#20138)
-#20150=*
-stmts(#20150,2,#20138,0,"expr?.bar")
-hasLocation(#20150,#20140)
-stmt_containers(#20150,#20138)
+successor(#20132,#20137)
+successor(#20135,#20131)
+#20138=*
+toplevel_parent_xml_node(#20121,#20138)
+#20139=@"script;{#10000},7,14"
+#20140=*
+lines(#20140,#20139,"expr?.bar","")
+#20141=@"loc,{#10000},7,14,7,22"
+locations_default(#20141,#10000,7,14,7,22)
+hasLocation(#20140,#20141)
+numlines(#20139,1,1,0)
+#20142=*
+tokeninfo(#20142,6,#20139,0,"expr")
+#20143=@"loc,{#10000},7,14,7,17"
+locations_default(#20143,#10000,7,14,7,17)
+hasLocation(#20142,#20143)
+#20144=*
+tokeninfo(#20144,8,#20139,1,"?.")
+#20145=@"loc,{#10000},7,18,7,19"
+locations_default(#20145,#10000,7,18,7,19)
+hasLocation(#20144,#20145)
+#20146=*
+tokeninfo(#20146,6,#20139,2,"bar")
+#20147=@"loc,{#10000},7,20,7,22"
+locations_default(#20147,#10000,7,20,7,22)
+hasLocation(#20146,#20147)
+#20148=*
+tokeninfo(#20148,0,#20139,3,"")
+#20149=@"loc,{#10000},7,23,7,22"
+locations_default(#20149,#10000,7,23,7,22)
+hasLocation(#20148,#20149)
+toplevels(#20139,4)
+hasLocation(#20139,#20141)
+#20150=@"module;{#10000},7,14"
+scopes(#20150,3)
+scopenodes(#20139,#20150)
+scopenesting(#20150,#20000)
+is_module(#20139)
 #20151=*
-exprs(#20151,14,#20150,0,"expr?.bar")
-hasLocation(#20151,#20140)
-enclosing_stmt(#20151,#20150)
-expr_containers(#20151,#20138)
+stmts(#20151,2,#20139,0,"expr?.bar")
+hasLocation(#20151,#20141)
+stmt_containers(#20151,#20139)
 #20152=*
-exprs(#20152,79,#20151,0,"expr")
-hasLocation(#20152,#20142)
-enclosing_stmt(#20152,#20150)
-expr_containers(#20152,#20138)
-literals("expr","expr",#20152)
-bind(#20152,#20115)
+exprs(#20152,14,#20151,0,"expr?.bar")
+hasLocation(#20152,#20141)
+enclosing_stmt(#20152,#20151)
+expr_containers(#20152,#20139)
 #20153=*
-exprs(#20153,0,#20151,1,"bar")
-hasLocation(#20153,#20146)
-enclosing_stmt(#20153,#20150)
-expr_containers(#20153,#20138)
-literals("bar","bar",#20153)
-isOptionalChaining(#20151)
-#20154=*
-entry_cfg_node(#20154,#20138)
-#20155=@"loc,{#10000},7,14,7,13"
-locations_default(#20155,#10000,7,14,7,13)
-hasLocation(#20154,#20155)
+exprs(#20153,79,#20152,0,"expr")
+hasLocation(#20153,#20143)
+enclosing_stmt(#20153,#20151)
+expr_containers(#20153,#20139)
+literals("expr","expr",#20153)
+#20154=@"var;{expr};{#20150}"
+variables(#20154,"expr",#20150)
+bind(#20153,#20154)
+#20155=*
+exprs(#20155,0,#20152,1,"bar")
+hasLocation(#20155,#20147)
+enclosing_stmt(#20155,#20151)
+expr_containers(#20155,#20139)
+literals("bar","bar",#20155)
+isOptionalChaining(#20152)
 #20156=*
-exit_cfg_node(#20156,#20138)
-hasLocation(#20156,#20148)
-successor(#20150,#20152)
-successor(#20153,#20151)
-successor(#20152,#20153)
-successor(#20151,#20156)
-successor(#20152,#20156)
-successor(#20154,#20150)
-#20157=*
-toplevel_parent_xml_node(#20138,#20157)
+entry_cfg_node(#20156,#20139)
+#20157=@"loc,{#10000},7,14,7,13"
+locations_default(#20157,#10000,7,14,7,13)
+hasLocation(#20156,#20157)
 #20158=*
-xmlChars(#20158,"
-	",#10000,0,0,#10000)
-#20159=@"loc,{#10000},4,13,5,2"
-locations_default(#20159,#10000,4,13,5,2)
-xmllocations(#20158,#20159)
+exit_cfg_node(#20158,#20139)
+hasLocation(#20158,#20149)
+successor(#20151,#20153)
+successor(#20155,#20152)
+successor(#20153,#20155)
+successor(#20152,#20158)
+successor(#20153,#20158)
+successor(#20156,#20151)
+#20159=*
+toplevel_parent_xml_node(#20139,#20159)
 #20160=*
 xmlChars(#20160,"
-	",#10000,2,0,#10000)
-#20161=@"loc,{#10000},5,29,6,2"
-locations_default(#20161,#10000,5,29,6,2)
+	",#10000,0,0,#10000)
+#20161=@"loc,{#10000},4,13,5,2"
+locations_default(#20161,#10000,4,13,5,2)
 xmllocations(#20160,#20161)
 #20162=*
 xmlChars(#20162,"
-	",#10000,4,0,#10000)
-#20163=@"loc,{#10000},6,23,7,2"
-locations_default(#20163,#10000,6,23,7,2)
+	",#10000,2,0,#10000)
+#20163=@"loc,{#10000},5,29,6,2"
+locations_default(#20163,#10000,5,29,6,2)
 xmllocations(#20162,#20163)
 #20164=*
 xmlChars(#20164,"
-	",#10000,6,0,#10000)
-#20165=@"loc,{#10000},7,27,8,2"
-locations_default(#20165,#10000,7,27,8,2)
+	",#10000,4,0,#10000)
+#20165=@"loc,{#10000},6,23,7,2"
+locations_default(#20165,#10000,6,23,7,2)
 xmllocations(#20164,#20165)
 #20166=*
-xmlElements(#20166,"foo",#10000,5,#10000)
-#20167=@"loc,{#10000},7,2,7,27"
-locations_default(#20167,#10000,7,2,7,27)
+xmlChars(#20166,"
+	",#10000,6,0,#10000)
+#20167=@"loc,{#10000},7,27,8,2"
+locations_default(#20167,#10000,7,27,8,2)
 xmllocations(#20166,#20167)
-xmlAttrs(#20157,#20166,"[baz]","expr?.bar",0,#10000)
-#20168=@"loc,{#10000},7,7,7,24"
-locations_default(#20168,#10000,7,7,7,24)
-xmllocations(#20157,#20168)
-#20169=*
-xmlElements(#20169,"foo",#10000,3,#10000)
-#20170=@"loc,{#10000},6,2,6,23"
-locations_default(#20170,#10000,6,2,6,23)
-xmllocations(#20169,#20170)
-xmlAttrs(#20137,#20169,"[baz]","expr!",0,#10000)
-#20171=@"loc,{#10000},6,7,6,20"
-locations_default(#20171,#10000,6,7,6,20)
-xmllocations(#20137,#20171)
-#20172=*
-xmlElements(#20172,"foo",#10000,1,#10000)
-#20173=@"loc,{#10000},5,2,5,29"
-locations_default(#20173,#10000,5,2,5,29)
-xmllocations(#20172,#20173)
-xmlAttrs(#20120,#20172,"[prop]","expr + expr",0,#10000)
-#20174=@"loc,{#10000},5,7,5,27"
-locations_default(#20174,#10000,5,7,5,27)
-xmllocations(#20120,#20174)
-xml_element_parent_expression(#20172,#20097,0)
-xml_element_parent_expression(#20169,#20097,1)
-xml_element_parent_expression(#20166,#20097,2)
-#20175=*
-exprs(#20175,78,#20085,0,"MyComponent")
-hasLocation(#20175,#20063)
-enclosing_stmt(#20175,#20085)
-expr_containers(#20175,#20001)
-literals("MyComponent","MyComponent",#20175)
-decl(#20175,#20075)
-typedecl(#20175,#20076)
-#20176=*
-scopes(#20176,10)
-scopenodes(#20085,#20176)
-scopenesting(#20176,#20071)
+#20168=*
+xmlElements(#20168,"foo",#10000,5,#10000)
+#20169=@"loc,{#10000},7,2,7,27"
+locations_default(#20169,#10000,7,2,7,27)
+xmllocations(#20168,#20169)
+xmlAttrs(#20159,#20168,"[baz]","expr?.bar",0,#10000)
+#20170=@"loc,{#10000},7,7,7,24"
+locations_default(#20170,#10000,7,7,7,24)
+xmllocations(#20159,#20170)
+#20171=*
+xmlElements(#20171,"foo",#10000,3,#10000)
+#20172=@"loc,{#10000},6,2,6,23"
+locations_default(#20172,#10000,6,2,6,23)
+xmllocations(#20171,#20172)
+xmlAttrs(#20138,#20171,"[baz]","expr!",0,#10000)
+#20173=@"loc,{#10000},6,7,6,20"
+locations_default(#20173,#10000,6,7,6,20)
+xmllocations(#20138,#20173)
+#20174=*
+xmlElements(#20174,"foo",#10000,1,#10000)
+#20175=@"loc,{#10000},5,2,5,29"
+locations_default(#20175,#10000,5,2,5,29)
+xmllocations(#20174,#20175)
+xmlAttrs(#20120,#20174,"[prop]","expr + expr",0,#10000)
+#20176=@"loc,{#10000},5,7,5,27"
+locations_default(#20176,#10000,5,7,5,27)
+xmllocations(#20120,#20176)
+xml_element_parent_expression(#20174,#20097,0)
+xml_element_parent_expression(#20171,#20097,1)
+xml_element_parent_expression(#20168,#20097,2)
 #20177=*
-properties(#20177,#20085,2,0,"constructor() {}")
-#20178=@"loc,{#10000},10,26,10,25"
-locations_default(#20178,#10000,10,26,10,25)
-hasLocation(#20177,#20178)
+exprs(#20177,78,#20085,0,"MyComponent")
+hasLocation(#20177,#20063)
+enclosing_stmt(#20177,#20085)
+expr_containers(#20177,#20001)
+literals("MyComponent","MyComponent",#20177)
+decl(#20177,#20075)
+typedecl(#20177,#20076)
+#20178=*
+scopes(#20178,10)
+scopenodes(#20085,#20178)
+scopenesting(#20178,#20071)
 #20179=*
-exprs(#20179,0,#20177,0,"constructor")
-hasLocation(#20179,#20178)
-enclosing_stmt(#20179,#20085)
-expr_containers(#20179,#20001)
-literals("constructor","constructor",#20179)
-#20180=*
-exprs(#20180,9,#20177,1,"() {}")
-hasLocation(#20180,#20178)
-enclosing_stmt(#20180,#20085)
-expr_containers(#20180,#20001)
+properties(#20179,#20085,2,0,"constructor() {}")
+#20180=@"loc,{#10000},10,26,10,25"
+locations_default(#20180,#10000,10,26,10,25)
+hasLocation(#20179,#20180)
 #20181=*
-scopes(#20181,1)
-scopenodes(#20180,#20181)
-scopenesting(#20181,#20176)
-#20182=@"var;{arguments};{#20181}"
-variables(#20182,"arguments",#20181)
-is_arguments_object(#20182)
+exprs(#20181,0,#20179,0,"constructor")
+hasLocation(#20181,#20180)
+enclosing_stmt(#20181,#20085)
+expr_containers(#20181,#20001)
+literals("constructor","constructor",#20181)
+#20182=*
+exprs(#20182,9,#20179,1,"() {}")
+hasLocation(#20182,#20180)
+enclosing_stmt(#20182,#20085)
+expr_containers(#20182,#20001)
 #20183=*
-stmts(#20183,1,#20180,-2,"{}")
-hasLocation(#20183,#20178)
-stmt_containers(#20183,#20180)
-is_method(#20177)
-#20184=*
-entry_cfg_node(#20184,#20001)
-#20185=@"loc,{#10000},1,1,1,0"
-locations_default(#20185,#10000,1,1,1,0)
-hasLocation(#20184,#20185)
+scopes(#20183,1)
+scopenodes(#20182,#20183)
+scopenesting(#20183,#20178)
+#20184=@"var;{arguments};{#20183}"
+variables(#20184,"arguments",#20183)
+is_arguments_object(#20184)
+#20185=*
+stmts(#20185,1,#20182,-2,"{}")
+hasLocation(#20185,#20180)
+stmt_containers(#20185,#20182)
+is_method(#20179)
 #20186=*
-exit_cfg_node(#20186,#20001)
-hasLocation(#20186,#20069)
-successor(#20084,#20175)
-successor(#20180,#20177)
-#20187=*
-entry_cfg_node(#20187,#20180)
-hasLocation(#20187,#20178)
+entry_cfg_node(#20186,#20001)
+#20187=@"loc,{#10000},1,1,1,0"
+locations_default(#20187,#10000,1,1,1,0)
+hasLocation(#20186,#20187)
 #20188=*
-exit_cfg_node(#20188,#20180)
-hasLocation(#20188,#20178)
-successor(#20183,#20188)
-successor(#20187,#20183)
-successor(#20179,#20180)
-successor(#20177,#20085)
-successor(#20175,#20179)
+exit_cfg_node(#20188,#20001)
+hasLocation(#20188,#20069)
+successor(#20084,#20177)
+successor(#20182,#20179)
+#20189=*
+entry_cfg_node(#20189,#20182)
+hasLocation(#20189,#20180)
+#20190=*
+exit_cfg_node(#20190,#20182)
+hasLocation(#20190,#20180)
+successor(#20185,#20190)
+successor(#20189,#20185)
+successor(#20181,#20182)
+successor(#20179,#20085)
+successor(#20177,#20181)
 successor(#20092,#20096)
 successor(#20097,#20099)
 successor(#20099,#20094)
@@ -657,10 +661,10 @@ successor(#20096,#20097)
 successor(#20094,#20089)
 successor(#20091,#20092)
 successor(#20089,#20087)
-successor(#20087,#20186)
+successor(#20087,#20188)
 successor(#20085,#20091)
 successor(#20077,#20084)
 successor(#20081,#20077)
-successor(#20184,#20081)
+successor(#20186,#20081)
 numlines(#10000,10,9,0)
 filetype(#10000,"javascript")
diff --git a/javascript/extractor/tests/node/output/trap/tst.html.trap b/javascript/extractor/tests/node/output/trap/tst.html.trap
index 4f02f161096..a647c518a44 100644
--- a/javascript/extractor/tests/node/output/trap/tst.html.trap
+++ b/javascript/extractor/tests/node/output/trap/tst.html.trap
@@ -87,27 +87,28 @@ successor(#20020,#20021)
 successor(#20018,#20024)
 successor(#20022,#20017)
 #20025=*
-xmlElements(#20025,"html",#10000,0,#10000)
-#20026=@"loc,{#10000},1,1,8,7"
-locations_default(#20026,#10000,1,1,8,7)
-xmllocations(#20025,#20026)
-#20027=*
-xmlElements(#20027,"body",#20025,1,#10000)
-#20028=@"loc,{#10000},5,1,7,7"
-locations_default(#20028,#10000,5,1,7,7)
-xmllocations(#20027,#20028)
-#20029=*
-xmlElements(#20029,"a",#20027,0,#10000)
-#20030=@"loc,{#10000},6,1,6,29"
-locations_default(#20030,#10000,6,1,6,29)
-xmllocations(#20029,#20030)
-#20031=*
-xmlAttrs(#20031,#20029,"onclick","var x = 42;",0,#10000)
+toplevel_parent_xml_node(#20001,#20025)
+#20026=*
+xmlElements(#20026,"html",#10000,0,#10000)
+#20027=@"loc,{#10000},1,1,8,7"
+locations_default(#20027,#10000,1,1,8,7)
+xmllocations(#20026,#20027)
+#20028=*
+xmlElements(#20028,"body",#20026,1,#10000)
+#20029=@"loc,{#10000},5,1,7,7"
+locations_default(#20029,#10000,5,1,7,7)
+xmllocations(#20028,#20029)
+#20030=*
+xmlElements(#20030,"a",#20028,0,#10000)
+#20031=@"loc,{#10000},6,1,6,29"
+locations_default(#20031,#10000,6,1,6,29)
+xmllocations(#20030,#20031)
+xmlAttrs(#20025,#20030,"onclick","var x = 42;",0,#10000)
 #20032=@"loc,{#10000},6,4,6,24"
 locations_default(#20032,#10000,6,4,6,24)
-xmllocations(#20031,#20032)
+xmllocations(#20025,#20032)
 #20033=*
-xmlElements(#20033,"head",#20025,0,#10000)
+xmlElements(#20033,"head",#20026,0,#10000)
 #20034=@"loc,{#10000},2,1,4,7"
 locations_default(#20034,#10000,2,1,4,7)
 xmllocations(#20033,#20034)
diff --git a/javascript/extractor/tests/shebang/output/trap/tst.html.trap b/javascript/extractor/tests/shebang/output/trap/tst.html.trap
index c4e88d8725f..4c153f4d397 100644
--- a/javascript/extractor/tests/shebang/output/trap/tst.html.trap
+++ b/javascript/extractor/tests/shebang/output/trap/tst.html.trap
@@ -44,24 +44,25 @@ locations_default(#20012,#10000,6,1,6,8)
 hasLocation(#20011,#20012)
 numlines(#20001,4,0,0)
 #20013=*
-xmlElements(#20013,"html",#10000,0,#10000)
-#20014=@"loc,{#10000},1,1,10,7"
-locations_default(#20014,#10000,1,1,10,7)
-xmllocations(#20013,#20014)
-#20015=*
-xmlElements(#20015,"body",#20013,1,#10000)
-#20016=@"loc,{#10000},8,5,9,11"
-locations_default(#20016,#10000,8,5,9,11)
-xmllocations(#20015,#20016)
-#20017=*
-xmlElements(#20017,"head",#20013,0,#10000)
-#20018=@"loc,{#10000},2,5,7,11"
-locations_default(#20018,#10000,2,5,7,11)
-xmllocations(#20017,#20018)
-#20019=*
-xmlElements(#20019,"script",#20017,0,#10000)
+toplevel_parent_xml_node(#20001,#20013)
+#20014=*
+xmlElements(#20014,"html",#10000,0,#10000)
+#20015=@"loc,{#10000},1,1,10,7"
+locations_default(#20015,#10000,1,1,10,7)
+xmllocations(#20014,#20015)
+#20016=*
+xmlElements(#20016,"body",#20014,1,#10000)
+#20017=@"loc,{#10000},8,5,9,11"
+locations_default(#20017,#10000,8,5,9,11)
+xmllocations(#20016,#20017)
+#20018=*
+xmlElements(#20018,"head",#20014,0,#10000)
+#20019=@"loc,{#10000},2,5,7,11"
+locations_default(#20019,#10000,2,5,7,11)
+xmllocations(#20018,#20019)
+xmlElements(#20013,"script",#20018,0,#10000)
 #20020=@"loc,{#10000},3,9,6,17"
 locations_default(#20020,#10000,3,9,6,17)
-xmllocations(#20019,#20020)
+xmllocations(#20013,#20020)
 numlines(#10000,10,0,0)
 filetype(#10000,"html")

From fbb5d1426332948663fd2e79e0126b676fd713e0 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 15 Jan 2021 14:54:12 +0000
Subject: [PATCH 191/343] JS: Update angular test output

---
 .../ql/test/library-tests/frameworks/Angular2/test.expected      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index 978d419086c..c63ccd8d624 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -23,6 +23,7 @@ pipeClassRef
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:6:19:6:26 | testPipe |
 taintFlow
 | inline.component.ts:15:22:15:29 | source() | sink.component.ts:27:48:27:57 | this.sink7 |
+| source.component.ts:14:22:14:29 | source() | TestPipe.ts:6:31:6:35 | value |
 | source.component.ts:14:22:14:29 | source() | sink.component.ts:21:48:21:57 | this.sink1 |
 | source.component.ts:14:22:14:29 | source() | sink.component.ts:24:48:24:57 | this.sink4 |
 | source.component.ts:14:22:14:29 | source() | sink.component.ts:25:48:25:57 | this.sink5 |

From deca7f3cd6ea4f7829a7431983e4f0a9a7913357 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Mon, 18 Jan 2021 13:46:10 +0000
Subject: [PATCH 192/343] JS: Add change note

---
 javascript/change-notes/2021-01-18-angular-templates.md | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 javascript/change-notes/2021-01-18-angular-templates.md

diff --git a/javascript/change-notes/2021-01-18-angular-templates.md b/javascript/change-notes/2021-01-18-angular-templates.md
new file mode 100644
index 00000000000..3ec349f8d18
--- /dev/null
+++ b/javascript/change-notes/2021-01-18-angular-templates.md
@@ -0,0 +1,4 @@
+lgtm,codescanning
+* Support for Angular has improved. Angular templates are now parsed and used to
+  establish data flow between components.
+* Support for RxJS has improved. Taint is now tracked through RxJS Observable objects.

From 01900d7ca26528478560f53c07e30b0c40f67865 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 18 Jan 2021 14:47:29 +0100
Subject: [PATCH 193/343] remove false positive due to "\n" not being in the
 `relevant` relation

---
 .../semmle/javascript/security/performance/ReDoSUtil.qll    | 6 +++++-
 .../test/query-tests/Performance/ReDoS/polynomial-redos.js  | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll b/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
index 2c4295c2381..425cee3ff6f 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
@@ -905,6 +905,10 @@ private module SuffixConstruction {
     exists(ascii(result))
     or
     exists(InputSymbol s | belongsTo(s, root) | result = intersect(s, _))
+    or
+    // The characters from `hasSimpleRejectEdge`. Only `\n` is really needed (as `\n` is not in the `ascii` relation).
+    // The three chars must be kept in sync with `hasSimpleRejectEdge`.
+    result = ["|", "\n", "Z"]
   }
 
   /**
@@ -923,7 +927,7 @@ private module SuffixConstruction {
    * This predicate is used as a cheap pre-processing to speed up `hasRejectEdge`.
    */
   private predicate hasSimpleRejectEdge(State s) {
-    // The three chars were chosen arbitrarily.
+    // The three chars were chosen arbitrarily. The three chars must be kept in sync with `relevant`.
     exists(string char | char = ["|", "\n", "Z"] | not deltaClosedChar(s, char, _))
   }
 
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/polynomial-redos.js b/javascript/ql/test/query-tests/Performance/ReDoS/polynomial-redos.js
index 0e91b5a9b56..a6648c0ed65 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/polynomial-redos.js
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/polynomial-redos.js
@@ -123,4 +123,6 @@ app.use(function(req, res) {
 		result += replaced;
 		result = result.replace(/^\s+|\s+$/g, ''); // NOT OK
 	})();
+
+	tainted.match(/(https?:\/\/[^\s]+)/gm); // OK
 });

From 1b285ee792a2ab26f09ce0a5d6e039d1e882f074 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 18 Jan 2021 10:27:59 +0100
Subject: [PATCH 194/343] C#: Hardcode well-known underlying enum types

---
 .../Entities/CustomAttributeDecoder.cs           | 15 +++++++++++++++
 .../cil/attributes/attribute.expected            | 16 +++++++++-------
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/CustomAttributeDecoder.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/CustomAttributeDecoder.cs
index caf6a3287de..94d6cc0ab6d 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/CustomAttributeDecoder.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/CustomAttributeDecoder.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Collections.Generic;
 using System.Reflection.Metadata;
 
 namespace Semmle.Extraction.CIL.Entities
@@ -36,12 +37,26 @@ namespace Semmle.Extraction.CIL.Entities
             }
 
             var name = type.GetQualifiedName();
+
+            if (wellKnownEnums.TryGetValue(name, out var code))
+            {
+                cx.Cx.Extractor.Logger.Log(Util.Logging.Severity.Debug, $"Using hard coded underlying enum type for {name}");
+                return code;
+            }
+
             cx.Cx.Extractor.Logger.Log(Util.Logging.Severity.Info, $"Couldn't get underlying enum type for {name}");
 
             // We can't fall back to Int32, because the type returned here defines how many bytes are read from the
             // stream and how those bytes are interpreted.
             throw new NotImplementedException();
         }
+
         public bool IsSystemType(Type type) => type.GetQualifiedName() == "System.Type";
+
+        private static readonly Dictionary<string, PrimitiveTypeCode> wellKnownEnums = new Dictionary<string, PrimitiveTypeCode>
+        {
+            { "System.AttributeTargets", PrimitiveTypeCode.Int32 },
+            { "System.ComponentModel.EditorBrowsableState", PrimitiveTypeCode.Int32 }
+        };
     }
 }
diff --git a/csharp/ql/test/library-tests/cil/attributes/attribute.expected b/csharp/ql/test/library-tests/cil/attributes/attribute.expected
index 557b97259d2..6ec0b072ec8 100644
--- a/csharp/ql/test/library-tests/cil/attributes/attribute.expected
+++ b/csharp/ql/test/library-tests/cil/attributes/attribute.expected
@@ -406,7 +406,6 @@ attrNoArg
 | System.Resources.ResourceReader.<>c | [CompilerGeneratedAttribute(...)] |
 | System.Resources.ResourceReader.<>c__DisplayClass49_0`1 | [CompilerGeneratedAttribute(...)] |
 | System.Resources.SatelliteContractVersionAttribute.<Version>k__BackingField | [CompilerGeneratedAttribute(...)] |
-| System.Runtime.AssemblyTargetedPatchBandAttribute | [AttributeUsageAttribute(...)] |
 | System.Runtime.AssemblyTargetedPatchBandAttribute.<TargetedPatchBand>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.AccessedThroughPropertyAttribute.<PropertyName>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.AsyncMethodBuilderAttribute.<BuilderType>k__BackingField | [CompilerGeneratedAttribute(...)] |
@@ -431,7 +430,6 @@ attrNoArg
 | System.Runtime.CompilerServices.DefaultDependencyAttribute.<LoadHint>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.DependencyAttribute.<DependentAssembly>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.DependencyAttribute.<LoadHint>k__BackingField | [CompilerGeneratedAttribute(...)] |
-| System.Runtime.CompilerServices.EnumeratorCancellationAttribute | [AttributeUsageAttribute(...)] |
 | System.Runtime.CompilerServices.FixedBufferAttribute.<ElementType>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.FixedBufferAttribute.<Length>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.InternalsVisibleToAttribute.<AllInternalsVisible>k__BackingField | [CompilerGeneratedAttribute(...)] |
@@ -439,13 +437,10 @@ attrNoArg
 | System.Runtime.CompilerServices.JitHelpers | [ExtensionAttribute(...)] |
 | System.Runtime.CompilerServices.MethodImplAttribute.<Value>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.MethodImplOptions | [FlagsAttribute(...)] |
-| System.Runtime.CompilerServices.NullableAttribute | [AttributeUsageAttribute(...)] |
 | System.Runtime.CompilerServices.NullableAttribute | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.NullableAttribute | [EmbeddedAttribute(...)] |
-| System.Runtime.CompilerServices.NullableContextAttribute | [AttributeUsageAttribute(...)] |
 | System.Runtime.CompilerServices.NullableContextAttribute | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.NullableContextAttribute | [EmbeddedAttribute(...)] |
-| System.Runtime.CompilerServices.NullablePublicOnlyAttribute | [AttributeUsageAttribute(...)] |
 | System.Runtime.CompilerServices.NullablePublicOnlyAttribute | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.CompilerServices.NullablePublicOnlyAttribute | [EmbeddedAttribute(...)] |
 | System.Runtime.CompilerServices.ReferenceAssemblyAttribute.<Description>k__BackingField | [CompilerGeneratedAttribute(...)] |
@@ -463,7 +458,6 @@ attrNoArg
 | System.Runtime.CompilerServices.YieldAwaitable | [IsReadOnlyAttribute(...)] |
 | System.Runtime.CompilerServices.YieldAwaitable.YieldAwaiter | [IsReadOnlyAttribute(...)] |
 | System.Runtime.CompilerServices.YieldAwaitable.YieldAwaiter.<>c | [CompilerGeneratedAttribute(...)] |
-| System.Runtime.ConstrainedExecution.PrePrepareMethodAttribute | [AttributeUsageAttribute(...)] |
 | System.Runtime.ConstrainedExecution.ReliabilityContractAttribute.<Cer>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.ConstrainedExecution.ReliabilityContractAttribute.<ConsistencyGuarantee>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.ExceptionServices.FirstChanceExceptionEventArgs.<Exception>k__BackingField | [CompilerGeneratedAttribute(...)] |
@@ -565,7 +559,6 @@ attrNoArg
 | System.Runtime.Serialization.SerializationInfo.<IsFullTypeNameSetExplicit>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.Runtime.Serialization.StreamingContext | [IsReadOnlyAttribute(...)] |
 | System.Runtime.Serialization.StreamingContextStates | [FlagsAttribute(...)] |
-| System.Runtime.TargetedPatchingOptOutAttribute | [AttributeUsageAttribute(...)] |
 | System.Runtime.TargetedPatchingOptOutAttribute.<Reason>k__BackingField | [CompilerGeneratedAttribute(...)] |
 | System.RuntimeArgumentHandle | [IsByRefLikeAttribute(...)] |
 | System.RuntimeType.RuntimeTypeCache.Filter | [IsReadOnlyAttribute(...)] |
@@ -805,6 +798,7 @@ attrArgNamed
 | System.Reflection.ObfuscationAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Resources.NeutralResourcesLanguageAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | False |
 | System.Resources.SatelliteContractVersionAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | False |
+| System.Runtime.AssemblyTargetedPatchBandAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.CompilerServices.AsyncIteratorStateMachineAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | False |
 | System.Runtime.CompilerServices.AsyncIteratorStateMachineAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.CompilerServices.AsyncMethodBuilderAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | False |
@@ -823,6 +817,7 @@ attrArgNamed
 | System.Runtime.CompilerServices.DependencyAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | True |
 | System.Runtime.CompilerServices.DisablePrivateReflectionAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | False |
 | System.Runtime.CompilerServices.DisablePrivateReflectionAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
+| System.Runtime.CompilerServices.EnumeratorCancellationAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.CompilerServices.FixedBufferAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.CompilerServices.IndexerNameAttribute | [AttributeUsageAttribute(...)] | Inherited | True |
 | System.Runtime.CompilerServices.InternalsVisibleToAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | True |
@@ -850,6 +845,7 @@ attrArgNamed
 | System.Runtime.CompilerServices.TypeForwardedFromAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.CompilerServices.TypeForwardedToAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | True |
 | System.Runtime.CompilerServices.TypeForwardedToAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
+| System.Runtime.ConstrainedExecution.PrePrepareMethodAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.ConstrainedExecution.ReliabilityContractAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.ExceptionServices.HandleProcessCorruptedStateExceptionsAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | False |
 | System.Runtime.ExceptionServices.HandleProcessCorruptedStateExceptionsAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
@@ -887,6 +883,8 @@ attrArgNamed
 | System.Runtime.Serialization.OnSerializedAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.Serialization.OnSerializingAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.Serialization.OptionalFieldAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
+| System.Runtime.TargetedPatchingOptOutAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | False |
+| System.Runtime.TargetedPatchingOptOutAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.Versioning.NonVersionableAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | False |
 | System.Runtime.Versioning.NonVersionableAttribute | [AttributeUsageAttribute(...)] | Inherited | False |
 | System.Runtime.Versioning.TargetFrameworkAttribute | [AttributeUsageAttribute(...)] | AllowMultiple | False |
@@ -1910,6 +1908,7 @@ attrArgPositional
 | System.Runtime.AmbiguousImplementationException | [NullableAttribute(...)] | 0 | 0 |
 | System.Runtime.AmbiguousImplementationException | [NullableContextAttribute(...)] | 0 | 2 |
 | System.Runtime.AmbiguousImplementationException | [TypeForwardedFromAttribute(...)] | 0 | System.Runtime, Version=4.2.1.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a |
+| System.Runtime.AssemblyTargetedPatchBandAttribute | [AttributeUsageAttribute(...)] | 0 | 1 |
 | System.Runtime.AssemblyTargetedPatchBandAttribute | [NullableAttribute(...)] | 0 | 0 |
 | System.Runtime.AssemblyTargetedPatchBandAttribute | [NullableContextAttribute(...)] | 0 | 1 |
 | System.Runtime.CompilerServices.AccessedThroughPropertyAttribute | [AttributeUsageAttribute(...)] | 0 | 256 |
@@ -1959,6 +1958,7 @@ attrArgPositional
 | System.Runtime.CompilerServices.DependencyAttribute | [NullableAttribute(...)] | 0 | 0 |
 | System.Runtime.CompilerServices.DependencyAttribute | [NullableContextAttribute(...)] | 0 | 1 |
 | System.Runtime.CompilerServices.DisablePrivateReflectionAttribute | [AttributeUsageAttribute(...)] | 0 | 1 |
+| System.Runtime.CompilerServices.EnumeratorCancellationAttribute | [AttributeUsageAttribute(...)] | 0 | 2048 |
 | System.Runtime.CompilerServices.ExtensionAttribute | [AttributeUsageAttribute(...)] | 0 | 69 |
 | System.Runtime.CompilerServices.FixedAddressValueTypeAttribute | [AttributeUsageAttribute(...)] | 0 | 256 |
 | System.Runtime.CompilerServices.FixedBufferAttribute | [AttributeUsageAttribute(...)] | 0 | 256 |
@@ -2014,6 +2014,7 @@ attrArgPositional
 | System.Runtime.CompilerServices.TypeForwardedToAttribute | [NullableAttribute(...)] | 0 | 0 |
 | System.Runtime.CompilerServices.TypeForwardedToAttribute | [NullableContextAttribute(...)] | 0 | 1 |
 | System.Runtime.CompilerServices.UnsafeValueTypeAttribute | [AttributeUsageAttribute(...)] | 0 | 8 |
+| System.Runtime.ConstrainedExecution.PrePrepareMethodAttribute | [AttributeUsageAttribute(...)] | 0 | 96 |
 | System.Runtime.ConstrainedExecution.ReliabilityContractAttribute | [AttributeUsageAttribute(...)] | 0 | 1133 |
 | System.Runtime.ExceptionServices.ExceptionDispatchInfo | [NullableAttribute(...)] | 0 | 0 |
 | System.Runtime.ExceptionServices.ExceptionDispatchInfo | [NullableContextAttribute(...)] | 0 | 1 |
@@ -2246,6 +2247,7 @@ attrArgPositional
 | System.Runtime.Serialization.SerializationInfoEnumerator | [NullableContextAttribute(...)] | 0 | 1 |
 | System.Runtime.Serialization.StreamingContext | [NullableAttribute(...)] | 0 | 0 |
 | System.Runtime.Serialization.StreamingContext | [NullableContextAttribute(...)] | 0 | 2 |
+| System.Runtime.TargetedPatchingOptOutAttribute | [AttributeUsageAttribute(...)] | 0 | 96 |
 | System.Runtime.TargetedPatchingOptOutAttribute | [NullableAttribute(...)] | 0 | 0 |
 | System.Runtime.TargetedPatchingOptOutAttribute | [NullableContextAttribute(...)] | 0 | 1 |
 | System.Runtime.Versioning.NonVersionableAttribute | [AttributeUsageAttribute(...)] | 0 | 108 |

From d05d4e22ad20e190ba12959be757f9355ef7e390 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 18 Jan 2021 14:18:23 +0100
Subject: [PATCH 195/343] C#: Fix namespace extraction of NoMetadataHandleType

---
 .../Entities/NoMetadataHandleType.cs          | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/NoMetadataHandleType.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/NoMetadataHandleType.cs
index 54d2403e1e1..fde969d12b9 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/NoMetadataHandleType.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/NoMetadataHandleType.cs
@@ -3,7 +3,6 @@ using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using System.Reflection;
-using Semmle.Util;
 
 namespace Semmle.Extraction.CIL.Entities
 {
@@ -21,6 +20,7 @@ namespace Semmle.Extraction.CIL.Entities
         private readonly Type[]? thisTypeArguments;
         private readonly Type unboundGenericType;
         private readonly Type? containingType;
+        private readonly Namespace? containingNamespace;
 
         private readonly NamedTypeIdWriter idWriter;
 
@@ -53,13 +53,20 @@ namespace Semmle.Extraction.CIL.Entities
                 ? null
                 : new NoMetadataHandleType(Cx, containerName);
 
+            containingNamespace = isContainerNamespace
+                ? containerName == Cx.GlobalNamespace.Name
+                    ? Cx.GlobalNamespace
+                    : containerName == Cx.SystemNamespace.Name
+                        ? Cx.SystemNamespace
+                        : new Namespace(Cx, containerName)
+                : null;
+
             Populate();
         }
 
         private void Populate()
         {
-            if (isContainerNamespace &&
-                !ContainingNamespace!.IsGlobalNamespace)
+            if (isContainerNamespace)
             {
                 Cx.Populate(ContainingNamespace);
             }
@@ -100,11 +107,7 @@ namespace Semmle.Extraction.CIL.Entities
 
         public override string Name => GenericsHelper.GetNonGenericName(name);
 
-        public override Namespace? ContainingNamespace => isContainerNamespace
-            ? containerName == Cx.GlobalNamespace.Name
-                ? Cx.GlobalNamespace
-                : new Namespace(Cx, containerName)
-            : null;
+        public override Namespace? ContainingNamespace => containingNamespace;
 
         public override Type? ContainingType => containingType;
 

From 8e5557eca37d9f28c4cddadca8d4a0478eaa5984 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 18 Jan 2021 16:15:19 +0100
Subject: [PATCH 196/343] Python: Avoid duplicated route-setup in django

When using `django.conf.urls.url` with Django 2+
---
 .../ql/src/semmle/python/frameworks/Django.qll  | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index 674aedec566..b7f2a0e12af 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1872,7 +1872,22 @@ private module Django {
   private class DjangoUrlsRePathCall extends DjangoRegexRouteSetup {
     override CallNode node;
 
-    DjangoUrlsRePathCall() { node.getFunction() = django::urls::re_path().asCfgNode() }
+    DjangoUrlsRePathCall() {
+      node.getFunction() = django::urls::re_path().asCfgNode() and
+      // `django.conf.urls.url` (which we support directly with
+      // `DjangoConfUrlsUrlCall`), is implemented in Django 2+ as backward compatibility
+      // using `django.urls.re_path`. See
+      // https://github.com/django/django/blob/stable/3.2.x/django/conf/urls/__init__.py#L22
+      // Since we're still installing dependencies and analyzing their source code,
+      // without explicitly filtering out this call, we would be double-counting such
+      // route-setups :( One practical negative side effect of double-counting it, is
+      // that since we can't figure out the URL, we mark ANY parameter as being a
+      // routed-parameter, which can lead to FPs.
+      not exists(Module mod |
+        mod.getName() = "django.conf.urls.__init__" and
+        node.getEnclosingModule() = mod
+      )
+    }
 
     override DataFlow::Node getUrlPatternArg() {
       result.asCfgNode() = [node.getArg(0), node.getArgByName("route")]

From e9aa63b67094cc8a4fe53033b8b63380397b67e1 Mon Sep 17 00:00:00 2001
From: Marcono1234 <Marcono1234@users.noreply.github.com>
Date: Mon, 18 Jan 2021 16:18:45 +0100
Subject: [PATCH 197/343] Fix broken links to QLDoc specification

---
 docs/qldoc-style-guide.md          | 2 +-
 docs/query-metadata-style-guide.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/qldoc-style-guide.md b/docs/qldoc-style-guide.md
index 79871ae8d9f..fde4d3ea2f8 100644
--- a/docs/qldoc-style-guide.md
+++ b/docs/qldoc-style-guide.md
@@ -6,7 +6,7 @@ Valid QL comments are known as QLDoc. This document describes the recommended st
 
 ### General requirements
 
-1. Documentation must adhere to the [QLDoc specification](https://help.semmle.com/QL/ql-handbook/qldoc.html).
+1. Documentation must adhere to the [QLDoc specification](https://codeql.github.com/docs/ql-language-reference/ql-language-specification/#qldoc).
 1. Documentation comments should be appropriate for users of the code.
 1. Documentation for maintainers of the code must use normal comments.
 1. Use `/** ... */` for documentation, even for single line comments.
diff --git a/docs/query-metadata-style-guide.md b/docs/query-metadata-style-guide.md
index e029339c1af..21e5897e243 100644
--- a/docs/query-metadata-style-guide.md
+++ b/docs/query-metadata-style-guide.md
@@ -26,7 +26,7 @@ For examples of query files for the languages supported by CodeQL, visit the fol
 
 ## Metadata area
 
-Query file metadata contains important information that defines the identifier and purpose of the query. The metadata is included as the content of a valid [QLDoc](https://help.semmle.com/QL/ql-handbook/qldoc.html) comment, on lines with leading whitespace followed by `*`, between an initial `/**` and a trailing `*/`. For example:
+Query file metadata contains important information that defines the identifier and purpose of the query. The metadata is included as the content of a valid [QLDoc](https://codeql.github.com/docs/ql-language-reference/ql-language-specification/#qldoc) comment, on lines with leading whitespace followed by `*`, between an initial `/**` and a trailing `*/`. For example:
 
 ```
 /**

From 703336a77fc5b639c2cf11d5c8416de737b27f5f Mon Sep 17 00:00:00 2001
From: Marcono1234 <Marcono1234@users.noreply.github.com>
Date: Mon, 18 Jan 2021 16:44:53 +0100
Subject: [PATCH 198/343] Add ArrayInit.getSize(), improve documentation

---
 java/ql/src/semmle/code/java/Expr.qll | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/java/ql/src/semmle/code/java/Expr.qll b/java/ql/src/semmle/code/java/Expr.qll
index 50f4a210d60..730c8c6c354 100755
--- a/java/ql/src/semmle/code/java/Expr.qll
+++ b/java/ql/src/semmle/code/java/Expr.qll
@@ -438,7 +438,7 @@ class ArrayCreationExpr extends Expr, @arraycreationexpr {
     result.getIndex() = index
   }
 
-  /** Gets the initializer of this array creation expression. */
+  /** Gets the initializer of this array creation expression, if any. */
   ArrayInit getInit() { result.isNthChildOf(this, -2) }
 
   /**
@@ -446,7 +446,7 @@ class ArrayCreationExpr extends Expr, @arraycreationexpr {
    */
   int getFirstDimensionSize() {
     if exists(getInit())
-    then result = count(getInit().getAnInit())
+    then result = getInit().getSize()
     else result = getDimension(0).(CompileTimeConstantExpr).getIntValue()
   }
 
@@ -456,7 +456,17 @@ class ArrayCreationExpr extends Expr, @arraycreationexpr {
   override string getAPrimaryQlClass() { result = "ArrayCreationExpr" }
 }
 
-/** An array initializer occurs in an array creation expression. */
+/**
+ * An array initializer consisting of an opening and closing curly bracket and
+ * optionally containing expressions (which themselves can be array initializers)
+ * representing the elements of the array. For example: `{ 'a', 'b' }`.
+ *
+ * This expression type matches array initializers representing the values for
+ * annotation elements as well, despite the Java Language Specification considering
+ * them a separate type, *ElementValueArrayInitializer*. It does however not match
+ * values for an array annotation element which consist of a single element
+ * without enclosing curly brackets (as per JLS).
+ */
 class ArrayInit extends Expr, @arrayinit {
   /**
    * An expression occurring in this initializer.
@@ -469,6 +479,12 @@ class ArrayInit extends Expr, @arrayinit {
   /** Gets the initializer occurring at the specified (zero-based) position. */
   Expr getInit(int index) { result = this.getAnInit() and result.getIndex() = index }
 
+  /**
+   * Gets the number of expressions in this initializer, i.e. the size the
+   * created array will have.
+   */
+  int getSize() { result = count(getAnInit()) }
+
   /** Gets a printable representation of this expression. */
   override string toString() { result = "{...}" }
 

From dde8d320f364aab86993b3b6c51ebe307b1b463f Mon Sep 17 00:00:00 2001
From: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
Date: Tue, 19 Jan 2021 08:24:24 +0100
Subject: [PATCH 199/343] Apply suggestions from code review

Minor qldoc fixes.
---
 java/ql/src/semmle/code/java/Expr.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/semmle/code/java/Expr.qll b/java/ql/src/semmle/code/java/Expr.qll
index 730c8c6c354..aef353088be 100755
--- a/java/ql/src/semmle/code/java/Expr.qll
+++ b/java/ql/src/semmle/code/java/Expr.qll
@@ -463,7 +463,7 @@ class ArrayCreationExpr extends Expr, @arraycreationexpr {
  *
  * This expression type matches array initializers representing the values for
  * annotation elements as well, despite the Java Language Specification considering
- * them a separate type, *ElementValueArrayInitializer*. It does however not match
+ * them a separate type, `ElementValueArrayInitializer`. It does however not match
  * values for an array annotation element which consist of a single element
  * without enclosing curly brackets (as per JLS).
  */
@@ -480,7 +480,7 @@ class ArrayInit extends Expr, @arrayinit {
   Expr getInit(int index) { result = this.getAnInit() and result.getIndex() = index }
 
   /**
-   * Gets the number of expressions in this initializer, i.e. the size the
+   * Gets the number of expressions in this initializer, that is, the size the
    * created array will have.
    */
   int getSize() { result = count(getAnInit()) }

From 3015dcd3109563a0ffb415f57ca7fbcc183d5a6e Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Wed, 13 Jan 2021 15:46:34 +0100
Subject: [PATCH 200/343] JS: reformulate js/server-crash. Support promises and
 shorter paths.

---
 .../ql/src/Security/CWE-730/ServerCrash.ql    | 278 +++++++++---------
 .../Security/CWE-730/ServerCrash.expected     | 107 ++++---
 .../Security/CWE-730/server-crash.js          | 108 ++++++-
 3 files changed, 302 insertions(+), 191 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-730/ServerCrash.ql b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
index 68607db011f..b81126b33cd 100644
--- a/javascript/ql/src/Security/CWE-730/ServerCrash.ql
+++ b/javascript/ql/src/Security/CWE-730/ServerCrash.ql
@@ -3,7 +3,7 @@
  * @description A server that can be forced to crash may be vulnerable to denial-of-service
  *              attacks.
  * @kind path-problem
- * @problem.severity error
+ * @problem.severity warning
  * @precision high
  * @id js/server-crash
  * @tags security
@@ -13,144 +13,114 @@
 import javascript
 
 /**
- * A call that appears to be asynchronous (heuristic).
+ * Gets a function that indirectly invokes an asynchronous callback through `async`, where the callback throws an uncaught exception at `thrower`.
  */
-class AsyncCall extends DataFlow::CallNode {
-  DataFlow::FunctionNode callback;
+Function invokesCallbackThatThrowsUncaughtException(
+  AsyncSentinelCall async, LikelyExceptionThrower thrower
+) {
+  async.getAsyncCallee() = throwsUncaughtExceptionInAsyncContext(thrower) and
+  result = async.getEnclosingFunction()
+  or
+  exists(DataFlow::InvokeNode invk, Function fun |
+    fun = invokesCallbackThatThrowsUncaughtException(async, thrower) and
+    // purposely not checking for `getEnclosingTryCatchStmt`. An async callback called from inside a try-catch can still crash the server.
+    result = invk.getEnclosingFunction()
+  |
+    invk.getACallee() = fun
+    or
+    // traverse a slightly extended call graph to get additional TPs
+    invk.(AsyncSentinelCall).getAsyncCallee() = fun
+  )
+}
 
-  AsyncCall() {
-    callback.flowsTo(getLastArgument()) and
-    callback.getParameter(0).getName() = ["e", "err", "error"] and
-    callback.getNumParameter() = 2 and
-    not exists(callback.getAReturn())
+/**
+ * Gets a callee of an invocation `invk` that is not guarded by a try statement.
+ */
+Function getUncaughtExceptionRethrowerCallee(DataFlow::InvokeNode invk) {
+  not exists(invk.asExpr().getEnclosingStmt().getEnclosingTryCatchStmt()) and
+  result = invk.getACallee()
+}
+
+/**
+ * Holds if `thrower` is not guarded by a try statement.
+ */
+predicate isUncaughtExceptionThrower(LikelyExceptionThrower thrower) {
+  not exists([thrower.(Expr).getEnclosingStmt(), thrower.(Stmt)].getEnclosingTryCatchStmt())
+}
+
+/**
+ * Gets a function that may throw an uncaught exception originating at `thrower`, which then may escape in an asynchronous calling context.
+ */
+Function throwsUncaughtExceptionInAsyncContext(LikelyExceptionThrower thrower) {
+  (
+    isUncaughtExceptionThrower(thrower) and
+    result = thrower.getContainer()
+    or
+    exists(DataFlow::InvokeNode invk |
+      getUncaughtExceptionRethrowerCallee(invk) = throwsUncaughtExceptionInAsyncContext(thrower) and
+      result = invk.getEnclosingFunction()
+    )
+  ) and
+  // Anti-case:
+  // An exception from an `async` function results in a rejected promise.
+  // Unhandled promises requires `node --unhandled-rejections=strict ...` to terminate the process
+  // without that flag, the DEP0018 deprecation warning is printed instead (node.js version 14 and below)
+  not result.isAsync() and
+  // pruning optimization since this predicate always is related to `invokesCallbackThatThrowsUncaughtException`
+  result = reachableFromAsyncCallback()
+}
+
+/**
+ * Holds if `result` is reachable from a callback that is invoked asynchronously.
+ */
+Function reachableFromAsyncCallback() {
+  result instanceof AsyncCallback
+  or
+  exists(DataFlow::InvokeNode invk |
+    invk.getEnclosingFunction() = reachableFromAsyncCallback() and
+    result = invk.getACallee()
+  )
+}
+
+/**
+ * The main predicate of this query: used for both result display and path computation.
+ */
+predicate main(
+  HTTP::RouteHandler rh, AsyncSentinelCall async, AsyncCallback cb, LikelyExceptionThrower thrower
+) {
+  async.getAsyncCallee() = cb and
+  rh.getAstNode() = invokesCallbackThatThrowsUncaughtException(async, thrower)
+}
+
+/**
+ * A call that may cause a function to be invoked in an asynchronous context outside of the visible source code.
+ */
+class AsyncSentinelCall extends DataFlow::CallNode {
+  Function asyncCallee;
+
+  AsyncSentinelCall() {
+    exists(DataFlow::FunctionNode node | node.getAstNode() = asyncCallee |
+      // manual models
+      exists(string memberName |
+        not "Sync" = memberName.suffix(memberName.length() - 4) and
+        this = NodeJSLib::FS::moduleMember(memberName).getACall() and
+        node = this.getCallback([1 .. 2])
+      )
+      // (add additional cases here to improve the query)
+    )
   }
 
   /**
-   * Gets the callback that is invoked asynchronously.
+   * Gets the callee that is invoked in an asynchronous context.
    */
-  DataFlow::FunctionNode getCallback() { result = callback }
+  Function getAsyncCallee() { result = asyncCallee }
 }
 
 /**
- * Gets a function that is invoked as a consequence of invoking a route handler `rh`.
+ * A callback provided to an asynchronous call (heuristic).
  */
-Function invokedByRouteHandler(HTTP::RouteHandler rh) {
-  rh = result.flow()
-  or
-  // follow the immediate call graph
-  exists(DataFlow::InvokeNode invk |
-    result = invk.getACallee() and
-    // purposely not checking for `getEnclosingTryCatchStmt`. An async callback called from inside a try-catch can still crash the server.
-    invk.getEnclosingFunction() = invokedByRouteHandler(rh)
-  )
-  // if new edges are added here, the `edges` predicate should be updated accordingly
-}
-
-/**
- * A callback provided to an asynchronous call.
- */
-class AsyncCallback extends DataFlow::FunctionNode {
-  AsyncCallback() { this = any(AsyncCall c).getCallback() }
-}
-
-/**
- * Gets a function that is in a call stack that starts at an asynchronous `callback`, calls in the call stack occur outside of `try` blocks.
- */
-Function inUnguardedAsyncCallStack(AsyncCallback callback) {
-  callback = result.flow()
-  or
-  exists(DataFlow::InvokeNode invk |
-    result = invk.getACallee() and
-    not exists(invk.asExpr().getEnclosingStmt().getEnclosingTryCatchStmt()) and
-    invk.getEnclosingFunction() = inUnguardedAsyncCallStack(callback)
-  )
-}
-
-/**
- * Gets a function that is invoked by `asyncCallback` without any try-block wrapping, `asyncCallback` is in turn is called indirectly by `routeHandler`.
- *
- * If the result throws an excection, the server of `routeHandler` will crash.
- */
-Function getAPotentialServerCrasher(
-  HTTP::RouteHandler routeHandler, AsyncCall asyncCall, AsyncCallback asyncCallback
-) {
-  // the route handler transitively calls an async function
-  asyncCall.getEnclosingFunction() = invokedByRouteHandler(routeHandler) and
-  asyncCallback = asyncCall.getCallback() and
-  // the async function transitively calls a function that may throw an exception out of the the async function
-  result = inUnguardedAsyncCallStack(asyncCallback)
-}
-
-/**
- * Gets a node that is likely to throw an uncaught exception in `fun`.
- */
-LikelyExceptionThrower getALikelyUncaughtExceptionThrower(Function fun) {
-  result.getContainer() = fun and
-  not exists([result.(Expr).getEnclosingStmt(), result.(Stmt)].getEnclosingTryCatchStmt())
-}
-
-/**
- * Edges that builds an explanatory graph that follows the mental model of how the the exception flows.
- *
- * - step 1. exception is thrown
- * - step 2. exception exits the enclosing function
- * - step 3. exception follows the call graph backwards until an async callee is encountered
- * - step 4. (at this point, the program crashes)
- * - step 5. if the program had not crashed, the exception would conceptually follow the call graph backwards to a route handler
- */
-query predicate edges(ASTNode pred, ASTNode succ) {
-  nodes(pred) and
-  nodes(succ) and
-  (
-    // the first step from the alert location to the enclosing function
-    pred = getALikelyUncaughtExceptionThrower(_) and
-    succ = pred.getContainer()
-    or
-    // ordinary flow graph
-    exists(DataFlow::InvokeNode invoke, Function f |
-      invoke.getACallee() = f and
-      succ = invoke.getAstNode() and
-      pred = f
-      or
-      invoke.getContainer() = f and
-      succ = f and
-      pred = invoke.getAstNode()
-    )
-    or
-    // the async step
-    exists(DataFlow::Node predNode, DataFlow::Node succNode |
-      exists(getAPotentialServerCrasher(_, predNode, succNode)) and
-      predNode.getAstNode() = succ and
-      succNode.getAstNode() = pred
-    )
-  )
-}
-
-/**
- * Nodes for building an explanatory graph that follows the mental model of how the the exception flows.
- */
-query predicate nodes(ASTNode node) {
-  exists(HTTP::RouteHandler rh, Function fun |
-    main(rh, _, _) and
-    fun = invokedByRouteHandler(rh)
-  |
-    node = any(DataFlow::InvokeNode invk | invk.getACallee() = fun).getAstNode() or
-    node = fun
-  )
-  or
-  exists(AsyncCallback cb, Function fun |
-    main(_, cb, _) and
-    fun = inUnguardedAsyncCallStack(cb)
-  |
-    node = any(DataFlow::InvokeNode invk | invk.getACallee() = fun).getAstNode() or
-    node = fun
-  )
-  or
-  main(_, _, node)
-}
-
-predicate main(HTTP::RouteHandler rh, AsyncCallback asyncCallback, ExprOrStmt crasher) {
-  crasher = getALikelyUncaughtExceptionThrower(getAPotentialServerCrasher(rh, _, asyncCallback))
+class AsyncCallback extends Function {
+  AsyncCallback() { any(AsyncSentinelCall c).getAsyncCallee() = this }
 }
 
 /**
@@ -172,8 +142,48 @@ class CompilerConfusingExceptionThrower extends LikelyExceptionThrower {
   CompilerConfusingExceptionThrower() { none() }
 }
 
-from HTTP::RouteHandler rh, AsyncCallback asyncCallback, ExprOrStmt crasher
-where main(rh, asyncCallback, crasher)
-select crasher, crasher, rh.getAstNode(),
-  "When an exception is thrown here and later escapes at $@, the server of $@ will crash.",
-  asyncCallback, "this asynchronous callback", rh, "this route handler"
+/**
+ * Edges that builds an explanatory graph that follows the mental model of how the the exception flows.
+ *
+ * - step 1. exception is thrown
+ * - step 2. exception escapes the enclosing function
+ * - step 3. exception follows the call graph backwards until an async callee is encountered
+ * - step 4. (at this point, the program crashes)
+ */
+query predicate edges(ASTNode pred, ASTNode succ) {
+  exists(LikelyExceptionThrower thrower | main(_, _, _, thrower) |
+    pred = thrower and
+    succ = thrower.getContainer()
+    or
+    exists(DataFlow::InvokeNode invk, Function fun |
+      fun = throwsUncaughtExceptionInAsyncContext(thrower)
+    |
+      succ = invk.getAstNode() and
+      pred = invk.getACallee() and
+      pred = fun
+      or
+      succ = fun and
+      succ = invk.getContainer() and
+      pred = invk.getAstNode()
+    )
+  )
+}
+
+/**
+ * A node in the `edge/2` relation above.
+ */
+query predicate nodes(ASTNode node) {
+  edges(node, _) or
+  edges(_, node)
+}
+
+from
+  HTTP::RouteHandler rh, AsyncSentinelCall async, DataFlow::Node callbackArg, AsyncCallback cb,
+  ExprOrStmt crasher
+where
+  main(rh, async, cb, crasher) and
+  callbackArg.getALocalSource().getAstNode() = cb and
+  async.getAnArgument() = callbackArg
+select crasher, crasher, cb,
+  "The server of $@ will terminate when an uncaught exception from here escapes this $@", rh,
+  "this route handler", callbackArg, "asynchronous callback"
diff --git a/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected b/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected
index acee72436fc..ef20a62aa9d 100644
--- a/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-730/ServerCrash.expected
@@ -1,48 +1,65 @@
 edges
-| server-crash.js:5:1:9:1 | functio ...   });\\n} | server-crash.js:49:3:49:16 | indirection1() |
-| server-crash.js:7:5:7:14 | throw err; | server-crash.js:6:28:8:3 | (err, x ...  OK\\n  } |
-| server-crash.js:10:1:12:1 | functio ... OT OK\\n} | server-crash.js:51:5:51:18 | indirection2() |
-| server-crash.js:11:3:11:11 | throw 42; | server-crash.js:10:1:12:1 | functio ... OT OK\\n} |
-| server-crash.js:13:1:19:1 | functio ... e) {}\\n} | server-crash.js:54:3:54:16 | indirection3() |
-| server-crash.js:16:7:16:16 | throw err; | server-crash.js:15:30:17:5 | (err, x ... K\\n    } |
-| server-crash.js:20:1:22:1 | functio ... aller\\n} | server-crash.js:56:5:56:18 | indirection4() |
-| server-crash.js:23:1:25:1 | functio ... n6();\\n} | server-crash.js:58:3:58:16 | indirection5() |
-| server-crash.js:24:3:24:16 | indirection6() | server-crash.js:23:1:25:1 | functio ... n6();\\n} |
-| server-crash.js:26:1:30:1 | functio ...   });\\n} | server-crash.js:24:3:24:16 | indirection6() |
-| server-crash.js:28:5:28:14 | throw err; | server-crash.js:27:28:29:3 | (err, x ...  OK\\n  } |
-| server-crash.js:33:5:33:14 | throw err; | server-crash.js:32:28:34:3 | (err, x ...  OK\\n  } |
-| server-crash.js:49:3:49:16 | indirection1() | server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
-| server-crash.js:51:5:51:18 | indirection2() | server-crash.js:50:28:52:3 | (err, x ... ();\\n  } |
-| server-crash.js:54:3:54:16 | indirection3() | server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
-| server-crash.js:56:5:56:18 | indirection4() | server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
-| server-crash.js:58:3:58:16 | indirection5() | server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
+| server-crash.js:15:5:15:14 | throw err; | server-crash.js:14:23:16:3 | (err, x ...  OK\\n  } |
+| server-crash.js:18:1:20:1 | functio ... OT OK\\n} | server-crash.js:59:5:59:18 | indirection2() |
+| server-crash.js:19:3:19:11 | throw 42; | server-crash.js:18:1:20:1 | functio ... OT OK\\n} |
+| server-crash.js:24:7:24:16 | throw err; | server-crash.js:23:25:25:5 | (err, x ... K\\n    } |
+| server-crash.js:36:5:36:14 | throw err; | server-crash.js:35:23:37:3 | (err, x ...  OK\\n  } |
+| server-crash.js:41:5:41:14 | throw err; | server-crash.js:40:23:42:3 | (err, x ...  OK\\n  } |
+| server-crash.js:59:5:59:18 | indirection2() | server-crash.js:58:23:60:3 | (err, x ... ();\\n  } |
+| server-crash.js:88:5:88:14 | throw err; | server-crash.js:87:23:89:3 | (err, x ...  OK\\n  } |
+| server-crash.js:94:5:94:14 | throw "e"; | server-crash.js:93:22:95:3 | () => { ...  OK\\n  } |
+| server-crash.js:102:7:102:16 | throw "e"; | server-crash.js:101:24:103:5 | () => { ... K\\n    } |
+| server-crash.js:109:9:109:18 | throw "e"; | server-crash.js:108:26:110:7 | () => { ...       } |
+| server-crash.js:117:9:117:18 | throw "e"; | server-crash.js:116:26:118:7 | () => { ...       } |
+| server-crash.js:131:7:131:16 | throw err; | server-crash.js:130:25:132:5 | (err, x ... K\\n    } |
+| server-crash.js:152:3:154:3 | functio ...  OK\\n  } | server-crash.js:157:5:157:16 | throwError() |
+| server-crash.js:152:3:154:3 | functio ...  OK\\n  } | server-crash.js:160:5:160:16 | throwError() |
+| server-crash.js:152:3:154:3 | functio ...  OK\\n  } | server-crash.js:164:3:164:14 | throwError() |
+| server-crash.js:153:5:153:22 | throw new Error(); | server-crash.js:152:3:154:3 | functio ...  OK\\n  } |
+| server-crash.js:153:11:153:21 | new Error() | server-crash.js:152:3:154:3 | functio ...  OK\\n  } |
+| server-crash.js:157:5:157:16 | throwError() | server-crash.js:156:3:158:3 | functio ... ath\\n  } |
 nodes
-| server-crash.js:5:1:9:1 | functio ...   });\\n} |
-| server-crash.js:6:28:8:3 | (err, x ...  OK\\n  } |
-| server-crash.js:7:5:7:14 | throw err; |
-| server-crash.js:10:1:12:1 | functio ... OT OK\\n} |
-| server-crash.js:11:3:11:11 | throw 42; |
-| server-crash.js:13:1:19:1 | functio ... e) {}\\n} |
-| server-crash.js:15:30:17:5 | (err, x ... K\\n    } |
-| server-crash.js:16:7:16:16 | throw err; |
-| server-crash.js:20:1:22:1 | functio ... aller\\n} |
-| server-crash.js:23:1:25:1 | functio ... n6();\\n} |
-| server-crash.js:24:3:24:16 | indirection6() |
-| server-crash.js:26:1:30:1 | functio ...   });\\n} |
-| server-crash.js:27:28:29:3 | (err, x ...  OK\\n  } |
-| server-crash.js:28:5:28:14 | throw err; |
-| server-crash.js:31:25:73:1 | (req, r ...   });\\n} |
-| server-crash.js:32:28:34:3 | (err, x ...  OK\\n  } |
-| server-crash.js:33:5:33:14 | throw err; |
-| server-crash.js:49:3:49:16 | indirection1() |
-| server-crash.js:50:28:52:3 | (err, x ... ();\\n  } |
-| server-crash.js:51:5:51:18 | indirection2() |
-| server-crash.js:54:3:54:16 | indirection3() |
-| server-crash.js:56:5:56:18 | indirection4() |
-| server-crash.js:58:3:58:16 | indirection5() |
+| server-crash.js:14:23:16:3 | (err, x ...  OK\\n  } |
+| server-crash.js:15:5:15:14 | throw err; |
+| server-crash.js:18:1:20:1 | functio ... OT OK\\n} |
+| server-crash.js:19:3:19:11 | throw 42; |
+| server-crash.js:23:25:25:5 | (err, x ... K\\n    } |
+| server-crash.js:24:7:24:16 | throw err; |
+| server-crash.js:35:23:37:3 | (err, x ...  OK\\n  } |
+| server-crash.js:36:5:36:14 | throw err; |
+| server-crash.js:40:23:42:3 | (err, x ...  OK\\n  } |
+| server-crash.js:41:5:41:14 | throw err; |
+| server-crash.js:58:23:60:3 | (err, x ... ();\\n  } |
+| server-crash.js:59:5:59:18 | indirection2() |
+| server-crash.js:87:23:89:3 | (err, x ...  OK\\n  } |
+| server-crash.js:88:5:88:14 | throw err; |
+| server-crash.js:93:22:95:3 | () => { ...  OK\\n  } |
+| server-crash.js:94:5:94:14 | throw "e"; |
+| server-crash.js:101:24:103:5 | () => { ... K\\n    } |
+| server-crash.js:102:7:102:16 | throw "e"; |
+| server-crash.js:108:26:110:7 | () => { ...       } |
+| server-crash.js:109:9:109:18 | throw "e"; |
+| server-crash.js:116:26:118:7 | () => { ...       } |
+| server-crash.js:117:9:117:18 | throw "e"; |
+| server-crash.js:130:25:132:5 | (err, x ... K\\n    } |
+| server-crash.js:131:7:131:16 | throw err; |
+| server-crash.js:152:3:154:3 | functio ...  OK\\n  } |
+| server-crash.js:153:5:153:22 | throw new Error(); |
+| server-crash.js:153:11:153:21 | new Error() |
+| server-crash.js:156:3:158:3 | functio ... ath\\n  } |
+| server-crash.js:157:5:157:16 | throwError() |
+| server-crash.js:160:5:160:16 | throwError() |
+| server-crash.js:164:3:164:14 | throwError() |
 #select
-| server-crash.js:7:5:7:14 | throw err; | server-crash.js:7:5:7:14 | throw err; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:6:28:8:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
-| server-crash.js:11:3:11:11 | throw 42; | server-crash.js:11:3:11:11 | throw 42; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:50:28:52:3 | (err, x ... ();\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
-| server-crash.js:16:7:16:16 | throw err; | server-crash.js:16:7:16:16 | throw err; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:15:30:17:5 | (err, x ... K\\n    } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
-| server-crash.js:28:5:28:14 | throw err; | server-crash.js:28:5:28:14 | throw err; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:27:28:29:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
-| server-crash.js:33:5:33:14 | throw err; | server-crash.js:33:5:33:14 | throw err; | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | When an exception is thrown here and later escapes at $@, the server of $@ will crash. | server-crash.js:32:28:34:3 | (err, x ...  OK\\n  } | this asynchronous callback | server-crash.js:31:25:73:1 | (req, r ...   });\\n} | this route handler |
+| server-crash.js:15:5:15:14 | throw err; | server-crash.js:15:5:15:14 | throw err; | server-crash.js:14:23:16:3 | (err, x ...  OK\\n  } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:39:25:85:1 | (req, r ... e) {}\\n} | this route handler | server-crash.js:14:23:16:3 | (err, x ...  OK\\n  } | asynchronous callback |
+| server-crash.js:19:3:19:11 | throw 42; | server-crash.js:19:3:19:11 | throw 42; | server-crash.js:58:23:60:3 | (err, x ... ();\\n  } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:39:25:85:1 | (req, r ... e) {}\\n} | this route handler | server-crash.js:58:23:60:3 | (err, x ... ();\\n  } | asynchronous callback |
+| server-crash.js:24:7:24:16 | throw err; | server-crash.js:24:7:24:16 | throw err; | server-crash.js:23:25:25:5 | (err, x ... K\\n    } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:39:25:85:1 | (req, r ... e) {}\\n} | this route handler | server-crash.js:23:25:25:5 | (err, x ... K\\n    } | asynchronous callback |
+| server-crash.js:36:5:36:14 | throw err; | server-crash.js:36:5:36:14 | throw err; | server-crash.js:35:23:37:3 | (err, x ...  OK\\n  } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:39:25:85:1 | (req, r ... e) {}\\n} | this route handler | server-crash.js:35:23:37:3 | (err, x ...  OK\\n  } | asynchronous callback |
+| server-crash.js:41:5:41:14 | throw err; | server-crash.js:41:5:41:14 | throw err; | server-crash.js:40:23:42:3 | (err, x ...  OK\\n  } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:39:25:85:1 | (req, r ... e) {}\\n} | this route handler | server-crash.js:40:23:42:3 | (err, x ...  OK\\n  } | asynchronous callback |
+| server-crash.js:88:5:88:14 | throw err; | server-crash.js:88:5:88:14 | throw err; | server-crash.js:87:23:89:3 | (err, x ...  OK\\n  } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:39:25:85:1 | (req, r ... e) {}\\n} | this route handler | server-crash.js:87:23:89:3 | (err, x ...  OK\\n  } | asynchronous callback |
+| server-crash.js:94:5:94:14 | throw "e"; | server-crash.js:94:5:94:14 | throw "e"; | server-crash.js:93:22:95:3 | () => { ...  OK\\n  } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:92:31:120:1 | (req, r ...   });\\n} | this route handler | server-crash.js:93:22:95:3 | () => { ...  OK\\n  } | asynchronous callback |
+| server-crash.js:102:7:102:16 | throw "e"; | server-crash.js:102:7:102:16 | throw "e"; | server-crash.js:101:24:103:5 | () => { ... K\\n    } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:92:31:120:1 | (req, r ...   });\\n} | this route handler | server-crash.js:101:24:103:5 | () => { ... K\\n    } | asynchronous callback |
+| server-crash.js:109:9:109:18 | throw "e"; | server-crash.js:109:9:109:18 | throw "e"; | server-crash.js:108:26:110:7 | () => { ...       } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:92:31:120:1 | (req, r ...   });\\n} | this route handler | server-crash.js:108:26:110:7 | () => { ...       } | asynchronous callback |
+| server-crash.js:117:9:117:18 | throw "e"; | server-crash.js:117:9:117:18 | throw "e"; | server-crash.js:116:26:118:7 | () => { ...       } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:92:31:120:1 | (req, r ...   });\\n} | this route handler | server-crash.js:116:26:118:7 | () => { ...       } | asynchronous callback |
+| server-crash.js:131:7:131:16 | throw err; | server-crash.js:131:7:131:16 | throw err; | server-crash.js:130:25:132:5 | (err, x ... K\\n    } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:128:32:135:1 | async ( ... un();\\n} | this route handler | server-crash.js:130:25:132:5 | (err, x ... K\\n    } | asynchronous callback |
+| server-crash.js:153:5:153:22 | throw new Error(); | server-crash.js:153:5:153:22 | throw new Error(); | server-crash.js:156:3:158:3 | functio ... ath\\n  } | The server of $@ will terminate when an uncaught exception from here escapes this $@ | server-crash.js:151:40:166:1 | (req, r ... nc();\\n} | this route handler | server-crash.js:161:16:161:17 | cb | asynchronous callback |
diff --git a/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js b/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
index b1e796cbd7a..cb7bc4d9b8e 100644
--- a/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
+++ b/javascript/ql/test/query-tests/Security/CWE-730/server-crash.js
@@ -1,9 +1,17 @@
 const express = require("express");
 const app = express();
 const fs = require("fs");
+const EventEmitter = require("events");
+const http = require("http");
+
+const port = 12000;
+let server = app.listen(port, () =>
+  // for manual testing of the fickle node.js runtime
+  console.log(`Example app listening on port ${port}!`)
+);
 
 function indirection1() {
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     throw err; // NOT OK
   });
 }
@@ -12,7 +20,7 @@ function indirection2() {
 }
 function indirection3() {
   try {
-    fs.readFile("/WHATEVER", (err, x) => {
+    fs.readFile("/foo", (err, x) => {
       throw err; // NOT OK
     });
   } catch (e) {}
@@ -24,30 +32,30 @@ function indirection5() {
   indirection6();
 }
 function indirection6() {
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     throw err; // NOT OK
   });
 }
 app.get("/async-throw", (req, res) => {
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     throw err; // NOT OK
   });
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     try {
       throw err; // OK: guarded throw
     } catch (e) {}
   });
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     res.setHeader("reflected", req.query.header); // NOT OK [INCONSISTENCY]
   });
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     try {
       res.setHeader("reflected", req.query.header); // OK: guarded call
     } catch (e) {}
   });
 
   indirection1();
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     indirection2();
   });
 
@@ -57,17 +65,17 @@ app.get("/async-throw", (req, res) => {
   } catch (e) {}
   indirection5();
 
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     req.query.foo; // OK
   });
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     req.query.foo.toString(); // OK
   });
 
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     req.query.foo.bar; // NOT OK [INCONSISTENCY]: need to add property reads as sinks
   });
-  fs.readFile("/WHATEVER", (err, x) => {
+  fs.readFile("/foo", (err, x) => {
     res.setHeader("reflected", unknown); // OK
   });
 
@@ -80,3 +88,79 @@ function indirection7() {
     throw err; // NOT OK
   });
 }
+
+app.get("/async-throw-again", (req, res) => {
+  fs.readFile("foo", () => {
+    throw "e"; // NOT OK
+  });
+  fs.readFileSync("foo", () => {
+    throw "e"; // OK (does not take callbacks at all)
+  });
+  // can nest async calls (and only warns about the inner one)
+  fs.readFile("foo", () => {
+    fs.readFile("bar", () => {
+      throw "e"; // NOT OK
+    });
+  });
+  fs.readFile("foo", () => {
+    // can not catch async exceptions
+    try {
+      fs.readFile("bar", () => {
+        throw "e"; // NOT OK
+      });
+    } catch (e) {}
+  });
+  // can mix sync/async calls
+  fs.readFile("foo", () => {
+    (() =>
+      fs.readFile("bar", () => {
+        throw "e"; // NOT OK
+      }))();
+  });
+});
+
+app.get("/throw-in-promise-1", async (req, res) => {
+  async function fun() {
+    throw new Error(); // OK, requires `node --unhandled-rejections=strict ...` to terminate the process
+  }
+  await fun();
+});
+app.get("/throw-in-promise-2", async (req, res) => {
+  async function fun() {
+    fs.readFile("/foo", (err, x) => {
+      throw err; // NOT OK
+    });
+  }
+  await fun();
+});
+app.get("/throw-in-promise-3", async (req, res) => {
+  fs.readFile("/foo", async (err, x) => {
+    throw err; // OK, requires `node --unhandled-rejections=strict ...` to terminate the process
+  });
+});
+
+app.get("/throw-in-event-emitter", async (req, res) => {
+  class MyEmitter extends EventEmitter {}
+  const myEmitter = new MyEmitter();
+  myEmitter.on("event", () => {
+    throw new Error(); // OK, requires `node --unhandled-rejections=strict ...` to terminate the process
+  });
+  myEmitter.emit("event");
+});
+
+app.get("/throw-with-ambiguous-paths", (req, res) => {
+  function throwError() {
+    throw new Error(); // NOT OK
+  }
+
+  function cb() {
+    throwError(); // on path
+  }
+  function withAsync() {
+    throwError(); // not on path
+    fs.stat(X, cb);
+  }
+
+  throwError(); // not on path
+  withAsync();
+});

From 42fa3bdb8191b2e3d506c7dc3e731bb3aaad8536 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 19 Jan 2021 09:13:17 +0100
Subject: [PATCH 201/343] Python: Only consider the closest SOURCE (in use-use
 flow) a source

---
 .../dataflow/coverage/dataflow.expected       | 114 ----------------
 .../dataflow/coverage/datamodel.py            |  16 +--
 .../experimental/dataflow/coverage/test.py    | 122 +++++++++---------
 .../dataflow/fieldflow/dataflow.expected      |  36 ------
 .../test/experimental/dataflow/testConfig.qll |   4 +-
 5 files changed, 72 insertions(+), 220 deletions(-)

diff --git a/python/ql/test/experimental/dataflow/coverage/dataflow.expected b/python/ql/test/experimental/dataflow/coverage/dataflow.expected
index dc085955408..3bb58f50618 100644
--- a/python/ql/test/experimental/dataflow/coverage/dataflow.expected
+++ b/python/ql/test/experimental/dataflow/coverage/dataflow.expected
@@ -1,68 +1,13 @@
 edges
-| datamodel.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module datamodel | datamodel.py:152:14:152:19 | ControlFlowNode for SOURCE |
-| datamodel.py:13:1:13:6 | GSSA Variable SOURCE | datamodel.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module datamodel |
-| datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:13:1:13:6 | GSSA Variable SOURCE |
-| datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE |
-| datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE |
-| datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE |
-| datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE |
-| datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:81:20:81:25 | ControlFlowNode for SOURCE |
 | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:38:6:38:17 | ControlFlowNode for f() |
-| datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE |
-| datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE |
-| datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE |
-| datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:81:20:81:25 | ControlFlowNode for SOURCE |
 | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() |
-| datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE |
-| datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE |
-| datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:81:20:81:25 | ControlFlowNode for SOURCE |
 | datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE | datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() |
-| datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE | datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE |
-| datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE | datamodel.py:81:20:81:25 | ControlFlowNode for SOURCE |
-| datamodel.py:73:18:73:23 | ControlFlowNode for SOURCE | datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE |
-| datamodel.py:73:18:73:23 | ControlFlowNode for SOURCE | datamodel.py:81:20:81:25 | ControlFlowNode for SOURCE |
 | datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE | datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() |
-| datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE | datamodel.py:81:20:81:25 | ControlFlowNode for SOURCE |
 | datamodel.py:81:20:81:25 | ControlFlowNode for SOURCE | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() |
 | datamodel.py:152:5:152:8 | [post store] ControlFlowNode for self [Attribute b] | datamodel.py:155:14:155:25 | ControlFlowNode for Customized() [Attribute b] |
 | datamodel.py:152:14:152:19 | ControlFlowNode for SOURCE | datamodel.py:152:5:152:8 | [post store] ControlFlowNode for self [Attribute b] |
 | datamodel.py:155:14:155:25 | ControlFlowNode for Customized() [Attribute b] | datamodel.py:159:6:159:15 | ControlFlowNode for customized [Attribute b] |
 | datamodel.py:159:6:159:15 | ControlFlowNode for customized [Attribute b] | datamodel.py:159:6:159:17 | ControlFlowNode for Attribute |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:42:21:42:26 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:55:9:55:14 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:87:10:87:15 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:93:10:93:15 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:103:10:103:15 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:108:22:108:27 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:113:10:113:15 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:125:10:125:15 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:130:10:130:15 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:135:22:135:27 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:140:10:140:15 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:152:15:152:20 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:157:15:157:20 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:183:23:183:28 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:188:25:188:30 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:199:34:199:39 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:336:11:336:16 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:340:11:340:16 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:344:16:344:21 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:367:28:367:33 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:375:30:375:35 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:383:36:383:41 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:391:33:391:38 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:399:39:399:44 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:420:10:420:15 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:428:34:428:39 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:452:12:452:17 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:459:28:459:33 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:473:30:473:35 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:487:36:487:41 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:492:33:492:38 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:497:39:497:44 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:509:9:509:14 | ControlFlowNode for SOURCE |
-| test.py:20:1:20:6 | GSSA Variable SOURCE | test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test |
-| test.py:20:10:20:17 | ControlFlowNode for Str | test.py:20:1:20:6 | GSSA Variable SOURCE |
 | test.py:42:10:42:26 | ControlFlowNode for Tuple [Tuple element at index 1] | test.py:43:9:43:9 | ControlFlowNode for x [Tuple element at index 1] |
 | test.py:42:21:42:26 | ControlFlowNode for SOURCE | test.py:42:10:42:26 | ControlFlowNode for Tuple [Tuple element at index 1] |
 | test.py:43:9:43:9 | ControlFlowNode for x [Tuple element at index 1] | test.py:43:9:43:12 | ControlFlowNode for Subscript |
@@ -180,16 +125,12 @@ edges
 | test.py:509:9:509:14 | ControlFlowNode for SOURCE | test.py:511:10:511:10 | ControlFlowNode for a |
 | test.py:509:9:509:14 | ControlFlowNode for SOURCE | test.py:516:10:516:10 | ControlFlowNode for b |
 nodes
-| datamodel.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module datamodel | semmle.label | ModuleVariableNode for Global Variable SOURCE in Module datamodel |
-| datamodel.py:13:1:13:6 | GSSA Variable SOURCE | semmle.label | GSSA Variable SOURCE |
-| datamodel.py:13:10:13:17 | ControlFlowNode for Str | semmle.label | ControlFlowNode for Str |
 | datamodel.py:38:6:38:17 | ControlFlowNode for f() | semmle.label | ControlFlowNode for f() |
 | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 | datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| datamodel.py:73:18:73:23 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 | datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
 | datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
@@ -199,9 +140,6 @@ nodes
 | datamodel.py:155:14:155:25 | ControlFlowNode for Customized() [Attribute b] | semmle.label | ControlFlowNode for Customized() [Attribute b] |
 | datamodel.py:159:6:159:15 | ControlFlowNode for customized [Attribute b] | semmle.label | ControlFlowNode for customized [Attribute b] |
 | datamodel.py:159:6:159:17 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | semmle.label | ModuleVariableNode for Global Variable SOURCE in Module test |
-| test.py:20:1:20:6 | GSSA Variable SOURCE | semmle.label | GSSA Variable SOURCE |
-| test.py:20:10:20:17 | ControlFlowNode for Str | semmle.label | ControlFlowNode for Str |
 | test.py:42:10:42:26 | ControlFlowNode for Tuple [Tuple element at index 1] | semmle.label | ControlFlowNode for Tuple [Tuple element at index 1] |
 | test.py:42:21:42:26 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 | test.py:43:9:43:9 | ControlFlowNode for x [Tuple element at index 1] | semmle.label | ControlFlowNode for x [Tuple element at index 1] |
@@ -356,99 +294,47 @@ nodes
 | test.py:511:10:511:10 | ControlFlowNode for a | semmle.label | ControlFlowNode for a |
 | test.py:516:10:516:10 | ControlFlowNode for b | semmle.label | ControlFlowNode for b |
 #select
-| datamodel.py:38:6:38:17 | ControlFlowNode for f() | datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:38:6:38:17 | ControlFlowNode for f() | Flow found |
 | datamodel.py:38:6:38:17 | ControlFlowNode for f() | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:38:6:38:17 | ControlFlowNode for f() | Flow found |
-| datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | Flow found |
 | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() | datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() | Flow found |
 | datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() | datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE | datamodel.py:72:6:72:27 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE | datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | datamodel.py:73:18:73:23 | ControlFlowNode for SOURCE | datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | Flow found |
 | datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE | datamodel.py:80:6:80:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | datamodel.py:72:18:72:23 | ControlFlowNode for SOURCE | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | datamodel.py:73:18:73:23 | ControlFlowNode for SOURCE | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | datamodel.py:80:20:80:25 | ControlFlowNode for SOURCE | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | Flow found |
 | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | datamodel.py:81:20:81:25 | ControlFlowNode for SOURCE | datamodel.py:81:6:81:26 | ControlFlowNode for Attribute() | Flow found |
-| datamodel.py:159:6:159:17 | ControlFlowNode for Attribute | datamodel.py:13:10:13:17 | ControlFlowNode for Str | datamodel.py:159:6:159:17 | ControlFlowNode for Attribute | Flow found |
 | datamodel.py:159:6:159:17 | ControlFlowNode for Attribute | datamodel.py:152:14:152:19 | ControlFlowNode for SOURCE | datamodel.py:159:6:159:17 | ControlFlowNode for Attribute | Flow found |
-| test.py:44:10:44:10 | ControlFlowNode for y | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:44:10:44:10 | ControlFlowNode for y | Flow found |
 | test.py:44:10:44:10 | ControlFlowNode for y | test.py:42:21:42:26 | ControlFlowNode for SOURCE | test.py:44:10:44:10 | ControlFlowNode for y | Flow found |
-| test.py:56:10:56:10 | ControlFlowNode for x | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:56:10:56:10 | ControlFlowNode for x | Flow found |
 | test.py:56:10:56:10 | ControlFlowNode for x | test.py:55:9:55:14 | ControlFlowNode for SOURCE | test.py:56:10:56:10 | ControlFlowNode for x | Flow found |
 | test.py:62:10:62:10 | ControlFlowNode for x | test.py:61:9:61:16 | ControlFlowNode for Str | test.py:62:10:62:10 | ControlFlowNode for x | Flow found |
 | test.py:67:10:67:10 | ControlFlowNode for x | test.py:66:9:66:17 | ControlFlowNode for Str | test.py:67:10:67:10 | ControlFlowNode for x | Flow found |
 | test.py:72:10:72:10 | ControlFlowNode for x | test.py:71:9:71:10 | ControlFlowNode for IntegerLiteral | test.py:72:10:72:10 | ControlFlowNode for x | Flow found |
 | test.py:77:10:77:10 | ControlFlowNode for x | test.py:76:9:76:12 | ControlFlowNode for FloatLiteral | test.py:77:10:77:10 | ControlFlowNode for x | Flow found |
-| test.py:88:10:88:10 | ControlFlowNode for x | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:88:10:88:10 | ControlFlowNode for x | Flow found |
 | test.py:88:10:88:10 | ControlFlowNode for x | test.py:87:10:87:15 | ControlFlowNode for SOURCE | test.py:88:10:88:10 | ControlFlowNode for x | Flow found |
-| test.py:94:10:94:13 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:94:10:94:13 | ControlFlowNode for Subscript | Flow found |
 | test.py:94:10:94:13 | ControlFlowNode for Subscript | test.py:93:10:93:15 | ControlFlowNode for SOURCE | test.py:94:10:94:13 | ControlFlowNode for Subscript | Flow found |
-| test.py:104:10:104:13 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:104:10:104:13 | ControlFlowNode for Subscript | Flow found |
 | test.py:104:10:104:13 | ControlFlowNode for Subscript | test.py:103:10:103:15 | ControlFlowNode for SOURCE | test.py:104:10:104:13 | ControlFlowNode for Subscript | Flow found |
-| test.py:109:10:109:13 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:109:10:109:13 | ControlFlowNode for Subscript | Flow found |
 | test.py:109:10:109:13 | ControlFlowNode for Subscript | test.py:108:22:108:27 | ControlFlowNode for SOURCE | test.py:109:10:109:13 | ControlFlowNode for Subscript | Flow found |
-| test.py:115:10:115:13 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:115:10:115:13 | ControlFlowNode for Subscript | Flow found |
 | test.py:115:10:115:13 | ControlFlowNode for Subscript | test.py:113:10:113:15 | ControlFlowNode for SOURCE | test.py:115:10:115:13 | ControlFlowNode for Subscript | Flow found |
-| test.py:126:10:126:16 | ControlFlowNode for Attribute() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:126:10:126:16 | ControlFlowNode for Attribute() | Flow found |
 | test.py:126:10:126:16 | ControlFlowNode for Attribute() | test.py:125:10:125:15 | ControlFlowNode for SOURCE | test.py:126:10:126:16 | ControlFlowNode for Attribute() | Flow found |
-| test.py:131:10:131:16 | ControlFlowNode for Attribute() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:131:10:131:16 | ControlFlowNode for Attribute() | Flow found |
 | test.py:131:10:131:16 | ControlFlowNode for Attribute() | test.py:130:10:130:15 | ControlFlowNode for SOURCE | test.py:131:10:131:16 | ControlFlowNode for Attribute() | Flow found |
-| test.py:136:10:136:16 | ControlFlowNode for Attribute() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:136:10:136:16 | ControlFlowNode for Attribute() | Flow found |
 | test.py:136:10:136:16 | ControlFlowNode for Attribute() | test.py:135:22:135:27 | ControlFlowNode for SOURCE | test.py:136:10:136:16 | ControlFlowNode for Attribute() | Flow found |
-| test.py:142:10:142:16 | ControlFlowNode for Attribute() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:142:10:142:16 | ControlFlowNode for Attribute() | Flow found |
 | test.py:142:10:142:16 | ControlFlowNode for Attribute() | test.py:140:10:140:15 | ControlFlowNode for SOURCE | test.py:142:10:142:16 | ControlFlowNode for Attribute() | Flow found |
-| test.py:153:10:153:15 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:153:10:153:15 | ControlFlowNode for Subscript | Flow found |
 | test.py:153:10:153:15 | ControlFlowNode for Subscript | test.py:152:15:152:20 | ControlFlowNode for SOURCE | test.py:153:10:153:15 | ControlFlowNode for Subscript | Flow found |
-| test.py:158:10:158:19 | ControlFlowNode for Attribute() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:158:10:158:19 | ControlFlowNode for Attribute() | Flow found |
 | test.py:158:10:158:19 | ControlFlowNode for Attribute() | test.py:157:15:157:20 | ControlFlowNode for SOURCE | test.py:158:10:158:19 | ControlFlowNode for Attribute() | Flow found |
-| test.py:184:10:184:13 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:184:10:184:13 | ControlFlowNode for Subscript | Flow found |
 | test.py:184:10:184:13 | ControlFlowNode for Subscript | test.py:183:23:183:28 | ControlFlowNode for SOURCE | test.py:184:10:184:13 | ControlFlowNode for Subscript | Flow found |
-| test.py:189:10:189:13 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:189:10:189:13 | ControlFlowNode for Subscript | Flow found |
 | test.py:189:10:189:13 | ControlFlowNode for Subscript | test.py:188:25:188:30 | ControlFlowNode for SOURCE | test.py:189:10:189:13 | ControlFlowNode for Subscript | Flow found |
-| test.py:200:10:200:13 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:200:10:200:13 | ControlFlowNode for Subscript | Flow found |
 | test.py:200:10:200:13 | ControlFlowNode for Subscript | test.py:199:34:199:39 | ControlFlowNode for SOURCE | test.py:200:10:200:13 | ControlFlowNode for Subscript | Flow found |
-| test.py:336:10:336:21 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:336:10:336:21 | ControlFlowNode for Subscript | Flow found |
 | test.py:336:10:336:21 | ControlFlowNode for Subscript | test.py:336:11:336:16 | ControlFlowNode for SOURCE | test.py:336:10:336:21 | ControlFlowNode for Subscript | Flow found |
-| test.py:340:10:340:20 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:340:10:340:20 | ControlFlowNode for Subscript | Flow found |
 | test.py:340:10:340:20 | ControlFlowNode for Subscript | test.py:340:11:340:16 | ControlFlowNode for SOURCE | test.py:340:10:340:20 | ControlFlowNode for Subscript | Flow found |
-| test.py:344:10:344:27 | ControlFlowNode for Subscript | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:344:10:344:27 | ControlFlowNode for Subscript | Flow found |
 | test.py:344:10:344:27 | ControlFlowNode for Subscript | test.py:344:16:344:21 | ControlFlowNode for SOURCE | test.py:344:10:344:27 | ControlFlowNode for Subscript | Flow found |
-| test.py:367:10:367:34 | ControlFlowNode for second() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:367:10:367:34 | ControlFlowNode for second() | Flow found |
 | test.py:367:10:367:34 | ControlFlowNode for second() | test.py:367:28:367:33 | ControlFlowNode for SOURCE | test.py:367:10:367:34 | ControlFlowNode for second() | Flow found |
-| test.py:375:10:375:36 | ControlFlowNode for second() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:375:10:375:36 | ControlFlowNode for second() | Flow found |
 | test.py:375:10:375:36 | ControlFlowNode for second() | test.py:375:30:375:35 | ControlFlowNode for SOURCE | test.py:375:10:375:36 | ControlFlowNode for second() | Flow found |
-| test.py:383:10:383:43 | ControlFlowNode for second() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:383:10:383:43 | ControlFlowNode for second() | Flow found |
 | test.py:383:10:383:43 | ControlFlowNode for second() | test.py:383:36:383:41 | ControlFlowNode for SOURCE | test.py:383:10:383:43 | ControlFlowNode for second() | Flow found |
-| test.py:391:10:391:39 | ControlFlowNode for f_extra_pos() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:391:10:391:39 | ControlFlowNode for f_extra_pos() | Flow found |
 | test.py:391:10:391:39 | ControlFlowNode for f_extra_pos() | test.py:391:33:391:38 | ControlFlowNode for SOURCE | test.py:391:10:391:39 | ControlFlowNode for f_extra_pos() | Flow found |
-| test.py:399:10:399:45 | ControlFlowNode for f_extra_keyword() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:399:10:399:45 | ControlFlowNode for f_extra_keyword() | Flow found |
 | test.py:399:10:399:45 | ControlFlowNode for f_extra_keyword() | test.py:399:39:399:44 | ControlFlowNode for SOURCE | test.py:399:10:399:45 | ControlFlowNode for f_extra_keyword() | Flow found |
-| test.py:420:10:420:38 | ControlFlowNode for IfExp | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:420:10:420:38 | ControlFlowNode for IfExp | Flow found |
 | test.py:420:10:420:38 | ControlFlowNode for IfExp | test.py:420:10:420:15 | ControlFlowNode for SOURCE | test.py:420:10:420:38 | ControlFlowNode for IfExp | Flow found |
-| test.py:428:10:428:39 | ControlFlowNode for IfExp | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:428:10:428:39 | ControlFlowNode for IfExp | Flow found |
 | test.py:428:10:428:39 | ControlFlowNode for IfExp | test.py:428:34:428:39 | ControlFlowNode for SOURCE | test.py:428:10:428:39 | ControlFlowNode for IfExp | Flow found |
-| test.py:452:10:452:18 | ControlFlowNode for f() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:452:10:452:18 | ControlFlowNode for f() | Flow found |
 | test.py:452:10:452:18 | ControlFlowNode for f() | test.py:452:12:452:17 | ControlFlowNode for SOURCE | test.py:452:10:452:18 | ControlFlowNode for f() | Flow found |
-| test.py:459:10:459:34 | ControlFlowNode for second() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:459:10:459:34 | ControlFlowNode for second() | Flow found |
 | test.py:459:10:459:34 | ControlFlowNode for second() | test.py:459:28:459:33 | ControlFlowNode for SOURCE | test.py:459:10:459:34 | ControlFlowNode for second() | Flow found |
-| test.py:473:10:473:36 | ControlFlowNode for second() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:473:10:473:36 | ControlFlowNode for second() | Flow found |
 | test.py:473:10:473:36 | ControlFlowNode for second() | test.py:473:30:473:35 | ControlFlowNode for SOURCE | test.py:473:10:473:36 | ControlFlowNode for second() | Flow found |
-| test.py:487:10:487:43 | ControlFlowNode for second() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:487:10:487:43 | ControlFlowNode for second() | Flow found |
 | test.py:487:10:487:43 | ControlFlowNode for second() | test.py:487:36:487:41 | ControlFlowNode for SOURCE | test.py:487:10:487:43 | ControlFlowNode for second() | Flow found |
-| test.py:492:10:492:39 | ControlFlowNode for f_extra_pos() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:492:10:492:39 | ControlFlowNode for f_extra_pos() | Flow found |
 | test.py:492:10:492:39 | ControlFlowNode for f_extra_pos() | test.py:492:33:492:38 | ControlFlowNode for SOURCE | test.py:492:10:492:39 | ControlFlowNode for f_extra_pos() | Flow found |
-| test.py:497:10:497:45 | ControlFlowNode for f_extra_keyword() | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:497:10:497:45 | ControlFlowNode for f_extra_keyword() | Flow found |
 | test.py:497:10:497:45 | ControlFlowNode for f_extra_keyword() | test.py:497:39:497:44 | ControlFlowNode for SOURCE | test.py:497:10:497:45 | ControlFlowNode for f_extra_keyword() | Flow found |
-| test.py:511:10:511:10 | ControlFlowNode for a | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:511:10:511:10 | ControlFlowNode for a | Flow found |
 | test.py:511:10:511:10 | ControlFlowNode for a | test.py:509:9:509:14 | ControlFlowNode for SOURCE | test.py:511:10:511:10 | ControlFlowNode for a | Flow found |
-| test.py:516:10:516:10 | ControlFlowNode for b | test.py:20:10:20:17 | ControlFlowNode for Str | test.py:516:10:516:10 | ControlFlowNode for b | Flow found |
 | test.py:516:10:516:10 | ControlFlowNode for b | test.py:509:9:509:14 | ControlFlowNode for SOURCE | test.py:516:10:516:10 | ControlFlowNode for b | Flow found |
diff --git a/python/ql/test/experimental/dataflow/coverage/datamodel.py b/python/ql/test/experimental/dataflow/coverage/datamodel.py
index 0d921a2cb85..3f11593dbd1 100644
--- a/python/ql/test/experimental/dataflow/coverage/datamodel.py
+++ b/python/ql/test/experimental/dataflow/coverage/datamodel.py
@@ -35,7 +35,7 @@ def SINK_F(x):
 def f(a, b):
   return a
 
-SINK(f(SOURCE, 3)) #$ flow="SOURCE -> f(..)" flow="'source', l:13 -> f(..)"
+SINK(f(SOURCE, 3)) #$ flow="SOURCE -> f(..)"
 
 # Instance methods
 # An instance method object combines a class, a class instance and any callable object (normally a user-defined function).
@@ -68,18 +68,18 @@ c = C()
 func_obj = c.method.__func__
 
 # When an instance method object is called, the underlying function (__func__) is called, inserting the class instance (__self__) in front of the argument list. For instance, when C is a class which contains a definition for a function f(), and x is an instance of C, calling x.f(1) is equivalent to calling C.f(x, 1).
-SINK(c.method(SOURCE, C)) #$ flow="SOURCE -> c.method(..)" flow="SOURCE, l:38 -> c.method(..)" flow="'source', l:13 -> c.method(..)"
-SINK(C.method(c, SOURCE, C)) #$ flow="SOURCE -> C.method(..)" flow="SOURCE, l:38 -> C.method(..)" flow="SOURCE, l:71 -> C.method(..)" flow="'source', l:13 -> C.method(..)"
-SINK(func_obj(c, SOURCE, C)) #$ MISSING: flow="SOURCE -> func_obj(..)" flow="SOURCE, l:38 -> func_obj(..)" flow="SOURCE, l:71 -> func_obj(..)" flow="SOURCE, l:72 -> func_obj(..)" flow="'source', l:13 ->  func_obj()"
+SINK(c.method(SOURCE, C)) #$ flow="SOURCE -> c.method(..)"
+SINK(C.method(c, SOURCE, C)) #$ flow="SOURCE -> C.method(..)"
+SINK(func_obj(c, SOURCE, C)) #$ MISSING: flow="SOURCE -> func_obj(..)"
 
 
 # When an instance method object is created by retrieving a class method object from a class or instance, its __self__ attribute is the class itself, and its __func__ attribute is the function object underlying the class method.
 c_func_obj = C.classmethod.__func__
 
 # When an instance method object is derived from a class method object, the “class instance” stored in __self__ will actually be the class itself, so that calling either x.f(1) or C.f(1) is equivalent to calling f(C,1) where f is the underlying function.
-SINK(c.classmethod(SOURCE)) #$ flow="SOURCE -> c.classmethod(..)" flow="SOURCE, l:38 -> c.classmethod(..)" flow="SOURCE, l:71 -> c.classmethod(..)" flow="SOURCE, l:72 -> c.classmethod(..)" flow="SOURCE, l:73 -> c.classmethod(..)" flow="'source', l:13 -> c.classmethod(..)"
-SINK(C.classmethod(SOURCE)) #$ flow="SOURCE -> C.classmethod(..)" flow="SOURCE, l:38 -> C.classmethod(..)" flow="SOURCE, l:71 -> C.classmethod(..)" flow="SOURCE, l:72 -> C.classmethod(..)" flow="SOURCE, l:73 -> C.classmethod(..)" flow="SOURCE, l:80 -> C.classmethod(..)" flow="'source', l:13 -> C.classmethod(..)"
-SINK(c_func_obj(C, SOURCE)) #$ MISSING: flow="SOURCE -> c_func_obj(..)" flow="SOURCE, l:38 -> c_func_obj(..)" flow="SOURCE, l:71 -> c_func_obj(..)" flow="SOURCE, l:72 -> c_func_obj(..)" flow="SOURCE, l:73 -> c_func_obj(..)" flow="SOURCE, l:80 -> c_func_obj(..)" flow="SOURCE, l:81 -> c_func_obj(..)" flow="'source', l:13 ->  c_func_obj()"
+SINK(c.classmethod(SOURCE)) #$ flow="SOURCE -> c.classmethod(..)"
+SINK(C.classmethod(SOURCE)) #$ flow="SOURCE -> C.classmethod(..)"
+SINK(c_func_obj(C, SOURCE)) #$ MISSING: flow="SOURCE -> c_func_obj(..)"
 
 # Generator functions
 # A function or method which uses the yield statement (see section The yield statement) is called a generator function. Such a function, when called, always returns an iterator object which can be used to execute the body of the function: calling the iterator’s iterator.__next__() method will cause the function to execute until it provides a value using the yield statement. When the function executes a return statement or falls off the end, a StopIteration exception is raised and the iterator will have reached the end of the set of values to be returned.
@@ -156,4 +156,4 @@ customized = Customized()
 SINK(Customized.a)
 SINK_F(Customized.b)
 SINK(customized.a)
-SINK(customized.b)  #$ flow="SOURCE, l:152 -> customized.b" flow="'source', l:13 -> customized.b"
+SINK(customized.b)  #$ flow="SOURCE, l:152 -> customized.b"
diff --git a/python/ql/test/experimental/dataflow/coverage/test.py b/python/ql/test/experimental/dataflow/coverage/test.py
index 616837a9d3b..2a1f7dca58c 100644
--- a/python/ql/test/experimental/dataflow/coverage/test.py
+++ b/python/ql/test/experimental/dataflow/coverage/test.py
@@ -41,7 +41,7 @@ def SINK_F(x):
 def test_tuple_with_local_flow():
     x = (NONSOURCE, SOURCE)
     y = x[1]
-    SINK(y) #$ flow="SOURCE, l:42 -> y" flow="'source', l:20 -> y"
+    SINK(y) #$ flow="SOURCE, l:42 -> y"
 
 
 def test_tuple_negative():
@@ -53,13 +53,13 @@ def test_tuple_negative():
 # 6.2.1. Identifiers (Names)
 def test_names():
     x = SOURCE
-    SINK(x) #$ flow="SOURCE, l:55 -> x" flow="'source', l:20 -> x"
+    SINK(x) #$ flow="SOURCE, l:55 -> x"
 
 
 # 6.2.2. Literals
 def test_string_literal():
     x = "source"
-    SINK(x) #$ flow="'source', l:61 -> x" 
+    SINK(x) #$ flow="'source', l:61 -> x"
 
 
 def test_bytes_literal():
@@ -85,13 +85,13 @@ def test_imagnumber_literal():
 # 6.2.3. Parenthesized forms
 def test_parenthesized_form():
     x = (SOURCE)
-    SINK(x) #$ flow="SOURCE, l:87 -> x" flow="'source', l:20 -> x"
+    SINK(x) #$ flow="SOURCE, l:87 -> x"
 
 
 # 6.2.5. List displays
 def test_list_display():
     x = [SOURCE]
-    SINK(x[0]) #$ flow="SOURCE, l:93 -> x[0]" flow="'source', l:20 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:93 -> x[0]"
 
 
 def test_list_display_negative():
@@ -101,109 +101,109 @@ def test_list_display_negative():
 
 def test_list_comprehension():
     x = [SOURCE for y in [NONSOURCE]]
-    SINK(x[0]) #$ flow="SOURCE, l:103 -> x[0]" flow="'source', l:20 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:103 -> x[0]"
 
 
 def test_list_comprehension_flow():
     x = [y for y in [SOURCE]]
-    SINK(x[0]) #$  flow="SOURCE, l:108 -> x[0]" flow="'source', l:20 -> x[0]"
+    SINK(x[0]) #$  flow="SOURCE, l:108 -> x[0]"
 
 
 def test_list_comprehension_inflow():
     l = [SOURCE]
     x = [y for y in l]
-    SINK(x[0]) #$ flow="SOURCE, l:113 -> x[0]" flow="'source', l:20 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:113 -> x[0]"
 
 
 def test_nested_list_display():
     x = [*[SOURCE]]
-    SINK(x[0]) #$ MISSING:flow="SOURCE, l:119 -> x[0]" MISSING:flow="'source', l:20 -> x[0]"
+    SINK(x[0]) #$ MISSING:flow="SOURCE, l:119 -> x[0]"
 
 
 # 6.2.6. Set displays
 def test_set_display():
     x = {SOURCE}
-    SINK(x.pop()) #$ flow="SOURCE, l:125 -> x.pop()" flow="'source', l:20 -> x.pop()"
+    SINK(x.pop()) #$ flow="SOURCE, l:125 -> x.pop()"
 
 
 def test_set_comprehension():
     x = {SOURCE for y in [NONSOURCE]}
-    SINK(x.pop()) #$ flow="SOURCE, l:130 -> x.pop()" flow="'source', l:20 -> x.pop()"
+    SINK(x.pop()) #$ flow="SOURCE, l:130 -> x.pop()"
 
 
 def test_set_comprehension_flow():
     x = {y for y in [SOURCE]}
-    SINK(x.pop()) #$ flow="SOURCE, l:135 -> x.pop()" flow="'source', l:20 -> x.pop()"
+    SINK(x.pop()) #$ flow="SOURCE, l:135 -> x.pop()"
 
 
 def test_set_comprehension_inflow():
     l = {SOURCE}
     x = {y for y in l}
-    SINK(x.pop()) #$ flow="SOURCE, l:140 -> x.pop()" flow="'source', l:20 -> x.pop()"
+    SINK(x.pop()) #$ flow="SOURCE, l:140 -> x.pop()"
 
 
 def test_nested_set_display():
     x = {*{SOURCE}}
-    SINK(x.pop()) #$ MISSING:flow="SOURCE, l:146 -> x.pop()" MISSING:flow="'source', l:20 -> x.pop()"
+    SINK(x.pop()) #$ MISSING:flow="SOURCE, l:146 -> x.pop()"
 
 
 # 6.2.7. Dictionary displays
 def test_dict_display():
     x = {"s": SOURCE}
-    SINK(x["s"]) #$ flow="SOURCE, l:152 -> x['s']" flow="'source', l:20 -> x['s']"
+    SINK(x["s"]) #$ flow="SOURCE, l:152 -> x['s']"
 
 
 def test_dict_display_pop():
     x = {"s": SOURCE}
-    SINK(x.pop("s")) #$ flow="SOURCE, l:157 -> x.pop(..)" flow="'source', l:20 -> x.pop(..)"
+    SINK(x.pop("s")) #$ flow="SOURCE, l:157 -> x.pop(..)"
 
 
 def test_dict_comprehension():
     x = {y: SOURCE for y in ["s"]}
-    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:152 -> x['s']" MISING:flow="'source', l:20 -> x['s']"
+    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:152 -> x['s']"
 
 
 def test_dict_comprehension_pop():
     x = {y: SOURCE for y in ["s"]}
-    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:167 -> x.pop()" MISSING:flow="'source', l:20 -> x.pop()"
+    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:167 -> x.pop()"
 
 
 def test_nested_dict_display():
     x = {**{"s": SOURCE}}
-    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:172 -> x['s']" MISING:flow="'source', l:20 -> x['s']"
+    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:172 -> x['s']"
 
 
 def test_nested_dict_display_pop():
     x = {**{"s": SOURCE}}
-    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:177 -> x.pop()" MISSING:flow="'source', l:20 -> x.pop()"
+    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:177 -> x.pop()"
 
 
 # Nested comprehensions
 def test_nested_comprehension():
     x = [y for z in [[SOURCE]] for y in z]
-    SINK(x[0]) #$ flow="SOURCE, l:183 -> x[0]" flow="'source', l:20 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:183 -> x[0]"
 
 
 def test_nested_comprehension_deep_with_local_flow():
     x = [y for v in [[[[SOURCE]]]] for u in v for z in u for y in z]
-    SINK(x[0]) #$ flow="SOURCE, l:188 -> x[0]" flow="'source', l:20 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:188 -> x[0]"
 
 
 def test_nested_comprehension_dict():
     d = {"s": [SOURCE]}
     x = [y for k, v in d.items() for y in v]
-    SINK(x[0]) #$ MISSING:flow="SOURCE, l:193 -> x[0]" MISING:flow="'source', l:20 -> x[0]"
+    SINK(x[0]) #$ MISSING:flow="SOURCE, l:193 -> x[0]"
 
 
 def test_nested_comprehension_paren():
     x = [y for y in (z for z in [SOURCE])]
-    SINK(x[0]) #$ flow="SOURCE, l:199 -> x[0]" flow="'source', l:20 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:199 -> x[0]"
 
 
 # 6.2.8. Generator expressions
 def test_generator():
     x = (SOURCE for y in [NONSOURCE])
-    SINK([*x][0]) #$ MISSING:flow="SOURCE, l:205 -> List[0]" MISING:flow="'source', l:20 -> List[0]"
+    SINK([*x][0]) #$ MISSING:flow="SOURCE, l:205 -> List[0]"
 
 
 # 6.2.9. Yield expressions
@@ -213,7 +213,7 @@ def gen(x):
 
 def test_yield():
     g = gen(SOURCE)
-    SINK(next(g)) #$ MISSING:flow="SOURCE, l:215 -> next()" MISING:flow="'source', l:20 -> next()"
+    SINK(next(g)) #$ MISSING:flow="SOURCE, l:215 -> next()"
 
 
 def gen_from(x):
@@ -222,19 +222,19 @@ def gen_from(x):
 
 def test_yield_from():
     g = gen_from(SOURCE)
-    SINK(next(g)) #$ MISSING:flow="SOURCE, l:224 -> next()" MISING:flow="'source', l:20 -> next()"
+    SINK(next(g)) #$ MISSING:flow="SOURCE, l:224 -> next()"
 
 
 # a statement rather than an expression, but related to generators
 def test_for():
     for x in gen(SOURCE):
-        SINK(x) #$ MISSING:flow="SOURCE, l:230 -> x" MISING:flow="'source', l:20 -> x"
+        SINK(x) #$ MISSING:flow="SOURCE, l:230 -> x"
 
 
 # 6.2.9.1. Generator-iterator methods
 def test___next__():
     g = gen(SOURCE)
-    SINK(g.__next__()) #$ MISSING:flow="SOURCE, l:236 -> g.__next__()" MISSING:flow="'source', l:20 -> g.__next__()"
+    SINK(g.__next__()) #$ MISSING:flow="SOURCE, l:236 -> g.__next__()"
 
 
 def gen2(x):
@@ -246,7 +246,7 @@ def gen2(x):
 def test_send():
     g = gen2(NONSOURCE)
     n = next(g)
-    SINK(g.send(SOURCE)) #$ MISSING:flow="SOURCE -> g.send()" MISSING:flow="'source', l:20 -> g.send()"
+    SINK(g.send(SOURCE)) #$ MISSING:flow="SOURCE -> g.send()"
 
 
 def gen_ex(x):
@@ -259,7 +259,7 @@ def gen_ex(x):
 def test_throw():
     g = gen_ex(SOURCE)
     n = next(g)
-    SINK(g.throw(TypeError)) #$ MISSING:flow="SOURCE, l:260 -> g.throw()" MISSING:flow="'source', l:20 -> g.throw()"
+    SINK(g.throw(TypeError)) #$ MISSING:flow="SOURCE, l:260 -> g.throw()"
 
 
 # no `test_close` as `close` involves no data flow
@@ -280,7 +280,7 @@ def runa(a):
 
 async def atest___anext__():
     g = agen(SOURCE)
-    SINK(await g.__anext__()) #$ MISSING:flow="SOURCE, l:282 -> g.__anext__()" MISSING:flow="'source', l:20 -> g.__anext__()"
+    SINK(await g.__anext__()) #$ MISSING:flow="SOURCE, l:282 -> g.__anext__()"
 
 
 def test___anext__():
@@ -296,7 +296,7 @@ async def agen2(x):
 async def atest_asend():
     g = agen2(NONSOURCE)
     n = await g.__anext__()
-    SINK(await g.asend(SOURCE)) #$ MISSING:flow="SOURCE -> g.asend()" MISSING:flow="'source', l:20 -> g.asend()"
+    SINK(await g.asend(SOURCE)) #$ MISSING:flow="SOURCE -> g.asend()"
 
 
 def test_asend():
@@ -313,7 +313,7 @@ async def agen_ex(x):
 async def atest_athrow():
     g = agen_ex(SOURCE)
     n = await g.__anext__()
-    SINK(await g.athrow(TypeError)) #$ MISSING:flow="SOURCE, l:314 -> g.athrow()" MISSING:flow="'source', l:20 -> g.athrow()"
+    SINK(await g.athrow(TypeError)) #$ MISSING:flow="SOURCE, l:314 -> g.athrow()"
 
 
 def test_athrow():
@@ -326,22 +326,22 @@ class C:
 
 
 def test_attribute_reference():
-    SINK(C.a) #$ MISSING:flow="SOURCE, l:325 -> C.a" MISSING:flow="'source', l:20 -> C.a"
+    SINK(C.a) #$ MISSING:flow="SOURCE, l:325 -> C.a"
 
 
 # overriding __getattr__ should be tested by the class coverage tests
 
 # 6.3.2. Subscriptions
 def test_subscription_tuple():
-    SINK((SOURCE,)[0]) #$ flow="SOURCE -> Tuple[0]" flow="'source', l:20 -> Tuple[0]"
+    SINK((SOURCE,)[0]) #$ flow="SOURCE -> Tuple[0]"
 
 
 def test_subscription_list():
-    SINK([SOURCE][0]) #$ flow="SOURCE -> List[0]" flow="'source', l:20 -> List[0]"
+    SINK([SOURCE][0]) #$ flow="SOURCE -> List[0]"
 
 
 def test_subscription_mapping():
-    SINK({"s": SOURCE}["s"]) #$ flow="SOURCE -> Dict['s']" flow="'source', l:20 -> Dict['s']"
+    SINK({"s": SOURCE}["s"]) #$ flow="SOURCE -> Dict['s']"
 
 
 # overriding __getitem__ should be tested by the class coverage tests
@@ -353,7 +353,7 @@ l = [SOURCE]
 
 def test_slicing():
     s = l[0:1:1]
-    SINK(s[0]) #$ MISSING:flow="SOURCE -> s[0]" MISSING:flow="'source', l:20 -> s[0]"
+    SINK(s[0]) #$ MISSING:flow="SOURCE -> s[0]"
 
 
 # The grammar seems to allow `l[0:1:1, 0:1]`, but the interpreter does not like it
@@ -364,7 +364,7 @@ def second(a, b):
 
 
 def test_call_positional():
-    SINK(second(NONSOURCE, SOURCE)) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
+    SINK(second(NONSOURCE, SOURCE)) #$ flow="SOURCE -> second(..)"
 
 
 def test_call_positional_negative():
@@ -372,7 +372,7 @@ def test_call_positional_negative():
 
 
 def test_call_keyword():
-    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
+    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> second(..)"
 
 
 def test_call_unpack_iterable():
@@ -380,7 +380,7 @@ def test_call_unpack_iterable():
 
 
 def test_call_unpack_mapping():
-    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
+    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="SOURCE -> second(..)"
 
 
 def f_extra_pos(a, *b):
@@ -388,7 +388,7 @@ def f_extra_pos(a, *b):
 
 
 def test_call_extra_pos():
-    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="SOURCE -> f_extra_pos(..)" flow="'source', l:20 -> f_extra_pos(..)"
+    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="SOURCE -> f_extra_pos(..)"
 
 
 def f_extra_keyword(a, **b):
@@ -396,7 +396,7 @@ def f_extra_keyword(a, **b):
 
 
 def test_call_extra_keyword():
-    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> f_extra_keyword(..)" flow="'source', l:20 -> f_extra_keyword(..)"
+    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> f_extra_keyword(..)"
 
 
 # return the name of the first extra keyword argument
@@ -406,18 +406,18 @@ def f_extra_keyword_flow(**a):
 
 # call the function with our source as the name of the keyword arguemnt
 def test_call_extra_keyword_flow():
-    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="SOURCE -> f_extra_keyword(..)" MISSING:flow="'source', l:20 -> f_extra_keyword(..)"
+    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="SOURCE -> f_extra_keyword(..)"
 
 
 # 6.12. Assignment expressions
 def test_assignment_expression():
     x = NONSOURCE
-    SINK(x := SOURCE) #$ MISSING:flow="SOURCE -> x" MISSING:flow="'source', l:20 -> x"
+    SINK(x := SOURCE) #$ MISSING:flow="SOURCE -> x"
 
 
 # 6.13. Conditional expressions
 def test_conditional_true():
-    SINK(SOURCE if True else NONSOURCE) #$ flow="SOURCE -> IfExp" flow="'source', l:20 -> IfExp"
+    SINK(SOURCE if True else NONSOURCE) #$ flow="SOURCE -> IfExp"
 
 
 def test_conditional_true_guards():
@@ -425,7 +425,7 @@ def test_conditional_true_guards():
 
 
 def test_conditional_false():
-    SINK(NONSOURCE if False else SOURCE) #$ flow="SOURCE -> IfExp" flow="'source', l:20 -> IfExp"
+    SINK(NONSOURCE if False else SOURCE) #$ flow="SOURCE -> IfExp"
 
 
 def test_conditional_false_guards():
@@ -435,13 +435,13 @@ def test_conditional_false_guards():
 # Condition is evaluated first, so x is SOURCE once chosen
 def test_conditional_evaluation_true():
     x = NONSOURCE
-    SINK(x if (SOURCE == (x := SOURCE)) else NONSOURCE) #$ MISSING:flow="SOURCE -> IfExp" MISSING:flow="'source', l:20 -> IfExp"
+    SINK(x if (SOURCE == (x := SOURCE)) else NONSOURCE) #$ MISSING:flow="SOURCE -> IfExp"
 
 
 # Condition is evaluated first, so x is SOURCE once chosen
 def test_conditional_evaluation_false():
     x = NONSOURCE
-    SINK(NONSOURCE if (NONSOURCE == (x := SOURCE)) else x) #$ MISSING:flow="SOURCE -> IfExp" MISSING:flow="'source', l:20 -> IfExp"
+    SINK(NONSOURCE if (NONSOURCE == (x := SOURCE)) else x) #$ MISSING:flow="SOURCE -> IfExp"
 
 
 # 6.14. Lambdas
@@ -449,14 +449,14 @@ def test_lambda():
     def f(x):
         return x
 
-    SINK(f(SOURCE)) #$ flow="SOURCE -> f(..)" flow="'source', l:20 -> f(..)"
+    SINK(f(SOURCE)) #$ flow="SOURCE -> f(..)"
 
 
 def test_lambda_positional():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, SOURCE)) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
+    SINK(second(NONSOURCE, SOURCE)) #$ flow="SOURCE -> second(..)"
 
 
 def test_lambda_positional_negative():
@@ -470,50 +470,50 @@ def test_lambda_keyword():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
+    SINK(second(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> second(..)"
 
 
 def test_lambda_unpack_iterable():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="SOURCE -> second(..)" MISSING:flow="'source', l:20 -> second(..)"  # Flow missing
+    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="SOURCE -> second(..)"  # Flow missing
 
 
 def test_lambda_unpack_mapping():
     def second(a, b):
         return b
 
-    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="SOURCE -> second(..)" flow="'source', l:20 -> second(..)"
+    SINK(second(NONSOURCE, **{"b": SOURCE})) #$ flow="SOURCE -> second(..)"
 
 
 def test_lambda_extra_pos():
     f_extra_pos = lambda a, *b: b[0]
-    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="SOURCE -> f_extra_pos(..)" flow="'source', l:20 -> f_extra_pos(..)"
+    SINK(f_extra_pos(NONSOURCE, SOURCE)) #$ flow="SOURCE -> f_extra_pos(..)"
 
 
 def test_lambda_extra_keyword():
     f_extra_keyword = lambda a, **b: b["b"]
-    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> f_extra_keyword(..)" flow="'source', l:20 -> f_extra_keyword(..)"
+    SINK(f_extra_keyword(NONSOURCE, b=SOURCE)) #$ flow="SOURCE -> f_extra_keyword(..)"
 
 
 # call the function with our source as the name of the keyword argument
 def test_lambda_extra_keyword_flow():
     # return the name of the first extra keyword argument
     f_extra_keyword_flow = lambda **a: [*a][0]
-    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="SOURCE -> f_extra_keyword(..)" MISSING:flow="'source', l:20 -> f_extra_keyword(..)"
+    SINK(f_extra_keyword_flow(**{SOURCE: None})) #$ MISSING:flow="SOURCE -> f_extra_keyword(..)"
 
 
 @expects(4)
 def test_swap():
     a = SOURCE
     b = NONSOURCE
-    SINK(a) #$ flow="SOURCE, l:509 -> a" flow="'source', l:20 -> a"
+    SINK(a) #$ flow="SOURCE, l:509 -> a"
     SINK_F(b)
 
     a, b = b, a
     SINK_F(a)
-    SINK(b) #$ flow="SOURCE, l:509 -> b" flow="'source', l:20 -> b"
+    SINK(b) #$ flow="SOURCE, l:509 -> b"
 
 
 def test_deep_callgraph():
@@ -538,7 +538,7 @@ def test_deep_callgraph():
         return f5(arg)
 
     x = f6(SOURCE)
-    SINK(x) #$ MISSING:flow="SOURCE, l:540 -> x" MISING:flow="'source', l:20 -> x"
+    SINK(x) #$ MISSING:flow="SOURCE, l:540 -> x"
 
 
 @expects(2)
diff --git a/python/ql/test/experimental/dataflow/fieldflow/dataflow.expected b/python/ql/test/experimental/dataflow/fieldflow/dataflow.expected
index 168ff7e66ce..2301e52f08f 100644
--- a/python/ql/test/experimental/dataflow/fieldflow/dataflow.expected
+++ b/python/ql/test/experimental/dataflow/fieldflow/dataflow.expected
@@ -1,34 +1,17 @@
 edges
 | examples.py:27:8:27:12 | [post arg] ControlFlowNode for myobj [Attribute foo] | examples.py:28:6:28:10 | ControlFlowNode for myobj [Attribute foo] |
 | examples.py:27:15:27:20 | ControlFlowNode for SOURCE | examples.py:27:8:27:12 | [post arg] ControlFlowNode for myobj [Attribute foo] |
-| examples.py:27:15:27:20 | ControlFlowNode for SOURCE | examples.py:35:13:35:13 | ControlFlowNode for x |
-| examples.py:27:15:27:20 | ControlFlowNode for SOURCE | examples.py:49:13:49:18 | ControlFlowNode for SOURCE |
-| examples.py:27:15:27:20 | ControlFlowNode for SOURCE | examples.py:59:29:59:34 | ControlFlowNode for SOURCE |
 | examples.py:28:6:28:10 | ControlFlowNode for myobj [Attribute foo] | examples.py:28:6:28:14 | ControlFlowNode for Attribute |
 | examples.py:31:5:31:10 | ControlFlowNode for SOURCE | examples.py:35:13:35:13 | ControlFlowNode for x |
-| examples.py:31:5:31:10 | ControlFlowNode for SOURCE | examples.py:49:13:49:18 | ControlFlowNode for SOURCE |
-| examples.py:31:5:31:10 | ControlFlowNode for SOURCE | examples.py:59:29:59:34 | ControlFlowNode for SOURCE |
 | examples.py:35:1:35:1 | [post read] ControlFlowNode for a [Attribute obj, Attribute foo] | examples.py:37:6:37:6 | ControlFlowNode for a [Attribute obj, Attribute foo] |
 | examples.py:35:1:35:5 | [post store] ControlFlowNode for Attribute [Attribute foo] | examples.py:35:1:35:1 | [post read] ControlFlowNode for a [Attribute obj, Attribute foo] |
 | examples.py:35:13:35:13 | ControlFlowNode for x | examples.py:35:1:35:5 | [post store] ControlFlowNode for Attribute [Attribute foo] |
 | examples.py:37:6:37:6 | ControlFlowNode for a [Attribute obj, Attribute foo] | examples.py:37:6:37:10 | ControlFlowNode for Attribute [Attribute foo] |
 | examples.py:37:6:37:10 | ControlFlowNode for Attribute [Attribute foo] | examples.py:37:6:37:14 | ControlFlowNode for Attribute |
-| examples.py:40:5:40:10 | ControlFlowNode for SOURCE | examples.py:49:13:49:18 | ControlFlowNode for SOURCE |
-| examples.py:40:5:40:10 | ControlFlowNode for SOURCE | examples.py:59:29:59:34 | ControlFlowNode for SOURCE |
 | examples.py:49:7:49:19 | ControlFlowNode for MyObj() [Attribute foo] | examples.py:50:6:50:8 | ControlFlowNode for obj [Attribute foo] |
 | examples.py:49:13:49:18 | ControlFlowNode for SOURCE | examples.py:49:7:49:19 | ControlFlowNode for MyObj() [Attribute foo] |
-| examples.py:49:13:49:18 | ControlFlowNode for SOURCE | examples.py:59:29:59:34 | ControlFlowNode for SOURCE |
 | examples.py:50:6:50:8 | ControlFlowNode for obj [Attribute foo] | examples.py:50:6:50:12 | ControlFlowNode for Attribute |
 | examples.py:59:29:59:34 | ControlFlowNode for SOURCE | examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:49:19:49:24 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:56:18:56:23 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:61:9:61:14 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:71:9:71:14 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:81:17:81:22 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:86:21:86:26 | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | test.py:97:33:97:38 | ControlFlowNode for SOURCE |
-| test.py:3:1:3:6 | GSSA Variable SOURCE | test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test |
-| test.py:3:10:3:17 | ControlFlowNode for Str | test.py:3:1:3:6 | GSSA Variable SOURCE |
 | test.py:49:12:49:16 | [post arg] ControlFlowNode for myobj [Attribute foo] | test.py:50:10:50:14 | ControlFlowNode for myobj [Attribute foo] |
 | test.py:49:19:49:24 | ControlFlowNode for SOURCE | test.py:49:12:49:16 | [post arg] ControlFlowNode for myobj [Attribute foo] |
 | test.py:50:10:50:14 | ControlFlowNode for myobj [Attribute foo] | test.py:50:10:50:18 | ControlFlowNode for Attribute |
@@ -66,16 +49,12 @@ nodes
 | examples.py:37:6:37:6 | ControlFlowNode for a [Attribute obj, Attribute foo] | semmle.label | ControlFlowNode for a [Attribute obj, Attribute foo] |
 | examples.py:37:6:37:10 | ControlFlowNode for Attribute [Attribute foo] | semmle.label | ControlFlowNode for Attribute [Attribute foo] |
 | examples.py:37:6:37:14 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
-| examples.py:40:5:40:10 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 | examples.py:49:7:49:19 | ControlFlowNode for MyObj() [Attribute foo] | semmle.label | ControlFlowNode for MyObj() [Attribute foo] |
 | examples.py:49:13:49:18 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 | examples.py:50:6:50:8 | ControlFlowNode for obj [Attribute foo] | semmle.label | ControlFlowNode for obj [Attribute foo] |
 | examples.py:50:6:50:12 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
 | examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | semmle.label | ControlFlowNode for fields_with_local_flow() |
 | examples.py:59:29:59:34 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:0:0:0:0 | ModuleVariableNode for Global Variable SOURCE in Module test | semmle.label | ModuleVariableNode for Global Variable SOURCE in Module test |
-| test.py:3:1:3:6 | GSSA Variable SOURCE | semmle.label | GSSA Variable SOURCE |
-| test.py:3:10:3:17 | ControlFlowNode for Str | semmle.label | ControlFlowNode for Str |
 | test.py:49:12:49:16 | [post arg] ControlFlowNode for myobj [Attribute foo] | semmle.label | [post arg] ControlFlowNode for myobj [Attribute foo] |
 | test.py:49:19:49:24 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 | test.py:50:10:50:14 | ControlFlowNode for myobj [Attribute foo] | semmle.label | ControlFlowNode for myobj [Attribute foo] |
@@ -110,28 +89,13 @@ nodes
 | test.py:97:33:97:38 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 #select
 | examples.py:28:6:28:14 | ControlFlowNode for Attribute | examples.py:27:15:27:20 | ControlFlowNode for SOURCE | examples.py:28:6:28:14 | ControlFlowNode for Attribute | Flow found |
-| examples.py:37:6:37:14 | ControlFlowNode for Attribute | examples.py:27:15:27:20 | ControlFlowNode for SOURCE | examples.py:37:6:37:14 | ControlFlowNode for Attribute | Flow found |
 | examples.py:37:6:37:14 | ControlFlowNode for Attribute | examples.py:31:5:31:10 | ControlFlowNode for SOURCE | examples.py:37:6:37:14 | ControlFlowNode for Attribute | Flow found |
-| examples.py:50:6:50:12 | ControlFlowNode for Attribute | examples.py:27:15:27:20 | ControlFlowNode for SOURCE | examples.py:50:6:50:12 | ControlFlowNode for Attribute | Flow found |
-| examples.py:50:6:50:12 | ControlFlowNode for Attribute | examples.py:31:5:31:10 | ControlFlowNode for SOURCE | examples.py:50:6:50:12 | ControlFlowNode for Attribute | Flow found |
-| examples.py:50:6:50:12 | ControlFlowNode for Attribute | examples.py:40:5:40:10 | ControlFlowNode for SOURCE | examples.py:50:6:50:12 | ControlFlowNode for Attribute | Flow found |
 | examples.py:50:6:50:12 | ControlFlowNode for Attribute | examples.py:49:13:49:18 | ControlFlowNode for SOURCE | examples.py:50:6:50:12 | ControlFlowNode for Attribute | Flow found |
-| examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | examples.py:27:15:27:20 | ControlFlowNode for SOURCE | examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | Flow found |
-| examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | examples.py:31:5:31:10 | ControlFlowNode for SOURCE | examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | Flow found |
-| examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | examples.py:40:5:40:10 | ControlFlowNode for SOURCE | examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | Flow found |
-| examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | examples.py:49:13:49:18 | ControlFlowNode for SOURCE | examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | Flow found |
 | examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | examples.py:59:29:59:34 | ControlFlowNode for SOURCE | examples.py:59:6:59:35 | ControlFlowNode for fields_with_local_flow() | Flow found |
-| test.py:50:10:50:18 | ControlFlowNode for Attribute | test.py:3:10:3:17 | ControlFlowNode for Str | test.py:50:10:50:18 | ControlFlowNode for Attribute | Flow found |
 | test.py:50:10:50:18 | ControlFlowNode for Attribute | test.py:49:19:49:24 | ControlFlowNode for SOURCE | test.py:50:10:50:18 | ControlFlowNode for Attribute | Flow found |
-| test.py:57:10:57:18 | ControlFlowNode for Attribute | test.py:3:10:3:17 | ControlFlowNode for Str | test.py:57:10:57:18 | ControlFlowNode for Attribute | Flow found |
 | test.py:57:10:57:18 | ControlFlowNode for Attribute | test.py:56:18:56:23 | ControlFlowNode for SOURCE | test.py:57:10:57:18 | ControlFlowNode for Attribute | Flow found |
-| test.py:67:10:67:18 | ControlFlowNode for Attribute | test.py:3:10:3:17 | ControlFlowNode for Str | test.py:67:10:67:18 | ControlFlowNode for Attribute | Flow found |
 | test.py:67:10:67:18 | ControlFlowNode for Attribute | test.py:61:9:61:14 | ControlFlowNode for SOURCE | test.py:67:10:67:18 | ControlFlowNode for Attribute | Flow found |
-| test.py:77:10:77:18 | ControlFlowNode for Attribute | test.py:3:10:3:17 | ControlFlowNode for Str | test.py:77:10:77:18 | ControlFlowNode for Attribute | Flow found |
 | test.py:77:10:77:18 | ControlFlowNode for Attribute | test.py:71:9:71:14 | ControlFlowNode for SOURCE | test.py:77:10:77:18 | ControlFlowNode for Attribute | Flow found |
-| test.py:82:10:82:16 | ControlFlowNode for Attribute | test.py:3:10:3:17 | ControlFlowNode for Str | test.py:82:10:82:16 | ControlFlowNode for Attribute | Flow found |
 | test.py:82:10:82:16 | ControlFlowNode for Attribute | test.py:81:17:81:22 | ControlFlowNode for SOURCE | test.py:82:10:82:16 | ControlFlowNode for Attribute | Flow found |
-| test.py:87:10:87:16 | ControlFlowNode for Attribute | test.py:3:10:3:17 | ControlFlowNode for Str | test.py:87:10:87:16 | ControlFlowNode for Attribute | Flow found |
 | test.py:87:10:87:16 | ControlFlowNode for Attribute | test.py:86:21:86:26 | ControlFlowNode for SOURCE | test.py:87:10:87:16 | ControlFlowNode for Attribute | Flow found |
-| test.py:97:10:97:39 | ControlFlowNode for fields_with_local_flow() | test.py:3:10:3:17 | ControlFlowNode for Str | test.py:97:10:97:39 | ControlFlowNode for fields_with_local_flow() | Flow found |
 | test.py:97:10:97:39 | ControlFlowNode for fields_with_local_flow() | test.py:97:33:97:38 | ControlFlowNode for SOURCE | test.py:97:10:97:39 | ControlFlowNode for fields_with_local_flow() | Flow found |
diff --git a/python/ql/test/experimental/dataflow/testConfig.qll b/python/ql/test/experimental/dataflow/testConfig.qll
index 43fdb48876f..90bd1d47978 100644
--- a/python/ql/test/experimental/dataflow/testConfig.qll
+++ b/python/ql/test/experimental/dataflow/testConfig.qll
@@ -44,5 +44,7 @@ class TestConfiguration extends DataFlow::Configuration {
     )
   }
 
-  override int explorationLimit() { result = 4 }
+  override predicate isBarrierIn(DataFlow::Node node) { this.isSource(node) }
+
+  override int explorationLimit() { result = 5 }
 }

From 6cafb281b5d686ffc717a2076ea710edcda48b42 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 19 Jan 2021 09:45:24 +0100
Subject: [PATCH 202/343] C#: Remove leftover DB upgrade folder

---
 csharp/upgrades/to_change/upgrade.properties | 2 --
 1 file changed, 2 deletions(-)
 delete mode 100644 csharp/upgrades/to_change/upgrade.properties

diff --git a/csharp/upgrades/to_change/upgrade.properties b/csharp/upgrades/to_change/upgrade.properties
deleted file mode 100644
index ff3b5413d2c..00000000000
--- a/csharp/upgrades/to_change/upgrade.properties
+++ /dev/null
@@ -1,2 +0,0 @@
-description: Add 'relational_pattern_expr' and its four subtypes ('<', '>', '<=', '>=')
-compatibility: backwards

From a5632b272ed3906423dd9da0eb5db3a74ca6d888 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 18 Jan 2021 14:52:35 +0000
Subject: [PATCH 203/343] C++: Fix performance issue in hasTaintFlow / 
 hasDataFlow.

---
 cpp/ql/src/semmle/code/cpp/models/interfaces/DataFlow.qll | 1 +
 cpp/ql/src/semmle/code/cpp/models/interfaces/Taint.qll    | 1 +
 2 files changed, 2 insertions(+)

diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/DataFlow.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/DataFlow.qll
index c1b65d62706..b30861254dc 100644
--- a/cpp/ql/src/semmle/code/cpp/models/interfaces/DataFlow.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/DataFlow.qll
@@ -24,5 +24,6 @@ abstract class DataFlowFunction extends Function {
    * represented by `input` to the return value or buffer represented by
    * `output`
    */
+  pragma[nomagic]
   abstract predicate hasDataFlow(FunctionInput input, FunctionOutput output);
 }
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/Taint.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/Taint.qll
index fe617533f59..05a5d9f1c28 100644
--- a/cpp/ql/src/semmle/code/cpp/models/interfaces/Taint.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/Taint.qll
@@ -28,5 +28,6 @@ abstract class TaintFunction extends Function {
    * Holds if data passed into the argument, qualifier, or buffer represented by
    * `input` influences the return value or buffer represented by `output`
    */
+  pragma[nomagic]
   abstract predicate hasTaintFlow(FunctionInput input, FunctionOutput output);
 }

From b8e6ad89221415c0dc2501850896bbe6b0414ae6 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 18 Jan 2021 17:27:26 +0000
Subject: [PATCH 204/343] C++: Introduce new predicate for better performance
 in models.

---
 cpp/ql/src/semmle/code/cpp/Function.qll              | 12 ++++++++++++
 .../code/cpp/models/implementations/StdString.qll    |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Function.qll b/cpp/ql/src/semmle/code/cpp/Function.qll
index 560ddfbd4c8..7bda4559c61 100644
--- a/cpp/ql/src/semmle/code/cpp/Function.qll
+++ b/cpp/ql/src/semmle/code/cpp/Function.qll
@@ -334,6 +334,18 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
     )
   }
 
+  /**
+   * Gets the class of which this function, called `name`, is a member.
+   *
+   * Prefer to use `getDeclaringType()` or `getName()` directly if you do not
+   * need to reason about both.
+   */
+  pragma[nomagic]
+  Class getClassAndName(string myName) {
+    this.hasName(myName) and
+    this.getDeclaringType() = result
+  }
+
   /**
    * Implements `ControlFlowNode.getControlFlowScope`. The `Function` is
    * used to represent the exit node of the control flow graph, so it is
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index effef9eef35..5c902cedd42 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -69,7 +69,7 @@ private class StdStringConstructor extends Constructor, TaintFunction {
  * The `std::string` function `c_str`.
  */
 private class StdStringCStr extends TaintFunction {
-  StdStringCStr() { this.getDeclaringType() instanceof StdBasicString and this.hasName("c_str") }
+  StdStringCStr() { this.getClassAndName("c_str") instanceof StdBasicString }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value

From bfef1a200eb727da0f72afb257182017477499bd Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 18 Jan 2021 17:54:05 +0000
Subject: [PATCH 205/343] C++: Apply the new pattern in other parts of
 StdString.qll where it matters.

---
 .../cpp/models/implementations/StdString.qll  | 35 ++++++-------------
 1 file changed, 11 insertions(+), 24 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 5c902cedd42..9a733cb3eed 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -82,7 +82,7 @@ private class StdStringCStr extends TaintFunction {
  * The `std::string` function `data`.
  */
 private class StdStringData extends TaintFunction {
-  StdStringData() { this.getDeclaringType() instanceof StdBasicString and this.hasName("data") }
+  StdStringData() { this.getClassAndName("data") instanceof StdBasicString }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value
@@ -100,10 +100,7 @@ private class StdStringData extends TaintFunction {
  * The `std::string` function `push_back`.
  */
 private class StdStringPush extends TaintFunction {
-  StdStringPush() {
-    this.getDeclaringType() instanceof StdBasicString and
-    this.hasName("push_back")
-  }
+  StdStringPush() { this.getClassAndName("push_back") instanceof StdBasicString }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from parameter to qualifier
@@ -196,7 +193,7 @@ private class StdStringAppend extends TaintFunction {
  * The standard function `std::string.assign`.
  */
 private class StdStringAssign extends TaintFunction {
-  StdStringAssign() { this.getDeclaringType() instanceof StdBasicString and this.hasName("assign") }
+  StdStringAssign() { this.getClassAndName("assign") instanceof StdBasicString }
 
   /**
    * Gets the index of a parameter to this function that is a string (or
@@ -236,7 +233,7 @@ private class StdStringAssign extends TaintFunction {
  * The standard function `std::string.copy`.
  */
 private class StdStringCopy extends TaintFunction {
-  StdStringCopy() { this.getDeclaringType() instanceof StdBasicString and this.hasName("copy") }
+  StdStringCopy() { this.getClassAndName("copy") instanceof StdBasicString }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // copy(dest, num, pos)
@@ -249,7 +246,7 @@ private class StdStringCopy extends TaintFunction {
  * The standard function `std::string.substr`.
  */
 private class StdStringSubstr extends TaintFunction {
-  StdStringSubstr() { this.getDeclaringType() instanceof StdBasicString and this.hasName("substr") }
+  StdStringSubstr() { this.getClassAndName("substr") instanceof StdBasicString }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // substr(pos, num)
@@ -295,9 +292,7 @@ private class StdBasicIStream extends ClassTemplateInstantiation {
  * The `std::istream` function `operator>>` (defined as a member function).
  */
 private class StdIStreamIn extends DataFlowFunction, TaintFunction {
-  StdIStreamIn() {
-    this.getDeclaringType() instanceof StdBasicIStream and this.hasName("operator>>")
-  }
+  StdIStreamIn() { this.getClassAndName("operator>>") instanceof StdBasicIStream }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -390,9 +385,7 @@ private class StdIStreamRead extends DataFlowFunction, TaintFunction {
  * The `std::istream` function `readsome`.
  */
 private class StdIStreamReadSome extends TaintFunction {
-  StdIStreamReadSome() {
-    this.getDeclaringType() instanceof StdBasicIStream and this.hasName("readsome")
-  }
+  StdIStreamReadSome() { this.getClassAndName("readsome") instanceof StdBasicIStream }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to first parameter
@@ -405,9 +398,7 @@ private class StdIStreamReadSome extends TaintFunction {
  * The `std::istream` function `putback`.
  */
 private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
-  StdIStreamPutBack() {
-    this.getDeclaringType() instanceof StdBasicIStream and this.hasName("putback")
-  }
+  StdIStreamPutBack() { this.getClassAndName("putback") instanceof StdBasicIStream }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -440,9 +431,7 @@ private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
  * The `std::istream` function `getline`.
  */
 private class StdIStreamGetLine extends DataFlowFunction, TaintFunction {
-  StdIStreamGetLine() {
-    this.getDeclaringType() instanceof StdBasicIStream and this.hasName("getline")
-  }
+  StdIStreamGetLine() { this.getClassAndName("getline") instanceof StdBasicIStream }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     // returns reference to `*this`
@@ -587,9 +576,7 @@ private class StdStringStreamConstructor extends Constructor, TaintFunction {
  * The `std::stringstream` function `str`.
  */
 private class StdStringStreamStr extends TaintFunction {
-  StdStringStreamStr() {
-    this.getDeclaringType() instanceof StdBasicStringStream and this.hasName("str")
-  }
+  StdStringStreamStr() { this.getClassAndName("str") instanceof StdBasicStringStream }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to return value (if any)
@@ -620,7 +607,7 @@ private class StdStreamFunction extends DataFlowFunction, TaintFunction {
     or
     this.getDeclaringType() instanceof StdBasicOStream and this.hasName(["seekp", "flush"])
     or
-    this.getDeclaringType() instanceof StdBasicIOS and this.hasName("copyfmt")
+    this.getClassAndName("copyfmt") instanceof StdBasicIOS
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {

From f8a1fb1c3515f4673007f01ae0b4f0b7cb45e988 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 18 Jan 2021 17:56:27 +0000
Subject: [PATCH 206/343] C++: Apply the new pattern where it doesn't matter
 for performance as well, for consistency.

---
 .../cpp/models/implementations/StdString.qll  | 25 ++++++-------------
 1 file changed, 8 insertions(+), 17 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index 9a733cb3eed..e0786074f2d 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -113,9 +113,7 @@ private class StdStringPush extends TaintFunction {
  * The `std::string` functions `front` and `back`.
  */
 private class StdStringFrontBack extends TaintFunction {
-  StdStringFrontBack() {
-    this.getDeclaringType() instanceof StdBasicString and this.hasName(["front", "back"])
-  }
+  StdStringFrontBack() { this.getClassAndName(["front", "back"]) instanceof StdBasicString }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from object to returned reference
@@ -150,8 +148,7 @@ private class StdStringPlus extends TaintFunction {
  */
 private class StdStringAppend extends TaintFunction {
   StdStringAppend() {
-    this.getDeclaringType() instanceof StdBasicString and
-    this.hasName(["operator+=", "append", "insert", "replace"])
+    this.getClassAndName(["operator+=", "append", "insert", "replace"]) instanceof StdBasicString
   }
 
   /**
@@ -266,9 +263,7 @@ private class StdBasicStringStream extends ClassTemplateInstantiation {
  * The `std::string` functions `at` and `operator[]`.
  */
 private class StdStringAt extends TaintFunction {
-  StdStringAt() {
-    this.getDeclaringType() instanceof StdBasicString and this.hasName(["at", "operator[]"])
-  }
+  StdStringAt() { this.getClassAndName(["at", "operator[]"]) instanceof StdBasicString }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from qualifier to referenced return value
@@ -342,8 +337,7 @@ private class StdIStreamInNonMember extends DataFlowFunction, TaintFunction {
  */
 private class StdIStreamGet extends TaintFunction {
   StdIStreamGet() {
-    this.getDeclaringType() instanceof StdBasicIStream and
-    this.hasName(["get", "peek"]) and
+    this.getClassAndName(["get", "peek"]) instanceof StdBasicIStream and
     this.getNumberOfParameters() = 0
   }
 
@@ -359,8 +353,7 @@ private class StdIStreamGet extends TaintFunction {
  */
 private class StdIStreamRead extends DataFlowFunction, TaintFunction {
   StdIStreamRead() {
-    this.getDeclaringType() instanceof StdBasicIStream and
-    this.hasName(["get", "read"]) and
+    this.getClassAndName(["get", "read"]) instanceof StdBasicIStream and
     this.getNumberOfParameters() > 0
   }
 
@@ -486,8 +479,7 @@ private class StdBasicOStream extends ClassTemplateInstantiation {
  */
 private class StdOStreamOut extends DataFlowFunction, TaintFunction {
   StdOStreamOut() {
-    this.getDeclaringType() instanceof StdBasicOStream and
-    this.hasName(["operator<<", "put", "write"])
+    this.getClassAndName(["operator<<", "put", "write"]) instanceof StdBasicOStream
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -602,10 +594,9 @@ private class StdBasicIOS extends ClassTemplateInstantiation {
  */
 private class StdStreamFunction extends DataFlowFunction, TaintFunction {
   StdStreamFunction() {
-    this.getDeclaringType() instanceof StdBasicIStream and
-    this.hasName(["ignore", "unget", "seekg"])
+    this.getClassAndName(["ignore", "unget", "seekg"]) instanceof StdBasicIStream
     or
-    this.getDeclaringType() instanceof StdBasicOStream and this.hasName(["seekp", "flush"])
+    this.getClassAndName(["seekp", "flush"]) instanceof StdBasicOStream
     or
     this.getClassAndName("copyfmt") instanceof StdBasicIOS
   }

From b4a5346dc335ac2d9ca23bc19c47df9b50da725b Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 18 Jan 2021 18:36:18 +0000
Subject: [PATCH 207/343] C++: It turns out .getTemplate() is not necessary.

---
 .../code/cpp/models/implementations/StdString.qll      | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
index e0786074f2d..8fd2f79cfdd 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -12,7 +12,7 @@ import semmle.code.cpp.models.interfaces.DataFlow
  * The `std::basic_string` template class instantiations.
  */
 private class StdBasicString extends ClassTemplateInstantiation {
-  StdBasicString() { this.getTemplate().hasQualifiedName("std", "basic_string") }
+  StdBasicString() { this.hasQualifiedName("std", "basic_string") }
 }
 
 /**
@@ -256,7 +256,7 @@ private class StdStringSubstr extends TaintFunction {
  * The `std::basic_stringstream` template class instantiations.
  */
 private class StdBasicStringStream extends ClassTemplateInstantiation {
-  StdBasicStringStream() { this.getTemplate().hasQualifiedName("std", "basic_stringstream") }
+  StdBasicStringStream() { this.hasQualifiedName("std", "basic_stringstream") }
 }
 
 /**
@@ -280,7 +280,7 @@ private class StdStringAt extends TaintFunction {
  * The `std::basic_istream` template class instantiations.
  */
 private class StdBasicIStream extends ClassTemplateInstantiation {
-  StdBasicIStream() { this.getTemplate().hasQualifiedName("std", "basic_istream") }
+  StdBasicIStream() { this.hasQualifiedName("std", "basic_istream") }
 }
 
 /**
@@ -470,7 +470,7 @@ private class StdGetLine extends DataFlowFunction, TaintFunction {
  * The `std::basic_ostream` template class instantiations.
  */
 private class StdBasicOStream extends ClassTemplateInstantiation {
-  StdBasicOStream() { this.getTemplate().hasQualifiedName("std", "basic_ostream") }
+  StdBasicOStream() { this.hasQualifiedName("std", "basic_ostream") }
 }
 
 /**
@@ -585,7 +585,7 @@ private class StdStringStreamStr extends TaintFunction {
  * The `std::basic_ios` template class instantiations.
  */
 private class StdBasicIOS extends ClassTemplateInstantiation {
-  StdBasicIOS() { this.getTemplate().hasQualifiedName("std", "basic_ios") }
+  StdBasicIOS() { this.hasQualifiedName("std", "basic_ios") }
 }
 
 /**

From be7d458dc65b30cfb74e1f2638a5a398e258a779 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 19 Jan 2021 09:49:51 +0100
Subject: [PATCH 208/343] C#: Fix build error in RelationalPattern

---
 .../Entities/Expressions/Patterns/RelationalPattern.cs          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs
index 9dce7bf7c52..77efd5668c4 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Patterns/RelationalPattern.cs
@@ -9,7 +9,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
     internal class RelationalPattern : Expression
     {
         public RelationalPattern(Context cx, RelationalPatternSyntax syntax, IExpressionParentEntity parent, int child) :
-             base(new ExpressionInfo(cx, NullType.Create(cx), cx.Create(syntax.GetLocation()), GetKind(syntax.OperatorToken), parent, child, false, null))
+             base(new ExpressionInfo(cx, null, cx.Create(syntax.GetLocation()), GetKind(syntax.OperatorToken), parent, child, false, null))
         {
             Expression.Create(cx, syntax.Expression, this, 0);
         }

From 2a8060102d4109c233f1f773e10b06a9c3fc6eaf Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 26 Nov 2020 15:47:01 +0100
Subject: [PATCH 209/343] C#: Split up SSA implementation

---
 .../ql/src/semmle/code/csharp/Assignable.qll  |    3 +-
 .../code/csharp/commons/ConsistencyChecks.qll |    5 +-
 .../semmle/code/csharp/controlflow/Guards.qll |    7 +-
 .../semmle/code/csharp/dataflow/Nullness.qll  |   19 +-
 .../src/semmle/code/csharp/dataflow/SSA.qll   | 1937 +----------------
 .../dataflow/internal/DataFlowPrivate.qll     |   15 +-
 .../code/csharp/dataflow/internal/SsaImpl.qll | 1231 +++++++++++
 .../dataflow/internal/SsaImplCommon.qll       |  561 +++++
 .../dataflow/internal/SsaImplSpecific.qll     |   19 +
 .../rangeanalysis/ModulusAnalysisSpecific.qll |    2 +-
 .../internal/rangeanalysis/RangeUtils.qll     |    2 +-
 .../rangeanalysis/SsaReadPositionSpecific.qll |    2 +-
 .../dataflow/defuse/useUseEquivalence.ql      |   16 +-
 .../dataflow/ssa/PreSsaConsistency.ql         |    7 +-
 14 files changed, 1957 insertions(+), 1869 deletions(-)
 create mode 100644 csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
 create mode 100644 csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
 create mode 100644 csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll

diff --git a/csharp/ql/src/semmle/code/csharp/Assignable.qll b/csharp/ql/src/semmle/code/csharp/Assignable.qll
index f0d82f1dbce..ef00211188c 100644
--- a/csharp/ql/src/semmle/code/csharp/Assignable.qll
+++ b/csharp/ql/src/semmle/code/csharp/Assignable.qll
@@ -3,6 +3,7 @@
  */
 
 import csharp
+private import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
 
 /**
  * An assignable, that is, an element that can be assigned to. Either a
@@ -83,7 +84,7 @@ class AssignableRead extends AssignableAccess {
 
   pragma[noinline]
   private ControlFlow::Node getAnAdjacentReadSameVar() {
-    Ssa::Internal::adjacentReadPairSameVar(_, this.getAControlFlowNode(), result)
+    SsaImpl::adjacentReadPairSameVar(_, this.getAControlFlowNode(), result)
   }
 
   /**
diff --git a/csharp/ql/src/semmle/code/csharp/commons/ConsistencyChecks.qll b/csharp/ql/src/semmle/code/csharp/commons/ConsistencyChecks.qll
index a4405a5a309..79ff7107129 100644
--- a/csharp/ql/src/semmle/code/csharp/commons/ConsistencyChecks.qll
+++ b/csharp/ql/src/semmle/code/csharp/commons/ConsistencyChecks.qll
@@ -46,7 +46,10 @@ module SsaChecks {
   }
 
   predicate notDominatedByDef(AssignableRead read, string m) {
-    exists(Definition def, BasicBlock bb, ControlFlow::Node rnode, ControlFlow::Node dnode, int i |
+    exists(
+      Definition def, ControlFlow::BasicBlock bb, ControlFlow::Node rnode, ControlFlow::Node dnode,
+      int i
+    |
       def.getAReadAtNode(rnode) = read
     |
       def.definesAt(_, bb, i) and
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
index a9d95bd0084..396fb52a85d 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/Guards.qll
@@ -1723,6 +1723,7 @@ module Internal {
   cached
   private module Cached {
     private import semmle.code.csharp.Caching
+    private import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
 
     /**
      * Holds if basic block `bb` only is reached when guard `g` has abstract value `v`.
@@ -1775,9 +1776,9 @@ module Internal {
     private predicate adjacentReadPairSameVarUniquePredecessor(
       Ssa::Definition def, ControlFlow::Node cfn1, ControlFlow::Node cfn2
     ) {
-      Ssa::Internal::adjacentReadPairSameVar(def, cfn1, cfn2) and
+      SsaImpl::adjacentReadPairSameVar(def, cfn1, cfn2) and
       not exists(ControlFlow::Node other |
-        Ssa::Internal::adjacentReadPairSameVar(def, other, cfn2) and
+        SsaImpl::adjacentReadPairSameVar(def, other, cfn2) and
         other != cfn1 and
         other != cfn2
       )
@@ -1831,7 +1832,7 @@ module Internal {
     private predicate firstReadUniquePredecessor(Ssa::ExplicitDefinition def, ControlFlow::Node cfn) {
       exists(def.getAFirstReadAtNode(cfn)) and
       not exists(ControlFlow::Node other |
-        Ssa::Internal::adjacentReadPairSameVar(def, other, cfn) and
+        SsaImpl::adjacentReadPairSameVar(def, other, cfn) and
         other != cfn
       )
     }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
index 33e1b7f24f9..15133668d00 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/Nullness.qll
@@ -23,6 +23,7 @@ private import internal.CallableReturns
 private import semmle.code.csharp.commons.Assertions
 private import semmle.code.csharp.controlflow.Guards as G
 private import semmle.code.csharp.controlflow.Guards::AbstractValues
+private import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
 private import semmle.code.csharp.frameworks.System
 private import semmle.code.csharp.frameworks.Test
 
@@ -177,7 +178,7 @@ private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason)
     exists(G::DereferenceableExpr de | de = def.getARead() |
       reason = de.getANullCheck(_, true) and
       msg = "as suggested by $@ null check" and
-      not de = any(Ssa::PseudoDefinition pdef).getARead() and
+      not de = any(Ssa::PhiNode phi).getARead() and
       strictcount(Element e | e = any(Ssa::Definition def0 | de = def0.getARead()).getElement()) = 1 and
       // Don't use a check as reason if there is a `null` assignment
       // or argument
@@ -205,7 +206,7 @@ private predicate defMaybeNull(Ssa::Definition def, string msg, Element reason)
     // A variable of nullable type may be null
     exists(Dereference d | dereferenceAt(_, _, def, d) |
       d.hasNullableType() and
-      not def instanceof Ssa::PseudoDefinition and
+      not def instanceof Ssa::PhiNode and
       reason = def.getSourceVariable().getAssignable() and
       msg = "because it has a nullable type"
     )
@@ -236,13 +237,13 @@ private predicate defNullImpliesStep(
   Ssa::Definition def1, BasicBlock bb1, Ssa::Definition def2, BasicBlock bb2
 ) {
   exists(Ssa::SourceVariable v | defNullImpliesStep0(v, def1, bb1, bb2) |
-    def2.(Ssa::PseudoDefinition).getAnInput() = def1 and
+    def2.(Ssa::PhiNode).getAnInput() = def1 and
     bb2 = def2.getBasicBlock()
     or
     def2 = def1 and
-    not exists(Ssa::PseudoDefinition def |
-      def.getSourceVariable() = v and
-      bb2 = def.getBasicBlock()
+    not exists(Ssa::PhiNode phi |
+      phi.getSourceVariable() = v and
+      bb2 = phi.getBasicBlock()
     )
   ) and
   not exists(SuccessorTypes::ConditionalSuccessor s, NullValue nv |
@@ -426,14 +427,14 @@ module PathGraph {
 }
 
 private Ssa::Definition getAPseudoInput(Ssa::Definition def) {
-  result = def.(Ssa::PseudoDefinition).getAnInput()
+  result = def.(Ssa::PhiNode).getAnInput()
 }
 
 // `def.getAnUltimateDefinition()` includes inputs into uncertain
 // definitions, but we only want inputs into pseudo nodes
 private Ssa::Definition getAnUltimateDefinition(Ssa::Definition def) {
   result = getAPseudoInput*(def) and
-  not result instanceof Ssa::PseudoDefinition
+  not result instanceof Ssa::PhiNode
 }
 
 /**
@@ -446,7 +447,7 @@ private predicate defReaches(Ssa::Definition def, ControlFlow::Node cfn, boolean
   (always = true or always = false)
   or
   exists(ControlFlow::Node mid | defReaches(def, mid, always) |
-    Ssa::Internal::adjacentReadPairSameVar(_, mid, cfn) and
+    SsaImpl::adjacentReadPairSameVar(_, mid, cfn) and
     not mid =
       any(Dereference d |
         if always = true
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index bb4856a0de0..f1ba9523c31 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -1,453 +1,14 @@
 /**
- * Provides classes for working with static single assignment (SSA) form.
+ * Provides the module `Ssa` for working with static single assignment (SSA) form.
  */
 
 import csharp
 
+/**
+ * Provides classes for working with static single assignment (SSA) form.
+ */
 module Ssa {
-  class BasicBlock = ControlFlow::BasicBlock;
-
-  private module SourceVariableImpl {
-    private import AssignableDefinitions
-
-    /** A field or a property. */
-    class FieldOrProp extends Assignable, Modifiable {
-      FieldOrProp() {
-        this instanceof Field
-        or
-        this instanceof Property
-      }
-
-      /** Holds if this is a volatile field. */
-      predicate isVolatile() { this.(Field).isVolatile() }
-    }
-
-    /** An instance field or property. */
-    class InstanceFieldOrProp extends FieldOrProp {
-      InstanceFieldOrProp() { not this.isStatic() }
-    }
-
-    /** An access to a field or a property. */
-    class FieldOrPropAccess extends AssignableAccess, QualifiableExpr {
-      FieldOrPropAccess() { this.getTarget() instanceof FieldOrProp }
-    }
-
-    /** An access to a field or a property that reads the underlying value. */
-    class FieldOrPropRead extends FieldOrPropAccess, AssignableRead { }
-
-    cached
-    private module Cached {
-      cached
-      newtype TSourceVariable =
-        TLocalVar(Callable c, LocalScopeVariable v) {
-          c = v.getCallable()
-          or
-          // Local scope variables can be captured
-          c = v.getAnAccess().getEnclosingCallable()
-        } or
-        TPlainFieldOrProp(Callable c, FieldOrProp f) {
-          exists(FieldOrPropRead fr | isPlainFieldOrPropAccess(fr, f, c)) and
-          trackFieldOrProp(f)
-        } or
-        TQualifiedFieldOrProp(Callable c, SourceVariable q, InstanceFieldOrProp f) {
-          exists(FieldOrPropRead fr | isQualifiedFieldOrPropAccess(fr, f, c, q)) and
-          trackFieldOrProp(f)
-        }
-
-      /** Gets an access to source variable `v`. */
-      cached
-      AssignableAccess getAnAccess(SourceVariable v) {
-        exists(Callable c |
-          exists(LocalScopeVariable lsv | v = TLocalVar(c, lsv) |
-            result = lsv.getAnAccess() and
-            result.getEnclosingCallable() = c
-          )
-          or
-          exists(FieldOrProp fp | v = TPlainFieldOrProp(c, fp) |
-            isPlainFieldOrPropAccess(result, fp, c)
-          )
-          or
-          exists(FieldOrProp fp, SourceVariable q | v = TQualifiedFieldOrProp(c, q, fp) |
-            isQualifiedFieldOrPropAccess(result, fp, c, q)
-          )
-        )
-      }
-
-      cached
-      AssignableDefinition getADefinition(ExplicitDefinition def) {
-        exists(SourceVariable v, AssignableDefinition ad | explicitDefinition(def, v, ad) |
-          result = ad or
-          result = getASameOutRefDefAfter(v, ad)
-        )
-      }
-
-      cached
-      predicate implicitEntryDefinition(ControlFlow::BasicBlocks::EntryBlock bb, SourceVariable v) {
-        exists(Callable c |
-          c = bb.getCallable() and
-          c = v.getEnclosingCallable()
-        |
-          // Captured variable
-          exists(LocalScopeVariable lsv |
-            v = any(LocalScopeSourceVariable lv | lsv = lv.getAssignable())
-          |
-            lsv.getCallable() != c
-          )
-          or
-          // Each tracked field and property has an implicit entry definition
-          v instanceof PlainFieldOrPropSourceVariable
-        )
-      }
-    }
-
-    import Cached
-
-    /**
-     * Holds if `fpa` is an access inside callable `c` of `this`-qualified or
-     * static field or property `fp`.
-     */
-    predicate isPlainFieldOrPropAccess(FieldOrPropAccess fpa, FieldOrProp fp, Callable c) {
-      fieldOrPropAccessInCallable(fpa, fp, c) and
-      (ownFieldOrPropAccess(fpa) or fp.isStatic())
-    }
-
-    /**
-     * Holds if `fpa` is an access inside callable `c` of instance field or property
-     * `fp` with qualifier `q`.
-     */
-    predicate isQualifiedFieldOrPropAccess(
-      FieldOrPropAccess fpa, InstanceFieldOrProp fp, Callable c, SourceVariable q
-    ) {
-      fieldOrPropAccessInCallable(fpa, fp, c) and
-      fpa.getQualifier() = q.getAnAccess()
-    }
-
-    /** Holds if `fpa` is an access inside callable `c` of field or property `fp`. */
-    private predicate fieldOrPropAccessInCallable(FieldOrPropAccess fpa, FieldOrProp fp, Callable c) {
-      fp = fpa.getTarget() and
-      c = fpa.getEnclosingCallable()
-    }
-
-    /** Holds if `fpa` is an access to an instance field or property of `this`. */
-    predicate ownFieldOrPropAccess(FieldOrPropAccess fpa) {
-      fpa.getQualifier() instanceof ThisAccess
-    }
-
-    /*
-     * Liveness analysis to restrict the size of the SSA representation
-     */
-
-    /**
-     * Holds if the `i`th node of basic block `bb` is assignable definition `ad`
-     * targeting source variable `v`.
-     */
-    predicate variableDefinition(BasicBlock bb, int i, SourceVariable v, AssignableDefinition ad) {
-      ad = v.getADefinition() and
-      ad.getAControlFlowNode() = bb.getNode(i) and
-      // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
-      not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = ad |
-        second.getAssignment() = first.getAssignment() and
-        second.getEvaluationOrder() > first.getEvaluationOrder() and
-        second = v.getADefinition()
-      ) and
-      // In cases like `M(out x, out x)`, there is no inherent evaluation order, so we
-      // collapse the two definitions of `x`, using the first access as the representative,
-      // and expose both definitions in `ExplicitDefinition.getADefinition()`
-      not ad = getASameOutRefDefAfter(v, _)
-    }
-
-    /**
-     * Gets an `out`/`ref` definition of the same source variable as the `out`/`ref`
-     * definition `def`, belonging to the same call, at a position after `def`.
-     */
-    OutRefDefinition getASameOutRefDefAfter(SourceVariable v, OutRefDefinition def) {
-      def = v.getADefinition() and
-      result.getCall() = def.getCall() and
-      result.getIndex() > def.getIndex() and
-      result = v.getADefinition()
-    }
-
-    /**
-     * Holds if the `i`th node of basic block `bb` is a (potential) write to source
-     * variable `v`. The Boolean `certain` indicates whether the write is certain.
-     *
-     * This excludes implicit writes via calls.
-     */
-    predicate variableWriteDirect(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-      exists(AssignableDefinition ad | variableDefinition(bb, i, v, ad) |
-        if
-          any(AssignableDefinition ad0 | ad0 = ad or ad0 = getASameOutRefDefAfter(v, ad))
-              .isCertain()
-        then certain = true
-        else certain = false
-      )
-      or
-      variableWriteDirect(bb, i, v.(QualifiedFieldOrPropSourceVariable).getQualifier(), certain)
-      or
-      implicitEntryDefinition(bb, v) and
-      i = -1 and
-      certain = true
-    }
-
-    /**
-     * A classification of variable reads.
-     */
-    newtype TReadKind =
-      /** An actual read. */
-      ActualRead() or
-      /**
-       * A pseudo read for a `ref` or `out` variable at the end of the variable's enclosing
-       * callable. A pseudo read is inserted to make assignments to `out`/`ref` variables
-       * live, for example line 1 in
-       *
-       * ```csharp
-       * void M(out int i) {
-       *   i = 0;
-       * }
-       * ```
-       */
-      OutRefExitRead() or
-      /**
-       * A pseudo read for a captured variable at the end of the capturing
-       * callable. A write to a captured variable needs to be live for the same reasons
-       * as a write to a `ref` or `out` variable (see above).
-       */
-      CapturedVarExitRead() or
-      /**
-       * A pseudo read for a captured variable via a call.
-       */
-      CapturedVarCallRead() or
-      /**
-       * A pseudo read for a `ref` variable, just prior to an update of the referenced value.
-       * A pseudo read is inserted to make assignments to the `ref` variable live, for example
-       * line 2 in
-       *
-       * ```csharp
-       * void M() {
-       *   ref int i = ref GetRef();
-       *   i = 0;
-       * }
-       * ```
-       *
-       * The pseudo read is inserted at the CFG node `i` on the left-hand side of the
-       * assignment on line 3.
-       */
-      RefReadBeforeWrite()
-
-    class ReadKind extends TReadKind {
-      string toString() {
-        this = ActualRead() and
-        result = "ActualRead"
-        or
-        this = OutRefExitRead() and
-        result = "OutRefExitRead"
-        or
-        this = CapturedVarExitRead() and
-        result = "CapturedVarExitRead"
-        or
-        this = CapturedVarCallRead() and
-        result = "CapturedVarCallRead"
-        or
-        this = RefReadBeforeWrite() and
-        result = "RefReadBeforeWrite"
-      }
-
-      /** Holds if this kind represents a pseudo read. */
-      predicate isPseudo() { this != ActualRead() }
-    }
-
-    /**
-     * Holds if the `i`th node `node` of basic block `bb` reads source variable `v`.
-     * The read at `node` is of kind `rk`.
-     *
-     * This excludes implicit reads via calls.
-     */
-    predicate variableReadDirect(
-      BasicBlock bb, int i, SourceVariable v, ControlFlow::Node node, ReadKind rk
-    ) {
-      v.getAnAccess().(AssignableRead) = node.getElement() and
-      node = bb.getNode(i) and
-      rk = ActualRead()
-      or
-      outRefExitRead(bb, i, v, node) and
-      rk = OutRefExitRead()
-      or
-      refReadBeforeWrite(bb, i, v, node) and
-      rk = RefReadBeforeWrite()
-    }
-
-    private predicate outRefExitRead(
-      BasicBlock bb, int i, LocalScopeSourceVariable v, ControlFlow::Nodes::AnnotatedExitNode node
-    ) {
-      node.isNormal() and
-      exists(LocalScopeVariable lsv |
-        lsv = v.getAssignable() and
-        bb.getNode(i) = node and
-        node.getCallable() = lsv.getCallable()
-      |
-        lsv.(Parameter).isOutOrRef()
-        or
-        lsv.isRef() and
-        strictcount(v.getAnAccess()) > 1
-      )
-    }
-
-    private predicate refReadBeforeWrite(
-      BasicBlock bb, int i, LocalScopeSourceVariable v, ControlFlow::Node node
-    ) {
-      exists(AssignableDefinitions::AssignmentDefinition def, LocalVariable lv |
-        def.getTarget() = lv and
-        lv.isRef() and
-        lv = v.getAssignable() and
-        node = def.getAControlFlowNode() and
-        bb.getNode(i) = node
-      )
-    }
-
-    /**
-     * A classification of variable references into reads (of a given kind) and
-     * (certain or uncertain) writes.
-     */
-    private newtype TRefKind =
-      Read(ReadKind rk) or
-      Write(boolean certain) { certain = true or certain = false }
-
-    private class RefKind extends TRefKind {
-      string toString() {
-        exists(ReadKind rk | this = Read(rk) and result = "read (" + rk + ")")
-        or
-        exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-      }
-
-      int getOrder() {
-        this = Read(_) and
-        result = 0
-        or
-        this = Write(_) and
-        result = 1
-      }
-    }
-
-    /**
-     * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-     */
-    private predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-      exists(ReadKind rk | variableRead(bb, i, v, _, rk) | k = Read(rk))
-      or
-      exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-    }
-
-    private newtype TaggedRefIndex =
-      MkTaggedRefIndex(int i, int tag) {
-        exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-      }
-
-    /**
-     * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic block `bb`,
-     * which has the given reference kind `k`.
-     *
-     * Reads are considered before writes when they happen at the same index.
-     */
-    int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-      MkTaggedRefIndex(i, k.getOrder()) =
-        rank[result](int j, RefKind rk0, int tag |
-          ref(bb, j, v, rk0) and
-          tag = rk0.getOrder()
-        |
-          MkTaggedRefIndex(j, tag) order by j, tag
-        ) and
-      ref(bb, i, v, k)
-    }
-
-    private int maxRefRank(BasicBlock bb, SourceVariable v) {
-      result = refRank(bb, _, v, _) and
-      not result + 1 = refRank(bb, _, v, _)
-    }
-
-    /**
-     * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-     * that is either a read or a certain write.
-     */
-    private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-      result =
-        min(int r, RefKind k |
-          r = refRank(bb, _, v, k) and
-          k != Write(false)
-        |
-          r
-        )
-    }
-
-    /**
-     * Holds if source variable `v` is live at the beginning of basic block `bb`.
-     * The read that witnesses the liveness of `v` is of kind `rk`.
-     */
-    predicate liveAtEntry(BasicBlock bb, SourceVariable v, ReadKind rk) {
-      // The first read or certain write to `v` inside `bb` is a read
-      refRank(bb, _, v, Read(rk)) = firstReadOrCertainWrite(bb, v)
-      or
-      // There is no certain write to `v` inside `bb`, but `v` is live at entry
-      // to a successor basic block of `bb`
-      not exists(firstReadOrCertainWrite(bb, v)) and
-      liveAtExit(bb, v, rk)
-    }
-
-    /**
-     * Holds if source variable `v` is live at the end of basic block `bb`.
-     * The read that witnesses the liveness of `v` is of kind `rk`.
-     */
-    predicate liveAtExit(BasicBlock bb, SourceVariable v, ReadKind rk) {
-      liveAtEntry(bb.getASuccessor(), v, rk)
-    }
-
-    /**
-     * Holds if variable `v` is live in basic block `bb` at index `i`.
-     * The rank of `i` is `rnk` as defined by `refRank()`.
-     */
-    private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk, ReadKind rk) {
-      exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-        rnk = maxRefRank(bb, v) and
-        liveAtExit(bb, v, rk)
-        or
-        ref(bb, i, v, kind) and
-        kind = Read(rk)
-        or
-        exists(RefKind nextKind |
-          liveAtRank(bb, _, v, rnk + 1, rk) and
-          rnk + 1 = refRank(bb, _, v, nextKind) and
-          nextKind != Write(true)
-        )
-      )
-    }
-
-    /**
-     * Holds if variable `v` is live after the (certain or uncertain) write at
-     * index `i` inside basic block `bb`. The read that witnesses the liveness of
-     * `v` is of kind `rk`.
-     */
-    predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v, ReadKind rk) {
-      exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk, rk))
-    }
-
-    /**
-     * Holds if `fp` is a field or a property that is interesting as a basis for SSA.
-     *
-     * - A volatile field is never interesting, since all reads must reread from
-     *   memory and we are forced to assume that the value can change at any point.
-     * - A property is only interesting if it is "field-like", that is, it is a
-     *   non-overridable trivial property.
-     */
-    predicate trackFieldOrProp(FieldOrProp fp) {
-      not fp.isVolatile() and
-      (
-        fp instanceof Field
-        or
-        fp = any(TrivialProperty p | not p.isOverridableOrImplementable())
-      )
-    }
-  }
-
-  private import SourceVariableImpl
+  private import internal.SsaImpl as SsaImpl
 
   /**
    * A variable that can be SSA converted.
@@ -457,7 +18,7 @@ module Ssa {
    * `q.fp1.fp2....fpn`, where the base qualifier `q` is either `this`, a local
    * scope variable, or a type in case `fp1` is static.
    */
-  class SourceVariable extends TSourceVariable {
+  class SourceVariable extends SsaImpl::TSourceVariable {
     /**
      * Gets the assignable corresponding to this source variable. Either
      * a local scope variable, a field, or a property.
@@ -465,7 +26,7 @@ module Ssa {
     Assignable getAssignable() { none() }
 
     /** Gets an access to this source variable. */
-    AssignableAccess getAnAccess() { result = getAnAccess(this) }
+    AssignableAccess getAnAccess() { result = SsaImpl::getAnAccess(this) }
 
     /** Gets a definition of this source variable. */
     AssignableDefinition getADefinition() {
@@ -474,7 +35,7 @@ module Ssa {
       // Local variable declaration without initializer
       not exists(result.getTargetAccess()) and
       this =
-        any(LocalScopeSourceVariable v |
+        any(SourceVariables::LocalScopeSourceVariable v |
           result.getTarget() = v.getAssignable() and
           result.getEnclosingCallable() = v.getEnclosingCallable()
         )
@@ -510,10 +71,10 @@ module Ssa {
   /** Provides different types of `SourceVariable`s. */
   module SourceVariables {
     /** A local scope variable. */
-    class LocalScopeSourceVariable extends SourceVariable, TLocalVar {
-      override LocalScopeVariable getAssignable() { this = TLocalVar(_, result) }
+    class LocalScopeSourceVariable extends SourceVariable, SsaImpl::TLocalVar {
+      override LocalScopeVariable getAssignable() { this = SsaImpl::TLocalVar(_, result) }
 
-      override Callable getEnclosingCallable() { this = TLocalVar(result, _) }
+      override Callable getEnclosingCallable() { this = SsaImpl::TLocalVar(result, _) }
 
       override string toString() { result = getAssignable().getName() }
 
@@ -523,20 +84,20 @@ module Ssa {
     /** A fully qualified field or property. */
     class FieldOrPropSourceVariable extends SourceVariable {
       FieldOrPropSourceVariable() {
-        this = TPlainFieldOrProp(_, _) or
-        this = TQualifiedFieldOrProp(_, _, _)
+        this = SsaImpl::TPlainFieldOrProp(_, _) or
+        this = SsaImpl::TQualifiedFieldOrProp(_, _, _)
       }
 
-      override FieldOrProp getAssignable() {
-        this = TPlainFieldOrProp(_, result) or
-        this = TQualifiedFieldOrProp(_, _, result)
+      override Assignable getAssignable() {
+        this = SsaImpl::TPlainFieldOrProp(_, result) or
+        this = SsaImpl::TQualifiedFieldOrProp(_, _, result)
       }
 
       /**
        * Gets the first access to this field or property in terms of source
        * code location. This is used as the representative location.
        */
-      private FieldOrPropAccess getFirstAccess() {
+      private AssignableAccess getFirstAccess() {
         result =
           min(this.getAnAccess() as a
             order by
@@ -548,1243 +109,37 @@ module Ssa {
     }
 
     /** A plain field or property. */
-    class PlainFieldOrPropSourceVariable extends FieldOrPropSourceVariable, TPlainFieldOrProp {
-      override Callable getEnclosingCallable() { this = TPlainFieldOrProp(result, _) }
+    class PlainFieldOrPropSourceVariable extends FieldOrPropSourceVariable,
+      SsaImpl::TPlainFieldOrProp {
+      override Callable getEnclosingCallable() { this = SsaImpl::TPlainFieldOrProp(result, _) }
 
       override string toString() {
-        exists(FieldOrProp f, string prefix |
+        exists(Assignable f, string prefix |
           f = getAssignable() and
           result = prefix + "." + getAssignable()
         |
-          if f.isStatic() then prefix = f.getDeclaringType().getQualifiedName() else prefix = "this"
+          if f.(Modifiable).isStatic()
+          then prefix = f.getDeclaringType().getQualifiedName()
+          else prefix = "this"
         )
       }
     }
 
     /** A qualified field or property. */
     class QualifiedFieldOrPropSourceVariable extends FieldOrPropSourceVariable,
-      TQualifiedFieldOrProp {
-      override Callable getEnclosingCallable() { this = TQualifiedFieldOrProp(result, _, _) }
+      SsaImpl::TQualifiedFieldOrProp {
+      override Callable getEnclosingCallable() {
+        this = SsaImpl::TQualifiedFieldOrProp(result, _, _)
+      }
 
-      override SourceVariable getQualifier() { this = TQualifiedFieldOrProp(_, result, _) }
+      override SourceVariable getQualifier() { this = SsaImpl::TQualifiedFieldOrProp(_, result, _) }
 
       override string toString() { result = getQualifier() + "." + getAssignable() }
     }
   }
 
-  private import SourceVariables
-
-  private module SsaDefReaches {
-    /**
-     * A classification of SSA variable references into reads definitions.
-     */
-    private newtype TSsaRefKind =
-      SsaRead() or
-      SsaDef()
-
-    private class SsaRefKind extends TSsaRefKind {
-      string toString() {
-        this = SsaRead() and
-        result = "SsaRead"
-        or
-        this = SsaDef() and
-        result = "SsaDef"
-      }
-
-      int getOrder() {
-        this = SsaRead() and
-        result = 0
-        or
-        this = SsaDef() and
-        result = 1
-      }
-    }
-
-    /**
-     * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-     * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-     * is `SsaDef()`).
-     */
-    private predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-      variableRead(bb, i, v, _, _) and
-      k = SsaRead()
-      or
-      exists(Definition def | def.definesAt(v, bb, i)) and
-      k = SsaDef()
-    }
-
-    private newtype TaggedSsaRefIndex =
-      MkTaggedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-    /**
-     * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-     * block `bb`, which has the given reference kind `k`.
-     *
-     * For example, if `bb` is a basic block with a phi node for `v` (considered
-     * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-     *
-     * ```ql
-     * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-     * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-     * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-     * ```
-     *
-     * Reads are considered before writes when they happen at the same index.
-     */
-    private int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-      MkTaggedSsaRefIndex(i, k) =
-        rank[result](int j, SsaRefKind k0 |
-          ssaRef(bb, j, v, k0)
-        |
-          MkTaggedSsaRefIndex(j, k0) order by j, k0.getOrder()
-        ) and
-      ssaRef(bb, i, v, k)
-    }
-
-    private int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-      result = ssaRefRank(bb, _, v, _) and
-      not result + 1 = ssaRefRank(bb, _, v, _)
-    }
-
-    /**
-     * Holds if the SSA definition `def` reaches rank index `rankix` in its own
-     * basic block `bb`.
-     */
-    private predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rankix, SourceVariable v) {
-      exists(int i |
-        rankix = ssaRefRank(bb, i, v, SsaDef()) and
-        def.definesAt(v, bb, i)
-      )
-      or
-      ssaDefReachesRank(bb, def, rankix - 1, v) and
-      rankix = ssaRefRank(bb, _, v, SsaRead())
-    }
-
-    /**
-     * Holds if the SSA definition of `v` at `def` reaches `read` in the
-     * same basic block without crossing another SSA definition of `v`.
-     * The read at `node` is of kind `rk`.
-     */
-    private predicate ssaDefReachesReadWithinBlock(
-      SourceVariable v, Definition def, ControlFlow::Node read, ReadKind rk
-    ) {
-      exists(BasicBlock bb, int rankix, int i |
-        ssaDefReachesRank(bb, def, rankix, v) and
-        rankix = ssaRefRank(bb, i, v, SsaRead()) and
-        variableRead(bb, i, v, read, rk)
-      )
-    }
-
-    /**
-     * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
-     * `redef` in the same basic block, without crossing another SSA definition of `v`.
-     */
-    private predicate ssaDefReachesUncertainDefWithinBlock(
-      SourceVariable v, Definition def, UncertainDefinition redef
-    ) {
-      exists(BasicBlock bb, int rankix, int i |
-        ssaDefReachesRank(bb, def, rankix, v) and
-        rankix = ssaRefRank(bb, i, v, SsaDef()) - 1 and
-        redef.definesAt(v, bb, i)
-      )
-    }
-
-    /**
-     * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-     */
-    private int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-      v = def.getSourceVariable() and
-      result = ssaRefRank(bb, i, v, k) and
-      (
-        ssaDefReachesRead(_, def, bb.getNode(i), _)
-        or
-        def.definesAt(_, bb, i)
-      )
-    }
-
-    private predicate varOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
-      exists(ssaDefRank(def, v, bb, _, _))
-    }
-
-    pragma[noinline]
-    private BasicBlock getAMaybeLiveSuccessor(Definition def, BasicBlock bb) {
-      result = bb.getASuccessor() and
-      not varOccursInBlock(_, bb, def.getSourceVariable()) and
-      ssaDefReachesEndOfBlock(bb, def, _)
-    }
-
-    /**
-     * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-     * `bb2` is a transitive successor of `bb1`, `def` is live at the end of `bb1`,
-     * and the underlying variable for `def` is neither read nor written in any block
-     * on the path between `bb1` and `bb2`.
-     */
-    private predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-      varOccursInBlock(def, bb1, _) and
-      bb2 = bb1.getASuccessor()
-      or
-      exists(BasicBlock mid | varBlockReaches(def, bb1, mid) |
-        bb2 = getAMaybeLiveSuccessor(def, mid)
-      )
-    }
-
-    /**
-     * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-     * `def` is read at `cfn`, `cfn` is in a transitive successor block of `bb1`,
-     * and `def` is not read in any block on the path between `bb1` and `cfn`.
-     */
-    private predicate varBlockReachesRead(Definition def, BasicBlock bb1, ControlFlow::Node cfn) {
-      exists(BasicBlock bb2, int i2 |
-        varBlockReaches(def, bb1, bb2) and
-        ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1 and
-        variableRead(bb2, i2, _, cfn, _)
-      )
-    }
-
-    /**
-     * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
-     * or a write), `def` is read at `cfn`, and there is a path between them without
-     * any read of `def`.
-     */
-    private predicate adjacentVarRead(Definition def, BasicBlock bb1, int i1, ControlFlow::Node cfn) {
-      exists(int rankix, int i2 |
-        rankix = ssaDefRank(def, _, bb1, i1, _) and
-        rankix + 1 = ssaDefRank(def, _, bb1, i2, SsaRead()) and
-        variableRead(bb1, i2, _, cfn, _)
-      )
-      or
-      exists(SourceVariable v | ssaDefRank(def, v, bb1, i1, _) = maxSsaRefRank(bb1, v)) and
-      varBlockReachesRead(def, bb1, cfn)
-    }
-
-    cached
-    private module Cached {
-      /**
-       * Holds if the node at index `i` in `bb` is a last reference to SSA
-       * definition `def`.
-       *
-       * That is, the node can reach the end of the enclosing callable, or another
-       * SSA definition for the underlying source variable, without passing through
-       * another read.
-       */
-      cached
-      predicate lastRef(Definition def, BasicBlock bb, int i) {
-        exists(int rnk, SourceVariable v | rnk = ssaDefRank(def, v, bb, i, _) |
-          // Next reference to `v` inside `bb` is a write
-          rnk + 1 = ssaRefRank(bb, _, v, SsaDef())
-          or
-          // No more references to `v` inside `bb`
-          rnk = maxSsaRefRank(bb, v) and
-          (
-            // Can reach exit directly
-            bb instanceof ControlFlow::BasicBlocks::ExitBlock
-            or
-            exists(BasicBlock bb2 | varBlockReaches(def, bb, bb2) |
-              // Can reach a write using one or more steps
-              1 = ssaRefRank(bb2, _, def.getSourceVariable(), SsaDef())
-              or
-              // Can reach a block using one or more steps, where `def` is no longer live
-              not varOccursInBlock(def, bb2, _) and
-              not ssaDefReachesEndOfBlock(bb2, def, _)
-            )
-          )
-        )
-      }
-
-      pragma[noinline]
-      private predicate ssaDefReachesEndOfBlockRec(BasicBlock bb, Definition def, SourceVariable v) {
-        exists(BasicBlock idom | ssaDefReachesEndOfBlock(idom, def, v) |
-          // The construction of SSA form ensures that each read of a variable is
-          // dominated by its definition. An SSA definition therefore reaches a
-          // control flow node if it is the _closest_ SSA definition that dominates
-          // the node. If two definitions dominate a node then one must dominate the
-          // other, so therefore the definition of _closest_ is given by the dominator
-          // tree. Thus, reaching definitions can be calculated in terms of dominance.
-          idom = bb.getImmediateDominator()
-        )
-      }
-
-      /**
-       * Holds if the SSA definition of `v` at `def` reaches the end of a basic
-       * block `bb`, at which point it is still live, without crossing another
-       * SSA definition of `v`.
-       */
-      cached
-      predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-        exists(int last | last = maxSsaRefRank(bb, v) |
-          ssaDefReachesRank(bb, def, last, v) and
-          liveAtExit(bb, v, _)
-        )
-        or
-        ssaDefReachesEndOfBlockRec(bb, def, v) and
-        liveAtExit(bb, v, _) and
-        not ssaRef(bb, _, v, SsaDef())
-      }
-
-      /**
-       * Holds if the SSA definition of `v` at `def` reaches `read` without crossing
-       * another SSA definition of `v`. The read at `node` is of kind `rk`.
-       */
-      cached
-      predicate ssaDefReachesRead(
-        SourceVariable v, Definition def, ControlFlow::Node read, ReadKind rk
-      ) {
-        ssaDefReachesReadWithinBlock(v, def, read, rk)
-        or
-        exists(BasicBlock bb |
-          variableRead(bb, _, v, read, rk) and
-          ssaDefReachesEndOfBlock(bb.getAPredecessor(), def, v) and
-          not ssaDefReachesReadWithinBlock(v, _, read, _)
-        )
-      }
-
-      /**
-       * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
-       * `redef` without crossing another SSA definition of `v`.
-       */
-      cached
-      predicate ssaDefReachesUncertainDef(
-        SourceVariable v, Definition def, UncertainDefinition redef
-      ) {
-        ssaDefReachesUncertainDefWithinBlock(v, def, redef)
-        or
-        exists(BasicBlock bb |
-          redef.definesAt(v, bb, _) and
-          ssaDefReachesEndOfBlock(bb.getAPredecessor(), def, v) and
-          not ssaDefReachesUncertainDefWithinBlock(v, _, redef)
-        )
-      }
-
-      /** Same as `adjacentVarRead`, but steps over pseudo reads. */
-      private predicate adjacentVarActualRead(
-        Definition def, BasicBlock bb1, int i1, ControlFlow::Node cfn
-      ) {
-        adjacentVarRead(def, bb1, i1, cfn)
-        or
-        exists(ControlFlow::Node mid, BasicBlock bb2, int i2 |
-          adjacentVarActualRead(def, bb1, i1, mid) and
-          variableRead(bb2, i2, _, mid, any(ReadKind rk | rk.isPseudo())) and
-          adjacentVarRead(def, bb2, i2, cfn)
-        )
-      }
-
-      /**
-       * Holds if the value defined at SSA definition `def` can reach a read at `cfn`,
-       * without passing through any other read.
-       */
-      cached
-      predicate firstReadSameVar(Definition def, ControlFlow::Node cfn) {
-        exists(BasicBlock bb1, int i1 |
-          def.definesAt(_, bb1, i1) and
-          adjacentVarActualRead(def, bb1, i1, cfn) and
-          variableRead(_, _, _, cfn, ActualRead())
-        )
-      }
-
-      /**
-       * Holds if the read at `cfn2` is a read of the same SSA definition `def`
-       * as the read at `cfn1`, and `cfn2` can be reached from `cfn1` without
-       * passing through another read.
-       */
-      cached
-      predicate adjacentReadPairSameVar(
-        Definition def, ControlFlow::Node cfn1, ControlFlow::Node cfn2
-      ) {
-        exists(BasicBlock bb1, int i1 |
-          variableRead(bb1, i1, _, cfn1, ActualRead()) and
-          adjacentVarActualRead(def, bb1, i1, cfn2) and
-          variableRead(_, _, _, cfn2, ActualRead())
-        )
-      }
-
-      private predicate reachesLastRef(Definition def, BasicBlock bb, int i) {
-        lastRef(def, bb, i)
-        or
-        exists(BasicBlock bb0, int i0, ControlFlow::Node cfn |
-          reachesLastRef(def, bb0, i0) and
-          variableRead(bb0, i0, _, cfn, any(ReadKind rk | rk.isPseudo())) and
-          adjacentVarRead(def, bb, i, cfn)
-        )
-      }
-
-      cached
-      predicate lastReadSameVar(Definition def, ControlFlow::Node cfn) {
-        exists(BasicBlock bb, int i |
-          reachesLastRef(def, bb, i) and
-          variableRead(bb, i, _, _, ActualRead()) and
-          cfn = bb.getNode(i)
-        )
-      }
-    }
-
-    import Cached
-  }
-
-  private import SsaDefReaches
-
-  /**
-   * The SSA construction for a field or a property `fp` relies on implicit
-   * update nodes at every call site that conceivably could reach an update
-   * of the field or property. For example, there is an implicit update of
-   * `this.Field` on line 7 in
-   *
-   * ```csharp
-   * int Field;
-   *
-   * void SetField(int i) { Field = i; }
-   *
-   * int M() {
-   *   Field = 0;
-   *   SetField(1); // implicit update of `this.Field`
-   *   return Field;
-   * }
-   * ```
-   *
-   * At a first approximation, we need to find update paths of the form:
-   *
-   * ```
-   *   Call --(callEdge)-->* Callable(setter of fp)
-   * ```
-   *
-   * This can be improved by excluding paths ending in:
-   *
-   * ```
-   *   Constructor --(intraInstanceCallEdge)-->+ Callable(setter of this.fp)
-   * ```
-   *
-   * as these updates are guaranteed not to alias with the `fp` under
-   * consideration.
-   *
-   * This set of paths can be expressed positively by noting that those
-   * that set `this.fp`, end in zero or more `intraInstanceCallEdge`s between
-   * callables, and before those is either the originating `Call`:
-   *
-   * ```
-   *   Call --(intraInstanceCallEdge)-->* Callable(setter of this.fp)
-   * ```
-   *
-   * or a `crossInstanceCallEdge`:
-   *
-   * ```
-   *   Call --crossInstanceCallEdge--> Callable
-   *        --(intraInstanceCallEdge)-->* Callable(setter of this.fp)
-   * ```
-   */
-  private module FieldOrPropsImpl {
-    private import semmle.code.csharp.dispatch.Dispatch
-
-    /**
-     * A callable that is neither static nor a constructor.
-     */
-    private class InstanceCallable extends Callable {
-      InstanceCallable() {
-        not this.(Modifiable).isStatic() and
-        not this instanceof Constructor
-      }
-    }
-
-    private class FieldOrPropDefinition extends AssignableDefinition {
-      FieldOrPropDefinition() { this.getTarget() instanceof FieldOrProp }
-    }
-
-    /**
-     * Holds if `fpdef` is a definition that is not relevant as an implicit
-     * SSA update, since it is an initialization and therefore cannot alias.
-     */
-    private predicate init(FieldOrPropDefinition fpdef) {
-      exists(FieldOrPropAccess access | access = fpdef.getTargetAccess() |
-        fpdef.getEnclosingCallable() instanceof Constructor and
-        ownFieldOrPropAccess(access)
-        or
-        exists(LocalVariable v |
-          v.getAnAccess() = access.getQualifier() and
-          not v.isCaptured() and
-          forex(AssignableDefinition def | def.getTarget() = v and exists(def.getSource()) |
-            def.getSource() instanceof ObjectCreation
-          )
-        )
-      )
-      or
-      fpdef.(AssignableDefinitions::AssignmentDefinition).getAssignment() instanceof
-        MemberInitializer
-    }
-
-    /**
-     * Holds if `fpdef` is an update of `fp` in `c` that is relevant for SSA construction.
-     */
-    private predicate relevantDefinition(Callable c, FieldOrProp fp, FieldOrPropDefinition fpdef) {
-      fpdef.getTarget() = fp and
-      not init(fpdef) and
-      fpdef.getEnclosingCallable() = c and
-      exists(FieldOrPropSourceVariable tf | tf.getAssignable() = fp)
-    }
-
-    /**
-     * Holds if callable `c` can change the value of `this.fp` and is relevant
-     * for SSA construction.
-     */
-    private predicate setsOwnFieldOrProp(InstanceCallable c, FieldOrProp fp) {
-      exists(FieldOrPropDefinition fpdef | relevantDefinition(c, fp, fpdef) |
-        ownFieldOrPropAccess(fpdef.getTargetAccess())
-      )
-    }
-
-    /**
-     * Holds if callable `c` can change the value of `fp` and is relevant for SSA
-     * construction excluding those cases covered by `setsOwnFieldOrProp`.
-     */
-    private predicate setsOtherFieldOrProp(Callable c, FieldOrProp fp) {
-      exists(FieldOrPropDefinition fpdef | relevantDefinition(c, fp, fpdef) |
-        not ownFieldOrPropAccess(fpdef.getTargetAccess())
-      )
-    }
-
-    /**
-     * Holds if `(c1,c2)` is a call edge to a callable that does not change the
-     * value of `this`.
-     *
-     * Constructor-to-constructor calls can also be intra-instance, but are not
-     * included, as this does not affect whether a call chain ends in
-     *
-     * ```
-     *   Constructor --(intraInstanceCallEdge)-->+ Callable(setter of this.f)
-     * ```
-     */
-    private predicate intraInstanceCallEdge(Callable c1, InstanceCallable c2) {
-      exists(Call c |
-        c.getEnclosingCallable() = c1 and
-        c2 = getARuntimeTarget(c, _) and
-        c.(QualifiableExpr).targetIsLocalInstance()
-      )
-    }
-
-    /**
-     * Gets a potential run-time target for the call `c`.
-     *
-     * This predicate differs from `Call.getARuntimeTarget()` in three ways:
-     *
-     * (1) The returned callable is always a source declaration,
-     *
-     * (2) a simpler analysis is applied for delegate calls (needed to avoid making
-     *     the SSA library and `Call.getARuntimeTarget()` mutually recursive), and
-     *
-     * (3) indirect calls to delegates via calls to library callables are included.
-     *
-     * The Boolean `libraryDelegateCall` indicates whether `c` is a call to a library
-     * method and the result is a delegate passed to `c`. For example, in
-     *
-     * ```csharp
-     * Lazy<int> M1()
-     * {
-     *     return new Lazy<int>(M2);
-     * }
-     * ```
-     *
-     * the constructor call `new Lazy<int>(M2)` includes `M2` as a target.
-     */
-    Callable getARuntimeTarget(Call c, boolean libraryDelegateCall) {
-      // Non-delegate call: use dispatch library
-      exists(DispatchCall dc | dc.getCall() = c |
-        result = dc.getADynamicTarget().getUnboundDeclaration() and
-        libraryDelegateCall = false
-      )
-      or
-      // Delegate call: use simple analysis
-      result = SimpleDelegateAnalysis::getARuntimeDelegateTarget(c, libraryDelegateCall)
-    }
-
-    private module SimpleDelegateAnalysis {
-      private import semmle.code.csharp.dataflow.internal.DelegateDataFlow
-      private import semmle.code.csharp.dataflow.internal.Steps
-      private import semmle.code.csharp.frameworks.system.linq.Expressions
-
-      /**
-       * Holds if `c` is a call that (potentially) calls the delegate expression `e`.
-       * Either `c` is a delegate call and `e` is the qualifier, or `c` is a call to
-       * a library callable and `e` is a delegate argument.
-       */
-      private predicate delegateCall(Call c, Expr e, boolean libraryDelegateCall) {
-        c = any(DelegateCall dc | e = dc.getDelegateExpr()) and
-        libraryDelegateCall = false
-        or
-        c.getTarget().fromLibrary() and
-        e = c.getAnArgument() and
-        e.getType() instanceof SystemLinqExpressions::DelegateExtType and
-        libraryDelegateCall = true
-      }
-
-      /** Holds if expression `e` is a delegate creation for callable `c` of type `t`. */
-      private predicate delegateCreation(
-        Expr e, Callable c, SystemLinqExpressions::DelegateExtType dt
-      ) {
-        e =
-          any(AnonymousFunctionExpr afe |
-            dt = afe.getType() and
-            c = afe
-          )
-        or
-        e =
-          any(CallableAccess ca |
-            c = ca.getTarget().getUnboundDeclaration() and
-            dt = ca.getType()
-          )
-      }
-
-      private predicate delegateFlowStep(Expr pred, Expr succ) {
-        Steps::stepClosed(pred, succ)
-        or
-        exists(Call call, Callable callable |
-          callable.getUnboundDeclaration().canReturn(pred) and
-          call = succ
-        |
-          callable = call.getTarget() or
-          callable = call.getTarget().(Method).getAnOverrider+() or
-          callable = call.getTarget().(Method).getAnUltimateImplementor() or
-          callable = getARuntimeDelegateTarget(call, false)
-        )
-        or
-        pred = succ.(DelegateCreation).getArgument()
-        or
-        exists(AssignableDefinition def, Assignable a |
-          a instanceof Field or
-          a instanceof Property
-        |
-          a = def.getTarget() and
-          succ.(AssignableRead) = a.getAnAccess() and
-          pred = def.getSource()
-        )
-        or
-        exists(AddEventExpr ae | succ.(EventAccess).getTarget() = ae.getTarget() |
-          pred = ae.getRValue()
-        )
-      }
-
-      private predicate reachesDelegateCall(Expr e) {
-        delegateCall(_, e, _)
-        or
-        exists(Expr mid | reachesDelegateCall(mid) | delegateFlowStep(e, mid))
-      }
-
-      pragma[nomagic]
-      private predicate delegateFlowStepReaches(Expr pred, Expr succ) {
-        delegateFlowStep(pred, succ) and
-        reachesDelegateCall(succ)
-      }
-
-      private Expr delegateCallSource(Callable c) {
-        delegateCreation(result, c, _)
-        or
-        delegateFlowStepReaches(delegateCallSource(c), result)
-      }
-
-      /** Gets a run-time target for the delegate call `c`. */
-      Callable getARuntimeDelegateTarget(Call c, boolean libraryDelegateCall) {
-        delegateCall(c, delegateCallSource(result), libraryDelegateCall)
-      }
-    }
-
-    /** Holds if `(c1,c2)` is an edge in the call graph. */
-    predicate callEdge(Callable c1, Callable c2) {
-      exists(Call c | c.getEnclosingCallable() = c1 and c2 = getARuntimeTarget(c, _))
-    }
-
-    /**
-     * Holds if `(c1,c2)` is an edge in the call graph excluding
-     * `intraInstanceCallEdge`.
-     */
-    private predicate crossInstanceCallEdge(Callable c1, Callable c2) {
-      callEdge(c1, c2) and
-      not intraInstanceCallEdge(c1, c2)
-    }
-
-    pragma[noinline]
-    predicate callAt(BasicBlock bb, int i, Call call) {
-      bb.getNode(i) = call.getAControlFlowNode() and
-      getARuntimeTarget(call, _).hasBody()
-    }
-
-    /**
-     * Holds if `call` occurs in basic block `bb` at index `i`, `fp` has
-     * an update somewhere, and `fp` is likely to be live in `bb` at index
-     * `i`.
-     */
-    private predicate updateCandidate(BasicBlock bb, int i, FieldOrPropSourceVariable fp, Call call) {
-      callAt(bb, i, call) and
-      call.getEnclosingCallable() = fp.getEnclosingCallable() and
-      relevantDefinition(_, fp.getAssignable(), _) and
-      not variableWriteDirect(bb, i, fp, _)
-    }
-
-    private predicate source(
-      Call call, FieldOrPropSourceVariable fps, FieldOrProp fp, Callable c, boolean fresh
-    ) {
-      updateCandidate(_, _, fps, call) and
-      c = getARuntimeTarget(call, _) and
-      fp = fps.getAssignable() and
-      if c instanceof Constructor then fresh = true else fresh = false
-    }
-
-    /**
-     * A callable in a potential call-chain between a source that cares about the
-     * value of some field `f` and a sink that may overwrite `f`. The Boolean
-     * `fresh` indicates whether the instance `this` in `c` has been freshly
-     * allocated along the call-chain.
-     */
-    private newtype TCallableNode =
-      MkCallableNode(Callable c, boolean fresh) { source(_, _, _, c, fresh) or edge(_, c, fresh) }
-
-    private predicate edge(TCallableNode n, Callable c2, boolean f2) {
-      exists(Callable c1, boolean f1 | n = MkCallableNode(c1, f1) |
-        intraInstanceCallEdge(c1, c2) and f2 = f1
-        or
-        crossInstanceCallEdge(c1, c2) and
-        if c2 instanceof Constructor then f2 = true else f2 = false
-      )
-    }
-
-    private predicate edge(TCallableNode n1, TCallableNode n2) {
-      exists(Callable c2, boolean f2 |
-        edge(n1, c2, f2) and
-        n2 = MkCallableNode(c2, f2)
-      )
-    }
-
-    pragma[noinline]
-    private predicate source(
-      Call call, FieldOrPropSourceVariable fps, FieldOrProp fp, TCallableNode n
-    ) {
-      exists(Callable c, boolean fresh |
-        source(call, fps, fp, c, fresh) and
-        n = MkCallableNode(c, fresh)
-      )
-    }
-
-    private predicate sink(Callable c, FieldOrProp fp, TCallableNode n) {
-      relevantDefinition(c, fp, _) and
-      (
-        setsOwnFieldOrProp(c, fp) and n = MkCallableNode(c, false)
-        or
-        setsOtherFieldOrProp(c, fp) and n = MkCallableNode(c, _)
-      )
-    }
-
-    private predicate prunedNode(TCallableNode n) {
-      sink(_, _, n)
-      or
-      exists(TCallableNode mid | edge(n, mid) and prunedNode(mid))
-    }
-
-    private predicate prunedEdge(TCallableNode n1, TCallableNode n2) {
-      prunedNode(n1) and
-      prunedNode(n2) and
-      edge(n1, n2)
-    }
-
-    private predicate edgePlus(TCallableNode c1, TCallableNode c2) = fastTC(prunedEdge/2)(c1, c2)
-
-    pragma[noopt]
-    private predicate updatesNamedFieldOrProp(
-      FieldOrPropSourceVariable fps, Call call, Callable setter
-    ) {
-      exists(TCallableNode src, TCallableNode sink, FieldOrProp fp |
-        source(call, fps, fp, src) and
-        sink(setter, fp, sink) and
-        (src = sink or edgePlus(src, sink))
-      )
-    }
-
-    /**
-     * Holds if `call` may change the value of field or property `fp`. The actual
-     * update occurs in `setter`.
-     */
-    cached
-    predicate updatesNamedFieldOrProp(
-      BasicBlock bb, int i, Call c, FieldOrPropSourceVariable fp, Callable setter
-    ) {
-      forceCachingInSameStage() and
-      updateCandidate(bb, i, fp, c) and
-      updatesNamedFieldOrProp(fp, c, setter)
-    }
-  }
-
-  private import FieldOrPropsImpl
-
-  /**
-   * As in the SSA construction for fields and properties, SSA construction
-   * for captured variables relies on implicit update nodes at every call
-   * site that conceivably could reach an update of the captured variable.
-   * For example, there is an implicit update of `v` on line 4 in
-   *
-   * ```csharp
-   * int M() {
-   *   int i = 0;
-   *   Action a = () => { i = 1; };
-   *   a(); // implicit update of `v`
-   *   return i;
-   * }
-   * ```
-   *
-   * We find update paths of the form:
-   *
-   * ```
-   *   Call --(callEdge)-->* Callable(update of v)
-   * ```
-   *
-   * For simplicity, and for performance reasons, we ignore cases where a path
-   * goes through the callable that introduces `v`; such a path does not
-   * represent an actual update, as a new copy of `v` is updated.
-   */
-  private module CapturedVariableImpl {
-    /**
-     * A local scope variable that is captured, and updated by at least one capturer.
-     */
-    private class CapturedWrittenLocalScopeVariable extends LocalScopeVariable {
-      CapturedWrittenLocalScopeVariable() {
-        exists(AssignableDefinition def | def.getTarget() = this |
-          def.getEnclosingCallable() != this.getCallable()
-        )
-      }
-    }
-
-    private class CapturedWrittenLocalScopeSourceVariable extends LocalScopeSourceVariable {
-      CapturedWrittenLocalScopeSourceVariable() {
-        this.getAssignable() instanceof CapturedWrittenLocalScopeVariable
-      }
-    }
-
-    private class CapturedWrittenLocalScopeVariableDefinition extends AssignableDefinition {
-      CapturedWrittenLocalScopeVariableDefinition() {
-        this.getTarget() instanceof CapturedWrittenLocalScopeVariable
-      }
-    }
-
-    /**
-     * Holds if `vdef` is an update of captured variable `v` in callable `c`
-     * that is relevant for SSA construction.
-     */
-    private predicate relevantDefinition(
-      Callable c, CapturedWrittenLocalScopeVariable v,
-      CapturedWrittenLocalScopeVariableDefinition vdef
-    ) {
-      exists(BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable sv |
-        vdef.getTarget() = v and
-        vdef.getEnclosingCallable() = c and
-        sv.getAssignable() = v and
-        bb.getNode(i) = vdef.getAControlFlowNode() and
-        c != v.getCallable()
-      )
-    }
-
-    /**
-     * Holds if `call` occurs in basic block `bb` at index `i`, captured variable
-     * `v` has an update somewhere, and `v` is likely to be live in `bb` at index
-     * `i`.
-     */
-    private predicate updateCandidate(
-      BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable v, Call call
-    ) {
-      callAt(bb, i, call) and
-      call.getEnclosingCallable() = v.getEnclosingCallable() and
-      exists(Assignable a |
-        a = v.getAssignable() and
-        relevantDefinition(_, a, _) and
-        not exists(AssignableDefinitions::OutRefDefinition def |
-          def.getCall() = call and
-          def.getTarget() = a
-        )
-      )
-    }
-
-    private predicate source(
-      Call call, CapturedWrittenLocalScopeSourceVariable v,
-      CapturedWrittenLocalScopeVariable captured, Callable c, boolean libraryDelegateCall
-    ) {
-      updateCandidate(_, _, v, call) and
-      c = getARuntimeTarget(call, libraryDelegateCall) and
-      captured = v.getAssignable() and
-      relevantDefinition(_, captured, _)
-    }
-
-    /**
-     * Holds if `c` is a relevant part of the call graph for
-     * `updatesCapturedVariable` based on following edges in forward direction.
-     */
-    private predicate reachbleFromSource(Callable c) {
-      source(_, _, _, c, _)
-      or
-      exists(Callable mid | reachbleFromSource(mid) | callEdge(mid, c))
-    }
-
-    private predicate sink(Callable c, CapturedWrittenLocalScopeVariable captured) {
-      reachbleFromSource(c) and
-      relevantDefinition(c, captured, _)
-    }
-
-    private predicate prunedCallable(Callable c) {
-      sink(c, _)
-      or
-      exists(Callable mid | callEdge(c, mid) and prunedCallable(mid))
-    }
-
-    private predicate prunedEdge(Callable c1, Callable c2) {
-      prunedCallable(c1) and
-      prunedCallable(c2) and
-      callEdge(c1, c2)
-    }
-
-    private predicate edgePlus(Callable c1, Callable c2) = fastTC(prunedEdge/2)(c1, c2)
-
-    /**
-     * Holds if `call` may change the value of captured variable `v`. The actual
-     * update occurs in `writer`. That is, `writer` can be reached from `call`
-     * using zero or more additional calls (as indicated by `additionalCalls`).
-     * One of the intermediate callables may be the callable that introduces `v`,
-     * in which case `call` is not an actual update.
-     */
-    pragma[noopt]
-    private predicate updatesCapturedVariableWriter(
-      Call call, CapturedWrittenLocalScopeSourceVariable v, Callable writer, boolean additionalCalls
-    ) {
-      exists(Callable src, CapturedWrittenLocalScopeVariable captured, boolean libraryDelegateCall |
-        source(call, v, captured, src, libraryDelegateCall) and
-        sink(writer, captured) and
-        (
-          src = writer and additionalCalls = libraryDelegateCall
-          or
-          edgePlus(src, writer) and additionalCalls = true
-        )
-      )
-    }
-
-    /**
-     * Holds if `call` may change the value of captured variable `v`. The actual
-     * update occurs in `def`.
-     */
-    cached
-    predicate updatesCapturedVariable(
-      BasicBlock bb, int i, Call call, LocalScopeSourceVariable v, AssignableDefinition def,
-      boolean additionalCalls
-    ) {
-      forceCachingInSameStage() and
-      updateCandidate(bb, i, v, call) and
-      exists(Callable writer | relevantDefinition(writer, v.getAssignable(), def) |
-        updatesCapturedVariableWriter(call, v, writer, additionalCalls)
-      )
-    }
-  }
-
-  private import CapturedVariableImpl
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a (potential) write to source
-   * variable `v`. The Boolean `certain` indicates whether the write is certain.
-   *
-   * This includes implicit writes via calls.
-   */
-  private predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
-    variableWriteDirect(bb, i, v, certain)
-    or
-    variableWriteQualifier(bb, i, v, certain)
-    or
-    updatesNamedFieldOrProp(bb, i, _, v, _) and
-    certain = false
-    or
-    updatesCapturedVariable(bb, i, _, v, _, _) and
-    certain = false
-  }
-
-  cached
-  private predicate variableWriteQualifier(
-    BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v, boolean certain
-  ) {
-    forceCachingInSameStage() and
-    variableWrite(bb, i, v.getQualifier(), certain) and
-    // Eliminate corner case where a call definition can overlap with a
-    // qualifier definition: if method `M` updates field `F`, then a call
-    // to `M` is both an update of `x.M` and `x.M.M`, so the former call
-    // definition should not give rise to an implicit qualifier definition
-    // for `x.M.M`.
-    not updatesNamedFieldOrProp(bb, i, _, v, _)
-  }
-
-  /**
-   * Liveness analysis to restrict the size of the SSA representation for
-   * captured variables.
-   *
-   * Example:
-   *
-   * ```csharp
-   * void M() {
-   *   int i = 0;
-   *   void M2() {
-   *     System.Console.WriteLine(i);
-   *   }
-   *   M2();
-   * }
-   * ```
-   *
-   * The definition of `i` on line 2 is live, because of the call to `M2` on
-   * line 6. However, that call is not a direct read of `i`, so we account
-   * for that by inserting an implicit read of `i` on line 6.
-   *
-   * The predicates in this module follow the same structure as those in
-   * `CapturedVariableImpl`.
-   */
-  private module CapturedVariableLivenessImpl {
-    /**
-     * Holds if `c` is a callable that captures local scope variable `v`, and
-     * `c` may read the value of the captured variable.
-     */
-    private predicate capturerReads(Callable c, LocalScopeVariable v) {
-      exists(LocalScopeSourceVariable sv |
-        variableReadDirect(_, _, sv, _, _) and
-        c = sv.getEnclosingCallable() and
-        v = sv.getAssignable() and
-        v.getCallable() != c
-      )
-    }
-
-    /**
-     * A local scope variable that is captured, and read by at least one capturer.
-     */
-    private class CapturedReadLocalScopeVariable extends LocalScopeVariable {
-      CapturedReadLocalScopeVariable() { capturerReads(_, this) }
-    }
-
-    private class CapturedReadLocalScopeSourceVariable extends LocalScopeSourceVariable {
-      CapturedReadLocalScopeSourceVariable() {
-        this.getAssignable() instanceof CapturedReadLocalScopeVariable
-      }
-    }
-
-    /**
-     * Holds if a write to captured source variable `v` may be read by a
-     * callable reachable from the call `c`.
-     */
-    private predicate implicitReadCandidate(
-      CapturedReadLocalScopeSourceVariable v, ControlFlow::Nodes::ElementNode c
-    ) {
-      exists(BasicBlock bb, int i | variableWriteDirect(bb, i, v, _) |
-        c = bb.getNode(any(int j | j > i))
-        or
-        c = bb.getASuccessor+().getANode()
-      )
-    }
-
-    private predicate source(
-      ControlFlow::Nodes::ElementNode call, CapturedReadLocalScopeSourceVariable v,
-      CapturedReadLocalScopeVariable captured, Callable c, boolean libraryDelegateCall
-    ) {
-      implicitReadCandidate(v, call) and
-      c = getARuntimeTarget(call.getElement(), libraryDelegateCall) and
-      captured = v.getAssignable() and
-      capturerReads(_, captured)
-    }
-
-    /**
-     * Holds if `c` is a relevant part of the call graph for
-     * `readsCapturedVariable` based on following edges in forward direction.
-     */
-    private predicate reachbleFromSource(Callable c) {
-      source(_, _, _, c, _)
-      or
-      exists(Callable mid | reachbleFromSource(mid) | callEdge(mid, c))
-    }
-
-    private predicate sink(Callable c, CapturedReadLocalScopeVariable captured) {
-      reachbleFromSource(c) and
-      capturerReads(c, captured)
-    }
-
-    private predicate prunedCallable(Callable c) {
-      sink(c, _)
-      or
-      exists(Callable mid | callEdge(c, mid) and prunedCallable(mid))
-    }
-
-    private predicate prunedEdge(Callable c1, Callable c2) {
-      prunedCallable(c1) and
-      prunedCallable(c2) and
-      callEdge(c1, c2)
-    }
-
-    private predicate edgePlus(Callable c1, Callable c2) = fastTC(prunedEdge/2)(c1, c2)
-
-    /**
-     * Holds if `call` may read the value of captured variable `v`. The actual
-     * read occurs in `reader`. That is, `reader` can be reached from `call`
-     * using zero or more additional calls (as indicated by `additionalCalls`).
-     * One of the intermediate callables may be a callable that writes to `v`,
-     * in which case `call` is not an actual read.
-     */
-    pragma[noopt]
-    private predicate readsCapturedVariable(
-      ControlFlow::Nodes::ElementNode call, CapturedReadLocalScopeSourceVariable v, Callable reader,
-      boolean additionalCalls
-    ) {
-      exists(Callable src, CapturedReadLocalScopeVariable captured, boolean libraryDelegateCall |
-        source(call, v, captured, src, libraryDelegateCall) and
-        sink(reader, captured) and
-        (
-          src = reader and additionalCalls = libraryDelegateCall
-          or
-          edgePlus(src, reader) and additionalCalls = true
-        )
-      )
-    }
-
-    /**
-     * Holds if captured local scope variable `v` is written inside the callable
-     * to which `bb` belongs, and the value may be read via `call` using zero or
-     * more additional calls (as indicated by `additionalCalls`).
-     *
-     * In this case a pseudo-read is inserted at the exit node `node`, at index
-     * `i` in `bb`, in order to make the write live.
-     *
-     * Example:
-     *
-     * ```csharp
-     * class C {
-     *   void M1() {
-     *     int i = 0;
-     *     void M2() { i = 2; };
-     *     M2();
-     *     System.Console.WriteLine(i);
-     *   }
-     * }
-     * ```
-     *
-     * The write to `i` inside `M2` on line 4 is live because of the implicit call
-     * definition on line 5.
-     */
-    predicate capturedReadOut(
-      BasicBlock bb, int i, LocalScopeSourceVariable v, ControlFlow::Nodes::AnnotatedExitNode node,
-      LocalScopeSourceVariable outer, Call call, boolean additionalCalls
-    ) {
-      node.isNormal() and
-      exists(BasicBlock pred, AssignableDefinition adef |
-        variableDefinition(pred, _, v, adef) and
-        updatesCapturedVariable(_, _, call, outer, adef, additionalCalls) and
-        pred.getASuccessor*() = bb and
-        node = bb.getNode(i)
-      )
-    }
-
-    /**
-     * Holds if a value written to captured local scope variable `outer` may be
-     * read as `inner` via `call`, at index `i` in basic block `bb`, using one or
-     * more calls (as indicated by `additionalCalls`).
-     *
-     * Example:
-     *
-     * ```csharp
-     * class C {
-     *   void M1() {
-     *     int i = 0;
-     *     void M2() => System.Console.WriteLine(i);
-     *     i = 1;
-     *     M2();
-     *   }
-     * }
-     * ```
-     *
-     * The write to `i` on line 5 is live because of the call to `M2` on line 6, which
-     * reaches the entry definition for `i` in `M2` on line 4.
-     */
-    predicate capturedReadIn(
-      BasicBlock bb, int i, LocalScopeSourceVariable outer, LocalScopeSourceVariable inner,
-      ControlFlow::Nodes::ElementNode call, boolean additionalCalls
-    ) {
-      exists(Callable reader |
-        implicitReadCandidate(outer, call) and
-        readsCapturedVariable(call, outer, reader, additionalCalls) and
-        reader = inner.getEnclosingCallable() and
-        outer.getAssignable() = inner.getAssignable() and
-        call = bb.getNode(i)
-      )
-    }
-  }
-
-  private import CapturedVariableLivenessImpl
-
-  /**
-   * Holds if the `i`th node `node` of basic block `bb` reads source variable `v`.
-   * The read at `node` is of kind `rk`.
-   *
-   * This includes implicit reads via calls.
-   */
-  private predicate variableRead(
-    BasicBlock bb, int i, SourceVariable v, ControlFlow::Node node, ReadKind rk
-  ) {
-    variableReadDirect(bb, i, v, node, rk)
-    or
-    capturedReadOut(bb, i, v, node, _, _, _) and
-    rk = CapturedVarExitRead()
-    or
-    capturedReadIn(bb, i, v, _, node, _) and
-    rk = CapturedVarCallRead()
-  }
-
-  cached
-  private module SsaImpl {
-    cached
-    predicate forceCachingInSameStage() { any() }
-
-    cached
-    newtype TDefinition =
-      TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-        variableWrite(bb, i, v, _) and
-        liveAfterWrite(bb, i, v, _)
-      } or
-      TPhiNode(SourceVariable v, ControlFlow::BasicBlocks::JoinBlock bb) {
-        phiNodeMaybeLive(bb, v) and
-        liveAtEntry(bb, v, _)
-      }
-
-    pragma[noinline]
-    private predicate phiNodeMaybeLive(ControlFlow::BasicBlocks::JoinBlock bb, SourceVariable v) {
-      exists(Definition def, BasicBlock bb1 | def.definesAt(v, bb1, _) |
-        bb1.inDominanceFrontier(bb)
-      )
-    }
-
-    cached
-    predicate isCapturedVariableDefinitionFlowIn(
-      ExplicitDefinition def, ImplicitEntryDefinition edef, ControlFlow::Nodes::ElementNode c,
-      boolean additionalCalls
-    ) {
-      exists(Definition def0 |
-        capturedReadIn(_, _, def.getSourceVariable(), edef.getSourceVariable(), c, additionalCalls) and
-        def = def0.getAnUltimateDefinition() and
-        ssaDefReachesRead(_, def0, c, CapturedVarCallRead())
-      )
-    }
-
-    cached
-    predicate isCapturedVariableDefinitionFlowOut(
-      ExplicitDefinition def, ImplicitCallDefinition cdef, boolean additionalCalls
-    ) {
-      exists(Definition def0, BasicBlock bb, int i |
-        def = def0.getAnUltimateDefinition() and
-        lastRef(def0, bb, i) and
-        capturedReadOut(bb, i, def0.getSourceVariable(), _, cdef.getSourceVariable(),
-          cdef.getCall(), additionalCalls)
-      )
-    }
-
-    cached
-    predicate explicitDefinition(Definition def, SourceVariable v, AssignableDefinition ad) {
-      exists(BasicBlock bb, int i |
-        def = TWriteDef(v, bb, i) and
-        variableDefinition(bb, i, v, ad)
-      )
-    }
-  }
-
-  private import SsaImpl
-
   private string getSplitString(Definition def) {
-    exists(BasicBlock bb, int i, ControlFlow::Node cfn |
+    exists(ControlFlow::BasicBlock bb, int i, ControlFlow::Node cfn |
       def.definesAt(_, bb, i) and
       result = cfn.(ControlFlow::Nodes::ElementNode).getSplitsString()
     |
@@ -1805,11 +160,21 @@ module Ssa {
   /**
    * A static single assignment (SSA) definition. Either an explicit variable
    * definition (`ExplicitDefinition`), an implicit variable definition
-   * (`ImplicitDefinition`), or a pseudo definition (`PseudoDefinition`).
+   * (`ImplicitDefinition`), or a phi node (`PhiNode`).
    */
-  class Definition extends TDefinition {
-    /** Gets the source variable underlying this SSA definition. */
-    SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
+  class Definition extends SsaImpl::Definition {
+    final override SourceVariable getSourceVariable() {
+      result = SsaImpl::Definition.super.getSourceVariable()
+    }
+
+    /**
+     * Gets the control flow node of this SSA definition, if any. Phi nodes are
+     * examples of SSA definitions without a control flow node, as they are
+     * modelled at index `-1` in the relevant basic block.
+     */
+    final ControlFlow::Node getControlFlowNode() {
+      exists(ControlFlow::BasicBlock bb, int i | this.definesAt(_, bb, i) | result = bb.getNode(i))
+    }
 
     /**
      * Gets a read of the source variable underlying this SSA definition that
@@ -1838,7 +203,7 @@ module Ssa {
      * - The reads of `this.Field` on lines 10 and 11 can be reached from the phi
      *   node between lines 9 and 10.
      */
-    AssignableRead getARead() { result = this.getAReadAtNode(_) }
+    final AssignableRead getARead() { result = this.getAReadAtNode(_) }
 
     /**
      * Gets a read of the source variable underlying this SSA definition at
@@ -1867,9 +232,12 @@ module Ssa {
      * - The reads of `this.Field` on lines 10 and 11 can be reached from the phi
      *   node between lines 9 and 10.
      */
-    AssignableRead getAReadAtNode(ControlFlow::Node cfn) {
-      ssaDefReachesRead(_, this, cfn, ActualRead()) and
-      result.getAControlFlowNode() = cfn
+    final AssignableRead getAReadAtNode(ControlFlow::Node cfn) {
+      exists(ControlFlow::BasicBlock bb, int i |
+        SsaImpl::ssaDefReachesRead(_, this, bb, i, SsaImpl::ActualRead()) and
+        cfn = bb.getNode(i) and
+        result.getAControlFlowNode() = cfn
+      )
     }
 
     /**
@@ -1906,7 +274,7 @@ module Ssa {
      * Subsequent reads can be found by following the steps defined by
      * `AssignableRead.getANextRead()`.
      */
-    AssignableRead getAFirstRead() { result = this.getAFirstReadAtNode(_) }
+    final AssignableRead getAFirstRead() { result = this.getAFirstReadAtNode(_) }
 
     /**
      * Gets a read of the source variable underlying this SSA definition at
@@ -1942,8 +310,8 @@ module Ssa {
      * Subsequent reads can be found by following the steps defined by
      * `AssignableRead.getANextRead()`.
      */
-    AssignableRead getAFirstReadAtNode(ControlFlow::Node cfn) {
-      firstReadSameVar(this, cfn) and
+    final AssignableRead getAFirstReadAtNode(ControlFlow::Node cfn) {
+      SsaImpl::firstReadSameVar(this, cfn) and
       result.getAControlFlowNode() = cfn
     }
 
@@ -1975,7 +343,7 @@ module Ssa {
      * - The read of `this.Field` on line 11 is a last read of the phi node
      *   between lines 9 and 10.
      */
-    AssignableRead getALastRead() { result = this.getALastReadAtNode(_) }
+    final AssignableRead getALastRead() { result = this.getALastReadAtNode(_) }
 
     /**
      * Gets a last read of the source variable underlying this SSA definition at
@@ -2005,8 +373,8 @@ module Ssa {
      * - The read of `this.Field` on line 11 is a last read of the phi node
      *   between lines 9 and 10.
      */
-    AssignableRead getALastReadAtNode(ControlFlow::Node cfn) {
-      lastReadSameVar(this, cfn) and
+    final AssignableRead getALastReadAtNode(ControlFlow::Node cfn) {
+      SsaImpl::lastReadSameVar(this, cfn) and
       result.getAControlFlowNode() = cfn
     }
 
@@ -2039,55 +407,14 @@ module Ssa {
      *   definition on line 4, the explicit definition on line 7, and the implicit
      *   definition on line 9.
      */
-    Definition getAnUltimateDefinition() {
-      result = this.getAPseudoInputOrPriorDefinition*() and
-      not result instanceof PseudoDefinition
+    final override Definition getAnUltimateDefinition() {
+      result = SsaImpl::Definition.super.getAnUltimateDefinition()
     }
 
-    /**
-     * Gets an SSA definition whose value can flow to this one in one step. This
-     * includes inputs to pseudo nodes and the prior definition of uncertain updates.
-     */
-    private Definition getAPseudoInputOrPriorDefinition() {
-      result = this.(PseudoDefinition).getAnInput() or
-      result = this.(UncertainDefinition).getPriorDefinition()
-    }
-
-    /**
-     * Holds is this SSA definition is live at the end of basic block `bb`. That is,
-     * this definition reaches the end of basic block `bb`, at which point it is still
-     * live, without crossing another SSA definition of the same source variable.
-     */
-    predicate isLiveAtEndOfBlock(BasicBlock bb) { ssaDefReachesEndOfBlock(bb, this, _) }
-
     /**
      * DEPRECATED: Use `definesAt/3` instead.
      */
-    deprecated predicate definesAt(BasicBlock bb, int i) { this.definesAt(_, bb, i) }
-
-    /**
-     * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-     * Phi nodes and entry nodes (captured variables and fields/properties) are
-     * considered to be at index `-1`, while normal variable updates are at the
-     * index of the control flow node they wrap.
-     */
-    predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-      this = TWriteDef(v, bb, i)
-      or
-      this = TPhiNode(v, bb) and i = -1
-    }
-
-    /** Gets the basic block to which this SSA definition belongs. */
-    BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-    /**
-     * Gets the control flow node of this SSA definition, if any. Phi nodes are examples
-     * of SSA definitions without a control flow node, as they are modelled at index
-     * `-1` in the relevant basic block.
-     */
-    ControlFlow::Node getControlFlowNode() {
-      exists(BasicBlock bb, int i | this.definesAt(_, bb, i) | result = bb.getNode(i))
-    }
+    deprecated predicate definesAt(ControlFlow::BasicBlock bb, int i) { this.definesAt(_, bb, i) }
 
     /**
      * Gets the syntax element associated with this SSA definition, if any.
@@ -2097,25 +424,18 @@ module Ssa {
     Element getElement() { result = this.getControlFlowNode().getElement() }
 
     /** Gets the callable to which this SSA definition belongs. */
-    Callable getEnclosingCallable() { result = this.getSourceVariable().getEnclosingCallable() }
+    final Callable getEnclosingCallable() {
+      result = this.getSourceVariable().getEnclosingCallable()
+    }
 
     /**
      * Holds if this SSA definition assigns to `out`/`ref` parameter `p`, and the
      * parameter may remain unchanged throughout the rest of the enclosing callable.
      */
-    predicate isLiveOutRefParameterDefinition(Parameter p) {
-      p.isOutOrRef() and
-      exists(Definition def, BasicBlock bb, int i |
-        this = def.getAnUltimateDefinition() and
-        lastRef(def, bb, i) and
-        variableRead(bb, i, def.getSourceVariable(), _, OutRefExitRead()) and
-        p = def.getSourceVariable().getAssignable()
-      )
+    final predicate isLiveOutRefParameterDefinition(Parameter p) {
+      SsaImpl::isLiveOutRefParameterDefinition(this, p)
     }
 
-    /** Gets a textual representation of this SSA definition. */
-    string toString() { none() }
-
     /** Gets the location of this SSA definition. */
     Location getLocation() { none() }
   }
@@ -2123,18 +443,18 @@ module Ssa {
   /**
    * An SSA definition that corresponds to an explicit assignable definition.
    */
-  class ExplicitDefinition extends Definition, TWriteDef {
+  class ExplicitDefinition extends Definition, SsaImpl::WriteDefinition {
     SourceVariable sv;
     AssignableDefinition ad;
 
-    ExplicitDefinition() { explicitDefinition(this, sv, ad) }
+    ExplicitDefinition() { SsaImpl::explicitDefinition(this, sv, ad) }
 
     /**
      * Gets an underlying assignable definition. The result is always unique,
      * except for pathological `out`/`ref` assignments like `M(out x, out x)`,
      * where there may be more than one underlying definition.
      */
-    AssignableDefinition getADefinition() { result = getADefinition(this) }
+    final AssignableDefinition getADefinition() { result = SsaImpl::getADefinition(this) }
 
     /**
      * Holds if this definition updates a captured local scope variable, and the updated
@@ -2157,10 +477,10 @@ module Ssa {
      * If this definition is the update of `i` on line 5, then the value may be read inside
      * `M2` via the call on line 6.
      */
-    predicate isCapturedVariableDefinitionFlowIn(
+    final predicate isCapturedVariableDefinitionFlowIn(
       ImplicitEntryDefinition def, ControlFlow::Nodes::ElementNode c, boolean additionalCalls
     ) {
-      isCapturedVariableDefinitionFlowIn(this, def, c, additionalCalls)
+      SsaImpl::isCapturedVariableDefinitionFlowIn(this, def, c, additionalCalls)
     }
 
     /**
@@ -2184,10 +504,10 @@ module Ssa {
      * If this definition is the update of `i` on line 4, then the value may be read outside
      * of `M2` via the call on line 5.
      */
-    predicate isCapturedVariableDefinitionFlowOut(
+    final predicate isCapturedVariableDefinitionFlowOut(
       ImplicitCallDefinition cdef, boolean additionalCalls
     ) {
-      isCapturedVariableDefinitionFlowOut(this, cdef, additionalCalls)
+      SsaImpl::isCapturedVariableDefinitionFlowOut(this, cdef, additionalCalls)
     }
 
     override Element getElement() { result = ad.getElement() }
@@ -2208,17 +528,17 @@ module Ssa {
    * (`ImplicitCallDefinition`), or an implicit definition where the qualifier is
    * updated (`ImplicitQualifierDefinition`).
    */
-  class ImplicitDefinition extends Definition {
+  class ImplicitDefinition extends Definition, SsaImpl::WriteDefinition {
     ImplicitDefinition() {
-      exists(BasicBlock bb, SourceVariable v, int i | this = TWriteDef(v, bb, i) |
-        implicitEntryDefinition(bb, v) and
+      exists(ControlFlow::BasicBlock bb, SourceVariable v, int i | this.definesAt(v, bb, i) |
+        SsaImpl::implicitEntryDefinition(bb, v) and
         i = -1
         or
-        updatesNamedFieldOrProp(bb, i, _, v, _)
+        SsaImpl::updatesNamedFieldOrProp(bb, i, _, v, _)
         or
-        updatesCapturedVariable(bb, i, _, v, _, _)
+        SsaImpl::updatesCapturedVariable(bb, i, _, v, _, _)
         or
-        variableWriteQualifier(bb, i, v, _)
+        SsaImpl::variableWriteQualifier(bb, i, v, _)
       )
     }
   }
@@ -2228,21 +548,16 @@ module Ssa {
    * at the beginning of a callable. Either the variable is a local scope variable
    * captured by the callable, or a field or property accessed inside the callable.
    */
-  class ImplicitEntryDefinition extends ImplicitDefinition, TWriteDef {
+  class ImplicitEntryDefinition extends ImplicitDefinition {
     ImplicitEntryDefinition() {
-      exists(BasicBlock bb, SourceVariable v |
-        this = TWriteDef(v, bb, -1) and
-        implicitEntryDefinition(bb, v)
+      exists(ControlFlow::BasicBlock bb, SourceVariable v |
+        this.definesAt(v, bb, -1) and
+        SsaImpl::implicitEntryDefinition(bb, v)
       )
     }
 
     /** Gets the callable that this entry definition belongs to. */
-    Callable getCallable() {
-      exists(BasicBlock bb |
-        this = TWriteDef(_, bb, _) and
-        result = bb.getCallable()
-      )
-    }
+    final Callable getCallable() { result = this.getBasicBlock().getCallable() }
 
     override Callable getElement() { result = this.getCallable() }
 
@@ -2259,18 +574,19 @@ module Ssa {
    * An SSA definition representing the potential definition of a variable
    * via a call.
    */
-  class ImplicitCallDefinition extends ImplicitDefinition, TWriteDef {
+  class ImplicitCallDefinition extends ImplicitDefinition {
     private Call c;
 
     ImplicitCallDefinition() {
-      exists(BasicBlock bb, SourceVariable v, int i | this = TWriteDef(v, bb, i) |
-        updatesNamedFieldOrProp(bb, i, c, v, _)
+      exists(ControlFlow::BasicBlock bb, SourceVariable v, int i | this.definesAt(v, bb, i) |
+        SsaImpl::updatesNamedFieldOrProp(bb, i, c, v, _)
         or
-        updatesCapturedVariable(bb, i, c, v, _, _)
+        SsaImpl::updatesCapturedVariable(bb, i, c, v, _, _)
       )
     }
 
-    Call getCall() { result = c }
+    /** Gets the underlying call. */
+    final Call getCall() { result = c }
 
     /**
      * Gets one of the definitions that may contribute to this implicit
@@ -2278,13 +594,13 @@ module Ssa {
      * the target of this call following zero or more additional calls,
      * and which targets the same assignable as this SSA definition.
      */
-    AssignableDefinition getAPossibleDefinition() {
-      exists(Callable setter | updatesNamedFieldOrProp(_, _, getCall(), _, setter) |
+    final AssignableDefinition getAPossibleDefinition() {
+      exists(Callable setter | SsaImpl::updatesNamedFieldOrProp(_, _, getCall(), _, setter) |
         result.getEnclosingCallable() = setter and
         result.getTarget() = this.getSourceVariable().getAssignable()
       )
       or
-      updatesCapturedVariable(_, _, getCall(), _, result, _) and
+      SsaImpl::updatesCapturedVariable(_, _, getCall(), _, result, _) and
       result.getTarget() = this.getSourceVariable().getAssignable()
     }
 
@@ -2299,20 +615,22 @@ module Ssa {
    * An SSA definition representing the potential definition of a variable
    * via an SSA definition for the qualifier.
    */
-  class ImplicitQualifierDefinition extends ImplicitDefinition, TWriteDef {
+  class ImplicitQualifierDefinition extends ImplicitDefinition, SsaImpl::WriteDefinition {
     private Definition q;
 
     ImplicitQualifierDefinition() {
-      exists(BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v |
-        this = TWriteDef(v, bb, i)
+      exists(
+        ControlFlow::BasicBlock bb, int i, SourceVariables::QualifiedFieldOrPropSourceVariable v
       |
-        variableWriteQualifier(bb, i, v, _) and
+        this.definesAt(v, bb, i)
+      |
+        SsaImpl::variableWriteQualifier(bb, i, v, _) and
         q.definesAt(v.getQualifier(), bb, i)
       )
     }
 
     /** Gets the SSA definition for the qualifier. */
-    Definition getQualifierDefinition() { result = q }
+    final Definition getQualifierDefinition() { result = q }
 
     override string toString() {
       result = getToStringPrefix(this) + "SSA qualifier def(" + getSourceVariable() + ")"
@@ -2327,21 +645,14 @@ module Ssa {
    *
    * Phi nodes are the canonical (and currently only) example.
    */
-  class PseudoDefinition extends Definition {
-    PseudoDefinition() { this = TPhiNode(_, _) }
-
-    /**
-     * Gets an input of this pseudo definition.
-     */
-    Definition getAnInput() { none() }
-  }
+  deprecated class PseudoDefinition = PhiNode;
 
   /**
    * An SSA phi node, that is, a pseudo definition for a variable at a point
    * in the flow graph where otherwise two or more definitions for the variable
    * would be visible.
    */
-  class PhiNode extends PseudoDefinition, TPhiNode {
+  class PhiNode extends Definition, SsaImpl::PhiNode {
     /**
      * Gets an input of this phi node. Example:
      *
@@ -2364,20 +675,7 @@ module Ssa {
      *   definition on line 4, the explicit definition on line 7, and the implicit
      *   call definition on line 9 as inputs.
      */
-    override Definition getAnInput() {
-      exists(BasicBlock bb, BasicBlock phiPred, SourceVariable v |
-        this.definesAt(v, bb, _) and
-        bb.getAPredecessor() = phiPred and
-        ssaDefReachesEndOfBlock(phiPred, result, v)
-      )
-    }
-
-    /** Holds if `inp` is an input to the phi node along the edge originating in `bb`. */
-    predicate hasInputFromBlock(Definition inp, BasicBlock bb) {
-      this.getAnInput() = inp and
-      this.getBasicBlock().getAPredecessor() = bb and
-      inp.isLiveAtEndOfBlock(bb)
-    }
+    final override Definition getAnInput() { result = SsaImpl::PhiNode.super.getAnInput() }
 
     override string toString() {
       result = getToStringPrefix(this) + "SSA phi(" + getSourceVariable() + ")"
@@ -2391,12 +689,7 @@ module Ssa {
      * does not exist in the source program.
      */
 
-    override Location getLocation() {
-      exists(ControlFlow::BasicBlocks::JoinBlock bb |
-        this = TPhiNode(_, bb) and
-        result = bb.getFirstNode().getLocation()
-      )
-    }
+    override Location getLocation() { result = this.getBasicBlock().getFirstNode().getLocation() }
   }
 
   /**
@@ -2405,27 +698,5 @@ module Ssa {
    * need not be certain), an implicit non-local update via a call, or an
    * uncertain update of the qualifier.
    */
-  class UncertainDefinition extends Definition {
-    UncertainDefinition() {
-      this =
-        any(ExplicitDefinition def |
-          forex(AssignableDefinition ad | ad = def.getADefinition() | not ad.isCertain())
-        )
-      or
-      this instanceof ImplicitCallDefinition
-      or
-      this.(ImplicitQualifierDefinition).getQualifierDefinition() instanceof UncertainDefinition
-    }
-
-    /**
-     * Gets the immediately preceding definition. Since this update is uncertain
-     * the value from the preceding definition might still be valid.
-     */
-    Definition getPriorDefinition() { ssaDefReachesUncertainDef(_, result, this) }
-  }
-
-  /** INTERNAL: Do not use. */
-  module Internal {
-    import SsaDefReaches
-  }
+  class UncertainDefinition extends Definition, SsaImpl::UncertainWriteDefinition { }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 001e071c651..6e30f8c50fa 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -10,6 +10,7 @@ private import FlowSummaryImpl as FlowSummaryImpl
 private import semmle.code.csharp.dataflow.FlowSummary
 private import semmle.code.csharp.Caching
 private import semmle.code.csharp.Conversion
+private import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
 private import semmle.code.csharp.ExprOrStmtParent
 private import semmle.code.csharp.Unification
 private import semmle.code.csharp.controlflow.Guards
@@ -291,7 +292,7 @@ module LocalFlow {
     or
     // Flow from read to next read
     exists(ControlFlow::Node cfnFrom, ControlFlow::Node cfnTo |
-      Ssa::Internal::adjacentReadPairSameVar(def, cfnFrom, cfnTo) and
+      SsaImpl::adjacentReadPairSameVar(def, cfnFrom, cfnTo) and
       nodeTo = TExprNode(cfnTo)
     |
       nodeFrom = TExprNode(cfnFrom)
@@ -299,11 +300,11 @@ module LocalFlow {
       cfnFrom = nodeFrom.(PostUpdateNode).getPreUpdateNode().getControlFlowNode()
     )
     or
-    // Flow into SSA pseudo definition
-    exists(Ssa::PseudoDefinition pseudo |
+    // Flow into phi node
+    exists(Ssa::PhiNode phi |
       localFlowSsaInput(nodeFrom, def) and
-      pseudo = nodeTo.(SsaDefinitionNode).getDefinition() and
-      def = pseudo.getAnInput()
+      phi = nodeTo.(SsaDefinitionNode).getDefinition() and
+      def = phi.getAnInput()
     )
     or
     // Flow into uncertain SSA definition
@@ -319,7 +320,7 @@ module LocalFlow {
    */
   predicate usesInstanceField(Ssa::Definition def) {
     exists(Ssa::SourceVariables::FieldOrPropSourceVariable fp | fp = def.getSourceVariable() |
-      not fp.getAssignable().isStatic()
+      not fp.getAssignable().(Modifiable).isStatic()
     )
   }
 
@@ -867,7 +868,7 @@ private module Cached {
   cached
   predicate nodeIsHidden(Node n) {
     exists(Ssa::Definition def | def = n.(SsaDefinitionNode).getDefinition() |
-      def instanceof Ssa::PseudoDefinition
+      def instanceof Ssa::PhiNode
       or
       def instanceof Ssa::ImplicitEntryDefinition
       or
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
new file mode 100644
index 00000000000..54cf939e50c
--- /dev/null
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -0,0 +1,1231 @@
+/**
+ * Provides classes for working with static single assignment (SSA) form.
+ */
+
+import csharp
+import SsaImplCommon
+
+/** A classification of variable reads. */
+newtype TReadKind =
+  /** An actual read. */
+  ActualRead() or
+  /**
+   * A pseudo read for a `ref` or `out` variable at the end of the variable's enclosing
+   * callable. A pseudo read is inserted to make assignments to `out`/`ref` variables
+   * live, for example line 1 in
+   *
+   * ```csharp
+   * void M(out int i) {
+   *   i = 0;
+   * }
+   * ```
+   */
+  OutRefExitRead() or
+  /**
+   * A pseudo read for a captured variable at the end of the capturing
+   * callable. A write to a captured variable needs to be live for the same reasons
+   * as a write to a `ref` or `out` variable (see above).
+   */
+  CapturedVarExitRead() or
+  /**
+   * A pseudo read for a captured variable via a call.
+   */
+  CapturedVarCallRead() or
+  /**
+   * A pseudo read for a `ref` variable, just prior to an update of the referenced value.
+   * A pseudo read is inserted to make assignments to the `ref` variable live, for example
+   * line 2 in
+   *
+   * ```csharp
+   * void M() {
+   *   ref int i = ref GetRef();
+   *   i = 0;
+   * }
+   * ```
+   *
+   * The pseudo read is inserted at the CFG node `i` on the left-hand side of the
+   * assignment on line 3.
+   */
+  RefReadBeforeWrite()
+
+/** A classification of variable reads. */
+class ReadKind extends TReadKind {
+  string toString() {
+    this = ActualRead() and
+    result = "ActualRead"
+    or
+    this = OutRefExitRead() and
+    result = "OutRefExitRead"
+    or
+    this = CapturedVarExitRead() and
+    result = "CapturedVarExitRead"
+    or
+    this = CapturedVarCallRead() and
+    result = "CapturedVarCallRead"
+    or
+    this = RefReadBeforeWrite() and
+    result = "RefReadBeforeWrite"
+  }
+
+  /** Holds if this kind represents a pseudo read. */
+  predicate isPseudo() { this != ActualRead() }
+}
+
+private module SourceVariableImpl {
+  private import AssignableDefinitions
+
+  /** A field or a property. */
+  class FieldOrProp extends Assignable, Modifiable {
+    FieldOrProp() {
+      this instanceof Field
+      or
+      this instanceof Property
+    }
+
+    /** Holds if this is a volatile field. */
+    predicate isVolatile() { this.(Field).isVolatile() }
+  }
+
+  /** An instance field or property. */
+  class InstanceFieldOrProp extends FieldOrProp {
+    InstanceFieldOrProp() { not this.isStatic() }
+  }
+
+  /** An access to a field or a property. */
+  class FieldOrPropAccess extends AssignableAccess, QualifiableExpr {
+    FieldOrPropAccess() { this.getTarget() instanceof FieldOrProp }
+  }
+
+  /** An access to a field or a property that reads the underlying value. */
+  class FieldOrPropRead extends FieldOrPropAccess, AssignableRead { }
+
+  /**
+   * Holds if `fpa` is an access inside callable `c` of `this`-qualified or
+   * static field or property `fp`.
+   */
+  predicate isPlainFieldOrPropAccess(FieldOrPropAccess fpa, FieldOrProp fp, Callable c) {
+    fieldOrPropAccessInCallable(fpa, fp, c) and
+    (ownFieldOrPropAccess(fpa) or fp.isStatic())
+  }
+
+  /**
+   * Holds if `fpa` is an access inside callable `c` of instance field or property
+   * `fp` with qualifier `q`.
+   */
+  predicate isQualifiedFieldOrPropAccess(
+    FieldOrPropAccess fpa, InstanceFieldOrProp fp, Callable c, Ssa::SourceVariable q
+  ) {
+    fieldOrPropAccessInCallable(fpa, fp, c) and
+    fpa.getQualifier() = q.getAnAccess()
+  }
+
+  /** Holds if `fpa` is an access inside callable `c` of field or property `fp`. */
+  private predicate fieldOrPropAccessInCallable(FieldOrPropAccess fpa, FieldOrProp fp, Callable c) {
+    fp = fpa.getTarget() and
+    c = fpa.getEnclosingCallable()
+  }
+
+  /** Holds if `fpa` is an access to an instance field or property of `this`. */
+  predicate ownFieldOrPropAccess(FieldOrPropAccess fpa) { fpa.getQualifier() instanceof ThisAccess }
+
+  /**
+   * Holds if the `i`th node of basic block `bb` is assignable definition `ad`
+   * targeting source variable `v`.
+   */
+  predicate variableDefinition(
+    ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, AssignableDefinition ad
+  ) {
+    ad = v.getADefinition() and
+    ad.getAControlFlowNode() = bb.getNode(i) and
+    // In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
+    not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = ad |
+      second.getAssignment() = first.getAssignment() and
+      second.getEvaluationOrder() > first.getEvaluationOrder() and
+      second = v.getADefinition()
+    ) and
+    // In cases like `M(out x, out x)`, there is no inherent evaluation order, so we
+    // collapse the two definitions of `x`, using the first access as the representative,
+    // and expose both definitions in `ExplicitDefinition.getADefinition()`
+    not ad = getASameOutRefDefAfter(v, _)
+  }
+
+  /**
+   * Gets an `out`/`ref` definition of the same source variable as the `out`/`ref`
+   * definition `def`, belonging to the same call, at a position after `def`.
+   */
+  OutRefDefinition getASameOutRefDefAfter(Ssa::SourceVariable v, OutRefDefinition def) {
+    def = v.getADefinition() and
+    result.getCall() = def.getCall() and
+    result.getIndex() > def.getIndex() and
+    result = v.getADefinition()
+  }
+
+  /**
+   * Holds if the `i`th node of basic block `bb` is a (potential) write to source
+   * variable `v`. The Boolean `certain` indicates whether the write is certain.
+   *
+   * This excludes implicit writes via calls.
+   */
+  predicate variableWriteDirect(
+    ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain
+  ) {
+    exists(AssignableDefinition ad | variableDefinition(bb, i, v, ad) |
+      if any(AssignableDefinition ad0 | ad0 = ad or ad0 = getASameOutRefDefAfter(v, ad)).isCertain()
+      then certain = true
+      else certain = false
+    )
+    or
+    variableWriteDirect(bb, i, v.(QualifiedFieldOrPropSourceVariable).getQualifier(), certain)
+    or
+    implicitEntryDefinition(bb, v) and
+    i = -1 and
+    certain = true
+  }
+
+  /**
+   * Holds if the `i`th node of basic block `bb` reads source variable `v`.
+   * The read is of kind `rk`.
+   *
+   * This excludes implicit reads via calls.
+   */
+  predicate variableReadDirect(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, ReadKind rk) {
+    v.getAnAccess().(AssignableRead) = bb.getNode(i).getElement() and
+    rk = ActualRead()
+    or
+    outRefExitRead(bb, i, v) and
+    rk = OutRefExitRead()
+    or
+    refReadBeforeWrite(bb, i, v) and
+    rk = RefReadBeforeWrite()
+  }
+
+  private predicate outRefExitRead(ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v) {
+    exists(ControlFlow::Nodes::AnnotatedExitNode exit |
+      exit.isNormal() and
+      exists(LocalScopeVariable lsv |
+        lsv = v.getAssignable() and
+        bb.getNode(i) = exit and
+        exit.getCallable() = lsv.getCallable()
+      |
+        lsv.(Parameter).isOutOrRef()
+        or
+        lsv.isRef() and
+        strictcount(v.getAnAccess()) > 1
+      )
+    )
+  }
+
+  private predicate refReadBeforeWrite(ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v) {
+    exists(AssignableDefinitions::AssignmentDefinition def, LocalVariable lv |
+      def.getTarget() = lv and
+      lv.isRef() and
+      lv = v.getAssignable() and
+      bb.getNode(i) = def.getAControlFlowNode()
+    )
+  }
+
+  /**
+   * Holds if `fp` is a field or a property that is interesting as a basis for SSA.
+   *
+   * - A volatile field is never interesting, since all reads must reread from
+   *   memory and we are forced to assume that the value can change at any point.
+   * - A property is only interesting if it is "field-like", that is, it is a
+   *   non-overridable trivial property.
+   */
+  predicate trackFieldOrProp(FieldOrProp fp) {
+    not fp.isVolatile() and
+    (
+      fp instanceof Field
+      or
+      fp = any(TrivialProperty p | not p.isOverridableOrImplementable())
+    )
+  }
+}
+
+private import SourceVariableImpl
+private import Ssa::SourceVariables
+
+private module CallGraph {
+  private import semmle.code.csharp.dispatch.Dispatch
+
+  /**
+   * Gets a potential run-time target for the call `c`.
+   *
+   * This predicate differs from `Call.getARuntimeTarget()` in three ways:
+   *
+   * (1) The returned callable is always a source declaration,
+   *
+   * (2) a simpler analysis is applied for delegate calls (needed to avoid making
+   *     the SSA library and `Call.getARuntimeTarget()` mutually recursive), and
+   *
+   * (3) indirect calls to delegates via calls to library callables are included.
+   *
+   * The Boolean `libraryDelegateCall` indicates whether `c` is a call to a library
+   * method and the result is a delegate passed to `c`. For example, in
+   *
+   * ```csharp
+   * Lazy<int> M1()
+   * {
+   *     return new Lazy<int>(M2);
+   * }
+   * ```
+   *
+   * the constructor call `new Lazy<int>(M2)` includes `M2` as a target.
+   */
+  Callable getARuntimeTarget(Call c, boolean libraryDelegateCall) {
+    // Non-delegate call: use dispatch library
+    exists(DispatchCall dc | dc.getCall() = c |
+      result = dc.getADynamicTarget().getUnboundDeclaration() and
+      libraryDelegateCall = false
+    )
+    or
+    // Delegate call: use simple analysis
+    result = SimpleDelegateAnalysis::getARuntimeDelegateTarget(c, libraryDelegateCall)
+  }
+
+  private module SimpleDelegateAnalysis {
+    private import semmle.code.csharp.dataflow.internal.DelegateDataFlow
+    private import semmle.code.csharp.dataflow.internal.Steps
+    private import semmle.code.csharp.frameworks.system.linq.Expressions
+
+    /**
+     * Holds if `c` is a call that (potentially) calls the delegate expression `e`.
+     * Either `c` is a delegate call and `e` is the qualifier, or `c` is a call to
+     * a library callable and `e` is a delegate argument.
+     */
+    private predicate delegateCall(Call c, Expr e, boolean libraryDelegateCall) {
+      c = any(DelegateCall dc | e = dc.getDelegateExpr()) and
+      libraryDelegateCall = false
+      or
+      c.getTarget().fromLibrary() and
+      e = c.getAnArgument() and
+      e.getType() instanceof SystemLinqExpressions::DelegateExtType and
+      libraryDelegateCall = true
+    }
+
+    /** Holds if expression `e` is a delegate creation for callable `c` of type `t`. */
+    private predicate delegateCreation(Expr e, Callable c, SystemLinqExpressions::DelegateExtType dt) {
+      e =
+        any(AnonymousFunctionExpr afe |
+          dt = afe.getType() and
+          c = afe
+        )
+      or
+      e =
+        any(CallableAccess ca |
+          c = ca.getTarget().getUnboundDeclaration() and
+          dt = ca.getType()
+        )
+    }
+
+    private predicate delegateFlowStep(Expr pred, Expr succ) {
+      Steps::stepClosed(pred, succ)
+      or
+      exists(Call call, Callable callable |
+        callable.getUnboundDeclaration().canReturn(pred) and
+        call = succ
+      |
+        callable = call.getTarget() or
+        callable = call.getTarget().(Method).getAnOverrider+() or
+        callable = call.getTarget().(Method).getAnUltimateImplementor() or
+        callable = getARuntimeDelegateTarget(call, false)
+      )
+      or
+      pred = succ.(DelegateCreation).getArgument()
+      or
+      exists(AssignableDefinition def, Assignable a |
+        a instanceof Field or
+        a instanceof Property
+      |
+        a = def.getTarget() and
+        succ.(AssignableRead) = a.getAnAccess() and
+        pred = def.getSource()
+      )
+      or
+      exists(AddEventExpr ae | succ.(EventAccess).getTarget() = ae.getTarget() |
+        pred = ae.getRValue()
+      )
+    }
+
+    private predicate reachesDelegateCall(Expr e) {
+      delegateCall(_, e, _)
+      or
+      exists(Expr mid | reachesDelegateCall(mid) | delegateFlowStep(e, mid))
+    }
+
+    pragma[nomagic]
+    private predicate delegateFlowStepReaches(Expr pred, Expr succ) {
+      delegateFlowStep(pred, succ) and
+      reachesDelegateCall(succ)
+    }
+
+    private Expr delegateCallSource(Callable c) {
+      delegateCreation(result, c, _)
+      or
+      delegateFlowStepReaches(delegateCallSource(c), result)
+    }
+
+    /** Gets a run-time target for the delegate call `c`. */
+    Callable getARuntimeDelegateTarget(Call c, boolean libraryDelegateCall) {
+      delegateCall(c, delegateCallSource(result), libraryDelegateCall)
+    }
+  }
+
+  /** Holds if `(c1,c2)` is an edge in the call graph. */
+  predicate callEdge(Callable c1, Callable c2) {
+    exists(Call c | c.getEnclosingCallable() = c1 and c2 = getARuntimeTarget(c, _))
+  }
+}
+
+private import CallGraph
+
+/**
+ * The SSA construction for a field or a property `fp` relies on implicit
+ * update nodes at every call site that conceivably could reach an update
+ * of the field or property. For example, there is an implicit update of
+ * `this.Field` on line 7 in
+ *
+ * ```csharp
+ * int Field;
+ *
+ * void SetField(int i) { Field = i; }
+ *
+ * int M() {
+ *   Field = 0;
+ *   SetField(1); // implicit update of `this.Field`
+ *   return Field;
+ * }
+ * ```
+ *
+ * At a first approximation, we need to find update paths of the form:
+ *
+ * ```
+ *   Call --(callEdge)-->* Callable(setter of fp)
+ * ```
+ *
+ * This can be improved by excluding paths ending in:
+ *
+ * ```
+ *   Constructor --(intraInstanceCallEdge)-->+ Callable(setter of this.fp)
+ * ```
+ *
+ * as these updates are guaranteed not to alias with the `fp` under
+ * consideration.
+ *
+ * This set of paths can be expressed positively by noting that those
+ * that set `this.fp`, end in zero or more `intraInstanceCallEdge`s between
+ * callables, and before those is either the originating `Call`:
+ *
+ * ```
+ *   Call --(intraInstanceCallEdge)-->* Callable(setter of this.fp)
+ * ```
+ *
+ * or a `crossInstanceCallEdge`:
+ *
+ * ```
+ *   Call --crossInstanceCallEdge--> Callable
+ *        --(intraInstanceCallEdge)-->* Callable(setter of this.fp)
+ * ```
+ */
+private module FieldOrPropsImpl {
+  /**
+   * A callable that is neither static nor a constructor.
+   */
+  private class InstanceCallable extends Callable {
+    InstanceCallable() {
+      not this.(Modifiable).isStatic() and
+      not this instanceof Constructor
+    }
+  }
+
+  private class FieldOrPropDefinition extends AssignableDefinition {
+    FieldOrPropDefinition() { this.getTarget() instanceof FieldOrProp }
+  }
+
+  /**
+   * Holds if `fpdef` is a definition that is not relevant as an implicit
+   * SSA update, since it is an initialization and therefore cannot alias.
+   */
+  private predicate init(FieldOrPropDefinition fpdef) {
+    exists(FieldOrPropAccess access | access = fpdef.getTargetAccess() |
+      fpdef.getEnclosingCallable() instanceof Constructor and
+      ownFieldOrPropAccess(access)
+      or
+      exists(LocalVariable v |
+        v.getAnAccess() = access.getQualifier() and
+        not v.isCaptured() and
+        forex(AssignableDefinition def | def.getTarget() = v and exists(def.getSource()) |
+          def.getSource() instanceof ObjectCreation
+        )
+      )
+    )
+    or
+    fpdef.(AssignableDefinitions::AssignmentDefinition).getAssignment() instanceof MemberInitializer
+  }
+
+  /**
+   * Holds if `fpdef` is an update of `fp` in `c` that is relevant for SSA construction.
+   */
+  private predicate relevantDefinition(Callable c, FieldOrProp fp, FieldOrPropDefinition fpdef) {
+    fpdef.getTarget() = fp and
+    not init(fpdef) and
+    fpdef.getEnclosingCallable() = c and
+    exists(FieldOrPropSourceVariable tf | tf.getAssignable() = fp)
+  }
+
+  /**
+   * Holds if callable `c` can change the value of `this.fp` and is relevant
+   * for SSA construction.
+   */
+  private predicate setsOwnFieldOrProp(InstanceCallable c, FieldOrProp fp) {
+    exists(FieldOrPropDefinition fpdef | relevantDefinition(c, fp, fpdef) |
+      ownFieldOrPropAccess(fpdef.getTargetAccess())
+    )
+  }
+
+  /**
+   * Holds if callable `c` can change the value of `fp` and is relevant for SSA
+   * construction excluding those cases covered by `setsOwnFieldOrProp`.
+   */
+  private predicate setsOtherFieldOrProp(Callable c, FieldOrProp fp) {
+    exists(FieldOrPropDefinition fpdef | relevantDefinition(c, fp, fpdef) |
+      not ownFieldOrPropAccess(fpdef.getTargetAccess())
+    )
+  }
+
+  /**
+   * Holds if `(c1,c2)` is a call edge to a callable that does not change the
+   * value of `this`.
+   *
+   * Constructor-to-constructor calls can also be intra-instance, but are not
+   * included, as this does not affect whether a call chain ends in
+   *
+   * ```
+   *   Constructor --(intraInstanceCallEdge)-->+ Callable(setter of this.f)
+   * ```
+   */
+  private predicate intraInstanceCallEdge(Callable c1, InstanceCallable c2) {
+    exists(Call c |
+      c.getEnclosingCallable() = c1 and
+      c2 = getARuntimeTarget(c, _) and
+      c.(QualifiableExpr).targetIsLocalInstance()
+    )
+  }
+
+  /**
+   * Holds if `(c1,c2)` is an edge in the call graph excluding
+   * `intraInstanceCallEdge`.
+   */
+  private predicate crossInstanceCallEdge(Callable c1, Callable c2) {
+    callEdge(c1, c2) and
+    not intraInstanceCallEdge(c1, c2)
+  }
+
+  pragma[noinline]
+  predicate callAt(ControlFlow::BasicBlock bb, int i, Call call) {
+    bb.getNode(i) = call.getAControlFlowNode() and
+    getARuntimeTarget(call, _).hasBody()
+  }
+
+  /**
+   * Holds if `call` occurs in basic block `bb` at index `i`, `fp` has
+   * an update somewhere, and `fp` is likely to be live in `bb` at index
+   * `i`.
+   */
+  predicate updateCandidate(
+    ControlFlow::BasicBlock bb, int i, FieldOrPropSourceVariable fp, Call call
+  ) {
+    callAt(bb, i, call) and
+    call.getEnclosingCallable() = fp.getEnclosingCallable() and
+    relevantDefinition(_, fp.getAssignable(), _) and
+    not variableWriteDirect(bb, i, fp, _)
+  }
+
+  private predicate source(
+    Call call, FieldOrPropSourceVariable fps, FieldOrProp fp, Callable c, boolean fresh
+  ) {
+    updateCandidate(_, _, fps, call) and
+    c = getARuntimeTarget(call, _) and
+    fp = fps.getAssignable() and
+    if c instanceof Constructor then fresh = true else fresh = false
+  }
+
+  /**
+   * A callable in a potential call-chain between a source that cares about the
+   * value of some field `f` and a sink that may overwrite `f`. The Boolean
+   * `fresh` indicates whether the instance `this` in `c` has been freshly
+   * allocated along the call-chain.
+   */
+  private newtype TCallableNode =
+    MkCallableNode(Callable c, boolean fresh) { source(_, _, _, c, fresh) or edge(_, c, fresh) }
+
+  private predicate edge(TCallableNode n, Callable c2, boolean f2) {
+    exists(Callable c1, boolean f1 | n = MkCallableNode(c1, f1) |
+      intraInstanceCallEdge(c1, c2) and f2 = f1
+      or
+      crossInstanceCallEdge(c1, c2) and
+      if c2 instanceof Constructor then f2 = true else f2 = false
+    )
+  }
+
+  private predicate edge(TCallableNode n1, TCallableNode n2) {
+    exists(Callable c2, boolean f2 |
+      edge(n1, c2, f2) and
+      n2 = MkCallableNode(c2, f2)
+    )
+  }
+
+  pragma[noinline]
+  private predicate source(Call call, FieldOrPropSourceVariable fps, FieldOrProp fp, TCallableNode n) {
+    exists(Callable c, boolean fresh |
+      source(call, fps, fp, c, fresh) and
+      n = MkCallableNode(c, fresh)
+    )
+  }
+
+  private predicate sink(Callable c, FieldOrProp fp, TCallableNode n) {
+    relevantDefinition(c, fp, _) and
+    (
+      setsOwnFieldOrProp(c, fp) and n = MkCallableNode(c, false)
+      or
+      setsOtherFieldOrProp(c, fp) and n = MkCallableNode(c, _)
+    )
+  }
+
+  private predicate prunedNode(TCallableNode n) {
+    sink(_, _, n)
+    or
+    exists(TCallableNode mid | edge(n, mid) and prunedNode(mid))
+  }
+
+  private predicate prunedEdge(TCallableNode n1, TCallableNode n2) {
+    prunedNode(n1) and
+    prunedNode(n2) and
+    edge(n1, n2)
+  }
+
+  private predicate edgePlus(TCallableNode c1, TCallableNode c2) = fastTC(prunedEdge/2)(c1, c2)
+
+  pragma[noopt]
+  predicate updatesNamedFieldOrProp(FieldOrPropSourceVariable fps, Call call, Callable setter) {
+    exists(TCallableNode src, TCallableNode sink, FieldOrProp fp |
+      source(call, fps, fp, src) and
+      sink(setter, fp, sink) and
+      (src = sink or edgePlus(src, sink))
+    )
+  }
+}
+
+/**
+ * As in the SSA construction for fields and properties, SSA construction
+ * for captured variables relies on implicit update nodes at every call
+ * site that conceivably could reach an update of the captured variable.
+ * For example, there is an implicit update of `v` on line 4 in
+ *
+ * ```csharp
+ * int M() {
+ *   int i = 0;
+ *   Action a = () => { i = 1; };
+ *   a(); // implicit update of `v`
+ *   return i;
+ * }
+ * ```
+ *
+ * We find update paths of the form:
+ *
+ * ```
+ *   Call --(callEdge)-->* Callable(update of v)
+ * ```
+ *
+ * For simplicity, and for performance reasons, we ignore cases where a path
+ * goes through the callable that introduces `v`; such a path does not
+ * represent an actual update, as a new copy of `v` is updated.
+ */
+private module CapturedVariableImpl {
+  /**
+   * A local scope variable that is captured, and updated by at least one capturer.
+   */
+  private class CapturedWrittenLocalScopeVariable extends LocalScopeVariable {
+    CapturedWrittenLocalScopeVariable() {
+      exists(AssignableDefinition def | def.getTarget() = this |
+        def.getEnclosingCallable() != this.getCallable()
+      )
+    }
+  }
+
+  private class CapturedWrittenLocalScopeSourceVariable extends LocalScopeSourceVariable {
+    CapturedWrittenLocalScopeSourceVariable() {
+      this.getAssignable() instanceof CapturedWrittenLocalScopeVariable
+    }
+  }
+
+  private class CapturedWrittenLocalScopeVariableDefinition extends AssignableDefinition {
+    CapturedWrittenLocalScopeVariableDefinition() {
+      this.getTarget() instanceof CapturedWrittenLocalScopeVariable
+    }
+  }
+
+  /**
+   * Holds if `vdef` is an update of captured variable `v` in callable `c`
+   * that is relevant for SSA construction.
+   */
+  predicate relevantDefinition(
+    Callable c, CapturedWrittenLocalScopeVariable v,
+    CapturedWrittenLocalScopeVariableDefinition vdef
+  ) {
+    exists(ControlFlow::BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable sv |
+      vdef.getTarget() = v and
+      vdef.getEnclosingCallable() = c and
+      sv.getAssignable() = v and
+      bb.getNode(i) = vdef.getAControlFlowNode() and
+      c != v.getCallable()
+    )
+  }
+
+  /**
+   * Holds if `call` occurs in basic block `bb` at index `i`, captured variable
+   * `v` has an update somewhere, and `v` is likely to be live in `bb` at index
+   * `i`.
+   */
+  predicate updateCandidate(
+    ControlFlow::BasicBlock bb, int i, CapturedWrittenLocalScopeSourceVariable v, Call call
+  ) {
+    FieldOrPropsImpl::callAt(bb, i, call) and
+    call.getEnclosingCallable() = v.getEnclosingCallable() and
+    exists(Assignable a |
+      a = v.getAssignable() and
+      relevantDefinition(_, a, _) and
+      not exists(AssignableDefinitions::OutRefDefinition def |
+        def.getCall() = call and
+        def.getTarget() = a
+      )
+    )
+  }
+
+  private predicate source(
+    Call call, CapturedWrittenLocalScopeSourceVariable v,
+    CapturedWrittenLocalScopeVariable captured, Callable c, boolean libraryDelegateCall
+  ) {
+    updateCandidate(_, _, v, call) and
+    c = getARuntimeTarget(call, libraryDelegateCall) and
+    captured = v.getAssignable() and
+    relevantDefinition(_, captured, _)
+  }
+
+  /**
+   * Holds if `c` is a relevant part of the call graph for
+   * `updatesCapturedVariable` based on following edges in forward direction.
+   */
+  private predicate reachbleFromSource(Callable c) {
+    source(_, _, _, c, _)
+    or
+    exists(Callable mid | reachbleFromSource(mid) | callEdge(mid, c))
+  }
+
+  private predicate sink(Callable c, CapturedWrittenLocalScopeVariable captured) {
+    reachbleFromSource(c) and
+    relevantDefinition(c, captured, _)
+  }
+
+  private predicate prunedCallable(Callable c) {
+    sink(c, _)
+    or
+    exists(Callable mid | callEdge(c, mid) and prunedCallable(mid))
+  }
+
+  private predicate prunedEdge(Callable c1, Callable c2) {
+    prunedCallable(c1) and
+    prunedCallable(c2) and
+    callEdge(c1, c2)
+  }
+
+  private predicate edgePlus(Callable c1, Callable c2) = fastTC(prunedEdge/2)(c1, c2)
+
+  /**
+   * Holds if `call` may change the value of captured variable `v`. The actual
+   * update occurs in `writer`. That is, `writer` can be reached from `call`
+   * using zero or more additional calls (as indicated by `additionalCalls`).
+   * One of the intermediate callables may be the callable that introduces `v`,
+   * in which case `call` is not an actual update.
+   */
+  pragma[noopt]
+  predicate updatesCapturedVariableWriter(
+    Call call, CapturedWrittenLocalScopeSourceVariable v, Callable writer, boolean additionalCalls
+  ) {
+    exists(Callable src, CapturedWrittenLocalScopeVariable captured, boolean libraryDelegateCall |
+      source(call, v, captured, src, libraryDelegateCall) and
+      sink(writer, captured) and
+      (
+        src = writer and additionalCalls = libraryDelegateCall
+        or
+        edgePlus(src, writer) and additionalCalls = true
+      )
+    )
+  }
+}
+
+/**
+ * Holds if the `i`th node of basic block `bb` is a (potential) write to source
+ * variable `v`. The Boolean `certain` indicates whether the write is certain.
+ *
+ * This includes implicit writes via calls.
+ */
+predicate variableWrite(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
+  variableWriteDirect(bb, i, v, certain)
+  or
+  variableWriteQualifier(bb, i, v, certain)
+  or
+  updatesNamedFieldOrProp(bb, i, _, v, _) and
+  certain = false
+  or
+  updatesCapturedVariable(bb, i, _, v, _, _) and
+  certain = false
+}
+
+/**
+ * Liveness analysis to restrict the size of the SSA representation for
+ * captured variables.
+ *
+ * Example:
+ *
+ * ```csharp
+ * void M() {
+ *   int i = 0;
+ *   void M2() {
+ *     System.Console.WriteLine(i);
+ *   }
+ *   M2();
+ * }
+ * ```
+ *
+ * The definition of `i` on line 2 is live, because of the call to `M2` on
+ * line 6. However, that call is not a direct read of `i`, so we account
+ * for that by inserting an implicit read of `i` on line 6.
+ *
+ * The predicates in this module follow the same structure as those in
+ * `CapturedVariableImpl`.
+ */
+private module CapturedVariableLivenessImpl {
+  /**
+   * Holds if `c` is a callable that captures local scope variable `v`, and
+   * `c` may read the value of the captured variable.
+   */
+  private predicate capturerReads(Callable c, LocalScopeVariable v) {
+    exists(LocalScopeSourceVariable sv |
+      variableReadDirect(_, _, sv, _) and
+      c = sv.getEnclosingCallable() and
+      v = sv.getAssignable() and
+      v.getCallable() != c
+    )
+  }
+
+  /**
+   * A local scope variable that is captured, and read by at least one capturer.
+   */
+  private class CapturedReadLocalScopeVariable extends LocalScopeVariable {
+    CapturedReadLocalScopeVariable() { capturerReads(_, this) }
+  }
+
+  private class CapturedReadLocalScopeSourceVariable extends LocalScopeSourceVariable {
+    CapturedReadLocalScopeSourceVariable() {
+      this.getAssignable() instanceof CapturedReadLocalScopeVariable
+    }
+  }
+
+  /**
+   * Holds if a write to captured source variable `v` may be read by a
+   * callable reachable from the call `c`.
+   */
+  private predicate implicitReadCandidate(
+    CapturedReadLocalScopeSourceVariable v, ControlFlow::Nodes::ElementNode c
+  ) {
+    exists(ControlFlow::BasicBlock bb, int i | variableWriteDirect(bb, i, v, _) |
+      c = bb.getNode(any(int j | j > i))
+      or
+      c = bb.getASuccessor+().getANode()
+    )
+  }
+
+  private predicate source(
+    ControlFlow::Nodes::ElementNode call, CapturedReadLocalScopeSourceVariable v,
+    CapturedReadLocalScopeVariable captured, Callable c, boolean libraryDelegateCall
+  ) {
+    implicitReadCandidate(v, call) and
+    c = getARuntimeTarget(call.getElement(), libraryDelegateCall) and
+    captured = v.getAssignable() and
+    capturerReads(_, captured)
+  }
+
+  /**
+   * Holds if `c` is a relevant part of the call graph for
+   * `readsCapturedVariable` based on following edges in forward direction.
+   */
+  private predicate reachbleFromSource(Callable c) {
+    source(_, _, _, c, _)
+    or
+    exists(Callable mid | reachbleFromSource(mid) | callEdge(mid, c))
+  }
+
+  private predicate sink(Callable c, CapturedReadLocalScopeVariable captured) {
+    reachbleFromSource(c) and
+    capturerReads(c, captured)
+  }
+
+  private predicate prunedCallable(Callable c) {
+    sink(c, _)
+    or
+    exists(Callable mid | callEdge(c, mid) and prunedCallable(mid))
+  }
+
+  private predicate prunedEdge(Callable c1, Callable c2) {
+    prunedCallable(c1) and
+    prunedCallable(c2) and
+    callEdge(c1, c2)
+  }
+
+  private predicate edgePlus(Callable c1, Callable c2) = fastTC(prunedEdge/2)(c1, c2)
+
+  /**
+   * Holds if `call` may read the value of captured variable `v`. The actual
+   * read occurs in `reader`. That is, `reader` can be reached from `call`
+   * using zero or more additional calls (as indicated by `additionalCalls`).
+   * One of the intermediate callables may be a callable that writes to `v`,
+   * in which case `call` is not an actual read.
+   */
+  pragma[noopt]
+  private predicate readsCapturedVariable(
+    ControlFlow::Nodes::ElementNode call, CapturedReadLocalScopeSourceVariable v, Callable reader,
+    boolean additionalCalls
+  ) {
+    exists(Callable src, CapturedReadLocalScopeVariable captured, boolean libraryDelegateCall |
+      source(call, v, captured, src, libraryDelegateCall) and
+      sink(reader, captured) and
+      (
+        src = reader and additionalCalls = libraryDelegateCall
+        or
+        edgePlus(src, reader) and additionalCalls = true
+      )
+    )
+  }
+
+  /**
+   * Holds if captured local scope variable `v` is written inside the callable
+   * to which `bb` belongs, and the value may be read via `call` using zero or
+   * more additional calls (as indicated by `additionalCalls`).
+   *
+   * In this case a pseudo-read is inserted at the exit node at index `i` in `bb`,
+   * in order to make the write live.
+   *
+   * Example:
+   *
+   * ```csharp
+   * class C {
+   *   void M1() {
+   *     int i = 0;
+   *     void M2() { i = 2; };
+   *     M2();
+   *     System.Console.WriteLine(i);
+   *   }
+   * }
+   * ```
+   *
+   * The write to `i` inside `M2` on line 4 is live because of the implicit call
+   * definition on line 5.
+   */
+  predicate capturedReadOut(
+    ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v, LocalScopeSourceVariable outer,
+    Call call, boolean additionalCalls
+  ) {
+    exists(
+      ControlFlow::Nodes::AnnotatedExitNode exit, ControlFlow::BasicBlock pred,
+      AssignableDefinition adef
+    |
+      exit.isNormal() and
+      variableDefinition(pred, _, v, adef) and
+      updatesCapturedVariable(_, _, call, outer, adef, additionalCalls) and
+      pred.getASuccessor*() = bb and
+      exit = bb.getNode(i)
+    )
+  }
+
+  /**
+   * Holds if a value written to captured local scope variable `outer` may be
+   * read as `inner` via `call`, at index `i` in basic block `bb`, using one or
+   * more calls (as indicated by `additionalCalls`).
+   *
+   * Example:
+   *
+   * ```csharp
+   * class C {
+   *   void M1() {
+   *     int i = 0;
+   *     void M2() => System.Console.WriteLine(i);
+   *     i = 1;
+   *     M2();
+   *   }
+   * }
+   * ```
+   *
+   * The write to `i` on line 5 is live because of the call to `M2` on line 6, which
+   * reaches the entry definition for `i` in `M2` on line 4.
+   */
+  predicate capturedReadIn(
+    ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable outer,
+    LocalScopeSourceVariable inner, ControlFlow::Nodes::ElementNode call, boolean additionalCalls
+  ) {
+    exists(Callable reader |
+      implicitReadCandidate(outer, call) and
+      readsCapturedVariable(call, outer, reader, additionalCalls) and
+      reader = inner.getEnclosingCallable() and
+      outer.getAssignable() = inner.getAssignable() and
+      call = bb.getNode(i)
+    )
+  }
+}
+
+private import CapturedVariableLivenessImpl
+
+/**
+ * Holds if the `i`th of basic block `bb` reads source variable `v`.
+ * The read is of kind `rk`.
+ *
+ * This includes implicit reads via calls.
+ */
+predicate variableRead(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, ReadKind rk) {
+  variableReadDirect(bb, i, v, rk)
+  or
+  capturedReadOut(bb, i, v, _, _, _) and
+  rk = CapturedVarExitRead()
+  or
+  capturedReadIn(bb, i, v, _, _, _) and
+  rk = CapturedVarCallRead()
+}
+
+cached
+private module Cached {
+  cached
+  newtype TSourceVariable =
+    TLocalVar(Callable c, LocalScopeVariable v) {
+      c = v.getCallable()
+      or
+      // Local scope variables can be captured
+      c = v.getAnAccess().getEnclosingCallable()
+    } or
+    TPlainFieldOrProp(Callable c, FieldOrProp f) {
+      exists(FieldOrPropRead fr | isPlainFieldOrPropAccess(fr, f, c)) and
+      trackFieldOrProp(f)
+    } or
+    TQualifiedFieldOrProp(Callable c, Ssa::SourceVariable q, InstanceFieldOrProp f) {
+      exists(FieldOrPropRead fr | isQualifiedFieldOrPropAccess(fr, f, c, q)) and
+      trackFieldOrProp(f)
+    }
+
+  /** Gets an access to source variable `v`. */
+  cached
+  AssignableAccess getAnAccess(Ssa::SourceVariable v) {
+    exists(Callable c |
+      exists(LocalScopeVariable lsv | v = TLocalVar(c, lsv) |
+        result = lsv.getAnAccess() and
+        result.getEnclosingCallable() = c
+      )
+      or
+      exists(FieldOrProp fp | v = TPlainFieldOrProp(c, fp) |
+        isPlainFieldOrPropAccess(result, fp, c)
+      )
+      or
+      exists(FieldOrProp fp, Ssa::SourceVariable q | v = TQualifiedFieldOrProp(c, q, fp) |
+        isQualifiedFieldOrPropAccess(result, fp, c, q)
+      )
+    )
+  }
+
+  cached
+  predicate implicitEntryDefinition(
+    ControlFlow::ControlFlow::BasicBlocks::EntryBlock bb, Ssa::SourceVariable v
+  ) {
+    exists(Callable c |
+      c = bb.getCallable() and
+      c = v.getEnclosingCallable()
+    |
+      // Captured variable
+      exists(LocalScopeVariable lsv |
+        v = any(LocalScopeSourceVariable lv | lsv = lv.getAssignable())
+      |
+        lsv.getCallable() != c
+      )
+      or
+      // Each tracked field and property has an implicit entry definition
+      v instanceof PlainFieldOrPropSourceVariable
+    )
+  }
+
+  cached
+  AssignableDefinition getADefinition(Ssa::ExplicitDefinition def) {
+    exists(Ssa::SourceVariable v, AssignableDefinition ad | explicitDefinition(def, v, ad) |
+      result = ad or
+      result = getASameOutRefDefAfter(v, ad)
+    )
+  }
+
+  /**
+   * Holds if `call` may change the value of field or property `fp`. The actual
+   * update occurs in `setter`.
+   */
+  cached
+  predicate updatesNamedFieldOrProp(
+    ControlFlow::BasicBlock bb, int i, Call c, FieldOrPropSourceVariable fp, Callable setter
+  ) {
+    FieldOrPropsImpl::updateCandidate(bb, i, fp, c) and
+    FieldOrPropsImpl::updatesNamedFieldOrProp(fp, c, setter)
+  }
+
+  /**
+   * Holds if `call` may change the value of captured variable `v`. The actual
+   * update occurs in `def`.
+   */
+  cached
+  predicate updatesCapturedVariable(
+    ControlFlow::BasicBlock bb, int i, Call call, LocalScopeSourceVariable v,
+    AssignableDefinition def, boolean additionalCalls
+  ) {
+    CapturedVariableImpl::updateCandidate(bb, i, v, call) and
+    exists(Callable writer |
+      CapturedVariableImpl::relevantDefinition(writer, v.getAssignable(), def)
+    |
+      CapturedVariableImpl::updatesCapturedVariableWriter(call, v, writer, additionalCalls)
+    )
+  }
+
+  cached
+  predicate variableWriteQualifier(
+    ControlFlow::BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v, boolean certain
+  ) {
+    variableWrite(bb, i, v.getQualifier(), certain) and
+    // Eliminate corner case where a call definition can overlap with a
+    // qualifier definition: if method `M` updates field `F`, then a call
+    // to `M` is both an update of `x.M` and `x.M.M`, so the former call
+    // definition should not give rise to an implicit qualifier definition
+    // for `x.M.M`.
+    not updatesNamedFieldOrProp(bb, i, _, v, _)
+  }
+
+  cached
+  predicate isCapturedVariableDefinitionFlowIn(
+    Ssa::ExplicitDefinition def, Ssa::ImplicitEntryDefinition edef,
+    ControlFlow::Nodes::ElementNode c, boolean additionalCalls
+  ) {
+    exists(Definition def0, ControlFlow::BasicBlock bb, int i |
+      capturedReadIn(_, _, def.getSourceVariable(), edef.getSourceVariable(), c, additionalCalls) and
+      def = def0.getAnUltimateDefinition() and
+      ssaDefReachesRead(_, def0, bb, i, CapturedVarCallRead()) and
+      c = bb.getNode(i)
+    )
+  }
+
+  cached
+  predicate isCapturedVariableDefinitionFlowOut(
+    Ssa::ExplicitDefinition def, Ssa::ImplicitCallDefinition cdef, boolean additionalCalls
+  ) {
+    exists(Ssa::Definition def0, ControlFlow::BasicBlock bb, int i |
+      def = def0.getAnUltimateDefinition() and
+      lastRef(def0, bb, i) and
+      capturedReadOut(bb, i, def0.getSourceVariable(), cdef.getSourceVariable(), cdef.getCall(),
+        additionalCalls)
+    )
+  }
+
+  cached
+  predicate explicitDefinition(WriteDefinition def, Ssa::SourceVariable v, AssignableDefinition ad) {
+    exists(ControlFlow::BasicBlock bb, int i |
+      def.definesAt(v, bb, i) and
+      variableDefinition(bb, i, v, ad)
+    )
+  }
+
+  private predicate adjacentDefReaches(
+    Definition def, ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2
+  ) {
+    adjacentDefRead(def, bb1, i1, bb2, i2)
+    or
+    exists(ControlFlow::BasicBlock bb3, int i3 |
+      adjacentDefReaches(def, bb1, i1, bb3, i3) and
+      variableRead(bb3, i3, _, any(ReadKind rk | rk.isPseudo())) and
+      adjacentDefRead(def, bb3, i3, bb2, i2)
+    )
+  }
+
+  pragma[noinline]
+  private predicate adjacentDefActualRead(
+    Definition def, ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2
+  ) {
+    adjacentDefReaches(def, bb1, i1, bb2, i2) and
+    variableRead(bb2, i2, _, ActualRead())
+  }
+
+  /**
+   * Holds if the value defined at SSA definition `def` can reach a read at `cfn`,
+   * without passing through any other read.
+   */
+  cached
+  predicate firstReadSameVar(Definition def, ControlFlow::Node cfn) {
+    exists(ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2 |
+      def.definesAt(_, bb1, i1) and
+      adjacentDefActualRead(def, bb1, i1, bb2, i2) and
+      cfn = bb2.getNode(i2)
+    )
+  }
+
+  /**
+   * Holds if the read at `cfn2` is a read of the same SSA definition `def`
+   * as the read at `cfn1`, and `cfn2` can be reached from `cfn1` without
+   * passing through another read.
+   */
+  cached
+  predicate adjacentReadPairSameVar(Definition def, ControlFlow::Node cfn1, ControlFlow::Node cfn2) {
+    exists(ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2 |
+      cfn1 = bb1.getNode(i1) and
+      variableRead(bb1, i1, _, ActualRead()) and
+      adjacentDefActualRead(def, bb1, i1, bb2, i2) and
+      cfn2 = bb2.getNode(i2)
+    )
+  }
+
+  private predicate adjacentDefPseudoRead(
+    Definition def, ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2
+  ) {
+    adjacentDefReaches(def, bb1, i1, bb2, i2) and
+    variableRead(bb2, i2, _, any(ReadKind rk | rk.isPseudo()))
+  }
+
+  private predicate reachesLastRef(Definition def, ControlFlow::BasicBlock bb, int i) {
+    lastRef(def, bb, i)
+    or
+    exists(ControlFlow::BasicBlock bb0, int i0 |
+      reachesLastRef(def, bb0, i0) and
+      variableRead(bb0, i0, _, any(ReadKind rk | rk.isPseudo())) and
+      adjacentDefPseudoRead(def, bb, i, bb0, i0)
+    )
+  }
+
+  cached
+  predicate lastReadSameVar(Definition def, ControlFlow::Node cfn) {
+    exists(ControlFlow::BasicBlock bb, int i |
+      reachesLastRef(def, bb, i) and
+      variableRead(bb, i, _, ActualRead()) and
+      cfn = bb.getNode(i)
+    )
+  }
+
+  cached
+  predicate isLiveOutRefParameterDefinition(Ssa::Definition def, Parameter p) {
+    p.isOutOrRef() and
+    exists(Ssa::Definition def0, ControlFlow::BasicBlock bb, int i |
+      def = def0.getAnUltimateDefinition() and
+      reachesLastRef(def0, bb, i) and
+      variableRead(bb, i, def0.getSourceVariable(), OutRefExitRead()) and
+      p = def0.getSourceVariable().getAssignable()
+    )
+  }
+}
+
+import Cached
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
new file mode 100644
index 00000000000..860d3b51dfe
--- /dev/null
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
@@ -0,0 +1,561 @@
+/**
+ * Provides a language-independant implementation of static single assignment
+ * (SSA) form.
+ */
+
+private import SsaImplSpecific
+
+cached
+private module Cached {
+  /**
+   * Liveness analysis (based on source variables) to restrict the size of the
+   * SSA representation.
+   */
+  private module Liveness {
+    /**
+     * A classification of variable references into reads (of a given kind) and
+     * (certain or uncertain) writes.
+     */
+    private newtype TRefKind =
+      Read(ReadKind rk) or
+      Write(boolean certain) { certain = true or certain = false }
+
+    private class RefKind extends TRefKind {
+      string toString() {
+        exists(ReadKind rk | this = Read(rk) and result = "read (" + rk + ")")
+        or
+        exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
+      }
+
+      int getOrder() {
+        this = Read(_) and
+        result = 0
+        or
+        this = Write(_) and
+        result = 1
+      }
+    }
+
+    /**
+     * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
+     */
+    private predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
+      exists(ReadKind rk | variableRead(bb, i, v, rk) | k = Read(rk))
+      or
+      exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
+    }
+
+    private newtype OrderedRefIndex =
+      MkOrderedRefIndex(int i, int tag) {
+        exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
+      }
+
+    private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
+      ref(bb, i, v, k) and
+      result = MkOrderedRefIndex(i, ord) and
+      ord = k.getOrder()
+    }
+
+    /**
+     * Gets the (1-based) rank of the reference to `v` at the `i`th node of
+     * basic block `bb`, which has the given reference kind `k`.
+     *
+     * Reads are considered before writes when they happen at the same index.
+     */
+    private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
+      refOrd(bb, i, v, k, _) =
+        rank[result](int j, int ord, OrderedRefIndex res |
+          res = refOrd(bb, j, v, _, ord)
+        |
+          res order by j, ord
+        )
+    }
+
+    private int maxRefRank(BasicBlock bb, SourceVariable v) {
+      result = refRank(bb, _, v, _) and
+      not result + 1 = refRank(bb, _, v, _)
+    }
+
+    /**
+     * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
+     * that is either a read or a certain write.
+     */
+    private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
+      result =
+        min(int r, RefKind k |
+          r = refRank(bb, _, v, k) and
+          k != Write(false)
+        |
+          r
+        )
+    }
+
+    /**
+     * Holds if source variable `v` is live at the beginning of basic block `bb`.
+     * The read that witnesses the liveness of `v` is of kind `rk`.
+     */
+    predicate liveAtEntry(BasicBlock bb, SourceVariable v, ReadKind rk) {
+      // The first read or certain write to `v` inside `bb` is a read
+      refRank(bb, _, v, Read(rk)) = firstReadOrCertainWrite(bb, v)
+      or
+      // There is no certain write to `v` inside `bb`, but `v` is live at entry
+      // to a successor basic block of `bb`
+      not exists(firstReadOrCertainWrite(bb, v)) and
+      liveAtExit(bb, v, rk)
+    }
+
+    /**
+     * Holds if source variable `v` is live at the end of basic block `bb`.
+     * The read that witnesses the liveness of `v` is of kind `rk`.
+     */
+    predicate liveAtExit(BasicBlock bb, SourceVariable v, ReadKind rk) {
+      liveAtEntry(bb.getASuccessor(), v, rk)
+    }
+
+    /**
+     * Holds if variable `v` is live in basic block `bb` at index `i`.
+     * The rank of `i` is `rnk` as defined by `refRank()`.
+     */
+    private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk, ReadKind rk) {
+      exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
+        rnk = maxRefRank(bb, v) and
+        liveAtExit(bb, v, rk)
+        or
+        ref(bb, i, v, kind) and
+        kind = Read(rk)
+        or
+        exists(RefKind nextKind |
+          liveAtRank(bb, _, v, rnk + 1, rk) and
+          rnk + 1 = refRank(bb, _, v, nextKind) and
+          nextKind != Write(true)
+        )
+      )
+    }
+
+    /**
+     * Holds if variable `v` is live after the (certain or uncertain) write at
+     * index `i` inside basic block `bb`. The read that witnesses the liveness of
+     * `v` is of kind `rk`.
+     */
+    predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v, ReadKind rk) {
+      exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk, rk))
+    }
+  }
+
+  private import Liveness
+
+  /**
+   * Holds if `bb` is in the dominance frontier of a block containing a
+   * definition of `v`.
+   */
+  pragma[noinline]
+  private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
+    exists(BasicBlock defbb, Definition def |
+      def.definesAt(v, defbb, _) and
+      defbb.inDominanceFrontier(bb)
+    )
+  }
+
+  cached
+  newtype TDefinition =
+    TWriteDef(SourceVariable v, BasicBlock bb, int i) {
+      variableWrite(bb, i, v, _) and
+      liveAfterWrite(bb, i, v, _)
+    } or
+    TPhiNode(SourceVariable v, BasicBlock bb) {
+      inDefDominanceFrontier(bb, v) and
+      liveAtEntry(bb, v, _)
+    }
+
+  private module SsaDefReaches {
+    newtype TSsaRefKind =
+      SsaRead() or
+      SsaDef()
+
+    /**
+     * A classification of SSA variable references into reads and definitions.
+     */
+    class SsaRefKind extends TSsaRefKind {
+      string toString() {
+        this = SsaRead() and
+        result = "SsaRead"
+        or
+        this = SsaDef() and
+        result = "SsaDef"
+      }
+
+      int getOrder() {
+        this = SsaRead() and
+        result = 0
+        or
+        this = SsaDef() and
+        result = 1
+      }
+    }
+
+    /**
+     * Holds if the `i`th node of basic block `bb` is a reference to `v`,
+     * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
+     * is `SsaDef()`).
+     *
+     * Unlike `Liveness::ref`, this includes `phi` nodes.
+     */
+    predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
+      variableRead(bb, i, v, _) and
+      k = SsaRead()
+      or
+      exists(Definition def | def.definesAt(v, bb, i)) and
+      k = SsaDef()
+    }
+
+    private newtype OrderedSsaRefIndex =
+      MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
+
+    private OrderedSsaRefIndex ssaRefOrd(
+      BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord
+    ) {
+      ssaRef(bb, i, v, k) and
+      result = MkOrderedSsaRefIndex(i, k) and
+      ord = k.getOrder()
+    }
+
+    /**
+     * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
+     * block `bb`, which has the given reference kind `k`.
+     *
+     * For example, if `bb` is a basic block with a phi node for `v` (considered
+     * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
+     *
+     * ```ql
+     * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
+     * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
+     * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
+     * ```
+     *
+     * Reads are considered before writes when they happen at the same index.
+     */
+    int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
+      ssaRefOrd(bb, i, v, k, _) =
+        rank[result](int j, int ord, OrderedSsaRefIndex res |
+          res = ssaRefOrd(bb, j, v, _, ord)
+        |
+          res order by j, ord
+        )
+    }
+
+    int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
+      result = ssaRefRank(bb, _, v, _) and
+      not result + 1 = ssaRefRank(bb, _, v, _)
+    }
+
+    /**
+     * Holds if the SSA definition `def` reaches rank index `rnk` in its own
+     * basic block `bb`.
+     */
+    predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
+      exists(int i |
+        rnk = ssaRefRank(bb, i, v, SsaDef()) and
+        def.definesAt(v, bb, i)
+      )
+      or
+      ssaDefReachesRank(bb, def, rnk - 1, v) and
+      rnk = ssaRefRank(bb, _, v, SsaRead())
+    }
+
+    /**
+     * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
+     * basic block `bb`, without crossing another SSA definition of `v`.
+     *
+     * The read at `i` is of kind `rk`.
+     */
+    predicate ssaDefReachesReadWithinBlock(
+      SourceVariable v, Definition def, BasicBlock bb, int i, ReadKind rk
+    ) {
+      exists(int rnk |
+        ssaDefReachesRank(bb, def, rnk, v) and
+        rnk = ssaRefRank(bb, i, v, SsaRead()) and
+        variableRead(bb, i, v, rk)
+      )
+    }
+
+    /**
+     * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
+     * `redef` in the same basic block, without crossing another SSA definition of `v`.
+     */
+    predicate ssaDefReachesUncertainDefWithinBlock(
+      SourceVariable v, Definition def, UncertainWriteDefinition redef
+    ) {
+      exists(BasicBlock bb, int rnk, int i |
+        ssaDefReachesRank(bb, def, rnk, v) and
+        rnk = ssaRefRank(bb, i, v, SsaDef()) - 1 and
+        redef.definesAt(v, bb, i)
+      )
+    }
+
+    /**
+     * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
+     */
+    int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
+      v = def.getSourceVariable() and
+      result = ssaRefRank(bb, i, v, k) and
+      (
+        ssaDefReachesRead(_, def, bb, i, _)
+        or
+        def.definesAt(_, bb, i)
+      )
+    }
+
+    predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
+      exists(ssaDefRank(def, v, bb, _, _))
+    }
+
+    pragma[noinline]
+    private BasicBlock getAMaybeLiveSuccessor(Definition def, BasicBlock bb) {
+      result = bb.getASuccessor() and
+      not defOccursInBlock(_, bb, def.getSourceVariable()) and
+      ssaDefReachesEndOfBlock(bb, def, _)
+    }
+
+    /**
+     * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
+     * `bb2` is a transitive successor of `bb1`, `def` is live at the end of `bb1`,
+     * and the underlying variable for `def` is neither read nor written in any block
+     * on the path between `bb1` and `bb2`.
+     */
+    predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
+      defOccursInBlock(def, bb1, _) and
+      bb2 = bb1.getASuccessor()
+      or
+      exists(BasicBlock mid | varBlockReaches(def, bb1, mid) |
+        bb2 = getAMaybeLiveSuccessor(def, mid)
+      )
+    }
+
+    /**
+     * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
+     * `def` is read at index `i2` in basic block `bb2`, `bb2` is in a transitive
+     * successor block of `bb1`, and `def` is neither read nor written in any block
+     * on a path between `bb1` and `bb2`.
+     */
+    predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
+      varBlockReaches(def, bb1, bb2) and
+      ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1 and
+      variableRead(bb2, i2, _, _)
+    }
+  }
+
+  private import SsaDefReaches
+
+  pragma[noinline]
+  private predicate ssaDefReachesEndOfBlockRec(BasicBlock bb, Definition def, SourceVariable v) {
+    exists(BasicBlock idom | ssaDefReachesEndOfBlock(idom, def, v) |
+      // The construction of SSA form ensures that each read of a variable is
+      // dominated by its definition. An SSA definition therefore reaches a
+      // control flow node if it is the _closest_ SSA definition that dominates
+      // the node. If two definitions dominate a node then one must dominate the
+      // other, so therefore the definition of _closest_ is given by the dominator
+      // tree. Thus, reaching definitions can be calculated in terms of dominance.
+      idom = getImmediateDominator(bb)
+    )
+  }
+
+  /**
+   * Holds if the SSA definition of `v` at `def` reaches the end of basic
+   * block `bb`, at which point it is still live, without crossing another
+   * SSA definition of `v`.
+   */
+  cached
+  predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
+    exists(int last | last = maxSsaRefRank(bb, v) |
+      ssaDefReachesRank(bb, def, last, v) and
+      liveAtExit(bb, v, _)
+    )
+    or
+    ssaDefReachesEndOfBlockRec(bb, def, v) and
+    liveAtExit(bb, v, _) and
+    not ssaRef(bb, _, v, SsaDef())
+  }
+
+  /**
+   * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
+   * basic block `bb`, without crossing another SSA definition of `v`. The read
+   * is of kind `rk`.
+   */
+  cached
+  predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i, ReadKind rk) {
+    ssaDefReachesReadWithinBlock(v, def, bb, i, rk)
+    or
+    variableRead(bb, i, v, rk) and
+    ssaDefReachesEndOfBlock(bb.getAPredecessor(), def, v) and
+    not ssaDefReachesReadWithinBlock(v, _, bb, i, _)
+  }
+
+  /**
+   * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
+   * `redef` without crossing another SSA definition of `v`.
+   */
+  cached
+  predicate ssaDefReachesUncertainDef(
+    SourceVariable v, Definition def, UncertainWriteDefinition redef
+  ) {
+    ssaDefReachesUncertainDefWithinBlock(v, def, redef)
+    or
+    exists(BasicBlock bb |
+      redef.definesAt(v, bb, _) and
+      ssaDefReachesEndOfBlock(bb.getAPredecessor(), def, v) and
+      not ssaDefReachesUncertainDefWithinBlock(v, _, redef)
+    )
+  }
+
+  /**
+   * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
+   * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
+   * path between them without any read of `def`.
+   */
+  cached
+  predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
+    exists(int rnk |
+      rnk = ssaDefRank(def, _, bb1, i1, _) and
+      rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaRead()) and
+      variableRead(bb1, i2, _, _) and
+      bb2 = bb1
+    )
+    or
+    exists(SourceVariable v | ssaDefRank(def, v, bb1, i1, _) = maxSsaRefRank(bb1, v)) and
+    defAdjacentRead(def, bb1, bb2, i2)
+  }
+
+  /**
+   * Holds if the node at index `i` in `bb` is a last reference to SSA
+   * definition `def`.
+   *
+   * That is, the node can reach the end of the enclosing callable, or another
+   * SSA definition for the underlying source variable, without passing through
+   * another read.
+   */
+  cached
+  predicate lastRef(Definition def, BasicBlock bb, int i) {
+    exists(int rnk, SourceVariable v | rnk = ssaDefRank(def, v, bb, i, _) |
+      // Next reference to `v` inside `bb` is a write
+      rnk + 1 = ssaRefRank(bb, _, v, SsaDef())
+      or
+      // No more references to `v` inside `bb`
+      rnk = maxSsaRefRank(bb, v) and
+      (
+        // Can reach exit directly
+        bb instanceof ExitBasicBlock
+        or
+        exists(BasicBlock bb2 | varBlockReaches(def, bb, bb2) |
+          // Can reach a write using one or more steps
+          1 = ssaRefRank(bb2, _, def.getSourceVariable(), SsaDef())
+          or
+          // Can reach a block using one or more steps, where `def` is no longer live
+          not defOccursInBlock(def, bb2, _) and
+          not ssaDefReachesEndOfBlock(bb2, def, _)
+        )
+      )
+    )
+  }
+}
+
+import Cached
+
+/** A static single assignment (SSA) definition. */
+class Definition extends TDefinition {
+  /** Gets the source variable underlying this SSA definition. */
+  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
+
+  /**
+   * Holds is this SSA definition is live at the end of basic block `bb`.
+   * That is, this definition reaches the end of basic block `bb`, at which
+   * point it is still live, without crossing another SSA definition of the
+   * same source variable.
+   */
+  final predicate isLiveAtEndOfBlock(BasicBlock bb) { ssaDefReachesEndOfBlock(bb, this, _) }
+
+  /**
+   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
+   * Phi nodes are considered to be at index `-1`, while normal variable writes
+   * are at the index of the control flow node they wrap.
+   */
+  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
+    this = TWriteDef(v, bb, i)
+    or
+    this = TPhiNode(v, bb) and i = -1
+  }
+
+  /** Gets the basic block to which this SSA definition belongs. */
+  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
+
+  /**
+   * Gets an SSA definition whose value can flow to this one in one step. This
+   * includes inputs to phi nodes and the prior definitions of uncertain writes.
+   */
+  private Definition getAPseudoInputOrPriorDefinition() {
+    result = this.(PhiNode).getAnInput() or
+    result = this.(UncertainWriteDefinition).getPriorDefinition()
+  }
+
+  /**
+   * Gets a definition that ultimately defines this SSA definition and is
+   * not itself a phi node.
+   */
+  Definition getAnUltimateDefinition() {
+    result = this.getAPseudoInputOrPriorDefinition*() and
+    not result instanceof PhiNode
+  }
+
+  /** Gets a textual representation of this SSA definition. */
+  string toString() { none() }
+}
+
+/** An SSA definition that corresponds to a write. */
+class WriteDefinition extends Definition, TWriteDef {
+  private SourceVariable v;
+  private BasicBlock bb;
+  private int i;
+
+  WriteDefinition() { this = TWriteDef(v, bb, i) }
+
+  override string toString() { result = "WriteDef" }
+}
+
+/** A phi node. */
+class PhiNode extends Definition, TPhiNode {
+  /** Gets an input of this phi node. */
+  Definition getAnInput() {
+    exists(BasicBlock bb, BasicBlock pred, SourceVariable v |
+      this.definesAt(v, bb, _) and
+      bb.getAPredecessor() = pred and
+      ssaDefReachesEndOfBlock(pred, result, v)
+    )
+  }
+
+  /** Holds if `inp` is an input to the phi node along the edge originating in `bb`. */
+  predicate hasInputFromBlock(Definition inp, BasicBlock bb) {
+    inp = this.getAnInput() and
+    this.getBasicBlock().getAPredecessor() = bb and
+    ssaDefReachesEndOfBlock(bb, inp, _)
+  }
+
+  override string toString() { result = "Phi" }
+}
+
+/**
+ * An SSA definition that represents an uncertain update of the underlying
+ * source variable.
+ */
+class UncertainWriteDefinition extends WriteDefinition {
+  UncertainWriteDefinition() {
+    exists(SourceVariable v, BasicBlock bb, int i |
+      this.definesAt(v, bb, i) and
+      variableWrite(bb, i, v, false)
+    )
+  }
+
+  /**
+   * Gets the immediately preceding definition. Since this update is uncertain,
+   * the value from the preceding definition might still be valid.
+   */
+  Definition getPriorDefinition() { ssaDefReachesUncertainDef(_, result, this) }
+}
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
new file mode 100644
index 00000000000..cf42efd3e0c
--- /dev/null
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
@@ -0,0 +1,19 @@
+/** Provides the C# specific parameters for `SsaImplCommon.qll`. */
+
+private import csharp
+private import AssignableDefinitions
+private import SsaImpl as SsaImpl
+
+class BasicBlock = ControlFlow::BasicBlock;
+
+BasicBlock getImmediateDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
+
+class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
+
+class ReadKind = SsaImpl::ReadKind;
+
+class SourceVariable = SsaImpl::TSourceVariable;
+
+predicate variableWrite = SsaImpl::variableWrite/4;
+
+predicate variableRead = SsaImpl::variableRead/4;
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ModulusAnalysisSpecific.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ModulusAnalysisSpecific.qll
index d3f616c6609..f71b0d0ffcd 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ModulusAnalysisSpecific.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ModulusAnalysisSpecific.qll
@@ -6,7 +6,7 @@ module Private {
   private import SsaReadPositionCommon
   private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl as CfgImpl
 
-  class BasicBlock = CS::Ssa::BasicBlock;
+  class BasicBlock = CS::ControlFlow::BasicBlock;
 
   class SsaVariable = SU::SsaVariable;
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
index dcd0d9b1ec3..4d765f769ad 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
@@ -95,7 +95,7 @@ private module Impl {
     /**
      * Holds if basic block `bb` is guarded by this guard having value `v`.
      */
-    predicate controlsBasicBlock(BasicBlock bb, G::AbstractValue v) {
+    predicate controlsBasicBlock(ControlFlow::BasicBlock bb, G::AbstractValue v) {
       this.(G::Guard).controlsBasicBlock(bb, v)
     }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionSpecific.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionSpecific.qll
index d7df9781b2a..7afd9a2a33d 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionSpecific.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionSpecific.qll
@@ -8,7 +8,7 @@ class SsaVariable = Ssa::Definition;
 
 class SsaPhiNode = Ssa::PhiNode;
 
-class BasicBlock = Ssa::BasicBlock;
+class BasicBlock = ControlFlow::BasicBlock;
 
 /** Gets a basic block in which SSA variable `v` is read. */
 BasicBlock getAReadBasicBlock(SsaVariable v) {
diff --git a/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql b/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
index 4dbc77e922e..e09c3d15caa 100644
--- a/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
+++ b/csharp/ql/test/library-tests/dataflow/defuse/useUseEquivalence.ql
@@ -28,20 +28,20 @@ private TLocalScopeVariableReadOrSsaDef getANextReadOrDef(TLocalScopeVariableRea
     or
     not exists(read.getANextRead()) and
     exists(
-      Ssa::Definition ssaDef, Ssa::PseudoDefinition pseudoDef, ControlFlow::Node cfn,
-      ControlFlow::BasicBlock bb, int i
+      Ssa::Definition ssaDef, Ssa::PhiNode phi, ControlFlow::Node cfn, ControlFlow::BasicBlock bb,
+      int i
     |
       ssaDef.getARead() = read
     |
-      pseudoDef.getAnInput() = ssaDef and
-      pseudoDef.definesAt(_, bb, i) and
+      phi.getAnInput() = ssaDef and
+      phi.definesAt(_, bb, i) and
       cfn = read.getAReachableElement().getAControlFlowNode() and
       (
         cfn = bb.getNode(i)
         or
         cfn = bb.getFirstNode() and i < 0
       ) and
-      result = TSsaDefinition(pseudoDef)
+      result = TSsaDefinition(phi)
     )
   )
   or
@@ -49,9 +49,9 @@ private TLocalScopeVariableReadOrSsaDef getANextReadOrDef(TLocalScopeVariableRea
     result = TLocalScopeVariableRead(ssaDef.getAFirstRead())
     or
     not exists(ssaDef.getAFirstRead()) and
-    exists(Ssa::PseudoDefinition pseudoDef |
-      pseudoDef.getAnInput() = ssaDef and
-      result = TSsaDefinition(pseudoDef)
+    exists(Ssa::PhiNode phi |
+      phi.getAnInput() = ssaDef and
+      result = TSsaDefinition(phi)
     )
   )
 }
diff --git a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
index ab31244d07b..9345525f486 100644
--- a/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/PreSsaConsistency.ql
@@ -1,6 +1,7 @@
 import csharp
 import semmle.code.csharp.controlflow.internal.PreSsa as PreSsa
 import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl
+import semmle.code.csharp.dataflow.internal.SsaImpl as SsaImpl
 
 class CallableWithSplitting extends Callable {
   CallableWithSplitting() { this = any(SplitControlFlowElement e).getEnclosingCallable() }
@@ -46,13 +47,11 @@ query predicate readReadInconsistency(
     b = true and
     a = read1.getTarget() and
     PreSsa::adjacentReadPairSameVar(read1, read2) and
-    not Ssa::Internal::adjacentReadPairSameVar(_, read1.getAControlFlowNode(),
-      read2.getAControlFlowNode())
+    not SsaImpl::adjacentReadPairSameVar(_, read1.getAControlFlowNode(), read2.getAControlFlowNode())
     or
     b = false and
     a = read1.getTarget() and
-    Ssa::Internal::adjacentReadPairSameVar(_, read1.getAControlFlowNode(),
-      read2.getAControlFlowNode()) and
+    SsaImpl::adjacentReadPairSameVar(_, read1.getAControlFlowNode(), read2.getAControlFlowNode()) and
     read1.getTarget() instanceof PreSsa::SimpleAssignable and
     not PreSsa::adjacentReadPairSameVar(read1, read2) and
     // Exclude split CFG elements because SSA may be more precise than pre-SSA

From 0674881ffd6be31f75b5a3817a74b45703e1eb7f Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 19 Jan 2021 09:51:01 +0100
Subject: [PATCH 210/343] C#: Do not rely on `BasicBlock` member predicates
 from `SsaImplSpecific`

---
 .../dataflow/internal/SsaImplCommon.qll       | 40 ++++++++++++++-----
 .../dataflow/internal/SsaImplSpecific.qll     |  4 +-
 2 files changed, 34 insertions(+), 10 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
index 860d3b51dfe..f1ffd7ff489 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
@@ -5,6 +5,8 @@
 
 private import SsaImplSpecific
 
+private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
+
 cached
 private module Cached {
   /**
@@ -109,7 +111,7 @@ private module Cached {
      * The read that witnesses the liveness of `v` is of kind `rk`.
      */
     predicate liveAtExit(BasicBlock bb, SourceVariable v, ReadKind rk) {
-      liveAtEntry(bb.getASuccessor(), v, rk)
+      liveAtEntry(getABasicBlockSuccessor(bb), v, rk)
     }
 
     /**
@@ -144,6 +146,26 @@ private module Cached {
 
   private import Liveness
 
+  /** Holds if `bb1` strictly dominates `bb2`. */
+  private predicate strictlyDominates(BasicBlock bb1, BasicBlock bb2) {
+    bb1 = getImmediateBasicBlockDominator+(bb2)
+  }
+
+  /** Holds if `bb1` dominates a predecessor of `bb2`. */
+  private predicate dominatesPredecessor(BasicBlock bb1, BasicBlock bb2) {
+    exists(BasicBlock pred | pred = getABasicBlockPredecessor(bb2) |
+      bb1 = pred
+      or
+      strictlyDominates(bb1, pred)
+    )
+  }
+
+  /** Holds if `df` is in the dominance frontier of `bb`. */
+  private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
+    dominatesPredecessor(bb, df) and
+    not strictlyDominates(bb, df)
+  }
+
   /**
    * Holds if `bb` is in the dominance frontier of a block containing a
    * definition of `v`.
@@ -152,7 +174,7 @@ private module Cached {
   private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
     exists(BasicBlock defbb, Definition def |
       def.definesAt(v, defbb, _) and
-      defbb.inDominanceFrontier(bb)
+      inDominanceFrontier(defbb, bb)
     )
   }
 
@@ -311,7 +333,7 @@ private module Cached {
 
     pragma[noinline]
     private BasicBlock getAMaybeLiveSuccessor(Definition def, BasicBlock bb) {
-      result = bb.getASuccessor() and
+      result = getABasicBlockSuccessor(bb) and
       not defOccursInBlock(_, bb, def.getSourceVariable()) and
       ssaDefReachesEndOfBlock(bb, def, _)
     }
@@ -324,7 +346,7 @@ private module Cached {
      */
     predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
       defOccursInBlock(def, bb1, _) and
-      bb2 = bb1.getASuccessor()
+      bb2 = getABasicBlockSuccessor(bb1)
       or
       exists(BasicBlock mid | varBlockReaches(def, bb1, mid) |
         bb2 = getAMaybeLiveSuccessor(def, mid)
@@ -355,7 +377,7 @@ private module Cached {
       // the node. If two definitions dominate a node then one must dominate the
       // other, so therefore the definition of _closest_ is given by the dominator
       // tree. Thus, reaching definitions can be calculated in terms of dominance.
-      idom = getImmediateDominator(bb)
+      idom = getImmediateBasicBlockDominator(bb)
     )
   }
 
@@ -386,7 +408,7 @@ private module Cached {
     ssaDefReachesReadWithinBlock(v, def, bb, i, rk)
     or
     variableRead(bb, i, v, rk) and
-    ssaDefReachesEndOfBlock(bb.getAPredecessor(), def, v) and
+    ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
     not ssaDefReachesReadWithinBlock(v, _, bb, i, _)
   }
 
@@ -402,7 +424,7 @@ private module Cached {
     or
     exists(BasicBlock bb |
       redef.definesAt(v, bb, _) and
-      ssaDefReachesEndOfBlock(bb.getAPredecessor(), def, v) and
+      ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
       not ssaDefReachesUncertainDefWithinBlock(v, _, redef)
     )
   }
@@ -526,7 +548,7 @@ class PhiNode extends Definition, TPhiNode {
   Definition getAnInput() {
     exists(BasicBlock bb, BasicBlock pred, SourceVariable v |
       this.definesAt(v, bb, _) and
-      bb.getAPredecessor() = pred and
+      getABasicBlockPredecessor(bb) = pred and
       ssaDefReachesEndOfBlock(pred, result, v)
     )
   }
@@ -534,7 +556,7 @@ class PhiNode extends Definition, TPhiNode {
   /** Holds if `inp` is an input to the phi node along the edge originating in `bb`. */
   predicate hasInputFromBlock(Definition inp, BasicBlock bb) {
     inp = this.getAnInput() and
-    this.getBasicBlock().getAPredecessor() = bb and
+    getABasicBlockPredecessor(this.getBasicBlock()) = bb and
     ssaDefReachesEndOfBlock(bb, inp, _)
   }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
index cf42efd3e0c..e71b469368a 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
@@ -6,7 +6,9 @@ private import SsaImpl as SsaImpl
 
 class BasicBlock = ControlFlow::BasicBlock;
 
-BasicBlock getImmediateDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
+BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result = bb.getImmediateDominator() }
+
+BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
 
 class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
 

From cff56350e088d8ba13065dad7e566b8503d27307 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 19 Jan 2021 10:34:25 +0000
Subject: [PATCH 211/343] C++: Fix getClassAndName parameter name.

---
 cpp/ql/src/semmle/code/cpp/Function.qll | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Function.qll b/cpp/ql/src/semmle/code/cpp/Function.qll
index 7bda4559c61..4ddf852f49f 100644
--- a/cpp/ql/src/semmle/code/cpp/Function.qll
+++ b/cpp/ql/src/semmle/code/cpp/Function.qll
@@ -335,14 +335,14 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
   }
 
   /**
-   * Gets the class of which this function, called `name`, is a member.
+   * Gets the class of which this function, called `memberName`, is a member.
    *
    * Prefer to use `getDeclaringType()` or `getName()` directly if you do not
    * need to reason about both.
    */
   pragma[nomagic]
-  Class getClassAndName(string myName) {
-    this.hasName(myName) and
+  Class getClassAndName(string memberName) {
+    this.hasName(memberName) and
     this.getDeclaringType() = result
   }
 

From 47470e08c3a15663119e44a1fe826a663b2c0fad Mon Sep 17 00:00:00 2001
From: Shati Patel <42641846+shati-patel@users.noreply.github.com>
Date: Tue, 19 Jan 2021 10:54:17 +0000
Subject: [PATCH 212/343] Add QLDoc link, suggested by @Marcono1234

---
 docs/codeql/ql-language-reference/ql-language-specification.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/codeql/ql-language-reference/ql-language-specification.rst b/docs/codeql/ql-language-reference/ql-language-specification.rst
index 940951067b8..61bad5e2a5b 100644
--- a/docs/codeql/ql-language-reference/ql-language-specification.rst
+++ b/docs/codeql/ql-language-reference/ql-language-specification.rst
@@ -470,6 +470,8 @@ A QLDoc comment is a *qldoc comment start*, followed by a *qldoc comment body*,
 
 The "content" of a QLDoc comment is the comment body of the comment, omitting the initial ``/**``, the trailing ``*/``, and the leading whitespace followed by ``*`` on each internal line.
 
+For more information about how the content is interpreted, see see "`QLDoc <#qldoc>`__" below.
+
 Keywords
 ~~~~~~~~
 

From 830f8bfef6f379c925294c4faaa1ca55a2fee69f Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Tue, 19 Jan 2021 15:08:47 +0100
Subject: [PATCH 213/343] Python: Add change-note for Flask class based view
 handlers

For https://github.com/github/codeql/pull/4944
---
 .../change-notes/2021-01-12-flask-class-based-view-handlers.md  | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 python/change-notes/2021-01-12-flask-class-based-view-handlers.md

diff --git a/python/change-notes/2021-01-12-flask-class-based-view-handlers.md b/python/change-notes/2021-01-12-flask-class-based-view-handlers.md
new file mode 100644
index 00000000000..ef32a9fce8b
--- /dev/null
+++ b/python/change-notes/2021-01-12-flask-class-based-view-handlers.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added modeling of flask class based view handlers (subclasses of `flask.views.View` and `flask.views.MethodView`). This means we're now able to detect routed parameters for request handler defined on these classes, as sources of remote user input (`RemoteFlowSource`).

From 91fa12b1befdb327c6056b02d8e19b0aca57168f Mon Sep 17 00:00:00 2001
From: yo-h <55373593+yo-h@users.noreply.github.com>
Date: Tue, 19 Jan 2021 10:19:18 -0500
Subject: [PATCH 214/343] Java: add change note for `struts.xml` extraction

---
 java/change-notes/2021-01-19-struts-xml-extraction.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 java/change-notes/2021-01-19-struts-xml-extraction.md

diff --git a/java/change-notes/2021-01-19-struts-xml-extraction.md b/java/change-notes/2021-01-19-struts-xml-extraction.md
new file mode 100644
index 00000000000..ce0ff2f30c2
--- /dev/null
+++ b/java/change-notes/2021-01-19-struts-xml-extraction.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* XML files named `struts.xml` are now extracted by default.

From 77da4b0106beaacebff7d9de3f8c30b292e7a8d3 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 19 Jan 2021 17:05:42 +0100
Subject: [PATCH 215/343] Python: Remove absolute line numbers - Use relative
 line numbers in flow test - Elide line numbers in routing test (new concept)

---
 .../dataflow/TestUtil/FlowTest.qll            |  13 +-
 .../dataflow/TestUtil/RoutingTest.qll         |  35 +
 .../test/experimental/dataflow/basic/test.py  |   8 +-
 .../dataflow/coverage/argumentPassing.py      |  92 +--
 .../dataflow/coverage/argumentRoutingTest.ql  |  16 +-
 .../experimental/dataflow/coverage/classes.py | 688 +++++++++---------
 .../dataflow/coverage/datamodel.py            |   6 +-
 .../experimental/dataflow/coverage/test.py    |  64 +-
 8 files changed, 482 insertions(+), 440 deletions(-)
 create mode 100644 python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll

diff --git a/python/ql/test/experimental/dataflow/TestUtil/FlowTest.qll b/python/ql/test/experimental/dataflow/TestUtil/FlowTest.qll
index edb24373386..f6985bf4a1e 100644
--- a/python/ql/test/experimental/dataflow/TestUtil/FlowTest.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/FlowTest.qll
@@ -26,8 +26,15 @@ abstract class FlowTest extends InlineExpectationsTest {
 
   pragma[inline]
   private string lineStr(DataFlow::Node fromNode, DataFlow::Node toNode) {
-    if fromNode.getLocation().getStartLine() = toNode.getLocation().getStartLine()
-    then result = ""
-    else result = ", l:" + fromNode.getLocation().getStartLine()
+    exists(int delta |
+      delta = fromNode.getLocation().getStartLine() - toNode.getLocation().getStartLine()
+    |
+      if delta = 0
+      then result = ""
+      else
+        if delta > 0
+        then result = ", l:+" + delta.toString()
+        else result = ", l:" + delta.toString()
+    )
   }
 }
diff --git a/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
new file mode 100644
index 00000000000..eb685cc3ac1
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
@@ -0,0 +1,35 @@
+import python
+import semmle.python.dataflow.new.DataFlow
+import TestUtilities.InlineExpectationsTest
+import experimental.dataflow.TestUtil.PrintNode
+
+/**
+ * A routing test is designed to test that vlues are routed to the
+ * correct arguments of the correct functions. It is assumed that
+ * the functions tested sink their arguments sequentially, that is
+ * `SINK1(arg1)`, etc.
+ */
+abstract class RoutingTest extends InlineExpectationsTest {
+  bindingset[this]
+  RoutingTest() { any() }
+
+  abstract string flowTag();
+
+  abstract predicate relevantFlow(DataFlow::Node fromNode, DataFlow::Node toNode);
+
+  override string getARelevantTag() { result in ["func", this.flowTag()] }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(DataFlow::Node fromNode, DataFlow::Node toNode | this.relevantFlow(fromNode, toNode) |
+      location = fromNode.getLocation() and
+      element = fromNode.toString() and
+      (
+        tag = this.flowTag() and
+        value = "\"" + prettyNode(fromNode).replaceAll("\"", "'") + "\""
+        or
+        tag = "func" and
+        value = toNode.getEnclosingCallable().getCallableValue().getScope().getQualifiedName() // TODO: More robust pretty printing?
+      )
+    )
+  }
+}
diff --git a/python/ql/test/experimental/dataflow/basic/test.py b/python/ql/test/experimental/dataflow/basic/test.py
index b850aa0d99c..7ea19e9d4d0 100644
--- a/python/ql/test/experimental/dataflow/basic/test.py
+++ b/python/ql/test/experimental/dataflow/basic/test.py
@@ -1,7 +1,7 @@
 def obfuscated_id(x): #$ step="FunctionExpr -> GSSA Variable obfuscated_id" step="x -> SSA variable x"
-  y = x #$ step="x -> SSA variable y" step="SSA variable x, l:1 -> x"
-  z = y #$ step="y -> SSA variable z" step="SSA variable y, l:2 -> y"
-  return z #$ flow="42, l:6 -> z" step="SSA variable z, l:3 -> z"
+  y = x #$ step="x -> SSA variable y" step="SSA variable x, l:-1 -> x"
+  z = y #$ step="y -> SSA variable z" step="SSA variable y, l:-1 -> y"
+  return z #$ flow="42, l:+2 -> z" step="SSA variable z, l:-1 -> z"
 
 a = 42 #$ step="42 -> GSSA Variable a"
-b = obfuscated_id(a) #$ flow="42, l:6 -> GSSA Variable b" flow="FunctionExpr, l:1 -> obfuscated_id" step="obfuscated_id(..) -> GSSA Variable b" step="GSSA Variable obfuscated_id, l:1 -> obfuscated_id" step="GSSA Variable a, l:6 -> a"
+b = obfuscated_id(a) #$ flow="42, l:-1 -> GSSA Variable b" flow="FunctionExpr, l:-6 -> obfuscated_id" step="obfuscated_id(..) -> GSSA Variable b" step="GSSA Variable obfuscated_id, l:-6 -> obfuscated_id" step="GSSA Variable a, l:-1 -> a"
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
index 6de4d56ad13..67650c149d3 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
+++ b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
@@ -72,78 +72,78 @@ def argument_passing(
     f,
     **g,
 ):
-    SINK1(a) #$ arg1="arg1, l:89 -> a" arg1="arg1, l:94 -> a"
-    SINK2(b) #$ arg2="arg2, l:94 -> b" MISSING:arg2="arg2, l:89 -> b"
-    SINK3(c) #$ arg3="arg3, l:94 -> c" MISSING: arg3="arg3, l:89 -> c"
-    SINK4(d) #$ MISSING: arg4="arg4, l:89 -> d"
-    SINK5(e) #$ MISSING: arg5="arg5, l:89 -> e"
-    SINK6(f) #$ MISSING: arg6="arg6, l:89 -> f"
+    SINK1(a)
+    SINK2(b)
+    SINK3(c)
+    SINK4(d)
+    SINK5(e)
+    SINK6(f)
     try:
-        SINK7(g["g"]) #$ arg7="arg7, l:89 -> g['g']"
+        SINK7(g["g"])
     except:
         print("OK")
 
 
 @expects(7)
 def test_argument_passing1():
-    argument_passing(arg1, *(arg2, arg3, arg4), e=arg5, **{"f": arg6, "g": arg7})
+    argument_passing(arg1, *(arg2, arg3, arg4), e=arg5, **{"f": arg6, "g": arg7})  #$ arg1="arg1" arg7="arg7" func=argument_passing MISSING: arg2="arg2" arg3="arg3 arg4="arg4" arg5="arg5" arg6="arg6"
 
 
 @expects(7)
 def test_argument_passing2():
-    argument_passing(arg1, arg2, arg3, f=arg6)
+    argument_passing(arg1, arg2, arg3, f=arg6)  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=argument_passing
 
 
 def with_pos_only(a, /, b):
-    SINK1(a) #$ arg1="arg1, l:104 -> a" arg1="arg1, l:105 -> a" arg1="arg1, l:106 -> a"
-    SINK2(b) #$ arg2="arg2, l:104 -> b" arg2="arg2, l:105 -> b" MISSING: arg2="arg2, l:106 -> b"
+    SINK1(a)
+    SINK2(b)
 
 
 @expects(6)
 def test_pos_only():
-    with_pos_only(arg1, arg2)
-    with_pos_only(arg1, b=arg2)
-    with_pos_only(arg1, *(arg2,))
+    with_pos_only(arg1, arg2)  #$ arg1="arg1" arg2="arg2" func=with_pos_only
+    with_pos_only(arg1, b=arg2)  #$ arg1="arg1" arg2="arg2" func=with_pos_only
+    with_pos_only(arg1, *(arg2,))  #$ arg1="arg1" func=with_pos_only MISSING: arg2="arg2"
 
 
 def with_multiple_kw_args(a, b, c):
-    SINK1(a) #$ arg1="arg1, l:117 -> a" arg1="arg1, l:118 -> a" arg1="arg1, l:119 -> a" arg1="arg1, l:120 -> a"
-    SINK2(b) #$ arg2="arg2, l:117 -> b" arg2="arg2, l:120 -> b" MISSING: arg2="arg2, l:118 -> b" arg2="arg2, l:119 -> b"
-    SINK3(c) #$ arg3="arg3, l:117 -> c" arg3="arg3, l:119 -> c" arg3="arg3, l:120 -> c" MISSING: arg3="arg3, l:118 -> c"
+    SINK1(a)
+    SINK2(b)
+    SINK3(c)
 
 
 @expects(9)
 def test_multiple_kw_args():
-    with_multiple_kw_args(b=arg2, c=arg3, a=arg1)
-    with_multiple_kw_args(arg1, *(arg2,), arg3)
-    with_multiple_kw_args(arg1, **{"c": arg3}, b=arg2)
-    with_multiple_kw_args(**{"b": arg2}, **{"c": arg3}, **{"a": arg1})
+    with_multiple_kw_args(b=arg2, c=arg3, a=arg1)  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=with_multiple_kw_args
+    with_multiple_kw_args(arg1, *(arg2,), arg3)  #$ arg1="arg1" func=with_multiple_kw_args MISSING: arg2="arg2" arg3="arg3"
+    with_multiple_kw_args(arg1, **{"c": arg3}, b=arg2)  #$ arg1="arg1" arg3="arg3" func=with_multiple_kw_args MISSING: arg2="arg2"
+    with_multiple_kw_args(**{"b": arg2}, **{"c": arg3}, **{"a": arg1})  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=with_multiple_kw_args
 
 
-def with_default_arguments(a=arg1, b=arg2, c=arg3):
-    SINK1(a) #$ arg1="arg1, l:132 -> a" MISSING:arg1="arg1, l:123 -> a"
-    SINK2(b) #$ arg2="arg2, l:133 -> b" MISSING: arg2="arg2, l:123 -> b"
-    SINK3(c) #$ arg3="arg3, l:134 -> c" MISSING: arg3="arg3, l:123 -> c"
+def with_default_arguments(a=arg1, b=arg2, c=arg3):  # Need a mechanism to test default arguments
+    SINK1(a)
+    SINK2(b)
+    SINK3(c)
 
 
 @expects(12)
 def test_default_arguments():
     with_default_arguments()
-    with_default_arguments(arg1)
-    with_default_arguments(b=arg2)
-    with_default_arguments(**{"c": arg3})
+    with_default_arguments(arg1)  #$ arg1="arg1" func=with_default_arguments
+    with_default_arguments(b=arg2)  #$ arg2="arg2" func=with_default_arguments
+    with_default_arguments(**{"c": arg3})  #$ arg3="arg3" func=with_default_arguments
 
 
 # Nested constructor pattern
 def grab_foo_bar_baz(foo, **kwargs):
-    SINK1(foo) #$ arg1="arg1, l:160 -> foo"
+    SINK1(foo)
     grab_bar_baz(**kwargs)
 
 
 # It is not possible to pass `bar` into `kwargs`,
 # since `bar` is a valid keyword argument.
 def grab_bar_baz(bar, **kwargs):
-    SINK2(bar) #$ arg2="arg2, l:160 -> bar"
+    SINK2(bar)
     try:
         SINK2_F(kwargs["bar"])
     except:
@@ -152,60 +152,60 @@ def grab_bar_baz(bar, **kwargs):
 
 
 def grab_baz(baz):
-    SINK3(baz) #$ arg3="arg3, l:160 -> baz"
+    SINK3(baz)
 
 
 @expects(4)
 def test_grab():
-    grab_foo_bar_baz(baz=arg3, bar=arg2, foo=arg1)
+    grab_foo_bar_baz(baz=arg3, bar=arg2, foo=arg1)  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=grab_foo_bar_baz func=grab_bar_baz func=grab_baz
 
 
 # All combinations
 def test_pos_pos():
     def with_pos(a):
-        SINK1(a) #$ arg1="arg1, l:168 -> a"
+        SINK1(a)
 
-    with_pos(arg1)
+    with_pos(arg1)  #$ arg1="arg1" func=test_pos_pos.with_pos
 
 
 def test_pos_pos_only():
     def with_pos_only(a, /):
-        SINK1(a) #$ arg1="arg1, l:175 -> a"
+        SINK1(a)
 
-    with_pos_only(arg1)
+    with_pos_only(arg1)  #$ arg1="arg1" func=test_pos_pos_only.with_pos_only
 
 
 def test_pos_star():
     def with_star(*a):
         if len(a) > 0:
-            SINK1(a[0]) #$ arg1="arg1, l:183 -> a[0]"
+            SINK1(a[0])
 
-    with_star(arg1)
+    with_star(arg1)  #$ arg1="arg1" func=test_pos_star.with_star
 
 
 def test_pos_kw():
     def with_kw(a=""):
-        SINK1(a) #$ arg1="arg1, l:190 -> a"
+        SINK1(a)
 
-    with_kw(arg1)
+    with_kw(arg1)  #$ arg1="arg1" func=test_pos_kw.with_kw
 
 
 def test_kw_pos():
     def with_pos(a):
-        SINK1(a) #$ arg1="arg1, l:197 -> a"
+        SINK1(a)
 
-    with_pos(a=arg1)
+    with_pos(a=arg1)  #$ arg1="arg1" func=test_kw_pos.with_pos
 
 
 def test_kw_kw():
     def with_kw(a=""):
-        SINK1(a) #$ arg1="arg1, l:204 -> a"
+        SINK1(a)
 
-    with_kw(a=arg1)
+    with_kw(a=arg1)  #$ arg1="arg1" func=test_kw_kw.with_kw
 
 
 def test_kw_doublestar():
     def with_doublestar(**a):
-        SINK1(a["a"]) #$ arg1="arg1, l:211 -> a['a']"
+        SINK1(a["a"])
 
-    with_doublestar(a=arg1)
+    with_doublestar(a=arg1)  #$ arg1="arg1" func=test_kw_doublestar.with_doublestar
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
index 8a2b9cf9235..51963055f56 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
+++ b/python/ql/test/experimental/dataflow/coverage/argumentRoutingTest.ql
@@ -1,9 +1,9 @@
 import python
 import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
-import experimental.dataflow.TestUtil.FlowTest
+import experimental.dataflow.TestUtil.RoutingTest
 
-class Argument1RoutingTest extends FlowTest {
+class Argument1RoutingTest extends RoutingTest {
   Argument1RoutingTest() { this = "Argument1RoutingTest" }
 
   override string flowTag() { result = "arg1" }
@@ -46,7 +46,7 @@ class Argument1RoutingConfig extends DataFlow::Configuration {
   override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
 }
 
-class Argument2RoutingTest extends FlowTest {
+class Argument2RoutingTest extends RoutingTest {
   Argument2RoutingTest() { this = "Argument2RoutingTest" }
 
   override string flowTag() { result = "arg2" }
@@ -82,7 +82,7 @@ class Argument2RoutingConfig extends DataFlow::Configuration {
   override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
 }
 
-class Argument3RoutingTest extends FlowTest {
+class Argument3RoutingTest extends RoutingTest {
   Argument3RoutingTest() { this = "Argument3RoutingTest" }
 
   override string flowTag() { result = "arg3" }
@@ -118,7 +118,7 @@ class Argument3RoutingConfig extends DataFlow::Configuration {
   override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
 }
 
-class Argument4RoutingTest extends FlowTest {
+class Argument4RoutingTest extends RoutingTest {
   Argument4RoutingTest() { this = "Argument4RoutingTest" }
 
   override string flowTag() { result = "arg4" }
@@ -154,7 +154,7 @@ class Argument4RoutingConfig extends DataFlow::Configuration {
   override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
 }
 
-class Argument5RoutingTest extends FlowTest {
+class Argument5RoutingTest extends RoutingTest {
   Argument5RoutingTest() { this = "Argument5RoutingTest" }
 
   override string flowTag() { result = "arg5" }
@@ -190,7 +190,7 @@ class Argument5RoutingConfig extends DataFlow::Configuration {
   override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
 }
 
-class Argument6RoutingTest extends FlowTest {
+class Argument6RoutingTest extends RoutingTest {
   Argument6RoutingTest() { this = "Argument6RoutingTest" }
 
   override string flowTag() { result = "arg6" }
@@ -226,7 +226,7 @@ class Argument6RoutingConfig extends DataFlow::Configuration {
   override predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
 }
 
-class Argument7RoutingTest extends FlowTest {
+class Argument7RoutingTest extends RoutingTest {
   Argument7RoutingTest() { this = "Argument7RoutingTest" }
 
   override string flowTag() { result = "arg7" }
diff --git a/python/ql/test/experimental/dataflow/coverage/classes.py b/python/ql/test/experimental/dataflow/coverage/classes.py
index fd8a45bc609..654297d3145 100644
--- a/python/ql/test/experimental/dataflow/coverage/classes.py
+++ b/python/ql/test/experimental/dataflow/coverage/classes.py
@@ -38,9 +38,9 @@ def OK():
 
 
 # object.__new__(cls[, ...])
-class With_new:
+class With_new:  #$ MISSING: arg1="With_new" func=With_new.__new__
     def __new__(cls):
-        SINK1(cls)  #$ MISSING: arg1="With_new, l:41 -> cls"
+        SINK1(cls)
         OK()  # Call not found
         return super().__new__(cls)
 
@@ -52,221 +52,221 @@ def test_new():
 # object.__init__(self[, ...])
 class With_init:
     def __init__(self):
-        SINK1(self)  #$ MISSING: arg1="with_init, l:60 -> self"
+        SINK1(self)
         OK()
 
 
 def test_init():
-    with_init = With_init()
+    with_init = With_init()  #$ MISSING: arg1="SSA variable with_init" func=With_init.__init__
 
 
 # object.__del__(self)
 class With_del:
     def __del__(self):
-        SINK1(self)  #$ MISSING: arg1="with_del, l:71 -> self"
+        SINK1(self)
         OK()  # Call not found
 
 
 def test_del():
-    with_del = With_del()
+    with_del = With_del()  #$ MISSING: arg1="SSA variable with_del" func=With_del.__del__
     del with_del
 
 
 # object.__repr__(self)
 class With_repr:
     def __repr__(self):
-        SINK1(self)  #$ MISSING: arg1="with_repr, l:84 -> self"
+        SINK1(self)
         OK()  # Call not found
         return "With_repr()"
 
 
 def test_repr():
-    with_repr = With_repr()
+    with_repr = With_repr()  #$ MISSING: arg1="SSA variable with_repr" func=With_repr.__repr__
     repr(with_repr)
 
 
 # object.__str__(self)
 class With_str:
     def __str__(self):
-        SINK1(self)  #$ MISSING: arg1="with_str, l:97 -> self"
+        SINK1(self)
         OK()  # Call not found
         return "Awesome"
 
 
 def test_str():
-    with_str = With_str()
+    with_str = With_str()  #$ MISSING: arg1="SSA variable with_str" func=With_str.__str__
     str(with_str)
 
 
 # object.__bytes__(self)
 class With_bytes:
     def __bytes__(self):
-        SINK1(self)  #$ MISSING: arg1="with_bytes, l:110 -> self"
+        SINK1(self)
         OK()  # Call not found
         return b"Awesome"
 
 
 def test_bytes():
-    with_bytes = With_bytes()
+    with_bytes = With_bytes()  #$ MISSING: arg1="SSA variable with_bytes" func=With_bytes.__bytes__
     bytes(with_bytes)
 
 
 # object.__format__(self, format_spec)
 class With_format:
     def __format__(self, format_spec):
-        SINK2(format_spec)  #$ MISSING: arg2="arg2, l:125 -> format_spec"
-        SINK1(self)  #$ MISSING: arg1="with_format, l:124 -> self"
+        SINK2(format_spec)
+        SINK1(self)
         OK()  # Call not found
         return "Awesome"
 
 
 def test_format():
-    with_format = With_format()
-    arg2 = ""
+    with_format = With_format()  #$ MISSING: arg1="SSA variable with_format" func=With_format.__format__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_format.__format__
     format(with_format, arg2)
 
 
 def test_format_str():
-    with_format = With_format()
+    with_format = With_format()  #$ MISSING: arg1="SSA variable with_format" func=With_format.__format__
     "{0}".format(with_format)
 
 
 def test_format_fstr():
-    with_format = With_format()
+    with_format = With_format()  #$ MISSING: arg1="SSA variable with_format" func=With_format.__format__
     f"{with_format}"
 
 
 # object.__lt__(self, other)
 class With_lt:
     def __lt__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:150 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_lt, l:149 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
 
 def test_lt():
-    with_lt = With_lt()
-    arg2 = with_lt
+    with_lt = With_lt()  #$ MISSING: arg1="SSA variable with_lt" func=With_lt.__lt__
+    arg2 = with_lt  #$ MISSING: arg2="arg2" func=With_lt.__lt__
     with_lt < arg2
 
 
 # object.__le__(self, other)
 class With_le:
     def __le__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:165 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_le, l:164 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
 
 def test_le():
-    with_le = With_le()
-    arg2 = with_le
+    with_le = With_le()  #$ MISSING: arg1="SSA variable with_le" func=With_le.__le__
+    arg2 = with_le  #$ MISSING: arg2="arg2" func=With_le.__le__
     with_le <= arg2
 
 
 # object.__eq__(self, other)
 class With_eq:
     def __eq__(self, other):
-        SINK2(other)  #$ MISSING: arg2="with_eq, l:180 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_eq, l:179 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
 
 def test_eq():
-    with_eq = With_eq()
-    with_eq == with_eq
+    with_eq = With_eq()  #$ MISSING: arg1="SSA variable with_eq" func=With_eq.__eq__
+    with_eq == with_eq  #$ MISSING: arg2="with_eq" func=With_eq.__eq__
 
 
 # object.__ne__(self, other)
 class With_ne:
     def __ne__(self, other):
-        SINK2(other)  #$ MISSING: arg2="with_ne, l:194 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_ne, l:193 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
 
 def test_ne():
-    with_ne = With_ne()
-    with_ne != with_ne
+    with_ne = With_ne()  #$ MISSING: arg1="SSA variable with_ne" func=With_ne.__ne__
+    with_ne != with_ne  #$ MISSING: arg2="with_ne" func=With_ne.__ne__
 
 
 # object.__gt__(self, other)
 class With_gt:
     def __gt__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:208 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_gt, l:207 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
 
 def test_gt():
-    with_gt = With_gt()
-    arg2 = with_gt
+    with_gt = With_gt()  #$ MISSING: arg1="SSA variable with_gt" func=With_gt.__gt__
+    arg2 = with_gt  #$ MISSING: arg2="arg2" func=With_gt.__gt__
     with_gt > arg2
 
 
 # object.__ge__(self, other)
 class With_ge:
     def __ge__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:223 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_ge, l:222 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
 
 def test_ge():
-    with_ge = With_ge()
-    arg2 = with_ge
+    with_ge = With_ge()  #$ MISSING: arg1="SSA variable with_ge" func=With_ge.__ge__
+    arg2 = with_ge  #$ MISSING: arg2="arg2" func=With_ge.__ge__
     with_ge >= arg2
 
 
 # object.__hash__(self)
 class With_hash:
     def __hash__(self):
-        SINK1(self)  #$ MISSING: arg1="with_hash, l:236 -> self" arg1="with_hash, l:241 -> self" arg1="with_hash, l:246 -> self" arg1="with_hash, l:251 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0
 
 
 def test_hash():
-    with_hash = With_hash()
+    with_hash = With_hash()  #$ MISSING: arg1="SSA variable with_hash" func=With_hash.__hash__
     hash(with_hash)
 
 
 def test_hash_set():
-    with_hash = With_hash()
+    with_hash = With_hash()  #$ MISSING: arg1="SSA variable with_hash" func=With_hash.__hash__
     len(set([with_hash]))
 
 
 def test_hash_frozenset():
-    with_hash = With_hash()
+    with_hash = With_hash()  #$ MISSING: arg1="SSA variable with_hash" func=With_hash.__hash__
     len(frozenset([with_hash]))
 
 
 def test_hash_dict():
-    with_hash = With_hash()
+    with_hash = With_hash()  #$ MISSING: arg1="SSA variable with_hash" func=With_hash.__hash__
     len(dict({with_hash: 0}))
 
 
 # object.__bool__(self)
 class With_bool:
     def __bool__(self):
-        SINK1(self)  #$ MISSING: arg1="with_bool, l:264 -> self" arg1="with_bool, l:269 -> self"
+        SINK1(self)
         OK()  # Call not found
         return True
 
 
 def test_bool():
-    with_bool = With_bool()
+    with_bool = With_bool()  #$ MISSING: arg1="SSA variable with_bool" func=With_bool.__bool__
     bool(with_bool)
 
 
 def test_bool_if():
-    with_bool = With_bool()
+    with_bool = With_bool()  #$ MISSING: arg1="SSA variable with_bool" func=With_bool.__bool__
     if with_bool:
         pass
 
@@ -275,69 +275,69 @@ def test_bool_if():
 # object.__getattr__(self, name)
 class With_getattr:
     def __getattr__(self, name):
-        SINK2(name)  #$ MISSING: arg2="with_getattr.arg2, l:286 -> name"
-        SINK1(self)  #$ MISSING: arg1="with_getattr, l:285 -> self"
+        SINK2(name)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
 
 def test_getattr():
-    with_getattr = With_getattr()
-    with_getattr.arg2
+    with_getattr = With_getattr()  #$ MISSING: arg1="SSA variable with_getattr" func=With_getattr.__getattr__
+    with_getattr.arg2  #$ MISSING: arg2="with_getattr.arg2" func=With_getattr.__getattr__
 
 
 # object.__getattribute__(self, name)
 class With_getattribute:
     def __getattribute__(self, name):
-        SINK2(name)  #$ MISSING: arg2="arg2, l:300 -> name"
-        SINK1(self)  #$ MISSING: arg1="with_getattribute, l:299 -> self"
+        SINK2(name)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
 
 def test_getattribute():
-    with_getattribute = With_getattribute()
-    with_getattribute.arg2
+    with_getattribute = With_getattribute()  #$ MISSING: arg1="SSA variable with_getattribute" func=With_getattribute.__getattribute__
+    with_getattribute.arg2  #$ MISSING: arg2="arg2" func=With_getattribute.__getattribute__
 
 
 # object.__setattr__(self, name, value)
 class With_setattr:
     def __setattr__(self, name, value):
-        SINK3(value)  #$ MISSING: arg3="arg3, l:314 -> value"
-        SINK2(name)  #$ MISSING: arg2="arg2, l:315 -> name"
-        SINK1(self)  #$ MISSING: arg1="with_setattr, l:313 -> self"
+        SINK3(value)
+        SINK2(name)
+        SINK1(self)
         OK()  # Call not found
 
 
 def test_setattr():
-    with_setattr = With_setattr()
-    arg3 = ""
-    with_setattr.arg2 = arg3
+    with_setattr = With_setattr()  #$ MISSING: arg1="SSA variable with_setattr" func=With_setattr.__setattr__
+    arg3 = ""  #$ MISSING: arg3="arg3" func=With_setattr.__setattr__
+    with_setattr.arg2 = arg3  #$ MISSING: arg2="arg2" func=With_setattr.__setattr__
 
 
 # object.__delattr__(self, name)
 class With_delattr:
     def __delattr__(self, name):
-        SINK2(name)  #$ MISSING: arg2="arg2, l:328 -> name"
-        SINK1(self)  #$ MISSING: arg1="with_delattr, l:327 -> self"
+        SINK2(name)
+        SINK1(self)
         OK()  # Call not found
 
 
 def test_delattr():
-    with_delattr = With_delattr()
-    del with_delattr.arg2
+    with_delattr = With_delattr()  #$ MISSING: arg1="SSA variable with_delattr" func=With_delattr.__delattr__
+    del with_delattr.arg2  #$ MISSING: arg2="arg2" func=With_delattr.__delattr__
 
 
 # object.__dir__(self)
 class With_dir:
     def __dir__(self):
-        SINK1(self)  #$ MISSING: arg1="with_dir, l:340 -> self"
+        SINK1(self)
         OK()  # Call not found
         return []
 
 
 def test_dir():
-    with_dir = With_dir()
+    with_dir = With_dir()  #$ MISSING: arg1="SSA variable with_dir" func=With_dir.__dir__
     dir(with_dir)
 
 
@@ -350,8 +350,8 @@ class Owner:
 class With_get:
     def __get__(self, instance, owner=None):
         SINK3(owner)  # Flow not testsed, use class `Owner` as source to test
-        SINK2(instance)  #$ MISSING: arg2="arg2, l:365 -> instance"
-        SINK1(self)  #$ MISSING: arg1="with_get, l:363 -> self"
+        SINK2(instance)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
@@ -360,56 +360,56 @@ def test_get():
     class arg3:
         pass
 
-    with_get = With_get()
+    with_get = With_get()  #$ MISSING: arg1="SSA variable with_get" func=With_get.__get__
     arg3.attr = with_get
-    arg2 = arg3()
+    arg2 = arg3()  #$ MISSING: arg2="arg2" func=With_get.__get__
     arg2.attr
 
 
 # object.__set__(self, instance, value)
 class With_set:
     def __set__(self, instance, value):
-        SINK3(value)  #$ MISSING: arg3="arg3, l:382 -> value"
-        SINK2(instance)  #$ MISSING: arg2="arg2, l:381 -> instance"
-        SINK1(self)  #$ MISSING: arg1="with_set, l:379 -> self"
+        SINK3(value)
+        SINK2(instance)
+        SINK1(self)
         OK()  # Call not found
 
 
 def test_set():
-    with_set = With_set()
+    with_set = With_set()  #$ MISSING: arg1="SSA variable with_set" func=With_set.__set__
     Owner.attr = with_set
-    arg2 = Owner()
-    arg3 = ""
+    arg2 = Owner()  #$ MISSING: arg2="arg2" func=With_set.__set__
+    arg3 = ""  #$ MISSING: arg3="arg3" func=With_set.__set__
     arg2.attr = arg3
 
 
 # object.__delete__(self, instance)
 class With_delete:
     def __delete__(self, instance):
-        SINK2(instance)  #$ MISSING: arg2="arg2, l:397 -> instance"
-        SINK1(self)  #$ MISSING: arg1="with_delete, l:395 -> self"
+        SINK2(instance)
+        SINK1(self)
         OK()  # Call not found
 
 
 def test_delete():
-    with_delete = With_delete()
+    with_delete = With_delete()  #$ MISSING: arg1="SSA variable with_delete" func=With_delete.__delete__
     Owner.attr = with_delete
-    arg2 = Owner()
+    arg2 = Owner()  #$ MISSING: arg2="arg2" func=With_delete.__delete__
     del arg2.attr
 
 
 # object.__set_name__(self, owner, name)
 class With_set_name:
     def __set_name__(self, owner, name):
-        SINK3(name)  #$ MISSING: arg3="arg3, l:412 -> name"
-        SINK2(owner)  #$ MISSING: arg2="arg2, l:412 -> owner"
-        SINK1(self)  #$ MISSING: arg1="with_set_name, l:411 -> self"
+        SINK3(name)
+        SINK2(owner)
+        SINK1(self)
         OK()  # Call not found
 
 
 def test_set_name():
-    with_set_name = With_set_name()
-    type("arg2", (object,), dict(arg3=with_set_name))
+    with_set_name = With_set_name()  #$ MISSING: arg1="SSA variable with_set_name" func=With_set_name.__set_name__
+    type("arg2", (object,), dict(arg3=with_set_name))  #$ MISSING: arg2="arg2" arg3="arg3" func=With_set_name.__set_name__
 
 
 # 3.3.2.4. __slots__   // We are not testing the  suppression of __weakref__ and __dict__ here
@@ -455,45 +455,45 @@ def test_prepare():
 # class.__instancecheck__(self, instance)
 class With_instancecheck:
     def __instancecheck__(self, instance):
-        SINK2(instance)  #$ MISSING: arg2="arg2, l:466 -> instance"
-        SINK1(self)  #$ MISSING: arg1="with_instancecheck, l:465 -> self"
+        SINK2(instance)
+        SINK1(self)
         OK()  # Call not found
         return True
 
 
 def test_instancecheck():
-    with_instancecheck = With_instancecheck()
-    arg2 = ""
+    with_instancecheck = With_instancecheck()  #$ MISSING: arg1="SSA variable with_instancecheck" func=With_instancecheck.__instancecheck__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_instancecheck.__instancecheck__
     isinstance(arg2, with_instancecheck)
 
 
 # class.__subclasscheck__(self, subclass)
 class With_subclasscheck:
     def __subclasscheck__(self, subclass):
-        SINK2(subclass)  #$ MISSING: arg2="arg2, l:481 -> subclass"
-        SINK1(self)  #$ MISSING: arg1="with_subclasscheck, l:480 -> self"
+        SINK2(subclass)
+        SINK1(self)
         OK()  # Call not found
         return True
 
 
 def test_subclasscheck():
-    with_subclasscheck = With_subclasscheck()
-    arg2 = object
+    with_subclasscheck = With_subclasscheck()  #$ MISSING: arg1="SSA variable with_subclasscheck" func=With_subclasscheck.__subclasscheck__
+    arg2 = object  #$ MISSING: arg2="arg2" func=With_subclasscheck.__subclasscheck__
     issubclass(arg2, with_subclasscheck)
 
 
 # 3.3.5. Emulating generic types
 # classmethod object.__class_getitem__(cls, key)
-class With_class_getitem:
+class With_class_getitem:  #$ MISSING: arg1="With_class_getitem" func=With_class_getitem.__class_getitem__
     def __class_getitem__(cls, key):
-        SINK2(key)  #$ MISSING: arg2="arg2, l:496 -> key"
-        SINK1(cls)  #$ MISSING: arg1="With_class_getitem, l:487 -> cls"
+        SINK2(key)
+        SINK1(cls)
         OK()  # Call not found
         return object
 
 
 def test_class_getitem():
-    arg2 = int
+    arg2 = int  #$ MISSING: arg2="arg2" func=With_class_getitem.__class_getitem__
     with_class_getitem = With_class_getitem[arg2]()
 
 
@@ -501,12 +501,12 @@ def test_class_getitem():
 # object.__call__(self[, args...])
 class With_call:
     def __call__(self):
-        SINK1(self)  #$ MISSING: arg1="with_call, l:509 -> self"
+        SINK1(self)
         OK()  # Call not found
 
 
 def test_call():
-    with_call = With_call()
+    with_call = With_call()  #$ MISSING: arg1="SSA variable with_call" func=With_call.__call__
     with_call()
 
 
@@ -514,23 +514,23 @@ def test_call():
 # object.__len__(self)
 class With_len:
     def __len__(self):
-        SINK1(self)  #$ MISSING: arg1="with_len, l:523 -> self" arg1="with_len, l:528 -> self" arg1="with_len, l:533 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0
 
 
 def test_len():
-    with_len = With_len()
+    with_len = With_len()  #$ MISSING: arg1="SSA variable with_len" func=With_len.__len__
     len(with_len)
 
 
 def test_len_bool():
-    with_len = With_len()
+    with_len = With_len()  #$ MISSING: arg1="SSA variable with_len" func=With_len.__len__
     bool(with_len)
 
 
 def test_len_if():
-    with_len = With_len()
+    with_len = With_len()  #$ MISSING: arg1="SSA variable with_len" func=With_len.__len__
     if with_len:
         pass
 
@@ -538,7 +538,7 @@ def test_len_if():
 # object.__length_hint__(self)
 class With_length_hint:
     def __length_hint__(self):
-        SINK1(self)  #$ MISSING: arg1="with_length_hint, l:549 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0
 
@@ -546,108 +546,108 @@ class With_length_hint:
 def test_length_hint():
     import operator
 
-    with_length_hint = With_length_hint()
+    with_length_hint = With_length_hint()  #$ MISSING: arg1="SSA variable with_length_hint" func=With_length_hint.__length_hint__
     operator.length_hint(with_length_hint)
 
 
 # object.__getitem__(self, key)
 class With_getitem:
     def __getitem__(self, key):
-        SINK2(key) #$ arg2="arg2, l:565 -> key"
-        SINK1(self) #$ arg1="SSA variable with_getitem, l:563 -> self"
+        SINK2(key)
+        SINK1(self)
         OK()
         return ""
 
 
 def test_getitem():
-    with_getitem = With_getitem()
+    with_getitem = With_getitem() #$ arg1="SSA variable with_getitem" func=With_getitem.__getitem__
     arg2 = 0
-    with_getitem[arg2]
+    with_getitem[arg2] #$ arg2="arg2" func=With_getitem.__getitem__
 
 
 # object.__setitem__(self, key, value)
 class With_setitem:
     def __setitem__(self, key, value):
-        SINK3(value) #$ arg3="arg3, l:581 -> value"
-        SINK2(key) #$ arg2="arg2, l:581 -> key"
-        SINK1(self) #$ arg1="SSA variable with_setitem, l:578 -> self"
+        SINK3(value)
+        SINK2(key)
+        SINK1(self)
         OK()
 
 
 def test_setitem():
-    with_setitem = With_setitem()
+    with_setitem = With_setitem()  #$ arg1="SSA variable with_setitem" func=With_setitem.__setitem__
     arg2 = 0
     arg3 = ""
-    with_setitem[arg2] = arg3
+    with_setitem[arg2] = arg3  #$ arg2="arg2" arg3="arg3" func=With_setitem.__setitem__
 
 
 # object.__delitem__(self, key)
 class With_delitem:
     def __delitem__(self, key):
-        SINK2(key) #$ arg2="arg2, l:595 -> key"
-        SINK1(self) #$ arg1="SSA variable with_delitem, l:593 -> self"
+        SINK2(key)
+        SINK1(self)
         OK()
 
 
 def test_delitem():
-    with_delitem = With_delitem()
+    with_delitem = With_delitem()  #$ arg1="SSA variable with_delitem" func=With_delitem.__delitem__
     arg2 = 0
-    del with_delitem[arg2]
+    del with_delitem[arg2]  #$ arg2="arg2" func=With_delitem.__delitem__
 
 
 # object.__missing__(self, key)
 class With_missing(dict):
     def __missing__(self, key):
-        SINK2(key)  #$ MISSING: arg2="arg2, l:609 -> key"
-        SINK1(self)  #$ MISSING: arg1="with_missing, l:608 -> self"
+        SINK2(key)
+        SINK1(self)
         OK()  # Call not found
         return ""
 
 
 def test_missing():
-    with_missing = With_missing()
-    arg2 = 0
+    with_missing = With_missing()  #$ MISSING: arg1="SSA variable with_missing" func=With_missing.__missing__
+    arg2 = 0  #$ MISSING: arg2="arg2" func=With_missing.__missing__
     with_missing[arg2]
 
 
 # object.__iter__(self)
 class With_iter:
     def __iter__(self):
-        SINK1(self)  #$ MISSING: arg1="with_iter, l:622 -> self"
+        SINK1(self)
         OK()  # Call not found
         return [].__iter__()
 
 
 def test_iter():
-    with_iter = With_iter()
+    with_iter = With_iter()  #$ MISSING: arg1="SSA variable with_iter" func=With_iter.__iter__
     [x for x in with_iter]
 
 
 # object.__reversed__(self)
 class With_reversed:
     def __reversed__(self):
-        SINK1(self)  #$ MISSING: arg1="with_reversed, l:635 -> self"
+        SINK1(self)
         OK()  # Call not found
         return [].__iter__
 
 
 def test_reversed():
-    with_reversed = With_reversed()
+    with_reversed = With_reversed()  #$ MISSING: arg1="SSA variable with_reversed" func=With_reversed.__reversed__
     reversed(with_reversed)
 
 
 # object.__contains__(self, item)
 class With_contains:
     def __contains__(self, item):
-        SINK2(item)  #$ MISSING: arg2="arg2, l:650 -> item"
-        SINK1(self)  #$ MISSING: arg1="with_contains, l:649 -> self"
+        SINK2(item)
+        SINK1(self)
         OK()  # Call not found
         return True
 
 
 def test_contains():
-    with_contains = With_contains()
-    arg2 = 0
+    with_contains = With_contains()  #$ MISSING: arg1="SSA variable with_contains" func=With_contains.__contains__
+    arg2 = 0  #$ MISSING: arg2="arg2" func=With_contains.__contains__
     arg2 in with_contains
 
 
@@ -655,725 +655,725 @@ def test_contains():
 # object.__add__(self, other)
 class With_add:
     def __add__(self, other):
-        SINK2(other) #$ arg2="arg2, l:667 -> other"
-        SINK1(self) #$ arg1="SSA variable with_add, l:665 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_add():
-    with_add = With_add()
+    with_add = With_add()  #$ arg1="SSA variable with_add" func=With_add.__add__
     arg2 = with_add
-    with_add + arg2
+    with_add + arg2  #$ arg2="arg2" func=With_add.__add__
 
 
 # object.__sub__(self, other)
 class With_sub:
     def __sub__(self, other):
-        SINK2(other) #$ arg2="arg2, l:682 -> other"
-        SINK1(self) #$ arg1="SSA variable with_sub, l:680 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_sub():
-    with_sub = With_sub()
+    with_sub = With_sub()  #$ arg1="SSA variable with_sub" func=With_sub.__sub__
     arg2 = with_sub
-    with_sub - arg2
+    with_sub - arg2  #$ arg2="arg2" func=With_sub.__sub__
 
 
 # object.__mul__(self, other)
 class With_mul:
     def __mul__(self, other):
-        SINK2(other) #$ arg2="arg2, l:697 -> other"
-        SINK1(self) #$ arg1="SSA variable with_mul, l:695 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_mul():
-    with_mul = With_mul()
+    with_mul = With_mul()  #$ arg1="SSA variable with_mul" func=With_mul.__mul__
     arg2 = with_mul
-    with_mul * arg2
+    with_mul * arg2  #$ arg2="arg2" func=With_mul.__mul__
 
 
 # object.__matmul__(self, other)
 class With_matmul:
     def __matmul__(self, other):
-        SINK2(other) #$ arg2="arg2, l:712 -> other"
-        SINK1(self) #$ arg1="SSA variable with_matmul, l:710 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_matmul():
-    with_matmul = With_matmul()
+    with_matmul = With_matmul()  #$ arg1="SSA variable with_matmul" func=With_matmul.__matmul__
     arg2 = with_matmul
-    with_matmul @ arg2
+    with_matmul @ arg2  #$ arg2="arg2" func=With_matmul.__matmul__
 
 
 # object.__truediv__(self, other)
 class With_truediv:
     def __truediv__(self, other):
-        SINK2(other) #$ arg2="arg2, l:727 -> other"
-        SINK1(self) #$ arg1="SSA variable with_truediv, l:725 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_truediv():
-    with_truediv = With_truediv()
+    with_truediv = With_truediv()  #$ arg1="SSA variable with_truediv" func=With_truediv.__truediv__
     arg2 = with_truediv
-    with_truediv / arg2
+    with_truediv / arg2  #$ arg2="arg2" func=With_truediv.__truediv__
 
 
 # object.__floordiv__(self, other)
 class With_floordiv:
     def __floordiv__(self, other):
-        SINK2(other) #$ arg2="arg2, l:742 -> other"
-        SINK1(self) #$ arg1="SSA variable with_floordiv, l:740 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_floordiv():
-    with_floordiv = With_floordiv()
+    with_floordiv = With_floordiv()  #$ arg1="SSA variable with_floordiv" func=With_floordiv.__floordiv__
     arg2 = with_floordiv
-    with_floordiv // arg2
+    with_floordiv // arg2  #$ arg2="arg2" func=With_floordiv.__floordiv__
 
 
 # object.__mod__(self, other)
 class With_mod:
     def __mod__(self, other):
-        SINK2(other) #$ arg2="arg2, l:757 -> other"
-        SINK1(self) #$ arg1="SSA variable with_mod, l:755 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_mod():
-    with_mod = With_mod()
+    with_mod = With_mod()  #$ arg1="SSA variable with_mod" func=With_mod.__mod__
     arg2 = with_mod
-    with_mod % arg2
+    with_mod % arg2  #$ arg2="arg2" func=With_mod.__mod__
 
 
 # object.__divmod__(self, other)
 class With_divmod:
     def __divmod__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:771 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_divmod, l:770 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_divmod():
-    with_divmod = With_divmod()
-    arg2 = With_divmod
+    with_divmod = With_divmod()  #$ MISSING: arg1="SSA variable with_divmod" func=With_divmod.__divmod__
+    arg2 = With_divmod  #$ MISSING: arg2="arg2" func=With_divmod.__divmod__
     divmod(with_divmod, arg2)
 
 
 # object.__pow__(self, other[, modulo])
 class With_pow:
     def __pow__(self, other):
-        SINK2(other) #$ arg2="arg2, l:793 -> other"
-        SINK1(self) #$ arg1="SSA variable with_pow, l:791 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_pow():
-    with_pow = With_pow()
+    with_pow = With_pow()  #$ MISSING: arg1="SSA variable with_pow" func=With_pow.__pow__
     arg2 = with_pow
-    pow(with_pow, arg2)  # Call not found
+    pow(with_pow, arg2)  #$ MISSING: arg2="arg2" func=With_pow.__pow__
 
 
 def test_pow_op():
-    with_pow = With_pow()
+    with_pow = With_pow()  #$ arg1="SSA variable with_pow" func=With_pow.__pow__
     arg2 = with_pow
-    with_pow ** arg2
+    with_pow ** arg2  #$ arg2="arg2" func=With_pow.__pow__
 
 
 # object.__lshift__(self, other)
 class With_lshift:
     def __lshift__(self, other):
-        SINK2(other) #$ arg2="arg2, l:808 -> other"
-        SINK1(self) #$ arg1="SSA variable with_lshift, l:806 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_lshift():
-    with_lshift = With_lshift()
+    with_lshift = With_lshift()  #$ arg1="SSA variable with_lshift" func=With_lshift.__lshift__
     arg2 = with_lshift
-    with_lshift << arg2
+    with_lshift << arg2  #$ arg2="arg2" func=With_lshift.__lshift__
 
 
 # object.__rshift__(self, other)
 class With_rshift:
     def __rshift__(self, other):
-        SINK2(other) #$ arg2="arg2, l:823 -> other"
-        SINK1(self) #$ arg1="SSA variable with_rshift, l:821 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_rshift():
-    with_rshift = With_rshift()
+    with_rshift = With_rshift()  #$ arg1="SSA variable with_rshift" func=With_rshift.__rshift__
     arg2 = with_rshift
-    with_rshift >> arg2
+    with_rshift >> arg2  #$ arg2="arg2" func=With_rshift.__rshift__
 
 
 # object.__and__(self, other)
 class With_and:
     def __and__(self, other):
-        SINK2(other) #$ arg2="arg2, l:838 -> other"
-        SINK1(self) #$ arg1="SSA variable with_and, l:836 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_and():
-    with_and = With_and()
+    with_and = With_and()  #$ arg1="SSA variable with_and" func=With_and.__and__
     arg2 = with_and
-    with_and & arg2
+    with_and & arg2  #$ arg2="arg2" func=With_and.__and__
 
 
 # object.__xor__(self, other)
 class With_xor:
     def __xor__(self, other):
-        SINK2(other) #$ arg2="arg2, l:853 -> other"
-        SINK1(self) #$ arg1="SSA variable with_xor, l:851 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_xor():
-    with_xor = With_xor()
+    with_xor = With_xor()  #$ arg1="SSA variable with_xor" func=With_xor.__xor__
     arg2 = with_xor
-    with_xor ^ arg2
+    with_xor ^ arg2  #$ arg2="arg2" func=With_xor.__xor__
 
 
 # object.__or__(self, other)
 class With_or:
     def __or__(self, other):
-        SINK2(other) #$ arg2="arg2, l:868 -> other"
-        SINK1(self) #$ arg1="SSA variable with_or, l:866 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()
         return self
 
 
 def test_or():
-    with_or = With_or()
+    with_or = With_or()  #$ arg1="SSA variable with_or" func=With_or.__or__
     arg2 = with_or
-    with_or | arg2
+    with_or | arg2  #$ arg2="arg2" func=With_or.__or__
 
 
 # object.__radd__(self, other)
 class With_radd:
     def __radd__(self, other):
         SINK2(other)  #$ MISSING: arg2="arg2, l:882 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_radd, l:881 -> self"
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_radd():
-    with_radd = With_radd()
-    arg2 = ""
+    with_radd = With_radd()  #$ MISSING: arg1="SSA variable with_radd" func=With_radd.__radd__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_radd.__radd__
     arg2 + with_radd
 
 
 # object.__rsub__(self, other)
 class With_rsub:
     def __rsub__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:897 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rsub, l:896 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rsub():
-    with_rsub = With_rsub()
-    arg2 = ""
+    with_rsub = With_rsub()  #$ MISSING: arg1="SSA variable with_rsub" func=With_rsub.__rsub__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rsub.__rsub__
     arg2 - with_rsub
 
 
 # object.__rmul__(self, other)
 class With_rmul:
     def __rmul__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:912 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rmul, l:911 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rmul():
-    with_rmul = With_rmul()
-    arg2 = ""
+    with_rmul = With_rmul()  #$ MISSING: arg1="SSA variable with_rmul" func=With_rmul.__rmul__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rmul.__rmul__
     arg2 * with_rmul
 
 
 # object.__rmatmul__(self, other)
 class With_rmatmul:
     def __rmatmul__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:927 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rmatmul, l:926 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rmatmul():
-    with_rmatmul = With_rmatmul()
-    arg2 = ""
+    with_rmatmul = With_rmatmul()  #$ MISSING: arg1="SSA variable with_rmatmul" func=With_rmatmul.__rmatmul__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rmatmul.__rmatmul__
     arg2 @ with_rmatmul
 
 
 # object.__rtruediv__(self, other)
 class With_rtruediv:
     def __rtruediv__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:942 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rtruediv, l:941 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rtruediv():
-    with_rtruediv = With_rtruediv()
-    arg2 = ""
+    with_rtruediv = With_rtruediv()  #$ MISSING: arg1="SSA variable with_rtruediv" func=With_rtruediv.__rtruediv__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rtruediv.__rtruediv__
     arg2 / with_rtruediv
 
 
 # object.__rfloordiv__(self, other)
 class With_rfloordiv:
     def __rfloordiv__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:957 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rfloordiv, l:956 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rfloordiv():
-    with_rfloordiv = With_rfloordiv()
-    arg2 = ""
+    with_rfloordiv = With_rfloordiv()  #$ MISSING: arg1="SSA variable with_rfloordiv" func=With_rfloordiv.__rfloordiv__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rfloordiv.__rfloordiv__
     arg2 // with_rfloordiv
 
 
 # object.__rmod__(self, other)
 class With_rmod:
     def __rmod__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:972 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rmod, l:971 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rmod():
-    with_rmod = With_rmod()
-    arg2 = {}
+    with_rmod = With_rmod()  #$ MISSING: arg1="SSA variable with_rmod" func=With_rmod.__rmod__
+    arg2 = {}  #$ MISSING: arg2="arg2" func=With_rmod.__rmod__
     arg2 % with_rmod
 
 
 # object.__rdivmod__(self, other)
 class With_rdivmod:
     def __rdivmod__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:987 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rdivmod, l:986 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rdivmod():
-    with_rdivmod = With_rdivmod()
-    arg2 = ""
+    with_rdivmod = With_rdivmod()  #$ MISSING: arg1="SSA variable with_rdivmod" func=With_rdivmod.__rdivmod__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rdivmod.__rdivmod__
     divmod(arg2, with_rdivmod)
 
 
 # object.__rpow__(self, other[, modulo])
 class With_rpow:
     def __rpow__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1002 -> other" arg2="arg2, l:1008 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rpow, l:1001 -> self" arg1="with_rpow, l:1007 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rpow():
-    with_rpow = With_rpow()
-    arg2 = ""
+    with_rpow = With_rpow()  #$ MISSING: arg1="SSA variable with_rpow" func=With_rpow.__rpow__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rpow.__rpow__
     pow(arg2, with_rpow)
 
 
 def test_rpow_op():
-    with_rpow = With_rpow()
-    arg2 = ""
+    with_rpow = With_rpow()  #$ MISSING: arg1="SSA variable with_rpow" func=With_rpow.__rpow__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rpow.__rpow__
     arg2 ** with_rpow
 
 
 # object.__rlshift__(self, other)
 class With_rlshift:
     def __rlshift__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1023 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rlshift, l:1022 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rlshift():
-    with_rlshift = With_rlshift()
-    arg2 = ""
+    with_rlshift = With_rlshift()  #$ MISSING: arg1="SSA variable with_rlshift" func=With_rlshift.__rlshift__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rlshift.__rlshift__
     arg2 << with_rlshift
 
 
 # object.__rrshift__(self, other)
 class With_rrshift:
     def __rrshift__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1038 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rrshift, l:1037 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rrshift():
-    with_rrshift = With_rrshift()
-    arg2 = ""
+    with_rrshift = With_rrshift()  #$ MISSING: arg1="SSA variable with_rrshift" func=With_rrshift.__rrshift__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rrshift.__rrshift__
     arg2 >> with_rrshift
 
 
 # object.__rand__(self, other)
 class With_rand:
     def __rand__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1053 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rand, l:1052 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rand():
-    with_rand = With_rand()
-    arg2 = ""
+    with_rand = With_rand()  #$ MISSING: arg1="SSA variable with_rand" func=With_rand.__rand__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rand.__rand__
     arg2 & with_rand
 
 
 # object.__rxor__(self, other)
 class With_rxor:
     def __rxor__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1068 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_rxor, l:1067 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_rxor():
-    with_rxor = With_rxor()
-    arg2 = ""
+    with_rxor = With_rxor()  #$ MISSING: arg1="SSA variable with_rxor" func=With_rxor.__rxor__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rxor.__rxor__
     arg2 ^ with_rxor
 
 
 # object.__ror__(self, other)
 class With_ror:
     def __ror__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1083 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_ror, l:1082 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_ror():
-    with_ror = With_ror()
-    arg2 = ""
+    with_ror = With_ror()  #$ MISSING: arg1="SSA variable with_ror" func=With_ror.__ror__
+    arg2 = ""  #$ MISSING: arg2="arg2" func=With_ror.__ror__
     arg2 | with_ror
 
 
 # object.__iadd__(self, other)
 class With_iadd:
     def __iadd__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1098 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_iadd, l:1097 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_iadd():
-    with_iadd = With_iadd()
-    arg2 = with_iadd
+    with_iadd = With_iadd()  #$ MISSING: arg1="SSA variable with_iadd" func=With_iadd.__iadd__
+    arg2 = with_iadd  #$ MISSING: arg2="arg2" func=With_iadd.__iadd__
     with_iadd += arg2
 
 
 # object.__isub__(self, other)
 class With_isub:
     def __isub__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1113 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_isub, l:1112 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_isub():
-    with_isub = With_isub()
-    arg2 = with_isub
+    with_isub = With_isub()  #$ MISSING: arg1="SSA variable with_isub" func=With_isub.__isub__
+    arg2 = with_isub  #$ MISSING: arg2="arg2" func=With_isub.__isub__
     with_isub -= arg2
 
 
 # object.__imul__(self, other)
 class With_imul:
     def __imul__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1128 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_imul, l:1127 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_imul():
-    with_imul = With_imul()
-    arg2 = with_imul
+    with_imul = With_imul()  #$ MISSING: arg1="SSA variable with_imul" func=With_imul.__imul__
+    arg2 = with_imul  #$ MISSING: arg2="arg2" func=With_imul.__imul__
     with_imul *= arg2
 
 
 # object.__imatmul__(self, other)
 class With_imatmul:
     def __imatmul__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1143 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_imatmul, l:1142 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_imatmul():
-    with_imatmul = With_imatmul()
-    arg2 = with_imatmul
+    with_imatmul = With_imatmul()  #$ MISSING: arg1="SSA variable with_imatmul" func=With_imatmul.__imatmul__
+    arg2 = with_imatmul  #$ MISSING: arg2="arg2" func=With_imatmul.__imatmul__
     with_imatmul @= arg2
 
 
 # object.__itruediv__(self, other)
 class With_itruediv:
     def __itruediv__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1158 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_itruediv, l:1157 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_itruediv():
-    with_itruediv = With_itruediv()
-    arg2 = with_itruediv
+    with_itruediv = With_itruediv()  #$ MISSING: arg1="SSA variable with_itruediv" func=With_itruediv.__itruediv__
+    arg2 = with_itruediv  #$ MISSING: arg2="arg2" func=With_itruediv.__itruediv__
     with_itruediv /= arg2
 
 
 # object.__ifloordiv__(self, other)
 class With_ifloordiv:
     def __ifloordiv__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1173 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_ifloordiv, l:172 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_ifloordiv():
-    with_ifloordiv = With_ifloordiv()
-    arg2 = with_ifloordiv
+    with_ifloordiv = With_ifloordiv()  #$ MISSING: arg1="SSA variable with_ifloordiv" func=With_ifloordiv.__ifloordiv__
+    arg2 = with_ifloordiv  #$ MISSING: arg2="arg2" func=With_ifloordiv.__ifloordiv__
     with_ifloordiv //= arg2
 
 
 # object.__imod__(self, other)
 class With_imod:
     def __imod__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1188 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_imod, l:1187 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_imod():
-    with_imod = With_imod()
-    arg2 = with_imod
+    with_imod = With_imod()  #$ MISSING: arg1="SSA variable with_imod" func=With_imod.__imod__
+    arg2 = with_imod  #$ MISSING: arg2="arg2" func=With_imod.__imod__
     with_imod %= arg2
 
 
 # object.__ipow__(self, other[, modulo])
 class With_ipow:
     def __ipow__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1203 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_ipow, l:1202 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_ipow():
-    with_ipow = With_ipow()
-    arg2 = with_ipow
+    with_ipow = With_ipow()  #$ MISSING: arg1="SSA variable with_ipow" func=With_ipow.__ipow__
+    arg2 = with_ipow  #$ MISSING: arg2="arg2" func=With_ipow.__ipow__
     with_ipow **= arg2
 
 
 # object.__ilshift__(self, other)
 class With_ilshift:
     def __ilshift__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1218 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_ilshift, l:1217 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_ilshift():
-    with_ilshift = With_ilshift()
-    arg2 = with_ilshift
+    with_ilshift = With_ilshift()  #$ MISSING: arg1="SSA variable with_ilshift" func=With_ilshift.__ilshift__
+    arg2 = with_ilshift  #$ MISSING: arg2="arg2" func=With_ilshift.__ilshift__
     with_ilshift <<= arg2
 
 
 # object.__irshift__(self, other)
 class With_irshift:
     def __irshift__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1233 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_irshift, l:1232 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_irshift():
-    with_irshift = With_irshift()
-    arg2 = with_irshift
+    with_irshift = With_irshift()  #$ MISSING: arg1="SSA variable with_irshift" func=With_irshift.__irshift__
+    arg2 = with_irshift  #$ MISSING: arg2="arg2" func=With_irshift.__irshift__
     with_irshift >>= arg2
 
 
 # object.__iand__(self, other)
 class With_iand:
     def __iand__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1248 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_iand, l:1247 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_iand():
-    with_iand = With_iand()
-    arg2 = with_iand
+    with_iand = With_iand()  #$ MISSING: arg1="SSA variable with_iand" func=With_iand.__iand__
+    arg2 = with_iand  #$ MISSING: arg2="arg2" func=With_iand.__iand__
     with_iand &= arg2
 
 
 # object.__ixor__(self, other)
 class With_ixor:
     def __ixor__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1263 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_ixor, l:1262 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_ixor():
-    with_ixor = With_ixor()
-    arg2 = with_ixor
+    with_ixor = With_ixor()  #$ MISSING: arg1="SSA variable with_ixor" func=With_ixor.__ixor__
+    arg2 = with_ixor  #$ MISSING: arg2="arg2" func=With_ixor.__ixor__
     with_ixor ^= arg2
 
 
 # object.__ior__(self, other)
 class With_ior:
     def __ior__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:1278 -> other"
-        SINK1(self)  #$ MISSING: arg1="with_ior, l:1277 -> self"
+        SINK2(other)
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_ior():
-    with_ior = With_ior()
-    arg2 = with_ior
+    with_ior = With_ior()  #$ MISSING: arg1="SSA variable with_ior" func=With_ior.__ior__
+    arg2 = with_ior  #$ MISSING: arg2="arg2" func=With_ior.__ior__
     with_ior |= arg2
 
 
 # object.__neg__(self)
 class With_neg:
     def __neg__(self):
-        SINK1(self)  #$ MISSING: arg1="with_neg, l:1291 -> self"
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_neg():
-    with_neg = With_neg()
+    with_neg = With_neg()  #$ MISSING: arg1="SSA variable with_neg" func=With_neg.__neg__
     -with_neg
 
 
 # object.__pos__(self)
 class With_pos:
     def __pos__(self):
-        SINK1(self)  #$ MISSING: arg1="with_pos, l:1303 -> self"
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_pos():
-    with_pos = With_pos()
+    with_pos = With_pos()  #$ MISSING: arg1="SSA variable with_pos" func=With_pos.__pos__
     +with_pos
 
 
 # object.__abs__(self)
 class With_abs:
     def __abs__(self):
-        SINK1(self)  #$ MISSING: arg1="with_abs, l:1317 -> self"
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_abs():
-    with_abs = With_abs()
+    with_abs = With_abs()  #$ MISSING: arg1="SSA variable with_abs" func=With_abs.__abs__
     abs(with_abs)
 
 
 # object.__invert__(self)
 class With_invert:
     def __invert__(self):
-        SINK1(self)  #$ MISSING: arg1="with_invert, l:1330 -> self"
+        SINK1(self)
         OK()  # Call not found
         return self
 
 
 def test_invert():
-    with_invert = With_invert()
+    with_invert = With_invert()  #$ MISSING: arg1="SSA variable with_invert" func=With_invert.__invert__
     ~with_invert
 
 
 # object.__complex__(self)
 class With_complex:
     def __complex__(self):
-        SINK1(self)  #$ MISSING: arg1="with_complex, l:1343 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0j
 
 
 def test_complex():
-    with_complex = With_complex()
+    with_complex = With_complex()  #$ MISSING: arg1="SSA variable with_complex" func=With_complex.__complex__
     complex(with_complex)
 
 
 # object.__int__(self)
 class With_int:
     def __int__(self):
-        SINK1(self)  #$ MISSING: arg1="with_int, l:1356 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0
 
 
 def test_int():
-    with_int = With_int()
+    with_int = With_int()  #$ MISSING: arg1="SSA variable with_int" func=With_int.__int__
     int(with_int)
 
 
 # object.__float__(self)
 class With_float:
     def __float__(self):
-        SINK1(self)  #$ MISSING: arg1="with_float, l:1369 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0.0
 
 
 def test_float():
-    with_float = With_float()
+    with_float = With_float()  #$ MISSING: arg1="SSA variable with_float" func=With_float.__float__
     float(with_float)
 
 
 # object.__index__(self)
 class With_index:
     def __index__(self):
-        SINK1(self)  #$ MISSING: arg1="with_index, l:1384 -> self" arg1="with_index, l:1389 -> self" arg1="with_index, l:1394 -> self" arg1="with_index, l:1399 -> self" arg1="with_index, l:1404 -> self" arg1="with_index, l:1409 -> self" arg1="with_index, l:1414 -> self" arg1="with_index, l:1419 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0
 
@@ -1381,68 +1381,68 @@ class With_index:
 def test_index():
     import operator
 
-    with_index = With_index()
+    with_index = With_index()  #$ MISSING: arg1="SSA variable with_index" func=With_index.__index__
     operator.index(with_index)
 
 
 def test_index_slicing():
-    with_index = With_index()
+    with_index = With_index()  #$ MISSING: arg1="SSA variable with_index" func=With_index.__index__
     [0][with_index:1]
 
 
 def test_index_bin():
-    with_index = With_index()
+    with_index = With_index()  #$ MISSING: arg1="SSA variable with_index" func=With_index.__index__
     bin(with_index)
 
 
 def test_index_hex():
-    with_index = With_index()
+    with_index = With_index()  #$ MISSING: arg1="SSA variable with_index" func=With_index.__index__
     hex(with_index)
 
 
 def test_index_oct():
-    with_index = With_index()
+    with_index = With_index()  #$ MISSING: arg1="SSA variable with_index" func=With_index.__index__
     oct(with_index)
 
 
 def test_index_int():
-    with_index = With_index()
+    with_index = With_index()  #$ MISSING: arg1="SSA variable with_index" func=With_index.__index__
     int(with_index)
 
 
 def test_index_float():
-    with_index = With_index()
+    with_index = With_index()  #$ MISSING: arg1="SSA variable with_index" func=With_index.__index__
     float(with_index)
 
 
 def test_index_complex():
-    with_index = With_index()
+    with_index = With_index()  #$ MISSING: arg1="SSA variable with_index" func=With_index.__index__
     complex(with_index)
 
 
 # object.__round__(self[, ndigits])
 class With_round:
     def __round__(self):
-        SINK1(self)  #$ MISSING: arg1="with_round, l:1432 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0
 
 
 def test_round():
-    with_round = With_round()
+    with_round = With_round()  #$ MISSING: arg1="SSA variable with_round" func=With_round.__round__
     round(with_round)
 
 
 # object.__trunc__(self)
 class With_trunc:
     def __trunc__(self):
-        SINK1(self)  #$ MISSING: arg1="with_trunc, l:1445 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0
 
 
 def test_trunc():
-    with_trunc = With_trunc()
+    with_trunc = With_trunc()  #$ MISSING: arg1="SSA variable with_trunc" func=With_trunc.__trunc__
     import math
 
     math.trunc(with_trunc)
@@ -1451,13 +1451,13 @@ def test_trunc():
 # object.__floor__(self)
 class With_floor:
     def __floor__(self):
-        SINK1(self)  #$ MISSING: arg1="with_floor, l:1460 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0
 
 
 def test_floor():
-    with_floor = With_floor()
+    with_floor = With_floor()  #$ MISSING: arg1="SSA variable with_floor" func=With_floor.__floor__
     import math
 
     math.floor(with_floor)
@@ -1466,13 +1466,13 @@ def test_floor():
 # object.__ceil__(self)
 class With_ceil:
     def __ceil__(self):
-        SINK1(self)  #$ MISSING: arg1="with_ceil, l:147 -> self"
+        SINK1(self)
         OK()  # Call not found
         return 0
 
 
 def test_ceil():
-    with_ceil = With_ceil()
+    with_ceil = With_ceil()  #$ MISSING: arg1="SSA variable with_ceil" func=With_ceil.__ceil__
     import math
 
     math.ceil(with_ceil)
@@ -1482,7 +1482,7 @@ def test_ceil():
 # object.__enter__(self)
 class With_enter:
     def __enter__(self):
-        SINK1(self)  #$ MISSING: arg1=".0, l:1494 -> self"
+        SINK1(self)
         OK()  # Call not found
         return
 
@@ -1504,7 +1504,7 @@ class With_exit:
         SINK4(traceback)  # Flow not tested
         SINK3(exc_value)  # Flow not tested
         SINK2(exc_type)  # Flow not tested
-        SINK1(self)  #$ MISSING: arg1=".0, l:1513 -> self"
+        SINK1(self)
         OK()  # Call not found
         return
 
@@ -1519,13 +1519,13 @@ def test_exit():
 # object.__await__(self)
 class With_await:
     def __await__(self):
-        SINK1(self)  #$ MISSING: arg1="with_await, l:1528 -> self"
+        SINK1(self)
         OK()  # Call not found
         return (yield from asyncio.coroutine(lambda: "")())
 
 
 async def atest_await():
-    with_await = With_await()
+    with_await = With_await()  #$ MISSING: arg1="SSA variable with_await" func=With_await.__await__
     await (with_await)
 
 
@@ -1538,7 +1538,7 @@ async def atest_await():
 # object.__aiter__(self)
 class With_aiter:
     def __aiter__(self):
-        SINK1(self)  #$ MISSING: arg1="with_aiter, l:1550 -> self"
+        SINK1(self)
         OK()  # Call not found
         return self
 
@@ -1547,7 +1547,7 @@ class With_aiter:
 
 
 async def atest_aiter():
-    with_aiter = With_aiter()
+    with_aiter = With_aiter()  #$ MISSING: arg1="SSA variable with_aiter" func=With_aiter.__aiter__
     async for x in with_aiter:
         pass
 
@@ -1558,13 +1558,13 @@ class With_anext:
         return self
 
     async def __anext__(self):
-        SINK1(self)  #$ MISSING: arg1="with_anext, l:1567 -> self"
+        SINK1(self)
         OK()  # Call not found
         raise StopAsyncIteration
 
 
 async def atest_anext():
-    with_anext = With_anext()
+    with_anext = With_anext()  #$ MISSING: arg1="SSA variable with_anext" func=With_anext.__anext__
     async for x in with_anext:
         pass
 
@@ -1573,7 +1573,7 @@ async def atest_anext():
 # object.__aenter__(self)
 class With_aenter:
     async def __aenter__(self):
-        SINK1(self)  #$ MISSING: arg1="with_aenter, l:1584 -> self"
+        SINK1(self)
         OK()  # Call not found
 
     async def __aexit__(self, exc_type, exc_value, traceback):
@@ -1581,7 +1581,7 @@ class With_aenter:
 
 
 async def atest_aenter():
-    with_aenter = With_aenter()
+    with_aenter = With_aenter()  #$ MISSING: arg1="SSA variable with_aenter" func=With_aenter.__aenter__
     async with with_aenter:
         pass
 
@@ -1595,11 +1595,11 @@ class With_aexit:
         SINK4(traceback)  # Flow not tested
         SINK3(exc_value)  # Flow not tested
         SINK2(exc_type)  # Flow not tested
-        SINK1(self)  #$ MISSING: arg1="with_aexit, l:1603 -> self"
+        SINK1(self)
         OK()  # Call not found
 
 
 async def atest_aexit():
-    with_aexit = With_aexit()
+    with_aexit = With_aexit()  #$ MISSING: arg1="SSA variable with_aexit" func=With_aexit.__aexit__
     async with with_aexit:
         pass
diff --git a/python/ql/test/experimental/dataflow/coverage/datamodel.py b/python/ql/test/experimental/dataflow/coverage/datamodel.py
index 3f11593dbd1..6c20ed60755 100644
--- a/python/ql/test/experimental/dataflow/coverage/datamodel.py
+++ b/python/ql/test/experimental/dataflow/coverage/datamodel.py
@@ -153,7 +153,7 @@ class Customized:
 
 # testing __new__ and __init__
 customized = Customized()
-SINK(Customized.a)
+SINK(Customized.a)  #$ MISSING:flow="SOURCE, l:-8 -> customized.a"
 SINK_F(Customized.b)
-SINK(customized.a)
-SINK(customized.b)  #$ flow="SOURCE, l:152 -> customized.b"
+SINK(customized.a)  #$ MISSING:flow="SOURCE, l:-10 -> customized.a"
+SINK(customized.b)  #$ flow="SOURCE, l:-7 -> customized.b"
diff --git a/python/ql/test/experimental/dataflow/coverage/test.py b/python/ql/test/experimental/dataflow/coverage/test.py
index 2a1f7dca58c..eb33273cd4e 100644
--- a/python/ql/test/experimental/dataflow/coverage/test.py
+++ b/python/ql/test/experimental/dataflow/coverage/test.py
@@ -41,7 +41,7 @@ def SINK_F(x):
 def test_tuple_with_local_flow():
     x = (NONSOURCE, SOURCE)
     y = x[1]
-    SINK(y) #$ flow="SOURCE, l:42 -> y"
+    SINK(y) #$ flow="SOURCE, l:-2 -> y"
 
 
 def test_tuple_negative():
@@ -53,45 +53,45 @@ def test_tuple_negative():
 # 6.2.1. Identifiers (Names)
 def test_names():
     x = SOURCE
-    SINK(x) #$ flow="SOURCE, l:55 -> x"
+    SINK(x) #$ flow="SOURCE, l:-1 -> x"
 
 
 # 6.2.2. Literals
 def test_string_literal():
     x = "source"
-    SINK(x) #$ flow="'source', l:61 -> x"
+    SINK(x) #$ flow="'source', l:-1 -> x"
 
 
 def test_bytes_literal():
     x = b"source"
-    SINK(x) #$ flow="b'source', l:66 -> x"
+    SINK(x) #$ flow="b'source', l:-1 -> x"
 
 
 def test_integer_literal():
     x = 42
-    SINK(x) #$ flow="42, l:71 -> x"
+    SINK(x) #$ flow="42, l:-1 -> x"
 
 
 def test_floatnumber_literal():
     x = 42.0
-    SINK(x) #$ flow="42.0, l:76 -> x"
+    SINK(x) #$ flow="42.0, l:-1 -> x"
 
 
 def test_imagnumber_literal():
     x = 42j
-    SINK(x) #$ MISSING:flow="42j, l:81 -> x"
+    SINK(x) #$ MISSING:flow="42j, l:-1 -> x"
 
 
 # 6.2.3. Parenthesized forms
 def test_parenthesized_form():
     x = (SOURCE)
-    SINK(x) #$ flow="SOURCE, l:87 -> x"
+    SINK(x) #$ flow="SOURCE, l:-1 -> x"
 
 
 # 6.2.5. List displays
 def test_list_display():
     x = [SOURCE]
-    SINK(x[0]) #$ flow="SOURCE, l:93 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:-1 -> x[0]"
 
 
 def test_list_display_negative():
@@ -101,103 +101,103 @@ def test_list_display_negative():
 
 def test_list_comprehension():
     x = [SOURCE for y in [NONSOURCE]]
-    SINK(x[0]) #$ flow="SOURCE, l:103 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:-1 -> x[0]"
 
 
 def test_list_comprehension_flow():
     x = [y for y in [SOURCE]]
-    SINK(x[0]) #$  flow="SOURCE, l:108 -> x[0]"
+    SINK(x[0]) #$  flow="SOURCE, l:-1 -> x[0]"
 
 
 def test_list_comprehension_inflow():
     l = [SOURCE]
     x = [y for y in l]
-    SINK(x[0]) #$ flow="SOURCE, l:113 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:-2 -> x[0]"
 
 
 def test_nested_list_display():
     x = [*[SOURCE]]
-    SINK(x[0]) #$ MISSING:flow="SOURCE, l:119 -> x[0]"
+    SINK(x[0]) #$ MISSING:flow="SOURCE, l:-1 -> x[0]"
 
 
 # 6.2.6. Set displays
 def test_set_display():
     x = {SOURCE}
-    SINK(x.pop()) #$ flow="SOURCE, l:125 -> x.pop()"
+    SINK(x.pop()) #$ flow="SOURCE, l:-1 -> x.pop()"
 
 
 def test_set_comprehension():
     x = {SOURCE for y in [NONSOURCE]}
-    SINK(x.pop()) #$ flow="SOURCE, l:130 -> x.pop()"
+    SINK(x.pop()) #$ flow="SOURCE, l:-1 -> x.pop()"
 
 
 def test_set_comprehension_flow():
     x = {y for y in [SOURCE]}
-    SINK(x.pop()) #$ flow="SOURCE, l:135 -> x.pop()"
+    SINK(x.pop()) #$ flow="SOURCE, l:-1 -> x.pop()"
 
 
 def test_set_comprehension_inflow():
     l = {SOURCE}
     x = {y for y in l}
-    SINK(x.pop()) #$ flow="SOURCE, l:140 -> x.pop()"
+    SINK(x.pop()) #$ flow="SOURCE, l:-2 -> x.pop()"
 
 
 def test_nested_set_display():
     x = {*{SOURCE}}
-    SINK(x.pop()) #$ MISSING:flow="SOURCE, l:146 -> x.pop()"
+    SINK(x.pop()) #$ MISSING:flow="SOURCE, l:-1 -> x.pop()"
 
 
 # 6.2.7. Dictionary displays
 def test_dict_display():
     x = {"s": SOURCE}
-    SINK(x["s"]) #$ flow="SOURCE, l:152 -> x['s']"
+    SINK(x["s"]) #$ flow="SOURCE, l:-1 -> x['s']"
 
 
 def test_dict_display_pop():
     x = {"s": SOURCE}
-    SINK(x.pop("s")) #$ flow="SOURCE, l:157 -> x.pop(..)"
+    SINK(x.pop("s")) #$ flow="SOURCE, l:-1 -> x.pop(..)"
 
 
 def test_dict_comprehension():
     x = {y: SOURCE for y in ["s"]}
-    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:152 -> x['s']"
+    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:-1 -> x['s']"
 
 
 def test_dict_comprehension_pop():
     x = {y: SOURCE for y in ["s"]}
-    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:167 -> x.pop()"
+    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:-1 -> x.pop()"
 
 
 def test_nested_dict_display():
     x = {**{"s": SOURCE}}
-    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:172 -> x['s']"
+    SINK(x["s"]) #$ MISSING:flow="SOURCE, l:-1 -> x['s']"
 
 
 def test_nested_dict_display_pop():
     x = {**{"s": SOURCE}}
-    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:177 -> x.pop()"
+    SINK(x.pop("s")) #$ MISSING:flow="SOURCE, l:-1 -> x.pop()"
 
 
 # Nested comprehensions
 def test_nested_comprehension():
     x = [y for z in [[SOURCE]] for y in z]
-    SINK(x[0]) #$ flow="SOURCE, l:183 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:-1 -> x[0]"
 
 
 def test_nested_comprehension_deep_with_local_flow():
     x = [y for v in [[[[SOURCE]]]] for u in v for z in u for y in z]
-    SINK(x[0]) #$ flow="SOURCE, l:188 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:-1 -> x[0]"
 
 
 def test_nested_comprehension_dict():
     d = {"s": [SOURCE]}
     x = [y for k, v in d.items() for y in v]
-    SINK(x[0]) #$ MISSING:flow="SOURCE, l:193 -> x[0]"
+    SINK(x[0]) #$ MISSING:flow="SOURCE, l:-1 -> x[0]"
 
 
 def test_nested_comprehension_paren():
     x = [y for y in (z for z in [SOURCE])]
-    SINK(x[0]) #$ flow="SOURCE, l:199 -> x[0]"
+    SINK(x[0]) #$ flow="SOURCE, l:-1 -> x[0]"
 
 
 # 6.2.8. Generator expressions
@@ -228,7 +228,7 @@ def test_yield_from():
 # a statement rather than an expression, but related to generators
 def test_for():
     for x in gen(SOURCE):
-        SINK(x) #$ MISSING:flow="SOURCE, l:230 -> x"
+        SINK(x) #$ MISSING:flow="SOURCE, l:-1 -> x"
 
 
 # 6.2.9.1. Generator-iterator methods
@@ -508,12 +508,12 @@ def test_lambda_extra_keyword_flow():
 def test_swap():
     a = SOURCE
     b = NONSOURCE
-    SINK(a) #$ flow="SOURCE, l:509 -> a"
+    SINK(a) #$ flow="SOURCE, l:-2 -> a"
     SINK_F(b)
 
     a, b = b, a
     SINK_F(a)
-    SINK(b) #$ flow="SOURCE, l:509 -> b"
+    SINK(b) #$ flow="SOURCE, l:-7 -> b"
 
 
 def test_deep_callgraph():
@@ -538,7 +538,7 @@ def test_deep_callgraph():
         return f5(arg)
 
     x = f6(SOURCE)
-    SINK(x) #$ MISSING:flow="SOURCE, l:540 -> x"
+    SINK(x) #$ MISSING:flow="SOURCE, l:-1 -> x"
 
 
 @expects(2)

From 876123315d351e0764d8b17cd07f593d937a3c29 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 3 Nov 2020 15:36:39 +0100
Subject: [PATCH 216/343] C#: Extract function pointers

---
 .../Entities/Expressions/Invocation.cs        |  50 +++++--
 .../Entities/LocalFunction.cs                 |   2 +-
 .../Entities/Method.cs                        |  16 +-
 .../Entities/OrdinaryMethod.cs                |   2 +-
 .../Entities/Types/FunctionPointerType.cs     |  44 ++++++
 .../Entities/Types/Type.cs                    |  45 +++---
 .../Kinds/ExprKind.cs                         |   3 +-
 .../Kinds/TypeKind.cs                         |   3 +-
 .../Populators/Symbols.cs                     |   2 +
 .../SymbolExtensions.cs                       | 141 ++++++++++++++++--
 .../Semmle.Extraction.CSharp/Tuples.cs        |  15 ++
 csharp/ql/src/semmlecode.csharp.dbscheme      |  22 ++-
 .../library-tests/csharp9/FunctionPointer.cs  |  39 +++++
 csharp/upgrades/TO_CHANGE/upgrade.properties  |   2 +
 14 files changed, 335 insertions(+), 51 deletions(-)
 create mode 100644 csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs
 create mode 100644 csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
 create mode 100644 csharp/upgrades/TO_CHANGE/upgrade.properties

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
index 9efb5aec97f..bf5cf006282 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
@@ -4,6 +4,7 @@ using System.Linq;
 using Microsoft.CodeAnalysis.CSharp;
 using Semmle.Extraction.Kinds;
 using System.IO;
+using System;
 
 namespace Semmle.Extraction.CSharp.Entities.Expressions
 {
@@ -66,7 +67,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     }
                     break;
                 default:
-                    // Delegate call; `d()`
+                    // Delegate or function pointer call; `d()`
                     Create(cx, Syntax.Expression, this, child++);
                     break;
             }
@@ -84,7 +85,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
             if (target == null)
             {
-                if (!isDynamicCall && !IsDelegateCall(info))
+                if (!isDynamicCall && !IsDelegateLikeCall(info))
                     cx.ModelError(Syntax, "Unable to resolve target for call. (Compilation error?)");
                 return;
             }
@@ -98,7 +99,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             // Either the qualifier (Expression) is dynamic,
             // or one of the arguments is dynamic.
             var node = (InvocationExpressionSyntax)info.Node;
-            return !IsDelegateCall(info) &&
+            return !IsDelegateLikeCall(info) &&
                 (IsDynamic(info.Context, node.Expression) || node.ArgumentList.Arguments.Any(arg => IsDynamic(info.Context, arg.Expression)));
         }
 
@@ -133,12 +134,22 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             }
         }
 
-        private static bool IsDelegateCall(ExpressionNodeInfo info)
+        private static bool IsDelegateLikeCall(ExpressionNodeInfo info)
+        {
+            return IsDelegateLikeCall(info, IsDelegateLikeCall);
+        }
+
+        private static bool IsDelegateInvokeCall(ExpressionNodeInfo info)
+        {
+            return IsDelegateLikeCall(info, IsDelegateInvoke);
+        }
+
+        private static bool IsDelegateLikeCall(ExpressionNodeInfo info, Func<ISymbol, bool> check)
         {
             var si = info.SymbolInfo;
 
             if (si.CandidateReason == CandidateReason.OverloadResolutionFailure &&
-                si.CandidateSymbols.OfType<IMethodSymbol>().All(s => s.MethodKind == MethodKind.DelegateInvoke))
+                si.CandidateSymbols.All(check))
             {
                 return true;
             }
@@ -153,9 +164,26 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                 return true;
             }
 
-            return si.Symbol != null &&
-                si.Symbol.Kind == SymbolKind.Method &&
-                ((IMethodSymbol)si.Symbol).MethodKind == MethodKind.DelegateInvoke;
+            return check(si.Symbol);
+        }
+
+        private static bool IsDelegateLikeCall(ISymbol symbol)
+        {
+            return IsFunctionPointer(symbol) ||
+                IsDelegateInvoke(symbol);
+        }
+
+        private static bool IsFunctionPointer(ISymbol symbol)
+        {
+            return symbol != null &&
+                symbol.Kind == SymbolKind.FunctionPointerType;
+        }
+
+        private static bool IsDelegateInvoke(ISymbol symbol)
+        {
+            return symbol != null &&
+                symbol.Kind == SymbolKind.Method &&
+                ((IMethodSymbol)symbol).MethodKind == MethodKind.DelegateInvoke;
         }
 
         private static bool IsLocalFunctionInvocation(ExpressionNodeInfo info)
@@ -168,8 +196,10 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
         {
             return IsNameof((InvocationExpressionSyntax)info.Node)
                 ? ExprKind.NAMEOF
-                : IsDelegateCall(info)
-                    ? ExprKind.DELEGATE_INVOCATION
+                : IsDelegateLikeCall(info)
+                    ? IsDelegateInvokeCall(info)
+                        ? ExprKind.DELEGATE_INVOCATION
+                        : ExprKind.FUNCTION_POINTER_INVOCATION
                     : IsLocalFunctionInvocation(info)
                         ? ExprKind.LOCAL_FUNCTION_INVOCATION
                         : ExprKind.METHOD_INVOCATION;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalFunction.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalFunction.cs
index 309feabfe3d..921036250d1 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalFunction.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalFunction.cs
@@ -39,7 +39,7 @@ namespace Semmle.Extraction.CSharp.Entities
             var originalDefinition = IsSourceDeclaration ? this : Create(Context, symbol.OriginalDefinition);
             var returnType = Type.Create(Context, symbol.ReturnType);
             trapFile.local_functions(this, symbol.Name, returnType, originalDefinition);
-            ExtractRefReturn(trapFile);
+            ExtractRefReturn(trapFile, symbol, this);
         }
 
         public override TrapStackBehaviour TrapStackBehaviour => TrapStackBehaviour.NeedsLabel;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
index 94e8c838e7b..6a52087e384 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs
@@ -40,7 +40,9 @@ namespace Semmle.Extraction.CSharp.Entities
 
             foreach (var p in parameters.Zip(originalParameters, (paramSymbol, originalParam) => new { paramSymbol, originalParam }))
             {
-                var original = SymbolEqualityComparer.Default.Equals(p.paramSymbol, p.originalParam) ? null : Parameter.Create(Context, p.originalParam, originalMethod);
+                var original = SymbolEqualityComparer.Default.Equals(p.paramSymbol, p.originalParam)
+                    ? null
+                    : Parameter.Create(Context, p.originalParam, originalMethod);
                 Parameter.Create(Context, p.paramSymbol, this, original);
             }
 
@@ -110,7 +112,7 @@ namespace Semmle.Extraction.CSharp.Entities
         /// <summary>
         ///  Factored out to share logic between `Method` and `UserOperator`.
         /// </summary>
-        protected static void BuildMethodId(Method m, TextWriter trapFile)
+        private static void BuildMethodId(Method m, TextWriter trapFile)
         {
             m.symbol.ReturnType.BuildOrWriteId(m.Context, trapFile, m.symbol);
             trapFile.Write(" ");
@@ -324,12 +326,12 @@ namespace Semmle.Extraction.CSharp.Entities
             }
         }
 
-        protected void ExtractRefReturn(TextWriter trapFile)
+        public static void ExtractRefReturn(TextWriter trapFile, IMethodSymbol method, IEntity element)
         {
-            if (symbol.ReturnsByRef)
-                trapFile.type_annotation(this, Kinds.TypeAnnotation.Ref);
-            if (symbol.ReturnsByRefReadonly)
-                trapFile.type_annotation(this, Kinds.TypeAnnotation.ReadonlyRef);
+            if (method.ReturnsByRef)
+                trapFile.type_annotation(element, Kinds.TypeAnnotation.Ref);
+            if (method.ReturnsByRefReadonly)
+                trapFile.type_annotation(element, Kinds.TypeAnnotation.ReadonlyRef);
         }
 
         protected void PopulateMethod(TextWriter trapFile)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs
index dbeab838b25..d81fc25f72b 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs
@@ -49,7 +49,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
             PopulateGenerics(trapFile);
             Overrides(trapFile);
-            ExtractRefReturn(trapFile);
+            ExtractRefReturn(trapFile, symbol, this);
             ExtractCompilerGenerated(trapFile);
         }
 
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs
new file mode 100644
index 00000000000..e4becfb9d32
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs
@@ -0,0 +1,44 @@
+using System.IO;
+using System.Linq;
+using Microsoft.CodeAnalysis;
+
+namespace Semmle.Extraction.CSharp.Entities
+{
+    internal class FunctionPointerType : Type<IFunctionPointerTypeSymbol>
+    {
+        private FunctionPointerType(Context cx, IFunctionPointerTypeSymbol init)
+            : base(cx, init)
+        {
+        }
+
+        public override void WriteId(TextWriter trapFile)
+        {
+            symbol.BuildTypeId(Context, trapFile, symbol);
+            trapFile.Write(";functionpointertype");
+        }
+
+        public override bool NeedsPopulation => true;
+
+        public override void Populate(TextWriter trapFile)
+        {
+            var unmanagedCallingConventionTypes = symbol.Signature.UnmanagedCallingConventionTypes.Select(nt => Create(Context, nt)).ToArray();
+
+            trapFile.function_pointer_calling_conventions(this, (int)symbol.Signature.CallingConvention);
+            for (var i = 0; i < unmanagedCallingConventionTypes.Length; i++)
+            {
+                trapFile.has_unmanaged_calling_conventions(this, i, unmanagedCallingConventionTypes[i].TypeRef);
+            }
+
+            PopulateType(trapFile);
+        }
+
+        public static FunctionPointerType Create(Context cx, IFunctionPointerTypeSymbol symbol) => FunctionPointerTypeFactory.Instance.CreateEntityFromSymbol(cx, symbol);
+
+        private class FunctionPointerTypeFactory : ICachedEntityFactory<IFunctionPointerTypeSymbol, FunctionPointerType>
+        {
+            public static FunctionPointerTypeFactory Instance { get; } = new FunctionPointerTypeFactory();
+
+            public FunctionPointerType Create(Context cx, IFunctionPointerTypeSymbol init) => new FunctionPointerType(cx, init);
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
index ef1e2909ebf..8c96a334565 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
@@ -1,6 +1,7 @@
 using Microsoft.CodeAnalysis;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
 using Semmle.Util;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
@@ -57,6 +58,7 @@ namespace Semmle.Extraction.CSharp.Entities
                         case TypeKind.Enum: return Kinds.TypeKind.ENUM;
                         case TypeKind.Delegate: return Kinds.TypeKind.DELEGATE;
                         case TypeKind.Pointer: return Kinds.TypeKind.POINTER;
+                        case TypeKind.FunctionPointer: return Kinds.TypeKind.FUNCTION_POINTER;
                         case TypeKind.Error: return Kinds.TypeKind.UNKNOWN;
                         default:
                             cx.ModelError(t, $"Unhandled type kind '{t.TypeKind}'");
@@ -131,23 +133,14 @@ namespace Semmle.Extraction.CSharp.Entities
                 // This is a delegate.
                 // The method "Invoke" has the return type.
                 var invokeMethod = ((INamedTypeSymbol)symbol).DelegateInvokeMethod;
+                ExtractParametersForDelegateLikeType(trapFile, invokeMethod,
+                    t => trapFile.delegate_return_type(this, t));
+            }
 
-                // Copy the parameters from the "Invoke" method to the delegate type
-                for (var i = 0; i < invokeMethod.Parameters.Length; ++i)
-                {
-                    var param = invokeMethod.Parameters[i];
-                    var originalParam = invokeMethod.OriginalDefinition.Parameters[i];
-                    var originalParamEntity = SymbolEqualityComparer.Default.Equals(param, originalParam) ? null :
-                        DelegateTypeParameter.Create(Context, originalParam, Create(Context, ((INamedTypeSymbol)symbol).OriginalDefinition));
-                    DelegateTypeParameter.Create(Context, param, this, originalParamEntity);
-                }
-
-                var returnKey = Create(Context, invokeMethod.ReturnType);
-                trapFile.delegate_return_type(this, returnKey.TypeRef);
-                if (invokeMethod.ReturnsByRef)
-                    trapFile.type_annotation(this, Kinds.TypeAnnotation.Ref);
-                if (invokeMethod.ReturnsByRefReadonly)
-                    trapFile.type_annotation(this, Kinds.TypeAnnotation.ReadonlyRef);
+            if (symbol is IFunctionPointerTypeSymbol functionPointer)
+            {
+                ExtractParametersForDelegateLikeType(trapFile, functionPointer.Signature,
+                    t => trapFile.function_pointer_return_type(this, t));
             }
 
             Modifier.ExtractModifiers(Context, trapFile, this, symbol);
@@ -170,6 +163,23 @@ namespace Semmle.Extraction.CSharp.Entities
             }
         }
 
+        private void ExtractParametersForDelegateLikeType(TextWriter trapFile, IMethodSymbol invokeMethod, Action<Type> storeReturnType)
+        {
+            for (var i = 0; i < invokeMethod.Parameters.Length; ++i)
+            {
+                var param = invokeMethod.Parameters[i];
+                var originalParam = invokeMethod.OriginalDefinition.Parameters[i];
+                var originalParamEntity = SymbolEqualityComparer.Default.Equals(param, originalParam)
+                    ? null
+                    : DelegateTypeParameter.Create(Context, originalParam, Create(Context, ((INamedTypeSymbol)symbol).OriginalDefinition));
+                DelegateTypeParameter.Create(Context, param, this, originalParamEntity);
+            }
+
+            var returnKey = Create(Context, invokeMethod.ReturnType);
+            storeReturnType(returnKey.TypeRef);
+            Method.ExtractRefReturn(trapFile, invokeMethod, this);
+        }
+
         /// <summary>
         /// Called to extract all members and nested types.
         /// This is called on each member of a namespace,
@@ -265,8 +275,7 @@ namespace Semmle.Extraction.CSharp.Entities
             symbol != null && symbol.TypeKind == TypeKind.Delegate;
 
         /// <summary>
-        /// A copy of a delegate "Invoke" method parameter used for the delgate
-        /// type.
+        /// A copy of a delegate "Invoke" method or function pointer parameter.
         /// </summary>
         private class DelegateTypeParameter : Parameter
         {
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
index 9d99122ce90..4dce36430d3 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs
@@ -120,6 +120,7 @@ namespace Semmle.Extraction.Kinds
         GT_PATTERN = 123,
         LE_PATTERN = 124,
         GE_PATTERN = 125,
-        NOT_PATTERN = 126
+        NOT_PATTERN = 126,
+        FUNCTION_POINTER_INVOCATION = 129,
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/TypeKind.cs b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/TypeKind.cs
index fb205a6646e..01fad60e003 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Kinds/TypeKind.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Kinds/TypeKind.cs
@@ -34,6 +34,7 @@ namespace Semmle.Extraction.Kinds  // lgtm[cs/similar-file]
         DYNAMIC = 29,
         ARGLIST = 30,
         UNKNOWN = 31,
-        TUPLE = 32
+        TUPLE = 32,
+        FUNCTION_POINTER = 33
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Populators/Symbols.cs b/csharp/extractor/Semmle.Extraction.CSharp/Populators/Symbols.cs
index ddf64257cbe..a4a06fd6ba2 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Populators/Symbols.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Populators/Symbols.cs
@@ -38,6 +38,8 @@ namespace Semmle.Extraction.CSharp.Populators
 
         public override IEntity VisitPointerType(IPointerTypeSymbol symbol) => PointerType.Create(cx, symbol);
 
+        public override IEntity VisitFunctionPointerType(IFunctionPointerTypeSymbol symbol) => FunctionPointerType.Create(cx, symbol);
+
         public override IEntity VisitDynamicType(IDynamicTypeSymbol symbol) => DynamicType.Create(cx, symbol);
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs b/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
index 574374a80f5..41278b59d4a 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
@@ -134,6 +134,13 @@ namespace Semmle.Extraction.CSharp
                             return tp.ContainingSymbol is ITypeSymbol cont
                                 ? IdDependsOnImpl(cont)
                                 : SymbolEqualityComparer.Default.Equals(tp.ContainingSymbol, symbol);
+                        case TypeKind.FunctionPointer:
+                            var funptr = (IFunctionPointerTypeSymbol)type;
+                            if (funptr.Signature.Parameters.Any(p => IdDependsOnImpl(p.Type)))
+                            {
+                                return true;
+                            }
+                            return IdDependsOnImpl(funptr.Signature.ReturnType);
                         default:
                             return false;
                     }
@@ -190,6 +197,10 @@ namespace Semmle.Extraction.CSharp
                     case TypeKind.Dynamic:
                         trapFile.Write("dynamic");
                         return;
+                    case TypeKind.FunctionPointer:
+                        var funptr = (IFunctionPointerTypeSymbol)type;
+                        funptr.BuildFunctionPointerTypeId(cx, trapFile, symbolBeingDefined);
+                        return;
                     default:
                         throw new InternalError(type, $"Unhandled type kind '{type.TypeKind}'");
                 }
@@ -265,6 +276,53 @@ namespace Semmle.Extraction.CSharp
             trapFile.Write("::");
         }
 
+        private static void BuildFunctionPointerTypeId(this IFunctionPointerTypeSymbol funptr, Context cx, TextWriter trapFile, ISymbol symbolBeingDefined)
+        {
+            trapFile.Write("delegate* ");
+            trapFile.Write(funptr.Signature.CallingConvention.ToString().ToLowerInvariant());
+            if (funptr.Signature.UnmanagedCallingConventionTypes.Any())
+            {
+                trapFile.Write('[');
+                trapFile.BuildList(",", funptr.Signature.UnmanagedCallingConventionTypes,
+                    (ta, tb0) => ta.BuildOrWriteId(cx, tb0, symbolBeingDefined)
+                    );
+                trapFile.Write("]");
+            }
+
+            trapFile.Write('<');
+            trapFile.BuildList(",", funptr.Signature.Parameters,
+                (p, trap) =>
+                {
+                    p.Type.BuildOrWriteId(cx, trap, symbolBeingDefined);
+                    switch (p.RefKind)
+                    {
+                        case RefKind.Out:
+                            trap.Write(" out");
+                            break;
+                        case RefKind.In:
+                            trap.Write(" in");
+                            break;
+                        case RefKind.Ref:
+                            trap.Write(" ref");
+                            break;
+                    }
+                });
+
+            if (funptr.Signature.Parameters.Any())
+            {
+                trapFile.Write(",");
+            }
+
+            funptr.Signature.ReturnType.BuildOrWriteId(cx, trapFile, symbolBeingDefined);
+
+            if (funptr.Signature.ReturnsByRef)
+                trapFile.Write(" ref");
+            if (funptr.Signature.ReturnsByRefReadonly)
+                trapFile.Write(" readonly ref");
+
+            trapFile.Write('>');
+        }
+
         private static void BuildNamedTypeId(this INamedTypeSymbol named, Context cx, TextWriter trapFile, ISymbol symbolBeingDefined, bool addBaseClass, bool constructUnderlyingTupleType)
         {
             if (!constructUnderlyingTupleType && named.IsTupleType)
@@ -394,6 +452,10 @@ namespace Semmle.Extraction.CSharp
                         ptr.PointedAtType.BuildDisplayName(cx, trapFile);
                         trapFile.Write('*');
                         return;
+                    case TypeKind.FunctionPointer:
+                        var funptr = (IFunctionPointerTypeSymbol)type;
+                        funptr.BuildFunctionPointerTypeDisplayName(cx, trapFile);
+                        return;
                     case TypeKind.TypeParameter:
                         trapFile.Write(type.Name);
                         return;
@@ -406,31 +468,90 @@ namespace Semmle.Extraction.CSharp
             }
         }
 
-        public static void BuildNamedTypeDisplayName(this INamedTypeSymbol namedType, Context cx, TextWriter trapFile, bool constructUnderlyingTupleType)
+        private static void BuildFunctionPointerTypeDisplayName(this IFunctionPointerTypeSymbol funptr, Context cx, TextWriter trapFile)
+        {
+            trapFile.Write("delegate* ");
+            trapFile.Write(funptr.Signature.CallingConvention.ToString().ToLowerInvariant());
+
+            if (funptr.Signature.UnmanagedCallingConventionTypes.Any())
+            {
+                trapFile.Write('[');
+                trapFile.BuildList(
+                    ",",
+                    funptr.Signature.UnmanagedCallingConventionTypes,
+                    (t, tb0) => t.BuildDisplayName(cx, tb0));
+                trapFile.Write("]");
+            }
+
+            trapFile.Write('<');
+            trapFile.BuildList(",", funptr.Signature.Parameters,
+                (p, trap) =>
+                {
+                    p.Type.BuildDisplayName(cx, trapFile);
+                    switch (p.RefKind)
+                    {
+                        case RefKind.Out:
+                            trap.Write(" out");
+                            break;
+                        case RefKind.In:
+                            trap.Write(" in");
+                            break;
+                        case RefKind.Ref:
+                            trap.Write(" ref");
+                            break;
+                    }
+                });
+
+            if (funptr.Signature.Parameters.Any())
+            {
+                trapFile.Write(",");
+            }
+
+            funptr.Signature.ReturnType.BuildDisplayName(cx, trapFile);
+
+            if (funptr.Signature.ReturnsByRef)
+                trapFile.Write(" ref");
+            if (funptr.Signature.ReturnsByRefReadonly)
+                trapFile.Write(" readonly ref");
+
+            trapFile.Write('>');
+        }
+
+        private static void BuildNamedTypeDisplayName(this INamedTypeSymbol namedType, Context cx, TextWriter trapFile, bool constructUnderlyingTupleType)
         {
             if (!constructUnderlyingTupleType && namedType.IsTupleType)
             {
                 trapFile.Write('(');
-                trapFile.BuildList(",", namedType.TupleElements.Select(f => f.Type),
-                    (t, tb0) => t.BuildDisplayName(cx, tb0)
-                    );
-
+                trapFile.BuildList(
+                    ",",
+                    namedType.TupleElements.Select(f => f.Type),
+                    (t, tb0) => t.BuildDisplayName(cx, tb0));
                 trapFile.Write(")");
                 return;
             }
 
             if (namedType.IsAnonymousType)
+            {
                 namedType.BuildAnonymousName(cx, trapFile);
+            }
             else
+            {
                 trapFile.Write(namedType.Name);
+            }
+
             if (namedType.IsGenericType && namedType.TypeKind != TypeKind.Error && namedType.TypeArguments.Any())
             {
                 trapFile.Write('<');
-                trapFile.BuildList(",", namedType.TypeArguments, (p, tb0) =>
-                {
-                    if (IsReallyBound(namedType))
-                        p.BuildDisplayName(cx, tb0);
-                });
+                trapFile.BuildList(
+                    ",",
+                    namedType.TypeArguments,
+                    (p, tb0) =>
+                    {
+                        if (IsReallyBound(namedType))
+                        {
+                            p.BuildDisplayName(cx, tb0);
+                        }
+                    });
                 trapFile.Write('>');
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
index 53fe9a00ca4..630c2848e3d 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs
@@ -151,6 +151,11 @@ namespace Semmle.Extraction.CSharp
             trapFile.WriteTuple("delegate_return_type", delegateKey, returnType);
         }
 
+        internal static void function_pointer_return_type(this TextWriter trapFile, Type functionPointer, Type returnType)
+        {
+            trapFile.WriteTuple("function_pointer_return_type", functionPointer, returnType);
+        }
+
         internal static void destructor_location(this TextWriter trapFile, Destructor destructor, Location location)
         {
             trapFile.WriteTuple("destructor_location", destructor, location);
@@ -476,6 +481,16 @@ namespace Semmle.Extraction.CSharp
             trapFile.WriteTuple("specific_type_parameter_nullability", constraints, baseType, nullability);
         }
 
+        internal static void function_pointer_calling_conventions(this TextWriter trapFile, FunctionPointerType type, int kind)
+        {
+            trapFile.WriteTuple("function_pointer_calling_conventions", type, kind);
+        }
+
+        internal static void has_unmanaged_calling_conventions(this TextWriter trapFile, FunctionPointerType type, int index, Type convention)
+        {
+            trapFile.WriteTuple("has_unmanaged_calling_conventions", type, index, convention);
+        }
+
         internal static void stackalloc_array_creation(this TextWriter trapFile, Expression array)
         {
             trapFile.WriteTuple("stackalloc_array_creation", array);
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index 98e37f65f0a..87af962edcd 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -369,6 +369,7 @@ case @type.kind of
 | 30 = @arglist_type
 | 31 = @unknown_type
 | 32 = @tuple_type
+| 33 = @function_pointer_type
   ;
 
 @simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
@@ -414,6 +415,10 @@ delegate_return_type(
   unique int delegate_id: @delegate_type ref,
   int return_type_id: @type_or_ref ref);
 
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
 extend(
   unique int sub: @type ref,
   int super: @type_or_ref ref);
@@ -545,6 +550,18 @@ specific_type_parameter_nullability(
   int base_id: @type_or_ref ref,
   int nullability: @nullability ref);
 
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
 /** MODIFIERS */
 
 @modifiable = @modifiable_direct | @event_accessor;
@@ -758,7 +775,7 @@ localvar_location(
   unique int id: @local_variable ref,
   int loc: @location ref);
 
-@parameterizable = @callable | @delegate_type | @indexer;
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
 
 #keyset[name, parent_id]
 #keyset[index, parent_id]
@@ -1015,6 +1032,7 @@ case @expr.kind of
 | 124 = @le_pattern_expr
 | 125 = @ge_pattern_expr
 | 126 = @not_pattern_expr
+| 129 = @function_pointer_invocation_expr
 ;
 
 @switch = @switch_stmt | @switch_expr;
@@ -1085,7 +1103,7 @@ case @expr.kind of
 
 @call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
       | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
-      | @local_function_invocation_expr;
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
 
 @call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
 
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
new file mode 100644
index 00000000000..471f611159e
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
@@ -0,0 +1,39 @@
+using System;
+
+#nullable enable
+
+public class Class1
+{
+    public unsafe static class Program
+    {
+        static delegate*<int> pointer = &Main;
+
+        public static int Main()
+        {
+            return 0;
+        }
+
+        static void M1(delegate*<ref int, out object?, int> f)
+        {
+            int i = 42;
+            int j = f(ref i, out object? o);
+        }
+
+        static void M2<T>(delegate* unmanaged[Stdcall, SuppressGCTransition]<ref int, out object?, T, void> f) where T : new()
+        {
+            int i = 42;
+            f(ref i, out object? o, new T());
+        }
+
+        static void M3(delegate* managed<ref int, out object?, in int, ref int> f)
+        {
+            int i = 42;
+            ref int j = ref f(ref i, out object? o, in i);
+        }
+
+        static void M4<T>(delegate*<T, int> f) where T : new()
+        {
+            int j = f(new T());
+        }
+    }
+}
\ No newline at end of file
diff --git a/csharp/upgrades/TO_CHANGE/upgrade.properties b/csharp/upgrades/TO_CHANGE/upgrade.properties
new file mode 100644
index 00000000000..f27d93bcd0e
--- /dev/null
+++ b/csharp/upgrades/TO_CHANGE/upgrade.properties
@@ -0,0 +1,2 @@
+description: Added '@function_pointer_type', '@function_pointer_invocation_expr' and related relations.
+compatibility: full

From 183926d9fdfd381ff43c9e43ddf0f16f7d982a68 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 4 Nov 2020 13:41:16 +0100
Subject: [PATCH 217/343] C#: Add QL classes for function pointer
 type/invocation, tests

---
 .../2020-11-19-Function-pointer.md            |  3 +
 csharp/ql/src/semmle/code/csharp/Type.qll     | 25 +++++
 .../ql/src/semmle/code/csharp/exprs/Call.qll  | 21 +++++
 .../library-tests/csharp9/FunctionPointer.cs  |  8 +-
 .../csharp9/FunctionPointer.expected          | 22 +++++
 .../library-tests/csharp9/FunctionPointer.ql  | 16 ++++
 .../library-tests/csharp9/PrintAst.expected   | 92 +++++++++++++++++++
 .../csharp9/typeParameterNullability.expected |  2 +
 csharp/upgrades/TO_CHANGE/upgrade.properties  |  2 +-
 9 files changed, 186 insertions(+), 5 deletions(-)
 create mode 100644 csharp/change-notes/2020-11-19-Function-pointer.md
 create mode 100644 csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
 create mode 100644 csharp/ql/test/library-tests/csharp9/FunctionPointer.ql

diff --git a/csharp/change-notes/2020-11-19-Function-pointer.md b/csharp/change-notes/2020-11-19-Function-pointer.md
new file mode 100644
index 00000000000..b48855d2f89
--- /dev/null
+++ b/csharp/change-notes/2020-11-19-Function-pointer.md
@@ -0,0 +1,3 @@
+lgtm,codescanning
+* Function pointer types (`FunctionPointerType`) and call to function pointers
+(`FunctionPointerCall`) are extracted.
diff --git a/csharp/ql/src/semmle/code/csharp/Type.qll b/csharp/ql/src/semmle/code/csharp/Type.qll
index 17b4c168f6c..a6adb2bbaa7 100644
--- a/csharp/ql/src/semmle/code/csharp/Type.qll
+++ b/csharp/ql/src/semmle/code/csharp/Type.qll
@@ -797,6 +797,31 @@ class DelegateType extends RefType, Parameterizable, @delegate_type {
   override string getAPrimaryQlClass() { result = "DelegateType" }
 }
 
+/**
+ * A function pointer type, for example
+ *
+ * ```csharp
+ * delegate*<int, void>
+ * ```
+ */
+class FunctionPointerType extends Type, Parameterizable, @function_pointer_type {
+  /** Gets the return type of this function pointer. */
+  Type getReturnType() { function_pointer_return_type(this, getTypeRef(result)) }
+
+  /** Gets the calling convention. */
+  int getCallingConvention() { function_pointer_calling_conventions(this, result) }
+
+  /** Gets the unmanaged calling convention at index `i`. */
+  Type getUnmanagedCallingConvention(int i) {
+    has_unmanaged_calling_conventions(this, i, getTypeRef(result))
+  }
+
+  /** Gets an unmanaged calling convention. */
+  Type getAnUnmanagedCallingConvention() { result = getUnmanagedCallingConvention(_) }
+
+  override string getAPrimaryQlClass() { result = "FunctionPointerType" }
+}
+
 /**
  * The `null` type. The type of the `null` literal.
  */
diff --git a/csharp/ql/src/semmle/code/csharp/exprs/Call.qll b/csharp/ql/src/semmle/code/csharp/exprs/Call.qll
index 150533526ed..a5348040d54 100644
--- a/csharp/ql/src/semmle/code/csharp/exprs/Call.qll
+++ b/csharp/ql/src/semmle/code/csharp/exprs/Call.qll
@@ -604,6 +604,27 @@ class DelegateCall extends Call, @delegate_invocation_expr {
   override string getAPrimaryQlClass() { result = "DelegateCall" }
 }
 
+/**
+ * A function pointer call, for example `fp(1)` on line 3 in
+ *
+ * ```csharp
+ * class A {
+ *   void Call(delegate*<int, void> fp) {
+ *     fp(1);
+ *   }
+ * }
+ * ```
+ */
+class FunctionPointerCall extends Call, @function_pointer_invocation_expr {
+  override Callable getTarget() { none() }
+
+  override Expr getRuntimeArgument(int i) { result = getArgument(i) }
+
+  override string toString() { result = "function pointer call" }
+
+  override string getAPrimaryQlClass() { result = "FunctionPointerCall" }
+}
+
 /**
  * A call to an accessor. Either a property accessor call (`PropertyCall`),
  * an indexer accessor call (`IndexerCall`), or an event accessor call
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
index 471f611159e..0bbf0787d48 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
@@ -2,13 +2,13 @@ using System;
 
 #nullable enable
 
-public class Class1
+public class FnPointer
 {
     public unsafe static class Program
     {
-        static delegate*<int> pointer = &Main;
+        static delegate*<int> pointer = &M0;
 
-        public static int Main()
+        public static int M0()
         {
             return 0;
         }
@@ -19,7 +19,7 @@ public class Class1
             int j = f(ref i, out object? o);
         }
 
-        static void M2<T>(delegate* unmanaged[Stdcall, SuppressGCTransition]<ref int, out object?, T, void> f) where T : new()
+        static void M2<T>(delegate* unmanaged[Stdcall/*, StdcallSuppressGCTransition*/]<ref int, out object?, T, void> f) where T : new()
         {
             int i = 42;
             f(ref i, out object? o, new T());
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected b/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
new file mode 100644
index 00000000000..59a4e39ef01
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
@@ -0,0 +1,22 @@
+type
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | Int32 | 0 |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32> | Int32 | 0 |
+| file://:0:0:0:0 | delegate* default<Int32> | Int32 | 0 |
+| file://:0:0:0:0 | delegate* default<T,Int32> | Int32 | 0 |
+| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | Void | 2 |
+unmanagedCallingConvention
+parameter
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 0 | file://:0:0:0:0 |  | Int32 |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 1 | file://:0:0:0:0 | `1 | Object |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 2 | file://:0:0:0:0 | `2 | Int32 |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32> | 0 | file://:0:0:0:0 |  | Int32 |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32> | 1 | file://:0:0:0:0 | `1 | Object |
+| file://:0:0:0:0 | delegate* default<T,Int32> | 0 | file://:0:0:0:0 |  | T |
+| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 0 | file://:0:0:0:0 |  | Int32 |
+| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 1 | file://:0:0:0:0 | `1 | Object |
+| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 2 | file://:0:0:0:0 | `2 | T |
+invocation
+| FunctionPointer.cs:19:21:19:43 | function pointer call |
+| FunctionPointer.cs:25:13:25:44 | function pointer call |
+| FunctionPointer.cs:31:29:31:57 | function pointer call |
+| FunctionPointer.cs:36:21:36:30 | function pointer call |
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql b/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
new file mode 100644
index 00000000000..d200484374b
--- /dev/null
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
@@ -0,0 +1,16 @@
+import csharp
+
+query predicate type(FunctionPointerType fpt, string returnType, int callingConvention) {
+  fpt.getReturnType().toString() = returnType and
+  fpt.getCallingConvention() = callingConvention
+}
+
+query predicate unmanagedCallingConvention(FunctionPointerType fpt, int i, string callingConvention) {
+  fpt.getUnmanagedCallingConvention(i).toString() = callingConvention
+}
+
+query predicate parameter(FunctionPointerType fpt, int i, Parameter p, string t) {
+  fpt.getParameter(i) = p and p.getType().toString() = t
+}
+
+query predicate invocation(FunctionPointerCall fpc) { any() }
diff --git a/csharp/ql/test/library-tests/csharp9/PrintAst.expected b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
index c3aabb85092..3a36c295c0a 100644
--- a/csharp/ql/test/library-tests/csharp9/PrintAst.expected
+++ b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
@@ -1,3 +1,5 @@
+FunctionPointer.cs:
+#    9| [MethodAccess] access to method M0
 AnonymousObjectCreation.cs:
 #    5| [Class] AnonObj
 #    7|   5: [Field] l
@@ -103,6 +105,94 @@ Discard.cs:
 #   10|             4: [BlockStmt] {...}
 #   10|               0: [ReturnStmt] return ...;
 #   10|                 0: [IntLiteral] 0
+FunctionPointer.cs:
+#    5| [Class] FnPointer
+#    7|   5: [Class] Program
+#    9|     5: [Field] pointer
+#    9|       -1: [TypeMention] delegate* default<Int32>
+#    9|       1: [AssignExpr] ... = ...
+#    9|         0: [FieldAccess] access to field pointer
+#   11|     6: [Method] M0
+#   11|       -1: [TypeMention] int
+#   12|       4: [BlockStmt] {...}
+#   13|         0: [ReturnStmt] return ...;
+#   13|           0: [IntLiteral] 0
+#   16|     7: [Method] M1
+#   16|       -1: [TypeMention] Void
+#-----|       2: (Parameters)
+#   16|         0: [Parameter] f
+#   16|           -1: [TypeMention] delegate* default<Int32 ref,Object out,Int32>
+#   17|       4: [BlockStmt] {...}
+#   18|         0: [LocalVariableDeclStmt] ... ...;
+#   18|           0: [LocalVariableDeclAndInitExpr] Int32 i = ...
+#   18|             -1: [TypeMention] int
+#   18|             0: [LocalVariableAccess] access to local variable i
+#   18|             1: [IntLiteral] 42
+#   19|         1: [LocalVariableDeclStmt] ... ...;
+#   19|           0: [LocalVariableDeclAndInitExpr] Int32 j = ...
+#   19|             -1: [TypeMention] int
+#   19|             0: [LocalVariableAccess] access to local variable j
+#   19|             1: [FunctionPointerCall] function pointer call
+#   19|               -1: [ParameterAccess] access to parameter f
+#   19|               0: [LocalVariableAccess] access to local variable i
+#   19|               1: [LocalVariableAccess,LocalVariableDeclExpr] Object o
+#   22|     8: [Method] M2
+#   22|       -1: [TypeMention] Void
+#-----|       1: (Type parameters)
+#   22|         0: [TypeParameter] T
+#-----|       2: (Parameters)
+#   22|         0: [Parameter] f
+#   22|           -1: [TypeMention] delegate* stdcall<Int32 ref,Object out,T,Void>
+#   23|       4: [BlockStmt] {...}
+#   24|         0: [LocalVariableDeclStmt] ... ...;
+#   24|           0: [LocalVariableDeclAndInitExpr] Int32 i = ...
+#   24|             -1: [TypeMention] int
+#   24|             0: [LocalVariableAccess] access to local variable i
+#   24|             1: [IntLiteral] 42
+#   25|         1: [ExprStmt] ...;
+#   25|           0: [FunctionPointerCall] function pointer call
+#   25|             -1: [ParameterAccess] access to parameter f
+#   25|             0: [LocalVariableAccess] access to local variable i
+#   25|             1: [LocalVariableAccess,LocalVariableDeclExpr] Object o
+#   25|             2: [ObjectCreation] object creation of type T
+#   25|               0: [TypeMention] T
+#   28|     9: [Method] M3
+#   28|       -1: [TypeMention] Void
+#-----|       2: (Parameters)
+#   28|         0: [Parameter] f
+#   28|           -1: [TypeMention] delegate* default<Int32 ref,Object out,Int32 in,Int32 ref>
+#   29|       4: [BlockStmt] {...}
+#   30|         0: [LocalVariableDeclStmt] ... ...;
+#   30|           0: [LocalVariableDeclAndInitExpr] Int32 i = ...
+#   30|             -1: [TypeMention] int
+#   30|             0: [LocalVariableAccess] access to local variable i
+#   30|             1: [IntLiteral] 42
+#   31|         1: [LocalVariableDeclStmt] ... ...;
+#   31|           0: [LocalVariableDeclAndInitExpr] Int32 j = ...
+#   31|             -1: [TypeMention] null
+#   31|             0: [LocalVariableAccess] access to local variable j
+#   31|             1: [RefExpr] ref ...
+#   31|               0: [FunctionPointerCall] function pointer call
+#   31|                 -1: [ParameterAccess] access to parameter f
+#   31|                 0: [LocalVariableAccess] access to local variable i
+#   31|                 1: [LocalVariableAccess,LocalVariableDeclExpr] Object o
+#   31|                 2: [LocalVariableAccess] access to local variable i
+#   34|     10: [Method] M4
+#   34|       -1: [TypeMention] Void
+#-----|       1: (Type parameters)
+#   34|         0: [TypeParameter] T
+#-----|       2: (Parameters)
+#   34|         0: [Parameter] f
+#   34|           -1: [TypeMention] delegate* default<T,Int32>
+#   35|       4: [BlockStmt] {...}
+#   36|         0: [LocalVariableDeclStmt] ... ...;
+#   36|           0: [LocalVariableDeclAndInitExpr] Int32 j = ...
+#   36|             -1: [TypeMention] int
+#   36|             0: [LocalVariableAccess] access to local variable j
+#   36|             1: [FunctionPointerCall] function pointer call
+#   36|               -1: [ParameterAccess] access to parameter f
+#   36|               0: [ObjectCreation] object creation of type T
+#   36|                 0: [TypeMention] T
 InitOnlyProperty.cs:
 #    3| [NamespaceDeclaration] namespace ... { ... }
 #    5|   1: [Class] IsExternalInit
@@ -136,6 +226,8 @@ InitOnlyProperty.cs:
 #   18| [Class] Derived
 #-----|   3: (Base types)
 #   18|     0: [TypeMention] Base
+#   18|     0: [TypeMention] Base
+#   18|     0: [TypeMention] Base
 #   20|   5: [Property] Prop1
 #   20|     -1: [TypeMention] int
 #   20|     3: [Getter] get_Prop1
diff --git a/csharp/ql/test/library-tests/csharp9/typeParameterNullability.expected b/csharp/ql/test/library-tests/csharp9/typeParameterNullability.expected
index cfec2a5ca11..cd42090259a 100644
--- a/csharp/ql/test/library-tests/csharp9/typeParameterNullability.expected
+++ b/csharp/ql/test/library-tests/csharp9/typeParameterNullability.expected
@@ -10,6 +10,8 @@ valueType
 | TypeParameterNullability.cs:19:29:19:29 | T |
 | TypeParameterNullability.cs:24:29:24:29 | T |
 valueOrRefType
+| FunctionPointer.cs:22:24:22:24 | T |
+| FunctionPointer.cs:34:24:34:24 | T |
 | TypeParameterNullability.cs:5:28:5:28 | T |
 | TypeParameterNullability.cs:9:28:9:28 | T |
 | TypeParameterNullability.cs:15:29:15:29 | T |
diff --git a/csharp/upgrades/TO_CHANGE/upgrade.properties b/csharp/upgrades/TO_CHANGE/upgrade.properties
index f27d93bcd0e..ff9999cd8df 100644
--- a/csharp/upgrades/TO_CHANGE/upgrade.properties
+++ b/csharp/upgrades/TO_CHANGE/upgrade.properties
@@ -1,2 +1,2 @@
 description: Added '@function_pointer_type', '@function_pointer_invocation_expr' and related relations.
-compatibility: full
+compatibility: backwards

From a11d8520546052725111939ae9b1a85712a34c74 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 14 Dec 2020 17:11:30 +0100
Subject: [PATCH 218/343] Fix address of unary operator extraction

---
 .../Semmle.Extraction.CSharp/Entities/Expression.cs          | 5 +++++
 csharp/ql/test/library-tests/csharp9/PrintAst.expected       | 4 ++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
index 7ac9d80cffb..9d701d242a3 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
@@ -316,6 +316,11 @@ namespace Semmle.Extraction.CSharp.Entities
         /// </summary>
         public static ExprKind AdjustKind(this Expression.CallType ct, ExprKind k)
         {
+            if (k == ExprKind.ADDRESS_OF)
+            {
+                return k;
+            }
+
             switch (ct)
             {
                 case Expression.CallType.Dynamic:
diff --git a/csharp/ql/test/library-tests/csharp9/PrintAst.expected b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
index 3a36c295c0a..83201311115 100644
--- a/csharp/ql/test/library-tests/csharp9/PrintAst.expected
+++ b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
@@ -1,5 +1,3 @@
-FunctionPointer.cs:
-#    9| [MethodAccess] access to method M0
 AnonymousObjectCreation.cs:
 #    5| [Class] AnonObj
 #    7|   5: [Field] l
@@ -112,6 +110,8 @@ FunctionPointer.cs:
 #    9|       -1: [TypeMention] delegate* default<Int32>
 #    9|       1: [AssignExpr] ... = ...
 #    9|         0: [FieldAccess] access to field pointer
+#    9|         1: [AddressOfExpr] &...
+#    9|           0: [MethodAccess] access to method M0
 #   11|     6: [Method] M0
 #   11|       -1: [TypeMention] int
 #   12|       4: [BlockStmt] {...}

From 15e88471be723d73939ee49f6bf594b90c8c2536 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 15 Dec 2020 11:04:49 +0100
Subject: [PATCH 219/343] Adjust 'Cast.getTargetType()' to return the
 expression type instead of the type access type

---
 csharp/ql/src/semmle/code/csharp/exprs/Expr.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
index e3dc50f52f2..09239817953 100644
--- a/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
+++ b/csharp/ql/src/semmle/code/csharp/exprs/Expr.qll
@@ -617,7 +617,7 @@ class Cast extends Expr {
   TypeAccess getTypeAccess() { result = this.getChild(1) }
 
   /** Gets the type that the underlying expression is being cast to. */
-  Type getTargetType() { result = this.getTypeAccess().getTarget() }
+  Type getTargetType() { result = this.getType() }
 
   /** Gets the type of the underlying expression. */
   Type getSourceType() { result = this.getExpr().getType() }

From fd27bde4b5f3076f42e9ddd844b6f9d3bf5f24ea Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 15 Dec 2020 11:05:11 +0100
Subject: [PATCH 220/343] Add function pointer conversion tests

---
 .../library-tests/csharp9/FunctionPointer.cs  | 13 ++++++++
 .../csharp9/FunctionPointer.expected          | 11 +++++++
 .../library-tests/csharp9/FunctionPointer.ql  |  4 +++
 .../library-tests/csharp9/PrintAst.expected   | 31 +++++++++++++++++++
 4 files changed, 59 insertions(+)

diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
index 0bbf0787d48..bd0ddc30906 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
@@ -35,5 +35,18 @@ public class FnPointer
         {
             int j = f(new T());
         }
+
+        static void M5(delegate*<B, A> f, delegate*<A, B> ff)
+        {
+            M5(ff, ff); // implicit conversion due to implicit reference conversion
+        }
+
+        static void M6(delegate*<int*, void*> f, delegate*<void*, int*> ff)
+        {
+            M6(ff, ff); // implicit conversion due to implicit pointer conversion
+        }
+
+        class A { }
+        class B : A { }
     }
 }
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected b/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
index 59a4e39ef01..c70fafe918a 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
@@ -1,17 +1,25 @@
 type
+| file://:0:0:0:0 | delegate* default<A,B> | B | 0 |
+| file://:0:0:0:0 | delegate* default<B,A> | A | 0 |
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | Int32 | 0 |
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32> | Int32 | 0 |
+| file://:0:0:0:0 | delegate* default<Int32*,Void*> | Void* | 0 |
 | file://:0:0:0:0 | delegate* default<Int32> | Int32 | 0 |
 | file://:0:0:0:0 | delegate* default<T,Int32> | Int32 | 0 |
+| file://:0:0:0:0 | delegate* default<Void*,Int32*> | Int32* | 0 |
 | file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | Void | 2 |
 unmanagedCallingConvention
 parameter
+| file://:0:0:0:0 | delegate* default<A,B> | 0 | file://:0:0:0:0 |  | A |
+| file://:0:0:0:0 | delegate* default<B,A> | 0 | file://:0:0:0:0 |  | B |
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 0 | file://:0:0:0:0 |  | Int32 |
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 1 | file://:0:0:0:0 | `1 | Object |
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 2 | file://:0:0:0:0 | `2 | Int32 |
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32> | 0 | file://:0:0:0:0 |  | Int32 |
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32> | 1 | file://:0:0:0:0 | `1 | Object |
+| file://:0:0:0:0 | delegate* default<Int32*,Void*> | 0 | file://:0:0:0:0 |  | Int32* |
 | file://:0:0:0:0 | delegate* default<T,Int32> | 0 | file://:0:0:0:0 |  | T |
+| file://:0:0:0:0 | delegate* default<Void*,Int32*> | 0 | file://:0:0:0:0 |  | Void* |
 | file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 0 | file://:0:0:0:0 |  | Int32 |
 | file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 1 | file://:0:0:0:0 | `1 | Object |
 | file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 2 | file://:0:0:0:0 | `2 | T |
@@ -20,3 +28,6 @@ invocation
 | FunctionPointer.cs:25:13:25:44 | function pointer call |
 | FunctionPointer.cs:31:29:31:57 | function pointer call |
 | FunctionPointer.cs:36:21:36:30 | function pointer call |
+casts
+| FunctionPointer.cs:41:16:41:17 | (...) ... | file://:0:0:0:0 | delegate* default<A,B> | file://:0:0:0:0 | delegate* default<B,A> |
+| FunctionPointer.cs:46:16:46:17 | (...) ... | file://:0:0:0:0 | delegate* default<Void*,Int32*> | file://:0:0:0:0 | delegate* default<Int32*,Void*> |
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql b/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
index d200484374b..976dce29ed1 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
@@ -14,3 +14,7 @@ query predicate parameter(FunctionPointerType fpt, int i, Parameter p, string t)
 }
 
 query predicate invocation(FunctionPointerCall fpc) { any() }
+
+query predicate casts(ImplicitCast cast, FunctionPointerType fromType, FunctionPointerType toType) {
+  cast.getSourceType() = fromType and cast.getTargetType() = toType
+}
diff --git a/csharp/ql/test/library-tests/csharp9/PrintAst.expected b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
index 83201311115..30318171c71 100644
--- a/csharp/ql/test/library-tests/csharp9/PrintAst.expected
+++ b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
@@ -193,6 +193,37 @@ FunctionPointer.cs:
 #   36|               -1: [ParameterAccess] access to parameter f
 #   36|               0: [ObjectCreation] object creation of type T
 #   36|                 0: [TypeMention] T
+#   39|     11: [Method] M5
+#   39|       -1: [TypeMention] Void
+#-----|       2: (Parameters)
+#   39|         0: [Parameter] f
+#   39|           -1: [TypeMention] delegate* default<B,A>
+#   39|         1: [Parameter] ff
+#   39|           -1: [TypeMention] delegate* default<A,B>
+#   40|       4: [BlockStmt] {...}
+#   41|         0: [ExprStmt] ...;
+#   41|           0: [MethodCall] call to method M5
+#   41|             0: [CastExpr] (...) ...
+#   41|               1: [ParameterAccess] access to parameter ff
+#   41|             1: [ParameterAccess] access to parameter ff
+#   44|     12: [Method] M6
+#   44|       -1: [TypeMention] Void
+#-----|       2: (Parameters)
+#   44|         0: [Parameter] f
+#   44|           -1: [TypeMention] delegate* default<Int32*,Void*>
+#   44|         1: [Parameter] ff
+#   44|           -1: [TypeMention] delegate* default<Void*,Int32*>
+#   45|       4: [BlockStmt] {...}
+#   46|         0: [ExprStmt] ...;
+#   46|           0: [MethodCall] call to method M6
+#   46|             0: [CastExpr] (...) ...
+#   46|               1: [ParameterAccess] access to parameter ff
+#   46|             1: [ParameterAccess] access to parameter ff
+#   49|     13: [Class] A
+#   50|     14: [Class] B
+#-----|       3: (Base types)
+#   50|         0: [TypeMention] A
+#   50|         0: [TypeMention] A
 InitOnlyProperty.cs:
 #    3| [NamespaceDeclaration] namespace ... { ... }
 #    5|   1: [Class] IsExternalInit

From a9986ca72d5ec1642495cb66ade770c420831b2c Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 12 Jan 2021 14:10:01 +0100
Subject: [PATCH 221/343] Fix expected printed AST

---
 csharp/ql/test/library-tests/csharp9/FunctionPointer.cs | 2 +-
 csharp/ql/test/library-tests/csharp9/PrintAst.expected  | 3 ---
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
index bd0ddc30906..f560f2767d7 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
@@ -1,6 +1,6 @@
 using System;
 
-#nullable enable
+
 
 public class FnPointer
 {
diff --git a/csharp/ql/test/library-tests/csharp9/PrintAst.expected b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
index 30318171c71..b94262ac27f 100644
--- a/csharp/ql/test/library-tests/csharp9/PrintAst.expected
+++ b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
@@ -223,7 +223,6 @@ FunctionPointer.cs:
 #   50|     14: [Class] B
 #-----|       3: (Base types)
 #   50|         0: [TypeMention] A
-#   50|         0: [TypeMention] A
 InitOnlyProperty.cs:
 #    3| [NamespaceDeclaration] namespace ... { ... }
 #    5|   1: [Class] IsExternalInit
@@ -257,8 +256,6 @@ InitOnlyProperty.cs:
 #   18| [Class] Derived
 #-----|   3: (Base types)
 #   18|     0: [TypeMention] Base
-#   18|     0: [TypeMention] Base
-#   18|     0: [TypeMention] Base
 #   20|   5: [Property] Prop1
 #   20|     -1: [TypeMention] int
 #   20|     3: [Getter] get_Prop1

From 348fe8f2fc1290644eab8bbbf68c31f5baabd03d Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 14 Jan 2021 15:50:33 +0100
Subject: [PATCH 222/343] Address PR review comments

---
 .../Entities/Types/FunctionPointerType.cs     |  6 +-
 .../SymbolExtensions.cs                       | 63 ++++---------------
 csharp/ql/src/semmle/code/csharp/Type.qll     | 63 ++++++++++++++++++-
 .../library-tests/csharp9/FunctionPointer.cs  |  2 +-
 .../csharp9/FunctionPointer.expected          | 22 +++----
 .../library-tests/csharp9/FunctionPointer.ql  |  4 +-
 6 files changed, 90 insertions(+), 70 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs
index e4becfb9d32..1bf68a4c3c2 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/FunctionPointerType.cs
@@ -21,12 +21,10 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            var unmanagedCallingConventionTypes = symbol.Signature.UnmanagedCallingConventionTypes.Select(nt => Create(Context, nt)).ToArray();
-
             trapFile.function_pointer_calling_conventions(this, (int)symbol.Signature.CallingConvention);
-            for (var i = 0; i < unmanagedCallingConventionTypes.Length; i++)
+            foreach (var (conv, i) in symbol.Signature.UnmanagedCallingConventionTypes.Select((nt, i) => (Create(Context, nt), i)))
             {
-                trapFile.has_unmanaged_calling_conventions(this, i, unmanagedCallingConventionTypes[i].TypeRef);
+                trapFile.has_unmanaged_calling_conventions(this, i, conv.TypeRef);
             }
 
             PopulateType(trapFile);
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs b/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
index 41278b59d4a..77e27a00be5 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/SymbolExtensions.cs
@@ -278,49 +278,7 @@ namespace Semmle.Extraction.CSharp
 
         private static void BuildFunctionPointerTypeId(this IFunctionPointerTypeSymbol funptr, Context cx, TextWriter trapFile, ISymbol symbolBeingDefined)
         {
-            trapFile.Write("delegate* ");
-            trapFile.Write(funptr.Signature.CallingConvention.ToString().ToLowerInvariant());
-            if (funptr.Signature.UnmanagedCallingConventionTypes.Any())
-            {
-                trapFile.Write('[');
-                trapFile.BuildList(",", funptr.Signature.UnmanagedCallingConventionTypes,
-                    (ta, tb0) => ta.BuildOrWriteId(cx, tb0, symbolBeingDefined)
-                    );
-                trapFile.Write("]");
-            }
-
-            trapFile.Write('<');
-            trapFile.BuildList(",", funptr.Signature.Parameters,
-                (p, trap) =>
-                {
-                    p.Type.BuildOrWriteId(cx, trap, symbolBeingDefined);
-                    switch (p.RefKind)
-                    {
-                        case RefKind.Out:
-                            trap.Write(" out");
-                            break;
-                        case RefKind.In:
-                            trap.Write(" in");
-                            break;
-                        case RefKind.Ref:
-                            trap.Write(" ref");
-                            break;
-                    }
-                });
-
-            if (funptr.Signature.Parameters.Any())
-            {
-                trapFile.Write(",");
-            }
-
-            funptr.Signature.ReturnType.BuildOrWriteId(cx, trapFile, symbolBeingDefined);
-
-            if (funptr.Signature.ReturnsByRef)
-                trapFile.Write(" ref");
-            if (funptr.Signature.ReturnsByRefReadonly)
-                trapFile.Write(" readonly ref");
-
-            trapFile.Write('>');
+            BuildFunctionPointerSignature(funptr, trapFile, (s, tw) => s.BuildOrWriteId(cx, tw, symbolBeingDefined));
         }
 
         private static void BuildNamedTypeId(this INamedTypeSymbol named, Context cx, TextWriter trapFile, ISymbol symbolBeingDefined, bool addBaseClass, bool constructUnderlyingTupleType)
@@ -468,7 +426,8 @@ namespace Semmle.Extraction.CSharp
             }
         }
 
-        private static void BuildFunctionPointerTypeDisplayName(this IFunctionPointerTypeSymbol funptr, Context cx, TextWriter trapFile)
+        public static void BuildFunctionPointerSignature(IFunctionPointerTypeSymbol funptr, TextWriter trapFile,
+            Action<ITypeSymbol, TextWriter> buildNested)
         {
             trapFile.Write("delegate* ");
             trapFile.Write(funptr.Signature.CallingConvention.ToString().ToLowerInvariant());
@@ -476,10 +435,7 @@ namespace Semmle.Extraction.CSharp
             if (funptr.Signature.UnmanagedCallingConventionTypes.Any())
             {
                 trapFile.Write('[');
-                trapFile.BuildList(
-                    ",",
-                    funptr.Signature.UnmanagedCallingConventionTypes,
-                    (t, tb0) => t.BuildDisplayName(cx, tb0));
+                trapFile.BuildList(",", funptr.Signature.UnmanagedCallingConventionTypes, buildNested);
                 trapFile.Write("]");
             }
 
@@ -487,7 +443,7 @@ namespace Semmle.Extraction.CSharp
             trapFile.BuildList(",", funptr.Signature.Parameters,
                 (p, trap) =>
                 {
-                    p.Type.BuildDisplayName(cx, trapFile);
+                    buildNested(p.Type, trap);
                     switch (p.RefKind)
                     {
                         case RefKind.Out:
@@ -507,16 +463,21 @@ namespace Semmle.Extraction.CSharp
                 trapFile.Write(",");
             }
 
-            funptr.Signature.ReturnType.BuildDisplayName(cx, trapFile);
+            buildNested(funptr.Signature.ReturnType, trapFile);
 
             if (funptr.Signature.ReturnsByRef)
                 trapFile.Write(" ref");
             if (funptr.Signature.ReturnsByRefReadonly)
-                trapFile.Write(" readonly ref");
+                trapFile.Write(" ref readonly");
 
             trapFile.Write('>');
         }
 
+        private static void BuildFunctionPointerTypeDisplayName(this IFunctionPointerTypeSymbol funptr, Context cx, TextWriter trapFile)
+        {
+            BuildFunctionPointerSignature(funptr, trapFile, (s, tw) => s.BuildDisplayName(cx, tw));
+        }
+
         private static void BuildNamedTypeDisplayName(this INamedTypeSymbol namedType, Context cx, TextWriter trapFile, bool constructUnderlyingTupleType)
         {
             if (!constructUnderlyingTupleType && namedType.IsTupleType)
diff --git a/csharp/ql/src/semmle/code/csharp/Type.qll b/csharp/ql/src/semmle/code/csharp/Type.qll
index a6adb2bbaa7..eb7f3ea119b 100644
--- a/csharp/ql/src/semmle/code/csharp/Type.qll
+++ b/csharp/ql/src/semmle/code/csharp/Type.qll
@@ -797,6 +797,63 @@ class DelegateType extends RefType, Parameterizable, @delegate_type {
   override string getAPrimaryQlClass() { result = "DelegateType" }
 }
 
+private newtype TCallingConvention =
+  MkCallingConvention(int i) { function_pointer_calling_conventions(_, i) }
+
+/**
+ * Represents a signature calling convention. Specifies how arguments in a given
+ * signature are passed from the caller to the callee.
+ */
+class CallingConvention extends TCallingConvention {
+  string toString() { result = "CallingConvention" }
+}
+
+/** Managed calling convention with fixed-length argument list. */
+class DefaultCallingConvention extends CallingConvention {
+  DefaultCallingConvention() { this = MkCallingConvention(0) }
+
+  override string toString() { result = "DefaultCallingConvention" }
+}
+
+/** Unmanaged C/C++-style calling convention where the call stack is cleaned by the caller. */
+class CDeclCallingConvention extends CallingConvention {
+  CDeclCallingConvention() { this = MkCallingConvention(1) }
+
+  override string toString() { result = "CDeclCallingConvention" }
+}
+
+/** Unmanaged calling convention where call stack is cleaned up by the callee. */
+class StdCallCallingConvention extends CallingConvention {
+  StdCallCallingConvention() { this = MkCallingConvention(2) }
+
+  override string toString() { result = "StdCallCallingConvention" }
+}
+
+/**
+ * Unmanaged C++-style calling convention for calling instance member functions
+ * with a fixed argument list.
+ */
+class ThisCallCallingConvention extends CallingConvention {
+  ThisCallCallingConvention() { this = MkCallingConvention(3) }
+
+  override string toString() { result = "ThisCallCallingConvention" }
+}
+
+/** Unmanaged calling convention where arguments are passed in registers when possible. */
+class FastCallCallingConvention extends CallingConvention {
+  FastCallCallingConvention() { this = MkCallingConvention(4) }
+
+  override string toString() { result = "FastCallCallingConvention" }
+}
+
+/** Managed calling convention for passing extra arguments. */
+class VarArgsCallingConvention extends CallingConvention {
+  VarArgsCallingConvention() { this = MkCallingConvention(5) }
+
+  override string toString() { result = "VarArgsCallingConvention" }
+}
+
+// Add sub classes
 /**
  * A function pointer type, for example
  *
@@ -809,7 +866,11 @@ class FunctionPointerType extends Type, Parameterizable, @function_pointer_type
   Type getReturnType() { function_pointer_return_type(this, getTypeRef(result)) }
 
   /** Gets the calling convention. */
-  int getCallingConvention() { function_pointer_calling_conventions(this, result) }
+  CallingConvention getCallingConvention() {
+    exists(int i |
+      function_pointer_calling_conventions(this, i) and result = MkCallingConvention(i)
+    )
+  }
 
   /** Gets the unmanaged calling convention at index `i`. */
   Type getUnmanagedCallingConvention(int i) {
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
index f560f2767d7..3c51dcc1744 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.cs
@@ -13,7 +13,7 @@ public class FnPointer
             return 0;
         }
 
-        static void M1(delegate*<ref int, out object?, int> f)
+        static void M1(delegate*<ref int, out object?, ref readonly int> f)
         {
             int i = 42;
             int j = f(ref i, out object? o);
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected b/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
index c70fafe918a..eb5f55e4af2 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
@@ -1,13 +1,13 @@
 type
-| file://:0:0:0:0 | delegate* default<A,B> | B | 0 |
-| file://:0:0:0:0 | delegate* default<B,A> | A | 0 |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | Int32 | 0 |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32> | Int32 | 0 |
-| file://:0:0:0:0 | delegate* default<Int32*,Void*> | Void* | 0 |
-| file://:0:0:0:0 | delegate* default<Int32> | Int32 | 0 |
-| file://:0:0:0:0 | delegate* default<T,Int32> | Int32 | 0 |
-| file://:0:0:0:0 | delegate* default<Void*,Int32*> | Int32* | 0 |
-| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | Void | 2 |
+| file://:0:0:0:0 | delegate* default<A,B> | B | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<B,A> | A | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | Int32 | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 ref readonly> | Int32 | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<Int32*,Void*> | Void* | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<Int32> | Int32 | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<T,Int32> | Int32 | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<Void*,Int32*> | Int32* | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | Void | StdCallCallingConvention |
 unmanagedCallingConvention
 parameter
 | file://:0:0:0:0 | delegate* default<A,B> | 0 | file://:0:0:0:0 |  | A |
@@ -15,8 +15,8 @@ parameter
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 0 | file://:0:0:0:0 |  | Int32 |
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 1 | file://:0:0:0:0 | `1 | Object |
 | file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 2 | file://:0:0:0:0 | `2 | Int32 |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32> | 0 | file://:0:0:0:0 |  | Int32 |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32> | 1 | file://:0:0:0:0 | `1 | Object |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 ref readonly> | 0 | file://:0:0:0:0 |  | Int32 |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 ref readonly> | 1 | file://:0:0:0:0 | `1 | Object |
 | file://:0:0:0:0 | delegate* default<Int32*,Void*> | 0 | file://:0:0:0:0 |  | Int32* |
 | file://:0:0:0:0 | delegate* default<T,Int32> | 0 | file://:0:0:0:0 |  | T |
 | file://:0:0:0:0 | delegate* default<Void*,Int32*> | 0 | file://:0:0:0:0 |  | Void* |
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql b/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
index 976dce29ed1..e5f120442ab 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
@@ -1,8 +1,8 @@
 import csharp
 
-query predicate type(FunctionPointerType fpt, string returnType, int callingConvention) {
+query predicate type(FunctionPointerType fpt, string returnType, string callingConvention) {
   fpt.getReturnType().toString() = returnType and
-  fpt.getCallingConvention() = callingConvention
+  fpt.getCallingConvention().toString() = callingConvention
 }
 
 query predicate unmanagedCallingConvention(FunctionPointerType fpt, int i, string callingConvention) {

From 1d9b3ec8b46f2a3f5dabb4b6f5a6ce176776fd07 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 14 Jan 2021 16:10:33 +0100
Subject: [PATCH 223/343] Allow annotating fnptr return types

---
 .../src/semmle/code/csharp/AnnotatedType.qll  |  2 ++
 csharp/ql/src/semmle/code/csharp/Type.qll     |  3 ++
 csharp/ql/src/semmlecode.csharp.dbscheme      |  2 +-
 .../csharp9/FunctionPointer.expected          | 28 +++++++++----------
 .../library-tests/csharp9/FunctionPointer.ql  |  4 +--
 5 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/AnnotatedType.qll b/csharp/ql/src/semmle/code/csharp/AnnotatedType.qll
index 0e5c512057a..6a6274821d7 100644
--- a/csharp/ql/src/semmle/code/csharp/AnnotatedType.qll
+++ b/csharp/ql/src/semmle/code/csharp/AnnotatedType.qll
@@ -231,6 +231,8 @@ private module Annotations {
       type = element.(Expr).getType()
       or
       type = element.(DelegateType).getReturnType()
+      or
+      type = element.(FunctionPointerType).getReturnType()
     )
   }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/Type.qll b/csharp/ql/src/semmle/code/csharp/Type.qll
index eb7f3ea119b..771ea7dca07 100644
--- a/csharp/ql/src/semmle/code/csharp/Type.qll
+++ b/csharp/ql/src/semmle/code/csharp/Type.qll
@@ -880,6 +880,9 @@ class FunctionPointerType extends Type, Parameterizable, @function_pointer_type
   /** Gets an unmanaged calling convention. */
   Type getAnUnmanagedCallingConvention() { result = getUnmanagedCallingConvention(_) }
 
+  /** Gets the annotated return type of this function pointer type. */
+  AnnotatedType getAnnotatedReturnType() { result.appliesTo(this) }
+
   override string getAPrimaryQlClass() { result = "FunctionPointerType" }
 }
 
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index 87af962edcd..dd813977f70 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -466,7 +466,7 @@ type_mention_location(
   unique int id: @type_mention ref,
   int loc: @location ref);
 
-@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic;
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
 
 /**
  * A direct annotation on an entity, for example `string? x;`.
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected b/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
index eb5f55e4af2..d39e7d7d2af 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.expected
@@ -1,27 +1,27 @@
 type
 | file://:0:0:0:0 | delegate* default<A,B> | B | DefaultCallingConvention |
 | file://:0:0:0:0 | delegate* default<B,A> | A | DefaultCallingConvention |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | Int32 | DefaultCallingConvention |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 ref readonly> | Int32 | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | ref int | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 ref readonly> | readonly int | DefaultCallingConvention |
 | file://:0:0:0:0 | delegate* default<Int32*,Void*> | Void* | DefaultCallingConvention |
-| file://:0:0:0:0 | delegate* default<Int32> | Int32 | DefaultCallingConvention |
-| file://:0:0:0:0 | delegate* default<T,Int32> | Int32 | DefaultCallingConvention |
-| file://:0:0:0:0 | delegate* default<Void*,Int32*> | Int32* | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<Int32> | int | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<T,Int32> | int | DefaultCallingConvention |
+| file://:0:0:0:0 | delegate* default<Void*,Int32*> | int* | DefaultCallingConvention |
 | file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | Void | StdCallCallingConvention |
 unmanagedCallingConvention
 parameter
 | file://:0:0:0:0 | delegate* default<A,B> | 0 | file://:0:0:0:0 |  | A |
 | file://:0:0:0:0 | delegate* default<B,A> | 0 | file://:0:0:0:0 |  | B |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 0 | file://:0:0:0:0 |  | Int32 |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 1 | file://:0:0:0:0 | `1 | Object |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 2 | file://:0:0:0:0 | `2 | Int32 |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 ref readonly> | 0 | file://:0:0:0:0 |  | Int32 |
-| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 ref readonly> | 1 | file://:0:0:0:0 | `1 | Object |
-| file://:0:0:0:0 | delegate* default<Int32*,Void*> | 0 | file://:0:0:0:0 |  | Int32* |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 0 | file://:0:0:0:0 |  | ref int! |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 1 | file://:0:0:0:0 | `1 | out object? |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 in,Int32 ref> | 2 | file://:0:0:0:0 | `2 | readonly int! |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 ref readonly> | 0 | file://:0:0:0:0 |  | ref int! |
+| file://:0:0:0:0 | delegate* default<Int32 ref,Object out,Int32 ref readonly> | 1 | file://:0:0:0:0 | `1 | out object? |
+| file://:0:0:0:0 | delegate* default<Int32*,Void*> | 0 | file://:0:0:0:0 |  | int*! |
 | file://:0:0:0:0 | delegate* default<T,Int32> | 0 | file://:0:0:0:0 |  | T |
-| file://:0:0:0:0 | delegate* default<Void*,Int32*> | 0 | file://:0:0:0:0 |  | Void* |
-| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 0 | file://:0:0:0:0 |  | Int32 |
-| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 1 | file://:0:0:0:0 | `1 | Object |
+| file://:0:0:0:0 | delegate* default<Void*,Int32*> | 0 | file://:0:0:0:0 |  | Void*! |
+| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 0 | file://:0:0:0:0 |  | ref int! |
+| file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 1 | file://:0:0:0:0 | `1 | out object? |
 | file://:0:0:0:0 | delegate* stdcall<Int32 ref,Object out,T,Void> | 2 | file://:0:0:0:0 | `2 | T |
 invocation
 | FunctionPointer.cs:19:21:19:43 | function pointer call |
diff --git a/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql b/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
index e5f120442ab..25f0254ef45 100644
--- a/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
+++ b/csharp/ql/test/library-tests/csharp9/FunctionPointer.ql
@@ -1,7 +1,7 @@
 import csharp
 
 query predicate type(FunctionPointerType fpt, string returnType, string callingConvention) {
-  fpt.getReturnType().toString() = returnType and
+  fpt.getAnnotatedReturnType().toString() = returnType and
   fpt.getCallingConvention().toString() = callingConvention
 }
 
@@ -10,7 +10,7 @@ query predicate unmanagedCallingConvention(FunctionPointerType fpt, int i, strin
 }
 
 query predicate parameter(FunctionPointerType fpt, int i, Parameter p, string t) {
-  fpt.getParameter(i) = p and p.getType().toString() = t
+  fpt.getParameter(i) = p and p.getAnnotatedType().toString() = t
 }
 
 query predicate invocation(FunctionPointerCall fpc) { any() }

From 613bf6dca663d6b58cdb40cbb4689f8a2de0e421 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 15 Jan 2021 08:23:18 +0100
Subject: [PATCH 224/343] Fix failing test

---
 csharp/ql/test/library-tests/csharp9/PrintAst.expected | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/csharp/ql/test/library-tests/csharp9/PrintAst.expected b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
index b94262ac27f..1bf5e98d962 100644
--- a/csharp/ql/test/library-tests/csharp9/PrintAst.expected
+++ b/csharp/ql/test/library-tests/csharp9/PrintAst.expected
@@ -121,7 +121,7 @@ FunctionPointer.cs:
 #   16|       -1: [TypeMention] Void
 #-----|       2: (Parameters)
 #   16|         0: [Parameter] f
-#   16|           -1: [TypeMention] delegate* default<Int32 ref,Object out,Int32>
+#   16|           -1: [TypeMention] delegate* default<Int32 ref,Object out,Int32 ref readonly>
 #   17|       4: [BlockStmt] {...}
 #   18|         0: [LocalVariableDeclStmt] ... ...;
 #   18|           0: [LocalVariableDeclAndInitExpr] Int32 i = ...

From f7a0c98cb311d6922d5c2271a550a2266bab7688 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Fri, 15 Jan 2021 08:33:48 +0100
Subject: [PATCH 225/343] Code quality improvement

---
 .../Entities/Expressions/Invocation.cs                    | 8 +-------
 csharp/ql/src/semmle/code/csharp/Type.qll                 | 2 +-
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
index bf5cf006282..638822f3d27 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
@@ -136,7 +136,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
 
         private static bool IsDelegateLikeCall(ExpressionNodeInfo info)
         {
-            return IsDelegateLikeCall(info, IsDelegateLikeCall);
+            return IsDelegateLikeCall(info, symbol => IsFunctionPointer(symbol) || IsDelegateInvoke(symbol));
         }
 
         private static bool IsDelegateInvokeCall(ExpressionNodeInfo info)
@@ -167,12 +167,6 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             return check(si.Symbol);
         }
 
-        private static bool IsDelegateLikeCall(ISymbol symbol)
-        {
-            return IsFunctionPointer(symbol) ||
-                IsDelegateInvoke(symbol);
-        }
-
         private static bool IsFunctionPointer(ISymbol symbol)
         {
             return symbol != null &&
diff --git a/csharp/ql/src/semmle/code/csharp/Type.qll b/csharp/ql/src/semmle/code/csharp/Type.qll
index 771ea7dca07..b15f7b57392 100644
--- a/csharp/ql/src/semmle/code/csharp/Type.qll
+++ b/csharp/ql/src/semmle/code/csharp/Type.qll
@@ -805,6 +805,7 @@ private newtype TCallingConvention =
  * signature are passed from the caller to the callee.
  */
 class CallingConvention extends TCallingConvention {
+  /** Gets a textual representation of this calling convention. */
   string toString() { result = "CallingConvention" }
 }
 
@@ -853,7 +854,6 @@ class VarArgsCallingConvention extends CallingConvention {
   override string toString() { result = "VarArgsCallingConvention" }
 }
 
-// Add sub classes
 /**
  * A function pointer type, for example
  *

From 35b955f694adf4de8a0f595e8963a09c5905e8f6 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 19 Jan 2021 10:18:20 +0100
Subject: [PATCH 226/343] Update change note date

---
 ...0-11-19-Function-pointer.md => 2021-01-19-Function-pointer.md} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename csharp/change-notes/{2020-11-19-Function-pointer.md => 2021-01-19-Function-pointer.md} (100%)

diff --git a/csharp/change-notes/2020-11-19-Function-pointer.md b/csharp/change-notes/2021-01-19-Function-pointer.md
similarity index 100%
rename from csharp/change-notes/2020-11-19-Function-pointer.md
rename to csharp/change-notes/2021-01-19-Function-pointer.md

From d34992d36c3532ea4c637a239fb265121982e247 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Tue, 19 Jan 2021 17:26:07 +0100
Subject: [PATCH 227/343] Add .stats file

---
 .../ql/src/semmlecode.csharp.dbscheme.stats   | 7808 +++++++++--------
 1 file changed, 4006 insertions(+), 3802 deletions(-)

diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme.stats b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
index 7717e6d8d2b..60d97b381d3 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme.stats
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
@@ -1,7 +1,7 @@
 <dbstats>
   <typesizes><e>
 <k>@compilation</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 <e>
 <k>@diagnostic</k>
@@ -25,7 +25,7 @@
 </e>
 <e>
 <k>@duplication</k>
-<v>22785</v>
+<v>22690</v>
 </e>
 <e>
 <k>@similarity</k>
@@ -33,31 +33,31 @@
 </e>
 <e>
 <k>@location_default</k>
-<v>14071972</v>
+<v>14071977</v>
 </e>
 <e>
 <k>@assembly</k>
-<v>4207</v>
+<v>4190</v>
 </e>
 <e>
 <k>@file</k>
-<v>42559</v>
+<v>42382</v>
 </e>
 <e>
 <k>@folder</k>
-<v>16977</v>
+<v>16906</v>
 </e>
 <e>
 <k>@namespace</k>
-<v>21990</v>
+<v>21898</v>
 </e>
 <e>
 <k>@namespace_declaration</k>
-<v>19803</v>
+<v>19720</v>
 </e>
 <e>
 <k>@using_namespace_directive</k>
-<v>144569</v>
+<v>143966</v>
 </e>
 <e>
 <k>@using_static_directive</k>
@@ -117,23 +117,23 @@
 </e>
 <e>
 <k>@enum_type</k>
-<v>11978</v>
+<v>11928</v>
 </e>
 <e>
 <k>@struct_type</k>
-<v>49774</v>
+<v>49566</v>
 </e>
 <e>
 <k>@class_type</k>
-<v>305768</v>
+<v>304493</v>
 </e>
 <e>
 <k>@interface_type</k>
-<v>178503</v>
+<v>177759</v>
 </e>
 <e>
 <k>@delegate_type</k>
-<v>107803</v>
+<v>107353</v>
 </e>
 <e>
 <k>@null_type</k>
@@ -141,11 +141,11 @@
 </e>
 <e>
 <k>@type_parameter</k>
-<v>203041</v>
+<v>202195</v>
 </e>
 <e>
 <k>@pointer_type</k>
-<v>219</v>
+<v>218</v>
 </e>
 <e>
 <k>@nullable_type</k>
@@ -153,7 +153,7 @@
 </e>
 <e>
 <k>@array_type</k>
-<v>9142</v>
+<v>9104</v>
 </e>
 <e>
 <k>@void_type</k>
@@ -165,7 +165,7 @@
 </e>
 <e>
 <k>@tuple_type</k>
-<v>1786</v>
+<v>1779</v>
 </e>
 <e>
 <k>@uint_ptr_type</k>
@@ -184,32 +184,36 @@
 <v>0</v>
 </e>
 <e>
+<k>@function_pointer_type</k>
+<v>11</v>
+</e>
+<e>
 <k>@typeref</k>
-<v>235307</v>
+<v>234326</v>
 </e>
 <e>
 <k>@attribute</k>
-<v>750912</v>
+<v>743932</v>
 </e>
 <e>
 <k>@type_mention</k>
-<v>1270028</v>
+<v>1246314</v>
 </e>
 <e>
 <k>@oblivious</k>
-<v>1317</v>
+<v>1312</v>
 </e>
 <e>
 <k>@not_annotated</k>
-<v>619</v>
+<v>617</v>
 </e>
 <e>
 <k>@annotated</k>
-<v>116</v>
+<v>113</v>
 </e>
 <e>
 <k>@type_parameter_constraints</k>
-<v>612122</v>
+<v>590676</v>
 </e>
 <e>
 <k>@modifier</k>
@@ -217,47 +221,47 @@
 </e>
 <e>
 <k>@property</k>
-<v>424457</v>
+<v>422687</v>
 </e>
 <e>
 <k>@indexer</k>
-<v>17079</v>
+<v>17008</v>
 </e>
 <e>
 <k>@getter</k>
-<v>441302</v>
+<v>439462</v>
 </e>
 <e>
 <k>@setter</k>
-<v>127806</v>
+<v>127273</v>
 </e>
 <e>
 <k>@event</k>
-<v>15263</v>
+<v>15200</v>
 </e>
 <e>
 <k>@add_event_accessor</k>
-<v>15263</v>
+<v>15200</v>
 </e>
 <e>
 <k>@remove_event_accessor</k>
-<v>15263</v>
+<v>15200</v>
 </e>
 <e>
 <k>@operator</k>
-<v>12437</v>
+<v>12385</v>
 </e>
 <e>
 <k>@method</k>
-<v>1119078</v>
+<v>1114413</v>
 </e>
 <e>
 <k>@constructor</k>
-<v>278247</v>
+<v>277088</v>
 </e>
 <e>
 <k>@destructor</k>
-<v>444</v>
+<v>442</v>
 </e>
 <e>
 <k>@local_function</k>
@@ -265,15 +269,15 @@
 </e>
 <e>
 <k>@addressable_field</k>
-<v>371280</v>
+<v>369732</v>
 </e>
 <e>
 <k>@constant</k>
-<v>185620</v>
+<v>184846</v>
 </e>
 <e>
 <k>@addressable_local_variable</k>
-<v>162450</v>
+<v>162455</v>
 </e>
 <e>
 <k>@local_constant</k>
@@ -281,23 +285,23 @@
 </e>
 <e>
 <k>@local_variable_ref</k>
-<v>259</v>
+<v>265</v>
 </e>
 <e>
 <k>@parameter</k>
-<v>2422733</v>
+<v>2412633</v>
 </e>
 <e>
 <k>@block_stmt</k>
-<v>308713</v>
+<v>307020</v>
 </e>
 <e>
 <k>@expr_stmt</k>
-<v>368014</v>
+<v>366480</v>
 </e>
 <e>
 <k>@return_stmt</k>
-<v>96238</v>
+<v>94536</v>
 </e>
 <e>
 <k>@using_block_stmt</k>
@@ -305,47 +309,47 @@
 </e>
 <e>
 <k>@var_decl_stmt</k>
-<v>147913</v>
+<v>147605</v>
 </e>
 <e>
 <k>@if_stmt</k>
-<v>119227</v>
+<v>117920</v>
 </e>
 <e>
 <k>@switch_stmt</k>
-<v>3050</v>
+<v>3071</v>
 </e>
 <e>
 <k>@while_stmt</k>
-<v>4546</v>
+<v>4455</v>
 </e>
 <e>
 <k>@do_stmt</k>
-<v>1001</v>
+<v>983</v>
 </e>
 <e>
 <k>@for_stmt</k>
-<v>6969</v>
+<v>6806</v>
 </e>
 <e>
 <k>@foreach_stmt</k>
-<v>5364</v>
+<v>5342</v>
 </e>
 <e>
 <k>@break_stmt</k>
-<v>10918</v>
+<v>11024</v>
 </e>
 <e>
 <k>@continue_stmt</k>
-<v>2188</v>
+<v>2222</v>
 </e>
 <e>
 <k>@goto_stmt</k>
-<v>2701</v>
+<v>2738</v>
 </e>
 <e>
 <k>@goto_case_stmt</k>
-<v>348</v>
+<v>329</v>
 </e>
 <e>
 <k>@goto_default_stmt</k>
@@ -353,27 +357,27 @@
 </e>
 <e>
 <k>@throw_stmt</k>
-<v>74371</v>
+<v>75270</v>
 </e>
 <e>
 <k>@yield_stmt</k>
-<v>686</v>
+<v>680</v>
 </e>
 <e>
 <k>@try_stmt</k>
-<v>4327</v>
+<v>4302</v>
 </e>
 <e>
 <k>@checked_stmt</k>
-<v>256</v>
+<v>253</v>
 </e>
 <e>
 <k>@unchecked_stmt</k>
-<v>105</v>
+<v>104</v>
 </e>
 <e>
 <k>@lock_stmt</k>
-<v>1661</v>
+<v>1526</v>
 </e>
 <e>
 <k>@const_decl_stmt</k>
@@ -381,111 +385,111 @@
 </e>
 <e>
 <k>@empty_stmt</k>
-<v>358</v>
+<v>352</v>
 </e>
 <e>
 <k>@unsafe_stmt</k>
-<v>179</v>
+<v>182</v>
 </e>
 <e>
 <k>@fixed_stmt</k>
-<v>1126</v>
+<v>1150</v>
 </e>
 <e>
 <k>@label_stmt</k>
-<v>1009</v>
+<v>1019</v>
 </e>
 <e>
 <k>@catch</k>
-<v>3441</v>
+<v>3425</v>
 </e>
 <e>
 <k>@case_stmt</k>
-<v>22456</v>
+<v>22759</v>
 </e>
 <e>
 <k>@local_function_stmt</k>
-<v>1793</v>
+<v>1792</v>
 </e>
 <e>
 <k>@using_decl_stmt</k>
-<v>554</v>
+<v>551</v>
 </e>
 <e>
 <k>@bool_literal_expr</k>
-<v>69559</v>
+<v>69419</v>
 </e>
 <e>
 <k>@int_literal_expr</k>
-<v>756818</v>
+<v>747703</v>
 </e>
 <e>
 <k>@long_literal_expr</k>
-<v>325</v>
+<v>332</v>
 </e>
 <e>
 <k>@double_literal_expr</k>
-<v>854</v>
+<v>866</v>
 </e>
 <e>
 <k>@string_literal_expr</k>
-<v>412639</v>
+<v>410826</v>
 </e>
 <e>
 <k>@null_literal_expr</k>
-<v>107934</v>
+<v>108012</v>
 </e>
 <e>
 <k>@local_variable_access_expr</k>
-<v>524154</v>
+<v>522612</v>
 </e>
 <e>
 <k>@parameter_access_expr</k>
-<v>357738</v>
+<v>354327</v>
 </e>
 <e>
 <k>@field_access_expr</k>
-<v>460637</v>
+<v>458716</v>
 </e>
 <e>
 <k>@property_access_expr</k>
-<v>359892</v>
+<v>358392</v>
 </e>
 <e>
 <k>@type_access_expr</k>
-<v>347147</v>
+<v>346534</v>
 </e>
 <e>
 <k>@typeof_expr</k>
-<v>30112</v>
+<v>29968</v>
 </e>
 <e>
 <k>@method_invocation_expr</k>
-<v>548157</v>
+<v>547087</v>
 </e>
 <e>
 <k>@cast_expr</k>
-<v>263006</v>
+<v>264717</v>
 </e>
 <e>
 <k>@object_creation_expr</k>
-<v>62905</v>
+<v>62624</v>
 </e>
 <e>
 <k>@array_creation_expr</k>
-<v>179763</v>
+<v>178981</v>
 </e>
 <e>
 <k>@array_init_expr</k>
-<v>179303</v>
+<v>178530</v>
 </e>
 <e>
 <k>@local_var_decl_expr</k>
-<v>163756</v>
+<v>163323</v>
 </e>
 <e>
 <k>@char_literal_expr</k>
-<v>15906</v>
+<v>16212</v>
 </e>
 <e>
 <k>@decimal_literal_expr</k>
@@ -493,59 +497,59 @@
 </e>
 <e>
 <k>@uint_literal_expr</k>
-<v>2368</v>
+<v>2411</v>
 </e>
 <e>
 <k>@ulong_literal_expr</k>
-<v>382</v>
+<v>390</v>
 </e>
 <e>
 <k>@float_literal_expr</k>
-<v>446</v>
+<v>455</v>
 </e>
 <e>
 <k>@this_access_expr</k>
-<v>593115</v>
+<v>590642</v>
 </e>
 <e>
 <k>@base_access_expr</k>
-<v>2823</v>
+<v>2845</v>
 </e>
 <e>
 <k>@method_access_expr</k>
-<v>9230</v>
+<v>9221</v>
 </e>
 <e>
 <k>@event_access_expr</k>
-<v>431</v>
+<v>434</v>
 </e>
 <e>
 <k>@indexer_access_expr</k>
-<v>30825</v>
+<v>30696</v>
 </e>
 <e>
 <k>@array_access_expr</k>
-<v>19760</v>
+<v>19392</v>
 </e>
 <e>
 <k>@delegate_invocation_expr</k>
-<v>2141</v>
+<v>2005</v>
 </e>
 <e>
 <k>@operator_invocation_expr</k>
-<v>29999</v>
+<v>29948</v>
 </e>
 <e>
 <k>@explicit_delegate_creation_expr</k>
-<v>668</v>
+<v>680</v>
 </e>
 <e>
 <k>@implicit_delegate_creation_expr</k>
-<v>5120</v>
+<v>5099</v>
 </e>
 <e>
 <k>@default_expr</k>
-<v>6362</v>
+<v>6155</v>
 </e>
 <e>
 <k>@plus_expr</k>
@@ -553,123 +557,123 @@
 </e>
 <e>
 <k>@minus_expr</k>
-<v>7147</v>
+<v>7081</v>
 </e>
 <e>
 <k>@bit_not_expr</k>
-<v>741</v>
+<v>739</v>
 </e>
 <e>
 <k>@log_not_expr</k>
-<v>26441</v>
+<v>26331</v>
 </e>
 <e>
 <k>@post_incr_expr</k>
-<v>12573</v>
+<v>12335</v>
 </e>
 <e>
 <k>@post_decr_expr</k>
-<v>1740</v>
+<v>1700</v>
 </e>
 <e>
 <k>@pre_incr_expr</k>
-<v>1275</v>
+<v>1263</v>
 </e>
 <e>
 <k>@pre_decr_expr</k>
-<v>412</v>
+<v>407</v>
 </e>
 <e>
 <k>@mul_expr</k>
-<v>4629</v>
+<v>4635</v>
 </e>
 <e>
 <k>@div_expr</k>
-<v>1819</v>
+<v>1795</v>
 </e>
 <e>
 <k>@rem_expr</k>
-<v>717</v>
+<v>705</v>
 </e>
 <e>
 <k>@add_expr</k>
-<v>27898</v>
+<v>27803</v>
 </e>
 <e>
 <k>@sub_expr</k>
-<v>12849</v>
+<v>12596</v>
 </e>
 <e>
 <k>@lshift_expr</k>
-<v>4051</v>
+<v>4129</v>
 </e>
 <e>
 <k>@rshift_expr</k>
-<v>1765</v>
+<v>1766</v>
 </e>
 <e>
 <k>@lt_expr</k>
-<v>16306</v>
+<v>15951</v>
 </e>
 <e>
 <k>@gt_expr</k>
-<v>9593</v>
+<v>9397</v>
 </e>
 <e>
 <k>@le_expr</k>
-<v>3899</v>
+<v>3836</v>
 </e>
 <e>
 <k>@ge_expr</k>
-<v>6286</v>
+<v>6025</v>
 </e>
 <e>
 <k>@eq_expr</k>
-<v>53949</v>
+<v>53613</v>
 </e>
 <e>
 <k>@ne_expr</k>
-<v>37977</v>
+<v>37287</v>
 </e>
 <e>
 <k>@bit_and_expr</k>
-<v>6334</v>
+<v>6310</v>
 </e>
 <e>
 <k>@bit_xor_expr</k>
-<v>537</v>
+<v>529</v>
 </e>
 <e>
 <k>@bit_or_expr</k>
-<v>14998</v>
+<v>15255</v>
 </e>
 <e>
 <k>@log_and_expr</k>
-<v>20845</v>
+<v>20419</v>
 </e>
 <e>
 <k>@log_or_expr</k>
-<v>14088</v>
+<v>14022</v>
 </e>
 <e>
 <k>@is_expr</k>
-<v>6722</v>
+<v>6498</v>
 </e>
 <e>
 <k>@as_expr</k>
-<v>2760</v>
+<v>2733</v>
 </e>
 <e>
 <k>@null_coalescing_expr</k>
-<v>3685</v>
+<v>3622</v>
 </e>
 <e>
 <k>@conditional_expr</k>
-<v>9160</v>
+<v>8989</v>
 </e>
 <e>
 <k>@simple_assign_expr</k>
-<v>167569</v>
+<v>166871</v>
 </e>
 <e>
 <k>@assign_add_expr</k>
@@ -677,7 +681,7 @@
 </e>
 <e>
 <k>@assign_sub_expr</k>
-<v>1018</v>
+<v>1023</v>
 </e>
 <e>
 <k>@assign_mul_expr</k>
@@ -685,7 +689,7 @@
 </e>
 <e>
 <k>@assign_div_expr</k>
-<v>97</v>
+<v>99</v>
 </e>
 <e>
 <k>@assign_rem_expr</k>
@@ -693,31 +697,31 @@
 </e>
 <e>
 <k>@assign_and_expr</k>
-<v>343</v>
+<v>341</v>
 </e>
 <e>
 <k>@assign_xor_expr</k>
-<v>116</v>
+<v>114</v>
 </e>
 <e>
 <k>@assign_or_expr</k>
-<v>1393</v>
+<v>1415</v>
 </e>
 <e>
 <k>@assign_lshift_expr</k>
-<v>116</v>
+<v>118</v>
 </e>
 <e>
 <k>@assign_rshift_expr</k>
-<v>218</v>
+<v>216</v>
 </e>
 <e>
 <k>@object_init_expr</k>
-<v>7702</v>
+<v>7670</v>
 </e>
 <e>
 <k>@collection_init_expr</k>
-<v>595</v>
+<v>593</v>
 </e>
 <e>
 <k>@checked_expr</k>
@@ -725,19 +729,19 @@
 </e>
 <e>
 <k>@unchecked_expr</k>
-<v>1422</v>
+<v>1424</v>
 </e>
 <e>
 <k>@constructor_init_expr</k>
-<v>5823</v>
+<v>5807</v>
 </e>
 <e>
 <k>@add_event_expr</k>
-<v>170</v>
+<v>173</v>
 </e>
 <e>
 <k>@remove_event_expr</k>
-<v>120</v>
+<v>121</v>
 </e>
 <e>
 <k>@par_expr</k>
@@ -745,7 +749,7 @@
 </e>
 <e>
 <k>@lambda_expr</k>
-<v>48876</v>
+<v>48672</v>
 </e>
 <e>
 <k>@anonymous_method_expr</k>
@@ -757,35 +761,35 @@
 </e>
 <e>
 <k>@dynamic_element_access_expr</k>
-<v>331</v>
+<v>330</v>
 </e>
 <e>
 <k>@dynamic_member_access_expr</k>
-<v>6858</v>
+<v>6829</v>
 </e>
 <e>
 <k>@pointer_indirection_expr</k>
-<v>4061</v>
+<v>4149</v>
 </e>
 <e>
 <k>@address_of_expr</k>
-<v>1251</v>
+<v>1292</v>
 </e>
 <e>
 <k>@sizeof_expr</k>
-<v>1041</v>
+<v>1063</v>
 </e>
 <e>
 <k>@await_expr</k>
-<v>54870</v>
+<v>54641</v>
 </e>
 <e>
 <k>@nameof_expr</k>
-<v>15943</v>
+<v>15612</v>
 </e>
 <e>
 <k>@interpolated_string_expr</k>
-<v>3047</v>
+<v>3044</v>
 </e>
 <e>
 <k>@unknown_expr</k>
@@ -793,59 +797,59 @@
 </e>
 <e>
 <k>@throw_expr</k>
-<v>1544</v>
+<v>1529</v>
 </e>
 <e>
 <k>@tuple_expr</k>
-<v>1478</v>
+<v>1450</v>
 </e>
 <e>
 <k>@local_function_invocation_expr</k>
-<v>7490</v>
+<v>7489</v>
 </e>
 <e>
 <k>@ref_expr</k>
-<v>563</v>
+<v>460</v>
 </e>
 <e>
 <k>@discard_expr</k>
-<v>909</v>
+<v>902</v>
 </e>
 <e>
 <k>@range_expr</k>
-<v>32</v>
+<v>33</v>
 </e>
 <e>
 <k>@index_expr</k>
-<v>46</v>
+<v>47</v>
 </e>
 <e>
 <k>@switch_expr</k>
-<v>518</v>
+<v>509</v>
 </e>
 <e>
 <k>@recursive_pattern_expr</k>
-<v>1014</v>
+<v>1004</v>
 </e>
 <e>
 <k>@property_pattern_expr</k>
-<v>831</v>
+<v>829</v>
 </e>
 <e>
 <k>@positional_pattern_expr</k>
-<v>180</v>
+<v>172</v>
 </e>
 <e>
 <k>@switch_case_expr</k>
-<v>4355</v>
+<v>4342</v>
 </e>
 <e>
 <k>@assign_coalesce_expr</k>
-<v>544</v>
+<v>545</v>
 </e>
 <e>
 <k>@suppress_nullable_warning_expr</k>
-<v>14413</v>
+<v>13875</v>
 </e>
 <e>
 <k>@namespace_access_expr</k>
@@ -869,7 +873,11 @@
 </e>
 <e>
 <k>@not_pattern_expr</k>
-<v>74</v>
+<v>70</v>
+</e>
+<e>
+<k>@function_pointer_invocation_expr</k>
+<v>4</v>
 </e>
 <e>
 <k>@xmldtd</k>
@@ -897,19 +905,19 @@
 </e>
 <e>
 <k>@singlelinecomment</k>
-<v>184816</v>
+<v>188909</v>
 </e>
 <e>
 <k>@multilinecomment</k>
-<v>22119</v>
+<v>22609</v>
 </e>
 <e>
 <k>@xmldoccomment</k>
-<v>203819</v>
+<v>208332</v>
 </e>
 <e>
 <k>@commentblock</k>
-<v>144374</v>
+<v>147571</v>
 </e>
 <e>
 <k>@asp_close_tag</k>
@@ -949,7 +957,7 @@
 </e>
 <e>
 <k>@cil_nop</k>
-<v>820695</v>
+<v>838867</v>
 </e>
 <e>
 <k>@cil_break</k>
@@ -957,147 +965,147 @@
 </e>
 <e>
 <k>@cil_ldarg_0</k>
-<v>3978359</v>
+<v>3961775</v>
 </e>
 <e>
 <k>@cil_ldarg_1</k>
-<v>1217617</v>
+<v>1212541</v>
 </e>
 <e>
 <k>@cil_ldarg_2</k>
-<v>444226</v>
+<v>442374</v>
 </e>
 <e>
 <k>@cil_ldarg_3</k>
-<v>209329</v>
+<v>208456</v>
 </e>
 <e>
 <k>@cil_ldloc_0</k>
-<v>929987</v>
+<v>926110</v>
 </e>
 <e>
 <k>@cil_ldloc_1</k>
-<v>494313</v>
+<v>492252</v>
 </e>
 <e>
 <k>@cil_ldloc_2</k>
-<v>288947</v>
+<v>287743</v>
 </e>
 <e>
 <k>@cil_ldloc_3</k>
-<v>192210</v>
+<v>191409</v>
 </e>
 <e>
 <k>@cil_stloc_0</k>
-<v>525377</v>
+<v>523187</v>
 </e>
 <e>
 <k>@cil_stloc_1</k>
-<v>260714</v>
+<v>259627</v>
 </e>
 <e>
 <k>@cil_stloc_2</k>
-<v>198468</v>
+<v>197640</v>
 </e>
 <e>
 <k>@cil_stloc_3</k>
-<v>138408</v>
+<v>137831</v>
 </e>
 <e>
 <k>@cil_ldarg_s</k>
-<v>264726</v>
+<v>263623</v>
 </e>
 <e>
 <k>@cil_ldarga_s</k>
-<v>74830</v>
+<v>74518</v>
 </e>
 <e>
 <k>@cil_starg_s</k>
-<v>37205</v>
+<v>37050</v>
 </e>
 <e>
 <k>@cil_ldloc_s</k>
-<v>686918</v>
+<v>684055</v>
 </e>
 <e>
 <k>@cil_ldloca_s</k>
-<v>629749</v>
+<v>627124</v>
 </e>
 <e>
 <k>@cil_stloc_s</k>
-<v>481231</v>
+<v>479225</v>
 </e>
 <e>
 <k>@cil_ldnull</k>
-<v>604205</v>
+<v>601686</v>
 </e>
 <e>
 <k>@cil_ldc_i4_m1</k>
-<v>126303</v>
+<v>125776</v>
 </e>
 <e>
 <k>@cil_ldc_i4_0</k>
-<v>626088</v>
+<v>623478</v>
 </e>
 <e>
 <k>@cil_ldc_i4_1</k>
-<v>495055</v>
+<v>492991</v>
 </e>
 <e>
 <k>@cil_ldc_i4_2</k>
-<v>121129</v>
+<v>120624</v>
 </e>
 <e>
 <k>@cil_ldc_i4_3</k>
-<v>64203</v>
+<v>63935</v>
 </e>
 <e>
 <k>@cil_ldc_i4_4</k>
-<v>58926</v>
+<v>58681</v>
 </e>
 <e>
 <k>@cil_ldc_i4_5</k>
-<v>38713</v>
+<v>38552</v>
 </e>
 <e>
 <k>@cil_ldc_i4_6</k>
-<v>23283</v>
+<v>23186</v>
 </e>
 <e>
 <k>@cil_ldc_i4_7</k>
-<v>20769</v>
+<v>20683</v>
 </e>
 <e>
 <k>@cil_ldc_i4_8</k>
-<v>33510</v>
+<v>33370</v>
 </e>
 <e>
 <k>@cil_ldc_i4_s</k>
-<v>423676</v>
+<v>421909</v>
 </e>
 <e>
 <k>@cil_ldc_i4</k>
-<v>511265</v>
+<v>509134</v>
 </e>
 <e>
 <k>@cil_ldc_i8</k>
-<v>4891</v>
+<v>4870</v>
 </e>
 <e>
 <k>@cil_ldc_r4</k>
-<v>10270</v>
+<v>10227</v>
 </e>
 <e>
 <k>@cil_ldc_r8</k>
-<v>10338</v>
+<v>10295</v>
 </e>
 <e>
 <k>@cil_dup</k>
-<v>842871</v>
+<v>839357</v>
 </e>
 <e>
 <k>@cil_pop</k>
-<v>256672</v>
+<v>255602</v>
 </e>
 <e>
 <k>@cil_jmp</k>
@@ -1105,7 +1113,7 @@
 </e>
 <e>
 <k>@cil_call</k>
-<v>2744029</v>
+<v>2732590</v>
 </e>
 <e>
 <k>@cil_calli</k>
@@ -1113,283 +1121,283 @@
 </e>
 <e>
 <k>@cil_ret</k>
-<v>1788117</v>
+<v>1780663</v>
 </e>
 <e>
 <k>@cil_br_s</k>
-<v>346141</v>
+<v>344698</v>
 </e>
 <e>
 <k>@cil_brfalse_s</k>
-<v>466401</v>
+<v>464457</v>
 </e>
 <e>
 <k>@cil_brtrue_s</k>
-<v>431110</v>
+<v>429313</v>
 </e>
 <e>
 <k>@cil_beq_s</k>
-<v>82337</v>
+<v>81994</v>
 </e>
 <e>
 <k>@cil_bge_s</k>
-<v>34959</v>
+<v>34814</v>
 </e>
 <e>
 <k>@cil_bgt_s</k>
-<v>16513</v>
+<v>16444</v>
 </e>
 <e>
 <k>@cil_ble_s</k>
-<v>29229</v>
+<v>29107</v>
 </e>
 <e>
 <k>@cil_blt_s</k>
-<v>60991</v>
+<v>60737</v>
 </e>
 <e>
 <k>@cil_bne_un_s</k>
-<v>102755</v>
+<v>102327</v>
 </e>
 <e>
 <k>@cil_bge_un_s</k>
-<v>2186</v>
+<v>2177</v>
 </e>
 <e>
 <k>@cil_bgt_un_s</k>
-<v>8742</v>
+<v>8705</v>
 </e>
 <e>
 <k>@cil_ble_un_s</k>
-<v>6126</v>
+<v>6100</v>
 </e>
 <e>
 <k>@cil_blt_un_s</k>
-<v>1469</v>
+<v>1463</v>
 </e>
 <e>
 <k>@cil_br</k>
-<v>96249</v>
+<v>95847</v>
 </e>
 <e>
 <k>@cil_brfalse</k>
-<v>32426</v>
+<v>32291</v>
 </e>
 <e>
 <k>@cil_brtrue</k>
-<v>27359</v>
+<v>27245</v>
 </e>
 <e>
 <k>@cil_beq</k>
-<v>21531</v>
+<v>21441</v>
 </e>
 <e>
 <k>@cil_bge</k>
-<v>1391</v>
+<v>1385</v>
 </e>
 <e>
 <k>@cil_bgt</k>
-<v>1464</v>
+<v>1458</v>
 </e>
 <e>
 <k>@cil_ble</k>
-<v>4646</v>
+<v>4627</v>
 </e>
 <e>
 <k>@cil_blt</k>
-<v>7941</v>
+<v>7908</v>
 </e>
 <e>
 <k>@cil_bne_un</k>
-<v>7243</v>
+<v>7213</v>
 </e>
 <e>
 <k>@cil_bge_un</k>
-<v>140</v>
+<v>143</v>
 </e>
 <e>
 <k>@cil_bgt_un</k>
-<v>693</v>
+<v>690</v>
 </e>
 <e>
 <k>@cil_ble_un</k>
-<v>1103</v>
+<v>1098</v>
 </e>
 <e>
 <k>@cil_blt_un</k>
-<v>180</v>
+<v>179</v>
 </e>
 <e>
 <k>@cil_switch</k>
-<v>23903</v>
+<v>23804</v>
 </e>
 <e>
 <k>@cil_ldind_i1</k>
-<v>86</v>
+<v>88</v>
 </e>
 <e>
 <k>@cil_ldind_u1</k>
-<v>5515</v>
+<v>5492</v>
 </e>
 <e>
 <k>@cil_ldind_i2</k>
-<v>512</v>
+<v>510</v>
 </e>
 <e>
 <k>@cil_ldind_u2</k>
-<v>2446</v>
+<v>2500</v>
 </e>
 <e>
 <k>@cil_ldind_i4</k>
-<v>9786</v>
+<v>9746</v>
 </e>
 <e>
 <k>@cil_ldind_u4</k>
-<v>1483</v>
+<v>1477</v>
 </e>
 <e>
 <k>@cil_ldind_i8</k>
-<v>1972</v>
+<v>1963</v>
 </e>
 <e>
 <k>@cil_ldind_i</k>
-<v>244</v>
+<v>250</v>
 </e>
 <e>
 <k>@cil_ldind_r4</k>
-<v>702</v>
+<v>699</v>
 </e>
 <e>
 <k>@cil_ldind_r8</k>
-<v>263</v>
+<v>262</v>
 </e>
 <e>
 <k>@cil_ldind_ref</k>
-<v>6662</v>
+<v>6635</v>
 </e>
 <e>
 <k>@cil_stind_ref</k>
-<v>16952</v>
+<v>16882</v>
 </e>
 <e>
 <k>@cil_stind_i1</k>
-<v>8532</v>
+<v>8496</v>
 </e>
 <e>
 <k>@cil_stind_i2</k>
-<v>1377</v>
+<v>1407</v>
 </e>
 <e>
 <k>@cil_stind_i4</k>
-<v>10372</v>
+<v>10329</v>
 </e>
 <e>
 <k>@cil_stind_i8</k>
-<v>2347</v>
-</e>
-<e>
-<k>@cil_stind_r4</k>
-<v>185</v>
-</e>
-<e>
-<k>@cil_stind_r8</k>
-<v>224</v>
-</e>
-<e>
-<k>@cil_add</k>
-<v>224202</v>
-</e>
-<e>
-<k>@cil_sub</k>
-<v>85368</v>
-</e>
-<e>
-<k>@cil_mul</k>
-<v>29980</v>
-</e>
-<e>
-<k>@cil_div</k>
-<v>9132</v>
-</e>
-<e>
-<k>@cil_div_un</k>
-<v>253</v>
-</e>
-<e>
-<k>@cil_rem</k>
-<v>3412</v>
-</e>
-<e>
-<k>@cil_rem_un</k>
-<v>229</v>
-</e>
-<e>
-<k>@cil_and</k>
-<v>59395</v>
-</e>
-<e>
-<k>@cil_or</k>
-<v>22170</v>
-</e>
-<e>
-<k>@cil_xor</k>
-<v>22737</v>
-</e>
-<e>
-<k>@cil_shl</k>
-<v>18988</v>
-</e>
-<e>
-<k>@cil_shr</k>
-<v>9186</v>
-</e>
-<e>
-<k>@cil_shr_un</k>
-<v>26134</v>
-</e>
-<e>
-<k>@cil_neg</k>
 <v>2338</v>
 </e>
 <e>
+<k>@cil_stind_r4</k>
+<v>184</v>
+</e>
+<e>
+<k>@cil_stind_r8</k>
+<v>223</v>
+</e>
+<e>
+<k>@cil_add</k>
+<v>223267</v>
+</e>
+<e>
+<k>@cil_sub</k>
+<v>85012</v>
+</e>
+<e>
+<k>@cil_mul</k>
+<v>29855</v>
+</e>
+<e>
+<k>@cil_div</k>
+<v>9094</v>
+</e>
+<e>
+<k>@cil_div_un</k>
+<v>252</v>
+</e>
+<e>
+<k>@cil_rem</k>
+<v>3397</v>
+</e>
+<e>
+<k>@cil_rem_un</k>
+<v>228</v>
+</e>
+<e>
+<k>@cil_and</k>
+<v>59147</v>
+</e>
+<e>
+<k>@cil_or</k>
+<v>22078</v>
+</e>
+<e>
+<k>@cil_xor</k>
+<v>22642</v>
+</e>
+<e>
+<k>@cil_shl</k>
+<v>18909</v>
+</e>
+<e>
+<k>@cil_shr</k>
+<v>9148</v>
+</e>
+<e>
+<k>@cil_shr_un</k>
+<v>26025</v>
+</e>
+<e>
+<k>@cil_neg</k>
+<v>2328</v>
+</e>
+<e>
 <k>@cil_not</k>
-<v>1459</v>
+<v>1453</v>
 </e>
 <e>
 <k>@cil_conv_i1</k>
-<v>1386</v>
+<v>1380</v>
 </e>
 <e>
 <k>@cil_conv_i2</k>
-<v>1449</v>
+<v>1443</v>
 </e>
 <e>
 <k>@cil_conv_i4</k>
-<v>59839</v>
+<v>59590</v>
 </e>
 <e>
 <k>@cil_conv_i8</k>
-<v>50340</v>
+<v>50130</v>
 </e>
 <e>
 <k>@cil_conv_r4</k>
-<v>2469</v>
+<v>2459</v>
 </e>
 <e>
 <k>@cil_conv_r8</k>
-<v>5286</v>
+<v>5264</v>
 </e>
 <e>
 <k>@cil_conv_u4</k>
-<v>7839</v>
+<v>7806</v>
 </e>
 <e>
 <k>@cil_conv_u8</k>
-<v>19564</v>
+<v>19482</v>
 </e>
 <e>
 <k>@cil_callvirt</k>
-<v>2052492</v>
+<v>2043936</v>
 </e>
 <e>
 <k>@cil_cpobj</k>
@@ -1397,27 +1405,27 @@
 </e>
 <e>
 <k>@cil_ldobj</k>
-<v>12666</v>
+<v>12614</v>
 </e>
 <e>
 <k>@cil_ldstr</k>
-<v>927688</v>
+<v>923821</v>
 </e>
 <e>
 <k>@cil_newobj</k>
-<v>657738</v>
+<v>654996</v>
 </e>
 <e>
 <k>@cil_castclass</k>
-<v>97166</v>
+<v>96761</v>
 </e>
 <e>
 <k>@cil_isinst</k>
-<v>56505</v>
+<v>56270</v>
 </e>
 <e>
 <k>@cil_conv_r_un</k>
-<v>263</v>
+<v>262</v>
 </e>
 <e>
 <k>@cil_unbox</k>
@@ -1425,35 +1433,35 @@
 </e>
 <e>
 <k>@cil_throw</k>
-<v>381613</v>
+<v>380023</v>
 </e>
 <e>
 <k>@cil_ldfld</k>
-<v>1678400</v>
+<v>1671404</v>
 </e>
 <e>
 <k>@cil_ldflda</k>
-<v>301009</v>
+<v>299754</v>
 </e>
 <e>
 <k>@cil_stfld</k>
-<v>1074185</v>
+<v>1069707</v>
 </e>
 <e>
 <k>@cil_ldsfld</k>
-<v>407753</v>
+<v>406053</v>
 </e>
 <e>
 <k>@cil_ldsflda</k>
-<v>2533</v>
+<v>2522</v>
 </e>
 <e>
 <k>@cil_stsfld</k>
-<v>131052</v>
+<v>130506</v>
 </e>
 <e>
 <k>@cil_stobj</k>
-<v>7029</v>
+<v>6999</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1_un</k>
@@ -1497,47 +1505,47 @@
 </e>
 <e>
 <k>@cil_box</k>
-<v>79921</v>
+<v>79588</v>
 </e>
 <e>
 <k>@cil_newarr</k>
-<v>112225</v>
+<v>111757</v>
 </e>
 <e>
 <k>@cil_ldlen</k>
-<v>55387</v>
+<v>55157</v>
 </e>
 <e>
 <k>@cil_ldelema</k>
-<v>9879</v>
+<v>9838</v>
 </e>
 <e>
 <k>@cil_ldelem_i1</k>
-<v>175</v>
+<v>174</v>
 </e>
 <e>
 <k>@cil_ldelem_u1</k>
-<v>15590</v>
+<v>15525</v>
 </e>
 <e>
 <k>@cil_ldelem_i2</k>
-<v>429</v>
+<v>427</v>
 </e>
 <e>
 <k>@cil_ldelem_u2</k>
-<v>6096</v>
+<v>6071</v>
 </e>
 <e>
 <k>@cil_ldelem_i4</k>
-<v>17601</v>
+<v>17528</v>
 </e>
 <e>
 <k>@cil_ldelem_u4</k>
-<v>19134</v>
+<v>19054</v>
 </e>
 <e>
 <k>@cil_ldelem_i8</k>
-<v>11934</v>
+<v>11884</v>
 </e>
 <e>
 <k>@cil_ldelem_i</k>
@@ -1545,15 +1553,15 @@
 </e>
 <e>
 <k>@cil_ldelem_r4</k>
-<v>283</v>
+<v>281</v>
 </e>
 <e>
 <k>@cil_ldelem_r8</k>
-<v>458</v>
+<v>456</v>
 </e>
 <e>
 <k>@cil_ldelem_ref</k>
-<v>30732</v>
+<v>30604</v>
 </e>
 <e>
 <k>@cil_stelem_i</k>
@@ -1561,43 +1569,43 @@
 </e>
 <e>
 <k>@cil_stelem_i1</k>
-<v>8800</v>
+<v>8764</v>
 </e>
 <e>
 <k>@cil_stelem_i2</k>
-<v>8996</v>
+<v>8958</v>
 </e>
 <e>
 <k>@cil_stelem_i4</k>
-<v>22849</v>
+<v>22754</v>
 </e>
 <e>
 <k>@cil_stelem_i8</k>
-<v>9435</v>
+<v>9396</v>
 </e>
 <e>
 <k>@cil_stelem_r4</k>
-<v>200</v>
+<v>199</v>
 </e>
 <e>
 <k>@cil_stelem_r8</k>
-<v>478</v>
+<v>476</v>
 </e>
 <e>
 <k>@cil_stelem_ref</k>
-<v>363318</v>
+<v>361804</v>
 </e>
 <e>
 <k>@cil_ldelem</k>
-<v>2279</v>
+<v>2270</v>
 </e>
 <e>
 <k>@cil_stelem</k>
-<v>53674</v>
+<v>53450</v>
 </e>
 <e>
 <k>@cil_unbox_any</k>
-<v>14404</v>
+<v>14344</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1</k>
@@ -1605,11 +1613,11 @@
 </e>
 <e>
 <k>@cil_conv_ovf_u1</k>
-<v>112</v>
+<v>111</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i2</k>
-<v>78</v>
+<v>77</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u2</k>
@@ -1617,11 +1625,11 @@
 </e>
 <e>
 <k>@cil_conv_ovf_i4</k>
-<v>287</v>
+<v>286</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u4</k>
-<v>78</v>
+<v>77</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i8</k>
@@ -1645,23 +1653,23 @@
 </e>
 <e>
 <k>@cil_ldtoken</k>
-<v>71388</v>
+<v>71091</v>
 </e>
 <e>
 <k>@cil_conv_u2</k>
-<v>4344</v>
+<v>4326</v>
 </e>
 <e>
 <k>@cil_conv_u1</k>
-<v>11270</v>
+<v>11223</v>
 </e>
 <e>
 <k>@cil_conv_i</k>
-<v>3665</v>
+<v>3747</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i</k>
-<v>268</v>
+<v>267</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u</k>
@@ -1669,23 +1677,23 @@
 </e>
 <e>
 <k>@cil_add_ovf</k>
-<v>1732</v>
+<v>1725</v>
 </e>
 <e>
 <k>@cil_add_ovf_un</k>
-<v>151</v>
+<v>150</v>
 </e>
 <e>
 <k>@cil_mul_ovf</k>
-<v>444</v>
+<v>442</v>
 </e>
 <e>
 <k>@cil_mul_ovf_un</k>
-<v>253</v>
+<v>252</v>
 </e>
 <e>
 <k>@cil_sub_ovf</k>
-<v>1112</v>
+<v>1108</v>
 </e>
 <e>
 <k>@cil_sub_ovf_un</k>
@@ -1693,23 +1701,23 @@
 </e>
 <e>
 <k>@cil_endfinally</k>
-<v>56959</v>
+<v>56722</v>
 </e>
 <e>
 <k>@cil_leave</k>
-<v>66932</v>
+<v>66653</v>
 </e>
 <e>
 <k>@cil_leave_s</k>
-<v>149499</v>
+<v>148875</v>
 </e>
 <e>
 <k>@cil_stind_i</k>
-<v>125</v>
+<v>128</v>
 </e>
 <e>
 <k>@cil_conv_u</k>
-<v>5814</v>
+<v>5942</v>
 </e>
 <e>
 <k>@cil_arglist</k>
@@ -1717,31 +1725,31 @@
 </e>
 <e>
 <k>@cil_ceq</k>
-<v>97066</v>
+<v>99216</v>
 </e>
 <e>
 <k>@cil_cgt</k>
-<v>11578</v>
+<v>11834</v>
 </e>
 <e>
 <k>@cil_cgt_un</k>
-<v>36744</v>
+<v>37558</v>
 </e>
 <e>
 <k>@cil_clt</k>
-<v>19540</v>
+<v>19973</v>
 </e>
 <e>
 <k>@cil_clt_un</k>
-<v>1315</v>
+<v>1344</v>
 </e>
 <e>
 <k>@cil_ldftn</k>
-<v>80014</v>
+<v>79680</v>
 </e>
 <e>
 <k>@cil_ldvirtftn</k>
-<v>1112</v>
+<v>1108</v>
 </e>
 <e>
 <k>@cil_ldarg</k>
@@ -1769,11 +1777,11 @@
 </e>
 <e>
 <k>@cil_localloc</k>
-<v>979</v>
+<v>1000</v>
 </e>
 <e>
 <k>@cil_endfilter</k>
-<v>810</v>
+<v>806</v>
 </e>
 <e>
 <k>@cil_unaligned</k>
@@ -1781,7 +1789,7 @@
 </e>
 <e>
 <k>@cil_volatile</k>
-<v>8547</v>
+<v>8511</v>
 </e>
 <e>
 <k>@cil_tail</k>
@@ -1789,11 +1797,11 @@
 </e>
 <e>
 <k>@cil_initobj</k>
-<v>101882</v>
+<v>101457</v>
 </e>
 <e>
 <k>@cil_constrained</k>
-<v>25338</v>
+<v>25233</v>
 </e>
 <e>
 <k>@cil_cpblk</k>
@@ -1805,11 +1813,11 @@
 </e>
 <e>
 <k>@cil_rethrow</k>
-<v>3773</v>
+<v>3757</v>
 </e>
 <e>
 <k>@cil_sizeof</k>
-<v>1732</v>
+<v>1725</v>
 </e>
 <e>
 <k>@cil_refanytype</k>
@@ -1821,80 +1829,80 @@
 </e>
 <e>
 <k>@cil_valueorreftype</k>
-<v>596517</v>
+<v>594030</v>
 </e>
 <e>
 <k>@cil_typeparameter</k>
-<v>185156</v>
+<v>184385</v>
 </e>
 <e>
 <k>@cil_array_type</k>
-<v>14199</v>
+<v>14140</v>
 </e>
 <e>
 <k>@cil_pointer_type</k>
-<v>624</v>
+<v>622</v>
 </e>
 <e>
 <k>@cil_method</k>
-<v>2316799</v>
+<v>2307141</v>
 </e>
 <e>
 <k>@cil_method_implementation</k>
-<v>1729473</v>
+<v>1722264</v>
 </e>
 <e>
 <k>@cil_field</k>
-<v>1010513</v>
+<v>1006301</v>
 </e>
 <e>
 <k>@cil_parameter</k>
-<v>4556386</v>
+<v>4537393</v>
 </e>
 <e>
 <k>@cil_property</k>
-<v>380725</v>
+<v>379138</v>
 </e>
 <e>
 <k>@cil_event</k>
-<v>20887</v>
+<v>20799</v>
 </e>
 <e>
 <k>@cil_local_variable</k>
-<v>1153120</v>
+<v>1148313</v>
 </e>
 <e>
 <k>@cil_catch_handler</k>
-<v>43902</v>
+<v>43719</v>
 </e>
 <e>
 <k>@cil_filter_handler</k>
-<v>810</v>
+<v>806</v>
 </e>
 <e>
 <k>@cil_finally_handler</k>
-<v>55485</v>
+<v>55254</v>
 </e>
 <e>
 <k>@cil_fault_handler</k>
-<v>1474</v>
+<v>1468</v>
 </e>
 <e>
 <k>@cil_attribute</k>
-<v>328979</v>
+<v>327607</v>
 </e>
 </typesizes>
   <stats><relation>
 <name>compilations</name>
-<cardinality>1098</cardinality>
+<cardinality>1093</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 <e>
 <k>cwd</k>
-<v>785</v>
+<v>782</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1908,7 +1916,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -1924,12 +1932,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>473</v>
+<v>471</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>312</v>
+<v>311</v>
 </b>
 </bs>
 </hist>
@@ -1939,11 +1947,11 @@
 </relation>
 <relation>
 <name>compilation_args</name>
-<cardinality>4627</cardinality>
+<cardinality>4472</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 <e>
 <k>num</k>
@@ -1951,7 +1959,7 @@
 </e>
 <e>
 <k>arg</k>
-<v>1122</v>
+<v>1118</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1965,12 +1973,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>863</v>
+<v>996</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>234</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -1986,12 +1994,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>863</v>
+<v>996</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>234</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -2005,8 +2013,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>48</a>
-<b>49</b>
+<a>20</a>
+<b>21</b>
 <v>4</v>
 </b>
 <b>
@@ -2031,13 +2039,13 @@
 <v>14</v>
 </b>
 <b>
-<a>48</a>
-<b>49</b>
+<a>20</a>
+<b>21</b>
 <v>4</v>
 </b>
 <b>
-<a>178</a>
-<b>179</b>
+<a>206</a>
+<b>207</b>
 <v>4</v>
 </b>
 </bs>
@@ -2054,10 +2062,10 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 <b>
-<a>48</a>
+<a>20</a>
 <b>226</b>
 <v>24</v>
 </b>
@@ -2075,7 +2083,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1112</v>
+<v>1108</v>
 </b>
 <b>
 <a>2</a>
@@ -2090,19 +2098,19 @@
 </relation>
 <relation>
 <name>compilation_compiling_files</name>
-<cardinality>22634</cardinality>
+<cardinality>22540</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 <e>
 <k>num</k>
-<v>712</v>
+<v>709</v>
 </e>
 <e>
 <k>file</k>
-<v>22629</v>
+<v>22535</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2308,7 +2316,7 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>78</v>
+<v>77</v>
 </b>
 <b>
 <a>12</a>
@@ -2389,7 +2397,7 @@
 <b>
 <a>11</a>
 <b>12</b>
-<v>78</v>
+<v>77</v>
 </b>
 <b>
 <a>12</a>
@@ -2440,7 +2448,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22624</v>
+<v>22530</v>
 </b>
 <b>
 <a>2</a>
@@ -2461,7 +2469,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22624</v>
+<v>22530</v>
 </b>
 <b>
 <a>2</a>
@@ -2476,19 +2484,19 @@
 </relation>
 <relation>
 <name>compilation_referencing_files</name>
-<cardinality>360048</cardinality>
+<cardinality>358547</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 <e>
 <k>num</k>
-<v>2748</v>
+<v>2736</v>
 </e>
 <e>
 <k>file</k>
-<v>3421</v>
+<v>3407</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2532,7 +2540,7 @@
 <b>
 <a>328</a>
 <b>344</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>344</a>
@@ -2562,7 +2570,7 @@
 <b>
 <a>369</a>
 <b>564</b>
-<v>39</v>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -2608,7 +2616,7 @@
 <b>
 <a>328</a>
 <b>344</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>344</a>
@@ -2638,7 +2646,7 @@
 <b>
 <a>369</a>
 <b>564</b>
-<v>39</v>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -2654,7 +2662,7 @@
 <b>
 <a>1</a>
 <b>4</b>
-<v>219</v>
+<v>218</v>
 </b>
 <b>
 <a>4</a>
@@ -2664,27 +2672,27 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>698</v>
+<v>695</v>
 </b>
 <b>
 <a>8</a>
 <b>118</b>
-<v>219</v>
+<v>218</v>
 </b>
 <b>
 <a>118</a>
 <b>214</b>
-<v>205</v>
+<v>204</v>
 </b>
 <b>
 <a>222</a>
 <b>223</b>
-<v>639</v>
+<v>636</v>
 </b>
 <b>
 <a>224</a>
 <b>225</b>
-<v>712</v>
+<v>709</v>
 </b>
 <b>
 <a>225</a>
@@ -2705,62 +2713,62 @@
 <b>
 <a>1</a>
 <b>4</b>
-<v>219</v>
+<v>218</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>39</v>
+<v>126</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>629</v>
+<v>578</v>
 </b>
 <b>
 <a>7</a>
 <b>20</b>
-<v>205</v>
+<v>233</v>
 </b>
 <b>
 <a>20</a>
-<b>24</b>
-<v>209</v>
+<b>25</b>
+<v>233</v>
 </b>
 <b>
-<a>24</a>
+<a>25</a>
 <b>30</b>
-<v>205</v>
+<v>228</v>
 </b>
 <b>
 <a>30</a>
-<b>34</b>
-<v>253</v>
+<b>37</b>
+<v>209</v>
 </b>
 <b>
-<a>34</a>
-<b>46</b>
-<v>214</v>
+<a>37</a>
+<b>48</b>
+<v>209</v>
 </b>
 <b>
-<a>46</a>
-<b>57</b>
-<v>205</v>
+<a>48</a>
+<b>58</b>
+<v>213</v>
 </b>
 <b>
-<a>57</a>
+<a>58</a>
 <b>60</b>
-<v>180</v>
+<v>199</v>
 </b>
 <b>
 <a>60</a>
 <b>63</b>
-<v>239</v>
+<v>209</v>
 </b>
 <b>
 <a>63</a>
-<b>69</b>
-<v>146</v>
+<b>67</b>
+<v>77</v>
 </b>
 </bs>
 </hist>
@@ -2776,12 +2784,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>527</v>
+<v>524</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>6</a>
@@ -2791,42 +2799,42 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>317</v>
+<v>315</v>
 </b>
 <b>
 <a>8</a>
 <b>10</b>
-<v>278</v>
+<v>277</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>23</a>
 <b>122</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>124</a>
 <b>214</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>220</a>
 <b>221</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>222</a>
 <b>223</b>
-<v>483</v>
+<v>481</v>
 </b>
 <b>
 <a>224</a>
 <b>225</b>
-<v>717</v>
+<v>714</v>
 </b>
 </bs>
 </hist>
@@ -2842,62 +2850,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>571</v>
+<v>559</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>253</v>
+<v>257</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>336</v>
+<v>199</v>
 </b>
 <b>
 <a>6</a>
-<b>8</b>
-<v>297</v>
+<b>7</b>
+<v>301</v>
 </b>
 <b>
-<a>8</a>
-<b>14</b>
-<v>258</v>
+<a>7</a>
+<b>11</b>
+<v>296</v>
 </b>
 <b>
-<a>14</a>
-<b>21</b>
-<v>297</v>
+<a>11</a>
+<b>18</b>
+<v>257</v>
 </b>
 <b>
-<a>21</a>
-<b>26</b>
-<v>287</v>
+<a>18</a>
+<b>22</b>
+<v>306</v>
 </b>
 <b>
-<a>26</a>
-<b>35</b>
-<v>263</v>
+<a>22</a>
+<b>27</b>
+<v>272</v>
 </b>
 <b>
-<a>35</a>
+<a>27</a>
+<b>58</b>
+<v>277</v>
+</b>
+<b>
+<a>58</a>
 <b>61</b>
-<v>244</v>
+<v>272</v>
 </b>
 <b>
 <a>61</a>
-<b>64</b>
-<v>258</v>
+<b>66</b>
+<v>311</v>
 </b>
 <b>
-<a>64</a>
-<b>68</b>
-<v>278</v>
-</b>
-<b>
-<a>68</a>
-<b>72</b>
-<v>73</v>
+<a>66</a>
+<b>71</b>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -2907,11 +2915,11 @@
 </relation>
 <relation>
 <name>compilation_time</name>
-<cardinality>7688</cardinality>
+<cardinality>7655</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 <e>
 <k>num</k>
@@ -2923,7 +2931,7 @@
 </e>
 <e>
 <k>seconds</k>
-<v>5803</v>
+<v>5896</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2937,7 +2945,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -2953,7 +2961,7 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -2967,9 +2975,14 @@
 <budget>12</budget>
 <bs>
 <b>
+<a>6</a>
+<b>7</b>
+<v>9</v>
+</b>
+<b>
 <a>7</a>
 <b>8</b>
-<v>1098</v>
+<v>1083</v>
 </b>
 </bs>
 </hist>
@@ -3015,8 +3028,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1189</a>
-<b>1190</b>
+<a>1213</a>
+<b>1214</b>
 <v>4</v>
 </b>
 </bs>
@@ -3063,18 +3076,23 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>177</a>
-<b>178</b>
-<v>9</v>
-</b>
-<b>
-<a>189</a>
-<b>190</b>
+<a>168</a>
+<b>169</b>
 <v>4</v>
 </b>
 <b>
-<a>190</a>
-<b>191</b>
+<a>176</a>
+<b>177</b>
+<v>4</v>
+</b>
+<b>
+<a>192</a>
+<b>193</b>
+<v>4</v>
+</b>
+<b>
+<a>193</a>
+<b>194</b>
 <v>4</v>
 </b>
 <b>
@@ -3096,17 +3114,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4539</v>
+<v>4807</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>815</v>
+<v>612</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>449</v>
+<v>461</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -3122,7 +3145,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5803</v>
+<v>5896</v>
 </b>
 </bs>
 </hist>
@@ -3138,17 +3161,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4871</v>
+<v>5079</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>800</v>
+<v>719</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>131</v>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -4419,7 +4442,7 @@
 </e>
 <e>
 <k>stack_trace</k>
-<v>199</v>
+<v>210</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -4647,8 +4670,8 @@
 <v>2</v>
 </b>
 <b>
-<a>198</a>
-<b>199</b>
+<a>209</a>
+<b>210</b>
 <v>1</v>
 </b>
 </bs>
@@ -4743,8 +4766,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>199</a>
-<b>200</b>
+<a>210</a>
+<b>211</b>
 <v>1</v>
 </b>
 </bs>
@@ -4804,13 +4827,13 @@
 <v>1</v>
 </b>
 <b>
-<a>324</a>
-<b>325</b>
+<a>326</a>
+<b>327</b>
 <v>1</v>
 </b>
 <b>
-<a>2413</a>
-<b>2414</b>
+<a>2411</a>
+<b>2412</b>
 <v>1</v>
 </b>
 <b>
@@ -4897,13 +4920,13 @@
 <v>1</v>
 </b>
 <b>
-<a>274</a>
-<b>275</b>
+<a>275</a>
+<b>276</b>
 <v>1</v>
 </b>
 <b>
-<a>1648</a>
-<b>1649</b>
+<a>1647</a>
+<b>1648</b>
 <v>1</v>
 </b>
 <b>
@@ -4958,13 +4981,13 @@
 <v>1</v>
 </b>
 <b>
-<a>324</a>
-<b>325</b>
+<a>326</a>
+<b>327</b>
 <v>1</v>
 </b>
 <b>
-<a>2019</a>
-<b>2020</b>
+<a>2017</a>
+<b>2018</b>
 <v>1</v>
 </b>
 <b>
@@ -4996,7 +5019,12 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>2</v>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
 </b>
 <b>
 <a>5</a>
@@ -5004,23 +5032,23 @@
 <v>1</v>
 </b>
 <b>
-<a>7</a>
-<b>8</b>
+<a>8</a>
+<b>9</b>
 <v>1</v>
 </b>
 <b>
-<a>10</a>
-<b>11</b>
+<a>9</a>
+<b>10</b>
 <v>1</v>
 </b>
 <b>
-<a>52</a>
-<b>53</b>
+<a>53</a>
+<b>54</b>
 <v>1</v>
 </b>
 <b>
-<a>114</a>
-<b>115</b>
+<a>123</a>
+<b>124</b>
 <v>1</v>
 </b>
 </bs>
@@ -5142,12 +5170,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5220</v>
+<v>5210</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>73</v>
+<v>83</v>
 </b>
 </bs>
 </hist>
@@ -5268,12 +5296,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6676</v>
+<v>6687</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>25</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -5289,47 +5317,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54</v>
+<v>61</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>40</v>
+<v>37</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>16</v>
+<v>12</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>13</v>
+<v>16</v>
 </b>
 <b>
 <a>5</a>
-<b>8</b>
-<v>15</v>
+<b>7</b>
+<v>16</v>
 </b>
 <b>
-<a>8</a>
-<b>12</b>
-<v>18</v>
+<a>7</a>
+<b>10</b>
+<v>16</v>
 </b>
 <b>
-<a>12</a>
-<b>37</b>
-<v>15</v>
+<a>10</a>
+<b>16</b>
+<v>16</v>
 </b>
 <b>
-<a>38</a>
-<b>122</b>
-<v>15</v>
+<a>20</a>
+<b>74</b>
+<v>16</v>
 </b>
 <b>
-<a>170</a>
-<b>1173</b>
-<v>13</v>
+<a>76</a>
+<b>432</b>
+<v>16</v>
+</b>
+<b>
+<a>563</a>
+<b>1147</b>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -5345,7 +5378,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>198</v>
+<v>209</v>
 </b>
 <b>
 <a>2</a>
@@ -5366,7 +5399,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199</v>
+<v>210</v>
 </b>
 </bs>
 </hist>
@@ -5382,7 +5415,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>198</v>
+<v>209</v>
 </b>
 <b>
 <a>2</a>
@@ -5403,42 +5436,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70</v>
+<v>76</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36</v>
+<v>32</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20</v>
-</b>
-<b>
-<a>4</a>
-<b>7</b>
-<v>17</v>
-</b>
-<b>
-<a>7</a>
-<b>10</b>
 <v>16</v>
 </b>
 <b>
-<a>11</a>
-<b>21</b>
-<v>15</v>
+<a>4</a>
+<b>5</b>
+<v>12</v>
 </b>
 <b>
-<a>25</a>
-<b>117</b>
-<v>15</v>
+<a>5</a>
+<b>7</b>
+<v>18</v>
 </b>
 <b>
-<a>131</a>
-<b>946</b>
-<v>10</v>
+<a>7</a>
+<b>12</b>
+<v>18</v>
+</b>
+<b>
+<a>12</a>
+<b>43</b>
+<v>16</v>
+</b>
+<b>
+<a>45</a>
+<b>250</b>
+<v>16</v>
+</b>
+<b>
+<a>277</a>
+<b>925</b>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -5454,48 +5492,48 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62</v>
+<v>71</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36</v>
+<v>32</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18</v>
+<v>15</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>13</v>
+<v>15</v>
 </b>
 <b>
 <a>5</a>
-<b>9</b>
-<v>18</v>
+<b>7</b>
+<v>14</v>
 </b>
 <b>
-<a>9</a>
-<b>14</b>
-<v>17</v>
+<a>7</a>
+<b>11</b>
+<v>16</v>
 </b>
 <b>
-<a>14</a>
-<b>67</b>
+<a>11</a>
+<b>22</b>
+<v>16</v>
+</b>
+<b>
+<a>28</a>
+<b>102</b>
+<v>16</v>
+</b>
+<b>
+<a>102</a>
+<b>1147</b>
 <v>15</v>
 </b>
-<b>
-<a>79</a>
-<b>340</b>
-<v>15</v>
-</b>
-<b>
-<a>360</a>
-<b>1173</b>
-<v>5</v>
-</b>
 </bs>
 </hist>
 </val>
@@ -5504,19 +5542,19 @@
 </relation>
 <relation>
 <name>compilation_finished</name>
-<cardinality>1098</cardinality>
+<cardinality>1093</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 <e>
 <k>cpu_seconds</k>
-<v>1000</v>
+<v>1001</v>
 </e>
 <e>
 <k>elapsed_seconds</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5530,7 +5568,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -5546,7 +5584,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -5562,12 +5600,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>903</v>
+<v>918</v>
 </b>
 <b>
 <a>2</a>
-<b>3</b>
-<v>97</v>
+<b>4</b>
+<v>82</v>
 </b>
 </bs>
 </hist>
@@ -5583,12 +5621,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>903</v>
+<v>918</v>
 </b>
 <b>
 <a>2</a>
-<b>3</b>
-<v>97</v>
+<b>4</b>
+<v>82</v>
 </b>
 </bs>
 </hist>
@@ -5604,7 +5642,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -5620,7 +5658,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -5630,15 +5668,15 @@
 </relation>
 <relation>
 <name>compilation_assembly</name>
-<cardinality>1098</cardinality>
+<cardinality>1093</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 <e>
 <k>assembly</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5652,7 +5690,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -5668,7 +5706,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -6330,19 +6368,19 @@
 </relation>
 <relation>
 <name>duplicateCode</name>
-<cardinality>22785</cardinality>
+<cardinality>22690</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>22785</v>
+<v>22690</v>
 </e>
 <e>
 <k>relativePath</k>
-<v>3812</v>
+<v>3796</v>
 </e>
 <e>
 <k>equivClass</k>
-<v>7024</v>
+<v>6994</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -6356,7 +6394,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22785</v>
+<v>22690</v>
 </b>
 </bs>
 </hist>
@@ -6372,7 +6410,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22785</v>
+<v>22690</v>
 </b>
 </bs>
 </hist>
@@ -6388,47 +6426,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1064</v>
+<v>1059</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>566</v>
+<v>563</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>424</v>
+<v>422</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>219</v>
+<v>218</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>219</v>
+<v>218</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>336</v>
+<v>335</v>
 </b>
 <b>
 <a>8</a>
 <b>10</b>
-<v>278</v>
+<v>277</v>
 </b>
 <b>
 <a>10</a>
 <b>14</b>
-<v>317</v>
+<v>315</v>
 </b>
 <b>
 <a>14</a>
 <b>28</b>
-<v>287</v>
+<v>286</v>
 </b>
 <b>
 <a>29</a>
@@ -6449,52 +6487,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1132</v>
+<v>1127</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>522</v>
+<v>520</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>444</v>
+<v>442</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>229</v>
+<v>228</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>327</v>
+<v>325</v>
 </b>
 <b>
 <a>8</a>
 <b>10</b>
-<v>278</v>
+<v>277</v>
 </b>
 <b>
 <a>10</a>
 <b>14</b>
-<v>312</v>
+<v>311</v>
 </b>
 <b>
 <a>14</a>
 <b>32</b>
-<v>292</v>
+<v>291</v>
 </b>
 <b>
 <a>33</a>
 <b>45</b>
-<v>39</v>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -6510,32 +6548,32 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3773</v>
+<v>3757</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1147</v>
+<v>1142</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>785</v>
+<v>782</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>429</v>
+<v>427</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>571</v>
+<v>568</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>317</v>
+<v>315</v>
 </b>
 </bs>
 </hist>
@@ -6551,37 +6589,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>678</v>
+<v>675</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3446</v>
+<v>3431</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1078</v>
+<v>1074</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>678</v>
+<v>675</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>385</v>
+<v>384</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>580</v>
+<v>578</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>175</v>
+<v>174</v>
 </b>
 </bs>
 </hist>
@@ -8659,11 +8697,11 @@
 </relation>
 <relation>
 <name>locations_default</name>
-<cardinality>14071972</cardinality>
+<cardinality>14071977</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14071972</v>
+<v>14071977</v>
 </e>
 <e>
 <k>file</k>
@@ -8697,7 +8735,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071972</v>
+<v>14071977</v>
 </b>
 </bs>
 </hist>
@@ -8713,7 +8751,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071972</v>
+<v>14071977</v>
 </b>
 </bs>
 </hist>
@@ -8729,7 +8767,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071972</v>
+<v>14071977</v>
 </b>
 </bs>
 </hist>
@@ -8745,7 +8783,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071972</v>
+<v>14071977</v>
 </b>
 </bs>
 </hist>
@@ -8761,7 +8799,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071972</v>
+<v>14071977</v>
 </b>
 </bs>
 </hist>
@@ -8807,40 +8845,40 @@
 <b>
 <a>150</a>
 <b>208</b>
-<v>471</v>
+<v>470</v>
 </b>
 <b>
 <a>208</a>
-<b>297</b>
-<v>472</v>
-</b>
-<b>
-<a>297</a>
-<b>446</b>
-<v>469</v>
-</b>
-<b>
-<a>446</a>
-<b>693</b>
-<v>469</v>
-</b>
-<b>
-<a>693</a>
-<b>1208</b>
+<b>296</b>
 <v>468</v>
 </b>
 <b>
-<a>1209</a>
-<b>2677</b>
+<a>296</a>
+<b>445</b>
 <v>468</v>
 </b>
 <b>
-<a>2691</a>
+<a>445</a>
+<b>685</b>
+<v>469</v>
+</b>
+<b>
+<a>685</a>
+<b>1200</b>
+<v>468</v>
+</b>
+<b>
+<a>1200</a>
+<b>2633</b>
+<v>468</v>
+</b>
+<b>
+<a>2635</a>
 <b>42820</b>
-<v>488</v>
+<v>494</v>
 </b>
 <b>
-<a>43087</a>
+<a>43085</a>
 <b>474768</b>
 <v>60</v>
 </b>
@@ -8863,12 +8901,12 @@
 <b>
 <a>12</a>
 <b>19</b>
-<v>507</v>
+<v>508</v>
 </b>
 <b>
 <a>19</a>
 <b>27</b>
-<v>519</v>
+<v>518</v>
 </b>
 <b>
 <a>27</a>
@@ -8954,12 +8992,12 @@
 <b>
 <a>26</a>
 <b>34</b>
-<v>516</v>
+<v>517</v>
 </b>
 <b>
 <a>34</a>
 <b>43</b>
-<v>500</v>
+<v>499</v>
 </b>
 <b>
 <a>43</a>
@@ -9015,12 +9053,12 @@
 <b>
 <a>12</a>
 <b>18</b>
-<v>482</v>
+<v>483</v>
 </b>
 <b>
 <a>18</a>
 <b>25</b>
-<v>471</v>
+<v>470</v>
 </b>
 <b>
 <a>25</a>
@@ -9136,12 +9174,12 @@
 <b>
 <a>105</a>
 <b>123</b>
-<v>482</v>
+<v>483</v>
 </b>
 <b>
 <a>123</a>
 <b>148</b>
-<v>470</v>
+<v>469</v>
 </b>
 <b>
 <a>148</a>
@@ -9207,12 +9245,12 @@
 <b>
 <a>101</a>
 <b>117</b>
-<v>12387</v>
+<v>12388</v>
 </b>
 <b>
 <a>117</a>
 <b>182</b>
-<v>12567</v>
+<v>12566</v>
 </b>
 <b>
 <a>182</a>
@@ -9505,13 +9543,13 @@
 <v>110</v>
 </b>
 <b>
-<a>5448</a>
+<a>5447</a>
 <b>74977</b>
 <v>110</v>
 </b>
 <b>
-<a>76216</a>
-<b>2221250</b>
+<a>76212</a>
+<b>2221242</b>
 <v>24</v>
 </b>
 </bs>
@@ -9562,7 +9600,7 @@
 </b>
 <b>
 <a>195</a>
-<b>1098</b>
+<b>1097</b>
 <v>110</v>
 </b>
 <b>
@@ -10376,11 +10414,11 @@
 </relation>
 <relation>
 <name>numlines</name>
-<cardinality>4585682</cardinality>
+<cardinality>4585662</cardinality>
 <columnsizes>
 <e>
 <k>element_id</k>
-<v>4585675</v>
+<v>4585655</v>
 </e>
 <e>
 <k>num_lines</k>
@@ -10406,7 +10444,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4585668</v>
+<v>4585648</v>
 </b>
 <b>
 <a>2</a>
@@ -10427,7 +10465,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4585668</v>
+<v>4585648</v>
 </b>
 <b>
 <a>2</a>
@@ -10448,7 +10486,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4585671</v>
+<v>4585651</v>
 </b>
 <b>
 <a>2</a>
@@ -10636,7 +10674,7 @@
 </b>
 <b>
 <a>52</a>
-<b>1614483</b>
+<b>1614463</b>
 <v>83</v>
 </b>
 </bs>
@@ -10774,7 +10812,7 @@
 </b>
 <b>
 <a>215</a>
-<b>4549193</b>
+<b>4549173</b>
 <v>19</v>
 </b>
 </bs>
@@ -10877,27 +10915,27 @@
 </relation>
 <relation>
 <name>assemblies</name>
-<cardinality>4207</cardinality>
+<cardinality>4190</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4207</v>
+<v>4190</v>
 </e>
 <e>
 <k>file</k>
-<v>4207</v>
+<v>4190</v>
 </e>
 <e>
 <k>fullname</k>
-<v>3446</v>
+<v>3431</v>
 </e>
 <e>
 <k>name</k>
-<v>3177</v>
+<v>3164</v>
 </e>
 <e>
 <k>version</k>
-<v>370</v>
+<v>369</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -10911,7 +10949,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4207</v>
+<v>4190</v>
 </b>
 </bs>
 </hist>
@@ -10927,7 +10965,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4207</v>
+<v>4190</v>
 </b>
 </bs>
 </hist>
@@ -10943,7 +10981,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4207</v>
+<v>4190</v>
 </b>
 </bs>
 </hist>
@@ -10959,7 +10997,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4207</v>
+<v>4190</v>
 </b>
 </bs>
 </hist>
@@ -10975,7 +11013,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4207</v>
+<v>4190</v>
 </b>
 </bs>
 </hist>
@@ -10991,7 +11029,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4207</v>
+<v>4190</v>
 </b>
 </bs>
 </hist>
@@ -11007,7 +11045,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4207</v>
+<v>4190</v>
 </b>
 </bs>
 </hist>
@@ -11023,7 +11061,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4207</v>
+<v>4190</v>
 </b>
 </bs>
 </hist>
@@ -11039,12 +11077,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2684</v>
+<v>2673</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>761</v>
+<v>758</v>
 </b>
 </bs>
 </hist>
@@ -11060,12 +11098,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2684</v>
+<v>2673</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>761</v>
+<v>758</v>
 </b>
 </bs>
 </hist>
@@ -11081,7 +11119,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3446</v>
+<v>3431</v>
 </b>
 </bs>
 </hist>
@@ -11097,7 +11135,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3446</v>
+<v>3431</v>
 </b>
 </bs>
 </hist>
@@ -11113,12 +11151,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2191</v>
+<v>2182</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>942</v>
+<v>938</v>
 </b>
 <b>
 <a>3</a>
@@ -11139,12 +11177,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2191</v>
+<v>2182</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>942</v>
+<v>938</v>
 </b>
 <b>
 <a>3</a>
@@ -11165,12 +11203,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2953</v>
+<v>2940</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>224</v>
+<v>223</v>
 </b>
 </bs>
 </hist>
@@ -11186,12 +11224,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2953</v>
+<v>2940</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>224</v>
+<v>223</v>
 </b>
 </bs>
 </hist>
@@ -11207,7 +11245,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>205</v>
+<v>204</v>
 </b>
 <b>
 <a>2</a>
@@ -11248,7 +11286,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>205</v>
+<v>204</v>
 </b>
 <b>
 <a>2</a>
@@ -11365,23 +11403,23 @@
 </relation>
 <relation>
 <name>files</name>
-<cardinality>42559</cardinality>
+<cardinality>42382</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42559</v>
+<v>42382</v>
 </e>
 <e>
 <k>name</k>
-<v>42559</v>
+<v>42382</v>
 </e>
 <e>
 <k>simple</k>
-<v>22985</v>
+<v>22890</v>
 </e>
 <e>
 <k>ext</k>
-<v>39</v>
+<v>38</v>
 </e>
 <e>
 <k>fromSource</k>
@@ -11399,7 +11437,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42559</v>
+<v>42382</v>
 </b>
 </bs>
 </hist>
@@ -11415,7 +11453,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42559</v>
+<v>42382</v>
 </b>
 </bs>
 </hist>
@@ -11431,7 +11469,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42559</v>
+<v>42382</v>
 </b>
 </bs>
 </hist>
@@ -11447,7 +11485,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42559</v>
+<v>42382</v>
 </b>
 </bs>
 </hist>
@@ -11463,7 +11501,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42559</v>
+<v>42382</v>
 </b>
 </bs>
 </hist>
@@ -11479,7 +11517,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42559</v>
+<v>42382</v>
 </b>
 </bs>
 </hist>
@@ -11495,7 +11533,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42559</v>
+<v>42382</v>
 </b>
 </bs>
 </hist>
@@ -11511,7 +11549,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42559</v>
+<v>42382</v>
 </b>
 </bs>
 </hist>
@@ -11527,12 +11565,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21575</v>
+<v>21485</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>1410</v>
+<v>1404</v>
 </b>
 </bs>
 </hist>
@@ -11548,12 +11586,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21575</v>
+<v>21485</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>1410</v>
+<v>1404</v>
 </b>
 </bs>
 </hist>
@@ -11569,12 +11607,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22195</v>
+<v>22102</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>790</v>
+<v>787</v>
 </b>
 </bs>
 </hist>
@@ -11590,7 +11628,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22985</v>
+<v>22890</v>
 </b>
 </bs>
 </hist>
@@ -11754,7 +11792,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39</v>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -11828,19 +11866,19 @@
 </relation>
 <relation>
 <name>folders</name>
-<cardinality>16977</cardinality>
+<cardinality>16906</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16977</v>
+<v>16906</v>
 </e>
 <e>
 <k>name</k>
-<v>14756</v>
+<v>14694</v>
 </e>
 <e>
 <k>simple</k>
-<v>2782</v>
+<v>2770</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -11854,7 +11892,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16977</v>
+<v>16906</v>
 </b>
 </bs>
 </hist>
@@ -11870,7 +11908,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16977</v>
+<v>16906</v>
 </b>
 </bs>
 </hist>
@@ -11886,7 +11924,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14756</v>
+<v>14694</v>
 </b>
 </bs>
 </hist>
@@ -11902,12 +11940,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12535</v>
+<v>12482</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2220</v>
+<v>2211</v>
 </b>
 </bs>
 </hist>
@@ -11923,17 +11961,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1825</v>
+<v>1817</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>375</v>
+<v>374</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>205</v>
+<v>204</v>
 </b>
 <b>
 <a>4</a>
@@ -11959,17 +11997,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1825</v>
+<v>1817</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>375</v>
+<v>374</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>205</v>
+<v>204</v>
 </b>
 <b>
 <a>4</a>
@@ -11989,15 +12027,15 @@
 </relation>
 <relation>
 <name>containerparent</name>
-<cardinality>57306</cardinality>
+<cardinality>57067</cardinality>
 <columnsizes>
 <e>
 <k>parent</k>
-<v>14756</v>
+<v>14694</v>
 </e>
 <e>
 <k>child</k>
-<v>57306</v>
+<v>57067</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12011,37 +12049,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8273</v>
+<v>8239</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1942</v>
+<v>1934</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>771</v>
+<v>768</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>971</v>
+<v>967</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>1108</v>
+<v>1103</v>
 </b>
 <b>
 <a>9</a>
 <b>18</b>
-<v>1142</v>
+<v>1137</v>
 </b>
 <b>
 <a>18</a>
 <b>170</b>
-<v>546</v>
+<v>544</v>
 </b>
 </bs>
 </hist>
@@ -12057,7 +12095,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>57306</v>
+<v>57067</v>
 </b>
 </bs>
 </hist>
@@ -12067,11 +12105,11 @@
 </relation>
 <relation>
 <name>file_extraction_mode</name>
-<cardinality>26837</cardinality>
+<cardinality>26725</cardinality>
 <columnsizes>
 <e>
 <k>file</k>
-<v>26837</v>
+<v>26725</v>
 </e>
 <e>
 <k>mode</k>
@@ -12089,7 +12127,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26837</v>
+<v>26725</v>
 </b>
 </bs>
 </hist>
@@ -12115,15 +12153,15 @@
 </relation>
 <relation>
 <name>namespaces</name>
-<cardinality>21990</cardinality>
+<cardinality>21898</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>21990</v>
+<v>21898</v>
 </e>
 <e>
 <k>name</k>
-<v>4900</v>
+<v>4880</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12137,7 +12175,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21990</v>
+<v>21898</v>
 </b>
 </bs>
 </hist>
@@ -12158,7 +12196,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3499</v>
+<v>3485</v>
 </b>
 <b>
 <a>3</a>
@@ -12168,17 +12206,17 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>624</v>
+<v>622</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>370</v>
+<v>369</v>
 </b>
 <b>
 <a>10</a>
 <b>101</b>
-<v>370</v>
+<v>369</v>
 </b>
 <b>
 <a>110</a>
@@ -12193,15 +12231,15 @@
 </relation>
 <relation>
 <name>namespace_declarations</name>
-<cardinality>19803</cardinality>
+<cardinality>19720</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19803</v>
+<v>19720</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>3895</v>
+<v>3879</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12215,7 +12253,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19803</v>
+<v>19720</v>
 </b>
 </bs>
 </hist>
@@ -12231,42 +12269,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1400</v>
+<v>1395</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>800</v>
+<v>797</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>414</v>
+<v>413</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>307</v>
+<v>306</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>224</v>
+<v>223</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>331</v>
+<v>330</v>
 </b>
 <b>
 <a>9</a>
 <b>17</b>
-<v>302</v>
+<v>301</v>
 </b>
 <b>
 <a>17</a>
 <b>996</b>
-<v>112</v>
+<v>111</v>
 </b>
 </bs>
 </hist>
@@ -12276,15 +12314,15 @@
 </relation>
 <relation>
 <name>namespace_declaration_location</name>
-<cardinality>19803</cardinality>
+<cardinality>19720</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19803</v>
+<v>19720</v>
 </e>
 <e>
 <k>loc</k>
-<v>19803</v>
+<v>19720</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12298,7 +12336,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19803</v>
+<v>19720</v>
 </b>
 </bs>
 </hist>
@@ -12314,7 +12352,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19803</v>
+<v>19720</v>
 </b>
 </bs>
 </hist>
@@ -12324,15 +12362,15 @@
 </relation>
 <relation>
 <name>parent_namespace</name>
-<cardinality>778765</cardinality>
+<cardinality>775518</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>778765</v>
+<v>775518</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>13584</v>
+<v>13527</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12346,7 +12384,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>778765</v>
+<v>775518</v>
 </b>
 </bs>
 </hist>
@@ -12362,52 +12400,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3333</v>
+<v>3320</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1630</v>
+<v>1623</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1029</v>
+<v>1025</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>917</v>
+<v>913</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>1254</v>
+<v>1249</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>1093</v>
+<v>1088</v>
 </b>
 <b>
 <a>10</a>
 <b>15</b>
-<v>1142</v>
+<v>1137</v>
 </b>
 <b>
 <a>15</a>
 <b>23</b>
-<v>1064</v>
+<v>1059</v>
 </b>
 <b>
 <a>23</a>
 <b>51</b>
-<v>1029</v>
+<v>1025</v>
 </b>
 <b>
 <a>51</a>
 <b>835</b>
-<v>1020</v>
+<v>1015</v>
 </b>
 <b>
 <a>900</a>
@@ -12422,15 +12460,15 @@
 </relation>
 <relation>
 <name>parent_namespace_declaration</name>
-<cardinality>88497</cardinality>
+<cardinality>88128</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>87980</v>
+<v>87613</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>19803</v>
+<v>19720</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12444,12 +12482,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87828</v>
+<v>87462</v>
 </b>
 <b>
 <a>2</a>
 <b>60</b>
-<v>151</v>
+<v>150</v>
 </b>
 </bs>
 </hist>
@@ -12465,27 +12503,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13809</v>
+<v>13751</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>1718</v>
+<v>1711</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>1278</v>
+<v>1273</v>
 </b>
 <b>
 <a>13</a>
 <b>16</b>
-<v>1430</v>
+<v>1424</v>
 </b>
 <b>
 <a>16</a>
 <b>32</b>
-<v>1513</v>
+<v>1506</v>
 </b>
 <b>
 <a>32</a>
@@ -12500,15 +12538,15 @@
 </relation>
 <relation>
 <name>using_namespace_directives</name>
-<cardinality>144569</cardinality>
+<cardinality>143966</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144569</v>
+<v>143966</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>4236</v>
+<v>4219</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12522,7 +12560,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144569</v>
+<v>143966</v>
 </b>
 </bs>
 </hist>
@@ -12538,47 +12576,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1498</v>
+<v>1492</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>473</v>
+<v>471</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>297</v>
+<v>296</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>366</v>
+<v>364</v>
 </b>
 <b>
 <a>8</a>
 <b>14</b>
-<v>336</v>
+<v>335</v>
 </b>
 <b>
 <a>14</a>
 <b>25</b>
-<v>322</v>
+<v>320</v>
 </b>
 <b>
 <a>25</a>
 <b>63</b>
-<v>327</v>
+<v>325</v>
 </b>
 <b>
 <a>64</a>
 <b>465</b>
-<v>322</v>
+<v>320</v>
 </b>
 <b>
 <a>510</a>
@@ -12681,15 +12719,15 @@
 </relation>
 <relation>
 <name>using_directive_location</name>
-<cardinality>144627</cardinality>
+<cardinality>144024</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144627</v>
+<v>144024</v>
 </e>
 <e>
 <k>loc</k>
-<v>144583</v>
+<v>143980</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12703,7 +12741,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144627</v>
+<v>144024</v>
 </b>
 </bs>
 </hist>
@@ -12719,7 +12757,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144539</v>
+<v>143937</v>
 </b>
 <b>
 <a>2</a>
@@ -12734,11 +12772,11 @@
 </relation>
 <relation>
 <name>types</name>
-<cardinality>869068</cardinality>
+<cardinality>865446</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>869068</v>
+<v>865446</v>
 </e>
 <e>
 <k>kind</k>
@@ -12746,7 +12784,7 @@
 </e>
 <e>
 <k>name</k>
-<v>367663</v>
+<v>366130</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12760,7 +12798,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>869068</v>
+<v>865446</v>
 </b>
 </bs>
 </hist>
@@ -12776,7 +12814,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>869068</v>
+<v>865446</v>
 </b>
 </bs>
 </hist>
@@ -12874,17 +12912,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>325323</v>
+<v>323966</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>28902</v>
+<v>28781</v>
 </b>
 <b>
 <a>5</a>
 <b>6356</b>
-<v>13438</v>
+<v>13382</v>
 </b>
 </bs>
 </hist>
@@ -12900,12 +12938,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>366223</v>
+<v>364696</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1439</v>
+<v>1433</v>
 </b>
 </bs>
 </hist>
@@ -12915,15 +12953,15 @@
 </relation>
 <relation>
 <name>typerefs</name>
-<cardinality>235307</cardinality>
+<cardinality>234326</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235307</v>
+<v>234326</v>
 </e>
 <e>
 <k>name</k>
-<v>177371</v>
+<v>176631</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12937,7 +12975,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235307</v>
+<v>234326</v>
 </b>
 </bs>
 </hist>
@@ -12953,17 +12991,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162790</v>
+<v>162112</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>13511</v>
+<v>13455</v>
 </b>
 <b>
 <a>7</a>
 <b>2183</b>
-<v>1069</v>
+<v>1064</v>
 </b>
 </bs>
 </hist>
@@ -12973,15 +13011,15 @@
 </relation>
 <relation>
 <name>typeref_type</name>
-<cardinality>235126</cardinality>
+<cardinality>234146</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235126</v>
+<v>234146</v>
 </e>
 <e>
 <k>typeId</k>
-<v>235126</v>
+<v>234146</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12995,7 +13033,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235126</v>
+<v>234146</v>
 </b>
 </bs>
 </hist>
@@ -13011,7 +13049,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235126</v>
+<v>234146</v>
 </b>
 </bs>
 </hist>
@@ -13021,11 +13059,11 @@
 </relation>
 <relation>
 <name>array_element_type</name>
-<cardinality>9142</cardinality>
+<cardinality>9104</cardinality>
 <columnsizes>
 <e>
 <k>array</k>
-<v>9142</v>
+<v>9104</v>
 </e>
 <e>
 <k>dimension</k>
@@ -13037,7 +13075,7 @@
 </e>
 <e>
 <k>element</k>
-<v>9132</v>
+<v>9094</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13051,7 +13089,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9142</v>
+<v>9104</v>
 </b>
 </bs>
 </hist>
@@ -13067,7 +13105,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9142</v>
+<v>9104</v>
 </b>
 </bs>
 </hist>
@@ -13083,7 +13121,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9142</v>
+<v>9104</v>
 </b>
 </bs>
 </hist>
@@ -13225,7 +13263,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9123</v>
+<v>9085</v>
 </b>
 <b>
 <a>2</a>
@@ -13246,7 +13284,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9132</v>
+<v>9094</v>
 </b>
 </bs>
 </hist>
@@ -13262,7 +13300,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9123</v>
+<v>9085</v>
 </b>
 <b>
 <a>2</a>
@@ -13325,15 +13363,15 @@
 </relation>
 <relation>
 <name>pointer_referent_type</name>
-<cardinality>219</cardinality>
+<cardinality>218</cardinality>
 <columnsizes>
 <e>
 <k>pointer</k>
-<v>219</v>
+<v>218</v>
 </e>
 <e>
 <k>referent</k>
-<v>219</v>
+<v>218</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13347,7 +13385,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>219</v>
+<v>218</v>
 </b>
 </bs>
 </hist>
@@ -13363,7 +13401,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>219</v>
+<v>218</v>
 </b>
 </bs>
 </hist>
@@ -13373,15 +13411,15 @@
 </relation>
 <relation>
 <name>enum_underlying_type</name>
-<cardinality>11978</cardinality>
+<cardinality>11928</cardinality>
 <columnsizes>
 <e>
 <k>enum_id</k>
-<v>11978</v>
+<v>11928</v>
 </e>
 <e>
 <k>underlying_type_id</k>
-<v>39</v>
+<v>38</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13395,7 +13433,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11978</v>
+<v>11928</v>
 </b>
 </bs>
 </hist>
@@ -13451,15 +13489,15 @@
 </relation>
 <relation>
 <name>delegate_return_type</name>
-<cardinality>107788</cardinality>
+<cardinality>107339</cardinality>
 <columnsizes>
 <e>
 <k>delegate_id</k>
-<v>107788</v>
+<v>107339</v>
 </e>
 <e>
 <k>return_type_id</k>
-<v>55632</v>
+<v>55400</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13473,7 +13511,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107788</v>
+<v>107339</v>
 </b>
 </bs>
 </hist>
@@ -13489,12 +13527,70 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52312</v>
+<v>52094</v>
 </b>
 <b>
 <a>2</a>
 <b>4178</b>
-<v>3319</v>
+<v>3305</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>function_pointer_return_type</name>
+<cardinality>11</cardinality>
+<columnsizes>
+<e>
+<k>function_pointer_id</k>
+<v>11</v>
+</e>
+<e>
+<k>return_type_id</k>
+<v>3</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>function_pointer_id</src>
+<trg>return_type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>return_type_id</src>
+<trg>function_pointer_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>1</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -13504,15 +13600,15 @@
 </relation>
 <relation>
 <name>extend</name>
-<cardinality>324195</cardinality>
+<cardinality>322844</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>324195</v>
+<v>322844</v>
 </e>
 <e>
 <k>super</k>
-<v>31635</v>
+<v>31503</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13526,7 +13622,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>324195</v>
+<v>322844</v>
 </b>
 </bs>
 </hist>
@@ -13542,22 +13638,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22678</v>
+<v>22583</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3988</v>
+<v>3971</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2421</v>
+<v>2411</v>
 </b>
 <b>
 <a>5</a>
 <b>70</b>
-<v>2382</v>
+<v>2372</v>
 </b>
 <b>
 <a>70</a>
@@ -13572,26 +13668,26 @@
 </relation>
 <relation>
 <name>anonymous_types</name>
-<cardinality>1215</cardinality>
+<cardinality>1210</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1215</v>
+<v>1210</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>implement</name>
-<cardinality>542813</cardinality>
+<cardinality>540550</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>226847</v>
+<v>225902</v>
 </e>
 <e>
 <k>super</k>
-<v>122813</v>
+<v>122301</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13605,27 +13701,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100993</v>
+<v>100572</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>57169</v>
+<v>56931</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>36189</v>
+<v>36038</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>19012</v>
+<v>18933</v>
 </b>
 <b>
 <a>7</a>
 <b>21</b>
-<v>13482</v>
+<v>13425</v>
 </b>
 </bs>
 </hist>
@@ -13641,27 +13737,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>67098</v>
+<v>66818</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29849</v>
+<v>29724</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10270</v>
+<v>10227</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>8713</v>
+<v>8676</v>
 </b>
 <b>
 <a>6</a>
 <b>21807</b>
-<v>6882</v>
+<v>6853</v>
 </b>
 </bs>
 </hist>
@@ -13671,15 +13767,15 @@
 </relation>
 <relation>
 <name>type_location</name>
-<cardinality>554904</cardinality>
+<cardinality>552591</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>467988</v>
+<v>466037</v>
 </e>
 <e>
 <k>loc</k>
-<v>29941</v>
+<v>29816</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13693,17 +13789,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>408280</v>
+<v>406578</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39318</v>
+<v>39154</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>20389</v>
+<v>20304</v>
 </b>
 </bs>
 </hist>
@@ -13719,17 +13815,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26061</v>
+<v>25952</v>
 </b>
 <b>
 <a>2</a>
 <b>26</b>
-<v>2274</v>
+<v>2265</v>
 </b>
 <b>
 <a>26</a>
 <b>12195</b>
-<v>1605</v>
+<v>1599</v>
 </b>
 </bs>
 </hist>
@@ -13739,15 +13835,15 @@
 </relation>
 <relation>
 <name>tuple_underlying_type</name>
-<cardinality>1786</cardinality>
+<cardinality>1779</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>1786</v>
+<v>1779</v>
 </e>
 <e>
 <k>struct</k>
-<v>1142</v>
+<v>1137</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13761,7 +13857,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1786</v>
+<v>1779</v>
 </b>
 </bs>
 </hist>
@@ -13777,17 +13873,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>644</v>
+<v>641</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>424</v>
+<v>422</v>
 </b>
 <b>
 <a>3</a>
 <b>9</b>
-<v>73</v>
+<v>72</v>
 </b>
 </bs>
 </hist>
@@ -13797,11 +13893,11 @@
 </relation>
 <relation>
 <name>tuple_element</name>
-<cardinality>6804</cardinality>
+<cardinality>6776</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>1781</v>
+<v>1774</v>
 </e>
 <e>
 <k>index</k>
@@ -13809,7 +13905,7 @@
 </e>
 <e>
 <k>field</k>
-<v>6804</v>
+<v>6776</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13828,12 +13924,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1137</v>
+<v>1132</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>146</v>
+<v>145</v>
 </b>
 <b>
 <a>4</a>
@@ -13843,17 +13939,17 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>141</v>
+<v>140</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>141</v>
+<v>140</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>107</v>
+<v>106</v>
 </b>
 </bs>
 </hist>
@@ -13874,12 +13970,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1137</v>
+<v>1132</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>146</v>
+<v>145</v>
 </b>
 <b>
 <a>4</a>
@@ -13889,17 +13985,17 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>141</v>
+<v>140</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>141</v>
+<v>140</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>107</v>
+<v>106</v>
 </b>
 </bs>
 </hist>
@@ -14147,7 +14243,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6804</v>
+<v>6776</v>
 </b>
 </bs>
 </hist>
@@ -14163,7 +14259,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6804</v>
+<v>6776</v>
 </b>
 </bs>
 </hist>
@@ -14173,19 +14269,19 @@
 </relation>
 <relation>
 <name>attributes</name>
-<cardinality>750912</cardinality>
+<cardinality>743932</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>750912</v>
+<v>743932</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1688</v>
+<v>1681</v>
 </e>
 <e>
 <k>target</k>
-<v>429992</v>
+<v>426172</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14199,7 +14295,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750912</v>
+<v>743932</v>
 </b>
 </bs>
 </hist>
@@ -14215,7 +14311,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>750912</v>
+<v>743932</v>
 </b>
 </bs>
 </hist>
@@ -14231,32 +14327,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185</v>
+<v>189</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>195</v>
+<v>194</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>92</v>
+<v>87</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>141</v>
+<v>140</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>146</v>
+<v>150</v>
 </b>
 <b>
 <a>10</a>
 <b>18</b>
-<v>136</v>
+<v>131</v>
 </b>
 <b>
 <a>18</a>
@@ -14285,11 +14381,11 @@
 </b>
 <b>
 <a>616</a>
-<b>5143</b>
+<b>4825</b>
 <v>126</v>
 </b>
 <b>
-<a>5204</a>
+<a>5142</a>
 <b>41857</b>
 <v>19</v>
 </b>
@@ -14307,7 +14403,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>312</v>
+<v>315</v>
 </b>
 <b>
 <a>2</a>
@@ -14317,52 +14413,52 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>82</v>
+<v>77</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>141</v>
+<v>140</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>136</v>
+<v>140</v>
 </b>
 <b>
 <a>9</a>
-<b>13</b>
+<b>15</b>
 <v>126</v>
 </b>
 <b>
-<a>14</a>
-<b>23</b>
+<a>15</a>
+<b>25</b>
 <v>126</v>
 </b>
 <b>
-<a>24</a>
-<b>46</b>
-<v>126</v>
-</b>
-<b>
-<a>46</a>
-<b>78</b>
+<a>25</a>
+<b>47</b>
 <v>131</v>
 </b>
 <b>
-<a>80</a>
-<b>173</b>
+<a>47</a>
+<b>81</b>
 <v>126</v>
 </b>
 <b>
-<a>175</a>
-<b>559</b>
+<a>81</a>
+<b>176</b>
 <v>126</v>
 </b>
 <b>
-<a>562</a>
+<a>180</a>
+<b>563</b>
+<v>126</v>
+</b>
+<b>
+<a>596</a>
 <b>39377</b>
-<v>117</v>
+<v>111</v>
 </b>
 </bs>
 </hist>
@@ -14378,17 +14474,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>366369</v>
+<v>364351</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48915</v>
+<v>47384</v>
 </b>
 <b>
 <a>3</a>
 <b>957</b>
-<v>14707</v>
+<v>14436</v>
 </b>
 </bs>
 </hist>
@@ -14404,17 +14500,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>395647</v>
+<v>393497</v>
 </b>
 <b>
 <a>2</a>
-<b>15</b>
-<v>33519</v>
+<b>16</b>
+<v>32305</v>
 </b>
 <b>
-<a>15</a>
+<a>16</a>
 <b>20</b>
-<v>824</v>
+<v>369</v>
 </b>
 </bs>
 </hist>
@@ -14424,15 +14520,15 @@
 </relation>
 <relation>
 <name>attribute_location</name>
-<cardinality>819118</cardinality>
+<cardinality>811854</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>750912</v>
+<v>743932</v>
 </e>
 <e>
 <k>loc</k>
-<v>72487</v>
+<v>72184</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14446,12 +14542,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>682706</v>
+<v>676010</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>68206</v>
+<v>67921</v>
 </b>
 </bs>
 </hist>
@@ -14467,12 +14563,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68274</v>
+<v>67989</v>
 </b>
 <b>
 <a>4</a>
-<b>26710</b>
-<v>4212</v>
+<b>26598</b>
+<v>4194</v>
 </b>
 </bs>
 </hist>
@@ -14482,19 +14578,19 @@
 </relation>
 <relation>
 <name>type_mention</name>
-<cardinality>1270028</cardinality>
+<cardinality>1246314</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1270028</v>
+<v>1246314</v>
 </e>
 <e>
 <k>type_id</k>
-<v>34479</v>
+<v>35250</v>
 </e>
 <e>
 <k>parent</k>
-<v>1029327</v>
+<v>1028293</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14508,7 +14604,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1270028</v>
+<v>1246314</v>
 </b>
 </bs>
 </hist>
@@ -14524,7 +14620,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1270028</v>
+<v>1246314</v>
 </b>
 </bs>
 </hist>
@@ -14540,52 +14636,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4967</v>
+<v>5804</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6801</v>
+<v>7126</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3386</v>
+<v>3598</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4028</v>
+<v>4000</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2098</v>
+<v>2063</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>2905</v>
+<v>2763</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>2804</v>
+<v>2845</v>
 </b>
 <b>
 <a>12</a>
-<b>20</b>
-<v>2617</v>
+<b>22</b>
+<v>2713</v>
 </b>
 <b>
-<a>20</a>
-<b>51</b>
-<v>2586</v>
+<a>22</a>
+<b>69</b>
+<v>2644</v>
 </b>
 <b>
-<a>51</a>
-<b>82737</b>
-<v>2281</v>
+<a>69</a>
+<b>80292</b>
+<v>1688</v>
 </b>
 </bs>
 </hist>
@@ -14601,52 +14697,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9472</v>
+<v>10003</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5707</v>
+<v>5779</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3313</v>
+<v>3438</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>3003</v>
+<v>2992</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>1948</v>
+<v>2029</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>2516</v>
+<v>2530</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>2763</v>
+<v>2749</v>
 </b>
 <b>
 <a>13</a>
 <b>29</b>
-<v>2631</v>
+<v>2675</v>
 </b>
 <b>
 <a>29</a>
-<b>206</b>
-<v>2589</v>
+<b>263</b>
+<v>2644</v>
 </b>
 <b>
-<a>206</a>
-<b>67616</b>
-<v>533</v>
+<a>263</a>
+<b>66416</b>
+<v>407</v>
 </b>
 </bs>
 </hist>
@@ -14662,17 +14758,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>871513</v>
+<v>874321</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137448</v>
+<v>137800</v>
 </b>
 <b>
 <a>3</a>
-<b>342</b>
-<v>20365</v>
+<b>182</b>
+<v>16171</v>
 </b>
 </bs>
 </hist>
@@ -14688,12 +14784,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1008634</v>
+<v>1009031</v>
 </b>
 <b>
 <a>2</a>
 <b>22</b>
-<v>20693</v>
+<v>19261</v>
 </b>
 </bs>
 </hist>
@@ -14703,15 +14799,15 @@
 </relation>
 <relation>
 <name>type_mention_location</name>
-<cardinality>1270028</cardinality>
+<cardinality>1246314</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1270028</v>
+<v>1246314</v>
 </e>
 <e>
 <k>loc</k>
-<v>1140490</v>
+<v>1165481</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14725,7 +14821,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1270028</v>
+<v>1246314</v>
 </b>
 </bs>
 </hist>
@@ -14741,12 +14837,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1077956</v>
+<v>1137104</v>
 </b>
 <b>
 <a>2</a>
 <b>199</b>
-<v>62533</v>
+<v>28376</v>
 </b>
 </bs>
 </hist>
@@ -14756,11 +14852,11 @@
 </relation>
 <relation>
 <name>type_annotation</name>
-<cardinality>51038</cardinality>
+<cardinality>50825</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>51038</v>
+<v>50825</v>
 </e>
 <e>
 <k>annotation</k>
@@ -14778,7 +14874,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51038</v>
+<v>50825</v>
 </b>
 </bs>
 </hist>
@@ -14814,11 +14910,11 @@
 </relation>
 <relation>
 <name>nullability</name>
-<cardinality>2001</cardinality>
+<cardinality>1992</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>2001</v>
+<v>1992</v>
 </e>
 <e>
 <k>kind</k>
@@ -14836,7 +14932,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2001</v>
+<v>1992</v>
 </b>
 </bs>
 </hist>
@@ -14872,11 +14968,11 @@
 </relation>
 <relation>
 <name>nullability_parent</name>
-<cardinality>6291</cardinality>
+<cardinality>6265</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>522</v>
+<v>520</v>
 </e>
 <e>
 <k>index</k>
@@ -14884,7 +14980,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>1986</v>
+<v>1978</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14898,12 +14994,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>341</v>
+<v>340</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>117</v>
+<v>116</v>
 </b>
 <b>
 <a>3</a>
@@ -14929,7 +15025,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>2</a>
@@ -14944,12 +15040,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>39</v>
+<v>38</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>39</v>
+<v>38</v>
 </b>
 <b>
 <a>8</a>
@@ -15127,17 +15223,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>595</v>
+<v>593</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1230</v>
+<v>1224</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>161</v>
+<v>160</v>
 </b>
 </bs>
 </hist>
@@ -15153,17 +15249,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>497</v>
+<v>495</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>722</v>
+<v>719</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>292</v>
+<v>291</v>
 </b>
 <b>
 <a>4</a>
@@ -15173,17 +15269,17 @@
 <b>
 <a>5</a>
 <b>8</b>
-<v>141</v>
+<v>140</v>
 </b>
 <b>
 <a>8</a>
 <b>15</b>
-<v>156</v>
+<v>155</v>
 </b>
 <b>
 <a>15</a>
 <b>22</b>
-<v>39</v>
+<v>38</v>
 </b>
 </bs>
 </hist>
@@ -15193,15 +15289,15 @@
 </relation>
 <relation>
 <name>type_nullability</name>
-<cardinality>4612058</cardinality>
+<cardinality>4590847</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4537587</v>
+<v>4523602</v>
 </e>
 <e>
 <k>nullability</k>
-<v>965</v>
+<v>953</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15215,12 +15311,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4471953</v>
+<v>4462766</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>65634</v>
+<v>60836</v>
 </b>
 </bs>
 </hist>
@@ -15236,62 +15332,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163</v>
+<v>159</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>144</v>
+<v>143</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>55</v>
+<v>59</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>68</v>
+<v>66</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>86</v>
+<v>85</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>65</v>
+<v>67</v>
 </b>
 <b>
 <a>10</a>
 <b>14</b>
-<v>74</v>
+<v>72</v>
 </b>
 <b>
 <a>14</a>
 <b>23</b>
-<v>77</v>
+<v>76</v>
 </b>
 <b>
 <a>23</a>
-<b>43</b>
-<v>73</v>
+<b>41</b>
+<v>72</v>
 </b>
 <b>
-<a>44</a>
-<b>121</b>
-<v>73</v>
+<a>41</a>
+<b>123</b>
+<v>72</v>
 </b>
 <b>
-<a>121</a>
-<b>2817</b>
-<v>73</v>
+<a>123</a>
+<b>4104</b>
+<v>72</v>
 </b>
 <b>
-<a>3109</a>
-<b>3683510</b>
-<v>14</v>
+<a>4576</a>
+<b>3672463</b>
+<v>10</v>
 </b>
 </bs>
 </hist>
@@ -15301,11 +15397,11 @@
 </relation>
 <relation>
 <name>expr_flowstate</name>
-<cardinality>2996275</cardinality>
+<cardinality>2975621</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2996275</v>
+<v>2975621</v>
 </e>
 <e>
 <k>state</k>
@@ -15323,7 +15419,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2996275</v>
+<v>2975621</v>
 </b>
 </bs>
 </hist>
@@ -15337,13 +15433,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>205843</a>
-<b>205844</b>
+<a>197302</a>
+<b>197303</b>
 <v>1</v>
 </b>
 <b>
-<a>2254382</a>
-<b>2254383</b>
+<a>2193035</a>
+<b>2193036</b>
 <v>1</v>
 </b>
 </bs>
@@ -15354,11 +15450,11 @@
 </relation>
 <relation>
 <name>type_parameters</name>
-<cardinality>203129</cardinality>
+<cardinality>202283</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>203129</v>
+<v>202283</v>
 </e>
 <e>
 <k>index</k>
@@ -15366,7 +15462,7 @@
 </e>
 <e>
 <k>generic_id</k>
-<v>103932</v>
+<v>103499</v>
 </e>
 <e>
 <k>variance</k>
@@ -15384,7 +15480,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203129</v>
+<v>202283</v>
 </b>
 </bs>
 </hist>
@@ -15400,7 +15496,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203129</v>
+<v>202283</v>
 </b>
 </bs>
 </hist>
@@ -15416,7 +15512,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>203129</v>
+<v>202283</v>
 </b>
 </bs>
 </hist>
@@ -15674,7 +15770,7 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>78</v>
+<v>77</v>
 </b>
 </bs>
 </hist>
@@ -15690,22 +15786,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80755</v>
+<v>80419</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10797</v>
+<v>10752</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8366</v>
+<v>8331</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>4012</v>
+<v>3995</v>
 </b>
 </bs>
 </hist>
@@ -15721,22 +15817,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80755</v>
+<v>80419</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10797</v>
+<v>10752</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8366</v>
+<v>8331</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>4012</v>
+<v>3995</v>
 </b>
 </bs>
 </hist>
@@ -15752,12 +15848,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>103781</v>
+<v>103348</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>151</v>
+<v>150</v>
 </b>
 </bs>
 </hist>
@@ -15845,11 +15941,11 @@
 </relation>
 <relation>
 <name>type_arguments</name>
-<cardinality>645178</cardinality>
+<cardinality>642489</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>273849</v>
+<v>272708</v>
 </e>
 <e>
 <k>index</k>
@@ -15857,7 +15953,7 @@
 </e>
 <e>
 <k>constructed_id</k>
-<v>413781</v>
+<v>412056</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15871,17 +15967,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235175</v>
+<v>234195</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37195</v>
+<v>37040</v>
 </b>
 <b>
 <a>3</a>
 <b>21</b>
-<v>1479</v>
+<v>1472</v>
 </b>
 </bs>
 </hist>
@@ -15897,27 +15993,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>174310</v>
+<v>173584</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>56593</v>
+<v>56357</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>20613</v>
+<v>20527</v>
 </b>
 <b>
 <a>5</a>
 <b>23</b>
-<v>20696</v>
+<v>20610</v>
 </b>
 <b>
 <a>23</a>
 <b>2800</b>
-<v>1635</v>
+<v>1628</v>
 </b>
 </bs>
 </hist>
@@ -16145,17 +16241,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>290680</v>
+<v>289468</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>96439</v>
+<v>96037</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>26661</v>
+<v>26550</v>
 </b>
 </bs>
 </hist>
@@ -16171,17 +16267,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>288513</v>
+<v>287310</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>97440</v>
+<v>97034</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27828</v>
+<v>27712</v>
 </b>
 </bs>
 </hist>
@@ -16191,15 +16287,15 @@
 </relation>
 <relation>
 <name>constructed_generic</name>
-<cardinality>413781</cardinality>
+<cardinality>412056</cardinality>
 <columnsizes>
 <e>
 <k>constructed</k>
-<v>413781</v>
+<v>412056</v>
 </e>
 <e>
 <k>generic</k>
-<v>8595</v>
+<v>8560</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16213,7 +16309,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>413781</v>
+<v>412056</v>
 </b>
 </bs>
 </hist>
@@ -16229,42 +16325,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3451</v>
+<v>3436</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1156</v>
+<v>1152</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>619</v>
+<v>617</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>654</v>
+<v>651</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>727</v>
+<v>724</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>649</v>
+<v>646</v>
 </b>
 <b>
 <a>26</a>
 <b>63</b>
-<v>658</v>
+<v>656</v>
 </b>
 <b>
 <a>63</a>
 <b>2866</b>
-<v>649</v>
+<v>646</v>
 </b>
 <b>
 <a>2964</a>
@@ -16279,15 +16375,15 @@
 </relation>
 <relation>
 <name>type_parameter_constraints</name>
-<cardinality>612122</cardinality>
+<cardinality>590676</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>612122</v>
+<v>590676</v>
 </e>
 <e>
 <k>param_id</k>
-<v>203041</v>
+<v>202195</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16301,7 +16397,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>612122</v>
+<v>590676</v>
 </b>
 </bs>
 </hist>
@@ -16317,22 +16413,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>164577</v>
+<v>166914</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17723</v>
+<v>19944</v>
 </b>
 <b>
 <a>3</a>
-<b>11</b>
-<v>16625</v>
+<b>307</b>
+<v>15170</v>
 </b>
 <b>
-<a>11</a>
-<b>2108</b>
-<v>4114</v>
+<a>310</a>
+<b>2107</b>
+<v>165</v>
 </b>
 </bs>
 </hist>
@@ -16378,11 +16474,11 @@
 </relation>
 <relation>
 <name>general_type_parameter_constraints</name>
-<cardinality>119043</cardinality>
+<cardinality>106685</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>68444</v>
+<v>60446</v>
 </e>
 <e>
 <k>kind</k>
@@ -16400,12 +16496,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17845</v>
+<v>14207</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>50599</v>
+<v>46239</v>
 </b>
 </bs>
 </hist>
@@ -16424,23 +16520,23 @@
 <v>1</v>
 </b>
 <b>
-<a>444</a>
-<b>445</b>
+<a>277</a>
+<b>278</b>
 <v>1</v>
 </b>
 <b>
-<a>5912</a>
-<b>5913</b>
+<a>5837</a>
+<b>5838</b>
 <v>1</v>
 </b>
 <b>
-<a>50478</a>
-<b>50479</b>
+<a>46182</a>
+<b>46183</b>
 <v>1</v>
 </b>
 <b>
-<a>62205</a>
-<b>62206</b>
+<a>54385</a>
+<b>54386</b>
 <v>1</v>
 </b>
 </bs>
@@ -16451,11 +16547,11 @@
 </relation>
 <relation>
 <name>specific_type_parameter_constraints</name>
-<cardinality>57247</cardinality>
+<cardinality>46329</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>56390</v>
+<v>45629</v>
 </e>
 <e>
 <k>base_id</k>
@@ -16473,12 +16569,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55581</v>
+<v>44975</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>809</v>
+<v>654</v>
 </b>
 </bs>
 </hist>
@@ -16494,32 +16590,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76</v>
+<v>97</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>215</v>
+<v>257</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>77</v>
+<v>74</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>97</v>
+<v>90</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>57</v>
+<v>60</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>115</v>
+<v>137</v>
 </b>
 <b>
 <a>7</a>
@@ -16528,33 +16624,28 @@
 </b>
 <b>
 <a>10</a>
-<b>13</b>
-<v>105</v>
+<b>15</b>
+<v>99</v>
 </b>
 <b>
-<a>13</a>
-<b>20</b>
-<v>93</v>
+<a>15</a>
+<b>21</b>
+<v>111</v>
 </b>
 <b>
-<a>20</a>
-<b>26</b>
-<v>108</v>
-</b>
-<b>
-<a>26</a>
-<b>51</b>
-<v>98</v>
-</b>
-<b>
-<a>51</a>
-<b>196</b>
+<a>21</a>
+<b>37</b>
 <v>97</v>
 </b>
 <b>
-<a>204</a>
-<b>8430</b>
-<v>41</v>
+<a>37</a>
+<b>106</b>
+<v>97</v>
+</b>
+<b>
+<a>108</a>
+<b>4902</b>
+<v>60</v>
 </b>
 </bs>
 </hist>
@@ -16564,15 +16655,15 @@
 </relation>
 <relation>
 <name>specific_type_parameter_nullability</name>
-<cardinality>39962</cardinality>
+<cardinality>31481</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>39721</v>
+<v>31339</v>
 </e>
 <e>
 <k>base_id</k>
-<v>927</v>
+<v>912</v>
 </e>
 <e>
 <k>nullability</k>
@@ -16590,12 +16681,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39480</v>
+<v>31197</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>241</v>
+<v>142</v>
 </b>
 </bs>
 </hist>
@@ -16611,7 +16702,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39721</v>
+<v>31339</v>
 </b>
 </bs>
 </hist>
@@ -16627,67 +16718,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24</v>
+<v>97</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>202</v>
+<v>151</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>55</v>
+<v>50</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>49</v>
+<v>39</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>50</v>
+<v>53</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>80</v>
+<v>102</v>
 </b>
 <b>
 <a>7</a>
-<b>10</b>
-<v>71</v>
+<b>9</b>
+<v>73</v>
 </b>
 <b>
-<a>10</a>
-<b>12</b>
-<v>53</v>
+<a>9</a>
+<b>13</b>
+<v>83</v>
 </b>
 <b>
-<a>12</a>
-<b>16</b>
-<v>71</v>
+<a>14</a>
+<b>20</b>
+<v>66</v>
 </b>
 <b>
-<a>16</a>
-<b>22</b>
+<a>20</a>
+<b>29</b>
 <v>70</v>
 </b>
 <b>
-<a>22</a>
-<b>33</b>
-<v>73</v>
+<a>29</a>
+<b>76</b>
+<v>71</v>
 </b>
 <b>
-<a>33</a>
-<b>93</b>
-<v>73</v>
-</b>
-<b>
-<a>95</a>
-<b>6991</b>
-<v>56</v>
+<a>77</a>
+<b>4327</b>
+<v>57</v>
 </b>
 </bs>
 </hist>
@@ -16703,12 +16789,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>895</v>
+<v>890</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32</v>
+<v>22</v>
 </b>
 </bs>
 </hist>
@@ -16747,6 +16833,11 @@
 <v>1</v>
 </b>
 <b>
+<a>12</a>
+<b>13</b>
+<v>1</v>
+</b>
+<b>
 <a>16</a>
 <b>17</b>
 <v>1</v>
@@ -16757,18 +16848,13 @@
 <v>1</v>
 </b>
 <b>
-<a>22</a>
-<b>23</b>
+<a>24</a>
+<b>25</b>
 <v>1</v>
 </b>
 <b>
-<a>30</a>
-<b>31</b>
-<v>1</v>
-</b>
-<b>
-<a>62</a>
-<b>63</b>
+<a>64</a>
+<b>65</b>
 <v>1</v>
 </b>
 <b>
@@ -16777,18 +16863,18 @@
 <v>1</v>
 </b>
 <b>
-<a>273</a>
-<b>274</b>
+<a>117</a>
+<b>118</b>
 <v>1</v>
 </b>
 <b>
-<a>390</a>
-<b>391</b>
+<a>386</a>
+<b>387</b>
 <v>1</v>
 </b>
 <b>
-<a>38794</a>
-<b>38795</b>
+<a>30586</a>
+<b>30587</b>
 <v>1</v>
 </b>
 </bs>
@@ -16823,9 +16909,9 @@
 <v>2</v>
 </b>
 <b>
-<a>8</a>
-<b>9</b>
-<v>1</v>
+<a>9</a>
+<b>10</b>
+<v>2</v>
 </b>
 <b>
 <a>12</a>
@@ -16833,18 +16919,13 @@
 <v>1</v>
 </b>
 <b>
-<a>20</a>
-<b>21</b>
+<a>43</a>
+<b>44</b>
 <v>1</v>
 </b>
 <b>
-<a>44</a>
-<b>45</b>
-<v>1</v>
-</b>
-<b>
-<a>850</a>
-<b>851</b>
+<a>836</a>
+<b>837</b>
 <v>1</v>
 </b>
 </bs>
@@ -16854,6 +16935,134 @@
 </dependencies>
 </relation>
 <relation>
+<name>function_pointer_calling_conventions</name>
+<cardinality>11</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>11</v>
+</e>
+<e>
+<k>kind</k>
+<v>1</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>11</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>9</a>
+<b>10</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>has_unmanaged_calling_conventions</name>
+<cardinality>0</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>0</v>
+</e>
+<e>
+<k>index</k>
+<v>0</v>
+</e>
+<e>
+<k>conv_id</k>
+<v>0</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs/>
+</hist>
+</val>
+</dep>
+<dep>
+<src>id</src>
+<trg>conv_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs/>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs/>
+</hist>
+</val>
+</dep>
+<dep>
+<src>index</src>
+<trg>conv_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs/>
+</hist>
+</val>
+</dep>
+<dep>
+<src>conv_id</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs/>
+</hist>
+</val>
+</dep>
+<dep>
+<src>conv_id</src>
+<trg>index</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs/>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
 <name>modifiers</name>
 <cardinality>82</cardinality>
 <columnsizes>
@@ -16903,11 +17112,11 @@
 </relation>
 <relation>
 <name>has_modifiers</name>
-<cardinality>5507681</cardinality>
+<cardinality>5484722</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3698681</v>
+<v>3683263</v>
 </e>
 <e>
 <k>mod_id</k>
@@ -16925,17 +17134,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2025460</v>
+<v>2017016</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1539288</v>
+<v>1532872</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>133932</v>
+<v>133374</v>
 </b>
 </bs>
 </hist>
@@ -17041,26 +17250,26 @@
 </relation>
 <relation>
 <name>compiler_generated</name>
-<cardinality>136139</cardinality>
+<cardinality>135571</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>136139</v>
+<v>135571</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>exprorstmt_name</name>
-<cardinality>3710</cardinality>
+<cardinality>3758</cardinality>
 <columnsizes>
 <e>
 <k>parent_id</k>
-<v>3710</v>
+<v>3758</v>
 </e>
 <e>
 <k>name</k>
-<v>366</v>
+<v>374</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17074,7 +17283,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3710</v>
+<v>3758</v>
 </b>
 </bs>
 </hist>
@@ -17090,47 +17299,47 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>107</v>
+<v>110</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>54</v>
+<v>56</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>46</v>
+<v>51</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>32</v>
+<v>34</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>31</v>
+<v>32</v>
 </b>
 <b>
 <a>8</a>
-<b>11</b>
-<v>30</v>
-</b>
-<b>
-<a>11</a>
-<b>21</b>
-<v>29</v>
-</b>
-<b>
-<a>21</a>
-<b>85</b>
+<b>12</b>
 <v>28</v>
 </b>
 <b>
-<a>118</a>
+<a>12</a>
+<b>23</b>
+<v>31</v>
+</b>
+<b>
+<a>25</a>
+<b>214</b>
+<v>28</v>
+</b>
+<b>
+<a>239</a>
 <b>240</b>
-<v>6</v>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -17140,19 +17349,19 @@
 </relation>
 <relation>
 <name>nested_types</name>
-<cardinality>112176</cardinality>
+<cardinality>111709</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>112176</v>
+<v>111709</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>40685</v>
+<v>40515</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>81292</v>
+<v>80954</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17166,7 +17375,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112176</v>
+<v>111709</v>
 </b>
 </bs>
 </hist>
@@ -17182,7 +17391,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112176</v>
+<v>111709</v>
 </b>
 </bs>
 </hist>
@@ -17198,32 +17407,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23537</v>
+<v>23439</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6350</v>
+<v>6324</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3236</v>
+<v>3222</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3363</v>
+<v>3349</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>3099</v>
+<v>3086</v>
 </b>
 <b>
 <a>12</a>
 <b>262</b>
-<v>1098</v>
+<v>1093</v>
 </b>
 </bs>
 </hist>
@@ -17239,32 +17448,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23571</v>
+<v>23473</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6433</v>
+<v>6406</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3153</v>
+<v>3140</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3392</v>
+<v>3378</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>3084</v>
+<v>3072</v>
 </b>
 <b>
 <a>12</a>
 <b>206</b>
-<v>1049</v>
+<v>1045</v>
 </b>
 </bs>
 </hist>
@@ -17280,12 +17489,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78271</v>
+<v>77945</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>3021</v>
+<v>3008</v>
 </b>
 </bs>
 </hist>
@@ -17301,12 +17510,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>79013</v>
+<v>78683</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>2279</v>
+<v>2270</v>
 </b>
 </bs>
 </hist>
@@ -17316,27 +17525,27 @@
 </relation>
 <relation>
 <name>properties</name>
-<cardinality>424457</cardinality>
+<cardinality>422687</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>424457</v>
+<v>422687</v>
 </e>
 <e>
 <k>name</k>
-<v>84543</v>
+<v>84191</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>116628</v>
+<v>116142</v>
 </e>
 <e>
 <k>type_id</k>
-<v>52239</v>
+<v>52021</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>334573</v>
+<v>333178</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17350,7 +17559,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424457</v>
+<v>422687</v>
 </b>
 </bs>
 </hist>
@@ -17366,7 +17575,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424457</v>
+<v>422687</v>
 </b>
 </bs>
 </hist>
@@ -17382,7 +17591,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424457</v>
+<v>422687</v>
 </b>
 </bs>
 </hist>
@@ -17398,7 +17607,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>424457</v>
+<v>422687</v>
 </b>
 </bs>
 </hist>
@@ -17414,32 +17623,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50862</v>
+<v>50650</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14023</v>
+<v>13965</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5764</v>
+<v>5740</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6662</v>
+<v>6635</v>
 </b>
 <b>
 <a>7</a>
 <b>49</b>
-<v>6350</v>
+<v>6324</v>
 </b>
 <b>
 <a>49</a>
 <b>2611</b>
-<v>878</v>
+<v>874</v>
 </b>
 </bs>
 </hist>
@@ -17455,32 +17664,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50862</v>
+<v>50650</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14092</v>
+<v>14033</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5750</v>
+<v>5726</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6697</v>
+<v>6669</v>
 </b>
 <b>
 <a>7</a>
 <b>51</b>
-<v>6345</v>
+<v>6319</v>
 </b>
 <b>
 <a>51</a>
 <b>2578</b>
-<v>795</v>
+<v>792</v>
 </b>
 </bs>
 </hist>
@@ -17496,17 +17705,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72994</v>
+<v>72690</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6946</v>
+<v>6917</v>
 </b>
 <b>
 <a>3</a>
 <b>524</b>
-<v>4603</v>
+<v>4583</v>
 </b>
 </bs>
 </hist>
@@ -17522,32 +17731,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51292</v>
+<v>51078</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14287</v>
+<v>14227</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5750</v>
+<v>5726</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6457</v>
+<v>6431</v>
 </b>
 <b>
 <a>7</a>
 <b>68</b>
-<v>6340</v>
+<v>6314</v>
 </b>
 <b>
 <a>68</a>
 <b>2018</b>
-<v>414</v>
+<v>413</v>
 </b>
 </bs>
 </hist>
@@ -17563,42 +17772,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39470</v>
+<v>39305</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29932</v>
+<v>29807</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10924</v>
+<v>10878</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7858</v>
+<v>7826</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7146</v>
+<v>7116</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9347</v>
+<v>9308</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>9586</v>
+<v>9546</v>
 </b>
 <b>
 <a>16</a>
 <b>250</b>
-<v>2362</v>
+<v>2352</v>
 </b>
 </bs>
 </hist>
@@ -17614,42 +17823,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43990</v>
+<v>43806</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25490</v>
+<v>25383</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10919</v>
+<v>10873</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7878</v>
+<v>7845</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7160</v>
+<v>7130</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9303</v>
+<v>9264</v>
 </b>
 <b>
 <a>8</a>
 <b>14</b>
-<v>8761</v>
+<v>8725</v>
 </b>
 <b>
 <a>14</a>
 <b>250</b>
-<v>3124</v>
+<v>3111</v>
 </b>
 </bs>
 </hist>
@@ -17665,32 +17874,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>45547</v>
+<v>45357</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32685</v>
+<v>32548</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13867</v>
+<v>13809</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7561</v>
+<v>7529</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>9401</v>
+<v>9362</v>
 </b>
 <b>
 <a>7</a>
 <b>48</b>
-<v>7565</v>
+<v>7534</v>
 </b>
 </bs>
 </hist>
@@ -17706,42 +17915,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39470</v>
+<v>39305</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29932</v>
+<v>29807</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10924</v>
+<v>10878</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7858</v>
+<v>7826</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7146</v>
+<v>7116</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9347</v>
+<v>9308</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>9586</v>
+<v>9546</v>
 </b>
 <b>
 <a>16</a>
 <b>250</b>
-<v>2362</v>
+<v>2352</v>
 </b>
 </bs>
 </hist>
@@ -17757,27 +17966,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31484</v>
+<v>31353</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10802</v>
+<v>10757</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4642</v>
+<v>4622</v>
 </b>
 <b>
 <a>5</a>
 <b>21</b>
-<v>3953</v>
+<v>3937</v>
 </b>
 <b>
 <a>21</a>
 <b>12516</b>
-<v>1356</v>
+<v>1351</v>
 </b>
 </bs>
 </hist>
@@ -17793,17 +18002,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44170</v>
+<v>43986</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4407</v>
+<v>4389</v>
 </b>
 <b>
 <a>3</a>
 <b>3289</b>
-<v>3660</v>
+<v>3645</v>
 </b>
 </bs>
 </hist>
@@ -17819,27 +18028,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32670</v>
+<v>32534</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10504</v>
+<v>10460</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4432</v>
+<v>4413</v>
 </b>
 <b>
 <a>5</a>
 <b>33</b>
-<v>3919</v>
+<v>3903</v>
 </b>
 <b>
 <a>33</a>
 <b>6176</b>
-<v>712</v>
+<v>709</v>
 </b>
 </bs>
 </hist>
@@ -17855,27 +18064,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31625</v>
+<v>31494</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10934</v>
+<v>10888</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4676</v>
+<v>4656</v>
 </b>
 <b>
 <a>5</a>
 <b>22</b>
-<v>3919</v>
+<v>3903</v>
 </b>
 <b>
 <a>22</a>
 <b>10632</b>
-<v>1083</v>
+<v>1079</v>
 </b>
 </bs>
 </hist>
@@ -17891,12 +18100,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>329389</v>
+<v>328016</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5183</v>
+<v>5162</v>
 </b>
 </bs>
 </hist>
@@ -17912,7 +18121,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>334573</v>
+<v>333178</v>
 </b>
 </bs>
 </hist>
@@ -17928,12 +18137,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>329389</v>
+<v>328016</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5183</v>
+<v>5162</v>
 </b>
 </bs>
 </hist>
@@ -17949,12 +18158,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>333362</v>
+<v>331972</v>
 </b>
 <b>
 <a>2</a>
 <b>439</b>
-<v>1210</v>
+<v>1205</v>
 </b>
 </bs>
 </hist>
@@ -17964,15 +18173,15 @@
 </relation>
 <relation>
 <name>property_location</name>
-<cardinality>535613</cardinality>
+<cardinality>533380</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>424457</v>
+<v>422687</v>
 </e>
 <e>
 <k>loc</k>
-<v>53010</v>
+<v>52789</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17986,17 +18195,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>338844</v>
+<v>337431</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>64247</v>
+<v>63979</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>21365</v>
+<v>21276</v>
 </b>
 </bs>
 </hist>
@@ -18012,12 +18221,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49520</v>
+<v>49314</v>
 </b>
 <b>
 <a>2</a>
 <b>7080</b>
-<v>3490</v>
+<v>3475</v>
 </b>
 </bs>
 </hist>
@@ -18027,11 +18236,11 @@
 </relation>
 <relation>
 <name>indexers</name>
-<cardinality>17079</cardinality>
+<cardinality>17008</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>17079</v>
+<v>17008</v>
 </e>
 <e>
 <k>name</k>
@@ -18039,15 +18248,15 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>13579</v>
+<v>13523</v>
 </e>
 <e>
 <k>type_id</k>
-<v>3978</v>
+<v>3961</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>4446</v>
+<v>4428</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18061,7 +18270,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17079</v>
+<v>17008</v>
 </b>
 </bs>
 </hist>
@@ -18077,7 +18286,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17079</v>
+<v>17008</v>
 </b>
 </bs>
 </hist>
@@ -18093,7 +18302,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17079</v>
+<v>17008</v>
 </b>
 </bs>
 </hist>
@@ -18109,7 +18318,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17079</v>
+<v>17008</v>
 </b>
 </bs>
 </hist>
@@ -18244,17 +18453,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10528</v>
+<v>10485</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2753</v>
+<v>2741</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>297</v>
+<v>296</v>
 </b>
 </bs>
 </hist>
@@ -18270,7 +18479,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13569</v>
+<v>13513</v>
 </b>
 <b>
 <a>2</a>
@@ -18291,12 +18500,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11070</v>
+<v>11024</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2508</v>
+<v>2498</v>
 </b>
 </bs>
 </hist>
@@ -18312,17 +18521,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10528</v>
+<v>10485</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2753</v>
+<v>2741</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>297</v>
+<v>296</v>
 </b>
 </bs>
 </hist>
@@ -18338,27 +18547,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>878</v>
+<v>874</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>873</v>
+<v>870</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1630</v>
+<v>1623</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>6</a>
 <b>18</b>
-<v>302</v>
+<v>301</v>
 </b>
 <b>
 <a>18</a>
@@ -18379,7 +18588,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3973</v>
+<v>3956</v>
 </b>
 <b>
 <a>2</a>
@@ -18400,27 +18609,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1034</v>
+<v>1030</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>781</v>
+<v>777</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1664</v>
+<v>1657</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>6</a>
 <b>978</b>
-<v>258</v>
+<v>257</v>
 </b>
 </bs>
 </hist>
@@ -18436,27 +18645,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>878</v>
+<v>874</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>873</v>
+<v>870</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1654</v>
+<v>1647</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>6</a>
 <b>198</b>
-<v>302</v>
+<v>301</v>
 </b>
 </bs>
 </hist>
@@ -18472,12 +18681,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4110</v>
+<v>4092</v>
 </b>
 <b>
 <a>2</a>
 <b>452</b>
-<v>336</v>
+<v>335</v>
 </b>
 </bs>
 </hist>
@@ -18493,7 +18702,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4446</v>
+<v>4428</v>
 </b>
 </bs>
 </hist>
@@ -18509,12 +18718,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4110</v>
+<v>4092</v>
 </b>
 <b>
 <a>2</a>
 <b>452</b>
-<v>336</v>
+<v>335</v>
 </b>
 </bs>
 </hist>
@@ -18530,12 +18739,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4256</v>
+<v>4238</v>
 </b>
 <b>
 <a>2</a>
 <b>452</b>
-<v>190</v>
+<v>189</v>
 </b>
 </bs>
 </hist>
@@ -18545,15 +18754,15 @@
 </relation>
 <relation>
 <name>indexer_location</name>
-<cardinality>23899</cardinality>
+<cardinality>23715</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12715</v>
+<v>12621</v>
 </e>
 <e>
 <k>loc</k>
-<v>220</v>
+<v>221</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18567,17 +18776,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4499</v>
+<v>4492</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6699</v>
+<v>6615</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>288</v>
+<v>285</v>
 </b>
 <b>
 <a>4</a>
@@ -18603,12 +18812,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75</v>
+<v>76</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22</v>
+<v>23</v>
 </b>
 <b>
 <a>3</a>
@@ -18623,17 +18832,17 @@
 <b>
 <a>5</a>
 <b>8</b>
-<v>17</v>
+<v>18</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>17</v>
+<v>16</v>
 </b>
 <b>
 <a>13</a>
 <b>21</b>
-<v>19</v>
+<v>18</v>
 </b>
 <b>
 <a>23</a>
@@ -18642,12 +18851,12 @@
 </b>
 <b>
 <a>47</a>
-<b>2441</b>
+<b>2230</b>
 <v>17</v>
 </b>
 <b>
 <a>3540</a>
-<b>5342</b>
+<b>5425</b>
 <v>3</v>
 </b>
 </bs>
@@ -18658,11 +18867,11 @@
 </relation>
 <relation>
 <name>accessors</name>
-<cardinality>569109</cardinality>
+<cardinality>566736</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>569109</v>
+<v>566736</v>
 </e>
 <e>
 <k>kind</k>
@@ -18670,15 +18879,15 @@
 </e>
 <e>
 <k>name</k>
-<v>121509</v>
+<v>121003</v>
 </e>
 <e>
 <k>declaring_member_id</k>
-<v>441536</v>
+<v>439696</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>441385</v>
+<v>439545</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18692,7 +18901,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>569109</v>
+<v>566736</v>
 </b>
 </bs>
 </hist>
@@ -18708,7 +18917,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>569109</v>
+<v>566736</v>
 </b>
 </bs>
 </hist>
@@ -18724,7 +18933,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>569109</v>
+<v>566736</v>
 </b>
 </bs>
 </hist>
@@ -18740,7 +18949,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>569109</v>
+<v>566736</v>
 </b>
 </bs>
 </hist>
@@ -18840,27 +19049,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75357</v>
+<v>75043</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19993</v>
+<v>19910</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7946</v>
+<v>7913</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10148</v>
+<v>10105</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8063</v>
+<v>8030</v>
 </b>
 </bs>
 </hist>
@@ -18876,7 +19085,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>121509</v>
+<v>121003</v>
 </b>
 </bs>
 </hist>
@@ -18892,27 +19101,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75367</v>
+<v>75052</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19983</v>
+<v>19900</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7946</v>
+<v>7913</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10148</v>
+<v>10105</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8063</v>
+<v>8030</v>
 </b>
 </bs>
 </hist>
@@ -18928,27 +19137,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76006</v>
+<v>75689</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20662</v>
+<v>20576</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7780</v>
+<v>7748</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>9674</v>
+<v>9634</v>
 </b>
 <b>
 <a>8</a>
 <b>1202</b>
-<v>7385</v>
+<v>7354</v>
 </b>
 </bs>
 </hist>
@@ -18964,12 +19173,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313974</v>
+<v>312665</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127557</v>
+<v>127026</v>
 </b>
 <b>
 <a>4</a>
@@ -18990,12 +19199,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313974</v>
+<v>312665</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127562</v>
+<v>127030</v>
 </b>
 </bs>
 </hist>
@@ -19011,12 +19220,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313974</v>
+<v>312665</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127562</v>
+<v>127030</v>
 </b>
 </bs>
 </hist>
@@ -19032,12 +19241,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>313974</v>
+<v>312665</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127557</v>
+<v>127026</v>
 </b>
 <b>
 <a>4</a>
@@ -19058,12 +19267,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434707</v>
+<v>432895</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6677</v>
+<v>6649</v>
 </b>
 </bs>
 </hist>
@@ -19079,7 +19288,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441385</v>
+<v>439545</v>
 </b>
 </bs>
 </hist>
@@ -19095,7 +19304,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>441385</v>
+<v>439545</v>
 </b>
 </bs>
 </hist>
@@ -19111,12 +19320,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>434707</v>
+<v>432895</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6677</v>
+<v>6649</v>
 </b>
 </bs>
 </hist>
@@ -19137,15 +19346,15 @@
 </relation>
 <relation>
 <name>accessor_location</name>
-<cardinality>749399</cardinality>
+<cardinality>746275</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>569109</v>
+<v>566736</v>
 </e>
 <e>
 <k>loc</k>
-<v>93418</v>
+<v>93028</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19159,17 +19368,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>433653</v>
+<v>431845</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98621</v>
+<v>98210</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>36834</v>
+<v>36680</v>
 </b>
 </bs>
 </hist>
@@ -19185,12 +19394,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89805</v>
+<v>89431</v>
 </b>
 <b>
 <a>2</a>
 <b>8294</b>
-<v>3612</v>
+<v>3597</v>
 </b>
 </bs>
 </hist>
@@ -19200,27 +19409,27 @@
 </relation>
 <relation>
 <name>events</name>
-<cardinality>15263</cardinality>
+<cardinality>15200</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15263</v>
+<v>15200</v>
 </e>
 <e>
 <k>name</k>
-<v>13018</v>
+<v>12964</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>1230</v>
+<v>1224</v>
 </e>
 <e>
 <k>type_id</k>
-<v>6379</v>
+<v>6353</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>15254</v>
+<v>15190</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19234,7 +19443,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15263</v>
+<v>15200</v>
 </b>
 </bs>
 </hist>
@@ -19250,7 +19459,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15263</v>
+<v>15200</v>
 </b>
 </bs>
 </hist>
@@ -19266,7 +19475,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15263</v>
+<v>15200</v>
 </b>
 </bs>
 </hist>
@@ -19282,7 +19491,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15263</v>
+<v>15200</v>
 </b>
 </bs>
 </hist>
@@ -19298,12 +19507,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12027</v>
+<v>11977</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>981</v>
+<v>977</v>
 </b>
 <b>
 <a>14</a>
@@ -19324,12 +19533,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12027</v>
+<v>11977</v>
 </b>
 <b>
 <a>2</a>
 <b>10</b>
-<v>981</v>
+<v>977</v>
 </b>
 <b>
 <a>14</a>
@@ -19350,12 +19559,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12876</v>
+<v>12823</v>
 </b>
 <b>
 <a>2</a>
 <b>10</b>
-<v>141</v>
+<v>140</v>
 </b>
 </bs>
 </hist>
@@ -19371,12 +19580,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12027</v>
+<v>11977</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>981</v>
+<v>977</v>
 </b>
 <b>
 <a>14</a>
@@ -19397,12 +19606,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>619</v>
+<v>617</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>229</v>
+<v>228</v>
 </b>
 <b>
 <a>3</a>
@@ -19412,7 +19621,7 @@
 <b>
 <a>4</a>
 <b>8</b>
-<v>107</v>
+<v>106</v>
 </b>
 <b>
 <a>8</a>
@@ -19422,7 +19631,7 @@
 <b>
 <a>58</a>
 <b>465</b>
-<v>73</v>
+<v>72</v>
 </b>
 </bs>
 </hist>
@@ -19438,12 +19647,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>619</v>
+<v>617</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>3</a>
@@ -19463,7 +19672,7 @@
 <b>
 <a>58</a>
 <b>465</b>
-<v>73</v>
+<v>72</v>
 </b>
 </bs>
 </hist>
@@ -19479,12 +19688,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>771</v>
+<v>768</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>200</v>
+<v>199</v>
 </b>
 <b>
 <a>3</a>
@@ -19499,7 +19708,7 @@
 <b>
 <a>12</a>
 <b>181</b>
-<v>78</v>
+<v>77</v>
 </b>
 </bs>
 </hist>
@@ -19515,12 +19724,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>619</v>
+<v>617</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>229</v>
+<v>228</v>
 </b>
 <b>
 <a>3</a>
@@ -19530,7 +19739,7 @@
 <b>
 <a>4</a>
 <b>8</b>
-<v>107</v>
+<v>106</v>
 </b>
 <b>
 <a>8</a>
@@ -19540,7 +19749,7 @@
 <b>
 <a>58</a>
 <b>465</b>
-<v>73</v>
+<v>72</v>
 </b>
 </bs>
 </hist>
@@ -19556,22 +19765,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4422</v>
+<v>4404</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1166</v>
+<v>1161</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>517</v>
+<v>515</v>
 </b>
 <b>
 <a>6</a>
 <b>318</b>
-<v>273</v>
+<v>272</v>
 </b>
 </bs>
 </hist>
@@ -19587,22 +19796,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4812</v>
+<v>4792</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>917</v>
+<v>913</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>502</v>
+<v>500</v>
 </b>
 <b>
 <a>8</a>
 <b>242</b>
-<v>146</v>
+<v>145</v>
 </b>
 </bs>
 </hist>
@@ -19618,12 +19827,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5764</v>
+<v>5740</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>522</v>
+<v>520</v>
 </b>
 <b>
 <a>4</a>
@@ -19644,22 +19853,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4422</v>
+<v>4404</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1166</v>
+<v>1161</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>517</v>
+<v>515</v>
 </b>
 <b>
 <a>6</a>
 <b>318</b>
-<v>273</v>
+<v>272</v>
 </b>
 </bs>
 </hist>
@@ -19675,7 +19884,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15244</v>
+<v>15180</v>
 </b>
 <b>
 <a>2</a>
@@ -19696,7 +19905,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15254</v>
+<v>15190</v>
 </b>
 </bs>
 </hist>
@@ -19712,7 +19921,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15244</v>
+<v>15180</v>
 </b>
 <b>
 <a>2</a>
@@ -19733,7 +19942,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15244</v>
+<v>15180</v>
 </b>
 <b>
 <a>2</a>
@@ -19748,15 +19957,15 @@
 </relation>
 <relation>
 <name>event_location</name>
-<cardinality>15903</cardinality>
+<cardinality>15836</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15263</v>
+<v>15200</v>
 </e>
 <e>
 <k>loc</k>
-<v>327</v>
+<v>325</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19770,12 +19979,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14624</v>
+<v>14563</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>639</v>
+<v>636</v>
 </b>
 </bs>
 </hist>
@@ -19851,11 +20060,11 @@
 </relation>
 <relation>
 <name>event_accessors</name>
-<cardinality>30527</cardinality>
+<cardinality>30400</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30527</v>
+<v>30400</v>
 </e>
 <e>
 <k>kind</k>
@@ -19863,15 +20072,15 @@
 </e>
 <e>
 <k>name</k>
-<v>26749</v>
+<v>26637</v>
 </e>
 <e>
 <k>declaring_event_id</k>
-<v>15263</v>
+<v>15200</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>30508</v>
+<v>30380</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19885,7 +20094,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30527</v>
+<v>30400</v>
 </b>
 </bs>
 </hist>
@@ -19901,7 +20110,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30527</v>
+<v>30400</v>
 </b>
 </bs>
 </hist>
@@ -19917,7 +20126,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30527</v>
+<v>30400</v>
 </b>
 </bs>
 </hist>
@@ -19933,7 +20142,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30527</v>
+<v>30400</v>
 </b>
 </bs>
 </hist>
@@ -20013,12 +20222,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24757</v>
+<v>24654</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1991</v>
+<v>1983</v>
 </b>
 </bs>
 </hist>
@@ -20034,7 +20243,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26749</v>
+<v>26637</v>
 </b>
 </bs>
 </hist>
@@ -20050,12 +20259,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24757</v>
+<v>24654</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1991</v>
+<v>1983</v>
 </b>
 </bs>
 </hist>
@@ -20071,12 +20280,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24757</v>
+<v>24654</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1991</v>
+<v>1983</v>
 </b>
 </bs>
 </hist>
@@ -20092,7 +20301,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15263</v>
+<v>15200</v>
 </b>
 </bs>
 </hist>
@@ -20108,7 +20317,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15263</v>
+<v>15200</v>
 </b>
 </bs>
 </hist>
@@ -20124,7 +20333,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15263</v>
+<v>15200</v>
 </b>
 </bs>
 </hist>
@@ -20140,7 +20349,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15263</v>
+<v>15200</v>
 </b>
 </bs>
 </hist>
@@ -20156,7 +20365,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30488</v>
+<v>30361</v>
 </b>
 <b>
 <a>2</a>
@@ -20177,7 +20386,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30508</v>
+<v>30380</v>
 </b>
 </bs>
 </hist>
@@ -20193,7 +20402,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30508</v>
+<v>30380</v>
 </b>
 </bs>
 </hist>
@@ -20209,7 +20418,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30488</v>
+<v>30361</v>
 </b>
 <b>
 <a>2</a>
@@ -20224,15 +20433,15 @@
 </relation>
 <relation>
 <name>event_accessor_location</name>
-<cardinality>31806</cardinality>
+<cardinality>31673</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30527</v>
+<v>30400</v>
 </e>
 <e>
 <k>loc</k>
-<v>327</v>
+<v>325</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20246,12 +20455,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29248</v>
+<v>29126</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1278</v>
+<v>1273</v>
 </b>
 </bs>
 </hist>
@@ -20327,11 +20536,11 @@
 </relation>
 <relation>
 <name>operators</name>
-<cardinality>12437</cardinality>
+<cardinality>12385</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12437</v>
+<v>12385</v>
 </e>
 <e>
 <k>name</k>
@@ -20339,19 +20548,19 @@
 </e>
 <e>
 <k>symbol</k>
-<v>117</v>
+<v>116</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>3031</v>
+<v>3018</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1625</v>
+<v>1618</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>11680</v>
+<v>11632</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20365,7 +20574,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12437</v>
+<v>12385</v>
 </b>
 </bs>
 </hist>
@@ -20381,7 +20590,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12437</v>
+<v>12385</v>
 </b>
 </bs>
 </hist>
@@ -20397,7 +20606,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12437</v>
+<v>12385</v>
 </b>
 </bs>
 </hist>
@@ -20413,7 +20622,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12437</v>
+<v>12385</v>
 </b>
 </bs>
 </hist>
@@ -20429,7 +20638,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12437</v>
+<v>12385</v>
 </b>
 </bs>
 </hist>
@@ -20623,7 +20832,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>39</v>
+<v>38</v>
 </b>
 <b>
 <a>3</a>
@@ -20831,7 +21040,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107</v>
+<v>106</v>
 </b>
 <b>
 <a>2</a>
@@ -20928,7 +21137,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>39</v>
+<v>38</v>
 </b>
 <b>
 <a>3</a>
@@ -21050,12 +21259,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>473</v>
+<v>471</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1571</v>
+<v>1565</v>
 </b>
 <b>
 <a>3</a>
@@ -21065,22 +21274,22 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>287</v>
+<v>286</v>
 </b>
 <b>
 <a>7</a>
 <b>16</b>
-<v>229</v>
+<v>228</v>
 </b>
 <b>
 <a>16</a>
 <b>73</b>
-<v>112</v>
+<v>111</v>
 </b>
 </bs>
 </hist>
@@ -21096,27 +21305,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>629</v>
+<v>627</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1542</v>
+<v>1536</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>273</v>
+<v>272</v>
 </b>
 <b>
 <a>5</a>
 <b>10</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>10</a>
@@ -21137,32 +21346,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>629</v>
+<v>627</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1547</v>
+<v>1540</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>273</v>
+<v>272</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>229</v>
+<v>228</v>
 </b>
 <b>
 <a>9</a>
 <b>22</b>
-<v>112</v>
+<v>111</v>
 </b>
 </bs>
 </hist>
@@ -21178,22 +21387,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2025</v>
+<v>2017</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>419</v>
+<v>418</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>292</v>
+<v>291</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>8</a>
@@ -21214,12 +21423,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>473</v>
+<v>471</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1571</v>
+<v>1565</v>
 </b>
 <b>
 <a>3</a>
@@ -21229,22 +21438,22 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>287</v>
+<v>286</v>
 </b>
 <b>
 <a>7</a>
 <b>16</b>
-<v>229</v>
+<v>228</v>
 </b>
 <b>
 <a>16</a>
 <b>73</b>
-<v>112</v>
+<v>111</v>
 </b>
 </bs>
 </hist>
@@ -21260,17 +21469,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>795</v>
+<v>792</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>370</v>
+<v>369</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>122</v>
+<v>121</v>
 </b>
 <b>
 <a>5</a>
@@ -21301,17 +21510,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1210</v>
+<v>1205</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>151</v>
+<v>150</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>117</v>
+<v>116</v>
 </b>
 <b>
 <a>5</a>
@@ -21337,12 +21546,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1210</v>
+<v>1205</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>161</v>
+<v>160</v>
 </b>
 <b>
 <a>3</a>
@@ -21352,7 +21561,7 @@
 <b>
 <a>5</a>
 <b>14</b>
-<v>122</v>
+<v>121</v>
 </b>
 <b>
 <a>15</a>
@@ -21373,12 +21582,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1269</v>
+<v>1263</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>122</v>
+<v>121</v>
 </b>
 <b>
 <a>3</a>
@@ -21388,7 +21597,7 @@
 <b>
 <a>6</a>
 <b>501</b>
-<v>107</v>
+<v>106</v>
 </b>
 </bs>
 </hist>
@@ -21404,17 +21613,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>795</v>
+<v>792</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>370</v>
+<v>369</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>122</v>
+<v>121</v>
 </b>
 <b>
 <a>5</a>
@@ -21445,12 +21654,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11534</v>
+<v>11486</v>
 </b>
 <b>
 <a>2</a>
 <b>26</b>
-<v>146</v>
+<v>145</v>
 </b>
 </bs>
 </hist>
@@ -21466,7 +21675,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11680</v>
+<v>11632</v>
 </b>
 </bs>
 </hist>
@@ -21482,7 +21691,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11680</v>
+<v>11632</v>
 </b>
 </bs>
 </hist>
@@ -21498,12 +21707,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11534</v>
+<v>11486</v>
 </b>
 <b>
 <a>2</a>
 <b>26</b>
-<v>146</v>
+<v>145</v>
 </b>
 </bs>
 </hist>
@@ -21519,7 +21728,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11622</v>
+<v>11573</v>
 </b>
 <b>
 <a>2</a>
@@ -21534,15 +21743,15 @@
 </relation>
 <relation>
 <name>operator_location</name>
-<cardinality>22304</cardinality>
+<cardinality>22798</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>5648</v>
+<v>5773</v>
 </e>
 <e>
 <k>loc</k>
-<v>3165</v>
+<v>3235</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21556,32 +21765,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>841</v>
+<v>860</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3156</v>
+<v>3226</v>
 </b>
 <b>
 <a>3</a>
 <b>9</b>
-<v>387</v>
+<v>395</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>450</v>
+<v>460</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>583</v>
+<v>596</v>
 </b>
 <b>
 <a>12</a>
 <b>14</b>
-<v>228</v>
+<v>234</v>
 </b>
 </bs>
 </hist>
@@ -21597,17 +21806,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2774</v>
+<v>2835</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>237</v>
+<v>242</v>
 </b>
 <b>
 <a>9</a>
 <b>2695</b>
-<v>153</v>
+<v>156</v>
 </b>
 </bs>
 </hist>
@@ -21617,15 +21826,15 @@
 </relation>
 <relation>
 <name>constant_value</name>
-<cardinality>185757</cardinality>
+<cardinality>184982</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>185645</v>
+<v>184871</v>
 </e>
 <e>
 <k>value</k>
-<v>47958</v>
+<v>47758</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21639,12 +21848,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185532</v>
+<v>184759</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>112</v>
+<v>111</v>
 </b>
 </bs>
 </hist>
@@ -21660,27 +21869,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32963</v>
+<v>32825</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7234</v>
+<v>7203</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3895</v>
+<v>3879</v>
 </b>
 <b>
 <a>4</a>
 <b>61</b>
-<v>3597</v>
+<v>3582</v>
 </b>
 <b>
 <a>61</a>
 <b>2421</b>
-<v>268</v>
+<v>267</v>
 </b>
 </bs>
 </hist>
@@ -21690,27 +21899,27 @@
 </relation>
 <relation>
 <name>methods</name>
-<cardinality>1119078</cardinality>
+<cardinality>1114413</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1119078</v>
+<v>1114413</v>
 </e>
 <e>
 <k>name</k>
-<v>133883</v>
+<v>133325</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>202475</v>
+<v>201631</v>
 </e>
 <e>
 <k>type_id</k>
-<v>113123</v>
+<v>112652</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>698082</v>
+<v>695172</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21724,7 +21933,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1119078</v>
+<v>1114413</v>
 </b>
 </bs>
 </hist>
@@ -21740,7 +21949,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1119078</v>
+<v>1114413</v>
 </b>
 </bs>
 </hist>
@@ -21756,7 +21965,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1119078</v>
+<v>1114413</v>
 </b>
 </bs>
 </hist>
@@ -21772,7 +21981,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1119078</v>
+<v>1114413</v>
 </b>
 </bs>
 </hist>
@@ -21788,32 +21997,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>69294</v>
+<v>69005</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23669</v>
+<v>23570</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10855</v>
+<v>10810</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10445</v>
+<v>10402</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>10592</v>
+<v>10548</v>
 </b>
 <b>
 <a>12</a>
 <b>5621</b>
-<v>9025</v>
+<v>8987</v>
 </b>
 </bs>
 </hist>
@@ -21829,32 +22038,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>79686</v>
+<v>79354</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19383</v>
+<v>19302</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11339</v>
+<v>11291</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>11070</v>
+<v>11024</v>
 </b>
 <b>
 <a>7</a>
 <b>33</b>
-<v>10128</v>
+<v>10086</v>
 </b>
 <b>
 <a>33</a>
 <b>4959</b>
-<v>2274</v>
+<v>2265</v>
 </b>
 </bs>
 </hist>
@@ -21870,22 +22079,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>113104</v>
+<v>112632</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10616</v>
+<v>10572</v>
 </b>
 <b>
 <a>3</a>
 <b>174</b>
-<v>10045</v>
+<v>10003</v>
 </b>
 <b>
 <a>177</a>
 <b>2703</b>
-<v>117</v>
+<v>116</v>
 </b>
 </bs>
 </hist>
@@ -21901,32 +22110,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71037</v>
+<v>70741</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24538</v>
+<v>24435</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10929</v>
+<v>10883</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10743</v>
+<v>10698</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>10050</v>
+<v>10008</v>
 </b>
 <b>
 <a>12</a>
 <b>4958</b>
-<v>6584</v>
+<v>6557</v>
 </b>
 </bs>
 </hist>
@@ -21942,42 +22151,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>59854</v>
+<v>59604</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43077</v>
+<v>42897</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31362</v>
+<v>31231</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14282</v>
+<v>14223</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14819</v>
+<v>14757</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>16132</v>
+<v>16065</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>15688</v>
+<v>15623</v>
 </b>
 <b>
 <a>23</a>
 <b>1309</b>
-<v>7258</v>
+<v>7228</v>
 </b>
 </bs>
 </hist>
@@ -21993,37 +22202,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64930</v>
+<v>64660</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44766</v>
+<v>44579</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>34466</v>
+<v>34323</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18231</v>
+<v>18155</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>18197</v>
+<v>18121</v>
 </b>
 <b>
 <a>8</a>
 <b>18</b>
-<v>15283</v>
+<v>15219</v>
 </b>
 <b>
 <a>18</a>
 <b>457</b>
-<v>6599</v>
+<v>6571</v>
 </b>
 </bs>
 </hist>
@@ -22039,32 +22248,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98011</v>
+<v>97602</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>49012</v>
+<v>48808</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22995</v>
+<v>22899</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11646</v>
+<v>11598</v>
 </b>
 <b>
 <a>5</a>
 <b>10</b>
-<v>15239</v>
+<v>15175</v>
 </b>
 <b>
 <a>10</a>
 <b>738</b>
-<v>5569</v>
+<v>5546</v>
 </b>
 </bs>
 </hist>
@@ -22080,42 +22289,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>59961</v>
+<v>59711</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43155</v>
+<v>42975</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31362</v>
+<v>31231</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14316</v>
+<v>14257</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14839</v>
+<v>14777</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>16049</v>
+<v>15982</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>16147</v>
+<v>16079</v>
 </b>
 <b>
 <a>23</a>
 <b>698</b>
-<v>6643</v>
+<v>6615</v>
 </b>
 </bs>
 </hist>
@@ -22131,27 +22340,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75601</v>
+<v>75286</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14512</v>
+<v>14451</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8327</v>
+<v>8292</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8844</v>
+<v>8808</v>
 </b>
 <b>
 <a>10</a>
 <b>62149</b>
-<v>5838</v>
+<v>5813</v>
 </b>
 </bs>
 </hist>
@@ -22167,22 +22376,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>91768</v>
+<v>91385</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9635</v>
+<v>9595</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8683</v>
+<v>8647</v>
 </b>
 <b>
 <a>8</a>
 <b>7666</b>
-<v>3036</v>
+<v>3023</v>
 </b>
 </bs>
 </hist>
@@ -22198,22 +22407,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87584</v>
+<v>87219</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14009</v>
+<v>13950</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8820</v>
+<v>8783</v>
 </b>
 <b>
 <a>8</a>
 <b>19632</b>
-<v>2709</v>
+<v>2697</v>
 </b>
 </bs>
 </hist>
@@ -22229,27 +22438,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75713</v>
+<v>75398</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14570</v>
+<v>14509</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8400</v>
+<v>8365</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8781</v>
+<v>8744</v>
 </b>
 <b>
 <a>10</a>
 <b>44480</b>
-<v>5657</v>
+<v>5633</v>
 </b>
 </bs>
 </hist>
@@ -22265,12 +22474,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>671191</v>
+<v>668393</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>26891</v>
+<v>26778</v>
 </b>
 </bs>
 </hist>
@@ -22286,7 +22495,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>698082</v>
+<v>695172</v>
 </b>
 </bs>
 </hist>
@@ -22302,12 +22511,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>673060</v>
+<v>670255</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>25021</v>
+<v>24917</v>
 </b>
 </bs>
 </hist>
@@ -22323,12 +22532,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>687694</v>
+<v>684828</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>10387</v>
+<v>10344</v>
 </b>
 </bs>
 </hist>
@@ -22338,15 +22547,15 @@
 </relation>
 <relation>
 <name>method_location</name>
-<cardinality>1283143</cardinality>
+<cardinality>1277794</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1119078</v>
+<v>1114413</v>
 </e>
 <e>
 <k>loc</k>
-<v>40919</v>
+<v>40749</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22360,17 +22569,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>988421</v>
+<v>984300</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98479</v>
+<v>98069</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>32177</v>
+<v>32043</v>
 </b>
 </bs>
 </hist>
@@ -22386,17 +22595,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36297</v>
+<v>36145</v>
 </b>
 <b>
 <a>2</a>
 <b>51</b>
-<v>3084</v>
+<v>3072</v>
 </b>
 <b>
 <a>51</a>
 <b>27729</b>
-<v>1537</v>
+<v>1531</v>
 </b>
 </bs>
 </hist>
@@ -22406,23 +22615,23 @@
 </relation>
 <relation>
 <name>constructors</name>
-<cardinality>278247</cardinality>
+<cardinality>277088</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>278247</v>
+<v>277088</v>
 </e>
 <e>
 <k>name</k>
-<v>133756</v>
+<v>133199</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>212443</v>
+<v>211557</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>223738</v>
+<v>222805</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22436,7 +22645,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278247</v>
+<v>277088</v>
 </b>
 </bs>
 </hist>
@@ -22452,7 +22661,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278247</v>
+<v>277088</v>
 </b>
 </bs>
 </hist>
@@ -22468,7 +22677,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>278247</v>
+<v>277088</v>
 </b>
 </bs>
 </hist>
@@ -22484,22 +22693,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102409</v>
+<v>101982</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19212</v>
+<v>19132</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>10270</v>
+<v>10227</v>
 </b>
 <b>
 <a>8</a>
 <b>2183</b>
-<v>1864</v>
+<v>1856</v>
 </b>
 </bs>
 </hist>
@@ -22515,17 +22724,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>122749</v>
+<v>122237</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>10104</v>
+<v>10062</v>
 </b>
 <b>
 <a>11</a>
 <b>2183</b>
-<v>903</v>
+<v>899</v>
 </b>
 </bs>
 </hist>
@@ -22541,22 +22750,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>103292</v>
+<v>102862</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19368</v>
+<v>19288</v>
 </b>
 <b>
 <a>3</a>
 <b>10</b>
-<v>10109</v>
+<v>10067</v>
 </b>
 <b>
 <a>10</a>
 <b>2183</b>
-<v>986</v>
+<v>981</v>
 </b>
 </bs>
 </hist>
@@ -22572,17 +22781,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179704</v>
+<v>178955</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19793</v>
+<v>19711</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12945</v>
+<v>12891</v>
 </b>
 </bs>
 </hist>
@@ -22598,7 +22807,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212443</v>
+<v>211557</v>
 </b>
 </bs>
 </hist>
@@ -22614,17 +22823,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179704</v>
+<v>178955</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19793</v>
+<v>19711</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12945</v>
+<v>12891</v>
 </b>
 </bs>
 </hist>
@@ -22640,12 +22849,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>221302</v>
+<v>220380</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2435</v>
+<v>2425</v>
 </b>
 </bs>
 </hist>
@@ -22661,7 +22870,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>223738</v>
+<v>222805</v>
 </b>
 </bs>
 </hist>
@@ -22677,12 +22886,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>221302</v>
+<v>220380</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2435</v>
+<v>2425</v>
 </b>
 </bs>
 </hist>
@@ -22692,15 +22901,15 @@
 </relation>
 <relation>
 <name>constructor_location</name>
-<cardinality>322140</cardinality>
+<cardinality>320729</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>278247</v>
+<v>277088</v>
 </e>
 <e>
 <k>loc</k>
-<v>24826</v>
+<v>24722</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22714,17 +22923,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>238841</v>
+<v>237845</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37654</v>
+<v>37565</v>
 </b>
 <b>
 <a>3</a>
 <b>87</b>
-<v>1752</v>
+<v>1677</v>
 </b>
 </bs>
 </hist>
@@ -22740,22 +22949,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19041</v>
+<v>18962</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3187</v>
+<v>3174</v>
 </b>
 <b>
 <a>3</a>
 <b>59</b>
-<v>1869</v>
+<v>1861</v>
 </b>
 <b>
 <a>59</a>
 <b>4796</b>
-<v>727</v>
+<v>724</v>
 </b>
 </bs>
 </hist>
@@ -22765,23 +22974,23 @@
 </relation>
 <relation>
 <name>destructors</name>
-<cardinality>444</cardinality>
+<cardinality>442</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>444</v>
+<v>442</v>
 </e>
 <e>
 <k>name</k>
-<v>414</v>
+<v>413</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>444</v>
+<v>442</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>429</v>
+<v>427</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22795,7 +23004,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>442</v>
 </b>
 </bs>
 </hist>
@@ -22811,7 +23020,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>442</v>
 </b>
 </bs>
 </hist>
@@ -22827,7 +23036,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>442</v>
 </b>
 </bs>
 </hist>
@@ -22843,7 +23052,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>395</v>
+<v>393</v>
 </b>
 <b>
 <a>2</a>
@@ -22864,7 +23073,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>395</v>
+<v>393</v>
 </b>
 <b>
 <a>2</a>
@@ -22885,7 +23094,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>400</v>
+<v>398</v>
 </b>
 <b>
 <a>2</a>
@@ -22906,7 +23115,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>442</v>
 </b>
 </bs>
 </hist>
@@ -22922,7 +23131,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>442</v>
 </b>
 </bs>
 </hist>
@@ -22938,7 +23147,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>444</v>
+<v>442</v>
 </b>
 </bs>
 </hist>
@@ -22954,7 +23163,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>419</v>
+<v>418</v>
 </b>
 <b>
 <a>2</a>
@@ -22975,7 +23184,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>429</v>
+<v>427</v>
 </b>
 </bs>
 </hist>
@@ -22991,7 +23200,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>419</v>
+<v>418</v>
 </b>
 <b>
 <a>2</a>
@@ -23006,15 +23215,15 @@
 </relation>
 <relation>
 <name>destructor_location</name>
-<cardinality>646</cardinality>
+<cardinality>661</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>161</v>
+<v>165</v>
 </e>
 <e>
 <k>loc</k>
-<v>322</v>
+<v>329</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23028,12 +23237,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31</v>
+<v>32</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43</v>
+<v>44</v>
 </b>
 <b>
 <a>3</a>
@@ -23043,7 +23252,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>15</v>
+<v>16</v>
 </b>
 <b>
 <a>5</a>
@@ -23084,7 +23293,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>254</v>
+<v>260</v>
 </b>
 <b>
 <a>2</a>
@@ -23099,7 +23308,7 @@
 <b>
 <a>5</a>
 <b>27</b>
-<v>20</v>
+<v>21</v>
 </b>
 </bs>
 </hist>
@@ -23109,15 +23318,15 @@
 </relation>
 <relation>
 <name>overrides</name>
-<cardinality>274528</cardinality>
+<cardinality>273383</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>274503</v>
+<v>273359</v>
 </e>
 <e>
 <k>base_id</k>
-<v>65545</v>
+<v>65272</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23131,7 +23340,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>274479</v>
+<v>273335</v>
 </b>
 <b>
 <a>2</a>
@@ -23152,32 +23361,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40338</v>
+<v>40170</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10494</v>
+<v>10451</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4295</v>
+<v>4277</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>5349</v>
+<v>5327</v>
 </b>
 <b>
 <a>7</a>
 <b>184</b>
-<v>4920</v>
+<v>4899</v>
 </b>
 <b>
 <a>215</a>
 <b>1329</b>
-<v>146</v>
+<v>145</v>
 </b>
 </bs>
 </hist>
@@ -23187,15 +23396,15 @@
 </relation>
 <relation>
 <name>explicitly_implements</name>
-<cardinality>156284</cardinality>
+<cardinality>155632</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>156284</v>
+<v>155632</v>
 </e>
 <e>
 <k>interface_id</k>
-<v>13311</v>
+<v>13255</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23209,7 +23418,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>156284</v>
+<v>155632</v>
 </b>
 </bs>
 </hist>
@@ -23225,37 +23434,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6784</v>
+<v>6756</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2494</v>
+<v>2483</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1186</v>
+<v>1181</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>458</v>
+<v>456</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>1210</v>
+<v>1205</v>
 </b>
 <b>
 <a>7</a>
 <b>58</b>
-<v>1000</v>
+<v>996</v>
 </b>
 <b>
 <a>58</a>
 <b>7851</b>
-<v>175</v>
+<v>174</v>
 </b>
 </bs>
 </hist>
@@ -23561,11 +23770,11 @@
 </relation>
 <relation>
 <name>local_function_stmts</name>
-<cardinality>1793</cardinality>
+<cardinality>1792</cardinality>
 <columnsizes>
 <e>
 <k>fn</k>
-<v>1793</v>
+<v>1792</v>
 </e>
 <e>
 <k>stmt</k>
@@ -23583,7 +23792,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1793</v>
+<v>1792</v>
 </b>
 </bs>
 </hist>
@@ -23599,12 +23808,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1791</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1</v>
+<v>1792</v>
 </b>
 </bs>
 </hist>
@@ -23614,11 +23818,11 @@
 </relation>
 <relation>
 <name>fields</name>
-<cardinality>556900</cardinality>
+<cardinality>554579</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>556900</v>
+<v>554579</v>
 </e>
 <e>
 <k>kind</k>
@@ -23626,19 +23830,19 @@
 </e>
 <e>
 <k>name</k>
-<v>218696</v>
+<v>217784</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>103805</v>
+<v>103372</v>
 </e>
 <e>
 <k>type_id</k>
-<v>89708</v>
+<v>89334</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>549188</v>
+<v>546899</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23652,7 +23856,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556900</v>
+<v>554579</v>
 </b>
 </bs>
 </hist>
@@ -23668,7 +23872,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556900</v>
+<v>554579</v>
 </b>
 </bs>
 </hist>
@@ -23684,7 +23888,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556900</v>
+<v>554579</v>
 </b>
 </bs>
 </hist>
@@ -23700,7 +23904,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556900</v>
+<v>554579</v>
 </b>
 </bs>
 </hist>
@@ -23716,7 +23920,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556900</v>
+<v>554579</v>
 </b>
 </bs>
 </hist>
@@ -23837,22 +24041,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176556</v>
+<v>175820</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22614</v>
+<v>22520</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>16591</v>
+<v>16522</v>
 </b>
 <b>
 <a>14</a>
 <b>4800</b>
-<v>2933</v>
+<v>2921</v>
 </b>
 </bs>
 </hist>
@@ -23868,418 +24072,418 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>209319</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>9376</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>declaring_type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>176580</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>22600</v>
-</b>
-<b>
-<a>3</a>
-<b>14</b>
-<v>16581</v>
-</b>
-<b>
-<a>14</a>
-<b>4800</b>
-<v>2933</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>189091</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>17694</v>
-</b>
-<b>
-<a>3</a>
-<b>2459</b>
-<v>11910</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>unbound_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>176946</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>22619</v>
-</b>
-<b>
-<a>3</a>
-<b>15</b>
-<v>16508</v>
-</b>
-<b>
-<a>15</a>
-<b>4800</b>
-<v>2621</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>27379</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>21194</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>12598</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>10123</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>7951</v>
-</b>
-<b>
-<a>6</a>
-<b>8</b>
-<v>9293</v>
-</b>
-<b>
-<a>8</a>
-<b>12</b>
-<v>8166</v>
-</b>
-<b>
-<a>12</a>
-<b>4204</b>
-<v>7097</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>kind</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>102712</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1093</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>name</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>27379</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>21199</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>12603</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>10118</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>7951</v>
-</b>
-<b>
-<a>6</a>
-<b>8</b>
-<v>9298</v>
-</b>
-<b>
-<a>8</a>
-<b>12</b>
-<v>8166</v>
-</b>
-<b>
-<a>12</a>
-<b>4204</b>
-<v>7087</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>44624</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>21248</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>9455</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>7380</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>6174</v>
-</b>
-<b>
-<a>6</a>
-<b>9</b>
-<v>9611</v>
-</b>
-<b>
-<a>9</a>
-<b>132</b>
-<v>5310</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>unbound_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>27379</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>21194</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>12598</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>10123</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>7951</v>
-</b>
-<b>
-<a>6</a>
-<b>8</b>
-<v>9293</v>
-</b>
-<b>
-<a>8</a>
-<b>12</b>
-<v>8166</v>
-</b>
-<b>
-<a>12</a>
-<b>4204</b>
-<v>7097</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>type_id</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>55920</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>10904</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>6223</v>
-</b>
-<b>
-<a>4</a>
-<b>7</b>
-<v>7985</v>
-</b>
-<b>
-<a>7</a>
-<b>27</b>
-<v>6804</v>
-</b>
-<b>
-<a>27</a>
-<b>9290</b>
-<v>1869</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>type_id</src>
-<trg>kind</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>87506</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>2201</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>type_id</src>
-<trg>name</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>63866</v>
+<v>208446</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
 <v>9337</v>
 </b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>declaring_type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>175844</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>22506</v>
+</b>
+<b>
+<a>3</a>
+<b>14</b>
+<v>16512</v>
+</b>
+<b>
+<a>14</a>
+<b>4800</b>
+<v>2921</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>188302</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>17620</v>
+</b>
+<b>
+<a>3</a>
+<b>2459</b>
+<v>11860</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>unbound_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>176208</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>22525</v>
+</b>
+<b>
+<a>3</a>
+<b>15</b>
+<v>16439</v>
+</b>
+<b>
+<a>15</a>
+<b>4800</b>
+<v>2610</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>27264</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21106</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>12546</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>10081</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>7918</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>9255</v>
+</b>
+<b>
+<a>8</a>
+<b>12</b>
+<v>8132</v>
+</b>
+<b>
+<a>12</a>
+<b>4204</b>
+<v>7067</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>102283</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1088</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>27264</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21111</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>12550</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>10076</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>7918</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>9260</v>
+</b>
+<b>
+<a>8</a>
+<b>12</b>
+<v>8132</v>
+</b>
+<b>
+<a>12</a>
+<b>4204</b>
+<v>7058</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>44438</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21159</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>9415</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7349</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>6149</v>
+</b>
+<b>
+<a>6</a>
+<b>9</b>
+<v>9571</v>
+</b>
+<b>
+<a>9</a>
+<b>132</b>
+<v>5288</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>unbound_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>27264</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21106</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>12546</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>10081</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>7918</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>9255</v>
+</b>
+<b>
+<a>8</a>
+<b>12</b>
+<v>8132</v>
+</b>
+<b>
+<a>12</a>
+<b>4204</b>
+<v>7067</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>55686</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>10859</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>6197</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>7952</v>
+</b>
+<b>
+<a>7</a>
+<b>27</b>
+<v>6776</v>
+</b>
+<b>
+<a>27</a>
+<b>9290</b>
+<v>1861</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>87142</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>2192</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>type_id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>63600</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>9298</v>
+</b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>7902</v>
+<v>7869</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>6853</v>
+<v>6824</v>
 </b>
 <b>
 <a>18</a>
 <b>5213</b>
-<v>1747</v>
+<v>1740</v>
 </b>
 </bs>
 </hist>
@@ -24295,22 +24499,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68460</v>
+<v>68174</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10060</v>
+<v>10018</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>7248</v>
+<v>7218</v>
 </b>
 <b>
 <a>7</a>
 <b>5746</b>
-<v>3939</v>
+<v>3922</v>
 </b>
 </bs>
 </hist>
@@ -24326,32 +24530,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55963</v>
+<v>55730</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11231</v>
+<v>11185</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5935</v>
+<v>5910</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7961</v>
+<v>7928</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>6760</v>
+<v>6732</v>
 </b>
 <b>
 <a>27</a>
 <b>9185</b>
-<v>1854</v>
+<v>1847</v>
 </b>
 </bs>
 </hist>
@@ -24367,12 +24571,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548275</v>
+<v>545990</v>
 </b>
 <b>
 <a>2</a>
 <b>234</b>
-<v>912</v>
+<v>908</v>
 </b>
 </bs>
 </hist>
@@ -24388,7 +24592,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>549188</v>
+<v>546899</v>
 </b>
 </bs>
 </hist>
@@ -24404,7 +24608,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>549188</v>
+<v>546899</v>
 </b>
 </bs>
 </hist>
@@ -24420,12 +24624,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548275</v>
+<v>545990</v>
 </b>
 <b>
 <a>2</a>
 <b>234</b>
-<v>912</v>
+<v>908</v>
 </b>
 </bs>
 </hist>
@@ -24441,12 +24645,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>548690</v>
+<v>546403</v>
 </b>
 <b>
 <a>2</a>
 <b>138</b>
-<v>497</v>
+<v>495</v>
 </b>
 </bs>
 </hist>
@@ -24456,15 +24660,15 @@
 </relation>
 <relation>
 <name>field_location</name>
-<cardinality>637832</cardinality>
+<cardinality>635173</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>549520</v>
+<v>547229</v>
 </e>
 <e>
 <k>loc</k>
-<v>52961</v>
+<v>52741</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24478,17 +24682,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>467236</v>
+<v>465288</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>78266</v>
+<v>77940</v>
 </b>
 <b>
 <a>3</a>
 <b>57</b>
-<v>4017</v>
+<v>4000</v>
 </b>
 </bs>
 </hist>
@@ -24504,12 +24708,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49447</v>
+<v>49241</v>
 </b>
 <b>
 <a>2</a>
 <b>8882</b>
-<v>3514</v>
+<v>3499</v>
 </b>
 </bs>
 </hist>
@@ -24519,11 +24723,11 @@
 </relation>
 <relation>
 <name>localvars</name>
-<cardinality>163704</cardinality>
+<cardinality>163272</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163704</v>
+<v>163272</v>
 </e>
 <e>
 <k>kind</k>
@@ -24531,7 +24735,7 @@
 </e>
 <e>
 <k>name</k>
-<v>22594</v>
+<v>22595</v>
 </e>
 <e>
 <k>implicitly_typed</k>
@@ -24539,11 +24743,11 @@
 </e>
 <e>
 <k>type_id</k>
-<v>7298</v>
+<v>7297</v>
 </e>
 <e>
 <k>parent_id</k>
-<v>163704</v>
+<v>163272</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24557,7 +24761,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -24573,7 +24777,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -24589,7 +24793,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -24605,7 +24809,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -24621,7 +24825,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -24645,8 +24849,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162450</a>
-<b>162451</b>
+<a>162455</a>
+<b>162456</b>
 <v>1</v>
 </b>
 </bs>
@@ -24671,8 +24875,8 @@
 <v>1</v>
 </b>
 <b>
-<a>22381</a>
-<b>22382</b>
+<a>22382</a>
+<b>22383</b>
 <v>1</v>
 </b>
 </bs>
@@ -24718,8 +24922,8 @@
 <v>1</v>
 </b>
 <b>
-<a>7293</a>
-<b>7294</b>
+<a>7292</a>
+<b>7293</b>
 <v>1</v>
 </b>
 </bs>
@@ -24734,8 +24938,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>20</a>
-<b>21</b>
+<a>18</a>
+<b>19</b>
 <v>1</v>
 </b>
 <b>
@@ -24744,8 +24948,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162885</a>
-<b>162886</b>
+<a>162455</a>
+<b>162456</b>
 <v>1</v>
 </b>
 </bs>
@@ -24767,7 +24971,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3483</v>
+<v>3484</v>
 </b>
 <b>
 <a>3</a>
@@ -24798,7 +25002,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22502</v>
+<v>22503</v>
 </b>
 <b>
 <a>2</a>
@@ -24819,7 +25023,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19934</v>
+<v>19935</v>
 </b>
 <b>
 <a>2</a>
@@ -24840,7 +25044,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19224</v>
+<v>19225</v>
 </b>
 <b>
 <a>2</a>
@@ -24866,12 +25070,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14081</v>
+<v>14115</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3501</v>
+<v>3484</v>
 </b>
 <b>
 <a>3</a>
@@ -24881,12 +25085,12 @@
 <b>
 <a>4</a>
 <b>8</b>
-<v>1884</v>
+<v>1876</v>
 </b>
 <b>
 <a>8</a>
 <b>15750</b>
-<v>1667</v>
+<v>1659</v>
 </b>
 </bs>
 </hist>
@@ -24900,13 +25104,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36623</a>
-<b>36624</b>
+<a>36625</a>
+<b>36626</b>
 <v>1</v>
 </b>
 <b>
-<a>126644</a>
-<b>126645</b>
+<a>126647</a>
+<b>126648</b>
 <v>1</v>
 </b>
 </bs>
@@ -24947,8 +25151,8 @@
 <v>1</v>
 </b>
 <b>
-<a>16705</a>
-<b>16706</b>
+<a>16706</a>
+<b>16707</b>
 <v>1</v>
 </b>
 </bs>
@@ -24968,8 +25172,8 @@
 <v>1</v>
 </b>
 <b>
-<a>6179</a>
-<b>6180</b>
+<a>6178</a>
+<b>6179</b>
 <v>1</v>
 </b>
 </bs>
@@ -24984,13 +25188,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36772</a>
-<b>36773</b>
+<a>36625</a>
+<b>36626</b>
 <v>1</v>
 </b>
 <b>
-<a>126932</a>
-<b>126933</b>
+<a>126647</a>
+<b>126648</b>
 <v>1</v>
 </b>
 </bs>
@@ -25007,7 +25211,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3309</v>
+<v>3308</v>
 </b>
 <b>
 <a>2</a>
@@ -25036,7 +25240,7 @@
 </b>
 <b>
 <a>35</a>
-<b>37235</b>
+<b>37236</b>
 <v>317</v>
 </b>
 </bs>
@@ -25053,7 +25257,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7269</v>
+<v>7268</v>
 </b>
 <b>
 <a>2</a>
@@ -25074,7 +25278,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4172</v>
+<v>4171</v>
 </b>
 <b>
 <a>2</a>
@@ -25098,7 +25302,7 @@
 </b>
 <b>
 <a>49</a>
-<b>1941</b>
+<b>1942</b>
 <v>84</v>
 </b>
 </bs>
@@ -25115,7 +25319,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5613</v>
+<v>5612</v>
 </b>
 <b>
 <a>2</a>
@@ -25136,37 +25340,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3243</v>
+<v>3308</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1169</v>
+<v>1137</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>761</v>
+<v>772</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>649</v>
+<v>624</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>608</v>
+<v>591</v>
 </b>
 <b>
 <a>11</a>
 <b>35</b>
-<v>549</v>
+<v>548</v>
 </b>
 <b>
 <a>35</a>
-<b>37240</b>
-<v>319</v>
+<b>37236</b>
+<v>317</v>
 </b>
 </bs>
 </hist>
@@ -25182,7 +25386,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -25198,7 +25402,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -25214,7 +25418,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -25230,7 +25434,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -25246,7 +25450,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163704</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -25256,15 +25460,15 @@
 </relation>
 <relation>
 <name>localvar_location</name>
-<cardinality>163267</cardinality>
+<cardinality>163272</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163267</v>
+<v>163272</v>
 </e>
 <e>
 <k>loc</k>
-<v>163187</v>
+<v>163192</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25278,7 +25482,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163267</v>
+<v>163272</v>
 </b>
 </bs>
 </hist>
@@ -25294,7 +25498,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163107</v>
+<v>163112</v>
 </b>
 <b>
 <a>2</a>
@@ -25309,23 +25513,23 @@
 </relation>
 <relation>
 <name>params</name>
-<cardinality>2422733</cardinality>
+<cardinality>2412633</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2422733</v>
+<v>2412633</v>
 </e>
 <e>
 <k>name</k>
-<v>80985</v>
+<v>80647</v>
 </e>
 <e>
 <k>type_id</k>
-<v>331297</v>
+<v>329916</v>
 </e>
 <e>
 <k>index</k>
-<v>200</v>
+<v>199</v>
 </e>
 <e>
 <k>mode</k>
@@ -25333,11 +25537,11 @@
 </e>
 <e>
 <k>parent_id</k>
-<v>1372592</v>
+<v>1366871</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>1438090</v>
+<v>1432095</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25351,7 +25555,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422733</v>
+<v>2412633</v>
 </b>
 </bs>
 </hist>
@@ -25367,7 +25571,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422733</v>
+<v>2412633</v>
 </b>
 </bs>
 </hist>
@@ -25383,7 +25587,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422733</v>
+<v>2412633</v>
 </b>
 </bs>
 </hist>
@@ -25399,7 +25603,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422733</v>
+<v>2412633</v>
 </b>
 </bs>
 </hist>
@@ -25415,7 +25619,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422733</v>
+<v>2412633</v>
 </b>
 </bs>
 </hist>
@@ -25431,7 +25635,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2422733</v>
+<v>2412633</v>
 </b>
 </bs>
 </hist>
@@ -25447,42 +25651,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31181</v>
+<v>31051</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13882</v>
+<v>13824</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7072</v>
+<v>7043</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4847</v>
+<v>4826</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6662</v>
+<v>6635</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6911</v>
+<v>6883</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6091</v>
+<v>6066</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4334</v>
+<v>4316</v>
 </b>
 </bs>
 </hist>
@@ -25498,22 +25702,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64349</v>
+<v>64081</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8176</v>
+<v>8142</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>6184</v>
+<v>6158</v>
 </b>
 <b>
 <a>12</a>
 <b>6855</b>
-<v>2274</v>
+<v>2265</v>
 </b>
 </bs>
 </hist>
@@ -25529,22 +25733,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55124</v>
+<v>54894</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14595</v>
+<v>14534</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5525</v>
+<v>5502</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>5740</v>
+<v>5716</v>
 </b>
 </bs>
 </hist>
@@ -25560,12 +25764,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75943</v>
+<v>75626</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>5042</v>
+<v>5021</v>
 </b>
 </bs>
 </hist>
@@ -25581,42 +25785,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31181</v>
+<v>31051</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13882</v>
+<v>13824</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7072</v>
+<v>7043</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4847</v>
+<v>4826</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6662</v>
+<v>6635</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6911</v>
+<v>6883</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6091</v>
+<v>6066</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4334</v>
+<v>4316</v>
 </b>
 </bs>
 </hist>
@@ -25632,42 +25836,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31572</v>
+<v>31440</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14111</v>
+<v>14052</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7087</v>
+<v>7058</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4964</v>
+<v>4943</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6492</v>
+<v>6465</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6926</v>
+<v>6897</v>
 </b>
 <b>
 <a>13</a>
 <b>43</b>
-<v>6165</v>
+<v>6139</v>
 </b>
 <b>
 <a>43</a>
 <b>36753</b>
-<v>3665</v>
+<v>3650</v>
 </b>
 </bs>
 </hist>
@@ -25683,27 +25887,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>228058</v>
+<v>227107</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39025</v>
+<v>38863</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30146</v>
+<v>30021</v>
 </b>
 <b>
 <a>6</a>
 <b>24</b>
-<v>25114</v>
+<v>25009</v>
 </b>
 <b>
 <a>24</a>
 <b>48952</b>
-<v>8952</v>
+<v>8914</v>
 </b>
 </bs>
 </hist>
@@ -25719,17 +25923,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>289718</v>
+<v>288511</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>30556</v>
+<v>30429</v>
 </b>
 <b>
 <a>4</a>
 <b>2470</b>
-<v>11021</v>
+<v>10975</v>
 </b>
 </bs>
 </hist>
@@ -25745,17 +25949,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>292789</v>
+<v>291568</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25128</v>
+<v>25024</v>
 </b>
 <b>
 <a>3</a>
 <b>36</b>
-<v>13379</v>
+<v>13323</v>
 </b>
 </bs>
 </hist>
@@ -25771,12 +25975,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>322569</v>
+<v>321225</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>8727</v>
+<v>8691</v>
 </b>
 </bs>
 </hist>
@@ -25792,27 +25996,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>230562</v>
+<v>229601</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37063</v>
+<v>36909</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30561</v>
+<v>30434</v>
 </b>
 <b>
 <a>6</a>
 <b>25</b>
-<v>25075</v>
+<v>24970</v>
 </b>
 <b>
 <a>25</a>
 <b>40409</b>
-<v>8034</v>
+<v>8001</v>
 </b>
 </bs>
 </hist>
@@ -25828,27 +26032,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>233759</v>
+<v>232785</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34979</v>
+<v>34833</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>25797</v>
+<v>25690</v>
 </b>
 <b>
 <a>5</a>
 <b>16</b>
-<v>25363</v>
+<v>25257</v>
 </b>
 <b>
 <a>16</a>
 <b>33990</b>
-<v>11397</v>
+<v>11350</v>
 </b>
 </bs>
 </hist>
@@ -26546,27 +26750,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806266</v>
+<v>802905</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333362</v>
+<v>331972</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129471</v>
+<v>128931</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102980</v>
+<v>102551</v>
 </b>
 <b>
 <a>17</a>
 <b>42</b>
-<v>512</v>
+<v>510</v>
 </b>
 </bs>
 </hist>
@@ -26582,27 +26786,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806266</v>
+<v>802905</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333362</v>
+<v>331972</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129471</v>
+<v>128931</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102980</v>
+<v>102551</v>
 </b>
 <b>
 <a>17</a>
 <b>42</b>
-<v>512</v>
+<v>510</v>
 </b>
 </bs>
 </hist>
@@ -26618,22 +26822,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>855923</v>
+<v>852355</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333660</v>
+<v>332269</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>113524</v>
+<v>113050</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>69485</v>
+<v>69195</v>
 </b>
 </bs>
 </hist>
@@ -26649,27 +26853,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806266</v>
+<v>802905</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333362</v>
+<v>331972</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129471</v>
+<v>128931</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102980</v>
+<v>102551</v>
 </b>
 <b>
 <a>17</a>
 <b>42</b>
-<v>512</v>
+<v>510</v>
 </b>
 </bs>
 </hist>
@@ -26685,12 +26889,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1303937</v>
+<v>1298502</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>68655</v>
+<v>68369</v>
 </b>
 </bs>
 </hist>
@@ -26706,27 +26910,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806266</v>
+<v>802905</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>333362</v>
+<v>331972</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>129471</v>
+<v>128931</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102980</v>
+<v>102551</v>
 </b>
 <b>
 <a>17</a>
 <b>42</b>
-<v>512</v>
+<v>510</v>
 </b>
 </bs>
 </hist>
@@ -26742,12 +26946,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1387700</v>
+<v>1381915</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50389</v>
+<v>50179</v>
 </b>
 </bs>
 </hist>
@@ -26763,7 +26967,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1438090</v>
+<v>1432095</v>
 </b>
 </bs>
 </hist>
@@ -26779,12 +26983,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1419946</v>
+<v>1414027</v>
 </b>
 <b>
 <a>2</a>
 <b>3718</b>
-<v>18143</v>
+<v>18068</v>
 </b>
 </bs>
 </hist>
@@ -26800,7 +27004,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1438090</v>
+<v>1432095</v>
 </b>
 </bs>
 </hist>
@@ -26816,7 +27020,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1438090</v>
+<v>1432095</v>
 </b>
 </bs>
 </hist>
@@ -26832,12 +27036,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1387700</v>
+<v>1381915</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50389</v>
+<v>50179</v>
 </b>
 </bs>
 </hist>
@@ -26847,15 +27051,15 @@
 </relation>
 <relation>
 <name>param_location</name>
-<cardinality>2692946</cardinality>
+<cardinality>2681720</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2419033</v>
+<v>2408949</v>
 </e>
 <e>
 <k>loc</k>
-<v>137837</v>
+<v>137263</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -26869,17 +27073,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2155336</v>
+<v>2146351</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>256877</v>
+<v>255806</v>
 </b>
 <b>
 <a>3</a>
 <b>60</b>
-<v>6819</v>
+<v>6790</v>
 </b>
 </bs>
 </hist>
@@ -26895,12 +27099,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>133508</v>
+<v>132951</v>
 </b>
 <b>
 <a>2</a>
 <b>99581</b>
-<v>4329</v>
+<v>4311</v>
 </b>
 </bs>
 </hist>
@@ -26910,15 +27114,15 @@
 </relation>
 <relation>
 <name>statements</name>
-<cardinality>992012</cardinality>
+<cardinality>984506</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>992012</v>
+<v>984506</v>
 </e>
 <e>
 <k>kind</k>
-<v>37</v>
+<v>38</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -26932,7 +27136,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>992012</v>
+<v>984506</v>
 </b>
 </bs>
 </hist>
@@ -26947,82 +27151,82 @@
 <bs>
 <b>
 <a>57</a>
-<b>88</b>
+<b>85</b>
 <v>2</v>
 </b>
 <b>
-<a>99</a>
+<a>97</a>
 <b>148</b>
 <v>2</v>
 </b>
 <b>
-<a>211</a>
-<b>287</b>
+<a>204</a>
+<b>266</b>
 <v>2</v>
 </b>
 <b>
-<a>294</a>
-<b>315</b>
+<a>283</a>
+<b>308</b>
 <v>2</v>
 </b>
 <b>
-<a>332</a>
-<b>601</b>
+<a>312</a>
+<b>593</b>
 <v>2</v>
 </b>
 <b>
-<a>822</a>
-<b>830</b>
+<a>790</a>
+<b>820</b>
 <v>2</v>
 </b>
 <b>
-<a>925</a>
-<b>939</b>
+<a>918</a>
+<b>925</b>
 <v>2</v>
 </b>
 <b>
-<a>1364</a>
-<b>1798</b>
+<a>1226</a>
+<b>1786</b>
 <v>2</v>
 </b>
 <b>
-<a>2218</a>
-<b>2506</b>
+<a>2200</a>
+<b>2468</b>
 <v>2</v>
 </b>
 <b>
-<a>2826</a>
-<b>3319</b>
+<a>2752</a>
+<b>3192</b>
 <v>2</v>
 </b>
 <b>
-<a>3553</a>
-<b>3734</b>
+<a>3456</a>
+<b>3580</b>
 <v>2</v>
 </b>
 <b>
-<a>5723</a>
-<b>8966</b>
+<a>5468</a>
+<b>8857</b>
 <v>2</v>
 </b>
 <b>
-<a>18439</a>
-<b>61067</b>
+<a>18283</a>
+<b>60466</b>
 <v>2</v>
 </b>
 <b>
-<a>64722</a>
-<b>79022</b>
+<a>62424</a>
+<b>75943</b>
 <v>2</v>
 </b>
 <b>
-<a>97897</a>
-<b>197966</b>
+<a>94726</a>
+<b>191611</b>
 <v>2</v>
 </b>
 <b>
-<a>253483</a>
-<b>253484</b>
+<a>246632</a>
+<b>246633</b>
 <v>1</v>
 </b>
 </bs>
@@ -27033,19 +27237,19 @@
 </relation>
 <relation>
 <name>stmt_parent</name>
-<cardinality>820273</cardinality>
+<cardinality>812665</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>820273</v>
+<v>812665</v>
 </e>
 <e>
 <k>index</k>
-<v>439</v>
+<v>449</v>
 </e>
 <e>
 <k>parent</k>
-<v>434546</v>
+<v>430564</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27059,7 +27263,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>820273</v>
+<v>812665</v>
 </b>
 </bs>
 </hist>
@@ -27075,7 +27279,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>820273</v>
+<v>812665</v>
 </b>
 </bs>
 </hist>
@@ -27091,22 +27295,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112</v>
+<v>114</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43</v>
+<v>44</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>25</v>
+<v>26</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>32</v>
+<v>33</v>
 </b>
 <b>
 <a>8</a>
@@ -27116,12 +27320,12 @@
 <b>
 <a>9</a>
 <b>10</b>
-<v>41</v>
+<v>42</v>
 </b>
 <b>
 <a>10</a>
 <b>26</b>
-<v>35</v>
+<v>36</v>
 </b>
 <b>
 <a>26</a>
@@ -27130,22 +27334,22 @@
 </b>
 <b>
 <a>45</a>
-<b>96</b>
+<b>95</b>
 <v>34</v>
 </b>
 <b>
-<a>99</a>
-<b>473</b>
+<a>98</a>
+<b>472</b>
 <v>34</v>
 </b>
 <b>
-<a>511</a>
-<b>81801</b>
+<a>510</a>
+<b>78797</b>
 <v>34</v>
 </b>
 <b>
-<a>202913</a>
-<b>240184</b>
+<a>196051</a>
+<b>233226</b>
 <v>2</v>
 </b>
 </bs>
@@ -27162,22 +27366,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112</v>
+<v>114</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43</v>
+<v>44</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>25</v>
+<v>26</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>32</v>
+<v>33</v>
 </b>
 <b>
 <a>8</a>
@@ -27187,12 +27391,12 @@
 <b>
 <a>9</a>
 <b>10</b>
-<v>41</v>
+<v>42</v>
 </b>
 <b>
 <a>10</a>
 <b>26</b>
-<v>35</v>
+<v>36</v>
 </b>
 <b>
 <a>26</a>
@@ -27201,22 +27405,22 @@
 </b>
 <b>
 <a>45</a>
-<b>96</b>
+<b>95</b>
 <v>34</v>
 </b>
 <b>
-<a>99</a>
-<b>473</b>
+<a>98</a>
+<b>472</b>
 <v>34</v>
 </b>
 <b>
-<a>511</a>
-<b>81801</b>
+<a>510</a>
+<b>78797</b>
 <v>34</v>
 </b>
 <b>
-<a>202913</a>
-<b>240184</b>
+<a>196051</a>
+<b>233226</b>
 <v>2</v>
 </b>
 </bs>
@@ -27233,22 +27437,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>293665</v>
+<v>291527</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>75371</v>
+<v>74507</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>38138</v>
+<v>37519</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27372</v>
+<v>27009</v>
 </b>
 </bs>
 </hist>
@@ -27264,22 +27468,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>293665</v>
+<v>291527</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>75371</v>
+<v>74507</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>38138</v>
+<v>37519</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27372</v>
+<v>27009</v>
 </b>
 </bs>
 </hist>
@@ -27289,11 +27493,11 @@
 </relation>
 <relation>
 <name>stmt_parent_top_level</name>
-<cardinality>171739</cardinality>
+<cardinality>171840</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>171739</v>
+<v>171840</v>
 </e>
 <e>
 <k>index</k>
@@ -27301,7 +27505,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>123213</v>
+<v>125941</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27315,7 +27519,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171739</v>
+<v>171840</v>
 </b>
 </bs>
 </hist>
@@ -27331,7 +27535,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171739</v>
+<v>171840</v>
 </b>
 </bs>
 </hist>
@@ -27345,8 +27549,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>141014</a>
-<b>141015</b>
+<a>138041</a>
+<b>138042</b>
 <v>1</v>
 </b>
 </bs>
@@ -27379,17 +27583,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>77164</v>
+<v>80692</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43678</v>
+<v>44606</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2371</v>
+<v>642</v>
 </b>
 </bs>
 </hist>
@@ -27405,7 +27609,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>123213</v>
+<v>125941</v>
 </b>
 </bs>
 </hist>
@@ -27415,15 +27619,15 @@
 </relation>
 <relation>
 <name>stmt_location</name>
-<cardinality>992012</cardinality>
+<cardinality>984506</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>992012</v>
+<v>984506</v>
 </e>
 <e>
 <k>loc</k>
-<v>960344</v>
+<v>981617</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27437,7 +27641,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>992012</v>
+<v>984506</v>
 </b>
 </bs>
 </hist>
@@ -27453,12 +27657,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>928675</v>
+<v>978728</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31668</v>
+<v>2889</v>
 </b>
 </bs>
 </hist>
@@ -27468,15 +27672,15 @@
 </relation>
 <relation>
 <name>catch_type</name>
-<cardinality>3441</cardinality>
+<cardinality>3425</cardinality>
 <columnsizes>
 <e>
 <k>catch_id</k>
-<v>3441</v>
+<v>3425</v>
 </e>
 <e>
 <k>type_id</k>
-<v>126</v>
+<v>129</v>
 </e>
 <e>
 <k>kind</k>
@@ -27494,7 +27698,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3441</v>
+<v>3425</v>
 </b>
 </bs>
 </hist>
@@ -27510,7 +27714,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3441</v>
+<v>3425</v>
 </b>
 </bs>
 </hist>
@@ -27526,47 +27730,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30</v>
+<v>32</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23</v>
+<v>22</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10</v>
+<v>11</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10</v>
+<v>12</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>10</v>
+<v>9</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>10</v>
+<v>11</v>
 </b>
 <b>
 <a>13</a>
-<b>28</b>
-<v>10</v>
-</b>
-<b>
-<a>28</a>
-<b>54</b>
+<b>24</b>
 <v>9</v>
 </b>
 <b>
-<a>97</a>
-<b>733</b>
-<v>8</v>
+<a>27</a>
+<b>47</b>
+<v>9</v>
+</b>
+<b>
+<a>48</a>
+<b>702</b>
+<v>9</v>
 </b>
 </bs>
 </hist>
@@ -27582,7 +27786,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>126</v>
+<v>129</v>
 </b>
 </bs>
 </hist>
@@ -27596,13 +27800,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>495</a>
-<b>496</b>
+<a>492</a>
+<b>493</b>
 <v>1</v>
 </b>
 <b>
-<a>2331</a>
-<b>2332</b>
+<a>2260</a>
+<b>2261</b>
 <v>1</v>
 </b>
 </bs>
@@ -27634,19 +27838,19 @@
 </relation>
 <relation>
 <name>expressions</name>
-<cardinality>4263212</cardinality>
+<cardinality>4241202</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4263212</v>
+<v>4241202</v>
 </e>
 <e>
 <k>kind</k>
-<v>405</v>
+<v>403</v>
 </e>
 <e>
 <k>type_id</k>
-<v>70456</v>
+<v>70157</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27660,7 +27864,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4263212</v>
+<v>4241202</v>
 </b>
 </bs>
 </hist>
@@ -27676,7 +27880,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4263212</v>
+<v>4241202</v>
 </b>
 </bs>
 </hist>
@@ -27736,12 +27940,12 @@
 </b>
 <b>
 <a>3359</a>
-<b>9533</b>
+<b>9531</b>
 <v>34</v>
 </b>
 <b>
 <a>10013</a>
-<b>21784</b>
+<b>21777</b>
 <v>34</v>
 </b>
 <b>
@@ -27751,7 +27955,7 @@
 </b>
 <b>
 <a>94368</a>
-<b>128776</b>
+<b>127999</b>
 <v>14</v>
 </b>
 </bs>
@@ -27768,12 +27972,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>156</v>
+<v>155</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39</v>
+<v>38</v>
 </b>
 <b>
 <a>3</a>
@@ -27806,8 +28010,8 @@
 <v>34</v>
 </b>
 <b>
-<a>5304</a>
-<b>5305</b>
+<a>5303</a>
+<b>5304</b>
 <v>4</v>
 </b>
 </bs>
@@ -27824,47 +28028,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12862</v>
+<v>12808</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21682</v>
+<v>21592</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3343</v>
+<v>3329</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5608</v>
+<v>5585</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>5623</v>
+<v>5594</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>5598</v>
+<v>5580</v>
 </b>
 <b>
 <a>11</a>
 <b>20</b>
-<v>5554</v>
+<v>5526</v>
 </b>
 <b>
 <a>20</a>
 <b>51</b>
-<v>5320</v>
+<v>5298</v>
 </b>
 <b>
 <a>51</a>
-<b>139941</b>
-<v>4861</v>
+<b>139922</b>
+<v>4841</v>
 </b>
 </bs>
 </hist>
@@ -27880,27 +28084,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31249</v>
+<v>31119</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24997</v>
+<v>24888</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5281</v>
+<v>5259</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>5115</v>
+<v>5094</v>
 </b>
 <b>
 <a>6</a>
 <b>34</b>
-<v>3812</v>
+<v>3796</v>
 </b>
 </bs>
 </hist>
@@ -27910,19 +28114,19 @@
 </relation>
 <relation>
 <name>expr_parent</name>
-<cardinality>3941191</cardinality>
+<cardinality>3919202</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>3941191</v>
+<v>3919202</v>
 </e>
 <e>
 <k>index</k>
-<v>79825</v>
+<v>81592</v>
 </e>
 <e>
 <k>parent</k>
-<v>2587204</v>
+<v>2570313</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27936,7 +28140,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3941191</v>
+<v>3919202</v>
 </b>
 </bs>
 </hist>
@@ -27952,7 +28156,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3941191</v>
+<v>3919202</v>
 </b>
 </bs>
 </hist>
@@ -27968,22 +28172,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66199</v>
+<v>67665</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6197</v>
+<v>6335</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6041</v>
+<v>6175</v>
 </b>
 <b>
 <a>13</a>
-<b>1629954</b>
-<v>1385</v>
+<b>1585226</b>
+<v>1416</v>
 </b>
 </bs>
 </hist>
@@ -27999,22 +28203,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66199</v>
+<v>67665</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6197</v>
+<v>6335</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6041</v>
+<v>6175</v>
 </b>
 <b>
 <a>13</a>
-<b>1629954</b>
-<v>1385</v>
+<b>1585226</b>
+<v>1416</v>
 </b>
 </bs>
 </hist>
@@ -28030,17 +28234,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1624198</v>
+<v>1614187</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>833643</v>
+<v>828683</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>129362</v>
+<v>127441</v>
 </b>
 </bs>
 </hist>
@@ -28056,17 +28260,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1624198</v>
+<v>1614187</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>833643</v>
+<v>828683</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>129362</v>
+<v>127441</v>
 </b>
 </bs>
 </hist>
@@ -28076,11 +28280,11 @@
 </relation>
 <relation>
 <name>expr_parent_top_level</name>
-<cardinality>504910</cardinality>
+<cardinality>498984</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>504910</v>
+<v>498984</v>
 </e>
 <e>
 <k>index</k>
@@ -28088,7 +28292,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>436567</v>
+<v>430936</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28102,7 +28306,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>504910</v>
+<v>498984</v>
 </b>
 </bs>
 </hist>
@@ -28118,7 +28322,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>504910</v>
+<v>498984</v>
 </b>
 </bs>
 </hist>
@@ -28167,13 +28371,13 @@
 <v>4</v>
 </b>
 <b>
-<a>8474</a>
-<b>8475</b>
+<a>8472</a>
+<b>8473</b>
 <v>4</v>
 </b>
 <b>
-<a>89041</a>
-<b>89042</b>
+<a>88257</a>
+<b>88258</b>
 <v>4</v>
 </b>
 </bs>
@@ -28223,13 +28427,13 @@
 <v>4</v>
 </b>
 <b>
-<a>8474</a>
-<b>8475</b>
+<a>8472</a>
+<b>8473</b>
 <v>4</v>
 </b>
 <b>
-<a>88977</a>
-<b>88978</b>
+<a>88193</a>
+<b>88194</b>
 <v>4</v>
 </b>
 </bs>
@@ -28246,17 +28450,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396457</v>
+<v>391004</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35735</v>
+<v>35577</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4373</v>
+<v>4355</v>
 </b>
 </bs>
 </hist>
@@ -28272,17 +28476,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>396638</v>
+<v>391183</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35613</v>
+<v>35455</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4315</v>
+<v>4297</v>
 </b>
 </bs>
 </hist>
@@ -28292,44 +28496,44 @@
 </relation>
 <relation>
 <name>implicitly_typed_array_creation</name>
-<cardinality>10816</cardinality>
+<cardinality>10813</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>10816</v>
+<v>10813</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>explicitly_sized_array_creation</name>
-<cardinality>4358</cardinality>
+<cardinality>4269</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4358</v>
+<v>4269</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>stackalloc_array_creation</name>
-<cardinality>826</cardinality>
+<cardinality>834</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>826</v>
+<v>834</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>implicitly_typed_object_creation</name>
-<cardinality>793</cardinality>
+<cardinality>769</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>793</v>
+<v>769</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -28384,22 +28588,22 @@
 </relation>
 <relation>
 <name>expr_compiler_generated</name>
-<cardinality>1637261</cardinality>
+<cardinality>1626197</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1637261</v>
+<v>1626197</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_value</name>
-<cardinality>1404079</cardinality>
+<cardinality>1394019</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1404079</v>
+<v>1394019</v>
 </e>
 <e>
 <k>value</k>
@@ -28417,7 +28621,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1404079</v>
+<v>1394019</v>
 </b>
 </bs>
 </hist>
@@ -28433,27 +28637,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72271</v>
+<v>72306</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14976</v>
+<v>14951</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>7876</v>
+<v>7873</v>
 </b>
 <b>
 <a>6</a>
-<b>2137</b>
+<b>2586</b>
 <v>7716</v>
 </b>
 <b>
-<a>2251</a>
-<b>272752</b>
-<v>38</v>
+<a>2635</a>
+<b>269984</b>
+<v>31</v>
 </b>
 </bs>
 </hist>
@@ -28463,15 +28667,15 @@
 </relation>
 <relation>
 <name>expr_call</name>
-<cardinality>679346</cardinality>
+<cardinality>677219</cardinality>
 <columnsizes>
 <e>
 <k>caller_id</k>
-<v>679346</v>
+<v>677219</v>
 </e>
 <e>
 <k>target_id</k>
-<v>53851</v>
+<v>53767</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28485,7 +28689,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>679346</v>
+<v>677219</v>
 </b>
 </bs>
 </hist>
@@ -28501,32 +28705,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28347</v>
+<v>28800</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10445</v>
+<v>10037</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4326</v>
+<v>4350</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>4791</v>
+<v>4656</v>
 </b>
 <b>
 <a>7</a>
 <b>24</b>
-<v>4085</v>
+<v>4068</v>
 </b>
 <b>
 <a>24</a>
 <b>43831</b>
-<v>1857</v>
+<v>1856</v>
 </b>
 </bs>
 </hist>
@@ -28536,15 +28740,15 @@
 </relation>
 <relation>
 <name>expr_access</name>
-<cardinality>1389511</cardinality>
+<cardinality>1377653</cardinality>
 <columnsizes>
 <e>
 <k>accesser_id</k>
-<v>1389511</v>
+<v>1377653</v>
 </e>
 <e>
 <k>target_id</k>
-<v>331466</v>
+<v>338815</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28558,7 +28762,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1389511</v>
+<v>1377653</v>
 </b>
 </bs>
 </hist>
@@ -28574,42 +28778,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>104720</v>
+<v>110292</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70740</v>
+<v>71168</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>51595</v>
+<v>54695</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>33429</v>
+<v>33113</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>18856</v>
+<v>19857</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>27048</v>
+<v>25695</v>
 </b>
 <b>
 <a>9</a>
-<b>185</b>
-<v>24863</v>
-</b>
-<b>
-<a>185</a>
-<b>8176</b>
-<v>211</v>
+<b>7782</b>
+<v>23993</v>
 </b>
 </bs>
 </hist>
@@ -28619,15 +28818,15 @@
 </relation>
 <relation>
 <name>expr_location</name>
-<cardinality>4263212</cardinality>
+<cardinality>4241202</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4263212</v>
+<v>4241202</v>
 </e>
 <e>
 <k>loc</k>
-<v>2614548</v>
+<v>3004401</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28641,7 +28840,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4263212</v>
+<v>4241202</v>
 </b>
 </bs>
 </hist>
@@ -28657,17 +28856,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1994761</v>
+<v>2758180</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>610692</v>
+<v>241569</v>
 </b>
 <b>
 <a>3</a>
-<b>111245</b>
-<v>9093</v>
+<b>542807</b>
+<v>4652</v>
 </b>
 </bs>
 </hist>
@@ -28677,15 +28876,15 @@
 </relation>
 <relation>
 <name>dynamic_member_name</name>
-<cardinality>13657</cardinality>
+<cardinality>13600</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>13657</v>
+<v>13600</v>
 </e>
 <e>
 <k>name</k>
-<v>1410</v>
+<v>1404</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28699,7 +28898,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13657</v>
+<v>13600</v>
 </b>
 </bs>
 </hist>
@@ -28715,42 +28914,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410</v>
+<v>408</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>248</v>
+<v>247</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>161</v>
+<v>160</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>112</v>
+<v>111</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>117</v>
+<v>116</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>122</v>
+<v>121</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>107</v>
+<v>106</v>
 </b>
 <b>
 <a>20</a>
 <b>97</b>
-<v>107</v>
+<v>106</v>
 </b>
 <b>
 <a>122</a>
@@ -28765,22 +28964,22 @@
 </relation>
 <relation>
 <name>conditional_access</name>
-<cardinality>3080</cardinality>
+<cardinality>3067</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3080</v>
+<v>3067</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_argument</name>
-<cardinality>875546</cardinality>
+<cardinality>873885</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>875546</v>
+<v>873885</v>
 </e>
 <e>
 <k>mode</k>
@@ -28798,7 +28997,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>875546</v>
+<v>873885</v>
 </b>
 </bs>
 </hist>
@@ -28812,23 +29011,23 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>244</a>
-<b>245</b>
+<a>213</a>
+<b>214</b>
 <v>1</v>
 </b>
 <b>
-<a>4306</a>
-<b>4307</b>
+<a>4293</a>
+<b>4294</b>
 <v>1</v>
 </b>
 <b>
-<a>5699</a>
-<b>5700</b>
+<a>5671</a>
+<b>5672</b>
 <v>1</v>
 </b>
 <b>
-<a>865297</a>
-<b>865298</b>
+<a>863708</a>
+<b>863709</b>
 <v>1</v>
 </b>
 </bs>
@@ -28839,11 +29038,11 @@
 </relation>
 <relation>
 <name>expr_argument_name</name>
-<cardinality>60861</cardinality>
+<cardinality>60805</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>60861</v>
+<v>60805</v>
 </e>
 <e>
 <k>name</k>
@@ -28861,7 +29060,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60861</v>
+<v>60805</v>
 </b>
 </bs>
 </hist>
@@ -28877,17 +29076,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>894</v>
+<v>895</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>487</v>
+<v>486</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>275</v>
+<v>281</v>
 </b>
 <b>
 <a>4</a>
@@ -28896,28 +29095,23 @@
 </b>
 <b>
 <a>5</a>
-<b>7</b>
-<v>197</v>
+<b>8</b>
+<v>251</v>
 </b>
 <b>
-<a>7</a>
-<b>12</b>
-<v>247</v>
+<a>8</a>
+<b>13</b>
+<v>232</v>
 </b>
 <b>
-<a>12</a>
-<b>22</b>
+<a>13</a>
+<b>28</b>
 <v>207</v>
 </b>
 <b>
-<a>22</a>
-<b>198</b>
-<v>206</v>
-</b>
-<b>
-<a>213</a>
+<a>28</a>
 <b>11230</b>
-<v>30</v>
+<v>191</v>
 </b>
 </bs>
 </hist>
@@ -33386,11 +33580,11 @@
 </relation>
 <relation>
 <name>commentline</name>
-<cardinality>410755</cardinality>
+<cardinality>419850</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>410755</v>
+<v>419850</v>
 </e>
 <e>
 <k>kind</k>
@@ -33398,11 +33592,11 @@
 </e>
 <e>
 <k>text</k>
-<v>197044</v>
+<v>201407</v>
 </e>
 <e>
 <k>rawtext</k>
-<v>199656</v>
+<v>204077</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33416,7 +33610,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410755</v>
+<v>419850</v>
 </b>
 </bs>
 </hist>
@@ -33432,7 +33626,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410755</v>
+<v>419850</v>
 </b>
 </bs>
 </hist>
@@ -33448,7 +33642,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410755</v>
+<v>419850</v>
 </b>
 </bs>
 </hist>
@@ -33542,17 +33736,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>161454</v>
+<v>165029</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23485</v>
+<v>24005</v>
 </b>
 <b>
 <a>3</a>
 <b>24462</b>
-<v>12104</v>
+<v>12372</v>
 </b>
 </bs>
 </hist>
@@ -33568,12 +33762,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>195954</v>
+<v>200293</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1090</v>
+<v>1114</v>
 </b>
 </bs>
 </hist>
@@ -33589,12 +33783,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>194967</v>
+<v>199285</v>
 </b>
 <b>
 <a>2</a>
 <b>51</b>
-<v>2076</v>
+<v>2122</v>
 </b>
 </bs>
 </hist>
@@ -33610,17 +33804,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>164777</v>
+<v>168426</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23019</v>
+<v>23528</v>
 </b>
 <b>
 <a>3</a>
 <b>24457</b>
-<v>11859</v>
+<v>12122</v>
 </b>
 </bs>
 </hist>
@@ -33636,7 +33830,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199656</v>
+<v>204077</v>
 </b>
 </bs>
 </hist>
@@ -33652,7 +33846,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199656</v>
+<v>204077</v>
 </b>
 </bs>
 </hist>
@@ -33662,15 +33856,15 @@
 </relation>
 <relation>
 <name>commentline_location</name>
-<cardinality>410755</cardinality>
+<cardinality>419850</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>410755</v>
+<v>419850</v>
 </e>
 <e>
 <k>loc</k>
-<v>410755</v>
+<v>419850</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33684,7 +33878,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410755</v>
+<v>419850</v>
 </b>
 </bs>
 </hist>
@@ -33700,7 +33894,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410755</v>
+<v>419850</v>
 </b>
 </bs>
 </hist>
@@ -33710,26 +33904,26 @@
 </relation>
 <relation>
 <name>commentblock</name>
-<cardinality>144374</cardinality>
+<cardinality>147571</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144374</v>
+<v>147571</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>commentblock_location</name>
-<cardinality>144374</cardinality>
+<cardinality>147571</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144374</v>
+<v>147571</v>
 </e>
 <e>
 <k>loc</k>
-<v>144374</v>
+<v>147571</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33743,7 +33937,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144374</v>
+<v>147571</v>
 </b>
 </bs>
 </hist>
@@ -33759,7 +33953,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144374</v>
+<v>147571</v>
 </b>
 </bs>
 </hist>
@@ -33769,15 +33963,15 @@
 </relation>
 <relation>
 <name>commentblock_binding</name>
-<cardinality>500046</cardinality>
+<cardinality>511118</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144315</v>
+<v>147511</v>
 </e>
 <e>
 <k>entity</k>
-<v>216120</v>
+<v>220905</v>
 </e>
 <e>
 <k>bindtype</k>
@@ -33795,22 +33989,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18063</v>
+<v>18463</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29064</v>
+<v>29708</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>96896</v>
+<v>99041</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>291</v>
+<v>297</v>
 </b>
 </bs>
 </hist>
@@ -33826,22 +34020,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12960</v>
+<v>13247</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5223</v>
+<v>5339</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>29018</v>
+<v>29661</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>97113</v>
+<v>99263</v>
 </b>
 </bs>
 </hist>
@@ -33857,17 +34051,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>158383</v>
+<v>161890</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>42079</v>
+<v>43010</v>
 </b>
 <b>
 <a>3</a>
 <b>9895</b>
-<v>15657</v>
+<v>16003</v>
 </b>
 </bs>
 </hist>
@@ -33883,22 +34077,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94357</v>
+<v>96446</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>92804</v>
+<v>94859</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>28088</v>
+<v>28710</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>870</v>
+<v>890</v>
 </b>
 </bs>
 </hist>
@@ -33970,19 +34164,19 @@
 </relation>
 <relation>
 <name>commentblock_child</name>
-<cardinality>544054</cardinality>
+<cardinality>556101</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144374</v>
+<v>147571</v>
 </e>
 <e>
 <k>commentline</k>
-<v>410669</v>
+<v>419762</v>
 </e>
 <e>
 <k>index</k>
-<v>4990</v>
+<v>5101</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33996,32 +34190,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76929</v>
+<v>78632</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19925</v>
+<v>20367</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>18985</v>
+<v>19406</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8968</v>
+<v>9167</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>11479</v>
+<v>11733</v>
 </b>
 <b>
 <a>8</a>
 <b>4098</b>
-<v>8085</v>
+<v>8264</v>
 </b>
 </bs>
 </hist>
@@ -34037,37 +34231,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4207</v>
+<v>4300</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>73623</v>
+<v>75253</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>21675</v>
+<v>22155</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>17231</v>
+<v>17613</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>8626</v>
+<v>8817</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>11199</v>
+<v>11447</v>
 </b>
 <b>
 <a>9</a>
 <b>4099</b>
-<v>7809</v>
+<v>7982</v>
 </b>
 </bs>
 </hist>
@@ -34083,7 +34277,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>410660</v>
+<v>419753</v>
 </b>
 <b>
 <a>2</a>
@@ -34104,12 +34298,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>277292</v>
+<v>283432</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>133376</v>
+<v>136330</v>
 </b>
 </bs>
 </hist>
@@ -34125,32 +34319,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2227</v>
+<v>2276</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1379</v>
+<v>1410</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>398</v>
+<v>407</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>439</v>
+<v>449</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>379</v>
+<v>388</v>
 </b>
 <b>
 <a>28</a>
 <b>118546</b>
-<v>165</v>
+<v>169</v>
 </b>
 </bs>
 </hist>
@@ -34166,32 +34360,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2227</v>
+<v>2276</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1379</v>
+<v>1410</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>398</v>
+<v>407</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>439</v>
+<v>449</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>379</v>
+<v>388</v>
 </b>
 <b>
 <a>28</a>
 <b>118539</b>
-<v>165</v>
+<v>169</v>
 </b>
 </bs>
 </hist>
@@ -34995,7 +35189,7 @@
 </e>
 <e>
 <k>name</k>
-<v>3</v>
+<v>6</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35023,9 +35217,19 @@
 <budget>12</budget>
 <bs>
 <b>
+<a>1</a>
+<b>2</b>
+<v>4</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1</v>
+</b>
+<b>
 <a>3</a>
 <b>4</b>
-<v>3</v>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -35046,23 +35250,23 @@
 </relation>
 <relation>
 <name>cil_instruction</name>
-<cardinality>32230984</cardinality>
+<cardinality>32096629</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32230984</v>
+<v>32096629</v>
 </e>
 <e>
 <k>opcode</k>
-<v>966</v>
+<v>962</v>
 </e>
 <e>
 <k>index</k>
-<v>333050</v>
+<v>331661</v>
 </e>
 <e>
 <k>impl</k>
-<v>1729473</v>
+<v>1722264</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35076,7 +35280,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32230984</v>
+<v>32096629</v>
 </b>
 </bs>
 </hist>
@@ -35092,7 +35296,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32230984</v>
+<v>32096629</v>
 </b>
 </bs>
 </hist>
@@ -35108,7 +35312,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32230984</v>
+<v>32096629</v>
 </b>
 </bs>
 </hist>
@@ -35124,67 +35328,67 @@
 <b>
 <a>1</a>
 <b>7</b>
-<v>78</v>
+<v>77</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>46</a>
 <b>106</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>128</a>
 <b>302</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>304</a>
 <b>953</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>1002</a>
 <b>1752</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>1791</a>
 <b>2952</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>3194</a>
 <b>4898</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>5191</a>
 <b>11577</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>11669</a>
 <b>19719</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>19906</a>
 <b>53412</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>54233</a>
 <b>104298</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>104740</a>
 <b>420483</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>562153</a>
@@ -35210,62 +35414,62 @@
 <b>
 <a>10</a>
 <b>31</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>32</a>
 <b>68</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>75</a>
 <b>148</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>150</a>
 <b>214</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>214</a>
 <b>313</b>
-<v>78</v>
+<v>77</v>
 </b>
 <b>
 <a>323</a>
 <b>468</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>486</a>
 <b>699</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>714</a>
 <b>872</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>879</a>
 <b>1176</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>1185</a>
 <b>1360</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>1382</a>
 <b>2349</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>2641</a>
 <b>31606</b>
-<v>73</v>
+<v>72</v>
 </b>
 </bs>
 </hist>
@@ -35281,67 +35485,67 @@
 <b>
 <a>1</a>
 <b>6</b>
-<v>78</v>
+<v>77</v>
 </b>
 <b>
 <a>7</a>
 <b>22</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>26</a>
 <b>58</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>62</a>
 <b>191</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>192</a>
 <b>422</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>434</a>
 <b>696</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>703</a>
 <b>993</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>1012</a>
 <b>2698</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>2754</a>
 <b>5088</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>5150</a>
 <b>9841</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>10112</a>
 <b>16999</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>18955</a>
 <b>42845</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>44005</a>
 <b>171634</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>243198</a>
@@ -35362,22 +35566,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>260875</v>
+<v>259787</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30654</v>
+<v>30526</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25538</v>
+<v>25432</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15981</v>
+<v>15914</v>
 </b>
 </bs>
 </hist>
@@ -35393,22 +35597,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>261470</v>
+<v>260380</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17714</v>
+<v>17640</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>28784</v>
+<v>28664</v>
 </b>
 <b>
 <a>5</a>
 <b>160</b>
-<v>24982</v>
+<v>24878</v>
 </b>
 <b>
 <a>160</a>
@@ -35429,22 +35633,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>260875</v>
+<v>259787</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30654</v>
+<v>30526</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25538</v>
+<v>25432</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15981</v>
+<v>15914</v>
 </b>
 </bs>
 </hist>
@@ -35460,57 +35664,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84163</v>
+<v>83812</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252294</v>
+<v>251242</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>332937</v>
+<v>331549</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>196222</v>
+<v>195404</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>107256</v>
+<v>106809</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>158270</v>
+<v>157611</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>151266</v>
+<v>150635</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>134079</v>
+<v>133520</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131726</v>
+<v>131177</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129749</v>
+<v>129208</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51507</v>
+<v>51292</v>
 </b>
 </bs>
 </hist>
@@ -35526,57 +35730,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84163</v>
+<v>83812</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252582</v>
+<v>251529</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>338917</v>
+<v>337504</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>239885</v>
+<v>238885</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>132668</v>
+<v>132115</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>96498</v>
+<v>96095</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>148044</v>
+<v>147427</v>
 </b>
 <b>
 <a>9</a>
 <b>12</b>
-<v>129085</v>
+<v>128547</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>136046</v>
+<v>135479</v>
 </b>
 <b>
 <a>17</a>
 <b>33</b>
-<v>132321</v>
+<v>131770</v>
 </b>
 <b>
 <a>33</a>
 <b>74</b>
-<v>39260</v>
+<v>39096</v>
 </b>
 </bs>
 </hist>
@@ -35592,57 +35796,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>84163</v>
+<v>83812</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>252294</v>
+<v>251242</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>332937</v>
+<v>331549</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>196222</v>
+<v>195404</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>107256</v>
+<v>106809</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>158270</v>
+<v>157611</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>151266</v>
+<v>150635</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>134079</v>
+<v>133520</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131726</v>
+<v>131177</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129749</v>
+<v>129208</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51507</v>
+<v>51292</v>
 </b>
 </bs>
 </hist>
@@ -35652,15 +35856,15 @@
 </relation>
 <relation>
 <name>cil_jump</name>
-<cardinality>2007740</cardinality>
+<cardinality>1999371</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>2007740</v>
+<v>1999371</v>
 </e>
 <e>
 <k>target</k>
-<v>1607992</v>
+<v>1601290</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35674,7 +35878,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2007740</v>
+<v>1999371</v>
 </b>
 </bs>
 </hist>
@@ -35690,17 +35894,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1393929</v>
+<v>1388118</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>143997</v>
+<v>143397</v>
 </b>
 <b>
 <a>3</a>
 <b>360</b>
-<v>70065</v>
+<v>69773</v>
 </b>
 </bs>
 </hist>
@@ -35710,15 +35914,15 @@
 </relation>
 <relation>
 <name>cil_access</name>
-<cardinality>11951094</cardinality>
+<cardinality>11901276</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>11951094</v>
+<v>11901276</v>
 </e>
 <e>
 <k>target</k>
-<v>2670463</v>
+<v>2659331</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35732,7 +35936,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11951094</v>
+<v>11901276</v>
 </b>
 </bs>
 </hist>
@@ -35748,37 +35952,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>947008</v>
+<v>943060</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>741599</v>
+<v>738507</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>269642</v>
+<v>268518</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>187534</v>
+<v>186752</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>227184</v>
+<v>226237</v>
 </b>
 <b>
 <a>7</a>
 <b>14</b>
-<v>203984</v>
+<v>203133</v>
 </b>
 <b>
 <a>14</a>
 <b>25741</b>
-<v>93510</v>
+<v>93120</v>
 </b>
 </bs>
 </hist>
@@ -35788,15 +35992,15 @@
 </relation>
 <relation>
 <name>cil_value</name>
-<cardinality>1888129</cardinality>
+<cardinality>1880259</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>1888129</v>
+<v>1880259</v>
 </e>
 <e>
 <k>value</k>
-<v>495933</v>
+<v>493866</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35810,7 +36014,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1888129</v>
+<v>1880259</v>
 </b>
 </bs>
 </hist>
@@ -35826,27 +36030,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>335100</v>
+<v>333703</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79179</v>
+<v>78849</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>40797</v>
+<v>40627</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>37332</v>
+<v>37176</v>
 </b>
 <b>
 <a>33</a>
 <b>86799</b>
-<v>3524</v>
+<v>3509</v>
 </b>
 </bs>
 </hist>
@@ -35856,19 +36060,19 @@
 </relation>
 <relation>
 <name>cil_switch</name>
-<cardinality>194826</cardinality>
+<cardinality>194014</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>23903</v>
+<v>23804</v>
 </e>
 <e>
 <k>index</k>
-<v>2523</v>
+<v>2513</v>
 </e>
 <e>
 <k>target</k>
-<v>130891</v>
+<v>130346</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35882,42 +36086,42 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>7033</v>
+<v>7004</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4603</v>
+<v>4583</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3236</v>
+<v>3222</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>1688</v>
+<v>1681</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>1444</v>
+<v>1438</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>2162</v>
+<v>2153</v>
 </b>
 <b>
 <a>11</a>
 <b>17</b>
-<v>1850</v>
+<v>1842</v>
 </b>
 <b>
 <a>17</a>
 <b>128</b>
-<v>1796</v>
+<v>1788</v>
 </b>
 <b>
 <a>141</a>
@@ -35938,42 +36142,42 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>1059</v>
+<v>1054</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8264</v>
+<v>8229</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5501</v>
+<v>5478</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2577</v>
+<v>2566</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>1845</v>
+<v>1837</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>1703</v>
+<v>1696</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>1801</v>
+<v>1793</v>
 </b>
 <b>
 <a>14</a>
 <b>204</b>
-<v>1151</v>
+<v>1147</v>
 </b>
 </bs>
 </hist>
@@ -35994,7 +36198,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>990</v>
+<v>986</v>
 </b>
 <b>
 <a>3</a>
@@ -36004,37 +36208,37 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>361</v>
+<v>359</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>205</v>
+<v>204</v>
 </b>
 <b>
 <a>11</a>
 <b>18</b>
-<v>205</v>
+<v>204</v>
 </b>
 <b>
 <a>18</a>
 <b>24</b>
-<v>190</v>
+<v>189</v>
 </b>
 <b>
 <a>25</a>
 <b>47</b>
-<v>200</v>
+<v>199</v>
 </b>
 <b>
 <a>47</a>
 <b>225</b>
-<v>190</v>
+<v>189</v>
 </b>
 <b>
 <a>238</a>
 <b>4898</b>
-<v>107</v>
+<v>106</v>
 </b>
 </bs>
 </hist>
@@ -36050,12 +36254,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39</v>
+<v>38</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>976</v>
+<v>972</v>
 </b>
 <b>
 <a>3</a>
@@ -36065,12 +36269,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>312</v>
+<v>311</v>
 </b>
 <b>
 <a>5</a>
 <b>11</b>
-<v>205</v>
+<v>204</v>
 </b>
 <b>
 <a>11</a>
@@ -36080,17 +36284,17 @@
 <b>
 <a>18</a>
 <b>24</b>
-<v>205</v>
+<v>204</v>
 </b>
 <b>
 <a>24</a>
 <b>47</b>
-<v>195</v>
+<v>194</v>
 </b>
 <b>
 <a>47</a>
 <b>271</b>
-<v>190</v>
+<v>189</v>
 </b>
 <b>
 <a>289</a>
@@ -36111,12 +36315,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>129256</v>
+<v>128717</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>1635</v>
+<v>1628</v>
 </b>
 </bs>
 </hist>
@@ -36132,17 +36336,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>118473</v>
+<v>117979</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>10021</v>
+<v>9979</v>
 </b>
 <b>
 <a>7</a>
 <b>253</b>
-<v>2396</v>
+<v>2386</v>
 </b>
 </bs>
 </hist>
@@ -36220,15 +36424,15 @@
 </relation>
 <relation>
 <name>cil_type_location</name>
-<cardinality>277950</cardinality>
+<cardinality>276791</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>255530</v>
+<v>254465</v>
 </e>
 <e>
 <k>loc</k>
-<v>3421</v>
+<v>3407</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36242,12 +36446,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>233110</v>
+<v>232138</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22419</v>
+<v>22326</v>
 </b>
 </bs>
 </hist>
@@ -36263,67 +36467,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>287</v>
+<v>286</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>219</v>
+<v>218</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>297</v>
+<v>296</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>273</v>
+<v>272</v>
 </b>
 <b>
 <a>13</a>
 <b>17</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>17</a>
 <b>23</b>
-<v>283</v>
+<v>281</v>
 </b>
 <b>
 <a>23</a>
 <b>32</b>
-<v>263</v>
+<v>262</v>
 </b>
 <b>
 <a>32</a>
 <b>43</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>43</a>
 <b>66</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>66</a>
 <b>110</b>
-<v>263</v>
+<v>262</v>
 </b>
 <b>
 <a>112</a>
 <b>238</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>239</a>
 <b>2419</b>
-<v>244</v>
+<v>243</v>
 </b>
 </bs>
 </hist>
@@ -36333,15 +36537,15 @@
 </relation>
 <relation>
 <name>cil_method_location</name>
-<cardinality>1888086</cardinality>
+<cardinality>1880215</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1800486</v>
+<v>1792981</v>
 </e>
 <e>
 <k>loc</k>
-<v>3133</v>
+<v>3120</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36355,12 +36559,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1712886</v>
+<v>1705746</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>87599</v>
+<v>87234</v>
 </b>
 </bs>
 </hist>
@@ -36376,67 +36580,67 @@
 <b>
 <a>1</a>
 <b>11</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>11</a>
 <b>23</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>23</a>
 <b>38</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>38</a>
 <b>53</b>
-<v>253</v>
+<v>252</v>
 </b>
 <b>
 <a>53</a>
 <b>79</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>80</a>
 <b>107</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>107</a>
 <b>138</b>
-<v>248</v>
+<v>247</v>
 </b>
 <b>
 <a>140</a>
 <b>204</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>204</a>
 <b>278</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>281</a>
 <b>385</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>388</a>
 <b>734</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>735</a>
 <b>1631</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>1646</a>
 <b>33686</b>
-<v>205</v>
+<v>204</v>
 </b>
 </bs>
 </hist>
@@ -36446,15 +36650,15 @@
 </relation>
 <relation>
 <name>cil_type</name>
-<cardinality>796498</cardinality>
+<cardinality>793178</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>796498</v>
+<v>793178</v>
 </e>
 <e>
 <k>name</k>
-<v>179460</v>
+<v>178712</v>
 </e>
 <e>
 <k>kind</k>
@@ -36462,11 +36666,11 @@
 </e>
 <e>
 <k>parent</k>
-<v>155766</v>
+<v>155117</v>
 </e>
 <e>
 <k>sourceDecl</k>
-<v>465620</v>
+<v>463679</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36480,7 +36684,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796498</v>
+<v>793178</v>
 </b>
 </bs>
 </hist>
@@ -36496,7 +36700,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796498</v>
+<v>793178</v>
 </b>
 </bs>
 </hist>
@@ -36512,7 +36716,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796498</v>
+<v>793178</v>
 </b>
 </bs>
 </hist>
@@ -36528,7 +36732,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>796498</v>
+<v>793178</v>
 </b>
 </bs>
 </hist>
@@ -36544,22 +36748,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>137959</v>
+<v>137384</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22541</v>
+<v>22447</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>14180</v>
+<v>14121</v>
 </b>
 <b>
 <a>7</a>
 <b>21324</b>
-<v>4778</v>
+<v>4758</v>
 </b>
 </bs>
 </hist>
@@ -36575,7 +36779,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>179460</v>
+<v>178712</v>
 </b>
 </bs>
 </hist>
@@ -36591,17 +36795,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162776</v>
+<v>162097</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>13672</v>
+<v>13615</v>
 </b>
 <b>
 <a>4</a>
 <b>21324</b>
-<v>3011</v>
+<v>2999</v>
 </b>
 </bs>
 </hist>
@@ -36617,17 +36821,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>146438</v>
+<v>145828</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22566</v>
+<v>22472</v>
 </b>
 <b>
 <a>3</a>
 <b>21324</b>
-<v>10455</v>
+<v>10412</v>
 </b>
 </bs>
 </hist>
@@ -36767,27 +36971,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101999</v>
+<v>101574</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>26851</v>
+<v>26740</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13369</v>
+<v>13314</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>11724</v>
+<v>11675</v>
 </b>
 <b>
 <a>33</a>
 <b>26080</b>
-<v>1820</v>
+<v>1813</v>
 </b>
 </bs>
 </hist>
@@ -36803,27 +37007,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102575</v>
+<v>102147</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27271</v>
+<v>27158</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13267</v>
+<v>13212</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11710</v>
+<v>11661</v>
 </b>
 <b>
 <a>38</a>
 <b>1430</b>
-<v>942</v>
+<v>938</v>
 </b>
 </bs>
 </hist>
@@ -36839,12 +37043,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>152554</v>
+<v>151918</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>3211</v>
+<v>3198</v>
 </b>
 </bs>
 </hist>
@@ -36860,27 +37064,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102472</v>
+<v>102045</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27291</v>
+<v>27177</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13174</v>
+<v>13119</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11690</v>
+<v>11641</v>
 </b>
 <b>
 <a>38</a>
 <b>3477</b>
-<v>1137</v>
+<v>1132</v>
 </b>
 </bs>
 </hist>
@@ -36896,12 +37100,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>438778</v>
+<v>436949</v>
 </b>
 <b>
 <a>2</a>
 <b>3705</b>
-<v>26842</v>
+<v>26730</v>
 </b>
 </bs>
 </hist>
@@ -36917,7 +37121,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>465620</v>
+<v>463679</v>
 </b>
 </bs>
 </hist>
@@ -36933,7 +37137,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>465620</v>
+<v>463679</v>
 </b>
 </bs>
 </hist>
@@ -36949,12 +37153,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>457278</v>
+<v>455372</v>
 </b>
 <b>
 <a>2</a>
 <b>225</b>
-<v>8342</v>
+<v>8307</v>
 </b>
 </bs>
 </hist>
@@ -36964,15 +37168,15 @@
 </relation>
 <relation>
 <name>cil_pointer_type</name>
-<cardinality>624</cardinality>
+<cardinality>622</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>624</v>
+<v>622</v>
 </e>
 <e>
 <k>pointee</k>
-<v>624</v>
+<v>622</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36986,7 +37190,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>624</v>
+<v>622</v>
 </b>
 </bs>
 </hist>
@@ -37002,7 +37206,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>624</v>
+<v>622</v>
 </b>
 </bs>
 </hist>
@@ -37012,15 +37216,15 @@
 </relation>
 <relation>
 <name>cil_array_type</name>
-<cardinality>14199</cardinality>
+<cardinality>14140</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14199</v>
+<v>14140</v>
 </e>
 <e>
 <k>element_type</k>
-<v>14121</v>
+<v>14062</v>
 </e>
 <e>
 <k>rank</k>
@@ -37038,7 +37242,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14199</v>
+<v>14140</v>
 </b>
 </bs>
 </hist>
@@ -37054,7 +37258,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14199</v>
+<v>14140</v>
 </b>
 </bs>
 </hist>
@@ -37070,12 +37274,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14048</v>
+<v>13989</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>73</v>
+<v>72</v>
 </b>
 </bs>
 </hist>
@@ -37091,12 +37295,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14048</v>
+<v>13989</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>73</v>
+<v>72</v>
 </b>
 </bs>
 </hist>
@@ -37158,23 +37362,23 @@
 </relation>
 <relation>
 <name>cil_method</name>
-<cardinality>2316799</cardinality>
+<cardinality>2307141</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2316799</v>
+<v>2307141</v>
 </e>
 <e>
 <k>name</k>
-<v>440584</v>
+<v>438748</v>
 </e>
 <e>
 <k>parent</k>
-<v>380730</v>
+<v>379143</v>
 </e>
 <e>
 <k>return_type</k>
-<v>214317</v>
+<v>213424</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37188,7 +37392,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2316799</v>
+<v>2307141</v>
 </b>
 </bs>
 </hist>
@@ -37204,7 +37408,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2316799</v>
+<v>2307141</v>
 </b>
 </bs>
 </hist>
@@ -37220,7 +37424,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2316799</v>
+<v>2307141</v>
 </b>
 </bs>
 </hist>
@@ -37236,27 +37440,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>271453</v>
+<v>270321</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79735</v>
+<v>79403</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>25075</v>
+<v>24970</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>33549</v>
+<v>33409</v>
 </b>
 <b>
 <a>7</a>
 <b>64064</b>
-<v>30771</v>
+<v>30643</v>
 </b>
 </bs>
 </hist>
@@ -37272,27 +37476,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>285486</v>
+<v>284296</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>76689</v>
+<v>76370</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>39933</v>
+<v>39767</v>
 </b>
 <b>
 <a>5</a>
 <b>25</b>
-<v>33212</v>
+<v>33073</v>
 </b>
 <b>
 <a>25</a>
 <b>52725</b>
-<v>5262</v>
+<v>5240</v>
 </b>
 </bs>
 </hist>
@@ -37308,17 +37512,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>384723</v>
+<v>383119</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>40295</v>
+<v>40127</v>
 </b>
 <b>
 <a>4</a>
 <b>2803</b>
-<v>15566</v>
+<v>15501</v>
 </b>
 </bs>
 </hist>
@@ -37334,42 +37538,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>108144</v>
+<v>107694</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>84641</v>
+<v>84288</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50028</v>
+<v>49819</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28614</v>
+<v>28494</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>30918</v>
+<v>30789</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>32968</v>
+<v>32830</v>
 </b>
 <b>
 <a>11</a>
 <b>21</b>
-<v>28999</v>
+<v>28878</v>
 </b>
 <b>
 <a>21</a>
 <b>3536</b>
-<v>16415</v>
+<v>16347</v>
 </b>
 </bs>
 </hist>
@@ -37385,42 +37589,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>114544</v>
+<v>114066</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86799</v>
+<v>86437</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50584</v>
+<v>50373</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28960</v>
+<v>28839</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>32924</v>
+<v>32787</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>30058</v>
+<v>29933</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>28736</v>
+<v>28616</v>
 </b>
 <b>
 <a>26</a>
 <b>1885</b>
-<v>8122</v>
+<v>8088</v>
 </b>
 </bs>
 </hist>
@@ -37436,32 +37640,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162415</v>
+<v>161737</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>93837</v>
+<v>93446</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>46464</v>
+<v>46271</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23332</v>
+<v>23235</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>28438</v>
+<v>28319</v>
 </b>
 <b>
 <a>7</a>
 <b>1924</b>
-<v>26241</v>
+<v>26132</v>
 </b>
 </bs>
 </hist>
@@ -37477,27 +37681,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132170</v>
+<v>131619</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>38298</v>
+<v>38138</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>18871</v>
+<v>18792</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>16591</v>
+<v>16522</v>
 </b>
 <b>
 <a>13</a>
 <b>190707</b>
-<v>8386</v>
+<v>8351</v>
 </b>
 </bs>
 </hist>
@@ -37513,22 +37717,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>153775</v>
+<v>153134</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30390</v>
+<v>30264</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>19173</v>
+<v>19093</v>
 </b>
 <b>
 <a>6</a>
 <b>28461</b>
-<v>10978</v>
+<v>10932</v>
 </b>
 </bs>
 </hist>
@@ -37544,22 +37748,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145613</v>
+<v>145006</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>35443</v>
+<v>35295</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>17577</v>
+<v>17504</v>
 </b>
 <b>
 <a>5</a>
 <b>62018</b>
-<v>15683</v>
+<v>15618</v>
 </b>
 </bs>
 </hist>
@@ -37569,15 +37773,15 @@
 </relation>
 <relation>
 <name>cil_method_source_declaration</name>
-<cardinality>2110238</cardinality>
+<cardinality>2101441</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>2110238</v>
+<v>2101441</v>
 </e>
 <e>
 <k>source</k>
-<v>1867257</v>
+<v>1859473</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37591,7 +37795,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2110238</v>
+<v>2101441</v>
 </b>
 </bs>
 </hist>
@@ -37607,12 +37811,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1762158</v>
+<v>1754813</v>
 </b>
 <b>
 <a>2</a>
 <b>1021</b>
-<v>105098</v>
+<v>104660</v>
 </b>
 </bs>
 </hist>
@@ -37622,19 +37826,19 @@
 </relation>
 <relation>
 <name>cil_method_implementation</name>
-<cardinality>1729473</cardinality>
+<cardinality>1722264</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1729473</v>
+<v>1722264</v>
 </e>
 <e>
 <k>method</k>
-<v>1642518</v>
+<v>1635671</v>
 </e>
 <e>
 <k>location</k>
-<v>3099</v>
+<v>3086</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37648,7 +37852,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1729473</v>
+<v>1722264</v>
 </b>
 </bs>
 </hist>
@@ -37664,7 +37868,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1729473</v>
+<v>1722264</v>
 </b>
 </bs>
 </hist>
@@ -37680,12 +37884,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1555563</v>
+<v>1549078</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86955</v>
+<v>86592</v>
 </b>
 </bs>
 </hist>
@@ -37701,12 +37905,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1555563</v>
+<v>1549078</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86955</v>
+<v>86592</v>
 </b>
 </bs>
 </hist>
@@ -37722,67 +37926,67 @@
 <b>
 <a>1</a>
 <b>11</b>
-<v>273</v>
+<v>272</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>22</a>
 <b>36</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>36</a>
 <b>50</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>50</a>
 <b>74</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>74</a>
 <b>104</b>
-<v>248</v>
+<v>247</v>
 </b>
 <b>
 <a>104</a>
 <b>133</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>133</a>
 <b>192</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>192</a>
 <b>271</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>271</a>
 <b>365</b>
-<v>248</v>
+<v>247</v>
 </b>
 <b>
 <a>372</a>
 <b>654</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>682</a>
 <b>1597</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>1599</a>
 <b>33053</b>
-<v>190</v>
+<v>189</v>
 </b>
 </bs>
 </hist>
@@ -37798,67 +38002,67 @@
 <b>
 <a>1</a>
 <b>11</b>
-<v>273</v>
+<v>272</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>22</a>
 <b>36</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>36</a>
 <b>50</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>50</a>
 <b>74</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>74</a>
 <b>104</b>
-<v>248</v>
+<v>247</v>
 </b>
 <b>
 <a>104</a>
 <b>133</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>133</a>
 <b>192</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>192</a>
 <b>271</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>271</a>
 <b>365</b>
-<v>248</v>
+<v>247</v>
 </b>
 <b>
 <a>372</a>
 <b>654</b>
-<v>234</v>
+<v>233</v>
 </b>
 <b>
 <a>682</a>
 <b>1597</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>1599</a>
 <b>33053</b>
-<v>190</v>
+<v>189</v>
 </b>
 </bs>
 </hist>
@@ -37868,15 +38072,15 @@
 </relation>
 <relation>
 <name>cil_implements</name>
-<cardinality>107285</cardinality>
+<cardinality>106838</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>106524</v>
+<v>106080</v>
 </e>
 <e>
 <k>decl</k>
-<v>17758</v>
+<v>17684</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37890,12 +38094,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>105762</v>
+<v>105321</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>761</v>
+<v>758</v>
 </b>
 </bs>
 </hist>
@@ -37911,27 +38115,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11558</v>
+<v>11510</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2709</v>
+<v>2697</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>1581</v>
+<v>1574</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>1332</v>
+<v>1327</v>
 </b>
 <b>
 <a>18</a>
 <b>2180</b>
-<v>575</v>
+<v>573</v>
 </b>
 </bs>
 </hist>
@@ -37941,23 +38145,23 @@
 </relation>
 <relation>
 <name>cil_field</name>
-<cardinality>1010513</cardinality>
+<cardinality>1006301</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1010513</v>
+<v>1006301</v>
 </e>
 <e>
 <k>parent</k>
-<v>201553</v>
+<v>200712</v>
 </e>
 <e>
 <k>name</k>
-<v>361595</v>
+<v>360088</v>
 </e>
 <e>
 <k>field_type</k>
-<v>166197</v>
+<v>165505</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37971,7 +38175,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1010513</v>
+<v>1006301</v>
 </b>
 </bs>
 </hist>
@@ -37987,7 +38191,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1010513</v>
+<v>1006301</v>
 </b>
 </bs>
 </hist>
@@ -38003,7 +38207,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1010513</v>
+<v>1006301</v>
 </b>
 </bs>
 </hist>
@@ -38019,47 +38223,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60742</v>
+<v>60489</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41115</v>
+<v>40943</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22336</v>
+<v>22243</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15512</v>
+<v>15448</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11734</v>
+<v>11685</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16981</v>
+<v>16911</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17889</v>
+<v>17815</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15122</v>
+<v>15059</v>
 </b>
 <b>
 <a>237</a>
 <b>4205</b>
-<v>117</v>
+<v>116</v>
 </b>
 </bs>
 </hist>
@@ -38075,47 +38279,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60742</v>
+<v>60489</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>41115</v>
+<v>40943</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22336</v>
+<v>22243</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15512</v>
+<v>15448</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11734</v>
+<v>11685</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16981</v>
+<v>16911</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17889</v>
+<v>17815</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15122</v>
+<v>15059</v>
 </b>
 <b>
 <a>237</a>
 <b>4205</b>
-<v>117</v>
+<v>116</v>
 </b>
 </bs>
 </hist>
@@ -38131,37 +38335,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70549</v>
+<v>70255</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>59878</v>
+<v>59629</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20462</v>
+<v>20377</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11485</v>
+<v>11437</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>15717</v>
+<v>15652</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>16088</v>
+<v>16021</v>
 </b>
 <b>
 <a>11</a>
 <b>132</b>
-<v>7370</v>
+<v>7340</v>
 </b>
 </bs>
 </hist>
@@ -38177,22 +38381,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>262383</v>
+<v>261289</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55466</v>
+<v>55234</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30132</v>
+<v>30006</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13613</v>
+<v>13557</v>
 </b>
 </bs>
 </hist>
@@ -38208,22 +38412,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>262383</v>
+<v>261289</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55466</v>
+<v>55234</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30132</v>
+<v>30006</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13613</v>
+<v>13557</v>
 </b>
 </bs>
 </hist>
@@ -38239,17 +38443,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>306022</v>
+<v>304746</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34125</v>
+<v>33982</v>
 </b>
 <b>
 <a>3</a>
 <b>2790</b>
-<v>21448</v>
+<v>21358</v>
 </b>
 </bs>
 </hist>
@@ -38265,32 +38469,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>82786</v>
+<v>82441</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43853</v>
+<v>43670</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8976</v>
+<v>8939</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>15288</v>
+<v>15224</v>
 </b>
 <b>
 <a>7</a>
 <b>31</b>
-<v>12564</v>
+<v>12512</v>
 </b>
 <b>
 <a>31</a>
 <b>21103</b>
-<v>2728</v>
+<v>2717</v>
 </b>
 </bs>
 </hist>
@@ -38306,22 +38510,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96893</v>
+<v>96489</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44580</v>
+<v>44394</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>14258</v>
+<v>14198</v>
 </b>
 <b>
 <a>6</a>
 <b>12257</b>
-<v>10465</v>
+<v>10421</v>
 </b>
 </bs>
 </hist>
@@ -38337,27 +38541,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>120055</v>
+<v>119554</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17997</v>
+<v>17922</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>13267</v>
+<v>13212</v>
 </b>
 <b>
 <a>5</a>
 <b>20</b>
-<v>12491</v>
+<v>12439</v>
 </b>
 <b>
 <a>20</a>
 <b>8901</b>
-<v>2386</v>
+<v>2376</v>
 </b>
 </bs>
 </hist>
@@ -38367,23 +38571,23 @@
 </relation>
 <relation>
 <name>cil_parameter</name>
-<cardinality>4556386</cardinality>
+<cardinality>4537393</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4556386</v>
+<v>4537393</v>
 </e>
 <e>
 <k>method</k>
-<v>2225099</v>
+<v>2215824</v>
 </e>
 <e>
 <k>index</k>
-<v>200</v>
+<v>199</v>
 </e>
 <e>
 <k>param_type</k>
-<v>553698</v>
+<v>551390</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38397,7 +38601,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4556386</v>
+<v>4537393</v>
 </b>
 </bs>
 </hist>
@@ -38413,7 +38617,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4556386</v>
+<v>4537393</v>
 </b>
 </bs>
 </hist>
@@ -38429,7 +38633,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4556386</v>
+<v>4537393</v>
 </b>
 </bs>
 </hist>
@@ -38445,27 +38649,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>902500</v>
+<v>898738</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>789103</v>
+<v>785814</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>325323</v>
+<v>323966</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>175301</v>
+<v>174570</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32870</v>
+<v>32733</v>
 </b>
 </bs>
 </hist>
@@ -38481,27 +38685,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>902500</v>
+<v>898738</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>789103</v>
+<v>785814</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>325323</v>
+<v>323966</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>175301</v>
+<v>174570</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32870</v>
+<v>32733</v>
 </b>
 </bs>
 </hist>
@@ -38517,22 +38721,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>950635</v>
+<v>946672</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>799632</v>
+<v>796299</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>313661</v>
+<v>312354</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>161170</v>
+<v>160498</v>
 </b>
 </bs>
 </hist>
@@ -38781,42 +38985,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185796</v>
+<v>185021</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137354</v>
+<v>136781</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45112</v>
+<v>44924</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>38532</v>
+<v>38372</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>43946</v>
+<v>43763</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42852</v>
+<v>42674</v>
 </b>
 <b>
 <a>11</a>
 <b>27</b>
-<v>41969</v>
+<v>41794</v>
 </b>
 <b>
 <a>27</a>
 <b>58010</b>
-<v>18133</v>
+<v>18058</v>
 </b>
 </bs>
 </hist>
@@ -38832,42 +39036,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>189008</v>
+<v>188220</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>136051</v>
+<v>135484</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45527</v>
+<v>45337</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>37312</v>
+<v>37157</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>44395</v>
+<v>44210</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42911</v>
+<v>42732</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>41808</v>
+<v>41633</v>
 </b>
 <b>
 <a>28</a>
 <b>46068</b>
-<v>16684</v>
+<v>16614</v>
 </b>
 </bs>
 </hist>
@@ -38883,22 +39087,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>386402</v>
+<v>384791</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>110063</v>
+<v>109604</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>44561</v>
+<v>44375</v>
 </b>
 <b>
 <a>4</a>
 <b>36</b>
-<v>12671</v>
+<v>12618</v>
 </b>
 </bs>
 </hist>
@@ -38908,37 +39112,37 @@
 </relation>
 <relation>
 <name>cil_parameter_in</name>
-<cardinality>32421</cardinality>
+<cardinality>32286</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32421</v>
+<v>32286</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_parameter_out</name>
-<cardinality>46123</cardinality>
+<cardinality>45930</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>46123</v>
+<v>45930</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_setter</name>
-<cardinality>106988</cardinality>
+<cardinality>106542</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>106988</v>
+<v>106542</v>
 </e>
 <e>
 <k>method</k>
-<v>106988</v>
+<v>106542</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38952,7 +39156,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106988</v>
+<v>106542</v>
 </b>
 </bs>
 </hist>
@@ -38968,7 +39172,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106988</v>
+<v>106542</v>
 </b>
 </bs>
 </hist>
@@ -38978,11 +39182,11 @@
 </relation>
 <relation>
 <name>cil_custom_modifiers</name>
-<cardinality>4114</cardinality>
+<cardinality>4097</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4114</v>
+<v>4097</v>
 </e>
 <e>
 <k>modifier</k>
@@ -39004,7 +39208,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4114</v>
+<v>4097</v>
 </b>
 </bs>
 </hist>
@@ -39020,7 +39224,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4114</v>
+<v>4097</v>
 </b>
 </bs>
 </hist>
@@ -39144,15 +39348,15 @@
 </relation>
 <relation>
 <name>cil_getter</name>
-<cardinality>380178</cardinality>
+<cardinality>378594</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>380178</v>
+<v>378594</v>
 </e>
 <e>
 <k>method</k>
-<v>380178</v>
+<v>378594</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39166,7 +39370,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380178</v>
+<v>378594</v>
 </b>
 </bs>
 </hist>
@@ -39182,7 +39386,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380178</v>
+<v>378594</v>
 </b>
 </bs>
 </hist>
@@ -39192,15 +39396,15 @@
 </relation>
 <relation>
 <name>cil_adder</name>
-<cardinality>20916</cardinality>
+<cardinality>20829</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20916</v>
+<v>20829</v>
 </e>
 <e>
 <k>method</k>
-<v>20916</v>
+<v>20829</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39214,7 +39418,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20916</v>
+<v>20829</v>
 </b>
 </bs>
 </hist>
@@ -39230,7 +39434,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20916</v>
+<v>20829</v>
 </b>
 </bs>
 </hist>
@@ -39240,15 +39444,15 @@
 </relation>
 <relation>
 <name>cil_remover</name>
-<cardinality>20916</cardinality>
+<cardinality>20829</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20916</v>
+<v>20829</v>
 </e>
 <e>
 <k>method</k>
-<v>20916</v>
+<v>20829</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39262,7 +39466,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20916</v>
+<v>20829</v>
 </b>
 </bs>
 </hist>
@@ -39278,7 +39482,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20916</v>
+<v>20829</v>
 </b>
 </bs>
 </hist>
@@ -39336,23 +39540,23 @@
 </relation>
 <relation>
 <name>cil_property</name>
-<cardinality>380725</cardinality>
+<cardinality>379138</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>380725</v>
+<v>379138</v>
 </e>
 <e>
 <k>parent</k>
-<v>93852</v>
+<v>93461</v>
 </e>
 <e>
 <k>name</k>
-<v>106460</v>
+<v>106017</v>
 </e>
 <e>
 <k>property_type</k>
-<v>49930</v>
+<v>49722</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39366,7 +39570,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380725</v>
+<v>379138</v>
 </b>
 </bs>
 </hist>
@@ -39382,7 +39586,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380725</v>
+<v>379138</v>
 </b>
 </bs>
 </hist>
@@ -39398,7 +39602,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>380725</v>
+<v>379138</v>
 </b>
 </bs>
 </hist>
@@ -39414,42 +39618,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28926</v>
+<v>28805</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22322</v>
+<v>22229</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11436</v>
+<v>11389</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8469</v>
+<v>8433</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5750</v>
+<v>5726</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>8678</v>
+<v>8642</v>
 </b>
 <b>
 <a>9</a>
 <b>25</b>
-<v>7112</v>
+<v>7082</v>
 </b>
 <b>
 <a>25</a>
 <b>1883</b>
-<v>1156</v>
+<v>1152</v>
 </b>
 </bs>
 </hist>
@@ -39465,42 +39669,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33680</v>
+<v>33540</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17826</v>
+<v>17752</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11334</v>
+<v>11287</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8478</v>
+<v>8443</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5730</v>
+<v>5706</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>6638</v>
+<v>6610</v>
 </b>
 <b>
 <a>8</a>
 <b>15</b>
-<v>7229</v>
+<v>7199</v>
 </b>
 <b>
 <a>15</a>
 <b>1883</b>
-<v>2933</v>
+<v>2921</v>
 </b>
 </bs>
 </hist>
@@ -39516,32 +39720,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>35130</v>
+<v>34984</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25812</v>
+<v>25704</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13501</v>
+<v>13445</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8117</v>
+<v>8083</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>7771</v>
+<v>7738</v>
 </b>
 <b>
 <a>8</a>
 <b>50</b>
-<v>3519</v>
+<v>3504</v>
 </b>
 </bs>
 </hist>
@@ -39557,27 +39761,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62763</v>
+<v>62501</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21477</v>
+<v>21388</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6492</v>
+<v>6465</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8776</v>
+<v>8739</v>
 </b>
 <b>
 <a>8</a>
 <b>2134</b>
-<v>6950</v>
+<v>6921</v>
 </b>
 </bs>
 </hist>
@@ -39593,27 +39797,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62763</v>
+<v>62501</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21550</v>
+<v>21461</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6467</v>
+<v>6440</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8791</v>
+<v>8754</v>
 </b>
 <b>
 <a>8</a>
 <b>1400</b>
-<v>6887</v>
+<v>6858</v>
 </b>
 </bs>
 </hist>
@@ -39629,17 +39833,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89595</v>
+<v>89222</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10992</v>
+<v>10946</v>
 </b>
 <b>
 <a>3</a>
 <b>568</b>
-<v>5872</v>
+<v>5847</v>
 </b>
 </bs>
 </hist>
@@ -39655,27 +39859,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31484</v>
+<v>31353</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7531</v>
+<v>7500</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3187</v>
+<v>3174</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>4373</v>
+<v>4355</v>
 </b>
 <b>
 <a>8</a>
 <b>15452</b>
-<v>3353</v>
+<v>3339</v>
 </b>
 </bs>
 </hist>
@@ -39691,27 +39895,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33275</v>
+<v>33137</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7043</v>
+<v>7014</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3050</v>
+<v>3038</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>3870</v>
+<v>3854</v>
 </b>
 <b>
 <a>8</a>
 <b>5858</b>
-<v>2689</v>
+<v>2678</v>
 </b>
 </bs>
 </hist>
@@ -39727,22 +39931,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40011</v>
+<v>39845</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5320</v>
+<v>5298</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>3807</v>
+<v>3791</v>
 </b>
 <b>
 <a>12</a>
 <b>6253</b>
-<v>790</v>
+<v>787</v>
 </b>
 </bs>
 </hist>
@@ -39752,23 +39956,23 @@
 </relation>
 <relation>
 <name>cil_event</name>
-<cardinality>20887</cardinality>
+<cardinality>20799</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>20887</v>
+<v>20799</v>
 </e>
 <e>
 <k>parent</k>
-<v>6472</v>
+<v>6445</v>
 </e>
 <e>
 <k>name</k>
-<v>13091</v>
+<v>13037</v>
 </e>
 <e>
 <k>event_type</k>
-<v>6809</v>
+<v>6781</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39782,7 +39986,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20887</v>
+<v>20799</v>
 </b>
 </bs>
 </hist>
@@ -39798,7 +40002,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20887</v>
+<v>20799</v>
 </b>
 </bs>
 </hist>
@@ -39814,7 +40018,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20887</v>
+<v>20799</v>
 </b>
 </bs>
 </hist>
@@ -39830,17 +40034,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5755</v>
+<v>5731</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>493</v>
+<v>490</v>
 </b>
 <b>
 <a>7</a>
 <b>465</b>
-<v>224</v>
+<v>223</v>
 </b>
 </bs>
 </hist>
@@ -39856,17 +40060,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5755</v>
+<v>5731</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>493</v>
+<v>490</v>
 </b>
 <b>
 <a>7</a>
 <b>465</b>
-<v>224</v>
+<v>223</v>
 </b>
 </bs>
 </hist>
@@ -39882,12 +40086,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5930</v>
+<v>5906</v>
 </b>
 <b>
 <a>2</a>
 <b>20</b>
-<v>488</v>
+<v>486</v>
 </b>
 <b>
 <a>30</a>
@@ -39908,17 +40112,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11680</v>
+<v>11632</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>966</v>
+<v>962</v>
 </b>
 <b>
 <a>4</a>
 <b>566</b>
-<v>444</v>
+<v>442</v>
 </b>
 </bs>
 </hist>
@@ -39934,17 +40138,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11680</v>
+<v>11632</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>966</v>
+<v>962</v>
 </b>
 <b>
 <a>4</a>
 <b>566</b>
-<v>444</v>
+<v>442</v>
 </b>
 </bs>
 </hist>
@@ -39960,12 +40164,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12496</v>
+<v>12444</v>
 </b>
 <b>
 <a>2</a>
 <b>566</b>
-<v>595</v>
+<v>593</v>
 </b>
 </bs>
 </hist>
@@ -39981,27 +40185,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>946</v>
+<v>943</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4524</v>
+<v>4506</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>585</v>
+<v>583</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>575</v>
+<v>573</v>
 </b>
 <b>
 <a>8</a>
 <b>318</b>
-<v>175</v>
+<v>174</v>
 </b>
 </bs>
 </hist>
@@ -40017,17 +40221,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1425</v>
+<v>1419</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5096</v>
+<v>5074</v>
 </b>
 <b>
 <a>3</a>
 <b>32</b>
-<v>287</v>
+<v>286</v>
 </b>
 </bs>
 </hist>
@@ -40043,27 +40247,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1313</v>
+<v>1307</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4354</v>
+<v>4335</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>497</v>
+<v>495</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>532</v>
+<v>529</v>
 </b>
 <b>
 <a>10</a>
 <b>243</b>
-<v>112</v>
+<v>111</v>
 </b>
 </bs>
 </hist>
@@ -40073,23 +40277,23 @@
 </relation>
 <relation>
 <name>cil_local_variable</name>
-<cardinality>1153120</cardinality>
+<cardinality>1148313</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1153120</v>
+<v>1148313</v>
 </e>
 <e>
 <k>impl</k>
-<v>349373</v>
+<v>347916</v>
 </e>
 <e>
 <k>index</k>
-<v>693</v>
+<v>690</v>
 </e>
 <e>
 <k>var_type</k>
-<v>154570</v>
+<v>153926</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40103,7 +40307,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1153120</v>
+<v>1148313</v>
 </b>
 </bs>
 </hist>
@@ -40119,7 +40323,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1153120</v>
+<v>1148313</v>
 </b>
 </bs>
 </hist>
@@ -40135,7 +40339,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1153120</v>
+<v>1148313</v>
 </b>
 </bs>
 </hist>
@@ -40151,37 +40355,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140195</v>
+<v>139610</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62163</v>
+<v>61904</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49423</v>
+<v>49216</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23522</v>
+<v>23424</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31943</v>
+<v>31809</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28916</v>
+<v>28796</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13208</v>
+<v>13153</v>
 </b>
 </bs>
 </hist>
@@ -40197,37 +40401,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>140195</v>
+<v>139610</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>62163</v>
+<v>61904</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49423</v>
+<v>49216</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23522</v>
+<v>23424</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31943</v>
+<v>31809</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28916</v>
+<v>28796</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13208</v>
+<v>13153</v>
 </b>
 </bs>
 </hist>
@@ -40243,32 +40447,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>168911</v>
+<v>168207</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>70163</v>
+<v>69871</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>37912</v>
+<v>37754</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>20647</v>
+<v>20561</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>27750</v>
+<v>27634</v>
 </b>
 <b>
 <a>7</a>
 <b>47</b>
-<v>23986</v>
+<v>23886</v>
 </b>
 </bs>
 </hist>
@@ -40426,7 +40630,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>2</a>
@@ -40502,37 +40706,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>81454</v>
+<v>81114</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27315</v>
+<v>27201</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8386</v>
+<v>8351</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11851</v>
+<v>11802</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>12813</v>
+<v>12759</v>
 </b>
 <b>
 <a>8</a>
 <b>76</b>
-<v>11602</v>
+<v>11554</v>
 </b>
 <b>
 <a>76</a>
 <b>35710</b>
-<v>1147</v>
+<v>1142</v>
 </b>
 </bs>
 </hist>
@@ -40548,32 +40752,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85495</v>
+<v>85139</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31064</v>
+<v>30935</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8400</v>
+<v>8365</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11719</v>
+<v>11671</v>
 </b>
 <b>
 <a>5</a>
 <b>14</b>
-<v>12047</v>
+<v>11996</v>
 </b>
 <b>
 <a>14</a>
 <b>21451</b>
-<v>5842</v>
+<v>5818</v>
 </b>
 </bs>
 </hist>
@@ -40589,27 +40793,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96820</v>
+<v>96416</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>28745</v>
+<v>28626</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13794</v>
+<v>13737</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>11900</v>
+<v>11850</v>
 </b>
 <b>
 <a>9</a>
 <b>122</b>
-<v>3309</v>
+<v>3295</v>
 </b>
 </bs>
 </hist>
@@ -40619,19 +40823,19 @@
 </relation>
 <relation>
 <name>cil_handler</name>
-<cardinality>101672</cardinality>
+<cardinality>101248</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>101672</v>
+<v>101248</v>
 </e>
 <e>
 <k>impl</k>
-<v>71579</v>
+<v>71280</v>
 </e>
 <e>
 <k>index</k>
-<v>78</v>
+<v>77</v>
 </e>
 <e>
 <k>kind</k>
@@ -40639,15 +40843,15 @@
 </e>
 <e>
 <k>try_start</k>
-<v>97825</v>
+<v>97418</v>
 </e>
 <e>
 <k>try_end</k>
-<v>100046</v>
+<v>99629</v>
 </e>
 <e>
 <k>handler_start</k>
-<v>101672</v>
+<v>101248</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40661,7 +40865,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -40677,7 +40881,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -40693,7 +40897,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -40709,7 +40913,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -40725,7 +40929,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -40741,7 +40945,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -40757,22 +40961,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53894</v>
+<v>53669</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11178</v>
+<v>11131</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5437</v>
+<v>5415</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>1069</v>
+<v>1064</v>
 </b>
 </bs>
 </hist>
@@ -40788,22 +40992,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53894</v>
+<v>53669</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11178</v>
+<v>11131</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5437</v>
+<v>5415</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>1069</v>
+<v>1064</v>
 </b>
 </bs>
 </hist>
@@ -40819,17 +41023,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>61997</v>
+<v>61738</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9357</v>
+<v>9318</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>224</v>
+<v>223</v>
 </b>
 </bs>
 </hist>
@@ -40845,22 +41049,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54924</v>
+<v>54695</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10870</v>
+<v>10825</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>5540</v>
+<v>5517</v>
 </b>
 <b>
 <a>7</a>
 <b>15</b>
-<v>244</v>
+<v>243</v>
 </b>
 </bs>
 </hist>
@@ -40876,22 +41080,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54445</v>
+<v>54218</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11090</v>
+<v>11044</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>5535</v>
+<v>5512</v>
 </b>
 <b>
 <a>6</a>
 <b>16</b>
-<v>507</v>
+<v>505</v>
 </b>
 </bs>
 </hist>
@@ -40907,22 +41111,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53894</v>
+<v>53669</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11178</v>
+<v>11131</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5437</v>
+<v>5415</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>1069</v>
+<v>1064</v>
 </b>
 </bs>
 </hist>
@@ -41585,12 +41789,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94521</v>
+<v>94127</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3304</v>
+<v>3290</v>
 </b>
 </bs>
 </hist>
@@ -41606,7 +41810,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97825</v>
+<v>97418</v>
 </b>
 </bs>
 </hist>
@@ -41622,12 +41826,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94521</v>
+<v>94127</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3304</v>
+<v>3290</v>
 </b>
 </bs>
 </hist>
@@ -41643,12 +41847,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95560</v>
+<v>95162</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>2264</v>
+<v>2255</v>
 </b>
 </bs>
 </hist>
@@ -41664,12 +41868,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95604</v>
+<v>95206</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2220</v>
+<v>2211</v>
 </b>
 </bs>
 </hist>
@@ -41685,12 +41889,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94521</v>
+<v>94127</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3304</v>
+<v>3290</v>
 </b>
 </bs>
 </hist>
@@ -41706,12 +41910,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98816</v>
+<v>98404</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>1230</v>
+<v>1224</v>
 </b>
 </bs>
 </hist>
@@ -41727,7 +41931,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100046</v>
+<v>99629</v>
 </b>
 </bs>
 </hist>
@@ -41743,12 +41947,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98816</v>
+<v>98404</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>1230</v>
+<v>1224</v>
 </b>
 </bs>
 </hist>
@@ -41764,12 +41968,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99871</v>
+<v>99454</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>175</v>
+<v>174</v>
 </b>
 </bs>
 </hist>
@@ -41785,7 +41989,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100046</v>
+<v>99629</v>
 </b>
 </bs>
 </hist>
@@ -41801,12 +42005,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98816</v>
+<v>98404</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>1230</v>
+<v>1224</v>
 </b>
 </bs>
 </hist>
@@ -41822,7 +42026,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -41838,7 +42042,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -41854,7 +42058,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -41870,7 +42074,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -41886,7 +42090,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -41902,7 +42106,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101672</v>
+<v>101248</v>
 </b>
 </bs>
 </hist>
@@ -41912,15 +42116,15 @@
 </relation>
 <relation>
 <name>cil_handler_filter</name>
-<cardinality>810</cardinality>
+<cardinality>806</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>810</v>
+<v>806</v>
 </e>
 <e>
 <k>filter_start</k>
-<v>810</v>
+<v>806</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41934,7 +42138,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>810</v>
+<v>806</v>
 </b>
 </bs>
 </hist>
@@ -41950,7 +42154,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>810</v>
+<v>806</v>
 </b>
 </bs>
 </hist>
@@ -41960,15 +42164,15 @@
 </relation>
 <relation>
 <name>cil_handler_type</name>
-<cardinality>43902</cardinality>
+<cardinality>43719</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>43902</v>
+<v>43719</v>
 </e>
 <e>
 <k>catch_type</k>
-<v>1264</v>
+<v>1258</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -41982,7 +42186,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43902</v>
+<v>43719</v>
 </b>
 </bs>
 </hist>
@@ -41998,17 +42202,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>439</v>
+<v>437</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>151</v>
+<v>150</v>
 </b>
 <b>
 <a>4</a>
@@ -42043,15 +42247,15 @@
 </relation>
 <relation>
 <name>cil_method_stack_size</name>
-<cardinality>1729473</cardinality>
+<cardinality>1722264</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>1729473</v>
+<v>1722264</v>
 </e>
 <e>
 <k>size</k>
-<v>161</v>
+<v>160</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42065,7 +42269,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1729473</v>
+<v>1722264</v>
 </b>
 </bs>
 </hist>
@@ -42146,110 +42350,110 @@
 </relation>
 <relation>
 <name>cil_public</name>
-<cardinality>1914064</cardinality>
+<cardinality>1906085</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1914064</v>
+<v>1906085</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_private</name>
-<cardinality>930299</cardinality>
+<cardinality>926421</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>930299</v>
+<v>926421</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_protected</name>
-<cardinality>1821270</cardinality>
+<cardinality>1813678</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1821270</v>
+<v>1813678</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_internal</name>
-<cardinality>41754</cardinality>
+<cardinality>41580</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>41754</v>
+<v>41580</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_static</name>
-<cardinality>796220</cardinality>
+<cardinality>792901</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>796220</v>
+<v>792901</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_sealed</name>
-<cardinality>357144</cardinality>
+<cardinality>355655</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>357144</v>
+<v>355655</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_virtual</name>
-<cardinality>678718</cardinality>
+<cardinality>675889</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>678718</v>
+<v>675889</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_abstract</name>
-<cardinality>165456</cardinality>
+<cardinality>164766</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>165456</v>
+<v>164766</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_class</name>
-<cardinality>238953</cardinality>
+<cardinality>237957</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>238953</v>
+<v>237957</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_interface</name>
-<cardinality>16576</cardinality>
+<cardinality>16507</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16576</v>
+<v>16507</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -42278,37 +42482,37 @@
 </relation>
 <relation>
 <name>cil_specialname</name>
-<cardinality>812328</cardinality>
+<cardinality>808942</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>812328</v>
+<v>808942</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_newslot</name>
-<cardinality>422968</cardinality>
+<cardinality>421205</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>422968</v>
+<v>421205</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_base_class</name>
-<cardinality>235966</cardinality>
+<cardinality>234982</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>235966</v>
+<v>234982</v>
 </e>
 <e>
 <k>base</k>
-<v>21443</v>
+<v>21354</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42322,7 +42526,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>235966</v>
+<v>234982</v>
 </b>
 </bs>
 </hist>
@@ -42338,32 +42542,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12335</v>
+<v>12283</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3865</v>
+<v>3849</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1615</v>
+<v>1608</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>1893</v>
+<v>1886</v>
 </b>
 <b>
 <a>7</a>
 <b>84</b>
-<v>1610</v>
+<v>1604</v>
 </b>
 <b>
 <a>86</a>
 <b>23834</b>
-<v>122</v>
+<v>121</v>
 </b>
 </bs>
 </hist>
@@ -42373,15 +42577,15 @@
 </relation>
 <relation>
 <name>cil_base_interface</name>
-<cardinality>125409</cardinality>
+<cardinality>124887</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>68708</v>
+<v>68422</v>
 </e>
 <e>
 <k>base</k>
-<v>31245</v>
+<v>31114</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42395,27 +42599,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>47773</v>
+<v>47573</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8127</v>
+<v>8093</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>6272</v>
+<v>6246</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>5384</v>
+<v>5361</v>
 </b>
 <b>
 <a>9</a>
 <b>25</b>
-<v>1151</v>
+<v>1147</v>
 </b>
 </bs>
 </hist>
@@ -42431,27 +42635,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22512</v>
+<v>22418</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3436</v>
+<v>3422</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2523</v>
+<v>2513</v>
 </b>
 <b>
 <a>5</a>
 <b>30</b>
-<v>2347</v>
+<v>2338</v>
 </b>
 <b>
 <a>30</a>
 <b>2180</b>
-<v>424</v>
+<v>422</v>
 </b>
 </bs>
 </hist>
@@ -42461,15 +42665,15 @@
 </relation>
 <relation>
 <name>cil_enum_underlying_type</name>
-<cardinality>14092</cardinality>
+<cardinality>14033</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14092</v>
+<v>14033</v>
 </e>
 <e>
 <k>underlying</k>
-<v>39</v>
+<v>38</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42483,7 +42687,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14092</v>
+<v>14033</v>
 </b>
 </bs>
 </hist>
@@ -42544,11 +42748,11 @@
 </relation>
 <relation>
 <name>cil_type_parameter</name>
-<cardinality>185156</cardinality>
+<cardinality>184385</cardinality>
 <columnsizes>
 <e>
 <k>unbound</k>
-<v>104083</v>
+<v>103649</v>
 </e>
 <e>
 <k>index</k>
@@ -42556,7 +42760,7 @@
 </e>
 <e>
 <k>param</k>
-<v>185156</v>
+<v>184385</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42570,22 +42774,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75108</v>
+<v>74795</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19032</v>
+<v>18952</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8171</v>
+<v>8137</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>1771</v>
+<v>1764</v>
 </b>
 </bs>
 </hist>
@@ -42601,22 +42805,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75108</v>
+<v>74795</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19032</v>
+<v>18952</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8171</v>
+<v>8137</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>1771</v>
+<v>1764</v>
 </b>
 </bs>
 </hist>
@@ -42864,7 +43068,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185156</v>
+<v>184385</v>
 </b>
 </bs>
 </hist>
@@ -42880,7 +43084,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185156</v>
+<v>184385</v>
 </b>
 </bs>
 </hist>
@@ -42890,11 +43094,11 @@
 </relation>
 <relation>
 <name>cil_type_argument</name>
-<cardinality>738587</cardinality>
+<cardinality>735508</cardinality>
 <columnsizes>
 <e>
 <k>bound</k>
-<v>482314</v>
+<v>480304</v>
 </e>
 <e>
 <k>index</k>
@@ -42902,7 +43106,7 @@
 </e>
 <e>
 <k>t</k>
-<v>252709</v>
+<v>251655</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42916,17 +43120,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>336857</v>
+<v>335453</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>117595</v>
+<v>117104</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27862</v>
+<v>27746</v>
 </b>
 </bs>
 </hist>
@@ -42942,17 +43146,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>341772</v>
+<v>340348</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>115476</v>
+<v>114995</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>25065</v>
+<v>24960</v>
 </b>
 </bs>
 </hist>
@@ -43180,27 +43384,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100520</v>
+<v>100101</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>72897</v>
+<v>72593</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>42574</v>
+<v>42397</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>20145</v>
+<v>20061</v>
 </b>
 <b>
 <a>6</a>
 <b>4208</b>
-<v>16571</v>
+<v>16502</v>
 </b>
 </bs>
 </hist>
@@ -43216,17 +43420,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>191190</v>
+<v>190393</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55597</v>
+<v>55366</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>5920</v>
+<v>5896</v>
 </b>
 </bs>
 </hist>
@@ -43327,19 +43531,19 @@
 </relation>
 <relation>
 <name>cil_attribute</name>
-<cardinality>328979</cardinality>
+<cardinality>327607</cardinality>
 <columnsizes>
 <e>
 <k>attributeid</k>
-<v>328979</v>
+<v>327607</v>
 </e>
 <e>
 <k>element</k>
-<v>249111</v>
+<v>248073</v>
 </e>
 <e>
 <k>constructor</k>
-<v>3382</v>
+<v>3368</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43353,7 +43557,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328979</v>
+<v>327607</v>
 </b>
 </bs>
 </hist>
@@ -43369,7 +43573,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328979</v>
+<v>327607</v>
 </b>
 </bs>
 </hist>
@@ -43385,17 +43589,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>197755</v>
+<v>196931</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36770</v>
+<v>36617</v>
 </b>
 <b>
 <a>3</a>
 <b>92</b>
-<v>14585</v>
+<v>14524</v>
 </b>
 </bs>
 </hist>
@@ -43411,17 +43615,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>213644</v>
+<v>212753</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>31059</v>
+<v>30930</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>4407</v>
+<v>4389</v>
 </b>
 </bs>
 </hist>
@@ -43437,57 +43641,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>556</v>
+<v>554</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>400</v>
+<v>398</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>287</v>
+<v>286</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>317</v>
+<v>315</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>307</v>
+<v>306</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>263</v>
+<v>262</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>19</a>
 <b>33</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>33</a>
 <b>64</b>
-<v>253</v>
+<v>252</v>
 </b>
 <b>
 <a>64</a>
 <b>179</b>
-<v>253</v>
+<v>252</v>
 </b>
 <b>
 <a>187</a>
 <b>15289</b>
-<v>214</v>
+<v>213</v>
 </b>
 </bs>
 </hist>
@@ -43503,57 +43707,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>600</v>
+<v>597</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>385</v>
+<v>384</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>283</v>
+<v>281</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>317</v>
+<v>315</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>244</v>
+<v>243</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>283</v>
+<v>281</v>
 </b>
 <b>
 <a>10</a>
 <b>17</b>
-<v>253</v>
+<v>252</v>
 </b>
 <b>
 <a>17</a>
 <b>31</b>
-<v>263</v>
+<v>262</v>
 </b>
 <b>
 <a>31</a>
 <b>50</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>50</a>
 <b>151</b>
-<v>253</v>
+<v>252</v>
 </b>
 <b>
 <a>152</a>
 <b>15028</b>
-<v>239</v>
+<v>238</v>
 </b>
 </bs>
 </hist>
@@ -43563,19 +43767,19 @@
 </relation>
 <relation>
 <name>cil_attribute_named_argument</name>
-<cardinality>5569</cardinality>
+<cardinality>5546</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>4632</v>
+<v>4613</v>
 </e>
 <e>
 <k>param</k>
-<v>156</v>
+<v>155</v>
 </e>
 <e>
 <k>value</k>
-<v>1098</v>
+<v>1093</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43589,17 +43793,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3768</v>
+<v>3752</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>790</v>
+<v>787</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>73</v>
+<v>72</v>
 </b>
 </bs>
 </hist>
@@ -43615,12 +43819,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4061</v>
+<v>4044</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>556</v>
+<v>554</v>
 </b>
 <b>
 <a>3</a>
@@ -43717,7 +43921,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78</v>
+<v>77</v>
 </b>
 <b>
 <a>2</a>
@@ -43763,12 +43967,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>722</v>
+<v>719</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>239</v>
+<v>238</v>
 </b>
 <b>
 <a>3</a>
@@ -43794,7 +43998,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1069</v>
+<v>1064</v>
 </b>
 <b>
 <a>2</a>
@@ -43809,11 +44013,11 @@
 </relation>
 <relation>
 <name>cil_attribute_positional_argument</name>
-<cardinality>96356</cardinality>
+<cardinality>95954</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>90220</v>
+<v>89844</v>
 </e>
 <e>
 <k>index</k>
@@ -43821,7 +44025,7 @@
 </e>
 <e>
 <k>value</k>
-<v>17147</v>
+<v>17076</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43835,12 +44039,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85529</v>
+<v>85173</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4690</v>
+<v>4671</v>
 </b>
 </bs>
 </hist>
@@ -43856,12 +44060,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85539</v>
+<v>85183</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4681</v>
+<v>4661</v>
 </b>
 </bs>
 </hist>
@@ -43954,22 +44158,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12364</v>
+<v>12312</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2465</v>
+<v>2454</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>1430</v>
+<v>1424</v>
 </b>
 <b>
 <a>6</a>
 <b>5555</b>
-<v>888</v>
+<v>884</v>
 </b>
 </bs>
 </hist>
@@ -43985,12 +44189,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16820</v>
+<v>16750</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>327</v>
+<v>325</v>
 </b>
 </bs>
 </hist>
@@ -44000,19 +44204,19 @@
 </relation>
 <relation>
 <name>metadata_handle</name>
-<cardinality>6189640</cardinality>
+<cardinality>6162511</cardinality>
 <columnsizes>
 <e>
 <k>entity</k>
-<v>5697807</v>
+<v>5673695</v>
 </e>
 <e>
 <k>location</k>
-<v>3421</v>
+<v>3407</v>
 </e>
 <e>
 <k>handle</k>
-<v>274621</v>
+<v>273476</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44026,17 +44230,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5224190</v>
+<v>5203021</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>464581</v>
+<v>461677</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>9035</v>
+<v>8997</v>
 </b>
 </bs>
 </hist>
@@ -44052,12 +44256,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5456559</v>
+<v>5434421</v>
 </b>
 <b>
 <a>2</a>
 <b>59</b>
-<v>241247</v>
+<v>239274</v>
 </b>
 </bs>
 </hist>
@@ -44073,67 +44277,67 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>287</v>
+<v>286</v>
 </b>
 <b>
 <a>3</a>
 <b>36</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>36</a>
 <b>79</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>79</a>
 <b>130</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>130</a>
 <b>200</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>200</a>
-<b>289</b>
-<v>263</v>
+<b>288</b>
+<v>257</v>
 </b>
 <b>
-<a>290</a>
-<b>404</b>
-<v>258</v>
+<a>288</a>
+<b>400</b>
+<v>257</v>
 </b>
 <b>
-<a>407</a>
-<b>529</b>
-<v>258</v>
+<a>403</a>
+<b>527</b>
+<v>257</v>
 </b>
 <b>
-<a>531</a>
-<b>748</b>
-<v>258</v>
+<a>528</a>
+<b>744</b>
+<v>257</v>
 </b>
 <b>
-<a>749</a>
+<a>747</a>
 <b>1109</b>
-<v>258</v>
+<v>262</v>
 </b>
 <b>
 <a>1116</a>
 <b>1915</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>1920</a>
 <b>4051</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>4053</a>
 <b>50922</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>67370</a>
@@ -44154,67 +44358,67 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>287</v>
+<v>286</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>283</v>
+<v>281</v>
 </b>
 <b>
 <a>20</a>
 <b>46</b>
-<v>268</v>
+<v>267</v>
 </b>
 <b>
 <a>46</a>
 <b>76</b>
-<v>263</v>
+<v>262</v>
 </b>
 <b>
 <a>77</a>
 <b>119</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>119</a>
 <b>176</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>176</a>
 <b>253</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>255</a>
 <b>332</b>
-<v>263</v>
+<v>262</v>
 </b>
 <b>
 <a>338</a>
 <b>481</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>483</a>
 <b>683</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>685</a>
 <b>1273</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>1295</a>
 <b>2685</b>
-<v>258</v>
+<v>257</v>
 </b>
 <b>
 <a>2710</a>
 <b>55264</b>
-<v>244</v>
+<v>243</v>
 </b>
 </bs>
 </hist>
@@ -44230,62 +44434,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18968</v>
+<v>18889</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>45103</v>
+<v>44915</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>23957</v>
+<v>23857</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>17543</v>
+<v>17470</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>30190</v>
+<v>30064</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>19007</v>
+<v>18928</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>22126</v>
+<v>22034</v>
 </b>
 <b>
 <a>11</a>
 <b>13</b>
-<v>21072</v>
+<v>20984</v>
 </b>
 <b>
 <a>13</a>
 <b>21</b>
-<v>21502</v>
+<v>21412</v>
 </b>
 <b>
 <a>21</a>
 <b>39</b>
-<v>21165</v>
+<v>21077</v>
 </b>
 <b>
 <a>39</a>
 <b>83</b>
-<v>20608</v>
+<v>20522</v>
 </b>
 <b>
 <a>83</a>
 <b>1061</b>
-<v>13374</v>
+<v>13318</v>
 </b>
 </bs>
 </hist>
@@ -44301,52 +44505,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>63017</v>
+<v>62754</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21131</v>
+<v>21042</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>47070</v>
+<v>46874</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18968</v>
+<v>18889</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>19432</v>
+<v>19351</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>22102</v>
+<v>22010</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>23332</v>
+<v>23235</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>22034</v>
+<v>21942</v>
 </b>
 <b>
 <a>19</a>
 <b>41</b>
-<v>20891</v>
+<v>20804</v>
 </b>
 <b>
 <a>41</a>
 <b>702</b>
-<v>16640</v>
+<v>16570</v>
 </b>
 </bs>
 </hist>

From 8fa3ffe12550da73307be141e8d9c7356a1ab578 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 12 Jan 2021 18:33:58 +0000
Subject: [PATCH 228/343] C++: Add a few more test cases that we don't
 recognize as OK.

---
 .../MemoryLeakOnFailedCallToRealloc.expected  |  3 ++
 .../Security/CWE/CWE-401/semmle/tests/test.c  | 47 +++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected
index c9b574fe315..e07c83019de 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected
@@ -2,3 +2,6 @@
 | test.c:63:29:63:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
 | test.c:139:29:139:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
 | test.c:186:29:186:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
+| test.c:282:29:282:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
+| test.c:299:26:299:32 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
+| test.c:316:33:316:39 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
index fcf60467ba9..a2c42f364d5 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
@@ -272,3 +272,50 @@ unsigned char * noBadResize_2_7(unsigned char * buffer,size_t currentSize,size_t
 	myASSERT_2(buffer);
 	return buffer;
 }
+
+unsigned char *goodResize_3_1(unsigned char *buffer, size_t currentSize, size_t newSize)
+{
+	// GOOD: this way we will exclude possible memory leak [FALSE POSITIVE]
+	unsigned char *tmp = buffer;
+	if (currentSize < newSize)
+	{
+		buffer = (unsigned char *)realloc(buffer, newSize);
+		if (buffer == NULL)
+		{
+			free(tmp);
+			return NULL;
+		} 
+	}
+
+	return buffer;
+}
+
+unsigned char *goodResize_3_2(unsigned char *buffer, size_t currentSize, size_t newSize)
+{
+	// GOOD: this way we will exclude possible memory leak [FALSE POSITIVE]
+	unsigned char *tmp = buffer;
+	if (currentSize < newSize)
+	{
+		tmp = (unsigned char *)realloc(tmp, newSize);
+		if (tmp != 0)
+		{
+			buffer = tmp;
+		} 
+	}
+
+	return buffer;
+}
+
+void abort(void);
+
+unsigned char *noBadResize_4_1(unsigned char *buffer, size_t currentSize, size_t newSize)
+{
+	// GOOD: program to end [FALSE POSITIVE]
+	if (currentSize < newSize)
+	{
+		if (buffer = (unsigned char *)realloc(buffer, newSize))
+			abort();
+	}
+
+	return buffer;
+}

From fe4ae7e975a4b4f42e6e7456c38276969e673a4c Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 12 Jan 2021 17:22:07 +0000
Subject: [PATCH 229/343] C++: General solution for functions that may exit.

---
 .../MemoryLeakOnFailedCallToRealloc.ql        | 52 +++++++------------
 .../MemoryLeakOnFailedCallToRealloc.expected  |  1 -
 .../Security/CWE/CWE-401/semmle/tests/test.c  |  2 +-
 3 files changed, 21 insertions(+), 34 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql b/cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
index da54d9a49bf..d6ae493cbf5 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
@@ -13,6 +13,19 @@
 
 import cpp
 
+/**
+ * A function call that potentially does not return (such as `exit`).
+ */
+class CallMayNotReturn extends FunctionCall {
+  CallMayNotReturn() {
+    // call that is known to not return
+    not exists(this.(ControlFlowNode).getASuccessor())
+    or
+    // call to another function that may not return
+    exists(CallMayNotReturn exit | getTarget() = exit.getEnclosingFunction())
+  }
+}
+
 /**
  * A call to `realloc` of the form `v = realloc(v, size)`, for some variable `v`.
  */
@@ -30,40 +43,15 @@ class ReallocCallLeak extends FunctionCall {
     )
   }
 
-  predicate isExistsIfWithExitCall() {
-    exists(IfStmt ifc |
-      this.getArgument(0) = v.getAnAccess() and
-      ifc.getCondition().getAChild*() = v.getAnAccess() and
-      ifc.getEnclosingFunction() = this.getEnclosingFunction() and
-      ifc.getLocation().getStartLine() >= this.getArgument(0).getLocation().getStartLine() and
-      exists(FunctionCall fc |
-        fc.getTarget().hasName("exit") and
-        fc.getEnclosingFunction() = this.getEnclosingFunction() and
-        (ifc.getThen().getAChild*() = fc or ifc.getElse().getAChild*() = fc)
-      )
-      or
-      exists(FunctionCall fc, FunctionCall ftmp1, FunctionCall ftmp2 |
-        ftmp1.getTarget().hasName("exit") and
-        ftmp2.(ControlFlowNode).getASuccessor*() = ftmp1 and
-        fc = ftmp2.getEnclosingFunction().getACallToThisFunction() and
-        fc.getEnclosingFunction() = this.getEnclosingFunction() and
-        (ifc.getThen().getAChild*() = fc or ifc.getElse().getAChild*() = fc)
-      )
-    )
-  }
-
-  predicate isExistsAssertWithArgumentCall() {
-    exists(FunctionCall fc |
-      fc.getTarget().hasName("__assert_fail") and
-      this.getEnclosingFunction() = fc.getEnclosingFunction() and
-      fc.getLocation().getStartLine() > this.getArgument(0).getLocation().getEndLine() and
-      fc.getArgument(0).toString().matches("%" + this.getArgument(0).toString() + "%")
-    )
+  /**
+   * Holds if failure of this allocation may be handled by termination, for
+   * example a call to `exit()`.
+   */
+  predicate mayHandleByTermination() {
+    this.(ControlFlowNode).getASuccessor*() instanceof CallMayNotReturn
   }
 }
 
 from ReallocCallLeak rcl
-where
-  not rcl.isExistsIfWithExitCall() and
-  not rcl.isExistsAssertWithArgumentCall()
+where not rcl.mayHandleByTermination()
 select rcl, "possible loss of original pointer on unsuccessful call realloc"
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected
index e07c83019de..adedc030f5f 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected
@@ -4,4 +4,3 @@
 | test.c:186:29:186:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
 | test.c:282:29:282:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
 | test.c:299:26:299:32 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
-| test.c:316:33:316:39 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
index a2c42f364d5..037f58bc15e 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
@@ -310,7 +310,7 @@ void abort(void);
 
 unsigned char *noBadResize_4_1(unsigned char *buffer, size_t currentSize, size_t newSize)
 {
-	// GOOD: program to end [FALSE POSITIVE]
+	// GOOD: program to end
 	if (currentSize < newSize)
 	{
 		if (buffer = (unsigned char *)realloc(buffer, newSize))

From d2dd19a293c65677a7c4fca50e3f7708fcdacc55 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 12 Jan 2021 17:41:39 +0000
Subject: [PATCH 230/343] C++: It turns out __assert_fail is special (see
 DefaultOptions.qll) so we don't need a body here. And the body was wrong.

---
 .../query-tests/Security/CWE/CWE-401/semmle/tests/test.c        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
index 037f58bc15e..d125d85607d 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
@@ -2,7 +2,7 @@
 #define NULL ((void*)0)
 
 #define assert(x) if (!(x)) __assert_fail(#x,__FILE__,__LINE__)
-void __assert_fail(const char *assertion, const char *file, int line) {  }
+void __assert_fail(const char *assertion, const char *file, int line);
 
 void aFakeFailed_1(int file, int line)
 {

From 69913c053e359caa4824f6ba58ed91817f955536 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 19 Jan 2021 18:10:22 +0100
Subject: [PATCH 231/343] Python: relative line numbers in MISSING-annotations

---
 .../experimental/dataflow/coverage/classes.py |  6 ++---
 .../experimental/dataflow/coverage/test.py    | 26 +++++++++----------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/python/ql/test/experimental/dataflow/coverage/classes.py b/python/ql/test/experimental/dataflow/coverage/classes.py
index 654297d3145..d9586f4997f 100644
--- a/python/ql/test/experimental/dataflow/coverage/classes.py
+++ b/python/ql/test/experimental/dataflow/coverage/classes.py
@@ -421,7 +421,7 @@ def test_set_name():
 # classmethod object.__init_subclass__(cls)
 class With_init_subclass:
     def __init_subclass__(cls):
-        SINK1(cls)  #$ MISSING: arg1="Tuple[0], l:429 -> cls"
+        SINK1(cls)  #$ MISSING: arg1="Tuple[0], l:+5 -> cls"
         OK()  # Call not found
 
 
@@ -441,7 +441,7 @@ class With_prepare(type):
     def __prepare__(name, bases, **kwds):
         SINK3(kwds)  # Flow not tested
         SINK2(bases)  # Flow not tested
-        SINK1(name)  #$ MISSING: arg1="arg1, l:450 -> name"
+        SINK1(name)  #$ MISSING: arg1="arg1, l:+6 -> name"
         OK()  # Call not found
         return kwds
 
@@ -871,7 +871,7 @@ def test_or():
 # object.__radd__(self, other)
 class With_radd:
     def __radd__(self, other):
-        SINK2(other)  #$ MISSING: arg2="arg2, l:882 -> other"
+        SINK2(other)  #$ MISSING: arg2="arg2, l:+8 -> other"
         SINK1(self)
         OK()  # Call not found
         return self
diff --git a/python/ql/test/experimental/dataflow/coverage/test.py b/python/ql/test/experimental/dataflow/coverage/test.py
index eb33273cd4e..a37b63215a2 100644
--- a/python/ql/test/experimental/dataflow/coverage/test.py
+++ b/python/ql/test/experimental/dataflow/coverage/test.py
@@ -203,7 +203,7 @@ def test_nested_comprehension_paren():
 # 6.2.8. Generator expressions
 def test_generator():
     x = (SOURCE for y in [NONSOURCE])
-    SINK([*x][0]) #$ MISSING:flow="SOURCE, l:205 -> List[0]"
+    SINK([*x][0]) #$ MISSING:flow="SOURCE, l:-1 -> List[0]"
 
 
 # 6.2.9. Yield expressions
@@ -213,7 +213,7 @@ def gen(x):
 
 def test_yield():
     g = gen(SOURCE)
-    SINK(next(g)) #$ MISSING:flow="SOURCE, l:215 -> next()"
+    SINK(next(g)) #$ MISSING:flow="SOURCE, l:-1 -> next()"
 
 
 def gen_from(x):
@@ -222,7 +222,7 @@ def gen_from(x):
 
 def test_yield_from():
     g = gen_from(SOURCE)
-    SINK(next(g)) #$ MISSING:flow="SOURCE, l:224 -> next()"
+    SINK(next(g)) #$ MISSING:flow="SOURCE, l:-1 -> next()"
 
 
 # a statement rather than an expression, but related to generators
@@ -234,7 +234,7 @@ def test_for():
 # 6.2.9.1. Generator-iterator methods
 def test___next__():
     g = gen(SOURCE)
-    SINK(g.__next__()) #$ MISSING:flow="SOURCE, l:236 -> g.__next__()"
+    SINK(g.__next__()) #$ MISSING:flow="SOURCE, l:-1 -> g.__next__()"
 
 
 def gen2(x):
@@ -259,7 +259,7 @@ def gen_ex(x):
 def test_throw():
     g = gen_ex(SOURCE)
     n = next(g)
-    SINK(g.throw(TypeError)) #$ MISSING:flow="SOURCE, l:260 -> g.throw()"
+    SINK(g.throw(TypeError)) #$ MISSING:flow="SOURCE, l:-2 -> g.throw()"
 
 
 # no `test_close` as `close` involves no data flow
@@ -280,7 +280,7 @@ def runa(a):
 
 async def atest___anext__():
     g = agen(SOURCE)
-    SINK(await g.__anext__()) #$ MISSING:flow="SOURCE, l:282 -> g.__anext__()"
+    SINK(await g.__anext__()) #$ MISSING:flow="SOURCE, l:-1 -> g.__anext__()"
 
 
 def test___anext__():
@@ -313,7 +313,7 @@ async def agen_ex(x):
 async def atest_athrow():
     g = agen_ex(SOURCE)
     n = await g.__anext__()
-    SINK(await g.athrow(TypeError)) #$ MISSING:flow="SOURCE, l:314 -> g.athrow()"
+    SINK(await g.athrow(TypeError)) #$ MISSING:flow="SOURCE, l:-2 -> g.athrow()"
 
 
 def test_athrow():
@@ -326,7 +326,7 @@ class C:
 
 
 def test_attribute_reference():
-    SINK(C.a) #$ MISSING:flow="SOURCE, l:325 -> C.a"
+    SINK(C.a) #$ MISSING:flow="SOURCE, l:-4 -> C.a"
 
 
 # overriding __getattr__ should be tested by the class coverage tests
@@ -376,7 +376,7 @@ def test_call_keyword():
 
 
 def test_call_unpack_iterable():
-    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="SOURCE -> second(..)" MISING:flow="'source', l:20 -> second(..)"
+    SINK(second(NONSOURCE, *[SOURCE])) #$ MISSING:flow="SOURCE -> second(..)"
 
 
 def test_call_unpack_mapping():
@@ -547,7 +547,7 @@ def test_dynamic_tuple_creation_1():
     tup += (SOURCE,)
     tup += (NONSOURCE,)
 
-    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:547 -> tup[0]" MISING:flow="'source', l:20 -> tup[0]"
+    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:-3 -> tup[0]"
     SINK_F(tup[1])
 
 
@@ -557,7 +557,7 @@ def test_dynamic_tuple_creation_2():
     tup += (SOURCE,)
     tup += (NONSOURCE,)
 
-    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:557 -> tup[0]" MISING:flow="'source', l:20 -> tup[0]"
+    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:-3 -> tup[0]"
     SINK_F(tup[1])
 
 
@@ -567,7 +567,7 @@ def test_dynamic_tuple_creation_3():
     tup2 = (NONSOURCE,)
     tup = tup1 + tup2
 
-    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:566 -> tup[0]" MISING:flow="'source', l:20 -> tup[0]"
+    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:-4 -> tup[0]"
     SINK_F(tup[1])
 
 
@@ -578,5 +578,5 @@ def test_dynamic_tuple_creation_4():
     for item in [SOURCE, NONSOURCE]:
         tup += (item,)
 
-    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:578 -> tup[0]" MISING:flow="'source', l:20 -> tup[0]"
+    SINK(tup[0]) #$ MISSING:flow="SOURCE, l:-3 -> tup[0]"
     SINK_F(tup[1])

From ae38bbe03b35eb74eb699d46de5c19e62b57aedf Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 19 Jan 2021 18:19:11 +0100
Subject: [PATCH 232/343] Python: Fearlessly adding another test in the middle
 of the file.

---
 .../ql/test/experimental/dataflow/coverage/argumentPassing.py | 2 +-
 python/ql/test/experimental/dataflow/coverage/test.py         | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
index 67650c149d3..db19860a901 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
+++ b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
@@ -112,7 +112,7 @@ def with_multiple_kw_args(a, b, c):
     SINK3(c)
 
 
-@expects(9)
+@expects(12)
 def test_multiple_kw_args():
     with_multiple_kw_args(b=arg2, c=arg3, a=arg1)  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=with_multiple_kw_args
     with_multiple_kw_args(arg1, *(arg2,), arg3)  #$ arg1="arg1" func=with_multiple_kw_args MISSING: arg2="arg2" arg3="arg3"
diff --git a/python/ql/test/experimental/dataflow/coverage/test.py b/python/ql/test/experimental/dataflow/coverage/test.py
index a37b63215a2..691d1f16097 100644
--- a/python/ql/test/experimental/dataflow/coverage/test.py
+++ b/python/ql/test/experimental/dataflow/coverage/test.py
@@ -325,9 +325,11 @@ class C:
     a = SOURCE
 
 
+@expects(2)
 def test_attribute_reference():
     SINK(C.a) #$ MISSING:flow="SOURCE, l:-4 -> C.a"
-
+    c = C()
+    SINK(c.a) #$ MISSING:flow="SOURCE, l:-6 -> c.a"
 
 # overriding __getattr__ should be tested by the class coverage tests
 

From 8e126603b3594ee036c1339be0814c623173d0bc Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 19 Jan 2021 18:21:27 +0100
Subject: [PATCH 233/343] Python: Remember that old style tests still needs
 updated expectations.

---
 .../dataflow/coverage/dataflow.expected       | 186 +++++++++---------
 1 file changed, 93 insertions(+), 93 deletions(-)

diff --git a/python/ql/test/experimental/dataflow/coverage/dataflow.expected b/python/ql/test/experimental/dataflow/coverage/dataflow.expected
index 3bb58f50618..83d1799cceb 100644
--- a/python/ql/test/experimental/dataflow/coverage/dataflow.expected
+++ b/python/ql/test/experimental/dataflow/coverage/dataflow.expected
@@ -95,35 +95,35 @@ edges
 | test.py:199:33:199:40 | ControlFlowNode for List [List element] | test.py:199:28:199:28 | SSA variable z |
 | test.py:199:34:199:39 | ControlFlowNode for SOURCE | test.py:199:33:199:40 | ControlFlowNode for List [List element] |
 | test.py:200:10:200:10 | ControlFlowNode for x [List element] | test.py:200:10:200:13 | ControlFlowNode for Subscript |
-| test.py:336:11:336:16 | ControlFlowNode for SOURCE | test.py:336:11:336:17 | ControlFlowNode for Tuple [Tuple element at index 0] |
-| test.py:336:11:336:17 | ControlFlowNode for Tuple [Tuple element at index 0] | test.py:336:10:336:21 | ControlFlowNode for Subscript |
-| test.py:340:10:340:17 | ControlFlowNode for List [List element] | test.py:340:10:340:20 | ControlFlowNode for Subscript |
-| test.py:340:11:340:16 | ControlFlowNode for SOURCE | test.py:340:10:340:17 | ControlFlowNode for List [List element] |
-| test.py:344:10:344:22 | ControlFlowNode for Dict [Dictionary element at key s] | test.py:344:10:344:27 | ControlFlowNode for Subscript |
-| test.py:344:16:344:21 | ControlFlowNode for SOURCE | test.py:344:10:344:22 | ControlFlowNode for Dict [Dictionary element at key s] |
-| test.py:367:28:367:33 | ControlFlowNode for SOURCE | test.py:367:10:367:34 | ControlFlowNode for second() |
-| test.py:375:30:375:35 | ControlFlowNode for SOURCE | test.py:375:10:375:36 | ControlFlowNode for second() |
-| test.py:383:10:383:43 | KwUnpacked b | test.py:383:10:383:43 | ControlFlowNode for second() |
-| test.py:383:30:383:42 | ControlFlowNode for Dict [Dictionary element at key b] | test.py:383:10:383:43 | KwUnpacked b |
-| test.py:383:36:383:41 | ControlFlowNode for SOURCE | test.py:383:30:383:42 | ControlFlowNode for Dict [Dictionary element at key b] |
-| test.py:391:10:391:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] | test.py:391:10:391:39 | ControlFlowNode for f_extra_pos() |
-| test.py:391:33:391:38 | ControlFlowNode for SOURCE | test.py:391:10:391:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] |
-| test.py:399:10:399:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] | test.py:399:10:399:45 | ControlFlowNode for f_extra_keyword() |
-| test.py:399:39:399:44 | ControlFlowNode for SOURCE | test.py:399:10:399:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] |
-| test.py:420:10:420:15 | ControlFlowNode for SOURCE | test.py:420:10:420:38 | ControlFlowNode for IfExp |
-| test.py:428:34:428:39 | ControlFlowNode for SOURCE | test.py:428:10:428:39 | ControlFlowNode for IfExp |
-| test.py:452:12:452:17 | ControlFlowNode for SOURCE | test.py:452:10:452:18 | ControlFlowNode for f() |
-| test.py:459:28:459:33 | ControlFlowNode for SOURCE | test.py:459:10:459:34 | ControlFlowNode for second() |
-| test.py:473:30:473:35 | ControlFlowNode for SOURCE | test.py:473:10:473:36 | ControlFlowNode for second() |
-| test.py:487:10:487:43 | KwUnpacked b | test.py:487:10:487:43 | ControlFlowNode for second() |
-| test.py:487:30:487:42 | ControlFlowNode for Dict [Dictionary element at key b] | test.py:487:10:487:43 | KwUnpacked b |
-| test.py:487:36:487:41 | ControlFlowNode for SOURCE | test.py:487:30:487:42 | ControlFlowNode for Dict [Dictionary element at key b] |
-| test.py:492:10:492:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] | test.py:492:10:492:39 | ControlFlowNode for f_extra_pos() |
-| test.py:492:33:492:38 | ControlFlowNode for SOURCE | test.py:492:10:492:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] |
-| test.py:497:10:497:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] | test.py:497:10:497:45 | ControlFlowNode for f_extra_keyword() |
-| test.py:497:39:497:44 | ControlFlowNode for SOURCE | test.py:497:10:497:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] |
-| test.py:509:9:509:14 | ControlFlowNode for SOURCE | test.py:511:10:511:10 | ControlFlowNode for a |
-| test.py:509:9:509:14 | ControlFlowNode for SOURCE | test.py:516:10:516:10 | ControlFlowNode for b |
+| test.py:338:11:338:16 | ControlFlowNode for SOURCE | test.py:338:11:338:17 | ControlFlowNode for Tuple [Tuple element at index 0] |
+| test.py:338:11:338:17 | ControlFlowNode for Tuple [Tuple element at index 0] | test.py:338:10:338:21 | ControlFlowNode for Subscript |
+| test.py:342:10:342:17 | ControlFlowNode for List [List element] | test.py:342:10:342:20 | ControlFlowNode for Subscript |
+| test.py:342:11:342:16 | ControlFlowNode for SOURCE | test.py:342:10:342:17 | ControlFlowNode for List [List element] |
+| test.py:346:10:346:22 | ControlFlowNode for Dict [Dictionary element at key s] | test.py:346:10:346:27 | ControlFlowNode for Subscript |
+| test.py:346:16:346:21 | ControlFlowNode for SOURCE | test.py:346:10:346:22 | ControlFlowNode for Dict [Dictionary element at key s] |
+| test.py:369:28:369:33 | ControlFlowNode for SOURCE | test.py:369:10:369:34 | ControlFlowNode for second() |
+| test.py:377:30:377:35 | ControlFlowNode for SOURCE | test.py:377:10:377:36 | ControlFlowNode for second() |
+| test.py:385:10:385:43 | KwUnpacked b | test.py:385:10:385:43 | ControlFlowNode for second() |
+| test.py:385:30:385:42 | ControlFlowNode for Dict [Dictionary element at key b] | test.py:385:10:385:43 | KwUnpacked b |
+| test.py:385:36:385:41 | ControlFlowNode for SOURCE | test.py:385:30:385:42 | ControlFlowNode for Dict [Dictionary element at key b] |
+| test.py:393:10:393:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] | test.py:393:10:393:39 | ControlFlowNode for f_extra_pos() |
+| test.py:393:33:393:38 | ControlFlowNode for SOURCE | test.py:393:10:393:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] |
+| test.py:401:10:401:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] | test.py:401:10:401:45 | ControlFlowNode for f_extra_keyword() |
+| test.py:401:39:401:44 | ControlFlowNode for SOURCE | test.py:401:10:401:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] |
+| test.py:422:10:422:15 | ControlFlowNode for SOURCE | test.py:422:10:422:38 | ControlFlowNode for IfExp |
+| test.py:430:34:430:39 | ControlFlowNode for SOURCE | test.py:430:10:430:39 | ControlFlowNode for IfExp |
+| test.py:454:12:454:17 | ControlFlowNode for SOURCE | test.py:454:10:454:18 | ControlFlowNode for f() |
+| test.py:461:28:461:33 | ControlFlowNode for SOURCE | test.py:461:10:461:34 | ControlFlowNode for second() |
+| test.py:475:30:475:35 | ControlFlowNode for SOURCE | test.py:475:10:475:36 | ControlFlowNode for second() |
+| test.py:489:10:489:43 | KwUnpacked b | test.py:489:10:489:43 | ControlFlowNode for second() |
+| test.py:489:30:489:42 | ControlFlowNode for Dict [Dictionary element at key b] | test.py:489:10:489:43 | KwUnpacked b |
+| test.py:489:36:489:41 | ControlFlowNode for SOURCE | test.py:489:30:489:42 | ControlFlowNode for Dict [Dictionary element at key b] |
+| test.py:494:10:494:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] | test.py:494:10:494:39 | ControlFlowNode for f_extra_pos() |
+| test.py:494:33:494:38 | ControlFlowNode for SOURCE | test.py:494:10:494:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] |
+| test.py:499:10:499:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] | test.py:499:10:499:45 | ControlFlowNode for f_extra_keyword() |
+| test.py:499:39:499:44 | ControlFlowNode for SOURCE | test.py:499:10:499:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] |
+| test.py:511:9:511:14 | ControlFlowNode for SOURCE | test.py:513:10:513:10 | ControlFlowNode for a |
+| test.py:511:9:511:14 | ControlFlowNode for SOURCE | test.py:518:10:518:10 | ControlFlowNode for b |
 nodes
 | datamodel.py:38:6:38:17 | ControlFlowNode for f() | semmle.label | ControlFlowNode for f() |
 | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
@@ -247,52 +247,52 @@ nodes
 | test.py:199:34:199:39 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
 | test.py:200:10:200:10 | ControlFlowNode for x [List element] | semmle.label | ControlFlowNode for x [List element] |
 | test.py:200:10:200:13 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
-| test.py:336:10:336:21 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
-| test.py:336:11:336:16 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:336:11:336:17 | ControlFlowNode for Tuple [Tuple element at index 0] | semmle.label | ControlFlowNode for Tuple [Tuple element at index 0] |
-| test.py:340:10:340:17 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
-| test.py:340:10:340:20 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
-| test.py:340:11:340:16 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:344:10:344:22 | ControlFlowNode for Dict [Dictionary element at key s] | semmle.label | ControlFlowNode for Dict [Dictionary element at key s] |
-| test.py:344:10:344:27 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
-| test.py:344:16:344:21 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:367:10:367:34 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
-| test.py:367:28:367:33 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:375:10:375:36 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
-| test.py:375:30:375:35 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:383:10:383:43 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
-| test.py:383:10:383:43 | KwUnpacked b | semmle.label | KwUnpacked b |
-| test.py:383:30:383:42 | ControlFlowNode for Dict [Dictionary element at key b] | semmle.label | ControlFlowNode for Dict [Dictionary element at key b] |
-| test.py:383:36:383:41 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:391:10:391:39 | ControlFlowNode for f_extra_pos() | semmle.label | ControlFlowNode for f_extra_pos() |
-| test.py:391:10:391:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] | semmle.label | PosOverflowNode for f_extra_pos() [Tuple element at index 0] |
-| test.py:391:33:391:38 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:399:10:399:45 | ControlFlowNode for f_extra_keyword() | semmle.label | ControlFlowNode for f_extra_keyword() |
-| test.py:399:10:399:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] | semmle.label | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] |
-| test.py:399:39:399:44 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:420:10:420:15 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:420:10:420:38 | ControlFlowNode for IfExp | semmle.label | ControlFlowNode for IfExp |
-| test.py:428:10:428:39 | ControlFlowNode for IfExp | semmle.label | ControlFlowNode for IfExp |
-| test.py:428:34:428:39 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:452:10:452:18 | ControlFlowNode for f() | semmle.label | ControlFlowNode for f() |
-| test.py:452:12:452:17 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:459:10:459:34 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
-| test.py:459:28:459:33 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:473:10:473:36 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
-| test.py:473:30:473:35 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:487:10:487:43 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
-| test.py:487:10:487:43 | KwUnpacked b | semmle.label | KwUnpacked b |
-| test.py:487:30:487:42 | ControlFlowNode for Dict [Dictionary element at key b] | semmle.label | ControlFlowNode for Dict [Dictionary element at key b] |
-| test.py:487:36:487:41 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:492:10:492:39 | ControlFlowNode for f_extra_pos() | semmle.label | ControlFlowNode for f_extra_pos() |
-| test.py:492:10:492:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] | semmle.label | PosOverflowNode for f_extra_pos() [Tuple element at index 0] |
-| test.py:492:33:492:38 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:497:10:497:45 | ControlFlowNode for f_extra_keyword() | semmle.label | ControlFlowNode for f_extra_keyword() |
-| test.py:497:10:497:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] | semmle.label | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] |
-| test.py:497:39:497:44 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:509:9:509:14 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
-| test.py:511:10:511:10 | ControlFlowNode for a | semmle.label | ControlFlowNode for a |
-| test.py:516:10:516:10 | ControlFlowNode for b | semmle.label | ControlFlowNode for b |
+| test.py:338:10:338:21 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
+| test.py:338:11:338:16 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:338:11:338:17 | ControlFlowNode for Tuple [Tuple element at index 0] | semmle.label | ControlFlowNode for Tuple [Tuple element at index 0] |
+| test.py:342:10:342:17 | ControlFlowNode for List [List element] | semmle.label | ControlFlowNode for List [List element] |
+| test.py:342:10:342:20 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
+| test.py:342:11:342:16 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:346:10:346:22 | ControlFlowNode for Dict [Dictionary element at key s] | semmle.label | ControlFlowNode for Dict [Dictionary element at key s] |
+| test.py:346:10:346:27 | ControlFlowNode for Subscript | semmle.label | ControlFlowNode for Subscript |
+| test.py:346:16:346:21 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:369:10:369:34 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
+| test.py:369:28:369:33 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:377:10:377:36 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
+| test.py:377:30:377:35 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:385:10:385:43 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
+| test.py:385:10:385:43 | KwUnpacked b | semmle.label | KwUnpacked b |
+| test.py:385:30:385:42 | ControlFlowNode for Dict [Dictionary element at key b] | semmle.label | ControlFlowNode for Dict [Dictionary element at key b] |
+| test.py:385:36:385:41 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:393:10:393:39 | ControlFlowNode for f_extra_pos() | semmle.label | ControlFlowNode for f_extra_pos() |
+| test.py:393:10:393:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] | semmle.label | PosOverflowNode for f_extra_pos() [Tuple element at index 0] |
+| test.py:393:33:393:38 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:401:10:401:45 | ControlFlowNode for f_extra_keyword() | semmle.label | ControlFlowNode for f_extra_keyword() |
+| test.py:401:10:401:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] | semmle.label | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] |
+| test.py:401:39:401:44 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:422:10:422:15 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:422:10:422:38 | ControlFlowNode for IfExp | semmle.label | ControlFlowNode for IfExp |
+| test.py:430:10:430:39 | ControlFlowNode for IfExp | semmle.label | ControlFlowNode for IfExp |
+| test.py:430:34:430:39 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:454:10:454:18 | ControlFlowNode for f() | semmle.label | ControlFlowNode for f() |
+| test.py:454:12:454:17 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:461:10:461:34 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
+| test.py:461:28:461:33 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:475:10:475:36 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
+| test.py:475:30:475:35 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:489:10:489:43 | ControlFlowNode for second() | semmle.label | ControlFlowNode for second() |
+| test.py:489:10:489:43 | KwUnpacked b | semmle.label | KwUnpacked b |
+| test.py:489:30:489:42 | ControlFlowNode for Dict [Dictionary element at key b] | semmle.label | ControlFlowNode for Dict [Dictionary element at key b] |
+| test.py:489:36:489:41 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:494:10:494:39 | ControlFlowNode for f_extra_pos() | semmle.label | ControlFlowNode for f_extra_pos() |
+| test.py:494:10:494:39 | PosOverflowNode for f_extra_pos() [Tuple element at index 0] | semmle.label | PosOverflowNode for f_extra_pos() [Tuple element at index 0] |
+| test.py:494:33:494:38 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:499:10:499:45 | ControlFlowNode for f_extra_keyword() | semmle.label | ControlFlowNode for f_extra_keyword() |
+| test.py:499:10:499:45 | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] | semmle.label | KwOverflowNode for f_extra_keyword() [Dictionary element at key b] |
+| test.py:499:39:499:44 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:511:9:511:14 | ControlFlowNode for SOURCE | semmle.label | ControlFlowNode for SOURCE |
+| test.py:513:10:513:10 | ControlFlowNode for a | semmle.label | ControlFlowNode for a |
+| test.py:518:10:518:10 | ControlFlowNode for b | semmle.label | ControlFlowNode for b |
 #select
 | datamodel.py:38:6:38:17 | ControlFlowNode for f() | datamodel.py:38:8:38:13 | ControlFlowNode for SOURCE | datamodel.py:38:6:38:17 | ControlFlowNode for f() | Flow found |
 | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | datamodel.py:71:15:71:20 | ControlFlowNode for SOURCE | datamodel.py:71:6:71:24 | ControlFlowNode for Attribute() | Flow found |
@@ -320,21 +320,21 @@ nodes
 | test.py:184:10:184:13 | ControlFlowNode for Subscript | test.py:183:23:183:28 | ControlFlowNode for SOURCE | test.py:184:10:184:13 | ControlFlowNode for Subscript | Flow found |
 | test.py:189:10:189:13 | ControlFlowNode for Subscript | test.py:188:25:188:30 | ControlFlowNode for SOURCE | test.py:189:10:189:13 | ControlFlowNode for Subscript | Flow found |
 | test.py:200:10:200:13 | ControlFlowNode for Subscript | test.py:199:34:199:39 | ControlFlowNode for SOURCE | test.py:200:10:200:13 | ControlFlowNode for Subscript | Flow found |
-| test.py:336:10:336:21 | ControlFlowNode for Subscript | test.py:336:11:336:16 | ControlFlowNode for SOURCE | test.py:336:10:336:21 | ControlFlowNode for Subscript | Flow found |
-| test.py:340:10:340:20 | ControlFlowNode for Subscript | test.py:340:11:340:16 | ControlFlowNode for SOURCE | test.py:340:10:340:20 | ControlFlowNode for Subscript | Flow found |
-| test.py:344:10:344:27 | ControlFlowNode for Subscript | test.py:344:16:344:21 | ControlFlowNode for SOURCE | test.py:344:10:344:27 | ControlFlowNode for Subscript | Flow found |
-| test.py:367:10:367:34 | ControlFlowNode for second() | test.py:367:28:367:33 | ControlFlowNode for SOURCE | test.py:367:10:367:34 | ControlFlowNode for second() | Flow found |
-| test.py:375:10:375:36 | ControlFlowNode for second() | test.py:375:30:375:35 | ControlFlowNode for SOURCE | test.py:375:10:375:36 | ControlFlowNode for second() | Flow found |
-| test.py:383:10:383:43 | ControlFlowNode for second() | test.py:383:36:383:41 | ControlFlowNode for SOURCE | test.py:383:10:383:43 | ControlFlowNode for second() | Flow found |
-| test.py:391:10:391:39 | ControlFlowNode for f_extra_pos() | test.py:391:33:391:38 | ControlFlowNode for SOURCE | test.py:391:10:391:39 | ControlFlowNode for f_extra_pos() | Flow found |
-| test.py:399:10:399:45 | ControlFlowNode for f_extra_keyword() | test.py:399:39:399:44 | ControlFlowNode for SOURCE | test.py:399:10:399:45 | ControlFlowNode for f_extra_keyword() | Flow found |
-| test.py:420:10:420:38 | ControlFlowNode for IfExp | test.py:420:10:420:15 | ControlFlowNode for SOURCE | test.py:420:10:420:38 | ControlFlowNode for IfExp | Flow found |
-| test.py:428:10:428:39 | ControlFlowNode for IfExp | test.py:428:34:428:39 | ControlFlowNode for SOURCE | test.py:428:10:428:39 | ControlFlowNode for IfExp | Flow found |
-| test.py:452:10:452:18 | ControlFlowNode for f() | test.py:452:12:452:17 | ControlFlowNode for SOURCE | test.py:452:10:452:18 | ControlFlowNode for f() | Flow found |
-| test.py:459:10:459:34 | ControlFlowNode for second() | test.py:459:28:459:33 | ControlFlowNode for SOURCE | test.py:459:10:459:34 | ControlFlowNode for second() | Flow found |
-| test.py:473:10:473:36 | ControlFlowNode for second() | test.py:473:30:473:35 | ControlFlowNode for SOURCE | test.py:473:10:473:36 | ControlFlowNode for second() | Flow found |
-| test.py:487:10:487:43 | ControlFlowNode for second() | test.py:487:36:487:41 | ControlFlowNode for SOURCE | test.py:487:10:487:43 | ControlFlowNode for second() | Flow found |
-| test.py:492:10:492:39 | ControlFlowNode for f_extra_pos() | test.py:492:33:492:38 | ControlFlowNode for SOURCE | test.py:492:10:492:39 | ControlFlowNode for f_extra_pos() | Flow found |
-| test.py:497:10:497:45 | ControlFlowNode for f_extra_keyword() | test.py:497:39:497:44 | ControlFlowNode for SOURCE | test.py:497:10:497:45 | ControlFlowNode for f_extra_keyword() | Flow found |
-| test.py:511:10:511:10 | ControlFlowNode for a | test.py:509:9:509:14 | ControlFlowNode for SOURCE | test.py:511:10:511:10 | ControlFlowNode for a | Flow found |
-| test.py:516:10:516:10 | ControlFlowNode for b | test.py:509:9:509:14 | ControlFlowNode for SOURCE | test.py:516:10:516:10 | ControlFlowNode for b | Flow found |
+| test.py:338:10:338:21 | ControlFlowNode for Subscript | test.py:338:11:338:16 | ControlFlowNode for SOURCE | test.py:338:10:338:21 | ControlFlowNode for Subscript | Flow found |
+| test.py:342:10:342:20 | ControlFlowNode for Subscript | test.py:342:11:342:16 | ControlFlowNode for SOURCE | test.py:342:10:342:20 | ControlFlowNode for Subscript | Flow found |
+| test.py:346:10:346:27 | ControlFlowNode for Subscript | test.py:346:16:346:21 | ControlFlowNode for SOURCE | test.py:346:10:346:27 | ControlFlowNode for Subscript | Flow found |
+| test.py:369:10:369:34 | ControlFlowNode for second() | test.py:369:28:369:33 | ControlFlowNode for SOURCE | test.py:369:10:369:34 | ControlFlowNode for second() | Flow found |
+| test.py:377:10:377:36 | ControlFlowNode for second() | test.py:377:30:377:35 | ControlFlowNode for SOURCE | test.py:377:10:377:36 | ControlFlowNode for second() | Flow found |
+| test.py:385:10:385:43 | ControlFlowNode for second() | test.py:385:36:385:41 | ControlFlowNode for SOURCE | test.py:385:10:385:43 | ControlFlowNode for second() | Flow found |
+| test.py:393:10:393:39 | ControlFlowNode for f_extra_pos() | test.py:393:33:393:38 | ControlFlowNode for SOURCE | test.py:393:10:393:39 | ControlFlowNode for f_extra_pos() | Flow found |
+| test.py:401:10:401:45 | ControlFlowNode for f_extra_keyword() | test.py:401:39:401:44 | ControlFlowNode for SOURCE | test.py:401:10:401:45 | ControlFlowNode for f_extra_keyword() | Flow found |
+| test.py:422:10:422:38 | ControlFlowNode for IfExp | test.py:422:10:422:15 | ControlFlowNode for SOURCE | test.py:422:10:422:38 | ControlFlowNode for IfExp | Flow found |
+| test.py:430:10:430:39 | ControlFlowNode for IfExp | test.py:430:34:430:39 | ControlFlowNode for SOURCE | test.py:430:10:430:39 | ControlFlowNode for IfExp | Flow found |
+| test.py:454:10:454:18 | ControlFlowNode for f() | test.py:454:12:454:17 | ControlFlowNode for SOURCE | test.py:454:10:454:18 | ControlFlowNode for f() | Flow found |
+| test.py:461:10:461:34 | ControlFlowNode for second() | test.py:461:28:461:33 | ControlFlowNode for SOURCE | test.py:461:10:461:34 | ControlFlowNode for second() | Flow found |
+| test.py:475:10:475:36 | ControlFlowNode for second() | test.py:475:30:475:35 | ControlFlowNode for SOURCE | test.py:475:10:475:36 | ControlFlowNode for second() | Flow found |
+| test.py:489:10:489:43 | ControlFlowNode for second() | test.py:489:36:489:41 | ControlFlowNode for SOURCE | test.py:489:10:489:43 | ControlFlowNode for second() | Flow found |
+| test.py:494:10:494:39 | ControlFlowNode for f_extra_pos() | test.py:494:33:494:38 | ControlFlowNode for SOURCE | test.py:494:10:494:39 | ControlFlowNode for f_extra_pos() | Flow found |
+| test.py:499:10:499:45 | ControlFlowNode for f_extra_keyword() | test.py:499:39:499:44 | ControlFlowNode for SOURCE | test.py:499:10:499:45 | ControlFlowNode for f_extra_keyword() | Flow found |
+| test.py:513:10:513:10 | ControlFlowNode for a | test.py:511:9:511:14 | ControlFlowNode for SOURCE | test.py:513:10:513:10 | ControlFlowNode for a | Flow found |
+| test.py:518:10:518:10 | ControlFlowNode for b | test.py:511:9:511:14 | ControlFlowNode for SOURCE | test.py:518:10:518:10 | ControlFlowNode for b | Flow found |

From fbfbe70debe926bf1ed14f595f7b2a2da91f75d0 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Tue, 19 Jan 2021 20:31:28 +0100
Subject: [PATCH 234/343] add support for unnamed/default exports in
 PackageExports.qll

---
 javascript/ql/src/semmle/javascript/PackageExports.qll   | 7 +++++++
 .../Performance/ReDoS/PolynomialBackTracking.expected    | 1 +
 .../Performance/ReDoS/PolynomialReDoS.expected           | 9 +++++++++
 .../ql/test/query-tests/Performance/ReDoS/lib/lib.js     | 8 ++++++++
 4 files changed, 25 insertions(+)

diff --git a/javascript/ql/src/semmle/javascript/PackageExports.qll b/javascript/ql/src/semmle/javascript/PackageExports.qll
index 09212bc8aa6..350a6301dd3 100644
--- a/javascript/ql/src/semmle/javascript/PackageExports.qll
+++ b/javascript/ql/src/semmle/javascript/PackageExports.qll
@@ -78,5 +78,12 @@ private DataFlow::Node getAValueExportedByPackage() {
 private DataFlow::Node getAnExportFromModule(Module mod) {
   result.analyze().getAValue() = mod.(NodeModule).getAModuleExportsValue()
   or
+  exists(Variable var | var = mod.(Closure::ClosureModule).getExportsVariable() |
+    result.asExpr() = var.getAReference() or
+    result.asExpr() = var.getAnAssignedExpr()
+  )
+  or
+  result.analyze().getAValue() = mod.(AmdModule).getDefine().getAModuleExportsValue()
+  or
   result = mod.getAnExportedValue(_)
 }
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
index 1c465b163dd..fcd8c43cd7c 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
@@ -25,6 +25,7 @@
 | highlight.js:38:64:38:69 | [^()]* | Strings starting with 'A(' and with many repetitions of ''' can start matching anywhere after the start of the preceeding [^()]* |
 | highlight.js:39:22:39:24 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding [a-zA-Z_]\\w*\\([^()]*(\\([^()]*(\\([^()]*\\)[^()]*)*\\)[^()]*)*\\)\\s*\\{ |
 | lib/lib.js:1:15:1:16 | a* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding a*b |
+| lib/lib.js:8:3:8:4 | f* | Strings with many repetitions of 'f' can start matching anywhere after the start of the preceeding f*g |
 | polynomial-redos.js:7:24:7:26 | \\s+ | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s+$ |
 | polynomial-redos.js:8:17:8:18 |  * | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding  *, * |
 | polynomial-redos.js:9:19:9:21 | \\s* | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s*\\n\\s* |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
index 59428ed86e0..9e5619f1aa3 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
@@ -3,6 +3,10 @@ nodes
 | lib/lib.js:3:28:3:31 | name |
 | lib/lib.js:4:14:4:17 | name |
 | lib/lib.js:4:14:4:17 | name |
+| lib/lib.js:7:19:7:22 | name |
+| lib/lib.js:7:19:7:22 | name |
+| lib/lib.js:8:13:8:16 | name |
+| lib/lib.js:8:13:8:16 | name |
 | polynomial-redos.js:5:6:5:32 | tainted |
 | polynomial-redos.js:5:16:5:32 | req.query.tainted |
 | polynomial-redos.js:5:16:5:32 | req.query.tainted |
@@ -150,6 +154,10 @@ edges
 | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
 | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
 | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
+| lib/lib.js:7:19:7:22 | name | lib/lib.js:8:13:8:16 | name |
+| lib/lib.js:7:19:7:22 | name | lib/lib.js:8:13:8:16 | name |
+| lib/lib.js:7:19:7:22 | name | lib/lib.js:8:13:8:16 | name |
+| lib/lib.js:7:19:7:22 | name | lib/lib.js:8:13:8:16 | name |
 | polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:7:2:7:8 | tainted |
 | polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:7:2:7:8 | tainted |
 | polynomial-redos.js:5:6:5:32 | tainted | polynomial-redos.js:8:2:8:8 | tainted |
@@ -289,6 +297,7 @@ edges
 | polynomial-redos.js:123:13:123:20 | replaced | polynomial-redos.js:123:3:123:20 | result |
 #select
 | lib/lib.js:4:2:4:18 | regexp.test(name) | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | lib/lib.js:1:15:1:16 | a* | regular expression | lib/lib.js:3:28:3:31 | name | library input |
+| lib/lib.js:8:2:8:17 | /f*g/.test(name) | lib/lib.js:7:19:7:22 | name | lib/lib.js:8:13:8:16 | name | This $@ that depends on $@ may run slow on strings with many repetitions of 'f'. | lib/lib.js:8:3:8:4 | f* | regular expression | lib/lib.js:7:19:7:22 | name | library input |
 | polynomial-redos.js:7:2:7:34 | tainted ... /g, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:7:2:7:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:7:24:7:26 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
 | polynomial-redos.js:8:2:8:23 | tainted ...  *, */) | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:8:2:8:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:8:17:8:18 |  * | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
 | polynomial-redos.js:9:2:9:34 | tainted ... g, ' ') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:9:2:9:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:9:19:9:21 | \\s* | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js b/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js
index 23ba27a32c2..47fc928845b 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js
@@ -3,3 +3,11 @@ var regexp = /a*b/;
 module.exports = function (name) {
 	regexp.test(name); // NOT OK
 };
+
+function bar(reg, name) {
+	/f*g/.test(name); // NOT OK
+}
+
+if (typeof define !== 'undefined' && define.amd) { // AMD
+    define([], function () {return bar});
+}
\ No newline at end of file

From e96f94226968532558a5a7d80215c28cca5c3d30 Mon Sep 17 00:00:00 2001
From: Felicity Chapman <felicitymay@github.com>
Date: Tue, 19 Jan 2021 22:38:12 +0000
Subject: [PATCH 235/343] Update reference to new CodeQL site

---
 docs/codeql/README.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/codeql/README.rst b/docs/codeql/README.rst
index 39c4d18cd55..c7ea08519da 100644
--- a/docs/codeql/README.rst
+++ b/docs/codeql/README.rst
@@ -105,6 +105,6 @@ Viewing the current version of the CodeQL documentation
 *******************************************************
 
 The documentation for the most recent release is 
-published to `help.semmle.com <https://help.semmle.com>`__. 
+published to `codeql.github.com <https://codeql.github.com>`__. 
 There, you can find the documentation for the CodeQL queries,
-the CodeQL standard libraries, and LGTM Enterprise. 
+the CodeQL standard libraries, and can learn about CodeQL. 

From 70c302ffbe1904fa9feaf32ea4382fbbf02fb790 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 20 Jan 2021 11:20:55 +0100
Subject: [PATCH 236/343] Add DB upgrade folder for function pointer

---
 .../old.dbscheme                              | 1922 ++++++++++++++++
 .../semmlecode.csharp.dbscheme                | 1940 +++++++++++++++++
 .../upgrade.properties                        |    0
 3 files changed, 3862 insertions(+)
 create mode 100644 csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/old.dbscheme
 create mode 100644 csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/semmlecode.csharp.dbscheme
 rename csharp/upgrades/{TO_CHANGE => 98e37f65f0ae39cfe1bff33908d6620ade5df0f7}/upgrade.properties (100%)

diff --git a/csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/old.dbscheme b/csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/old.dbscheme
new file mode 100644
index 00000000000..98e37f65f0a
--- /dev/null
+++ b/csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/old.dbscheme
@@ -0,0 +1,1922 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+
+#keyset[method, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int method: @cil_method ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/semmlecode.csharp.dbscheme b/csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/semmlecode.csharp.dbscheme
new file mode 100644
index 00000000000..dd813977f70
--- /dev/null
+++ b/csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/semmlecode.csharp.dbscheme
@@ -0,0 +1,1940 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 129 = @function_pointer_invocation_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+
+#keyset[method, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int method: @cil_method ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/TO_CHANGE/upgrade.properties b/csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/upgrade.properties
similarity index 100%
rename from csharp/upgrades/TO_CHANGE/upgrade.properties
rename to csharp/upgrades/98e37f65f0ae39cfe1bff33908d6620ade5df0f7/upgrade.properties

From 4c9de4574a9169f51428dbc02b280b216cbdb5c7 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Wed, 20 Jan 2021 16:24:43 +0300
Subject: [PATCH 237/343] Update CompilerRemovalOfCodeToClearBuffers.ql

---
 .../Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
index 96ecc30a95e..b0c412df4cc 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -12,6 +12,7 @@
 
 import cpp
 import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.StackAddress
 
 /**
  * A call to `memset` of the form `memset(ptr, value, num)`, for some local variable `ptr`.
@@ -34,6 +35,8 @@ class CompilerRemovaMemset extends FunctionCall {
       this.getArgument(0) = v.getAnAccess() and
       alloc.getASuccessor+() = this
     )
+    or
+    not stackPointerFlowsToUse(this.getArgument(0), _, _, _)
   }
 
   predicate isExistsFreeForThisVariable() {

From 2e024c3c61b076d56b234309fd2ef19f9f571eab Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Wed, 20 Jan 2021 15:26:39 +0100
Subject: [PATCH 238/343] fix that type inference assumed every
 compound-assignment have type number

---
 .../ql/src/Expressions/ImplicitOperandConversion.ql  |  8 +-------
 javascript/ql/src/semmle/javascript/Expr.qll         | 12 ++++++++++++
 .../dataflow/internal/BasicExprTypeInference.qll     |  4 +++-
 .../LanguageFeatures/PropertyWriteOnPrimitive/tst.js |  6 ++++++
 4 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/javascript/ql/src/Expressions/ImplicitOperandConversion.ql b/javascript/ql/src/Expressions/ImplicitOperandConversion.ql
index a10b5b9c0c3..00196d9ef25 100644
--- a/javascript/ql/src/Expressions/ImplicitOperandConversion.ql
+++ b/javascript/ql/src/Expressions/ImplicitOperandConversion.ql
@@ -130,13 +130,7 @@ class NumericConversion extends ImplicitConversion {
     or
     parent instanceof ArithmeticExpr and not parent instanceof AddExpr
     or
-    parent instanceof CompoundAssignExpr and
-    not (
-      parent instanceof AssignAddExpr or
-      parent instanceof AssignLogOrExpr or
-      parent instanceof AssignLogAndExpr or
-      parent instanceof AssignNullishCoalescingExpr
-    )
+    parent.(CompoundAssignExpr).isNumeric()
     or
     parent instanceof UpdateExpr
   }
diff --git a/javascript/ql/src/semmle/javascript/Expr.qll b/javascript/ql/src/semmle/javascript/Expr.qll
index 1a932a7c08b..8d15653c5b2 100644
--- a/javascript/ql/src/semmle/javascript/Expr.qll
+++ b/javascript/ql/src/semmle/javascript/Expr.qll
@@ -1921,6 +1921,18 @@ private class TCompoundAssignExpr =
  */
 class CompoundAssignExpr extends TCompoundAssignExpr, Assignment {
   override string getAPrimaryQlClass() { result = "CompoundAssignExpr" }
+
+  /**
+   * Holds if this compound assignment always returns a number value.
+   */
+  predicate isNumeric() {
+    not (
+      this instanceof AssignAddExpr or
+      this instanceof AssignLogOrExpr or
+      this instanceof AssignLogAndExpr or
+      this instanceof AssignNullishCoalescingExpr
+    )
+  }
 }
 
 /**
diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/BasicExprTypeInference.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/BasicExprTypeInference.qll
index ab31b07f31c..776eacb5804 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/BasicExprTypeInference.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/BasicExprTypeInference.qll
@@ -391,13 +391,15 @@ private class AnalyzedUpdateExpr extends DataFlow::AnalyzedValueNode {
 private class AnalyzedCompoundAssignExpr extends DataFlow::AnalyzedValueNode {
   override CompoundAssignExpr astNode;
 
+  AnalyzedCompoundAssignExpr() { astNode.isNumeric() }
+
   override AbstractValue getALocalValue() { result = abstractValueOfType(TTNumber()) }
 }
 
 /**
  * Flow analysis for add-assign.
  */
-private class AnalyzedAssignAddExpr extends AnalyzedCompoundAssignExpr {
+private class AnalyzedAssignAddExpr extends DataFlow::AnalyzedValueNode {
   override AssignAddExpr astNode;
 
   override AbstractValue getALocalValue() {
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/PropertyWriteOnPrimitive/tst.js b/javascript/ql/test/query-tests/LanguageFeatures/PropertyWriteOnPrimitive/tst.js
index 40f77627e32..5d83bad877d 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/PropertyWriteOnPrimitive/tst.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/PropertyWriteOnPrimitive/tst.js
@@ -20,4 +20,10 @@ function g(b) {
   return;
   // OK: no types inferred for `z`, since this is dead code
   z.y = true;
+}
+
+function h() {
+  let tmp;
+  let obj = (tmp ||= {});
+  obj.p = 42;
 }
\ No newline at end of file

From 9a397b6faf931455d949c968e2dd8fecfe0a2ab2 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Wed, 20 Jan 2021 15:28:20 +0100
Subject: [PATCH 239/343] Python: Apply code-review suggestion

Co-authored-by: yoff <lerchedahl@gmail.com>
---
 python/ql/src/semmle/python/frameworks/Django.qll | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
index b7f2a0e12af..6eeae4b742e 100644
--- a/python/ql/src/semmle/python/frameworks/Django.qll
+++ b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1881,8 +1881,9 @@ private module Django {
       // Since we're still installing dependencies and analyzing their source code,
       // without explicitly filtering out this call, we would be double-counting such
       // route-setups :( One practical negative side effect of double-counting it, is
-      // that since we can't figure out the URL, we mark ANY parameter as being a
-      // routed-parameter, which can lead to FPs.
+      // that since we can't figure out the URL in the library code calling `django.urls.re_path`
+      // (because we only consider local flow), we will for all those cases mark ANY parameter
+      // as being a routed-parameter, which can lead to FPs.
       not exists(Module mod |
         mod.getName() = "django.conf.urls.__init__" and
         node.getEnclosingModule() = mod

From f12ebe88e6635aa8be81057211b3a2e9a2f5f6f0 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 20 Jan 2021 15:43:24 +0100
Subject: [PATCH 240/343] Revert "C++: Replace SkippableInstruction with local
 flow steps."

This reverts commit 258d04178f90b48153c1119aa55a86544cbea54c. This
change caused a ~20% performance regression.
---
 .../ir/dataflow/internal/DataFlowPrivate.qll  | 18 ++++
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 99 +++++++++----------
 2 files changed, 66 insertions(+), 51 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index a5a30dc756e..d9f23d00c8d 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -346,6 +346,24 @@ private class ArrayToPointerConvertInstruction extends ConvertInstruction {
   }
 }
 
+/**
+ * These two predicates look like copy-paste from the two predicates with the same name in DataFlowUtil,
+ * but crucially they only skip past `CopyValueInstruction`s. This is because we use a special case of
+ * a `ConvertInstruction` to detect some read steps from arrays that undergoes array-to-pointer
+ * conversion.
+ */
+private Instruction skipOneCopyValueInstructionRec(CopyValueInstruction copy) {
+  copy.getUnary() = result and not result instanceof CopyValueInstruction
+  or
+  result = skipOneCopyValueInstructionRec(copy.getUnary())
+}
+
+private Instruction skipCopyValueInstructions(Operand op) {
+  not result instanceof CopyValueInstruction and result = op.getDef()
+  or
+  result = skipOneCopyValueInstructionRec(op.getDef())
+}
+
 private class InexactLoadOperand extends LoadOperand {
   InexactLoadOperand() { this.isDefinitionInexact() }
 }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 016bf565021..f7eaaf7f2e1 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -185,15 +185,54 @@ class OperandNode extends Node, TOperandNode {
   override string toString() { result = this.getOperand().toString() }
 }
 
+/** An abstract class that defines conversion-like instructions. */
+abstract private class SkippableInstruction extends Instruction {
+  abstract Instruction getSourceInstruction();
+}
+
+/**
+ * Gets the instruction that is propaged through a non-empty sequence of conversion-like instructions.
+ */
+private Instruction skipSkippableInstructionsRec(SkippableInstruction skip) {
+  result = skip.getSourceInstruction() and not result instanceof SkippableInstruction
+  or
+  result = skipSkippableInstructionsRec(skip.getSourceInstruction())
+}
+
+/**
+ * Gets the instruction that is propagated through a (possibly empty) sequence of conversion-like
+ * instructions.
+ */
+private Instruction skipSkippableInstructions(Instruction instr) {
+  result = instr and not result instanceof SkippableInstruction
+  or
+  result = skipSkippableInstructionsRec(instr)
+}
+
+private class SkippableCopyValueInstruction extends SkippableInstruction, CopyValueInstruction {
+  override Instruction getSourceInstruction() { result = this.getSourceValue() }
+}
+
+private class SkippableConvertInstruction extends SkippableInstruction, ConvertInstruction {
+  override Instruction getSourceInstruction() { result = this.getUnary() }
+}
+
+private class SkippableCheckedConvertInstruction extends SkippableInstruction,
+  CheckedConvertOrNullInstruction {
+  override Instruction getSourceInstruction() { result = this.getUnary() }
+}
+
+private class SkippableInheritanceConversionInstruction extends SkippableInstruction,
+  InheritanceConversionInstruction {
+  override Instruction getSourceInstruction() { result = this.getUnary() }
+}
+
 /**
  * INTERNAL: do not use. Gets the `FieldNode` corresponding to `instr`, if
  * `instr` is an instruction that propagates an address of a `FieldAddressInstruction`.
  */
 FieldNode getFieldNodeForFieldInstruction(Instruction instr) {
-  result.getFieldInstruction() =
-    any(FieldAddressInstruction fai |
-      longestRegisterInstructionOperandLocalFlowStep(instructionNode(fai), instructionNode(instr))
-    )
+  result.getFieldInstruction() = skipSkippableInstructions(instr)
 }
 
 /**
@@ -584,11 +623,6 @@ class VariableNode extends Node, TVariableNode {
  */
 InstructionNode instructionNode(Instruction instr) { result.getInstruction() = instr }
 
-/**
- * Gets the node corresponding to `operand`.
- */
-OperandNode operandNode(Operand operand) { result.getOperand() = operand }
-
 /**
  * DEPRECATED: use `definitionByReferenceNodeFromArgument` instead.
  *
@@ -706,47 +740,6 @@ private predicate flowIntoReadNode(Node nodeFrom, FieldNode nodeTo) {
   )
 }
 
-/** Holds if `node` holds an `Instruction` or `Operand` that has a register result. */
-private predicate hasRegisterResult(Node node) {
-  node.asOperand() instanceof RegisterOperand
-  or
-  exists(Instruction i | i = node.asInstruction() and not i.hasMemoryResult())
-}
-
-/**
- * Holds if there is a `Instruction` or `Operand` flow step from `nodeFrom` to `nodeTo` and both
- * `nodeFrom` and `nodeTo` wraps register results.
- */
-private predicate registerInstructionOperandLocalFlowStep(Node nodeFrom, Node nodeTo) {
-  hasRegisterResult(nodeFrom) and
-  hasRegisterResult(nodeTo) and
-  instructionOperandLocalFlowStep(nodeFrom, nodeTo)
-}
-
-/**
- * INTERNAL: do not use.
- * Holds if `nodeFrom` has no incoming local `Operand` or `Instruction` register flow and `nodeFrom` can
- * reach `nodeTo` using only local `Instruction` or `Operand` register flow steps.
- */
-bindingset[nodeTo]
-private predicate longestRegisterInstructionOperandLocalFlowStep(Node nodeFrom, Node nodeTo) {
-  registerInstructionOperandLocalFlowStep*(nodeFrom, nodeTo) and
-  not registerInstructionOperandLocalFlowStep(_, nodeFrom)
-}
-
-/**
- * INTERNAL: do not use.
- * Holds if `nodeFrom` is an operand and `nodeTo` is an instruction node that uses this operand, or
- * if `nodeFrom` is an instruction and `nodeTo` is an operand that refers to this instruction.
- */
-private predicate instructionOperandLocalFlowStep(Node nodeFrom, Node nodeTo) {
-  // Operand -> Instruction flow
-  simpleInstructionLocalFlowStep(nodeFrom.asOperand(), nodeTo.asInstruction())
-  or
-  // Instruction -> Operand flow
-  simpleOperandLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asOperand())
-}
-
 /**
  * INTERNAL: do not use.
  *
@@ -755,7 +748,11 @@ private predicate instructionOperandLocalFlowStep(Node nodeFrom, Node nodeTo) {
  */
 cached
 predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
-  instructionOperandLocalFlowStep(nodeFrom, nodeTo)
+  // Operand -> Instruction flow
+  simpleInstructionLocalFlowStep(nodeFrom.asOperand(), nodeTo.asInstruction())
+  or
+  // Instruction -> Operand flow
+  simpleOperandLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asOperand())
   or
   flowIntoReadNode(nodeFrom, nodeTo)
   or

From 0c213d0926a680c20ac420bb3dd0a8ff0bd2d69f Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 16 Dec 2020 14:12:25 +0100
Subject: [PATCH 241/343] C#: Extract function pointer types from CIL

---
 .../Entities/CilTypeKind.cs                   |   3 +-
 .../Entities/FunctionPointerType.cs           | 116 ++++++++++++++++++
 .../Entities/IParameterizable.cs              |   7 ++
 .../Semmle.Extraction.CIL/Entities/Method.cs  |   2 +-
 .../Entities/ModifiedType.cs                  |   9 +-
 .../Entities/Parameter.cs                     |   4 +-
 .../Entities/SignatureDecoder.cs              |  14 ++-
 .../Entities/TypeSignatureDecoder.cs          |   2 +-
 .../extractor/Semmle.Extraction.CIL/Tuples.cs |   8 +-
 csharp/ql/src/semmlecode.csharp.dbscheme      |  16 ++-
 .../cil/functionPointers/Class1.cs_           |  52 ++++++++
 .../cil/functionPointers/Test.cs              |   7 ++
 .../cil/functionPointers/fnptr.dll            | Bin 0 -> 5632 bytes
 13 files changed, 228 insertions(+), 12 deletions(-)
 create mode 100644 csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
 create mode 100644 csharp/extractor/Semmle.Extraction.CIL/Entities/IParameterizable.cs
 create mode 100644 csharp/ql/test/library-tests/cil/functionPointers/Class1.cs_
 create mode 100644 csharp/ql/test/library-tests/cil/functionPointers/Test.cs
 create mode 100644 csharp/ql/test/library-tests/cil/functionPointers/fnptr.dll

diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/CilTypeKind.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/CilTypeKind.cs
index f5ccf5057f7..e95fe0e28c0 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/CilTypeKind.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/CilTypeKind.cs
@@ -8,6 +8,7 @@ namespace Semmle.Extraction.CIL.Entities
         ValueOrRefType,
         TypeParameter,
         Array,
-        Pointer
+        Pointer,
+        FunctionPointer
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
new file mode 100644
index 00000000000..8609e858ed4
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
@@ -0,0 +1,116 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Reflection.Metadata;
+
+namespace Semmle.Extraction.CIL.Entities
+{
+    internal sealed class FunctionPointerType : Type, IParameterizable, ICustomModifierReceiver
+    {
+        private readonly MethodSignature<Type> signature;
+
+        public FunctionPointerType(Context cx, MethodSignature<Type> signature) : base(cx)
+        {
+            this.signature = signature;
+        }
+
+        public override CilTypeKind Kind => CilTypeKind.FunctionPointer;
+
+        public override string Name
+        {
+            get
+            {
+                using var id = new StringWriter();
+                WriteName(
+                    id.Write,
+                    t => id.Write(t.Name),
+                    signature
+                );
+                return id.ToString();
+            }
+        }
+
+        public override Namespace? ContainingNamespace => Cx.GlobalNamespace;
+
+        public override Type? ContainingType => null;
+
+        public override int ThisTypeParameterCount => throw new System.NotImplementedException();
+
+        public override IEnumerable<Type> TypeParameters => throw new System.NotImplementedException();
+
+        public override Type Construct(IEnumerable<Type> typeArguments) => throw new System.NotImplementedException();
+
+        public override void WriteAssemblyPrefix(TextWriter trapFile) { }
+
+        public override void WriteId(TextWriter trapFile, bool inContext)
+        {
+            WriteName(
+                trapFile.Write,
+                t => t.WriteId(trapFile, inContext),
+                signature
+            );
+        }
+
+        internal static void WriteName<TType>(Action<string> write, Action<TType> writeType, MethodSignature<TType> signature)
+        {
+            write("delegate* ");
+            write(GetCallingConvention(signature.Header.CallingConvention));
+            write("<");
+            foreach (var pt in signature.ParameterTypes)
+            {
+                writeType(pt);
+                write(",");
+            }
+            writeType(signature.ReturnType);
+            write(">");
+        }
+
+        internal static string GetCallingConvention(SignatureCallingConvention callingConvention)
+        {
+            if (callingConvention == SignatureCallingConvention.Default)
+            {
+                return "managed";
+            }
+
+            if (callingConvention == SignatureCallingConvention.Unmanaged)
+            {
+                return "unmanaged";
+            }
+
+            return $"unmanaged[{callingConvention}]";
+        }
+
+        public override IEnumerable<IExtractionProduct> Contents
+        {
+            get
+            {
+                foreach (var c in base.Contents)
+                {
+                    yield return c;
+                }
+
+                var retType = signature.ReturnType;
+                if (retType is ModifiedType mt)
+                {
+                    retType = mt.Unmodified;
+                    yield return Tuples.cil_custom_modifiers(this, mt.Modifier, mt.IsRequired);
+                }
+                yield return Tuples.cil_function_pointer_return_type(this, retType);
+
+                yield return Tuples.cil_function_pointer_calling_conventions(this, signature.Header.CallingConvention);
+
+                var i = 0;
+                foreach (var p in signature.ParameterTypes)
+                {
+                    var t = p;
+                    if (t is ModifiedType mtparam)
+                    {
+                        t = mtparam.Unmodified;
+                        yield return Tuples.cil_custom_modifiers(this, mtparam.Modifier, mtparam.IsRequired);
+                    }
+                    yield return Cx.Populate(new Parameter(Cx, this, i++, t));
+                }
+            }
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/IParameterizable.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/IParameterizable.cs
new file mode 100644
index 00000000000..ad9347848e4
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/IParameterizable.cs
@@ -0,0 +1,7 @@
+namespace Semmle.Extraction.CIL.Entities
+{
+    internal interface IParameterizable : IEntity
+    {
+
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
index 119dc2fd287..d4da3e16463 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
@@ -9,7 +9,7 @@ namespace Semmle.Extraction.CIL.Entities
     /// <summary>
     /// A method entity.
     /// </summary>
-    internal abstract class Method : TypeContainer, IMember, ICustomModifierReceiver
+    internal abstract class Method : TypeContainer, IMember, ICustomModifierReceiver, IParameterizable
     {
         protected MethodTypeParameter[]? genericParams;
         protected GenericContext gc;
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/ModifiedType.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/ModifiedType.cs
index c794ed812a5..f160c6869de 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/ModifiedType.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/ModifiedType.cs
@@ -37,6 +37,13 @@ namespace Semmle.Extraction.CIL.Entities
 
         public override void WriteAssemblyPrefix(TextWriter trapFile) => throw new NotImplementedException();
 
-        public override void WriteId(TextWriter trapFile, bool inContext) => throw new NotImplementedException();
+        public override void WriteId(TextWriter trapFile, bool inContext)
+        {
+            Unmodified.WriteId(trapFile, inContext);
+            trapFile.Write(IsRequired ? " modreq" : " modopt");
+            trapFile.Write("(");
+            Modifier.WriteId(trapFile, inContext);
+            trapFile.Write(")");
+        }
     }
 }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Parameter.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Parameter.cs
index dea5f2db30b..90452fe9265 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Parameter.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Parameter.cs
@@ -8,11 +8,11 @@ namespace Semmle.Extraction.CIL.Entities
     /// </summary>
     internal sealed class Parameter : LabelledEntity
     {
-        private readonly Method method;
+        private readonly IParameterizable method;
         private readonly int index;
         private readonly Type type;
 
-        public Parameter(Context cx, Method m, int i, Type t) : base(cx)
+        public Parameter(Context cx, IParameterizable m, int i, Type t) : base(cx)
         {
             method = m;
             index = i;
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs
index 15920051143..d5b3ca176ec 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs
@@ -48,10 +48,20 @@ namespace Semmle.Extraction.CIL.Entities
 
         private struct FnPtr : ITypeSignature
         {
+            private readonly MethodSignature<ITypeSignature> signature;
+
+            public FnPtr(MethodSignature<ITypeSignature> signature)
+            {
+                this.signature = signature;
+            }
 
             public void WriteId(TextWriter trapFile, GenericContext gc)
             {
-                trapFile.Write("<method signature>");
+                FunctionPointerType.WriteName(
+                    trapFile.Write,
+                    t => t.WriteId(trapFile, gc),
+                    signature
+                );
             }
         }
 
@@ -62,7 +72,7 @@ namespace Semmle.Extraction.CIL.Entities
             new ByRef(elementType);
 
         ITypeSignature ISignatureTypeProvider<ITypeSignature, object>.GetFunctionPointerType(MethodSignature<ITypeSignature> signature) =>
-            new FnPtr();
+            new FnPtr(signature);
 
         private class Instantiation : ITypeSignature
         {
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs
index cf04f4fbdaf..45805fda115 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs
@@ -23,7 +23,7 @@ namespace Semmle.Extraction.CIL.Entities
             elementType;  // ??
 
         Type ISignatureTypeProvider<Type, GenericContext>.GetFunctionPointerType(MethodSignature<Type> signature) =>
-            cx.ErrorType; // Don't know what to do !!
+            cx.Populate(new FunctionPointerType(cx, signature));
 
         Type IConstructedTypeProvider<Type>.GetGenericInstantiation(Type genericType, ImmutableArray<Type> typeArguments) =>
             genericType.Construct(typeArguments);
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs b/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs
index 9568537f71f..cf625ccfc42 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs
@@ -86,6 +86,12 @@ namespace Semmle.Extraction.CIL
         internal static Tuple cil_method(Method method, string name, Type declType, Type returnType) =>
             new Tuple("cil_method", method, name, declType, returnType);
 
+        internal static Tuple cil_function_pointer_return_type(FunctionPointerType fnptr, Type returnType) =>
+            new Tuple("cil_function_pointer_return_type", fnptr, returnType);
+
+        internal static Tuple cil_function_pointer_calling_conventions(FunctionPointerType fnptr, System.Reflection.Metadata.SignatureCallingConvention callingConvention) =>
+            new Tuple("cil_function_pointer_calling_conventions", fnptr, (int)callingConvention);
+
         internal static Tuple cil_method_implementation(MethodImplementation impl, Method method, Assembly assembly) =>
             new Tuple("cil_method_implementation", impl, method, assembly);
 
@@ -101,7 +107,7 @@ namespace Semmle.Extraction.CIL
         internal static Tuple cil_newslot(Method method) =>
             new Tuple("cil_newslot", method);
 
-        internal static Tuple cil_parameter(Parameter p, Method m, int i, Type t) =>
+        internal static Tuple cil_parameter(Parameter p, IParameterizable m, int i, Type t) =>
             new Tuple("cil_parameter", p, m, i, t);
 
         internal static Tuple cil_parameter_in(Parameter p) =>
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index dd813977f70..e0e4ca2c62a 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -1695,6 +1695,7 @@ case @cil_type.kind of
 | 1 = @cil_typeparameter
 | 2 = @cil_array_type
 | 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
 ;
 
 cil_type(
@@ -1713,6 +1714,10 @@ cil_array_type(
   int element_type: @cil_type ref,
   int rank: int ref);
 
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
 cil_method(
   unique int id: @cil_method,
   string name: string ref,
@@ -1746,12 +1751,13 @@ cil_field(
 @cil_variable = @cil_field | @cil_stack_variable;
 @cil_stack_variable = @cil_local_variable | @cil_parameter;
 @cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
-@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
 
-#keyset[method, index]
+#keyset[parameterizable, index]
 cil_parameter(
   unique int id: @cil_parameter,
-  int method: @cil_method ref,
+  int parameterizable: @cil_parameterizable ref,
   int index: int ref,
   int param_type: @cil_type ref);
 
@@ -1796,6 +1802,10 @@ cil_local_variable(
   int index: int ref,
   int var_type: @cil_type ref);
 
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
 // CIL handlers (exception handlers etc).
 
 case @cil_handler.kind of
diff --git a/csharp/ql/test/library-tests/cil/functionPointers/Class1.cs_ b/csharp/ql/test/library-tests/cil/functionPointers/Class1.cs_
new file mode 100644
index 00000000000..bd0ddc30906
--- /dev/null
+++ b/csharp/ql/test/library-tests/cil/functionPointers/Class1.cs_
@@ -0,0 +1,52 @@
+using System;
+
+#nullable enable
+
+public class FnPointer
+{
+    public unsafe static class Program
+    {
+        static delegate*<int> pointer = &M0;
+
+        public static int M0()
+        {
+            return 0;
+        }
+
+        static void M1(delegate*<ref int, out object?, int> f)
+        {
+            int i = 42;
+            int j = f(ref i, out object? o);
+        }
+
+        static void M2<T>(delegate* unmanaged[Stdcall/*, StdcallSuppressGCTransition*/]<ref int, out object?, T, void> f) where T : new()
+        {
+            int i = 42;
+            f(ref i, out object? o, new T());
+        }
+
+        static void M3(delegate* managed<ref int, out object?, in int, ref int> f)
+        {
+            int i = 42;
+            ref int j = ref f(ref i, out object? o, in i);
+        }
+
+        static void M4<T>(delegate*<T, int> f) where T : new()
+        {
+            int j = f(new T());
+        }
+
+        static void M5(delegate*<B, A> f, delegate*<A, B> ff)
+        {
+            M5(ff, ff); // implicit conversion due to implicit reference conversion
+        }
+
+        static void M6(delegate*<int*, void*> f, delegate*<void*, int*> ff)
+        {
+            M6(ff, ff); // implicit conversion due to implicit pointer conversion
+        }
+
+        class A { }
+        class B : A { }
+    }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/cil/functionPointers/Test.cs b/csharp/ql/test/library-tests/cil/functionPointers/Test.cs
new file mode 100644
index 00000000000..c72cfe0b0b3
--- /dev/null
+++ b/csharp/ql/test/library-tests/cil/functionPointers/Test.cs
@@ -0,0 +1,7 @@
+// semmle-extractor-options: --cil
+
+using System;
+
+class Test
+{
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/cil/functionPointers/fnptr.dll b/csharp/ql/test/library-tests/cil/functionPointers/fnptr.dll
new file mode 100644
index 0000000000000000000000000000000000000000..c63b9dcc254503c4d1686d1bb40d3a702bedd6b6
GIT binary patch
literal 5632
zcmeHLYit}>6+U<N;q|(X*LISobsp<DPsd%a?Ich&X}$K^iQBC0WY_5nDW2V(-Ap_?
zv&_sowNR;PLW=}QBoa|0MT#QmFaAVoe*`3uDu@aa5eOlHP$>ujLP7#nDhlwU;X8L`
zACAN8C!*K6=bqO+_ndR@+&wp$7rsIPA_}74yGL{jBe!u0|20^Jc*BlwZJ@W?@ATgi
zC+_s;&gxFQYFlMnt;7qeX<BYPuf^?}8Q0BtdM+EUSVb+-*%{sCo1UK{Iw1nIvTgpO
z`f9(Xo$(HlgmG}f9(Up~jB)gFbfTEV70+*Gu>Z2H0)o#iK#QMeRsPo;eUe#de;Oj1
zV`QA@Lw_EVjkZYi5Qr_%%Qcw)0TL&Qw5UZuA8(-(uJ)1(`gkV*WHQ$K)(3krVLNsK
zV(HsB5DrwvgVAr}@IGN{h6P3Tl@`(2)<*P}Hcm9rLP~Te=M{~8Qz%4d`-yHwiG<|-
z_h6^8uZt*3gLxlO9{%!XnA^QMaP4In4Gun87X;SP@HsdL3y2REs5dF74K83>H*Jm{
zpfK|S)FXWbZ^vL%>Fl8%rF}onaCgTbK^~-sAxD}#`9qM4eK2t#vOmO3wh@%6!O?25
z(L?R~u^O!OCKZ`t>|Zx29ddHp{&rB&!9fZH_I2>F^ibp*=;%jb7z?k$i<STo2~IG?
z@Mj|X^n~!U%6qhYFp*4*CC5e{2Z6jBfIr9dfzJ}9;e3_xtZVCL*<p>h;TmuKz(SU8
z0p}wyaBN{Fjq&@S|A5>LOc+)kG&hjq*#(8#`5XGX7$e>Upqv{%moQJ*D2aDt>_cZc
zqLd@!tOGl~*GClQaXhbxpDAIwE8%r|Q|Y3+Pz%$0v=jXIMG<gOLLuRH39n0dn^?M_
z90-IdEf`kl4B#nZn;pt5;IRP1*NNeC62B#G0sjjz+$43r0Lb1TEHs%}5u<V17)Uj!
zw_uYgC_;7{{-%Hj!HLl_m>EPEqE{iC_Ng#9G1>u(8R%`0R6nS#pt@)eg#*XM9@?gy
z5Z$z@%!&Cpg!I~$%kWFk^9^c22(la03!q+YP%OLLpm^RjNnHW92-!_ZUBZe*P(Svm
zHnN36ANo|3F5u4G$ga^P>ZB_oNJ*cH(G3xzCw!`x-V$vz?NM9aP;QHM%1X-fx}83?
zhT>fIal-xyROr!$l<{`DjC0Wq7^X)6qqH9|Mk5kFE@4W-83|8H_`HNV;3oPsV3<}U
zyad=spOg4i3BL(T^R$Z|#oq6w0%=NuI_L)?LA~@7z&`o_Z~#X<K?i6A(lI&$_yipT
zoTMD!Gm@VLoTMdKn8fX(DQVdJu2PVkg5(s)p>s-6u6053FG&6c@GmJB!T*u+b--UJ
z-;<EUPCBEEOBliVf0O!YHyxs<=tU~i%k(9>LcvweWox^R{NZ1tUBeu1VVuP_K(@r+
zcQ>NqaTCS?I?XDXBxOb@GfJ5;${eK3A<7)4BN?k$Gqfiuh1)$xrsg`XY8F+yNRzgv
zy4sA%jDki}mAqCgYQ>a`dnI3UHJY?4Ro&3+W16YiP;C({n9G{2mvl96Xp{KSZcb`o
z3yxZD;it8Htz2gPh6c^n3}Y=P<v3a;Z>;2Ww^cEx+GWk1M%|#Dx9p{+g&DJn*XK^d
z=hK?)=+*;-GiJ%ME2;~jYOK@BYK5AuyDRgWUD2HfTbQ)Wl3uPMA!`=!k|mj^G(&w!
zV$OQ+=51_9!EFlWYAr-PBUpq>fTmVGI9^6ISDJ!THPh8A*aYxhJ+B*ZzbTzq!9JEs
zG;OG5%C0!BR!R6X5`Ogf4WW`*b?rpaFbM8(dFJa<Jt3(AN87NVl?=_}Oq=tT4qt7m
z`Xj3@tFC2JqToR}$R+9q(z;qUEyvXhPMuZvYKDzj)vRVO>jiC{xPB%Za_?Lr2pn{%
z*AvJAJCxB2w&hqQHz5xxwtU6W8#e2~C7RpqP$PHVnR93^e-5$M-K@{y4-R$T-7o%L
zDP25q^*nuG>`mUIU|fhuAWk9#q`RBR4H6xZa4OIyB3*64NMvgtDUn!Y$H~~%_68Pf
z3qYU*geTZep_riU6pV`P`0;D9H^D-TO$1`TjU5ZI2!4=S$@VrS(nlf!D-uS2_?g~&
zcOLuY$<-SPvHH4y80zt~<{(jLHuKWR%22%J3K@#~XXxlC>J|JA#V2cqTeG#JrdD%p
z)fkG;*Ybv5ct%^vSxcIEv{3j&eq^jvDilYH#p0onO(LhnvP*gumT;dG<YyxS;cX!$
z914X|ctkjfAx_`65NeJ{CkfF^UMwa+w&bQqiq~W!Ds^NMP_bdM=-Jv6=ONy+)#r4H
zF3wh0q)T8C5fOfUzMYGQoU-{@TdmGo=G03Ct;(N5?yPN{cUZ4YUf_oXJ(8H6%4PlA
zb*P@1WuyicHf(I%UTNK_8tTd{E;EV>3VC0KMCD;dnGUNXUPe*tLPZiN1ZA}n<OTN#
zy12wY6*;9dWf<1^3=*$b4GoO;8S^Z%i3^+6PN2^JcWPKe{^$U72-G!bT+h|nK<jK2
z9ex}A&C~CY$jtM^7txI&bgn1;#)`e@d(q#8?A;a_tK9cYp;Os(_Wi@J^`%~!Oy9V>
z>*80x^N!6nh8G-M=EJU9QJrP=+|qDSTOP(eRvng!8@BT2hGpJ{TTUjD?uirCVxF?c
zQ=^9tlW*Pa_pKv>ROcTD-}~KffAzI*{O!io&HihLy-U_#luX>$>aQY?eP+_K(}s~z
zb(1Pi!Ll_?-lU%N-foJo3-vyG|0^U{#<=r{R@ZvWp9nJc06y#S+wr+^qBrCTV-Dj7
z0Z&tw&HzrKzR%JOUfQ#uX8@<YS2uk-_-DNP**bS_-uRS9pbB1FEis$lJOWl#vSCNZ
z+ew2>lS*W<7}X-r%0a4v>p-rO3q1>z*KP*?ie&_Ra-pSzUw(k4pGuu1;`aUyQl4`_
zL#WUMYD)`mm#SQ21re#BG-<vBdsS(f=%CcCdzprYgDRHSWR0dzt#gvNnMA{%)0ksp
zR#SI`67Zwmd5tLaIRmcLHQ|fV;!)Fff{KvvTXP?-1Kb?YFH3EXriv<@JuA~$SR#s}
zACb1_d_HH2ZP(*r%8U9zYj}B@$6O2R))2Sb;uT@Pnt4jfJgwEeKk{bWM4yy7N+B-}
nVyIwe40s>MsaTt><{Zw~$8B8(;@<xmrH`(Ye9ZVi$iP1UX&*p|

literal 0
HcmV?d00001


From f986c1520035535ef1e097e7563b127c79f51761 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Thu, 17 Dec 2020 10:57:35 +0100
Subject: [PATCH 242/343] Add QL classes for CIL function pointers, and add
 test

---
 csharp/ql/src/semmle/code/cil/Access.qll      |  2 +-
 csharp/ql/src/semmle/code/cil/CIL.qll         |  1 +
 csharp/ql/src/semmle/code/cil/DataFlow.qll    |  2 +-
 .../ql/src/semmle/code/cil/Instructions.qll   | 24 ++++++++-----
 csharp/ql/src/semmle/code/cil/Method.qll      |  6 ++--
 .../src/semmle/code/cil/Parameterizable.qll   | 15 ++++++++
 csharp/ql/src/semmle/code/cil/Types.qll       | 18 ++++++++++
 csharp/ql/src/semmle/code/cil/Variable.qll    | 35 +++++++++++++------
 csharp/ql/src/semmle/code/csharp/Member.qll   | 14 ++------
 csharp/ql/src/semmle/code/csharp/Variable.qll |  4 +--
 .../dataflow/internal/DataFlowPrivate.qll     |  2 +-
 csharp/ql/src/semmle/code/dotnet/Callable.qll | 20 ++---------
 .../semmle/code/dotnet/Parameterizable.qll    | 30 ++++++++++++++++
 csharp/ql/src/semmle/code/dotnet/Variable.qll | 11 +++---
 csharp/ql/src/semmlecode.csharp.dbscheme      |  1 +
 .../functionPointers.expected                 | 29 +++++++++++++++
 .../cil/functionPointers/functionPointers.ql  | 23 ++++++++++++
 17 files changed, 176 insertions(+), 61 deletions(-)
 create mode 100644 csharp/ql/src/semmle/code/cil/Parameterizable.qll
 create mode 100644 csharp/ql/src/semmle/code/dotnet/Parameterizable.qll
 create mode 100644 csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected
 create mode 100644 csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql

diff --git a/csharp/ql/src/semmle/code/cil/Access.qll b/csharp/ql/src/semmle/code/cil/Access.qll
index e42a883a2e5..6d72a48ff1b 100644
--- a/csharp/ql/src/semmle/code/cil/Access.qll
+++ b/csharp/ql/src/semmle/code/cil/Access.qll
@@ -37,7 +37,7 @@ class WriteAccess extends VariableAccess, @cil_write_access {
 
 /** An instruction that accesses a parameter. */
 class ParameterAccess extends StackVariableAccess, @cil_arg_access {
-  override Parameter getTarget() { result = StackVariableAccess.super.getTarget() }
+  override MethodParameter getTarget() { result = StackVariableAccess.super.getTarget() }
 }
 
 /** An instruction that reads a parameter. */
diff --git a/csharp/ql/src/semmle/code/cil/CIL.qll b/csharp/ql/src/semmle/code/cil/CIL.qll
index 04adbda83b7..1e77d98fd29 100644
--- a/csharp/ql/src/semmle/code/cil/CIL.qll
+++ b/csharp/ql/src/semmle/code/cil/CIL.qll
@@ -19,3 +19,4 @@ import DataFlow
 import Attribute
 import Stubs
 import CustomModifierReceiver
+import Parameterizable
diff --git a/csharp/ql/src/semmle/code/cil/DataFlow.qll b/csharp/ql/src/semmle/code/cil/DataFlow.qll
index 7316a06b2de..6991658ea3a 100644
--- a/csharp/ql/src/semmle/code/cil/DataFlow.qll
+++ b/csharp/ql/src/semmle/code/cil/DataFlow.qll
@@ -74,7 +74,7 @@ private predicate localExactStep(DataFlowNode src, DataFlowNode sink) {
   or
   src = sink.(ConditionalBranch).getAnOperand()
   or
-  src = sink.(Parameter).getAWrite()
+  src = sink.(MethodParameter).getAWrite()
   or
   exists(VariableUpdate update |
     update.getVariable().(Parameter) = sink and src = update.getSource()
diff --git a/csharp/ql/src/semmle/code/cil/Instructions.qll b/csharp/ql/src/semmle/code/cil/Instructions.qll
index 438c16518f8..bc79e15d4e4 100644
--- a/csharp/ql/src/semmle/code/cil/Instructions.qll
+++ b/csharp/ql/src/semmle/code/cil/Instructions.qll
@@ -626,35 +626,43 @@ module Opcodes {
   class Ldarg_0 extends ParameterReadAccess, @cil_ldarg_0 {
     override string getOpcodeName() { result = "ldarg.0" }
 
-    override Parameter getTarget() { result = getImplementation().getMethod().getRawParameter(0) }
+    override MethodParameter getTarget() {
+      result = getImplementation().getMethod().getRawParameter(0)
+    }
   }
 
   /** An `ldarg.1` instruction. */
   class Ldarg_1 extends ParameterReadAccess, @cil_ldarg_1 {
     override string getOpcodeName() { result = "ldarg.1" }
 
-    override Parameter getTarget() { result = getImplementation().getMethod().getRawParameter(1) }
+    override MethodParameter getTarget() {
+      result = getImplementation().getMethod().getRawParameter(1)
+    }
   }
 
   /** An `ldarg.2` instruction. */
   class Ldarg_2 extends ParameterReadAccess, @cil_ldarg_2 {
     override string getOpcodeName() { result = "ldarg.2" }
 
-    override Parameter getTarget() { result = getImplementation().getMethod().getRawParameter(2) }
+    override MethodParameter getTarget() {
+      result = getImplementation().getMethod().getRawParameter(2)
+    }
   }
 
   /** An `ldarg.3` instruction. */
   class Ldarg_3 extends ParameterReadAccess, @cil_ldarg_3 {
     override string getOpcodeName() { result = "ldarg.3" }
 
-    override Parameter getTarget() { result = getImplementation().getMethod().getRawParameter(3) }
+    override MethodParameter getTarget() {
+      result = getImplementation().getMethod().getRawParameter(3)
+    }
   }
 
   /** An `ldarg.s` instruction. */
   class Ldarg_s extends ParameterReadAccess, @cil_ldarg_s {
     override string getOpcodeName() { result = "ldarg.s" }
 
-    override Parameter getTarget() { cil_access(this, result) }
+    override MethodParameter getTarget() { cil_access(this, result) }
 
     override string getExtra() { result = this.getTarget().getIndex().toString() }
   }
@@ -663,21 +671,21 @@ module Opcodes {
   class Ldarg extends ParameterReadAccess, @cil_ldarg {
     override string getOpcodeName() { result = "ldarg" }
 
-    override Parameter getTarget() { cil_access(this, result) }
+    override MethodParameter getTarget() { cil_access(this, result) }
   }
 
   /** An `ldarga.s` instruction. */
   class Ldarga_s extends ParameterReadAccess, ReadRefAccess, @cil_ldarga_s {
     override string getOpcodeName() { result = "ldarga.s" }
 
-    override Parameter getTarget() { cil_access(this, result) }
+    override MethodParameter getTarget() { cil_access(this, result) }
   }
 
   /** An `starg.s` instruction. */
   class Starg_s extends ParameterWriteAccess, @cil_starg_s {
     override string getOpcodeName() { result = "starg.s" }
 
-    override Parameter getTarget() { cil_access(this, result) }
+    override MethodParameter getTarget() { cil_access(this, result) }
   }
 
   /** An `ldfld` instruction. */
diff --git a/csharp/ql/src/semmle/code/cil/Method.qll b/csharp/ql/src/semmle/code/cil/Method.qll
index 36fdae94c3c..5ef282e582a 100644
--- a/csharp/ql/src/semmle/code/cil/Method.qll
+++ b/csharp/ql/src/semmle/code/cil/Method.qll
@@ -67,7 +67,7 @@ class MethodImplementation extends EntryPoint, @cil_method_implementation {
  * destructors, operators, accessors and so on.
  */
 class Method extends DotNet::Callable, Element, Member, TypeContainer, DataFlowNode,
-  CustomModifierReceiver, @cil_method {
+  CustomModifierReceiver, Parameterizable, @cil_method {
   /**
    * Gets a method implementation, if any. Note that there can
    * be several implementations in different assemblies.
@@ -89,9 +89,7 @@ class Method extends DotNet::Callable, Element, Member, TypeContainer, DataFlowN
 
   override Location getALocation() { cil_method_location(this.getUnboundDeclaration(), result) }
 
-  override Parameter getRawParameter(int n) { cil_parameter(result, this, n, _) }
-
-  override Parameter getParameter(int n) {
+  override MethodParameter getParameter(int n) {
     if isStatic() then result = getRawParameter(n) else (result = getRawParameter(n + 1) and n >= 0)
   }
 
diff --git a/csharp/ql/src/semmle/code/cil/Parameterizable.qll b/csharp/ql/src/semmle/code/cil/Parameterizable.qll
new file mode 100644
index 00000000000..77b16aba025
--- /dev/null
+++ b/csharp/ql/src/semmle/code/cil/Parameterizable.qll
@@ -0,0 +1,15 @@
+/**
+ * Provides `Parameterizable` class.
+ */
+
+private import CIL
+private import dotnet
+
+/**
+ * A parameterizable entity, such as `FunctionPointerType` or `Method`.
+ */
+class Parameterizable extends DotNet::Parameterizable, Element, @cil_parameterizable {
+  override Parameter getRawParameter(int n) { cil_parameter(result, this, n, _) }
+
+  override Parameter getParameter(int n) { cil_parameter(result, this, n, _) }
+}
diff --git a/csharp/ql/src/semmle/code/cil/Types.qll b/csharp/ql/src/semmle/code/cil/Types.qll
index 5a106eeb0cb..0a07e78bb20 100644
--- a/csharp/ql/src/semmle/code/cil/Types.qll
+++ b/csharp/ql/src/semmle/code/cil/Types.qll
@@ -288,3 +288,21 @@ class CharType extends IntegralType {
 class SystemType extends ValueOrRefType {
   SystemType() { this.isSystemType("Type") }
 }
+
+/**
+ * A function pointer type, for example
+ *
+ * ```csharp
+ * delegate*<int, void>
+ * ```
+ */
+class FunctionPointerType extends Type, CustomModifierReceiver, Parameterizable,
+  @cil_function_pointer_type {
+  /** Gets the return type of this function pointer. */
+  Type getReturnType() { cil_function_pointer_return_type(this, result) }
+
+  /** Gets the calling convention. */
+  int getCallingConvention() { cil_function_pointer_calling_conventions(this, result) }
+
+  override string toString() { result = Type.super.toString() }
+}
diff --git a/csharp/ql/src/semmle/code/cil/Variable.qll b/csharp/ql/src/semmle/code/cil/Variable.qll
index 03679fb6bd1..3a247e1f0d1 100644
--- a/csharp/ql/src/semmle/code/cil/Variable.qll
+++ b/csharp/ql/src/semmle/code/cil/Variable.qll
@@ -56,17 +56,16 @@ class LocalVariable extends StackVariable, @cil_local_variable {
   override Method getMethod() { result = getImplementation().getMethod() }
 }
 
-/** A method parameter. */
-class Parameter extends DotNet::Parameter, StackVariable, CustomModifierReceiver, @cil_parameter {
-  /** Gets the method declaring this parameter. */
-  override Method getMethod() { this = result.getARawParameter() }
-
-  override Method getCallable() { result = getMethod() }
+/** A parameter of a `Method` or `FunctionPointerType`. */
+class Parameter extends DotNet::Parameter, CustomModifierReceiver, @cil_parameter {
+  override Parameterizable getDeclaringElement() { cil_parameter(this, result, _, _) }
 
   /** Gets the index of this parameter. */
   int getIndex() { cil_parameter(this, _, result, _) }
 
-  override string toString() { result = "Parameter " + getIndex() + " of " + getMethod().getName() }
+  override string toString() {
+    result = "Parameter " + getIndex() + " of " + getDeclaringElement().getName()
+  }
 
   override Type getType() { cil_parameter(this, _, _, result) }
 
@@ -99,22 +98,36 @@ class Parameter extends DotNet::Parameter, StackVariable, CustomModifierReceiver
       else result = ""
   }
 
-  override Location getLocation() { result = getMethod().getLocation() }
+  override Location getLocation() { result = getDeclaringElement().getLocation() }
+}
+
+/** A method parameter. */
+class MethodParameter extends Parameter, StackVariable {
+  /** Gets the method declaring this parameter. */
+  override Method getMethod() { this = result.getARawParameter() }
 
   override ParameterAccess getAnAccess() { result.getTarget() = this }
 
   /** Gets a parameter in an overridden method. */
-  Parameter getOverriddenParameter() {
+  MethodParameter getOverriddenParameter() {
     result = getMethod().getOverriddenMethod().getRawParameter(getRawPosition())
   }
 
-  override Parameter getUnboundDeclaration() {
+  override MethodParameter getUnboundDeclaration() {
     result = getMethod().getUnboundDeclaration().getRawParameter(getRawPosition())
   }
+
+  override string toString() { result = Parameter.super.toString() }
+
+  override string toStringWithTypes() { result = Parameter.super.toStringWithTypes() }
+
+  override Type getType() { result = Parameter.super.getType() }
+
+  override Location getLocation() { result = Parameter.super.getLocation() }
 }
 
 /** A parameter corresponding to `this`. */
-class ThisParameter extends Parameter {
+class ThisParameter extends MethodParameter {
   ThisParameter() {
     not this.getMethod().isStatic() and
     this.getIndex() = 0
diff --git a/csharp/ql/src/semmle/code/csharp/Member.qll b/csharp/ql/src/semmle/code/csharp/Member.qll
index 0b3e06c2e5e..1d2bfe0a284 100644
--- a/csharp/ql/src/semmle/code/csharp/Member.qll
+++ b/csharp/ql/src/semmle/code/csharp/Member.qll
@@ -316,18 +316,10 @@ class Virtualizable extends Member, @virtualizable {
  * A parameterizable declaration. Either a callable (`Callable`), a delegate
  * type (`DelegateType`), or an indexer (`Indexer`).
  */
-class Parameterizable extends Declaration, @parameterizable {
-  /** Gets a parameter of this declaration, if any. */
-  Parameter getAParameter() { result = getParameter(_) }
+class Parameterizable extends DotNet::Parameterizable, Declaration, @parameterizable {
+  override Parameter getRawParameter(int i) { params(result, _, _, i, _, this, _) }
 
-  /** Gets the `i`th parameter of this declaration. */
-  Parameter getParameter(int i) { params(result, _, _, i, _, this, _) }
-
-  /** Gets the number of parameters of this declaration. */
-  int getNumberOfParameters() { result = count(this.getAParameter()) }
-
-  /** Holds if this declaration has no parameters. */
-  predicate hasNoParameters() { not exists(this.getAParameter()) }
+  override Parameter getParameter(int i) { params(result, _, _, i, _, this, _) }
 
   /**
    * Gets the name of this parameter followed by its type, possibly prefixed
diff --git a/csharp/ql/src/semmle/code/csharp/Variable.qll b/csharp/ql/src/semmle/code/csharp/Variable.qll
index 6756ca6e533..a13175dfeb0 100644
--- a/csharp/ql/src/semmle/code/csharp/Variable.qll
+++ b/csharp/ql/src/semmle/code/csharp/Variable.qll
@@ -177,7 +177,7 @@ class Parameter extends DotNet::Parameter, LocalScopeVariable, Attributable, Top
   predicate hasExtensionMethodModifier() { params(this, _, _, _, 4, _, _) }
 
   /** Gets the declaring element of this parameter. */
-  Parameterizable getDeclaringElement() { params(this, _, _, _, _, result, _) }
+  override Parameterizable getDeclaringElement() { params(this, _, _, _, _, result, _) }
 
   override Parameter getUnboundDeclaration() { params(this, _, _, _, _, _, result) }
 
@@ -213,7 +213,7 @@ class Parameter extends DotNet::Parameter, LocalScopeVariable, Attributable, Top
   predicate hasDefaultValue() { exists(getDefaultValue()) }
 
   /** Gets the callable to which this parameter belongs, if any. */
-  override Callable getCallable() { result.getAParameter() = this }
+  override Callable getCallable() { result = this.getDeclaringElement() }
 
   /**
    * Gets an argument which is assigned to this parameter in a call to the
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 001e071c651..62d3318d4d5 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -571,7 +571,7 @@ private module Cached {
     TCilExprNode(CIL::Expr e) { e.getImplementation() instanceof CIL::BestImplementation } or
     TSsaDefinitionNode(Ssa::Definition def) or
     TInstanceParameterNode(Callable c) { c.hasBody() and not c.(Modifiable).isStatic() } or
-    TCilParameterNode(CIL::Parameter p) { p.getMethod().hasBody() } or
+    TCilParameterNode(CIL::MethodParameter p) { p.getMethod().hasBody() } or
     TYieldReturnNode(ControlFlow::Nodes::ElementNode cfn) {
       any(Callable c).canYieldReturn(cfn.getElement())
     } or
diff --git a/csharp/ql/src/semmle/code/dotnet/Callable.qll b/csharp/ql/src/semmle/code/dotnet/Callable.qll
index 1443da24481..7cdb248d669 100644
--- a/csharp/ql/src/semmle/code/dotnet/Callable.qll
+++ b/csharp/ql/src/semmle/code/dotnet/Callable.qll
@@ -6,29 +6,13 @@
 import Declaration
 import Variable
 import Expr
+import Parameterizable
 
 /** A .Net callable. */
-class Callable extends Declaration, @dotnet_callable {
-  /** Gets raw parameter `i`, including the `this` parameter at index 0. */
-  Parameter getRawParameter(int i) { none() }
-
-  /** Gets the `i`th parameter, excluding the `this` parameter. */
-  Parameter getParameter(int i) { none() }
-
+class Callable extends Parameterizable, @dotnet_callable {
   /** Holds if this callable has a body or an implementation. */
   predicate hasBody() { none() }
 
-  override Callable getUnboundDeclaration() { result = Declaration.super.getUnboundDeclaration() }
-
-  /** Gets the number of parameters of this callable. */
-  int getNumberOfParameters() { result = count(getAParameter()) }
-
-  /** Gets a parameter, if any. */
-  Parameter getAParameter() { result = getParameter(_) }
-
-  /** Gets a raw parameter (including the qualifier), if any. */
-  final Parameter getARawParameter() { result = getRawParameter(_) }
-
   /** Holds if this callable can return expression `e`. */
   predicate canReturn(Expr e) { none() }
 
diff --git a/csharp/ql/src/semmle/code/dotnet/Parameterizable.qll b/csharp/ql/src/semmle/code/dotnet/Parameterizable.qll
new file mode 100644
index 00000000000..8a1f9c108ca
--- /dev/null
+++ b/csharp/ql/src/semmle/code/dotnet/Parameterizable.qll
@@ -0,0 +1,30 @@
+/**
+ * Provides a general parameterizable entity to represent constructs that might
+ * have parameters.
+ */
+
+import Declaration
+
+/**
+ * A general parameterizable entity, such as a callable, delegate type, accessor,
+ * indexer, or function pointer type.
+ */
+class Parameterizable extends Declaration, @dotnet_parameterizable {
+  /** Gets raw parameter `i`, including the `this` parameter at index 0. */
+  Parameter getRawParameter(int i) { none() }
+
+  /** Gets the `i`th parameter, excluding the `this` parameter. */
+  Parameter getParameter(int i) { none() }
+
+  /** Gets the number of parameters of this callable. */
+  int getNumberOfParameters() { result = count(this.getAParameter()) }
+
+  /** Holds if this declaration has no parameters. */
+  predicate hasNoParameters() { not exists(this.getAParameter()) }
+
+  /** Gets a parameter, if any. */
+  Parameter getAParameter() { result = this.getParameter(_) }
+
+  /** Gets a raw parameter (including the qualifier), if any. */
+  final Parameter getARawParameter() { result = this.getRawParameter(_) }
+}
diff --git a/csharp/ql/src/semmle/code/dotnet/Variable.qll b/csharp/ql/src/semmle/code/dotnet/Variable.qll
index c004b9ab6b3..9f9a12e7d98 100644
--- a/csharp/ql/src/semmle/code/dotnet/Variable.qll
+++ b/csharp/ql/src/semmle/code/dotnet/Variable.qll
@@ -12,16 +12,19 @@ class Variable extends Declaration, @dotnet_variable {
 /** A .Net field. */
 class Field extends Variable, Member, @dotnet_field { }
 
-/** A parameter to a .Net callable or property. */
+/** A parameter to a .Net callable, property or function pointer type. */
 class Parameter extends Variable, @dotnet_parameter {
   /** Gets the raw position of this parameter, including the `this` parameter at index 0. */
-  final int getRawPosition() { this = getCallable().getRawParameter(result) }
+  final int getRawPosition() { this = getDeclaringElement().getRawParameter(result) }
 
   /** Gets the position of this parameter, excluding the `this` parameter. */
-  int getPosition() { this = getCallable().getParameter(result) }
+  int getPosition() { this = getDeclaringElement().getParameter(result) }
 
   /** Gets the callable defining this parameter. */
-  Callable getCallable() { none() }
+  Callable getCallable() { result = this.getDeclaringElement() }
+
+  /** Gets the declaring `Parameterizable`. */
+  Parameterizable getDeclaringElement() { none() }
 
   /** Holds if this is an `out` parameter. */
   predicate isOut() { none() }
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index e0e4ca2c62a..712940d4218 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -1918,6 +1918,7 @@ cil_attribute_positional_argument(
 @dotnet_member = @member | @cil_member;
 @dotnet_event = @event | @cil_event;
 @dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
 
 // Common types
 @dotnet_type = @type | @cil_type;
diff --git a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected
new file mode 100644
index 00000000000..c1ca2539a91
--- /dev/null
+++ b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected
@@ -0,0 +1,29 @@
+fnptr
+| file://:0:0:0:0 | delegate* managed<!0,Int32> | 1 | file://:0:0:0:0 | Int32 | 0 |
+| file://:0:0:0:0 | delegate* managed<A,B> | 1 | file://:0:0:0:0 | B | 0 |
+| file://:0:0:0:0 | delegate* managed<B,A> | 1 | file://:0:0:0:0 | A | 0 |
+| file://:0:0:0:0 | delegate* managed<Int32*,Void*> | 1 | file://:0:0:0:0 | Void* | 0 |
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | 3 | file://:0:0:0:0 | Int32 | 0 |
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32> | 2 | file://:0:0:0:0 | Int32 | 0 |
+| file://:0:0:0:0 | delegate* managed<Int32> | 0 | file://:0:0:0:0 | Int32 | 0 |
+| file://:0:0:0:0 | delegate* managed<Void*,Int32*> | 1 | file://:0:0:0:0 | Int32* | 0 |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | 3 | file://:0:0:0:0 | void | 2 |
+params
+| file://:0:0:0:0 | delegate* managed<!0,Int32> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<!0,Int32> | fnptr.dll:0:0:0:0 | !0 |
+| file://:0:0:0:0 | delegate* managed<A,B> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<A,B> | file://:0:0:0:0 | A |
+| file://:0:0:0:0 | delegate* managed<B,A> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<B,A> | file://:0:0:0:0 | B |
+| file://:0:0:0:0 | delegate* managed<Int32*,Void*> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32*,Void*> | file://:0:0:0:0 | Int32* |
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | file://:0:0:0:0 | Int32 |
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | file://:0:0:0:0 | Object |
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | 2 | file://:0:0:0:0 | Parameter 2 of delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | file://:0:0:0:0 | Int32 |
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32,Object modreq(OutAttribute),Int32> | file://:0:0:0:0 | Int32 |
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* managed<Int32,Object modreq(OutAttribute),Int32> | file://:0:0:0:0 | Object |
+| file://:0:0:0:0 | delegate* managed<Void*,Int32*> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Void*,Int32*> | file://:0:0:0:0 | Void* |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | file://:0:0:0:0 | Int32 |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | file://:0:0:0:0 | Object |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | 2 | file://:0:0:0:0 | Parameter 2 of delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | fnptr.dll:0:0:0:0 | !0 |
+modifiers
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | System.Runtime.InteropServices.InAttribute | modreq |
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | System.Runtime.InteropServices.OutAttribute | modreq |
+| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32> | System.Runtime.InteropServices.OutAttribute | modreq |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | System.Runtime.InteropServices.OutAttribute | modreq |
diff --git a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql
new file mode 100644
index 00000000000..dc68fc951f2
--- /dev/null
+++ b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql
@@ -0,0 +1,23 @@
+import cil
+import semmle.code.cil.Type
+
+bindingset[kind]
+private string getKind(int kind) { if kind = 1 then result = "modreq" else result = "modopt" }
+
+query predicate fnptr(FunctionPointerType fn, int paramCount, Type returnType, int callingConvention) {
+  paramCount = fn.getNumberOfParameters() and
+  returnType = fn.getReturnType() and
+  callingConvention = fn.getCallingConvention()
+}
+
+query predicate params(FunctionPointerType fn, int i, Parameter p, Type t) {
+  fn.getParameter(i) = p and p.getType() = t
+}
+
+query predicate modifiers(FunctionPointerType fn, string modifier, string sKind) {
+  exists(Type modType, int kind |
+    cil_custom_modifiers(fn, modType, kind) and
+    modType.getQualifiedName() = modifier and
+    sKind = getKind(kind)
+  )
+}

From f99bf5755c033fa646c5a3bdd1a702c7dca67d75 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 11 Jan 2021 11:36:24 +0100
Subject: [PATCH 243/343] Merge parameter extraction between methods and
 function pointers

---
 .../Entities/FunctionPointerType.cs                 | 11 ++---------
 .../Semmle.Extraction.CIL/Entities/Method.cs        | 13 +++++++++++--
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
index 8609e858ed4..2ce644d4261 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
@@ -99,16 +99,9 @@ namespace Semmle.Extraction.CIL.Entities
 
                 yield return Tuples.cil_function_pointer_calling_conventions(this, signature.Header.CallingConvention);
 
-                var i = 0;
-                foreach (var p in signature.ParameterTypes)
+                foreach (var p in Method.GetParameterExtractionProducts(signature.ParameterTypes, this, this, Cx, 0))
                 {
-                    var t = p;
-                    if (t is ModifiedType mtparam)
-                    {
-                        t = mtparam.Unmodified;
-                        yield return Tuples.cil_custom_modifiers(this, mtparam.Modifier, mtparam.IsRequired);
-                    }
-                    yield return Cx.Populate(new Parameter(Cx, this, i++, t));
+                    yield return p;
                 }
             }
         }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
index d4da3e16463..53ff032ba3f 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
@@ -86,15 +86,24 @@ namespace Semmle.Extraction.CIL.Entities
                 yield return Cx.Populate(new Parameter(Cx, this, i++, DeclaringType));
             }
 
+            foreach (var p in GetParameterExtractionProducts(parameterTypes, this, this, Cx, i))
+            {
+                yield return p;
+            }
+        }
+
+        internal static IEnumerable<IExtractionProduct> GetParameterExtractionProducts(IEnumerable<Type> parameterTypes, IParameterizable parameterizable, ICustomModifierReceiver receiver, Context cx, int firstChildIndex)
+        {
+            var i = firstChildIndex;
             foreach (var p in parameterTypes)
             {
                 var t = p;
                 if (t is ModifiedType mt)
                 {
                     t = mt.Unmodified;
-                    yield return Tuples.cil_custom_modifiers(this, mt.Modifier, mt.IsRequired);
+                    yield return Tuples.cil_custom_modifiers(receiver, mt.Modifier, mt.IsRequired);
                 }
-                yield return Cx.Populate(new Parameter(Cx, this, i++, t));
+                yield return cx.Populate(new Parameter(cx, parameterizable, i++, t));
             }
         }
 

From 2804f5cba998c6e83fd95d7dcedb9c870c935abf Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 11 Jan 2021 21:27:11 +0100
Subject: [PATCH 244/343] Add by-ref, and fix pinned CIL extraction

---
 .../Entities/ByRefType.cs                     | 42 +++++++++++++++++++
 .../Entities/DefinitionMethod.cs              |  7 +++-
 .../Entities/FunctionPointerType.cs           |  4 ++
 .../Semmle.Extraction.CIL/Entities/Method.cs  |  8 ++++
 .../Entities/Property.cs                      |  4 ++
 .../Entities/SignatureDecoder.cs              | 20 +--------
 .../Entities/TypeSignatureDecoder.cs          |  5 +--
 .../functionPointers.expected                 | 30 ++++++-------
 8 files changed, 83 insertions(+), 37 deletions(-)
 create mode 100644 csharp/extractor/Semmle.Extraction.CIL/Entities/ByRefType.cs

diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/ByRefType.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/ByRefType.cs
new file mode 100644
index 00000000000..2a527419249
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/ByRefType.cs
@@ -0,0 +1,42 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+
+namespace Semmle.Extraction.CIL.Entities
+{
+    /// <summary>
+    /// Types that are passed by reference are not written directly to trap files. Instead, the annotation is stored on
+    /// the entity.
+    /// </summary>
+    internal sealed class ByRefType : Type
+    {
+        public ByRefType(Context cx, Type elementType) : base(cx)
+        {
+            ElementType = elementType;
+        }
+
+        public override CilTypeKind Kind => throw new NotImplementedException();
+
+        public override Namespace? ContainingNamespace => throw new NotImplementedException();
+
+        public override Type? ContainingType => throw new NotImplementedException();
+
+        public override int ThisTypeParameterCount => throw new NotImplementedException();
+
+        public override IEnumerable<Type> TypeParameters => throw new NotImplementedException();
+
+        public override Type Construct(IEnumerable<Type> typeArguments) => throw new NotImplementedException();
+
+        public override string Name => $"{ElementType.Name}&";
+
+        public Type ElementType { get; }
+
+        public override void WriteAssemblyPrefix(TextWriter trapFile) => throw new NotImplementedException();
+
+        public override void WriteId(TextWriter trapFile, bool inContext)
+        {
+            ElementType.WriteId(trapFile, inContext);
+            trapFile.Write('&');
+        }
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs
index 353015bb9ad..60af5e2cc6e 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs
@@ -121,7 +121,12 @@ namespace Semmle.Extraction.CIL.Entities
 
                         for (var l = 0; l < this.locals.Length; ++l)
                         {
-                            this.locals[l] = Cx.Populate(new LocalVariable(Cx, Implementation, l, localVariableTypes[l]));
+                            var t = localVariableTypes[l];
+                            if (t is ByRefType brt)
+                            {
+                                t = brt.ElementType;
+                            }
+                            this.locals[l] = Cx.Populate(new LocalVariable(Cx, Implementation, l, t));
                             yield return this.locals[l];
                         }
                     }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
index 2ce644d4261..b86fbc61e0c 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
@@ -95,6 +95,10 @@ namespace Semmle.Extraction.CIL.Entities
                     retType = mt.Unmodified;
                     yield return Tuples.cil_custom_modifiers(this, mt.Modifier, mt.IsRequired);
                 }
+                if (retType is ByRefType byRefType)
+                {
+                    retType = byRefType.ElementType;
+                }
                 yield return Tuples.cil_function_pointer_return_type(this, retType);
 
                 yield return Tuples.cil_function_pointer_calling_conventions(this, signature.Header.CallingConvention);
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
index 53ff032ba3f..dd534ac3431 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
@@ -103,6 +103,10 @@ namespace Semmle.Extraction.CIL.Entities
                     t = mt.Unmodified;
                     yield return Tuples.cil_custom_modifiers(receiver, mt.Modifier, mt.IsRequired);
                 }
+                if (t is ByRefType brt)
+                {
+                    t = brt.ElementType;
+                }
                 yield return cx.Populate(new Parameter(cx, parameterizable, i++, t));
             }
         }
@@ -115,6 +119,10 @@ namespace Semmle.Extraction.CIL.Entities
                 t = mt.Unmodified;
                 yield return Tuples.cil_custom_modifiers(this, mt.Modifier, mt.IsRequired);
             }
+            if (t is ByRefType brt)
+            {
+                t = brt.ElementType;
+            }
             yield return Tuples.cil_method(this, name, declaringType, t);
         }
     }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs
index 3a15bf795fe..879b53da077 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs
@@ -62,6 +62,10 @@ namespace Semmle.Extraction.CIL.Entities
                     t = mt.Unmodified;
                     yield return Tuples.cil_custom_modifiers(this, mt.Modifier, mt.IsRequired);
                 }
+                if (t is ByRefType brt)
+                {
+                    t = brt.ElementType;
+                }
                 yield return Tuples.cil_property(this, type, name, t);
 
                 var accessors = pd.GetAccessors();
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs
index d5b3ca176ec..a80f456df72 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/SignatureDecoder.cs
@@ -41,8 +41,8 @@ namespace Semmle.Extraction.CIL.Entities
 
             public void WriteId(TextWriter trapFile, GenericContext gc)
             {
-                trapFile.Write("ref ");
                 elementType.WriteId(trapFile, gc);
+                trapFile.Write('&');
             }
         }
 
@@ -173,25 +173,9 @@ namespace Semmle.Extraction.CIL.Entities
             return new Modified(unmodifiedType, modifier, isRequired);
         }
 
-        private class Pinned : ITypeSignature
-        {
-            private readonly ITypeSignature elementType;
-
-            public Pinned(ITypeSignature elementType)
-            {
-                this.elementType = elementType;
-            }
-
-            public void WriteId(TextWriter trapFile, GenericContext gc)
-            {
-                trapFile.Write("pinned ");
-                elementType.WriteId(trapFile, gc);
-            }
-        }
-
         ITypeSignature ISignatureTypeProvider<ITypeSignature, object>.GetPinnedType(ITypeSignature elementType)
         {
-            return new Pinned(elementType);
+            return elementType;
         }
 
         private class PointerType : ITypeSignature
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs
index 45805fda115..dcb986f1526 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeSignatureDecoder.cs
@@ -20,7 +20,7 @@ namespace Semmle.Extraction.CIL.Entities
             cx.Populate(new ArrayType(cx, elementType, shape.Rank));
 
         Type IConstructedTypeProvider<Type>.GetByReferenceType(Type elementType) =>
-            elementType;  // ??
+            new ByRefType(cx, elementType);
 
         Type ISignatureTypeProvider<Type, GenericContext>.GetFunctionPointerType(MethodSignature<Type> signature) =>
             cx.Populate(new FunctionPointerType(cx, signature));
@@ -37,8 +37,7 @@ namespace Semmle.Extraction.CIL.Entities
         Type ISignatureTypeProvider<Type, GenericContext>.GetModifiedType(Type modifier, Type unmodifiedType, bool isRequired) =>
             new ModifiedType(cx, unmodifiedType, modifier, isRequired);
 
-        Type ISignatureTypeProvider<Type, GenericContext>.GetPinnedType(Type elementType) =>
-            cx.Populate(new PointerType(cx, elementType));
+        Type ISignatureTypeProvider<Type, GenericContext>.GetPinnedType(Type elementType) => elementType;
 
         Type IConstructedTypeProvider<Type>.GetPointerType(Type elementType) =>
             cx.Populate(new PointerType(cx, elementType));
diff --git a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected
index c1ca2539a91..485eb118b15 100644
--- a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected
+++ b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected
@@ -2,28 +2,28 @@ fnptr
 | file://:0:0:0:0 | delegate* managed<!0,Int32> | 1 | file://:0:0:0:0 | Int32 | 0 |
 | file://:0:0:0:0 | delegate* managed<A,B> | 1 | file://:0:0:0:0 | B | 0 |
 | file://:0:0:0:0 | delegate* managed<B,A> | 1 | file://:0:0:0:0 | A | 0 |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 3 | file://:0:0:0:0 | Int32 | 0 |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 2 | file://:0:0:0:0 | Int32 | 0 |
 | file://:0:0:0:0 | delegate* managed<Int32*,Void*> | 1 | file://:0:0:0:0 | Void* | 0 |
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | 3 | file://:0:0:0:0 | Int32 | 0 |
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32> | 2 | file://:0:0:0:0 | Int32 | 0 |
 | file://:0:0:0:0 | delegate* managed<Int32> | 0 | file://:0:0:0:0 | Int32 | 0 |
 | file://:0:0:0:0 | delegate* managed<Void*,Int32*> | 1 | file://:0:0:0:0 | Int32* | 0 |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | 3 | file://:0:0:0:0 | void | 2 |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 3 | file://:0:0:0:0 | void | 2 |
 params
 | file://:0:0:0:0 | delegate* managed<!0,Int32> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<!0,Int32> | fnptr.dll:0:0:0:0 | !0 |
 | file://:0:0:0:0 | delegate* managed<A,B> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<A,B> | file://:0:0:0:0 | A |
 | file://:0:0:0:0 | delegate* managed<B,A> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<B,A> | file://:0:0:0:0 | B |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | file://:0:0:0:0 | Int32 |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | file://:0:0:0:0 | Object |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 2 | file://:0:0:0:0 | Parameter 2 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | file://:0:0:0:0 | Int32 |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | file://:0:0:0:0 | Int32 |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | file://:0:0:0:0 | Object |
 | file://:0:0:0:0 | delegate* managed<Int32*,Void*> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32*,Void*> | file://:0:0:0:0 | Int32* |
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | file://:0:0:0:0 | Int32 |
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | file://:0:0:0:0 | Object |
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | 2 | file://:0:0:0:0 | Parameter 2 of delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | file://:0:0:0:0 | Int32 |
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32,Object modreq(OutAttribute),Int32> | file://:0:0:0:0 | Int32 |
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* managed<Int32,Object modreq(OutAttribute),Int32> | file://:0:0:0:0 | Object |
 | file://:0:0:0:0 | delegate* managed<Void*,Int32*> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Void*,Int32*> | file://:0:0:0:0 | Void* |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | file://:0:0:0:0 | Int32 |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | file://:0:0:0:0 | Object |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | 2 | file://:0:0:0:0 | Parameter 2 of delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | fnptr.dll:0:0:0:0 | !0 |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | file://:0:0:0:0 | Int32 |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | file://:0:0:0:0 | Object |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 2 | file://:0:0:0:0 | Parameter 2 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | fnptr.dll:0:0:0:0 | !0 |
 modifiers
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | System.Runtime.InteropServices.InAttribute | modreq |
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32 modreq(InAttribute),Int32> | System.Runtime.InteropServices.OutAttribute | modreq |
-| file://:0:0:0:0 | delegate* managed<Int32,Object modreq(OutAttribute),Int32> | System.Runtime.InteropServices.OutAttribute | modreq |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32,Object modreq(OutAttribute),!0,Void> | System.Runtime.InteropServices.OutAttribute | modreq |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | System.Runtime.InteropServices.InAttribute | modreq |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | System.Runtime.InteropServices.OutAttribute | modreq |
+| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | System.Runtime.InteropServices.OutAttribute | modreq |
+| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | System.Runtime.InteropServices.OutAttribute | modreq |

From 727412b26bc2af9be74883d92b547f7f326a4ea9 Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 11 Jan 2021 22:11:55 +0100
Subject: [PATCH 245/343] Store by-ref type annotation in trap and add tests

---
 .../Entities/DefinitionMethod.cs              |   10 +-
 .../Entities/FunctionPointerType.cs           |    1 +
 .../Semmle.Extraction.CIL/Entities/Method.cs  |    9 +-
 .../Entities/Property.cs                      |    1 +
 .../Entities/TypeAnnotation.cs                |   11 +
 .../extractor/Semmle.Extraction.CIL/Tuples.cs |    3 +
 csharp/ql/src/semmlecode.csharp.dbscheme      |    5 +
 .../functionPointers.expected                 |   52 +-
 .../cil/functionPointers/functionPointers.ql  |   26 +-
 .../cil/typeAnnotations/Program.cs            |   10 +
 .../typeAnnotations/typeAnnotations.expected  | 1747 +++++++++++++++++
 .../cil/typeAnnotations/typeAnnotations.ql    |   25 +
 12 files changed, 1863 insertions(+), 37 deletions(-)
 create mode 100644 csharp/extractor/Semmle.Extraction.CIL/Entities/TypeAnnotation.cs
 create mode 100644 csharp/ql/test/library-tests/cil/typeAnnotations/Program.cs
 create mode 100644 csharp/ql/test/library-tests/cil/typeAnnotations/typeAnnotations.expected
 create mode 100644 csharp/ql/test/library-tests/cil/typeAnnotations/typeAnnotations.ql

diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs
index 60af5e2cc6e..175da806597 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs
@@ -125,9 +125,15 @@ namespace Semmle.Extraction.CIL.Entities
                             if (t is ByRefType brt)
                             {
                                 t = brt.ElementType;
+                                this.locals[l] = Cx.Populate(new LocalVariable(Cx, Implementation, l, t));
+                                yield return this.locals[l];
+                                yield return Tuples.cil_type_annotation(this.locals[l], TypeAnnotation.Ref);
+                            }
+                            else
+                            {
+                                this.locals[l] = Cx.Populate(new LocalVariable(Cx, Implementation, l, t));
+                                yield return this.locals[l];
                             }
-                            this.locals[l] = Cx.Populate(new LocalVariable(Cx, Implementation, l, t));
-                            yield return this.locals[l];
                         }
                     }
 
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
index b86fbc61e0c..e92dd957cb5 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/FunctionPointerType.cs
@@ -98,6 +98,7 @@ namespace Semmle.Extraction.CIL.Entities
                 if (retType is ByRefType byRefType)
                 {
                     retType = byRefType.ElementType;
+                    yield return Tuples.cil_type_annotation(this, TypeAnnotation.Ref);
                 }
                 yield return Tuples.cil_function_pointer_return_type(this, retType);
 
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
index dd534ac3431..30e94c8e16a 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Method.cs
@@ -106,8 +106,14 @@ namespace Semmle.Extraction.CIL.Entities
                 if (t is ByRefType brt)
                 {
                     t = brt.ElementType;
+                    var parameter = cx.Populate(new Parameter(cx, parameterizable, i++, t));
+                    yield return parameter;
+                    yield return Tuples.cil_type_annotation(parameter, TypeAnnotation.Ref);
+                }
+                else
+                {
+                    yield return cx.Populate(new Parameter(cx, parameterizable, i++, t));
                 }
-                yield return cx.Populate(new Parameter(cx, parameterizable, i++, t));
             }
         }
 
@@ -122,6 +128,7 @@ namespace Semmle.Extraction.CIL.Entities
             if (t is ByRefType brt)
             {
                 t = brt.ElementType;
+                yield return Tuples.cil_type_annotation(this, TypeAnnotation.Ref);
             }
             yield return Tuples.cil_method(this, name, declaringType, t);
         }
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs
index 879b53da077..5fb22b40409 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/Property.cs
@@ -65,6 +65,7 @@ namespace Semmle.Extraction.CIL.Entities
                 if (t is ByRefType brt)
                 {
                     t = brt.ElementType;
+                    yield return Tuples.cil_type_annotation(this, TypeAnnotation.Ref);
                 }
                 yield return Tuples.cil_property(this, type, name, t);
 
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeAnnotation.cs b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeAnnotation.cs
new file mode 100644
index 00000000000..fe005326b95
--- /dev/null
+++ b/csharp/extractor/Semmle.Extraction.CIL/Entities/TypeAnnotation.cs
@@ -0,0 +1,11 @@
+using System;
+
+namespace Semmle.Extraction.CIL.Entities
+{
+    [Flags]
+    public enum TypeAnnotation
+    {
+        None = 0,
+        Ref = 32
+    }
+}
diff --git a/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs b/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs
index cf625ccfc42..0ae92386c3e 100644
--- a/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs
+++ b/csharp/extractor/Semmle.Extraction.CIL/Tuples.cs
@@ -197,6 +197,9 @@ namespace Semmle.Extraction.CIL
         internal static Tuple cil_custom_modifiers(ICustomModifierReceiver receiver, Type modifier, bool isRequired) =>
             new Tuple("cil_custom_modifiers", receiver, modifier, isRequired ? 1 : 0);
 
+        internal static Tuple cil_type_annotation(IEntity receiver, TypeAnnotation annotation) =>
+            new Tuple("cil_type_annotation", receiver, (int)annotation);
+
         internal static Tuple containerparent(Folder parent, IFileOrFolder child) =>
             new Tuple("containerparent", parent, child);
 
diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme b/csharp/ql/src/semmlecode.csharp.dbscheme
index 712940d4218..2fb07f0b8c6 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme
@@ -1753,6 +1753,7 @@ cil_field(
 @cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
 @cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
 @cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
 
 #keyset[parameterizable, index]
 cil_parameter(
@@ -1773,6 +1774,10 @@ cil_custom_modifiers(
   int modifier: @cil_type ref,
   int kind: int ref); // modreq: 1, modopt: 0
 
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
 cil_getter(unique int prop: @cil_property ref,
   int method: @cil_method ref);
 
diff --git a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected
index 485eb118b15..0e26dc0592c 100644
--- a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected
+++ b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected
@@ -1,29 +1,29 @@
 fnptr
-| file://:0:0:0:0 | delegate* managed<!0,Int32> | 1 | file://:0:0:0:0 | Int32 | 0 |
-| file://:0:0:0:0 | delegate* managed<A,B> | 1 | file://:0:0:0:0 | B | 0 |
-| file://:0:0:0:0 | delegate* managed<B,A> | 1 | file://:0:0:0:0 | A | 0 |
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 3 | file://:0:0:0:0 | Int32 | 0 |
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 2 | file://:0:0:0:0 | Int32 | 0 |
-| file://:0:0:0:0 | delegate* managed<Int32*,Void*> | 1 | file://:0:0:0:0 | Void* | 0 |
-| file://:0:0:0:0 | delegate* managed<Int32> | 0 | file://:0:0:0:0 | Int32 | 0 |
-| file://:0:0:0:0 | delegate* managed<Void*,Int32*> | 1 | file://:0:0:0:0 | Int32* | 0 |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 3 | file://:0:0:0:0 | void | 2 |
+| delegate* managed<!0,Int32> | 1 | Int32 | 0 |
+| delegate* managed<A,B> | 1 | B | 0 |
+| delegate* managed<B,A> | 1 | A | 0 |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 3 | Int32& | 0 |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 2 | Int32 | 0 |
+| delegate* managed<Int32*,Void*> | 1 | Void* | 0 |
+| delegate* managed<Int32> | 0 | Int32 | 0 |
+| delegate* managed<Void*,Int32*> | 1 | Int32* | 0 |
+| delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 3 | void | 2 |
 params
-| file://:0:0:0:0 | delegate* managed<!0,Int32> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<!0,Int32> | fnptr.dll:0:0:0:0 | !0 |
-| file://:0:0:0:0 | delegate* managed<A,B> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<A,B> | file://:0:0:0:0 | A |
-| file://:0:0:0:0 | delegate* managed<B,A> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<B,A> | file://:0:0:0:0 | B |
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | file://:0:0:0:0 | Int32 |
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | file://:0:0:0:0 | Object |
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 2 | file://:0:0:0:0 | Parameter 2 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | file://:0:0:0:0 | Int32 |
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | file://:0:0:0:0 | Int32 |
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | file://:0:0:0:0 | Object |
-| file://:0:0:0:0 | delegate* managed<Int32*,Void*> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Int32*,Void*> | file://:0:0:0:0 | Int32* |
-| file://:0:0:0:0 | delegate* managed<Void*,Int32*> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* managed<Void*,Int32*> | file://:0:0:0:0 | Void* |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 0 | file://:0:0:0:0 | Parameter 0 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | file://:0:0:0:0 | Int32 |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 1 | file://:0:0:0:0 | Parameter 1 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | file://:0:0:0:0 | Object |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 2 | file://:0:0:0:0 | Parameter 2 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | fnptr.dll:0:0:0:0 | !0 |
+| delegate* managed<!0,Int32> | 0 | Parameter 0 of delegate* managed<!0,Int32> | !0 |
+| delegate* managed<A,B> | 0 | Parameter 0 of delegate* managed<A,B> | A |
+| delegate* managed<B,A> | 0 | Parameter 0 of delegate* managed<B,A> | B |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 0 | Parameter 0 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | Int32& |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 1 | Parameter 1 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | Object& |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | 2 | Parameter 2 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | Int32& |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 0 | Parameter 0 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | Int32& |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 1 | Parameter 1 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | Object& |
+| delegate* managed<Int32*,Void*> | 0 | Parameter 0 of delegate* managed<Int32*,Void*> | Int32* |
+| delegate* managed<Void*,Int32*> | 0 | Parameter 0 of delegate* managed<Void*,Int32*> | Void* |
+| delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 0 | Parameter 0 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | Int32& |
+| delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 1 | Parameter 1 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | Object& |
+| delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 2 | Parameter 2 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | !0 |
 modifiers
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | System.Runtime.InteropServices.InAttribute | modreq |
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | System.Runtime.InteropServices.OutAttribute | modreq |
-| file://:0:0:0:0 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | System.Runtime.InteropServices.OutAttribute | modreq |
-| file://:0:0:0:0 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | System.Runtime.InteropServices.OutAttribute | modreq |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | System.Runtime.InteropServices.InAttribute | modreq |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32& modreq(InAttribute),Int32&> | System.Runtime.InteropServices.OutAttribute | modreq |
+| delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | System.Runtime.InteropServices.OutAttribute | modreq |
+| delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | System.Runtime.InteropServices.OutAttribute | modreq |
diff --git a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql
index dc68fc951f2..9dbeb467e24 100644
--- a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql
+++ b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql
@@ -4,18 +4,28 @@ import semmle.code.cil.Type
 bindingset[kind]
 private string getKind(int kind) { if kind = 1 then result = "modreq" else result = "modopt" }
 
-query predicate fnptr(FunctionPointerType fn, int paramCount, Type returnType, int callingConvention) {
-  paramCount = fn.getNumberOfParameters() and
-  returnType = fn.getReturnType() and
-  callingConvention = fn.getCallingConvention()
+private string getAnnotatedType(Type t, Element e) {
+  cil_type_annotation(e, 32) and result = t.toString() + "&"
+  or
+  not cil_type_annotation(e, 32) and result = t.toString()
 }
 
-query predicate params(FunctionPointerType fn, int i, Parameter p, Type t) {
-  fn.getParameter(i) = p and p.getType() = t
+query predicate fnptr(string fnptr, int paramCount, string returnType, int callingConvention) {
+  exists(FunctionPointerType fn | fnptr = fn.toString() |
+    paramCount = fn.getNumberOfParameters() and
+    returnType = getAnnotatedType(fn.getReturnType(), fn) and
+    callingConvention = fn.getCallingConvention()
+  )
 }
 
-query predicate modifiers(FunctionPointerType fn, string modifier, string sKind) {
-  exists(Type modType, int kind |
+query predicate params(string fnptr, int i, string param, string t) {
+  exists(FunctionPointerType fn, Parameter p | fnptr = fn.toString() and param = p.toString() |
+    fn.getParameter(i) = p and t = getAnnotatedType(p.getType(), p)
+  )
+}
+
+query predicate modifiers(string fnptr, string modifier, string sKind) {
+  exists(Type modType, int kind, FunctionPointerType fn | fnptr = fn.toString() |
     cil_custom_modifiers(fn, modType, kind) and
     modType.getQualifiedName() = modifier and
     sKind = getKind(kind)
diff --git a/csharp/ql/test/library-tests/cil/typeAnnotations/Program.cs b/csharp/ql/test/library-tests/cil/typeAnnotations/Program.cs
new file mode 100644
index 00000000000..ea38187bdec
--- /dev/null
+++ b/csharp/ql/test/library-tests/cil/typeAnnotations/Program.cs
@@ -0,0 +1,10 @@
+// semmle-extractor-options: --cil
+
+using System;
+
+class Test
+{
+    static void Main(string[] args)
+    {
+    }
+}
diff --git a/csharp/ql/test/library-tests/cil/typeAnnotations/typeAnnotations.expected b/csharp/ql/test/library-tests/cil/typeAnnotations/typeAnnotations.expected
new file mode 100644
index 00000000000..c2a2d3a76fe
--- /dev/null
+++ b/csharp/ql/test/library-tests/cil/typeAnnotations/typeAnnotations.expected
@@ -0,0 +1,1747 @@
+| Add | method | 32 |
+| AddByteOffset | method | 32 |
+| As | method | 32 |
+| AsMutable | method | 32 |
+| AsRef | method | 32 |
+| GetNonNullPinnableReference | method | 32 |
+| GetPinnableReference | method | 32 |
+| GetRawArrayData | method | 32 |
+| GetRawArrayGeometry | method | 32 |
+| GetRawData | method | 32 |
+| GetRawStringData | method | 32 |
+| GetRawSzArrayData | method | 32 |
+| GetReference | method | 32 |
+| Local variable 0 of method <GetUpper>g__SoftwareFallback\|66_0 | local | 32 |
+| Local variable 0 of method Add | local | 32 |
+| Local variable 0 of method Clear | local | 32 |
+| Local variable 0 of method EnumCalendarInfoCallback | local | 32 |
+| Local variable 0 of method GetElement | local | 32 |
+| Local variable 0 of method GetHashCode | local | 32 |
+| Local variable 0 of method GetPinnableReference | local | 32 |
+| Local variable 0 of method GetUpper | local | 32 |
+| Local variable 0 of method GetValue | local | 32 |
+| Local variable 0 of method LinkTimer | local | 32 |
+| Local variable 0 of method Memmove | local | 32 |
+| Local variable 0 of method MoveNext | local | 32 |
+| Local variable 0 of method Multiply | local | 32 |
+| Local variable 0 of method RemoveIndex | local | 32 |
+| Local variable 0 of method Reverse | local | 32 |
+| Local variable 0 of method RunOrScheduleAction | local | 32 |
+| Local variable 0 of method ToUInt64 | local | 32 |
+| Local variable 0 of method TryDecodeFromUtf16 | local | 32 |
+| Local variable 0 of method TryParseExactD | local | 32 |
+| Local variable 0 of method TryParseExactN | local | 32 |
+| Local variable 0 of method ValueToHexString | local | 32 |
+| Local variable 0 of method ValueToString | local | 32 |
+| Local variable 1 of method .ctor | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|32_0 | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|33_0 | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|34_0 | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|35_0 | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|36_0 | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|37_0 | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|38_0 | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|39_0 | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|40_0 | local | 32 |
+| Local variable 1 of method <Create>g__SoftwareFallback\|41_0 | local | 32 |
+| Local variable 1 of method <GetCalendarInfo>b__32_0 | local | 32 |
+| Local variable 1 of method <GetDisplayName>b__113_0 | local | 32 |
+| Local variable 1 of method <WithUpper>g__SoftwareFallback\|67_0 | local | 32 |
+| Local variable 1 of method Add | local | 32 |
+| Local variable 1 of method Append | local | 32 |
+| Local variable 1 of method AppendHelper | local | 32 |
+| Local variable 1 of method AppendJoin | local | 32 |
+| Local variable 1 of method CompareString | local | 32 |
+| Local variable 1 of method CompareStringOrdinalIgnoreCase | local | 32 |
+| Local variable 1 of method Convert | local | 32 |
+| Local variable 1 of method Create | local | 32 |
+| Local variable 1 of method CreateActivityPathGuid | local | 32 |
+| Local variable 1 of method EndsWith | local | 32 |
+| Local variable 1 of method FillStringChecked | local | 32 |
+| Local variable 1 of method FromBase64CharArray | local | 32 |
+| Local variable 1 of method FromBase64String | local | 32 |
+| Local variable 1 of method FromUtf16 | local | 32 |
+| Local variable 1 of method GetAscii | local | 32 |
+| Local variable 1 of method GetByteCount | local | 32 |
+| Local variable 1 of method GetByteCountWithFallback | local | 32 |
+| Local variable 1 of method GetBytes | local | 32 |
+| Local variable 1 of method GetBytesFromEncoding | local | 32 |
+| Local variable 1 of method GetBytesWithFallback | local | 32 |
+| Local variable 1 of method GetCharCount | local | 32 |
+| Local variable 1 of method GetCharCountWithFallback | local | 32 |
+| Local variable 1 of method GetChars | local | 32 |
+| Local variable 1 of method GetCharsWithFallback | local | 32 |
+| Local variable 1 of method GetEnvironmentVariable | local | 32 |
+| Local variable 1 of method GetHashCode | local | 32 |
+| Local variable 1 of method GetNonRandomizedHashCode | local | 32 |
+| Local variable 1 of method GetString | local | 32 |
+| Local variable 1 of method GetUnicode | local | 32 |
+| Local variable 1 of method IndexOf | local | 32 |
+| Local variable 1 of method IndexOfCore | local | 32 |
+| Local variable 1 of method IndexOfOrdinalHelper | local | 32 |
+| Local variable 1 of method IndexOfOrdinalIgnoreCaseHelper | local | 32 |
+| Local variable 1 of method Insert | local | 32 |
+| Local variable 1 of method InternalCopy | local | 32 |
+| Local variable 1 of method InvariantIndexOf | local | 32 |
+| Local variable 1 of method InvariantLastIndexOf | local | 32 |
+| Local variable 1 of method IsAscii | local | 32 |
+| Local variable 1 of method IsSortable | local | 32 |
+| Local variable 1 of method Join | local | 32 |
+| Local variable 1 of method LastIndexOf | local | 32 |
+| Local variable 1 of method MatchChars | local | 32 |
+| Local variable 1 of method Memmove | local | 32 |
+| Local variable 1 of method Pow10 | local | 32 |
+| Local variable 1 of method ReplaceAllInChunk | local | 32 |
+| Local variable 1 of method Reverse | local | 32 |
+| Local variable 1 of method StartsWith | local | 32 |
+| Local variable 1 of method TZif_ToInt32 | local | 32 |
+| Local variable 1 of method TZif_ToInt64 | local | 32 |
+| Local variable 1 of method ThreadSafeCopy | local | 32 |
+| Local variable 1 of method ToLowerAsciiInvariant | local | 32 |
+| Local variable 1 of method ToUpperAsciiInvariant | local | 32 |
+| Local variable 1 of method ToUtf16 | local | 32 |
+| Local variable 1 of method Trim | local | 32 |
+| Local variable 1 of method TrimEnd | local | 32 |
+| Local variable 1 of method TrimStart | local | 32 |
+| Local variable 1 of method TryDecodeFromUtf16 | local | 32 |
+| Local variable 1 of method TryStringToNumber | local | 32 |
+| Local variable 1 of method WaitMultipleIgnoringSyncContext | local | 32 |
+| Local variable 1 of method WithElement | local | 32 |
+| Local variable 1 of method WithUpper | local | 32 |
+| Local variable 1 of method WriteEvent | local | 32 |
+| Local variable 1 of method WriteImpl | local | 32 |
+| Local variable 1 of method WriteMultiMerge | local | 32 |
+| Local variable 1 of method WriteNative | local | 32 |
+| Local variable 1 of method get_Item | local | 32 |
+| Local variable 2 of method .ctor | local | 32 |
+| Local variable 2 of method ChangeCaseCommon | local | 32 |
+| Local variable 2 of method CompareOrdinalHelper | local | 32 |
+| Local variable 2 of method CompareOrdinalIgnoreCase | local | 32 |
+| Local variable 2 of method CopyTo | local | 32 |
+| Local variable 2 of method CreateSortKey | local | 32 |
+| Local variable 2 of method Ctor | local | 32 |
+| Local variable 2 of method DoAnsiConversion | local | 32 |
+| Local variable 2 of method EndsWithOrdinalHelper | local | 32 |
+| Local variable 2 of method EndsWithOrdinalIgnoreCaseHelper | local | 32 |
+| Local variable 2 of method EqualStartingCharacterCount | local | 32 |
+| Local variable 2 of method GetByteCount | local | 32 |
+| Local variable 2 of method GetBytes | local | 32 |
+| Local variable 2 of method GetChars | local | 32 |
+| Local variable 2 of method GetValue | local | 32 |
+| Local variable 2 of method IndexOfCore | local | 32 |
+| Local variable 2 of method IndexOfOrdinalCore | local | 32 |
+| Local variable 2 of method Insert | local | 32 |
+| Local variable 2 of method InternalGetNumericValue | local | 32 |
+| Local variable 2 of method InternalSubString | local | 32 |
+| Local variable 2 of method InvariantCreateSortKey | local | 32 |
+| Local variable 2 of method LastIndexOfCore | local | 32 |
+| Local variable 2 of method LastIndexOfOrdinalCore | local | 32 |
+| Local variable 2 of method Multiply | local | 32 |
+| Local variable 2 of method ReadNative | local | 32 |
+| Local variable 2 of method SetValue | local | 32 |
+| Local variable 2 of method StartsWithOrdinalHelper | local | 32 |
+| Local variable 2 of method StartsWithOrdinalIgnoreCaseHelper | local | 32 |
+| Local variable 2 of method StringToAnsiString | local | 32 |
+| Local variable 2 of method TryInt32ToHexStr | local | 32 |
+| Local variable 2 of method TryInt64ToHexStr | local | 32 |
+| Local variable 2 of method TryJoin | local | 32 |
+| Local variable 2 of method TryNegativeInt32ToDecStr | local | 32 |
+| Local variable 2 of method TryUInt32ToDecStr | local | 32 |
+| Local variable 2 of method TryUInt64ToDecStr | local | 32 |
+| Local variable 2 of method Write | local | 32 |
+| Local variable 3 of method AddCustomAttributes | local | 32 |
+| Local variable 3 of method CompareOrdinalIgnoreCase | local | 32 |
+| Local variable 3 of method CompareString | local | 32 |
+| Local variable 3 of method CompareStringOrdinalIgnoreCase | local | 32 |
+| Local variable 3 of method Convert | local | 32 |
+| Local variable 3 of method Copy | local | 32 |
+| Local variable 3 of method CreateInstance | local | 32 |
+| Local variable 3 of method CreateStringFromEncoding | local | 32 |
+| Local variable 3 of method Ctor | local | 32 |
+| Local variable 3 of method EndsWith | local | 32 |
+| Local variable 3 of method Fill | local | 32 |
+| Local variable 3 of method FillStringChecked | local | 32 |
+| Local variable 3 of method FindSection | local | 32 |
+| Local variable 3 of method FromUtf16 | local | 32 |
+| Local variable 3 of method GetBytes | local | 32 |
+| Local variable 3 of method GetBytesWithFallback | local | 32 |
+| Local variable 3 of method GetChars | local | 32 |
+| Local variable 3 of method GetCharsWithFallback | local | 32 |
+| Local variable 3 of method IndexOfCharArray | local | 32 |
+| Local variable 3 of method IndexOfCore | local | 32 |
+| Local variable 3 of method IndexOfOrdinalHelper | local | 32 |
+| Local variable 3 of method IndexOfOrdinalIgnoreCaseHelper | local | 32 |
+| Local variable 3 of method Int32ToHexStr | local | 32 |
+| Local variable 3 of method Int64ToHexStr | local | 32 |
+| Local variable 3 of method InternalLoad | local | 32 |
+| Local variable 3 of method InvariantIndexOf | local | 32 |
+| Local variable 3 of method InvariantLastIndexOf | local | 32 |
+| Local variable 3 of method JoinInternal | local | 32 |
+| Local variable 3 of method LastIndexOfCharArray | local | 32 |
+| Local variable 3 of method NegativeInt32ToDecStr | local | 32 |
+| Local variable 3 of method Pin | local | 32 |
+| Local variable 3 of method Populate | local | 32 |
+| Local variable 3 of method Pow10 | local | 32 |
+| Local variable 3 of method Replace | local | 32 |
+| Local variable 3 of method Resize | local | 32 |
+| Local variable 3 of method StartsWith | local | 32 |
+| Local variable 3 of method StringToCoTaskMemUni | local | 32 |
+| Local variable 3 of method StringToHGlobalUni | local | 32 |
+| Local variable 3 of method ThreadSafeCopy | local | 32 |
+| Local variable 3 of method ToBase64String | local | 32 |
+| Local variable 3 of method ToCharArray | local | 32 |
+| Local variable 3 of method ToString | local | 32 |
+| Local variable 3 of method ToUtf16 | local | 32 |
+| Local variable 3 of method TryNegativeInt64ToDecStr | local | 32 |
+| Local variable 3 of method TryToBase64Chars | local | 32 |
+| Local variable 3 of method UInt32ToDecStr | local | 32 |
+| Local variable 3 of method UInt64ToDecStr | local | 32 |
+| Local variable 3 of method Write | local | 32 |
+| Local variable 3 of method WriteEvent | local | 32 |
+| Local variable 3 of method WriteStdoutAnsiString | local | 32 |
+| Local variable 3 of method get_Item | local | 32 |
+| Local variable 4 of method .ctor | local | 32 |
+| Local variable 4 of method AddDivisor | local | 32 |
+| Local variable 4 of method AddNullTerminatedString | local | 32 |
+| Local variable 4 of method ChangeCaseCommon | local | 32 |
+| Local variable 4 of method CompareOrdinalHelper | local | 32 |
+| Local variable 4 of method Copy | local | 32 |
+| Local variable 4 of method EndsWithOrdinalHelper | local | 32 |
+| Local variable 4 of method EndsWithOrdinalIgnoreCaseHelper | local | 32 |
+| Local variable 4 of method EqualStartingCharacterCount | local | 32 |
+| Local variable 4 of method EscapeString | local | 32 |
+| Local variable 4 of method FormatPrintF | local | 32 |
+| Local variable 4 of method GetBytes | local | 32 |
+| Local variable 4 of method GetChars | local | 32 |
+| Local variable 4 of method GetMessage | local | 32 |
+| Local variable 4 of method GetUnicodeCore | local | 32 |
+| Local variable 4 of method IndexOfCore | local | 32 |
+| Local variable 4 of method IndexOfOrdinalCore | local | 32 |
+| Local variable 4 of method InternalLoad | local | 32 |
+| Local variable 4 of method InternalSubString | local | 32 |
+| Local variable 4 of method JoinInternal | local | 32 |
+| Local variable 4 of method LastIndexOfCore | local | 32 |
+| Local variable 4 of method MakeRoom | local | 32 |
+| Local variable 4 of method NegativeInt64ToDecStr | local | 32 |
+| Local variable 4 of method PadLeft | local | 32 |
+| Local variable 4 of method PadRight | local | 32 |
+| Local variable 4 of method Remove | local | 32 |
+| Local variable 4 of method StartsWithOrdinalHelper | local | 32 |
+| Local variable 4 of method StartsWithOrdinalIgnoreCaseHelper | local | 32 |
+| Local variable 4 of method ToCharArray | local | 32 |
+| Local variable 4 of method TryInsert | local | 32 |
+| Local variable 4 of method Write | local | 32 |
+| Local variable 4 of method WriteCore | local | 32 |
+| Local variable 4 of method WriteEvent | local | 32 |
+| Local variable 5 of method Append | local | 32 |
+| Local variable 5 of method ConvertToNative | local | 32 |
+| Local variable 5 of method CreateInstance | local | 32 |
+| Local variable 5 of method GetAttributeUsage | local | 32 |
+| Local variable 5 of method GetBytes | local | 32 |
+| Local variable 5 of method GetBytesWithFallback | local | 32 |
+| Local variable 5 of method GetCharsWithFallback | local | 32 |
+| Local variable 5 of method GetCwd | local | 32 |
+| Local variable 5 of method GetHomeDirectory | local | 32 |
+| Local variable 5 of method Insert | local | 32 |
+| Local variable 5 of method JoinInternal | local | 32 |
+| Local variable 5 of method Pow10 | local | 32 |
+| Local variable 5 of method Read | local | 32 |
+| Local variable 5 of method ReadArray | local | 32 |
+| Local variable 5 of method ReadCore | local | 32 |
+| Local variable 5 of method Replace | local | 32 |
+| Local variable 5 of method StringToCoTaskMemUTF8 | local | 32 |
+| Local variable 5 of method StringToHGlobalUTF8 | local | 32 |
+| Local variable 5 of method SubtractDivisor | local | 32 |
+| Local variable 5 of method ToBase64String | local | 32 |
+| Local variable 5 of method ToLowerAsciiInvariant | local | 32 |
+| Local variable 5 of method ToUpperAsciiInvariant | local | 32 |
+| Local variable 5 of method TryToBase64Chars | local | 32 |
+| Local variable 5 of method WriteArray | local | 32 |
+| Local variable 5 of method WriteEvent | local | 32 |
+| Local variable 5 of method get_Item | local | 32 |
+| Local variable 5 of method get_UserName | local | 32 |
+| Local variable 6 of method .ctor | local | 32 |
+| Local variable 6 of method Clear | local | 32 |
+| Local variable 6 of method ConvertToBase64Array | local | 32 |
+| Local variable 6 of method GenerateMetadataForProperty | local | 32 |
+| Local variable 6 of method GetAsciiCore | local | 32 |
+| Local variable 6 of method IndexOfOrdinalCore | local | 32 |
+| Local variable 6 of method InternalCopy | local | 32 |
+| Local variable 6 of method JoinInternal | local | 32 |
+| Local variable 6 of method PadRight | local | 32 |
+| Local variable 6 of method Remove | local | 32 |
+| Local variable 6 of method Replace | local | 32 |
+| Local variable 6 of method Resize | local | 32 |
+| Local variable 6 of method SetConstantValue | local | 32 |
+| Local variable 6 of method ToBase64CharArray | local | 32 |
+| Local variable 6 of method TryDecodeFromUtf16 | local | 32 |
+| Local variable 6 of method TryFormat | local | 32 |
+| Local variable 6 of method Write | local | 32 |
+| Local variable 7 of method .ctor | local | 32 |
+| Local variable 7 of method Append | local | 32 |
+| Local variable 7 of method GenerateMetadata | local | 32 |
+| Local variable 7 of method GetBytesWithFallback | local | 32 |
+| Local variable 7 of method GetCharsWithFallback | local | 32 |
+| Local variable 7 of method GetHashCodeOfStringCore | local | 32 |
+| Local variable 7 of method Insert | local | 32 |
+| Local variable 7 of method JoinInternal | local | 32 |
+| Local variable 7 of method PadLeft | local | 32 |
+| Local variable 7 of method Populate | local | 32 |
+| Local variable 7 of method Pow10 | local | 32 |
+| Local variable 7 of method Remove | local | 32 |
+| Local variable 7 of method Resize | local | 32 |
+| Local variable 7 of method WriteEventString | local | 32 |
+| Local variable 7 of method get_Item | local | 32 |
+| Local variable 8 of method JoinInternal | local | 32 |
+| Local variable 8 of method Pow10 | local | 32 |
+| Local variable 8 of method Replace | local | 32 |
+| Local variable 8 of method SetConstantValue | local | 32 |
+| Local variable 8 of method ToBase64CharArray | local | 32 |
+| Local variable 8 of method ToString | local | 32 |
+| Local variable 8 of method TryInsert | local | 32 |
+| Local variable 8 of method Write | local | 32 |
+| Local variable 9 of method GenerateMetadataForProperty | local | 32 |
+| Local variable 9 of method GetHashCodeOfStringCore | local | 32 |
+| Local variable 9 of method Insert | local | 32 |
+| Local variable 9 of method JoinInternal | local | 32 |
+| Local variable 9 of method TrimExcess | local | 32 |
+| Local variable 9 of method get_Item | local | 32 |
+| Local variable 10 of method .ctor | local | 32 |
+| Local variable 10 of method FormatFixed | local | 32 |
+| Local variable 10 of method IntToString | local | 32 |
+| Local variable 10 of method JoinInternal | local | 32 |
+| Local variable 10 of method LongToString | local | 32 |
+| Local variable 10 of method ReplaceAllInChunk | local | 32 |
+| Local variable 11 of method GenerateMetadata | local | 32 |
+| Local variable 11 of method GetHashCodeOfStringCore | local | 32 |
+| Local variable 11 of method InternalReadChars | local | 32 |
+| Local variable 11 of method Resize | local | 32 |
+| Local variable 11 of method get_Item | local | 32 |
+| Local variable 12 of method JoinCore | local | 32 |
+| Local variable 13 of method .ctor | local | 32 |
+| Local variable 13 of method ChangeCaseCommon | local | 32 |
+| Local variable 13 of method get_Item | local | 32 |
+| Local variable 14 of method .ctor | local | 32 |
+| Local variable 14 of method Resize | local | 32 |
+| Local variable 15 of method get_Item | local | 32 |
+| Local variable 16 of method .ctor | local | 32 |
+| Local variable 17 of method get_Item | local | 32 |
+| Local variable 18 of method .ctor | local | 32 |
+| Local variable 19 of method .ctor | local | 32 |
+| Local variable 19 of method NumberToStringFormat | local | 32 |
+| Local variable 19 of method get_Item | local | 32 |
+| Local variable 22 of method .ctor | local | 32 |
+| Local variable 23 of method WriteEvent | local | 32 |
+| Local variable 24 of method WriteEvent | local | 32 |
+| Local variable 25 of method .ctor | local | 32 |
+| Local variable 25 of method WriteEvent | local | 32 |
+| Local variable 26 of method .ctor | local | 32 |
+| Local variable 26 of method WriteEvent | local | 32 |
+| Local variable 27 of method WriteEvent | local | 32 |
+| Local variable 28 of method .ctor | local | 32 |
+| Local variable 28 of method WriteEvent | local | 32 |
+| Local variable 29 of method WriteEvent | local | 32 |
+| Local variable 30 of method .ctor | local | 32 |
+| Local variable 30 of method WriteEvent | local | 32 |
+| Local variable 31 of method .ctor | local | 32 |
+| Local variable 31 of method NumberToStringFormat | local | 32 |
+| Local variable 33 of method .ctor | local | 32 |
+| Local variable 34 of method .ctor | local | 32 |
+| Local variable 34 of method WriteEvent | local | 32 |
+| Local variable 35 of method .ctor | local | 32 |
+| Local variable 37 of method .ctor | local | 32 |
+| Local variable 38 of method .ctor | local | 32 |
+| Local variable 39 of method .ctor | local | 32 |
+| Local variable 41 of method .ctor | local | 32 |
+| Local variable 43 of method .ctor | local | 32 |
+| Local variable 45 of method .ctor | local | 32 |
+| Local variable 47 of method .ctor | local | 32 |
+| Local variable 49 of method .ctor | local | 32 |
+| Max | method | 32 |
+| Min | method | 32 |
+| Parameter 0 of <Equals>g__SoftwareFallback\|10_0 | parameter | 32 |
+| Parameter 0 of <Equals>g__SoftwareFallback\|12_0 | parameter | 32 |
+| Parameter 0 of <UpdatedCachedCursorPosition>g__IncrementX\|115_1 | parameter | 32 |
+| Parameter 0 of <UpdatedCachedCursorPosition>g__IncrementY\|115_0 | parameter | 32 |
+| Parameter 0 of Abs | parameter | 32 |
+| Parameter 0 of AccumulateDecimalDigitsIntoBigInteger | parameter | 32 |
+| Parameter 0 of Add | parameter | 32 |
+| Parameter 0 of Add32To96 | parameter | 32 |
+| Parameter 0 of AddByteOffset | parameter | 32 |
+| Parameter 0 of AddCustomAttributes | parameter | 32 |
+| Parameter 0 of AddDivisor | parameter | 32 |
+| Parameter 0 of AddEventDescriptor | parameter | 32 |
+| Parameter 0 of AddExceptionsForCompletedTask | parameter | 32 |
+| Parameter 0 of AddNonLetter | parameter | 32 |
+| Parameter 0 of AddToCleanupList | parameter | 32 |
+| Parameter 0 of AdjustDaylightDeltaToExpectedRange | parameter | 32 |
+| Parameter 0 of AdjustHour | parameter | 32 |
+| Parameter 0 of AdjustTimeZoneToLocal | parameter | 32 |
+| Parameter 0 of AdjustTimeZoneToUniversal | parameter | 32 |
+| Parameter 0 of AppendParameters | parameter | 32 |
+| Parameter 0 of AreSame | parameter | 32 |
+| Parameter 0 of As | parameter | 32 |
+| Parameter 0 of AsMutable | parameter | 32 |
+| Parameter 0 of AsPointer | parameter | 32 |
+| Parameter 0 of AsRef | parameter | 32 |
+| Parameter 0 of AssembleFloatingPointBits | parameter | 32 |
+| Parameter 0 of BinarySearch | parameter | 32 |
+| Parameter 0 of Block | parameter | 32 |
+| Parameter 0 of ByteOffset | parameter | 32 |
+| Parameter 0 of CheckDefaultDateTime | parameter | 32 |
+| Parameter 0 of CheckForAvailableMemory | parameter | 32 |
+| Parameter 0 of CheckNewValue | parameter | 32 |
+| Parameter 0 of CheckVMForIOPacket | parameter | 32 |
+| Parameter 0 of ClearWithReferences | parameter | 32 |
+| Parameter 0 of ClearWithoutReferences | parameter | 32 |
+| Parameter 0 of Compare | parameter | 32 |
+| Parameter 0 of CompareExchange | parameter | 32 |
+| Parameter 0 of CompareOrdinalIgnoreCase | parameter | 32 |
+| Parameter 0 of CompareStringOrdinalIgnoreCase | parameter | 32 |
+| Parameter 0 of ComputeHash32 | parameter | 32 |
+| Parameter 0 of ComputeHash32OrdinalIgnoreCase | parameter | 32 |
+| Parameter 0 of ComputeHash32OrdinalIgnoreCaseSlow | parameter | 32 |
+| Parameter 0 of ConfigureFormatOS | parameter | 32 |
+| Parameter 0 of ConfigureFormatR | parameter | 32 |
+| Parameter 0 of Contains | parameter | 32 |
+| Parameter 0 of ConvertBigIntegerToFloatingPointBits | parameter | 32 |
+| Parameter 0 of CountSignificantBits | parameter | 32 |
+| Parameter 0 of CreateReadOnlySpan | parameter | 32 |
+| Parameter 0 of CreateSpan | parameter | 32 |
+| Parameter 0 of DateTimeOffsetTimeZonePostProcessing | parameter | 32 |
+| Parameter 0 of DebugCheckEvent | parameter | 32 |
+| Parameter 0 of DecAddSub | parameter | 32 |
+| Parameter 0 of DecDivMod1E9 | parameter | 32 |
+| Parameter 0 of DecimalToNumber | parameter | 32 |
+| Parameter 0 of Decode | parameter | 32 |
+| Parameter 0 of DecodePayload | parameter | 32 |
+| Parameter 0 of Decrement | parameter | 32 |
+| Parameter 0 of DestroyCleanupList | parameter | 32 |
+| Parameter 0 of DetermineTimeZoneAdjustments | parameter | 32 |
+| Parameter 0 of Div96By32 | parameter | 32 |
+| Parameter 0 of Div96By64 | parameter | 32 |
+| Parameter 0 of Div96ByConst | parameter | 32 |
+| Parameter 0 of Div128By96 | parameter | 32 |
+| Parameter 0 of DivRem | parameter | 32 |
+| Parameter 0 of EncodeObject | parameter | 32 |
+| Parameter 0 of EnsureInitialized | parameter | 32 |
+| Parameter 0 of EnsureInitializedCore | parameter | 32 |
+| Parameter 0 of EnsureLockInitialized | parameter | 32 |
+| Parameter 0 of EqualsOrdinalIgnoreCase | parameter | 32 |
+| Parameter 0 of EqualsOrdinalIgnoreCaseNonAscii | parameter | 32 |
+| Parameter 0 of Exchange | parameter | 32 |
+| Parameter 0 of ExchangeAdd | parameter | 32 |
+| Parameter 0 of FormatCurrency | parameter | 32 |
+| Parameter 0 of FormatDouble | parameter | 32 |
+| Parameter 0 of FormatExponent | parameter | 32 |
+| Parameter 0 of FormatFixed | parameter | 32 |
+| Parameter 0 of FormatGeneral | parameter | 32 |
+| Parameter 0 of FormatNumber | parameter | 32 |
+| Parameter 0 of FormatPercent | parameter | 32 |
+| Parameter 0 of FormatScientific | parameter | 32 |
+| Parameter 0 of FormatSingle | parameter | 32 |
+| Parameter 0 of GetAvailableThreads | parameter | 32 |
+| Parameter 0 of GetAvailableThreadsNative | parameter | 32 |
+| Parameter 0 of GetBytes | parameter | 32 |
+| Parameter 0 of GetCpuUtilization | parameter | 32 |
+| Parameter 0 of GetCurrentMethod | parameter | 32 |
+| Parameter 0 of GetDateOfDSN | parameter | 32 |
+| Parameter 0 of GetDateOfNDS | parameter | 32 |
+| Parameter 0 of GetDateOfNNDS | parameter | 32 |
+| Parameter 0 of GetDateTimeNow | parameter | 32 |
+| Parameter 0 of GetDateTimeParseException | parameter | 32 |
+| Parameter 0 of GetDayOfMN | parameter | 32 |
+| Parameter 0 of GetDayOfMNN | parameter | 32 |
+| Parameter 0 of GetDayOfNM | parameter | 32 |
+| Parameter 0 of GetDayOfNN | parameter | 32 |
+| Parameter 0 of GetDayOfNNN | parameter | 32 |
+| Parameter 0 of GetDayOfNNY | parameter | 32 |
+| Parameter 0 of GetDayOfYM | parameter | 32 |
+| Parameter 0 of GetDayOfYMN | parameter | 32 |
+| Parameter 0 of GetDayOfYN | parameter | 32 |
+| Parameter 0 of GetDayOfYNN | parameter | 32 |
+| Parameter 0 of GetDefaultLocaleName | parameter | 32 |
+| Parameter 0 of GetDefaultYear | parameter | 32 |
+| Parameter 0 of GetDirectoryEntryFullPath | parameter | 32 |
+| Parameter 0 of GetExecutingAssembly | parameter | 32 |
+| Parameter 0 of GetHashCode | parameter | 32 |
+| Parameter 0 of GetHebrewDayOfNM | parameter | 32 |
+| Parameter 0 of GetMaxThreads | parameter | 32 |
+| Parameter 0 of GetMaxThreadsNative | parameter | 32 |
+| Parameter 0 of GetMemoryInfo | parameter | 32 |
+| Parameter 0 of GetMinThreads | parameter | 32 |
+| Parameter 0 of GetMinThreadsNative | parameter | 32 |
+| Parameter 0 of GetNextIntroducedMethod | parameter | 32 |
+| Parameter 0 of GetObjectHandleOnStack | parameter | 32 |
+| Parameter 0 of GetQCallAssemblyOnStack | parameter | 32 |
+| Parameter 0 of GetQCallModuleOnStack | parameter | 32 |
+| Parameter 0 of GetQCallTypeHandleOnStack | parameter | 32 |
+| Parameter 0 of GetStackCrawlMarkHandle | parameter | 32 |
+| Parameter 0 of GetStringHandleOnStack | parameter | 32 |
+| Parameter 0 of GetSymbolOrDefault | parameter | 32 |
+| Parameter 0 of GetThreadDeserializationTracker | parameter | 32 |
+| Parameter 0 of GetTimeOfN | parameter | 32 |
+| Parameter 0 of GetTimeOfNN | parameter | 32 |
+| Parameter 0 of GetTimeOfNNN | parameter | 32 |
+| Parameter 0 of GetTimeZoneName | parameter | 32 |
+| Parameter 0 of GetWindowSize | parameter | 32 |
+| Parameter 0 of HandleTimeZone | parameter | 32 |
+| Parameter 0 of HeuristicDivide | parameter | 32 |
+| Parameter 0 of IncreaseScale | parameter | 32 |
+| Parameter 0 of IncreaseScale64 | parameter | 32 |
+| Parameter 0 of Increment | parameter | 32 |
+| Parameter 0 of IndexOf | parameter | 32 |
+| Parameter 0 of IndexOfAny | parameter | 32 |
+| Parameter 0 of InitBlockUnaligned | parameter | 32 |
+| Parameter 0 of Initialize | parameter | 32 |
+| Parameter 0 of InitializeVMTp | parameter | 32 |
+| Parameter 0 of Int64DivMod1E9 | parameter | 32 |
+| Parameter 0 of InternalGetCurrentMethod | parameter | 32 |
+| Parameter 0 of InternalRound | parameter | 32 |
+| Parameter 0 of IsAddressGreaterThan | parameter | 32 |
+| Parameter 0 of IsAddressLessThan | parameter | 32 |
+| Parameter 0 of IsUtf8ContinuationByte | parameter | 32 |
+| Parameter 0 of LastIndexOf | parameter | 32 |
+| Parameter 0 of LastIndexOfAny | parameter | 32 |
+| Parameter 0 of LoadUIntPtr | parameter | 32 |
+| Parameter 0 of LoadVector | parameter | 32 |
+| Parameter 0 of LoadVector128 | parameter | 32 |
+| Parameter 0 of LoadVector256 | parameter | 32 |
+| Parameter 0 of MatchAbbreviatedDayName | parameter | 32 |
+| Parameter 0 of MatchAbbreviatedMonthName | parameter | 32 |
+| Parameter 0 of MatchAbbreviatedTimeMark | parameter | 32 |
+| Parameter 0 of MatchDayName | parameter | 32 |
+| Parameter 0 of MatchEraName | parameter | 32 |
+| Parameter 0 of MatchHebrewDigits | parameter | 32 |
+| Parameter 0 of MatchMonthName | parameter | 32 |
+| Parameter 0 of MatchTimeMark | parameter | 32 |
+| Parameter 0 of MatchWord | parameter | 32 |
+| Parameter 0 of Max | parameter | 32 |
+| Parameter 0 of Memmove | parameter | 32 |
+| Parameter 0 of Min | parameter | 32 |
+| Parameter 0 of Multiply | parameter | 32 |
+| Parameter 0 of NarrowFourUtf16CharsToAsciiAndWriteToBuffer | parameter | 32 |
+| Parameter 0 of NarrowTwoUtf16CharsToAsciiAndWriteToBuffer | parameter | 32 |
+| Parameter 0 of NumberToDouble | parameter | 32 |
+| Parameter 0 of NumberToFloatingPointBits | parameter | 32 |
+| Parameter 0 of NumberToFloatingPointBitsSlow | parameter | 32 |
+| Parameter 0 of NumberToSingle | parameter | 32 |
+| Parameter 0 of NumberToString | parameter | 32 |
+| Parameter 0 of NumberToStringFormat | parameter | 32 |
+| Parameter 0 of OverflowUnscale | parameter | 32 |
+| Parameter 0 of ParseByFormat | parameter | 32 |
+| Parameter 0 of ParseDigits | parameter | 32 |
+| Parameter 0 of ParseExactDigits | parameter | 32 |
+| Parameter 0 of ParseExactLiteral | parameter | 32 |
+| Parameter 0 of ParseFraction | parameter | 32 |
+| Parameter 0 of ParseFractionExact | parameter | 32 |
+| Parameter 0 of ParseISO8601 | parameter | 32 |
+| Parameter 0 of ParseJapaneseEraStart | parameter | 32 |
+| Parameter 0 of ParseSign | parameter | 32 |
+| Parameter 0 of ParseTimeZone | parameter | 32 |
+| Parameter 0 of ParseTimeZoneOffset | parameter | 32 |
+| Parameter 0 of ProcessDateTimeSuffix | parameter | 32 |
+| Parameter 0 of ProcessTerminalState | parameter | 32 |
+| Parameter 0 of ProcessTerminal_D | parameter | 32 |
+| Parameter 0 of ProcessTerminal_DHMSF | parameter | 32 |
+| Parameter 0 of ProcessTerminal_HM | parameter | 32 |
+| Parameter 0 of ProcessTerminal_HMS_F_D | parameter | 32 |
+| Parameter 0 of ProcessTerminal_HM_S_D | parameter | 32 |
+| Parameter 0 of Read | parameter | 32 |
+| Parameter 0 of ReadUnaligned | parameter | 32 |
+| Parameter 0 of RefreshColors | parameter | 32 |
+| Parameter 0 of RemoveFirstArgIfRelatedActivityId | parameter | 32 |
+| Parameter 0 of Resize | parameter | 32 |
+| Parameter 0 of RhBulkMoveWithWriteBarrier | parameter | 32 |
+| Parameter 0 of RhZeroMemory | parameter | 32 |
+| Parameter 0 of Round | parameter | 32 |
+| Parameter 0 of RoundNumber | parameter | 32 |
+| Parameter 0 of SearchScale | parameter | 32 |
+| Parameter 0 of SequenceCompareTo | parameter | 32 |
+| Parameter 0 of SequenceEqual | parameter | 32 |
+| Parameter 0 of SetDateDMY | parameter | 32 |
+| Parameter 0 of SetDateMDY | parameter | 32 |
+| Parameter 0 of SetDateYDM | parameter | 32 |
+| Parameter 0 of SetDateYMD | parameter | 32 |
+| Parameter 0 of Sign | parameter | 32 |
+| Parameter 0 of Start | parameter | 32 |
+| Parameter 0 of SubtractDivisor | parameter | 32 |
+| Parameter 0 of TZif_GenerateAdjustmentRule | parameter | 32 |
+| Parameter 0 of TZif_GenerateAdjustmentRules | parameter | 32 |
+| Parameter 0 of TrimEventDescriptors | parameter | 32 |
+| Parameter 0 of Truncate | parameter | 32 |
+| Parameter 0 of TryAdjustYear | parameter | 32 |
+| Parameter 0 of TryDigitGenCounted | parameter | 32 |
+| Parameter 0 of TryDigitGenShortest | parameter | 32 |
+| Parameter 0 of TryFormatDecimalE | parameter | 32 |
+| Parameter 0 of TryFormatDecimalF | parameter | 32 |
+| Parameter 0 of TryFormatDecimalG | parameter | 32 |
+| Parameter 0 of TryFormatThrowFormatException | parameter | 32 |
+| Parameter 0 of TryGetCachedCursorPosition | parameter | 32 |
+| Parameter 0 of TryGetCursorPosition | parameter | 32 |
+| Parameter 0 of TryGetLocalTzFile | parameter | 32 |
+| Parameter 0 of TryNumberToDecimal | parameter | 32 |
+| Parameter 0 of TryNumberToInt32 | parameter | 32 |
+| Parameter 0 of TryNumberToInt64 | parameter | 32 |
+| Parameter 0 of TryNumberToUInt32 | parameter | 32 |
+| Parameter 0 of TryNumberToUInt64 | parameter | 32 |
+| Parameter 0 of TryParseHebrewNumber | parameter | 32 |
+| Parameter 0 of TryParseNumber | parameter | 32 |
+| Parameter 0 of TryParseThrowFormatException | parameter | 32 |
+| Parameter 0 of TryResolveStateMachineMethod | parameter | 32 |
+| Parameter 0 of TryRunCounted | parameter | 32 |
+| Parameter 0 of TryRunShortest | parameter | 32 |
+| Parameter 0 of UnalignedCountVector | parameter | 32 |
+| Parameter 0 of UnalignedCountVector128 | parameter | 32 |
+| Parameter 0 of UnalignedCountVectorFromEnd | parameter | 32 |
+| Parameter 0 of Unscale | parameter | 32 |
+| Parameter 0 of UpdateStringBuilder | parameter | 32 |
+| Parameter 0 of ValueAtReturn | parameter | 32 |
+| Parameter 0 of VarCyFromDec | parameter | 32 |
+| Parameter 0 of VarDecCmp | parameter | 32 |
+| Parameter 0 of VarDecCmpSub | parameter | 32 |
+| Parameter 0 of VarDecDiv | parameter | 32 |
+| Parameter 0 of VarDecMod | parameter | 32 |
+| Parameter 0 of VarDecModFull | parameter | 32 |
+| Parameter 0 of VarDecMul | parameter | 32 |
+| Parameter 0 of VarR4FromDec | parameter | 32 |
+| Parameter 0 of VarR8FromDec | parameter | 32 |
+| Parameter 0 of VerifyValidPunctuation | parameter | 32 |
+| Parameter 0 of VolatileRead | parameter | 32 |
+| Parameter 0 of VolatileWrite | parameter | 32 |
+| Parameter 0 of WidenFourAsciiBytesToUtf16AndWriteToBuffer | parameter | 32 |
+| Parameter 0 of Write | parameter | 32 |
+| Parameter 0 of WriteFirstUtf16CharAsUtf8ThreeByteSequence | parameter | 32 |
+| Parameter 0 of WriteNibble | parameter | 32 |
+| Parameter 0 of WriteThreeLowOrderBytes | parameter | 32 |
+| Parameter 0 of WriteTwoUtf16CharsAsTwoUtf8ThreeByteSequences | parameter | 32 |
+| Parameter 0 of WriteUnaligned | parameter | 32 |
+| Parameter 0 of _GetCurrentMethod | parameter | 32 |
+| Parameter 0 of _Memmove | parameter | 32 |
+| Parameter 1 of .ctor | parameter | 32 |
+| Parameter 1 of <SignalCompletion>b__21_0 | parameter | 32 |
+| Parameter 1 of AcquirePointer | parameter | 32 |
+| Parameter 1 of Add | parameter | 32 |
+| Parameter 1 of AddNonLetter | parameter | 32 |
+| Parameter 1 of AddSpecialInterface | parameter | 32 |
+| Parameter 1 of AddTitlecaseLetter | parameter | 32 |
+| Parameter 1 of AddToList | parameter | 32 |
+| Parameter 1 of AdjustDaylightDeltaToExpectedRange | parameter | 32 |
+| Parameter 1 of AdjustTimeMark | parameter | 32 |
+| Parameter 1 of AreSame | parameter | 32 |
+| Parameter 1 of AwaitOnCompleted | parameter | 32 |
+| Parameter 1 of AwaitUnsafeOnCompleted | parameter | 32 |
+| Parameter 1 of BeginInvoke | parameter | 32 |
+| Parameter 1 of Block | parameter | 32 |
+| Parameter 1 of ByteOffset | parameter | 32 |
+| Parameter 1 of ChangeCaseCommon | parameter | 32 |
+| Parameter 1 of CheckDefaultDateTime | parameter | 32 |
+| Parameter 1 of CheckForAvailableMemory | parameter | 32 |
+| Parameter 1 of CheckVMForIOPacket | parameter | 32 |
+| Parameter 1 of ClearManaged | parameter | 32 |
+| Parameter 1 of ClearNative | parameter | 32 |
+| Parameter 1 of Clone | parameter | 32 |
+| Parameter 1 of Compare | parameter | 32 |
+| Parameter 1 of ConfigureFormatOS | parameter | 32 |
+| Parameter 1 of ConfigureFormatR | parameter | 32 |
+| Parameter 1 of ConstructName | parameter | 32 |
+| Parameter 1 of ConvertBigIntegerToFloatingPointBits | parameter | 32 |
+| Parameter 1 of ConvertContentsToManaged | parameter | 32 |
+| Parameter 1 of ConvertContentsToNative | parameter | 32 |
+| Parameter 1 of ConvertGregorianToHijri | parameter | 32 |
+| Parameter 1 of ConvertSpaceToManaged | parameter | 32 |
+| Parameter 1 of ConvertSpaceToNative | parameter | 32 |
+| Parameter 1 of CopyRuntimeTypeHandles | parameter | 32 |
+| Parameter 1 of CountDecimalTrailingZeros | parameter | 32 |
+| Parameter 1 of CreateActivityPathGuid | parameter | 32 |
+| Parameter 1 of CreateAndGetBoundaries | parameter | 32 |
+| Parameter 1 of CreationOptionsFromContinuationOptions | parameter | 32 |
+| Parameter 1 of DangerousAddRef | parameter | 32 |
+| Parameter 1 of DecAddSub | parameter | 32 |
+| Parameter 1 of DecimalToNumber | parameter | 32 |
+| Parameter 1 of Decode | parameter | 32 |
+| Parameter 1 of DecodeFromUtf8 | parameter | 32 |
+| Parameter 1 of DecodeFromUtf16 | parameter | 32 |
+| Parameter 1 of DecodeLastFromUtf8 | parameter | 32 |
+| Parameter 1 of DecodeLastFromUtf16 | parameter | 32 |
+| Parameter 1 of Deconstruct | parameter | 32 |
+| Parameter 1 of Div96ByConst | parameter | 32 |
+| Parameter 1 of Div128By96 | parameter | 32 |
+| Parameter 1 of DivRem | parameter | 32 |
+| Parameter 1 of EatWhiteSpace | parameter | 32 |
+| Parameter 1 of Encode | parameter | 32 |
+| Parameter 1 of EncodeObject | parameter | 32 |
+| Parameter 1 of EncodeTags | parameter | 32 |
+| Parameter 1 of EndInvoke | parameter | 32 |
+| Parameter 1 of EnsureInitialized | parameter | 32 |
+| Parameter 1 of EnsureInitializedCore | parameter | 32 |
+| Parameter 1 of Enter | parameter | 32 |
+| Parameter 1 of EnumConnectionPoints | parameter | 32 |
+| Parameter 1 of EnumConnections | parameter | 32 |
+| Parameter 1 of EnumObjectParam | parameter | 32 |
+| Parameter 1 of EnumRunning | parameter | 32 |
+| Parameter 1 of EqualsOrdinalIgnoreCase | parameter | 32 |
+| Parameter 1 of EqualsOrdinalIgnoreCaseNonAscii | parameter | 32 |
+| Parameter 1 of EtwEnableCallBack | parameter | 32 |
+| Parameter 1 of EvaluateInternal | parameter | 32 |
+| Parameter 1 of EventActivityIdControl | parameter | 32 |
+| Parameter 1 of ExecuteWithThreadLocal | parameter | 32 |
+| Parameter 1 of ExpandPredefinedFormat | parameter | 32 |
+| Parameter 1 of ExtractFractionAndBiasedExponent | parameter | 32 |
+| Parameter 1 of FStat | parameter | 32 |
+| Parameter 1 of FilterCustomAttributeRecord | parameter | 32 |
+| Parameter 1 of FilterHelper | parameter | 32 |
+| Parameter 1 of FindAndParseNextNumber | parameter | 32 |
+| Parameter 1 of FindConnectionPoint | parameter | 32 |
+| Parameter 1 of FormatCurrency | parameter | 32 |
+| Parameter 1 of FormatFixed | parameter | 32 |
+| Parameter 1 of FormatGeneral | parameter | 32 |
+| Parameter 1 of FormatNumber | parameter | 32 |
+| Parameter 1 of FormatPercent | parameter | 32 |
+| Parameter 1 of FormatScientific | parameter | 32 |
+| Parameter 1 of GetAvailableThreads | parameter | 32 |
+| Parameter 1 of GetAvailableThreadsNative | parameter | 32 |
+| Parameter 1 of GetBindOptions | parameter | 32 |
+| Parameter 1 of GetBoolValue | parameter | 32 |
+| Parameter 1 of GetCachedSwitchValue | parameter | 32 |
+| Parameter 1 of GetCachedSwitchValueInternal | parameter | 32 |
+| Parameter 1 of GetClassID | parameter | 32 |
+| Parameter 1 of GetCodeInfo | parameter | 32 |
+| Parameter 1 of GetCombinedList | parameter | 32 |
+| Parameter 1 of GetConfigBoolValue | parameter | 32 |
+| Parameter 1 of GetConnectionInterface | parameter | 32 |
+| Parameter 1 of GetConnectionPointContainer | parameter | 32 |
+| Parameter 1 of GetContainingTypeLib | parameter | 32 |
+| Parameter 1 of GetCurFile | parameter | 32 |
+| Parameter 1 of GetCustData | parameter | 32 |
+| Parameter 1 of GetDateOfDSN | parameter | 32 |
+| Parameter 1 of GetDateOfNDS | parameter | 32 |
+| Parameter 1 of GetDateOfNNDS | parameter | 32 |
+| Parameter 1 of GetDatePart | parameter | 32 |
+| Parameter 1 of GetDateTimeNow | parameter | 32 |
+| Parameter 1 of GetDateTimeNowUtcOffsetFromUtc | parameter | 32 |
+| Parameter 1 of GetDayOfMN | parameter | 32 |
+| Parameter 1 of GetDayOfMNN | parameter | 32 |
+| Parameter 1 of GetDayOfNM | parameter | 32 |
+| Parameter 1 of GetDayOfNN | parameter | 32 |
+| Parameter 1 of GetDayOfNNN | parameter | 32 |
+| Parameter 1 of GetDayOfNNY | parameter | 32 |
+| Parameter 1 of GetDayOfYM | parameter | 32 |
+| Parameter 1 of GetDayOfYMN | parameter | 32 |
+| Parameter 1 of GetDayOfYN | parameter | 32 |
+| Parameter 1 of GetDayOfYNN | parameter | 32 |
+| Parameter 1 of GetDefaultYear | parameter | 32 |
+| Parameter 1 of GetDelegateTarget | parameter | 32 |
+| Parameter 1 of GetDynamicOrStaticVariables | parameter | 32 |
+| Parameter 1 of GetEnumData | parameter | 32 |
+| Parameter 1 of GetFloatingPointMaxDigitsAndPrecision | parameter | 32 |
+| Parameter 1 of GetGUID | parameter | 32 |
+| Parameter 1 of GetHebrewDayOfNM | parameter | 32 |
+| Parameter 1 of GetInterface | parameter | 32 |
+| Parameter 1 of GetJapaneseEraStartDate | parameter | 32 |
+| Parameter 1 of GetJitContext | parameter | 32 |
+| Parameter 1 of GetLibAttr | parameter | 32 |
+| Parameter 1 of GetLocalSignature | parameter | 32 |
+| Parameter 1 of GetLocaleName | parameter | 32 |
+| Parameter 1 of GetMarshalAs | parameter | 32 |
+| Parameter 1 of GetMaxThreads | parameter | 32 |
+| Parameter 1 of GetMaxThreadsNative | parameter | 32 |
+| Parameter 1 of GetMemberCache | parameter | 32 |
+| Parameter 1 of GetMemberList | parameter | 32 |
+| Parameter 1 of GetMemoryInfo | parameter | 32 |
+| Parameter 1 of GetMetadata | parameter | 32 |
+| Parameter 1 of GetMinThreads | parameter | 32 |
+| Parameter 1 of GetMinThreadsNative | parameter | 32 |
+| Parameter 1 of GetNeutralResourcesLanguage | parameter | 32 |
+| Parameter 1 of GetObjectStartLength | parameter | 32 |
+| Parameter 1 of GetPEKind | parameter | 32 |
+| Parameter 1 of GetPrimaryAndSecondary | parameter | 32 |
+| Parameter 1 of GetPropertyOrFieldData | parameter | 32 |
+| Parameter 1 of GetPwUidR | parameter | 32 |
+| Parameter 1 of GetRawArrayGeometry | parameter | 32 |
+| Parameter 1 of GetRegularToken | parameter | 32 |
+| Parameter 1 of GetRunningObjectTable | parameter | 32 |
+| Parameter 1 of GetScopeProps | parameter | 32 |
+| Parameter 1 of GetSizeMax | parameter | 32 |
+| Parameter 1 of GetSortHandle | parameter | 32 |
+| Parameter 1 of GetStackTracesDeepCopy | parameter | 32 |
+| Parameter 1 of GetStateMachineBox | parameter | 32 |
+| Parameter 1 of GetTimeOfN | parameter | 32 |
+| Parameter 1 of GetTimeOfNN | parameter | 32 |
+| Parameter 1 of GetTimeOfNNN | parameter | 32 |
+| Parameter 1 of GetTypeAttr | parameter | 32 |
+| Parameter 1 of GetTypeComp | parameter | 32 |
+| Parameter 1 of GetTypeFlags | parameter | 32 |
+| Parameter 1 of GetTypeInfoOfGuid | parameter | 32 |
+| Parameter 1 of GetTypeKind | parameter | 32 |
+| Parameter 1 of GetUtf16SurrogatesFromSupplementaryPlaneScalar | parameter | 32 |
+| Parameter 1 of GetVersion | parameter | 32 |
+| Parameter 1 of GetWindowSize | parameter | 32 |
+| Parameter 1 of GrowTable | parameter | 32 |
+| Parameter 1 of HandleTimeZone | parameter | 32 |
+| Parameter 1 of Hash | parameter | 32 |
+| Parameter 1 of HeuristicDivide | parameter | 32 |
+| Parameter 1 of Initialize | parameter | 32 |
+| Parameter 1 of Insert | parameter | 32 |
+| Parameter 1 of Int32ToNumber | parameter | 32 |
+| Parameter 1 of Int64ToNumber | parameter | 32 |
+| Parameter 1 of InternalGetSignature | parameter | 32 |
+| Parameter 1 of InternalLoad | parameter | 32 |
+| Parameter 1 of InternalLoadAssemblyName | parameter | 32 |
+| Parameter 1 of InternalTryGetRawMetadata | parameter | 32 |
+| Parameter 1 of Inverse | parameter | 32 |
+| Parameter 1 of Invoke | parameter | 32 |
+| Parameter 1 of IsAddressGreaterThan | parameter | 32 |
+| Parameter 1 of IsAddressLessThan | parameter | 32 |
+| Parameter 1 of IsSystemMoniker | parameter | 32 |
+| Parameter 1 of LStat | parameter | 32 |
+| Parameter 1 of LazyCreateEvent | parameter | 32 |
+| Parameter 1 of Lex | parameter | 32 |
+| Parameter 1 of Load | parameter | 32 |
+| Parameter 1 of MapBufferToConsoleKey | parameter | 32 |
+| Parameter 1 of Max | parameter | 32 |
+| Parameter 1 of Memmove | parameter | 32 |
+| Parameter 1 of Min | parameter | 32 |
+| Parameter 1 of MoveNext | parameter | 32 |
+| Parameter 1 of Multiply | parameter | 32 |
+| Parameter 1 of NormalizeAdjustmentRuleOffset | parameter | 32 |
+| Parameter 1 of NormalizeCultureName | parameter | 32 |
+| Parameter 1 of NumberToFloatingPointBits | parameter | 32 |
+| Parameter 1 of NumberToFloatingPointBitsSlow | parameter | 32 |
+| Parameter 1 of NumberToString | parameter | 32 |
+| Parameter 1 of NumberToStringFormat | parameter | 32 |
+| Parameter 1 of OpenExistingWorker | parameter | 32 |
+| Parameter 1 of ParseAttributeArguments | parameter | 32 |
+| Parameter 1 of ParseAttributeUsageAttribute | parameter | 32 |
+| Parameter 1 of ParseByChar | parameter | 32 |
+| Parameter 1 of ParseByFormat | parameter | 32 |
+| Parameter 1 of ParseFormatO | parameter | 32 |
+| Parameter 1 of ParseFormatR | parameter | 32 |
+| Parameter 1 of ParseFormatSpecifier | parameter | 32 |
+| Parameter 1 of ParseFraction | parameter | 32 |
+| Parameter 1 of ParseHelper | parameter | 32 |
+| Parameter 1 of ParseISO8601 | parameter | 32 |
+| Parameter 1 of ParseSign | parameter | 32 |
+| Parameter 1 of ParseTime | parameter | 32 |
+| Parameter 1 of ParseTimeZone | parameter | 32 |
+| Parameter 1 of Pow2 | parameter | 32 |
+| Parameter 1 of Pow10 | parameter | 32 |
+| Parameter 1 of ProcessDateTimeSuffix | parameter | 32 |
+| Parameter 1 of ProcessHebrewTerminalState | parameter | 32 |
+| Parameter 1 of ProcessTerminalState | parameter | 32 |
+| Parameter 1 of ProcessToken | parameter | 32 |
+| Parameter 1 of QueryInterface | parameter | 32 |
+| Parameter 1 of ReadKey | parameter | 32 |
+| Parameter 1 of ReliableEnter | parameter | 32 |
+| Parameter 1 of ReorderArgumentArray | parameter | 32 |
+| Parameter 1 of ReplaceInPlaceAtChunk | parameter | 32 |
+| Parameter 1 of RestoreDispatchState | parameter | 32 |
+| Parameter 1 of RhBulkMoveWithWriteBarrier | parameter | 32 |
+| Parameter 1 of SafeHandleAddRef | parameter | 32 |
+| Parameter 1 of SequenceEqual | parameter | 32 |
+| Parameter 1 of SetBindOptions | parameter | 32 |
+| Parameter 1 of SetCurrentThreadActivityId | parameter | 32 |
+| Parameter 1 of SetValue | parameter | 32 |
+| Parameter 1 of SkipWhitespace | parameter | 32 |
+| Parameter 1 of SnapForObservation | parameter | 32 |
+| Parameter 1 of SplitName | parameter | 32 |
+| Parameter 1 of Start | parameter | 32 |
+| Parameter 1 of Stat | parameter | 32 |
+| Parameter 1 of Subtract | parameter | 32 |
+| Parameter 1 of TZif_ParseJulianDay | parameter | 32 |
+| Parameter 1 of TZif_ParseMDateRule | parameter | 32 |
+| Parameter 1 of TZif_ParsePosixDate | parameter | 32 |
+| Parameter 1 of TZif_ParsePosixDateTime | parameter | 32 |
+| Parameter 1 of TZif_ParsePosixFormat | parameter | 32 |
+| Parameter 1 of TZif_ParsePosixName | parameter | 32 |
+| Parameter 1 of TZif_ParsePosixOffset | parameter | 32 |
+| Parameter 1 of TZif_ParsePosixString | parameter | 32 |
+| Parameter 1 of TZif_ParsePosixTime | parameter | 32 |
+| Parameter 1 of TZif_ParseRaw | parameter | 32 |
+| Parameter 1 of ThrowIfDeserializationInProgress | parameter | 32 |
+| Parameter 1 of TryCreate | parameter | 32 |
+| Parameter 1 of TryDequeue | parameter | 32 |
+| Parameter 1 of TryDequeueSlow | parameter | 32 |
+| Parameter 1 of TryDigitGenShortest | parameter | 32 |
+| Parameter 1 of TryEnter | parameter | 32 |
+| Parameter 1 of TryGetArray | parameter | 32 |
+| Parameter 1 of TryGetBuffer | parameter | 32 |
+| Parameter 1 of TryGetCachedCursorPosition | parameter | 32 |
+| Parameter 1 of TryGetCursorPosition | parameter | 32 |
+| Parameter 1 of TryGetLocalTzFile | parameter | 32 |
+| Parameter 1 of TryGetMemoryManager | parameter | 32 |
+| Parameter 1 of TryGetRawMetadata | parameter | 32 |
+| Parameter 1 of TryGetString | parameter | 32 |
+| Parameter 1 of TryGetSwitch | parameter | 32 |
+| Parameter 1 of TryGetTarget | parameter | 32 |
+| Parameter 1 of TryGetTimeZoneFromLocalMachine | parameter | 32 |
+| Parameter 1 of TryGetTrailByte | parameter | 32 |
+| Parameter 1 of TryLoad | parameter | 32 |
+| Parameter 1 of TryLoadTzFile | parameter | 32 |
+| Parameter 1 of TryNumberToDecimal | parameter | 32 |
+| Parameter 1 of TryNumberToInt32 | parameter | 32 |
+| Parameter 1 of TryNumberToInt64 | parameter | 32 |
+| Parameter 1 of TryNumberToUInt32 | parameter | 32 |
+| Parameter 1 of TryNumberToUInt64 | parameter | 32 |
+| Parameter 1 of TryOpen | parameter | 32 |
+| Parameter 1 of TryOpenExisting | parameter | 32 |
+| Parameter 1 of TryParse | parameter | 32 |
+| Parameter 1 of TryParseByteD | parameter | 32 |
+| Parameter 1 of TryParseByteN | parameter | 32 |
+| Parameter 1 of TryParseByteX | parameter | 32 |
+| Parameter 1 of TryParseDateTimeG | parameter | 32 |
+| Parameter 1 of TryParseDateTimeOffsetDefault | parameter | 32 |
+| Parameter 1 of TryParseDateTimeOffsetO | parameter | 32 |
+| Parameter 1 of TryParseExactB | parameter | 32 |
+| Parameter 1 of TryParseExactD | parameter | 32 |
+| Parameter 1 of TryParseExactN | parameter | 32 |
+| Parameter 1 of TryParseExactP | parameter | 32 |
+| Parameter 1 of TryParseExactX | parameter | 32 |
+| Parameter 1 of TryParseGuid | parameter | 32 |
+| Parameter 1 of TryParseGuidN | parameter | 32 |
+| Parameter 1 of TryParseHebrewNumber | parameter | 32 |
+| Parameter 1 of TryParseHex | parameter | 32 |
+| Parameter 1 of TryParseInt16D | parameter | 32 |
+| Parameter 1 of TryParseInt16N | parameter | 32 |
+| Parameter 1 of TryParseInt32D | parameter | 32 |
+| Parameter 1 of TryParseInt32N | parameter | 32 |
+| Parameter 1 of TryParseInt64D | parameter | 32 |
+| Parameter 1 of TryParseInt64N | parameter | 32 |
+| Parameter 1 of TryParseNormalAsFloatingPoint | parameter | 32 |
+| Parameter 1 of TryParseNumber | parameter | 32 |
+| Parameter 1 of TryParseSByteD | parameter | 32 |
+| Parameter 1 of TryParseSByteN | parameter | 32 |
+| Parameter 1 of TryParseThrowFormatException | parameter | 32 |
+| Parameter 1 of TryParseTimeSpanBigG | parameter | 32 |
+| Parameter 1 of TryParseTimeSpanC | parameter | 32 |
+| Parameter 1 of TryParseTimeSpanConstant | parameter | 32 |
+| Parameter 1 of TryParseTimeSpanFraction | parameter | 32 |
+| Parameter 1 of TryParseTimeSpanLittleG | parameter | 32 |
+| Parameter 1 of TryParseUInt16D | parameter | 32 |
+| Parameter 1 of TryParseUInt16N | parameter | 32 |
+| Parameter 1 of TryParseUInt16X | parameter | 32 |
+| Parameter 1 of TryParseUInt32D | parameter | 32 |
+| Parameter 1 of TryParseUInt32N | parameter | 32 |
+| Parameter 1 of TryParseUInt32X | parameter | 32 |
+| Parameter 1 of TryParseUInt64D | parameter | 32 |
+| Parameter 1 of TryParseUInt64N | parameter | 32 |
+| Parameter 1 of TryParseUInt64X | parameter | 32 |
+| Parameter 1 of TryPeek | parameter | 32 |
+| Parameter 1 of TryRead | parameter | 32 |
+| Parameter 1 of TryReadInt16BigEndian | parameter | 32 |
+| Parameter 1 of TryReadInt16LittleEndian | parameter | 32 |
+| Parameter 1 of TryReadInt32BigEndian | parameter | 32 |
+| Parameter 1 of TryReadInt32LittleEndian | parameter | 32 |
+| Parameter 1 of TryReadInt64BigEndian | parameter | 32 |
+| Parameter 1 of TryReadInt64LittleEndian | parameter | 32 |
+| Parameter 1 of TryReadUInt16BigEndian | parameter | 32 |
+| Parameter 1 of TryReadUInt16LittleEndian | parameter | 32 |
+| Parameter 1 of TryReadUInt32BigEndian | parameter | 32 |
+| Parameter 1 of TryReadUInt32LittleEndian | parameter | 32 |
+| Parameter 1 of TryReadUInt64BigEndian | parameter | 32 |
+| Parameter 1 of TryReadUInt64LittleEndian | parameter | 32 |
+| Parameter 1 of TryResolveStateMachineMethod | parameter | 32 |
+| Parameter 1 of TryRunShortest | parameter | 32 |
+| Parameter 1 of TrySteal | parameter | 32 |
+| Parameter 1 of TryTake | parameter | 32 |
+| Parameter 1 of TryWrite | parameter | 32 |
+| Parameter 1 of UInt32ToNumber | parameter | 32 |
+| Parameter 1 of UInt64ToNumber | parameter | 32 |
+| Parameter 1 of Unscale | parameter | 32 |
+| Parameter 1 of ValidateEventOpcodeForTransfer | parameter | 32 |
+| Parameter 1 of ValidateVariableAndValue | parameter | 32 |
+| Parameter 1 of VarDecCmp | parameter | 32 |
+| Parameter 1 of VarDecCmpSub | parameter | 32 |
+| Parameter 1 of VarDecDiv | parameter | 32 |
+| Parameter 1 of VarDecFromR4 | parameter | 32 |
+| Parameter 1 of VarDecFromR8 | parameter | 32 |
+| Parameter 1 of VarDecMod | parameter | 32 |
+| Parameter 1 of VarDecModFull | parameter | 32 |
+| Parameter 1 of VarDecMul | parameter | 32 |
+| Parameter 1 of Widen | parameter | 32 |
+| Parameter 1 of Write | parameter | 32 |
+| Parameter 1 of WriteEvent | parameter | 32 |
+| Parameter 1 of WriteEventRaw | parameter | 32 |
+| Parameter 1 of YearMonthAdjustment | parameter | 32 |
+| Parameter 1 of _GetScopeProps | parameter | 32 |
+| Parameter 1 of _Memmove | parameter | 32 |
+| Parameter 1 of nCreateDynamicAssembly | parameter | 32 |
+| Parameter 1 of nGetPrimaryAndSecondary | parameter | 32 |
+| Parameter 2 of <TryGetCursorPosition>g__BufferUntil\|86_0 | parameter | 32 |
+| Parameter 2 of Add | parameter | 32 |
+| Parameter 2 of AddDivisor | parameter | 32 |
+| Parameter 2 of AddNum | parameter | 32 |
+| Parameter 2 of AddResourceSet | parameter | 32 |
+| Parameter 2 of AddSep | parameter | 32 |
+| Parameter 2 of AddTitlecaseLetter | parameter | 32 |
+| Parameter 2 of Advise | parameter | 32 |
+| Parameter 2 of AllocateStringForNameIndex | parameter | 32 |
+| Parameter 2 of AttributeUsageCheck | parameter | 32 |
+| Parameter 2 of AwaitOnCompleted | parameter | 32 |
+| Parameter 2 of AwaitUnsafeOnCompleted | parameter | 32 |
+| Parameter 2 of BiggestPowerTen | parameter | 32 |
+| Parameter 2 of ChangeCaseCommon | parameter | 32 |
+| Parameter 2 of CheckVMForIOPacket | parameter | 32 |
+| Parameter 2 of CommonPrefixWith | parameter | 32 |
+| Parameter 2 of CompareOrdinalIgnoreCase | parameter | 32 |
+| Parameter 2 of CompareStringOrdinalIgnoreCase | parameter | 32 |
+| Parameter 2 of ConfigureFormatR | parameter | 32 |
+| Parameter 2 of ContinueTryEnter | parameter | 32 |
+| Parameter 2 of ConvertGregorianToHijri | parameter | 32 |
+| Parameter 2 of ConvertUtcToTimeZone | parameter | 32 |
+| Parameter 2 of CopyToTempBufferWithoutWhiteSpace | parameter | 32 |
+| Parameter 2 of CountOccurrences | parameter | 32 |
+| Parameter 2 of CreateActivityPathGuid | parameter | 32 |
+| Parameter 2 of CreateAndGetBoundaries | parameter | 32 |
+| Parameter 2 of CreateInstance | parameter | 32 |
+| Parameter 2 of CreationOptionsFromContinuationOptions | parameter | 32 |
+| Parameter 2 of DecodeFirstRune | parameter | 32 |
+| Parameter 2 of DecodeFromUtf8 | parameter | 32 |
+| Parameter 2 of DecodeFromUtf16 | parameter | 32 |
+| Parameter 2 of DecodeLastFromUtf8 | parameter | 32 |
+| Parameter 2 of DecodeLastFromUtf16 | parameter | 32 |
+| Parameter 2 of Deconstruct | parameter | 32 |
+| Parameter 2 of Dequeue | parameter | 32 |
+| Parameter 2 of DivByConst | parameter | 32 |
+| Parameter 2 of DivMod | parameter | 32 |
+| Parameter 2 of DivRem | parameter | 32 |
+| Parameter 2 of DrainLeftoverDataForGetByteCount | parameter | 32 |
+| Parameter 2 of DrainLeftoverDataForGetCharCount | parameter | 32 |
+| Parameter 2 of EncodeObject | parameter | 32 |
+| Parameter 2 of EndInvoke | parameter | 32 |
+| Parameter 2 of EnqueueSlow | parameter | 32 |
+| Parameter 2 of EnsureInitialized | parameter | 32 |
+| Parameter 2 of EnsureInitializedCore | parameter | 32 |
+| Parameter 2 of Enum | parameter | 32 |
+| Parameter 2 of EnumCustomAttributes | parameter | 32 |
+| Parameter 2 of EnumEvents | parameter | 32 |
+| Parameter 2 of EnumFields | parameter | 32 |
+| Parameter 2 of EnumNestedTypes | parameter | 32 |
+| Parameter 2 of EnumParams | parameter | 32 |
+| Parameter 2 of EnumProperties | parameter | 32 |
+| Parameter 2 of EscapeAsciiChar | parameter | 32 |
+| Parameter 2 of EventActivityIdControl | parameter | 32 |
+| Parameter 2 of EventWriteTransfer | parameter | 32 |
+| Parameter 2 of ExpandPredefinedFormat | parameter | 32 |
+| Parameter 2 of FilterHelper | parameter | 32 |
+| Parameter 2 of FindConnectionPoint | parameter | 32 |
+| Parameter 2 of FindEntry | parameter | 32 |
+| Parameter 2 of FmtClassUpdateNativeInternal | parameter | 32 |
+| Parameter 2 of FromUtf16 | parameter | 32 |
+| Parameter 2 of GenerateMetadata | parameter | 32 |
+| Parameter 2 of GenerateMetadataForProperty | parameter | 32 |
+| Parameter 2 of GetAdjustmentRuleForAmbiguousOffsets | parameter | 32 |
+| Parameter 2 of GetAdjustmentRuleForTime | parameter | 32 |
+| Parameter 2 of GetBoundaries | parameter | 32 |
+| Parameter 2 of GetCachedPowerForBinaryExponentRange | parameter | 32 |
+| Parameter 2 of GetClassLayout | parameter | 32 |
+| Parameter 2 of GetCodeInfo | parameter | 32 |
+| Parameter 2 of GetContainingTypeLib | parameter | 32 |
+| Parameter 2 of GetCustData | parameter | 32 |
+| Parameter 2 of GetCustomAttributeProps | parameter | 32 |
+| Parameter 2 of GetCustomAttributes | parameter | 32 |
+| Parameter 2 of GetDatePart | parameter | 32 |
+| Parameter 2 of GetDayOfMN | parameter | 32 |
+| Parameter 2 of GetDayOfNM | parameter | 32 |
+| Parameter 2 of GetDayOfNN | parameter | 32 |
+| Parameter 2 of GetDefaultValue | parameter | 32 |
+| Parameter 2 of GetDisplayName | parameter | 32 |
+| Parameter 2 of GetDocumentation | parameter | 32 |
+| Parameter 2 of GetDocumentation2 | parameter | 32 |
+| Parameter 2 of GetDynamicOrStaticVariables | parameter | 32 |
+| Parameter 2 of GetElement | parameter | 32 |
+| Parameter 2 of GetElementNoThrow | parameter | 32 |
+| Parameter 2 of GetEnumData | parameter | 32 |
+| Parameter 2 of GetEventProps | parameter | 32 |
+| Parameter 2 of GetFieldDefProps | parameter | 32 |
+| Parameter 2 of GetFuncCustData | parameter | 32 |
+| Parameter 2 of GetFuncDesc | parameter | 32 |
+| Parameter 2 of GetGenericParamProps | parameter | 32 |
+| Parameter 2 of GetImplTypeCustData | parameter | 32 |
+| Parameter 2 of GetImplTypeFlags | parameter | 32 |
+| Parameter 2 of GetIndexOfNextTokenAfterSeconds | parameter | 32 |
+| Parameter 2 of GetInterface | parameter | 32 |
+| Parameter 2 of GetJapaneseEraStartDate | parameter | 32 |
+| Parameter 2 of GetKeyFromCharValue | parameter | 32 |
+| Parameter 2 of GetLibStatistics | parameter | 32 |
+| Parameter 2 of GetLocaleInfoGroupingSizes | parameter | 32 |
+| Parameter 2 of GetLocaleInfoInt | parameter | 32 |
+| Parameter 2 of GetMarshalAs | parameter | 32 |
+| Parameter 2 of GetMemoryInfo | parameter | 32 |
+| Parameter 2 of GetMetadata | parameter | 32 |
+| Parameter 2 of GetMonthDayOrder | parameter | 32 |
+| Parameter 2 of GetMops | parameter | 32 |
+| Parameter 2 of GetObject | parameter | 32 |
+| Parameter 2 of GetObjectParam | parameter | 32 |
+| Parameter 2 of GetObjectStartLength | parameter | 32 |
+| Parameter 2 of GetPEKind | parameter | 32 |
+| Parameter 2 of GetPInvokeMap | parameter | 32 |
+| Parameter 2 of GetParamDefProps | parameter | 32 |
+| Parameter 2 of GetPointerToFirstInvalidByte | parameter | 32 |
+| Parameter 2 of GetPointerToFirstInvalidChar | parameter | 32 |
+| Parameter 2 of GetPropertyProps | parameter | 32 |
+| Parameter 2 of GetRawArrayGeometry | parameter | 32 |
+| Parameter 2 of GetRefTypeInfo | parameter | 32 |
+| Parameter 2 of GetRefTypeOfImplType | parameter | 32 |
+| Parameter 2 of GetRegularToken | parameter | 32 |
+| Parameter 2 of GetResource | parameter | 32 |
+| Parameter 2 of GetResourceData | parameter | 32 |
+| Parameter 2 of GetSeparatorToken | parameter | 32 |
+| Parameter 2 of GetSessionInfo | parameter | 32 |
+| Parameter 2 of GetSessionInfoCallback | parameter | 32 |
+| Parameter 2 of GetStackTracesDeepCopy | parameter | 32 |
+| Parameter 2 of GetTimeOfLastChange | parameter | 32 |
+| Parameter 2 of GetTypeInfo | parameter | 32 |
+| Parameter 2 of GetTypeInfoOfGuid | parameter | 32 |
+| Parameter 2 of GetTypeInfoType | parameter | 32 |
+| Parameter 2 of GetUnescapeSequence | parameter | 32 |
+| Parameter 2 of GetUtcOffsetFromUniversalTime | parameter | 32 |
+| Parameter 2 of GetUtcOffsetFromUtc | parameter | 32 |
+| Parameter 2 of GetUtf16SurrogatesFromSupplementaryPlaneScalar | parameter | 32 |
+| Parameter 2 of GetVarCustData | parameter | 32 |
+| Parameter 2 of GetVarDesc | parameter | 32 |
+| Parameter 2 of GetVarIndexOfMemId | parameter | 32 |
+| Parameter 2 of GetVersion | parameter | 32 |
+| Parameter 2 of GetYearMonthDayOrder | parameter | 32 |
+| Parameter 2 of GetYearMonthOrder | parameter | 32 |
+| Parameter 2 of GrabInts | parameter | 32 |
+| Parameter 2 of GrabLongs | parameter | 32 |
+| Parameter 2 of IndexOf | parameter | 32 |
+| Parameter 2 of IndexOfAny | parameter | 32 |
+| Parameter 2 of Initialize | parameter | 32 |
+| Parameter 2 of InternalConvertToUtf32 | parameter | 32 |
+| Parameter 2 of InternalDefineDynamicAssembly | parameter | 32 |
+| Parameter 2 of InternalFallback | parameter | 32 |
+| Parameter 2 of InternalFallbackGetByteCount | parameter | 32 |
+| Parameter 2 of InternalGetUnicodeCategory | parameter | 32 |
+| Parameter 2 of InternalTryGetRawMetadata | parameter | 32 |
+| Parameter 2 of IsDigit | parameter | 32 |
+| Parameter 2 of IsInstanceOfInterface | parameter | 32 |
+| Parameter 2 of LastIndexOf | parameter | 32 |
+| Parameter 2 of LastIndexOfAny | parameter | 32 |
+| Parameter 2 of Lex | parameter | 32 |
+| Parameter 2 of LoadObject | parameter | 32 |
+| Parameter 2 of LoadObjectV2 | parameter | 32 |
+| Parameter 2 of MakeSeparatorList | parameter | 32 |
+| Parameter 2 of MapBufferToConsoleKey | parameter | 32 |
+| Parameter 2 of MatchAbbreviatedDayName | parameter | 32 |
+| Parameter 2 of MatchAbbreviatedMonthName | parameter | 32 |
+| Parameter 2 of MatchAbbreviatedTimeMark | parameter | 32 |
+| Parameter 2 of MatchDayName | parameter | 32 |
+| Parameter 2 of MatchEraName | parameter | 32 |
+| Parameter 2 of MatchHebrewDigits | parameter | 32 |
+| Parameter 2 of MatchLongestWords | parameter | 32 |
+| Parameter 2 of MatchMonthName | parameter | 32 |
+| Parameter 2 of MatchTimeMark | parameter | 32 |
+| Parameter 2 of Multiply | parameter | 32 |
+| Parameter 2 of NormalizeDayOfWeek | parameter | 32 |
+| Parameter 2 of NoteChangeTime | parameter | 32 |
+| Parameter 2 of Overlaps | parameter | 32 |
+| Parameter 2 of ParseAttributeArguments | parameter | 32 |
+| Parameter 2 of ParseAttributeUsageAttribute | parameter | 32 |
+| Parameter 2 of ParseByFormat | parameter | 32 |
+| Parameter 2 of ParseComponent | parameter | 32 |
+| Parameter 2 of ParseDigits | parameter | 32 |
+| Parameter 2 of ParseExactDigits | parameter | 32 |
+| Parameter 2 of ParseFormatO | parameter | 32 |
+| Parameter 2 of ParseFormatR | parameter | 32 |
+| Parameter 2 of ParseFractionExact | parameter | 32 |
+| Parameter 2 of ParseInt | parameter | 32 |
+| Parameter 2 of ParseTime | parameter | 32 |
+| Parameter 2 of ParseTimeZoneOffset | parameter | 32 |
+| Parameter 2 of ProcessDateTimeSuffix | parameter | 32 |
+| Parameter 2 of ProcessHebrewTerminalState | parameter | 32 |
+| Parameter 2 of ProcessTerminalState | parameter | 32 |
+| Parameter 2 of ProcessTerminal_D | parameter | 32 |
+| Parameter 2 of ProcessTerminal_DHMSF | parameter | 32 |
+| Parameter 2 of ProcessTerminal_HM | parameter | 32 |
+| Parameter 2 of ProcessTerminal_HMS_F_D | parameter | 32 |
+| Parameter 2 of ProcessTerminal_HM_S_D | parameter | 32 |
+| Parameter 2 of ProcessToken | parameter | 32 |
+| Parameter 2 of QueryInterface | parameter | 32 |
+| Parameter 2 of Read | parameter | 32 |
+| Parameter 2 of ReadBuffer | parameter | 32 |
+| Parameter 2 of RelativePathTo | parameter | 32 |
+| Parameter 2 of ReleaseSemaphore | parameter | 32 |
+| Parameter 2 of ReliableEnterTimeout | parameter | 32 |
+| Parameter 2 of Remove | parameter | 32 |
+| Parameter 2 of RemoveRelativeSegments | parameter | 32 |
+| Parameter 2 of ReplaceInPlaceAtChunk | parameter | 32 |
+| Parameter 2 of ResolveToken | parameter | 32 |
+| Parameter 2 of RunForThreadPoolUnsafe | parameter | 32 |
+| Parameter 2 of RunInternal | parameter | 32 |
+| Parameter 2 of SequenceCompareTo | parameter | 32 |
+| Parameter 2 of ShiftLeft | parameter | 32 |
+| Parameter 2 of SnapForObservation | parameter | 32 |
+| Parameter 2 of SplitName | parameter | 32 |
+| Parameter 2 of SubtractDivisor | parameter | 32 |
+| Parameter 2 of TZif_ParseJulianDay | parameter | 32 |
+| Parameter 2 of TZif_ParseMDateRule | parameter | 32 |
+| Parameter 2 of TZif_ParsePosixDateTime | parameter | 32 |
+| Parameter 2 of TZif_ParsePosixFormat | parameter | 32 |
+| Parameter 2 of TZif_ParseRaw | parameter | 32 |
+| Parameter 2 of TimeToLunar | parameter | 32 |
+| Parameter 2 of ToUtf16 | parameter | 32 |
+| Parameter 2 of Tokenize | parameter | 32 |
+| Parameter 2 of TryAddTicks | parameter | 32 |
+| Parameter 2 of TryAdjustYear | parameter | 32 |
+| Parameter 2 of TryCopyTo | parameter | 32 |
+| Parameter 2 of TryCreate | parameter | 32 |
+| Parameter 2 of TryDecodeFromUtf16 | parameter | 32 |
+| Parameter 2 of TryDequeueSlow | parameter | 32 |
+| Parameter 2 of TryDigitGenShortest | parameter | 32 |
+| Parameter 2 of TryDrainRemainingDataForGetBytes | parameter | 32 |
+| Parameter 2 of TryDrainRemainingDataForGetChars | parameter | 32 |
+| Parameter 2 of TryEncodeToUtf8 | parameter | 32 |
+| Parameter 2 of TryEncodeToUtf16 | parameter | 32 |
+| Parameter 2 of TryEnter | parameter | 32 |
+| Parameter 2 of TryFormat | parameter | 32 |
+| Parameter 2 of TryFormatDateTimeL | parameter | 32 |
+| Parameter 2 of TryFormatDateTimeR | parameter | 32 |
+| Parameter 2 of TryFormatDecimalE | parameter | 32 |
+| Parameter 2 of TryFormatDecimalF | parameter | 32 |
+| Parameter 2 of TryFormatDecimalG | parameter | 32 |
+| Parameter 2 of TryFormatFloatingPoint | parameter | 32 |
+| Parameter 2 of TryFormatInt32MultipleDigits | parameter | 32 |
+| Parameter 2 of TryFormatInt64Default | parameter | 32 |
+| Parameter 2 of TryFormatInt64LessThanNegativeBillionMaxUInt | parameter | 32 |
+| Parameter 2 of TryFormatInt64MoreThanNegativeBillionMaxUInt | parameter | 32 |
+| Parameter 2 of TryFormatInt64MultipleDigits | parameter | 32 |
+| Parameter 2 of TryFormatUInt32MultipleDigits | parameter | 32 |
+| Parameter 2 of TryFormatUInt32SingleDigit | parameter | 32 |
+| Parameter 2 of TryFormatUInt64 | parameter | 32 |
+| Parameter 2 of TryFormatUInt64Default | parameter | 32 |
+| Parameter 2 of TryFormatUInt64LessThanBillionMaxUInt | parameter | 32 |
+| Parameter 2 of TryFormatUInt64MoreThanBillionMaxUInt | parameter | 32 |
+| Parameter 2 of TryFormatUInt64MultipleDigits | parameter | 32 |
+| Parameter 2 of TryFromBase64Chars | parameter | 32 |
+| Parameter 2 of TryFromBase64String | parameter | 32 |
+| Parameter 2 of TryGetByteCount | parameter | 32 |
+| Parameter 2 of TryGetEntry | parameter | 32 |
+| Parameter 2 of TryGetExport | parameter | 32 |
+| Parameter 2 of TryGetHomeDirectoryFromPasswd | parameter | 32 |
+| Parameter 2 of TryGetMemoryManager | parameter | 32 |
+| Parameter 2 of TryGetRawMetadata | parameter | 32 |
+| Parameter 2 of TryGetRuneAt | parameter | 32 |
+| Parameter 2 of TryGetString | parameter | 32 |
+| Parameter 2 of TryGetTimeZone | parameter | 32 |
+| Parameter 2 of TryGetTimeZoneFromLocalMachine | parameter | 32 |
+| Parameter 2 of TryGetUserNameFromPasswd | parameter | 32 |
+| Parameter 2 of TryGetValue | parameter | 32 |
+| Parameter 2 of TryGetValueWorker | parameter | 32 |
+| Parameter 2 of TryLoadTzFile | parameter | 32 |
+| Parameter 2 of TryParse | parameter | 32 |
+| Parameter 2 of TryParseByteD | parameter | 32 |
+| Parameter 2 of TryParseByteN | parameter | 32 |
+| Parameter 2 of TryParseByteX | parameter | 32 |
+| Parameter 2 of TryParseDateTimeG | parameter | 32 |
+| Parameter 2 of TryParseDateTimeOffsetDefault | parameter | 32 |
+| Parameter 2 of TryParseDateTimeOffsetO | parameter | 32 |
+| Parameter 2 of TryParseDateTimeOffsetR | parameter | 32 |
+| Parameter 2 of TryParseExact | parameter | 32 |
+| Parameter 2 of TryParseGuidN | parameter | 32 |
+| Parameter 2 of TryParseHebrewNumber | parameter | 32 |
+| Parameter 2 of TryParseHex | parameter | 32 |
+| Parameter 2 of TryParseInt16D | parameter | 32 |
+| Parameter 2 of TryParseInt16N | parameter | 32 |
+| Parameter 2 of TryParseInt32D | parameter | 32 |
+| Parameter 2 of TryParseInt32N | parameter | 32 |
+| Parameter 2 of TryParseInt64D | parameter | 32 |
+| Parameter 2 of TryParseInt64N | parameter | 32 |
+| Parameter 2 of TryParseNormalAsFloatingPoint | parameter | 32 |
+| Parameter 2 of TryParseNumber | parameter | 32 |
+| Parameter 2 of TryParseSByteD | parameter | 32 |
+| Parameter 2 of TryParseSByteN | parameter | 32 |
+| Parameter 2 of TryParseTimeSpanBigG | parameter | 32 |
+| Parameter 2 of TryParseTimeSpanC | parameter | 32 |
+| Parameter 2 of TryParseTimeSpanFraction | parameter | 32 |
+| Parameter 2 of TryParseTimeSpanLittleG | parameter | 32 |
+| Parameter 2 of TryParseUInt16D | parameter | 32 |
+| Parameter 2 of TryParseUInt16N | parameter | 32 |
+| Parameter 2 of TryParseUInt16X | parameter | 32 |
+| Parameter 2 of TryParseUInt32D | parameter | 32 |
+| Parameter 2 of TryParseUInt32HexNumberStyle | parameter | 32 |
+| Parameter 2 of TryParseUInt32N | parameter | 32 |
+| Parameter 2 of TryParseUInt32X | parameter | 32 |
+| Parameter 2 of TryParseUInt64D | parameter | 32 |
+| Parameter 2 of TryParseUInt64HexNumberStyle | parameter | 32 |
+| Parameter 2 of TryParseUInt64N | parameter | 32 |
+| Parameter 2 of TryParseUInt64X | parameter | 32 |
+| Parameter 2 of TryRunDouble | parameter | 32 |
+| Parameter 2 of TryRunShortest | parameter | 32 |
+| Parameter 2 of TryRunSingle | parameter | 32 |
+| Parameter 2 of TryStringToNumber | parameter | 32 |
+| Parameter 2 of TryToBase64Chars | parameter | 32 |
+| Parameter 2 of UInt64x64To128 | parameter | 32 |
+| Parameter 2 of Unscale | parameter | 32 |
+| Parameter 2 of WaitOnEvent | parameter | 32 |
+| Parameter 2 of Widen | parameter | 32 |
+| Parameter 2 of Write | parameter | 32 |
+| Parameter 2 of WriteEventRaw | parameter | 32 |
+| Parameter 2 of WriteImpl | parameter | 32 |
+| Parameter 2 of WriteMultiMerge | parameter | 32 |
+| Parameter 2 of WriteMultiMergeInner | parameter | 32 |
+| Parameter 2 of WriteToAllListeners | parameter | 32 |
+| Parameter 2 of WriteToBuffer | parameter | 32 |
+| Parameter 2 of YearMonthAdjustment | parameter | 32 |
+| Parameter 2 of _GetClassLayout | parameter | 32 |
+| Parameter 2 of _GetCustomAttributeProps | parameter | 32 |
+| Parameter 2 of _GetDefaultValue | parameter | 32 |
+| Parameter 2 of _GetFieldDefProps | parameter | 32 |
+| Parameter 2 of _GetFieldMarshal | parameter | 32 |
+| Parameter 2 of _GetGenericParamProps | parameter | 32 |
+| Parameter 2 of _GetMarshalAs | parameter | 32 |
+| Parameter 2 of _GetMemberRefProps | parameter | 32 |
+| Parameter 2 of _GetPInvokeMap | parameter | 32 |
+| Parameter 2 of _GetParamDefProps | parameter | 32 |
+| Parameter 2 of _GetParentToken | parameter | 32 |
+| Parameter 2 of _GetSigOfFieldDef | parameter | 32 |
+| Parameter 2 of _GetSigOfMethodDef | parameter | 32 |
+| Parameter 2 of _GetSignatureFromToken | parameter | 32 |
+| Parameter 2 of _LoadObjectV2 | parameter | 32 |
+| Parameter 2 of _ParseAttributeUsageAttribute | parameter | 32 |
+| Parameter 2 of ctor>g__TryConvertFromInvariantString\|2_0 | parameter | 32 |
+| Parameter 3 of .ctor | parameter | 32 |
+| Parameter 3 of <GetSessions>b__39_0 | parameter | 32 |
+| Parameter 3 of <TryGetCursorPosition>g__AppendToStdInReaderUntil\|86_1 | parameter | 32 |
+| Parameter 3 of <TryGetCursorPosition>g__BufferUntil\|86_0 | parameter | 32 |
+| Parameter 3 of AccumulateDecimalDigitsIntoBigInteger | parameter | 32 |
+| Parameter 3 of AddressOfMember | parameter | 32 |
+| Parameter 3 of AtomicStateUpdate | parameter | 32 |
+| Parameter 3 of BeginInvoke | parameter | 32 |
+| Parameter 3 of BindToMethod | parameter | 32 |
+| Parameter 3 of BindToObject | parameter | 32 |
+| Parameter 3 of BindToStorage | parameter | 32 |
+| Parameter 3 of BindType | parameter | 32 |
+| Parameter 3 of CheckNewValue | parameter | 32 |
+| Parameter 3 of CompareExchange | parameter | 32 |
+| Parameter 3 of ComposeWith | parameter | 32 |
+| Parameter 3 of ContinueTryEnterWithThreadTracking | parameter | 32 |
+| Parameter 3 of ConvertGregorianToHijri | parameter | 32 |
+| Parameter 3 of ConvertHijriToGregorian | parameter | 32 |
+| Parameter 3 of ConvertToNative | parameter | 32 |
+| Parameter 3 of CopyToTempBufferWithoutWhiteSpace | parameter | 32 |
+| Parameter 3 of CreateCaObject | parameter | 32 |
+| Parameter 3 of CreateInstance | parameter | 32 |
+| Parameter 3 of CreateMutexCore | parameter | 32 |
+| Parameter 3 of DecodeFirstRune | parameter | 32 |
+| Parameter 3 of DecodeObject | parameter | 32 |
+| Parameter 3 of Deconstruct | parameter | 32 |
+| Parameter 3 of DefineDynamicModuleInternal | parameter | 32 |
+| Parameter 3 of DefineDynamicModuleInternalNoLock | parameter | 32 |
+| Parameter 3 of DivByConst | parameter | 32 |
+| Parameter 3 of DivRem | parameter | 32 |
+| Parameter 3 of DoAnsiConversion | parameter | 32 |
+| Parameter 3 of Dragon4Double | parameter | 32 |
+| Parameter 3 of Dragon4Single | parameter | 32 |
+| Parameter 3 of DrainLeftoverDataForGetChars | parameter | 32 |
+| Parameter 3 of EncodeObject | parameter | 32 |
+| Parameter 3 of EncodeRune | parameter | 32 |
+| Parameter 3 of EndInvoke | parameter | 32 |
+| Parameter 3 of Enum | parameter | 32 |
+| Parameter 3 of EnumCalendarInfo | parameter | 32 |
+| Parameter 3 of EnumDatePatterns | parameter | 32 |
+| Parameter 3 of EnumEraNames | parameter | 32 |
+| Parameter 3 of EnumMonthNames | parameter | 32 |
+| Parameter 3 of ExpandPredefinedFormat | parameter | 32 |
+| Parameter 3 of FilterHelper | parameter | 32 |
+| Parameter 3 of FromUtf16 | parameter | 32 |
+| Parameter 3 of GetAdjustmentRuleForTime | parameter | 32 |
+| Parameter 3 of GetBoundaries | parameter | 32 |
+| Parameter 3 of GetCalendarInfo | parameter | 32 |
+| Parameter 3 of GetClassLayout | parameter | 32 |
+| Parameter 3 of GetCodeInfo | parameter | 32 |
+| Parameter 3 of GetControlCharacters | parameter | 32 |
+| Parameter 3 of GetCurrentTextElementLen | parameter | 32 |
+| Parameter 3 of GetCustomAttributeProps | parameter | 32 |
+| Parameter 3 of GetDataFromController | parameter | 32 |
+| Parameter 3 of GetDatePart | parameter | 32 |
+| Parameter 3 of GetDefaultValue | parameter | 32 |
+| Parameter 3 of GetDisplayName | parameter | 32 |
+| Parameter 3 of GetDocumentation | parameter | 32 |
+| Parameter 3 of GetDocumentation2 | parameter | 32 |
+| Parameter 3 of GetDynamicOrStaticVariables | parameter | 32 |
+| Parameter 3 of GetEventProps | parameter | 32 |
+| Parameter 3 of GetFieldOffset | parameter | 32 |
+| Parameter 3 of GetFloatingPointMaxDigitsAndPrecision | parameter | 32 |
+| Parameter 3 of GetFuncCustData | parameter | 32 |
+| Parameter 3 of GetFuncIndexOfMemId | parameter | 32 |
+| Parameter 3 of GetImplTypeCustData | parameter | 32 |
+| Parameter 3 of GetJapaneseEraStartDate | parameter | 32 |
+| Parameter 3 of GetKeyFromCharValue | parameter | 32 |
+| Parameter 3 of GetLocaleInfoGroupingSizes | parameter | 32 |
+| Parameter 3 of GetMarshalAs | parameter | 32 |
+| Parameter 3 of GetMemoryInfo | parameter | 32 |
+| Parameter 3 of GetMetadata | parameter | 32 |
+| Parameter 3 of GetPInvokeMap | parameter | 32 |
+| Parameter 3 of GetParamCustData | parameter | 32 |
+| Parameter 3 of GetParamDefProps | parameter | 32 |
+| Parameter 3 of GetParameters | parameter | 32 |
+| Parameter 3 of GetPointerToFirstInvalidByte | parameter | 32 |
+| Parameter 3 of GetPointerToFirstInvalidChar | parameter | 32 |
+| Parameter 3 of GetPropertyOrFieldData | parameter | 32 |
+| Parameter 3 of GetPropertyProps | parameter | 32 |
+| Parameter 3 of GetRawArrayGeometry | parameter | 32 |
+| Parameter 3 of GetResourceData | parameter | 32 |
+| Parameter 3 of GetSeparatorToken | parameter | 32 |
+| Parameter 3 of GetTimeOfLastChange | parameter | 32 |
+| Parameter 3 of GetType | parameter | 32 |
+| Parameter 3 of GetTypeByName | parameter | 32 |
+| Parameter 3 of GetUtcOffsetFromUtc | parameter | 32 |
+| Parameter 3 of GetVarCustData | parameter | 32 |
+| Parameter 3 of GetVersion | parameter | 32 |
+| Parameter 3 of InitHash | parameter | 32 |
+| Parameter 3 of Initialize | parameter | 32 |
+| Parameter 3 of InternalFallback | parameter | 32 |
+| Parameter 3 of Invoke | parameter | 32 |
+| Parameter 3 of Lex | parameter | 32 |
+| Parameter 3 of MakeRoom | parameter | 32 |
+| Parameter 3 of MakeSeparatorList | parameter | 32 |
+| Parameter 3 of MapBufferToConsoleKey | parameter | 32 |
+| Parameter 3 of MatchSpecifiedWords | parameter | 32 |
+| Parameter 3 of Parse | parameter | 32 |
+| Parameter 3 of ParseAttributeArguments | parameter | 32 |
+| Parameter 3 of ParseAttributeUsageAttribute | parameter | 32 |
+| Parameter 3 of ParseComponent | parameter | 32 |
+| Parameter 3 of ParseDigits | parameter | 32 |
+| Parameter 3 of ParseExactDigits | parameter | 32 |
+| Parameter 3 of ParseISO8601 | parameter | 32 |
+| Parameter 3 of ParseInt | parameter | 32 |
+| Parameter 3 of Poll | parameter | 32 |
+| Parameter 3 of PopulateLiteralFields | parameter | 32 |
+| Parameter 3 of PopulateRtFields | parameter | 32 |
+| Parameter 3 of ProcessHebrewTerminalState | parameter | 32 |
+| Parameter 3 of ProcessTerminalState | parameter | 32 |
+| Parameter 3 of ReadAsyncInternal | parameter | 32 |
+| Parameter 3 of ReadDirR | parameter | 32 |
+| Parameter 3 of Reduce | parameter | 32 |
+| Parameter 3 of Remove | parameter | 32 |
+| Parameter 3 of ResolveAssembly | parameter | 32 |
+| Parameter 3 of ResolveToken | parameter | 32 |
+| Parameter 3 of RunCallback | parameter | 32 |
+| Parameter 3 of ScanRepeatChar | parameter | 32 |
+| Parameter 3 of SnapForObservation | parameter | 32 |
+| Parameter 3 of StringToInt | parameter | 32 |
+| Parameter 3 of StringToLong | parameter | 32 |
+| Parameter 3 of TZif_ParseMDateRule | parameter | 32 |
+| Parameter 3 of TZif_ParsePosixDateTime | parameter | 32 |
+| Parameter 3 of TZif_ParsePosixFormat | parameter | 32 |
+| Parameter 3 of TZif_ParseRaw | parameter | 32 |
+| Parameter 3 of TimeToLunar | parameter | 32 |
+| Parameter 3 of ToUtf16 | parameter | 32 |
+| Parameter 3 of Tokenize | parameter | 32 |
+| Parameter 3 of TryDecodeFromUtf16 | parameter | 32 |
+| Parameter 3 of TryDequeueSlow | parameter | 32 |
+| Parameter 3 of TryDigitGenCounted | parameter | 32 |
+| Parameter 3 of TryDrainLeftoverDataForGetBytes | parameter | 32 |
+| Parameter 3 of TryFormat | parameter | 32 |
+| Parameter 3 of TryFormatDateTimeG | parameter | 32 |
+| Parameter 3 of TryFormatDateTimeO | parameter | 32 |
+| Parameter 3 of TryFormatInt64 | parameter | 32 |
+| Parameter 3 of TryFormatInt64D | parameter | 32 |
+| Parameter 3 of TryFormatInt64N | parameter | 32 |
+| Parameter 3 of TryFormatO | parameter | 32 |
+| Parameter 3 of TryFormatR | parameter | 32 |
+| Parameter 3 of TryGetEntry | parameter | 32 |
+| Parameter 3 of TryGetMemoryManager | parameter | 32 |
+| Parameter 3 of TryGetSpecialConsoleKey | parameter | 32 |
+| Parameter 3 of TryGetString | parameter | 32 |
+| Parameter 3 of TryGetTimeZone | parameter | 32 |
+| Parameter 3 of TryGetTimeZoneFromLocalMachine | parameter | 32 |
+| Parameter 3 of TryInternalFallbackGetBytes | parameter | 32 |
+| Parameter 3 of TryJoin | parameter | 32 |
+| Parameter 3 of TryLoad | parameter | 32 |
+| Parameter 3 of TryParse | parameter | 32 |
+| Parameter 3 of TryParseByFormat | parameter | 32 |
+| Parameter 3 of TryParseComponent | parameter | 32 |
+| Parameter 3 of TryParseDateTimeG | parameter | 32 |
+| Parameter 3 of TryParseDateTimeOffsetO | parameter | 32 |
+| Parameter 3 of TryParseDateTimeOffsetR | parameter | 32 |
+| Parameter 3 of TryParseDecimal | parameter | 32 |
+| Parameter 3 of TryParseDouble | parameter | 32 |
+| Parameter 3 of TryParseExact | parameter | 32 |
+| Parameter 3 of TryParseInt32 | parameter | 32 |
+| Parameter 3 of TryParseInt32IntegerStyle | parameter | 32 |
+| Parameter 3 of TryParseInt32Number | parameter | 32 |
+| Parameter 3 of TryParseInt64 | parameter | 32 |
+| Parameter 3 of TryParseInt64IntegerStyle | parameter | 32 |
+| Parameter 3 of TryParseInt64Number | parameter | 32 |
+| Parameter 3 of TryParseNumber | parameter | 32 |
+| Parameter 3 of TryParseQuoteString | parameter | 32 |
+| Parameter 3 of TryParseSingle | parameter | 32 |
+| Parameter 3 of TryParseTimeSpan | parameter | 32 |
+| Parameter 3 of TryParseUInt32 | parameter | 32 |
+| Parameter 3 of TryParseUInt32IntegerStyle | parameter | 32 |
+| Parameter 3 of TryParseUInt32Number | parameter | 32 |
+| Parameter 3 of TryParseUInt64 | parameter | 32 |
+| Parameter 3 of TryParseUInt64IntegerStyle | parameter | 32 |
+| Parameter 3 of TryParseUInt64Number | parameter | 32 |
+| Parameter 3 of TryRunCounted | parameter | 32 |
+| Parameter 3 of TrySplitTimeSpan | parameter | 32 |
+| Parameter 3 of TryUInt32ToDecStr | parameter | 32 |
+| Parameter 3 of TryUInt64ToDecStr | parameter | 32 |
+| Parameter 3 of UpdateDescriptor | parameter | 32 |
+| Parameter 3 of ValidateTimeZoneInfo | parameter | 32 |
+| Parameter 3 of Write | parameter | 32 |
+| Parameter 3 of WriteFile | parameter | 32 |
+| Parameter 3 of _Enum | parameter | 32 |
+| Parameter 3 of _GetClassLayout | parameter | 32 |
+| Parameter 3 of _GetCustomAttributeProps | parameter | 32 |
+| Parameter 3 of _GetDefaultValue | parameter | 32 |
+| Parameter 3 of _GetEventProps | parameter | 32 |
+| Parameter 3 of _GetFieldOffset | parameter | 32 |
+| Parameter 3 of _GetMarshalAs | parameter | 32 |
+| Parameter 3 of _GetParamDefProps | parameter | 32 |
+| Parameter 3 of _GetPropertyOrFieldData | parameter | 32 |
+| Parameter 3 of _GetPropertyProps | parameter | 32 |
+| Parameter 3 of _GetUserString | parameter | 32 |
+| Parameter 3 of _ParseAttributeUsageAttribute | parameter | 32 |
+| Parameter 3 of nLoad | parameter | 32 |
+| Parameter 4 of .ctor | parameter | 32 |
+| Parameter 4 of <TryGetCursorPosition>g__AppendToStdInReaderUntil\|86_1 | parameter | 32 |
+| Parameter 4 of <TryGetCursorPosition>g__BufferUntil\|86_0 | parameter | 32 |
+| Parameter 4 of <TryGetCursorPosition>g__ReadRowOrCol\|86_2 | parameter | 32 |
+| Parameter 4 of AssignAssociates | parameter | 32 |
+| Parameter 4 of BeginInvoke | parameter | 32 |
+| Parameter 4 of Bind | parameter | 32 |
+| Parameter 4 of BindToObject | parameter | 32 |
+| Parameter 4 of BindToStorage | parameter | 32 |
+| Parameter 4 of BindType | parameter | 32 |
+| Parameter 4 of CallStringMethod | parameter | 32 |
+| Parameter 4 of Convert | parameter | 32 |
+| Parameter 4 of ConvertHijriToGregorian | parameter | 32 |
+| Parameter 4 of CreateEventCore | parameter | 32 |
+| Parameter 4 of CreateInstance | parameter | 32 |
+| Parameter 4 of CreateSemaphoreCore | parameter | 32 |
+| Parameter 4 of Deconstruct | parameter | 32 |
+| Parameter 4 of DoStrictParse | parameter | 32 |
+| Parameter 4 of EndInvoke | parameter | 32 |
+| Parameter 4 of EnumMonthNames | parameter | 32 |
+| Parameter 4 of EscapeString | parameter | 32 |
+| Parameter 4 of EvaluateInternal | parameter | 32 |
+| Parameter 4 of EventRegister | parameter | 32 |
+| Parameter 4 of FilterHelper | parameter | 32 |
+| Parameter 4 of GetByteCountFast | parameter | 32 |
+| Parameter 4 of GetCharCountFast | parameter | 32 |
+| Parameter 4 of GetCurrentTextElementLen | parameter | 32 |
+| Parameter 4 of GetDataFromController | parameter | 32 |
+| Parameter 4 of GetDefaultValue | parameter | 32 |
+| Parameter 4 of GetDocumentation | parameter | 32 |
+| Parameter 4 of GetDocumentation2 | parameter | 32 |
+| Parameter 4 of GetMarshalAs | parameter | 32 |
+| Parameter 4 of GetMemoryInfo | parameter | 32 |
+| Parameter 4 of GetMetadata | parameter | 32 |
+| Parameter 4 of GetNames | parameter | 32 |
+| Parameter 4 of GetPInvokeMap | parameter | 32 |
+| Parameter 4 of GetParamCustData | parameter | 32 |
+| Parameter 4 of GetPropertyOrFieldData | parameter | 32 |
+| Parameter 4 of GetPropertyProps | parameter | 32 |
+| Parameter 4 of GetRawArrayGeometry | parameter | 32 |
+| Parameter 4 of GetValue | parameter | 32 |
+| Parameter 4 of GetVersion | parameter | 32 |
+| Parameter 4 of GregorianToLunar | parameter | 32 |
+| Parameter 4 of InitHash | parameter | 32 |
+| Parameter 4 of Invoke | parameter | 32 |
+| Parameter 4 of Lex | parameter | 32 |
+| Parameter 4 of LunarToGregorian | parameter | 32 |
+| Parameter 4 of MakeRoom | parameter | 32 |
+| Parameter 4 of MapBufferToConsoleKey | parameter | 32 |
+| Parameter 4 of OnStart | parameter | 32 |
+| Parameter 4 of OnStop | parameter | 32 |
+| Parameter 4 of ParseByFormat | parameter | 32 |
+| Parameter 4 of ParseDisplayName | parameter | 32 |
+| Parameter 4 of ParseExact | parameter | 32 |
+| Parameter 4 of ParseExactDigits | parameter | 32 |
+| Parameter 4 of ParseExactMultiple | parameter | 32 |
+| Parameter 4 of PopulateEvents | parameter | 32 |
+| Parameter 4 of ProcessHebrewTerminalState | parameter | 32 |
+| Parameter 4 of ProcessTerminalState | parameter | 32 |
+| Parameter 4 of Reduce | parameter | 32 |
+| Parameter 4 of Remove | parameter | 32 |
+| Parameter 4 of ResolveToken | parameter | 32 |
+| Parameter 4 of SnapForObservation | parameter | 32 |
+| Parameter 4 of TZif_ParsePosixFormat | parameter | 32 |
+| Parameter 4 of TZif_ParseRaw | parameter | 32 |
+| Parameter 4 of TimeToLunar | parameter | 32 |
+| Parameter 4 of Tokenize | parameter | 32 |
+| Parameter 4 of TranscodeToUtf8 | parameter | 32 |
+| Parameter 4 of TranscodeToUtf16 | parameter | 32 |
+| Parameter 4 of TryCreateDateTimeOffset | parameter | 32 |
+| Parameter 4 of TryDigitGenCounted | parameter | 32 |
+| Parameter 4 of TryDigitGenShortest | parameter | 32 |
+| Parameter 4 of TryDrainLeftoverDataForGetBytes | parameter | 32 |
+| Parameter 4 of TryFormatDecimal | parameter | 32 |
+| Parameter 4 of TryFormatDouble | parameter | 32 |
+| Parameter 4 of TryFormatInt32 | parameter | 32 |
+| Parameter 4 of TryFormatInt64 | parameter | 32 |
+| Parameter 4 of TryFormatSingle | parameter | 32 |
+| Parameter 4 of TryFormatStandard | parameter | 32 |
+| Parameter 4 of TryFormatUInt32 | parameter | 32 |
+| Parameter 4 of TryFormatUInt64 | parameter | 32 |
+| Parameter 4 of TryFormatUInt64D | parameter | 32 |
+| Parameter 4 of TryFormatUInt64N | parameter | 32 |
+| Parameter 4 of TryFormatUInt64X | parameter | 32 |
+| Parameter 4 of TryGetSpecialConsoleKey | parameter | 32 |
+| Parameter 4 of TryInt32ToHexStr | parameter | 32 |
+| Parameter 4 of TryInt64ToHexStr | parameter | 32 |
+| Parameter 4 of TryInternalFallbackGetBytes | parameter | 32 |
+| Parameter 4 of TryInternalFallbackGetChars | parameter | 32 |
+| Parameter 4 of TryJoin | parameter | 32 |
+| Parameter 4 of TryNegativeInt32ToDecStr | parameter | 32 |
+| Parameter 4 of TryNegativeInt64ToDecStr | parameter | 32 |
+| Parameter 4 of TryParse | parameter | 32 |
+| Parameter 4 of TryParseAsSpecialFloatingPoint | parameter | 32 |
+| Parameter 4 of TryParseExact | parameter | 32 |
+| Parameter 4 of TryParseExactMultiple | parameter | 32 |
+| Parameter 4 of TryParseExactMultipleTimeSpan | parameter | 32 |
+| Parameter 4 of TryParseExactTimeSpan | parameter | 32 |
+| Parameter 4 of TryParseGuidCore | parameter | 32 |
+| Parameter 4 of TryParseNumber | parameter | 32 |
+| Parameter 4 of TryRunCounted | parameter | 32 |
+| Parameter 4 of TryRunShortest | parameter | 32 |
+| Parameter 4 of TrySZBinarySearch | parameter | 32 |
+| Parameter 4 of TrySZIndexOf | parameter | 32 |
+| Parameter 4 of TrySZLastIndexOf | parameter | 32 |
+| Parameter 4 of UpdateDescriptor | parameter | 32 |
+| Parameter 4 of Write | parameter | 32 |
+| Parameter 4 of _GetDefaultValue | parameter | 32 |
+| Parameter 4 of _GetMarshalAs | parameter | 32 |
+| Parameter 4 of _GetPropertyOrFieldData | parameter | 32 |
+| Parameter 4 of _GetPropertyProps | parameter | 32 |
+| Parameter 4 of _ParseAttributeUsageAttribute | parameter | 32 |
+| Parameter 5 of AssignAssociates | parameter | 32 |
+| Parameter 5 of BeginInvoke | parameter | 32 |
+| Parameter 5 of Bind | parameter | 32 |
+| Parameter 5 of ConstructType | parameter | 32 |
+| Parameter 5 of Convert | parameter | 32 |
+| Parameter 5 of ConvertHijriToGregorian | parameter | 32 |
+| Parameter 5 of CreateCaObject | parameter | 32 |
+| Parameter 5 of CreateInstance | parameter | 32 |
+| Parameter 5 of Deconstruct | parameter | 32 |
+| Parameter 5 of EnsureDestinationSize | parameter | 32 |
+| Parameter 5 of EvaluateInternal | parameter | 32 |
+| Parameter 5 of FilterHelper | parameter | 32 |
+| Parameter 5 of FindName | parameter | 32 |
+| Parameter 5 of GetBytesFast | parameter | 32 |
+| Parameter 5 of GetCharsFast | parameter | 32 |
+| Parameter 5 of GetDataFromController | parameter | 32 |
+| Parameter 5 of GetDocumentation | parameter | 32 |
+| Parameter 5 of GetIsDaylightSavingsFromUtc | parameter | 32 |
+| Parameter 5 of GetMarshalAs | parameter | 32 |
+| Parameter 5 of GetMemoryInfo | parameter | 32 |
+| Parameter 5 of GetPropertyOrFieldData | parameter | 32 |
+| Parameter 5 of GetType | parameter | 32 |
+| Parameter 5 of GregorianToLunar | parameter | 32 |
+| Parameter 5 of Invoke | parameter | 32 |
+| Parameter 5 of Lex | parameter | 32 |
+| Parameter 5 of LunarToGregorian | parameter | 32 |
+| Parameter 5 of MapBufferToConsoleKey | parameter | 32 |
+| Parameter 5 of OnStart | parameter | 32 |
+| Parameter 5 of ParseDisplayName | parameter | 32 |
+| Parameter 5 of PopulateProperties | parameter | 32 |
+| Parameter 5 of PopulateRtFields | parameter | 32 |
+| Parameter 5 of ResolveType | parameter | 32 |
+| Parameter 5 of TZif_ParsePosixFormat | parameter | 32 |
+| Parameter 5 of TZif_ParseRaw | parameter | 32 |
+| Parameter 5 of TranscodeToUtf8 | parameter | 32 |
+| Parameter 5 of TranscodeToUtf16 | parameter | 32 |
+| Parameter 5 of TryDigitGenShortest | parameter | 32 |
+| Parameter 5 of TryParseAsSpecialFloatingPoint | parameter | 32 |
+| Parameter 5 of TryParseByName | parameter | 32 |
+| Parameter 5 of TryParseExact | parameter | 32 |
+| Parameter 5 of TryParseExactMultiple | parameter | 32 |
+| Parameter 5 of TryParseGuidCore | parameter | 32 |
+| Parameter 5 of TryParseInt64Enum | parameter | 32 |
+| Parameter 5 of TryParseRareEnum | parameter | 32 |
+| Parameter 5 of TryParseUInt64Enum | parameter | 32 |
+| Parameter 5 of TryRoundWeedCounted | parameter | 32 |
+| Parameter 5 of TryRunShortest | parameter | 32 |
+| Parameter 5 of Write | parameter | 32 |
+| Parameter 5 of _GetMarshalAs | parameter | 32 |
+| Parameter 5 of _GetPropertyOrFieldData | parameter | 32 |
+| Parameter 6 of AssignAssociates | parameter | 32 |
+| Parameter 6 of BeginInvoke | parameter | 32 |
+| Parameter 6 of Bind | parameter | 32 |
+| Parameter 6 of Convert | parameter | 32 |
+| Parameter 6 of Deconstruct | parameter | 32 |
+| Parameter 6 of FilterCustomAttributeRecord | parameter | 32 |
+| Parameter 6 of GetMarshalAs | parameter | 32 |
+| Parameter 6 of GetPropertyOrFieldData | parameter | 32 |
+| Parameter 6 of GregorianToLunar | parameter | 32 |
+| Parameter 6 of Invoke | parameter | 32 |
+| Parameter 6 of LunarToGregorian | parameter | 32 |
+| Parameter 6 of SetValue | parameter | 32 |
+| Parameter 6 of TZif_ParsePosixFormat | parameter | 32 |
+| Parameter 6 of TZif_ParseRaw | parameter | 32 |
+| Parameter 6 of TryCreateTimeSpan | parameter | 32 |
+| Parameter 6 of TryTimeToTicks | parameter | 32 |
+| Parameter 6 of _GetMarshalAs | parameter | 32 |
+| Parameter 6 of _GetPropertyOrFieldData | parameter | 32 |
+| Parameter 7 of AssignAssociates | parameter | 32 |
+| Parameter 7 of BindToMethod | parameter | 32 |
+| Parameter 7 of Convert | parameter | 32 |
+| Parameter 7 of Deconstruct | parameter | 32 |
+| Parameter 7 of Dragon4 | parameter | 32 |
+| Parameter 7 of FilterCustomAttributeRecord | parameter | 32 |
+| Parameter 7 of GetMarshalAs | parameter | 32 |
+| Parameter 7 of Invoke | parameter | 32 |
+| Parameter 7 of TZif_ParsePosixFormat | parameter | 32 |
+| Parameter 7 of TZif_ParseRaw | parameter | 32 |
+| Parameter 7 of TryCreate | parameter | 32 |
+| Parameter 7 of TryCreateDateTimeOffsetInterpretingDataAsLocalTime | parameter | 32 |
+| Parameter 7 of TryParseUInt32Enum | parameter | 32 |
+| Parameter 7 of _GetMarshalAs | parameter | 32 |
+| Parameter 8 of AssignAssociates | parameter | 32 |
+| Parameter 8 of Convert | parameter | 32 |
+| Parameter 8 of CreateInstanceInternal | parameter | 32 |
+| Parameter 8 of Deconstruct | parameter | 32 |
+| Parameter 8 of FilterCustomAttributeRecord | parameter | 32 |
+| Parameter 8 of GetMarshalAs | parameter | 32 |
+| Parameter 8 of TZif_ParsePosixFormat | parameter | 32 |
+| Parameter 8 of TZif_ParseRaw | parameter | 32 |
+| Parameter 8 of TryCreateDateTime | parameter | 32 |
+| Parameter 8 of TryParseInt32Enum | parameter | 32 |
+| Parameter 8 of _GetMarshalAs | parameter | 32 |
+| Parameter 9 of AssignAssociates | parameter | 32 |
+| Parameter 9 of BeginInvoke | parameter | 32 |
+| Parameter 9 of Convert | parameter | 32 |
+| Parameter 9 of Deconstruct | parameter | 32 |
+| Parameter 9 of FilterCustomAttributeRecord | parameter | 32 |
+| Parameter 9 of GetMarshalAs | parameter | 32 |
+| Parameter 9 of Invoke | parameter | 32 |
+| Parameter 9 of TryToDateTime | parameter | 32 |
+| Parameter 9 of _GetMarshalAs | parameter | 32 |
+| Parameter 10 of AssignAssociates | parameter | 32 |
+| Parameter 10 of BeginInvoke | parameter | 32 |
+| Parameter 10 of Convert | parameter | 32 |
+| Parameter 10 of Deconstruct | parameter | 32 |
+| Parameter 10 of FilterCustomAttributeRecord | parameter | 32 |
+| Parameter 10 of Invoke | parameter | 32 |
+| Parameter 10 of TryCreateDateTimeOffset | parameter | 32 |
+| Parameter 10 of _GetMarshalAs | parameter | 32 |
+| Parameter 11 of AssignAssociates | parameter | 32 |
+| Parameter 11 of BeginInvoke | parameter | 32 |
+| Parameter 11 of Deconstruct | parameter | 32 |
+| Parameter 11 of Invoke | parameter | 32 |
+| Parameter 12 of Deconstruct | parameter | 32 |
+| Parameter 13 of Deconstruct | parameter | 32 |
+| Parameter 14 of Deconstruct | parameter | 32 |
+| Parameter 15 of Deconstruct | parameter | 32 |
+| Parameter 16 of Deconstruct | parameter | 32 |
+| Parameter 17 of Deconstruct | parameter | 32 |
+| Parameter 18 of Deconstruct | parameter | 32 |
+| Parameter 19 of Deconstruct | parameter | 32 |
+| Parameter 20 of Deconstruct | parameter | 32 |
+| Parameter 21 of Deconstruct | parameter | 32 |
+| get_Current | method | 32 |
+| get_EventHandle | method | 32 |
+| get_Item | method | 32 |
+| get_OffsetHigh | method | 32 |
+| get_OffsetLow | method | 32 |
+| get_Value | method | 32 |
+| property Current | property | 32 |
+| property EventHandle | property | 32 |
+| property Item | property | 32 |
+| property OffsetHigh | property | 32 |
+| property OffsetLow | property | 32 |
+| property Value | property | 32 |
diff --git a/csharp/ql/test/library-tests/cil/typeAnnotations/typeAnnotations.ql b/csharp/ql/test/library-tests/cil/typeAnnotations/typeAnnotations.ql
new file mode 100644
index 00000000000..6544f049f7c
--- /dev/null
+++ b/csharp/ql/test/library-tests/cil/typeAnnotations/typeAnnotations.ql
@@ -0,0 +1,25 @@
+import cil
+import semmle.code.cil.Type
+
+private string elementType(Element e) {
+  e instanceof Method and result = "method"
+  or
+  e instanceof Property and result = "property"
+  or
+  e instanceof Parameter and result = "parameter"
+  or
+  e instanceof LocalVariable and result = "local"
+  or
+  e instanceof FunctionPointerType and result = "fnptr"
+  or
+  not e instanceof Method and
+  not e instanceof Property and
+  not e instanceof Parameter and
+  not e instanceof LocalVariable and
+  not e instanceof FunctionPointerType and
+  result = "other"
+}
+
+from Element e, int i
+where cil_type_annotation(e, i)
+select e.toString(), elementType(e), i

From ab8dc27b267d479056f9cbe1a4f1cadc583c49ee Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 13 Jan 2021 17:17:41 +0100
Subject: [PATCH 246/343] Add missing 'bindingset'

---
 .../test/library-tests/cil/functionPointers/functionPointers.ql  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql
index 9dbeb467e24..ddc6671d358 100644
--- a/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql
+++ b/csharp/ql/test/library-tests/cil/functionPointers/functionPointers.ql
@@ -4,6 +4,7 @@ import semmle.code.cil.Type
 bindingset[kind]
 private string getKind(int kind) { if kind = 1 then result = "modreq" else result = "modopt" }
 
+bindingset[t, e]
 private string getAnnotatedType(Type t, Element e) {
   cil_type_annotation(e, 32) and result = t.toString() + "&"
   or

From b0e255eb16c3486f968abfcc7395cbecea47afae Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 20 Jan 2021 15:45:37 +0100
Subject: [PATCH 247/343] C++: Encapsulate skipSkippableInstructions in a
 module.

---
 .../ir/dataflow/internal/DataFlowPrivate.qll  | 30 ++----
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 98 +++++++++++--------
 2 files changed, 61 insertions(+), 67 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index d9f23d00c8d..422c63559ce 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -240,7 +240,7 @@ private predicate instrToFieldNodeStoreStepNoChi(
   exists(StoreInstruction store, PartialFieldDefinition pd |
     pd = node2.getPartialDefinition() and
     not exists(ChiInstruction chi | chi.getPartial() = store) and
-    pd.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
+    pd.getPreUpdateNode() = GetFieldNode::fromInstruction(store.getDestinationAddress()) and
     store.getSourceValueOperand() = node1.asOperand() and
     f.getADirectField() = pd.getPreUpdateNode().getField()
   )
@@ -262,7 +262,7 @@ private predicate instrToFieldNodeStoreStepChi(
     node1.asOperand() = operand and
     chi.getPartialOperand() = operand and
     store = operand.getDef() and
-    pd.getPreUpdateNode() = getFieldNodeForFieldInstruction(store.getDestinationAddress()) and
+    pd.getPreUpdateNode() = GetFieldNode::fromInstruction(store.getDestinationAddress()) and
     f.getADirectField() = pd.getPreUpdateNode().getField()
   )
 }
@@ -277,7 +277,7 @@ private predicate callableWithoutDefinitionStoreStep(
     chi.getPartial() = write and
     not chi.isResultConflated() and
     pd = node2.getPartialDefinition() and
-    pd.getPreUpdateNode() = getFieldNodeForFieldInstruction(write.getDestinationAddress()) and
+    pd.getPreUpdateNode() = GetFieldNode::fromInstruction(write.getDestinationAddress()) and
     f.getADirectField() = pd.getPreUpdateNode().getField() and
     call = write.getPrimaryInstruction() and
     callable = call.getStaticCallTarget() and
@@ -346,24 +346,6 @@ private class ArrayToPointerConvertInstruction extends ConvertInstruction {
   }
 }
 
-/**
- * These two predicates look like copy-paste from the two predicates with the same name in DataFlowUtil,
- * but crucially they only skip past `CopyValueInstruction`s. This is because we use a special case of
- * a `ConvertInstruction` to detect some read steps from arrays that undergoes array-to-pointer
- * conversion.
- */
-private Instruction skipOneCopyValueInstructionRec(CopyValueInstruction copy) {
-  copy.getUnary() = result and not result instanceof CopyValueInstruction
-  or
-  result = skipOneCopyValueInstructionRec(copy.getUnary())
-}
-
-private Instruction skipCopyValueInstructions(Operand op) {
-  not result instanceof CopyValueInstruction and result = op.getDef()
-  or
-  result = skipOneCopyValueInstructionRec(op.getDef())
-}
-
 private class InexactLoadOperand extends LoadOperand {
   InexactLoadOperand() { this.isDefinitionInexact() }
 }
@@ -407,12 +389,12 @@ private predicate instrToFieldNodeReadStep(FieldNode node1, FieldContent f, Node
     (
       exists(LoadInstruction load |
         node2.asInstruction() = load and
-        node1 = getFieldNodeForFieldInstruction(load.getSourceAddress())
+        node1 = GetFieldNode::fromInstruction(load.getSourceAddress())
       )
       or
       exists(ReadSideEffectInstruction read |
         node2.asOperand() = read.getSideEffectOperand() and
-        node1 = getFieldNodeForFieldInstruction(read.getArgumentDef())
+        node1 = GetFieldNode::fromInstruction(read.getArgumentDef())
       )
     )
   ) and
@@ -424,7 +406,7 @@ private int unbindInt(int i) { i <= result and i >= result }
 
 pragma[noinline]
 private FieldNode getFieldNodeFromLoadOperand(LoadOperand loadOperand) {
-  result = getFieldNodeForFieldInstruction(loadOperand.getAddressOperand().getDef())
+  result = GetFieldNode::fromOperand(loadOperand.getAddressOperand())
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index f7eaaf7f2e1..3608c2c68fe 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -185,54 +185,66 @@ class OperandNode extends Node, TOperandNode {
   override string toString() { result = this.getOperand().toString() }
 }
 
-/** An abstract class that defines conversion-like instructions. */
-abstract private class SkippableInstruction extends Instruction {
-  abstract Instruction getSourceInstruction();
-}
-
 /**
- * Gets the instruction that is propaged through a non-empty sequence of conversion-like instructions.
+ * INTERNAL: do not use. Encapsulates the details of getting a `FieldNode` from
+ * an `Instruction` or an `Operand`.
  */
-private Instruction skipSkippableInstructionsRec(SkippableInstruction skip) {
-  result = skip.getSourceInstruction() and not result instanceof SkippableInstruction
-  or
-  result = skipSkippableInstructionsRec(skip.getSourceInstruction())
-}
+module GetFieldNode {
+  /** An abstract class that defines conversion-like instructions. */
+  abstract private class SkippableInstruction extends Instruction {
+    abstract Instruction getSourceInstruction();
+  }
 
-/**
- * Gets the instruction that is propagated through a (possibly empty) sequence of conversion-like
- * instructions.
- */
-private Instruction skipSkippableInstructions(Instruction instr) {
-  result = instr and not result instanceof SkippableInstruction
-  or
-  result = skipSkippableInstructionsRec(instr)
-}
+  /**
+   * Gets the instruction that is propaged through a non-empty sequence of conversion-like instructions.
+   */
+  private Instruction skipSkippableInstructionsRec(SkippableInstruction skip) {
+    result = skip.getSourceInstruction() and not result instanceof SkippableInstruction
+    or
+    result = skipSkippableInstructionsRec(skip.getSourceInstruction())
+  }
 
-private class SkippableCopyValueInstruction extends SkippableInstruction, CopyValueInstruction {
-  override Instruction getSourceInstruction() { result = this.getSourceValue() }
-}
+  /**
+   * Gets the instruction that is propagated through a (possibly empty) sequence of conversion-like
+   * instructions.
+   */
+  private Instruction skipSkippableInstructions(Instruction instr) {
+    result = instr and not result instanceof SkippableInstruction
+    or
+    result = skipSkippableInstructionsRec(instr)
+  }
 
-private class SkippableConvertInstruction extends SkippableInstruction, ConvertInstruction {
-  override Instruction getSourceInstruction() { result = this.getUnary() }
-}
+  private class SkippableCopyValueInstruction extends SkippableInstruction, CopyValueInstruction {
+    override Instruction getSourceInstruction() { result = this.getSourceValue() }
+  }
 
-private class SkippableCheckedConvertInstruction extends SkippableInstruction,
-  CheckedConvertOrNullInstruction {
-  override Instruction getSourceInstruction() { result = this.getUnary() }
-}
+  private class SkippableConvertInstruction extends SkippableInstruction, ConvertInstruction {
+    override Instruction getSourceInstruction() { result = this.getUnary() }
+  }
 
-private class SkippableInheritanceConversionInstruction extends SkippableInstruction,
-  InheritanceConversionInstruction {
-  override Instruction getSourceInstruction() { result = this.getUnary() }
-}
+  private class SkippableCheckedConvertInstruction extends SkippableInstruction,
+    CheckedConvertOrNullInstruction {
+    override Instruction getSourceInstruction() { result = this.getUnary() }
+  }
 
-/**
- * INTERNAL: do not use. Gets the `FieldNode` corresponding to `instr`, if
- * `instr` is an instruction that propagates an address of a `FieldAddressInstruction`.
- */
-FieldNode getFieldNodeForFieldInstruction(Instruction instr) {
-  result.getFieldInstruction() = skipSkippableInstructions(instr)
+  private class SkippableInheritanceConversionInstruction extends SkippableInstruction,
+    InheritanceConversionInstruction {
+    override Instruction getSourceInstruction() { result = this.getUnary() }
+  }
+
+  /**
+   * INTERNAL: do not use. Gets the `FieldNode` corresponding to `instr`, if
+   * `instr` is an instruction that propagates an address of a `FieldAddressInstruction`.
+   */
+  FieldNode fromInstruction(Instruction instr) {
+    result.getFieldInstruction() = skipSkippableInstructions(instr)
+  }
+
+  /**
+   * INTERNAL: do not use. Gets the `FieldNode` corresponding to `op`, if the definition
+   * of `op` is an instruction that propagates an address of a `FieldAddressInstruction`.
+   */
+  FieldNode fromOperand(Operand op) { result = fromInstruction(op.getDef()) }
 }
 
 /**
@@ -265,7 +277,7 @@ class FieldNode extends Node, TFieldNode {
    * gives the `FieldNode` of `b`, and `f.getObjectNode().getObjectNode()` has no result as `a` is
    * not a field.
    */
-  FieldNode getObjectNode() { result = getFieldNodeForFieldInstruction(field.getObjectAddress()) }
+  FieldNode getObjectNode() { result = GetFieldNode::fromInstruction(field.getObjectAddress()) }
 
   /**
    * Gets the `FieldNode` that has this `FieldNode` as parent, if any.
@@ -683,7 +695,7 @@ private predicate flowOutOfPostUpdate(PartialDefinitionNode nodeFrom, Node nodeT
   exists(AddressOperand addressOperand, PartialFieldDefinition pd |
     pd = nodeFrom.getPartialDefinition() and
     not exists(pd.getPreUpdateNode().getObjectNode()) and
-    pd.getPreUpdateNode().getNextNode*() = getFieldNodeForFieldInstruction(addressOperand.getDef()) and
+    pd.getPreUpdateNode().getNextNode*() = GetFieldNode::fromOperand(addressOperand) and
     (
       exists(ChiInstruction chi |
         nodeTo.asInstruction() = chi and
@@ -711,7 +723,7 @@ private predicate flowOutOfPostUpdate(PartialDefinitionNode nodeFrom, Node nodeT
  */
 private FieldNode getOutermostFieldNode(Instruction address) {
   not exists(result.getObjectNode()) and
-  result.getNextNode*() = getFieldNodeForFieldInstruction(address)
+  result.getNextNode*() = GetFieldNode::fromInstruction(address)
 }
 
 private predicate flowIntoReadNode(Node nodeFrom, FieldNode nodeTo) {

From 3fc085ff38cae5de0ce9b9d776c670aed1fe9376 Mon Sep 17 00:00:00 2001
From: yoff <lerchedahl@gmail.com>
Date: Wed, 20 Jan 2021 16:11:40 +0100
Subject: [PATCH 248/343] Update
 python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
---
 python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
index eb685cc3ac1..8224a510ef1 100644
--- a/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
@@ -4,7 +4,7 @@ import TestUtilities.InlineExpectationsTest
 import experimental.dataflow.TestUtil.PrintNode
 
 /**
- * A routing test is designed to test that vlues are routed to the
+ * A routing test is designed to test that values are routed to the
  * correct arguments of the correct functions. It is assumed that
  * the functions tested sink their arguments sequentially, that is
  * `SINK1(arg1)`, etc.

From 439fe41b0afc2af6ecb0ef54c01f7749ea32f408 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 20 Jan 2021 15:33:32 +0000
Subject: [PATCH 249/343] C++: Add a couple more test cases.

---
 .../Security/CWE/CWE-401/semmle/tests/test.c  | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
index d125d85607d..514945ea91a 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
@@ -319,3 +319,28 @@ unsigned char *noBadResize_4_1(unsigned char *buffer, size_t currentSize, size_t
 
 	return buffer;
 }
+
+unsigned char * badResize_5_2(unsigned char *buffer, size_t currentSize, size_t newSize, int cond)
+{
+	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block [NOT DETECTED]
+	if (currentSize < newSize)
+	{
+		buffer = (unsigned char *)realloc(buffer, newSize);
+	}
+	if (cond)
+	{
+		abort(); // irrelevant
+	}
+	return buffer;
+}
+
+unsigned char * badResize_5_1(unsigned char *buffer, size_t currentSize, size_t newSize, int cond)
+{
+	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block [NOT DETECTED]
+	if (currentSize < newSize)
+	{
+		buffer = (unsigned char *)realloc(buffer, newSize);
+		assert(cond); // irrelevant
+	}
+	return buffer;
+}

From d5d8b482181d890b3dd555838fa52e902dbbccaa Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 20 Jan 2021 15:36:18 +0000
Subject: [PATCH 250/343] C++: More accurate solution using Guards library.

---
 .../CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql         | 7 ++++++-
 .../semmle/tests/MemoryLeakOnFailedCallToRealloc.expected  | 2 ++
 .../query-tests/Security/CWE/CWE-401/semmle/tests/test.c   | 4 ++--
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql b/cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
index d6ae493cbf5..1578bff1407 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
@@ -12,6 +12,7 @@
  */
 
 import cpp
+import semmle.code.cpp.controlflow.Guards
 
 /**
  * A function call that potentially does not return (such as `exit`).
@@ -48,7 +49,11 @@ class ReallocCallLeak extends FunctionCall {
    * example a call to `exit()`.
    */
   predicate mayHandleByTermination() {
-    this.(ControlFlowNode).getASuccessor*() instanceof CallMayNotReturn
+    exists(GuardCondition guard, CallMayNotReturn exit |
+      this.(ControlFlowNode).getASuccessor*() = guard and
+      guard.getAChild*() = v.getAnAccess() and
+      guard.controls(exit.getBasicBlock(), _)
+    )
   }
 }
 
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected
index adedc030f5f..b40e19c7559 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.expected
@@ -4,3 +4,5 @@
 | test.c:186:29:186:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
 | test.c:282:29:282:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
 | test.c:299:26:299:32 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
+| test.c:328:29:328:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
+| test.c:342:29:342:35 | call to realloc | possible loss of original pointer on unsuccessful call realloc |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
index 514945ea91a..df33fc19ef6 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c
@@ -322,7 +322,7 @@ unsigned char *noBadResize_4_1(unsigned char *buffer, size_t currentSize, size_t
 
 unsigned char * badResize_5_2(unsigned char *buffer, size_t currentSize, size_t newSize, int cond)
 {
-	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block [NOT DETECTED]
+	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
 		buffer = (unsigned char *)realloc(buffer, newSize);
@@ -336,7 +336,7 @@ unsigned char * badResize_5_2(unsigned char *buffer, size_t currentSize, size_t
 
 unsigned char * badResize_5_1(unsigned char *buffer, size_t currentSize, size_t newSize, int cond)
 {
-	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block [NOT DETECTED]
+	// BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block
 	if (currentSize < newSize)
 	{
 		buffer = (unsigned char *)realloc(buffer, newSize);

From a44aefa6c987609748edd6d00beb260ef7a8ef23 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Wed, 20 Jan 2021 14:54:39 +0100
Subject: [PATCH 251/343] add test for top-level closure modules - and simplify

---
 javascript/ql/src/semmle/javascript/PackageExports.qll   | 5 +----
 .../Performance/ReDoS/PolynomialBackTracking.expected    | 1 +
 .../Performance/ReDoS/PolynomialReDoS.expected           | 9 +++++++++
 .../ql/test/query-tests/Performance/ReDoS/lib/closure.js | 5 +++++
 .../ql/test/query-tests/Performance/ReDoS/lib/lib.js     | 4 +++-
 5 files changed, 19 insertions(+), 5 deletions(-)
 create mode 100644 javascript/ql/test/query-tests/Performance/ReDoS/lib/closure.js

diff --git a/javascript/ql/src/semmle/javascript/PackageExports.qll b/javascript/ql/src/semmle/javascript/PackageExports.qll
index 350a6301dd3..bdb0c297411 100644
--- a/javascript/ql/src/semmle/javascript/PackageExports.qll
+++ b/javascript/ql/src/semmle/javascript/PackageExports.qll
@@ -78,10 +78,7 @@ private DataFlow::Node getAValueExportedByPackage() {
 private DataFlow::Node getAnExportFromModule(Module mod) {
   result.analyze().getAValue() = mod.(NodeModule).getAModuleExportsValue()
   or
-  exists(Variable var | var = mod.(Closure::ClosureModule).getExportsVariable() |
-    result.asExpr() = var.getAReference() or
-    result.asExpr() = var.getAnAssignedExpr()
-  )
+  result = mod.(Closure::ClosureModule).getExportsVariable().getAnAssignedExpr().flow()
   or
   result.analyze().getAValue() = mod.(AmdModule).getDefine().getAModuleExportsValue()
   or
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
index fcd8c43cd7c..8452d81ee07 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialBackTracking.expected
@@ -24,6 +24,7 @@
 | highlight.js:38:54:38:59 | [^()]* | Strings starting with 'A((' and with many repetitions of ''' can start matching anywhere after the start of the preceeding [^()]* |
 | highlight.js:38:64:38:69 | [^()]* | Strings starting with 'A(' and with many repetitions of ''' can start matching anywhere after the start of the preceeding [^()]* |
 | highlight.js:39:22:39:24 | \\w* | Strings starting with 'A' and with many repetitions of 'A' can start matching anywhere after the start of the preceeding [a-zA-Z_]\\w*\\([^()]*(\\([^()]*(\\([^()]*\\)[^()]*)*\\)[^()]*)*\\)\\s*\\{ |
+| lib/closure.js:4:6:4:7 | u* | Strings with many repetitions of 'u' can start matching anywhere after the start of the preceeding u*o |
 | lib/lib.js:1:15:1:16 | a* | Strings with many repetitions of 'a' can start matching anywhere after the start of the preceeding a*b |
 | lib/lib.js:8:3:8:4 | f* | Strings with many repetitions of 'f' can start matching anywhere after the start of the preceeding f*g |
 | polynomial-redos.js:7:24:7:26 | \\s+ | Strings with many repetitions of ' ' can start matching anywhere after the start of the preceeding \\s+$ |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
index 9e5619f1aa3..d40e70d0fc6 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/PolynomialReDoS.expected
@@ -1,4 +1,8 @@
 nodes
+| lib/closure.js:3:21:3:21 | x |
+| lib/closure.js:3:21:3:21 | x |
+| lib/closure.js:4:16:4:16 | x |
+| lib/closure.js:4:16:4:16 | x |
 | lib/lib.js:3:28:3:31 | name |
 | lib/lib.js:3:28:3:31 | name |
 | lib/lib.js:4:14:4:17 | name |
@@ -150,6 +154,10 @@ nodes
 | polynomial-redos.js:124:12:124:17 | result |
 | polynomial-redos.js:124:12:124:17 | result |
 edges
+| lib/closure.js:3:21:3:21 | x | lib/closure.js:4:16:4:16 | x |
+| lib/closure.js:3:21:3:21 | x | lib/closure.js:4:16:4:16 | x |
+| lib/closure.js:3:21:3:21 | x | lib/closure.js:4:16:4:16 | x |
+| lib/closure.js:3:21:3:21 | x | lib/closure.js:4:16:4:16 | x |
 | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
 | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
 | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name |
@@ -296,6 +304,7 @@ edges
 | polynomial-redos.js:123:3:123:20 | result | polynomial-redos.js:124:12:124:17 | result |
 | polynomial-redos.js:123:13:123:20 | replaced | polynomial-redos.js:123:3:123:20 | result |
 #select
+| lib/closure.js:4:5:4:17 | /u*o/.test(x) | lib/closure.js:3:21:3:21 | x | lib/closure.js:4:16:4:16 | x | This $@ that depends on $@ may run slow on strings with many repetitions of 'u'. | lib/closure.js:4:6:4:7 | u* | regular expression | lib/closure.js:3:21:3:21 | x | library input |
 | lib/lib.js:4:2:4:18 | regexp.test(name) | lib/lib.js:3:28:3:31 | name | lib/lib.js:4:14:4:17 | name | This $@ that depends on $@ may run slow on strings with many repetitions of 'a'. | lib/lib.js:1:15:1:16 | a* | regular expression | lib/lib.js:3:28:3:31 | name | library input |
 | lib/lib.js:8:2:8:17 | /f*g/.test(name) | lib/lib.js:7:19:7:22 | name | lib/lib.js:8:13:8:16 | name | This $@ that depends on $@ may run slow on strings with many repetitions of 'f'. | lib/lib.js:8:3:8:4 | f* | regular expression | lib/lib.js:7:19:7:22 | name | library input |
 | polynomial-redos.js:7:2:7:34 | tainted ... /g, '') | polynomial-redos.js:5:16:5:32 | req.query.tainted | polynomial-redos.js:7:2:7:8 | tainted | This $@ that depends on $@ may run slow on strings with many repetitions of ' '. | polynomial-redos.js:7:24:7:26 | \\s+ | regular expression | polynomial-redos.js:5:16:5:32 | req.query.tainted | a user-provided value |
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/lib/closure.js b/javascript/ql/test/query-tests/Performance/ReDoS/lib/closure.js
new file mode 100644
index 00000000000..4f5ca816870
--- /dev/null
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/lib/closure.js
@@ -0,0 +1,5 @@
+goog.module('x.y.z.closure2');
+
+exports = function (x) {
+    /u*o/.test(x); // NOT OK
+}
\ No newline at end of file
diff --git a/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js b/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js
index 47fc928845b..d18f43078c3 100644
--- a/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js
+++ b/javascript/ql/test/query-tests/Performance/ReDoS/lib/lib.js
@@ -10,4 +10,6 @@ function bar(reg, name) {
 
 if (typeof define !== 'undefined' && define.amd) { // AMD
     define([], function () {return bar});
-}
\ No newline at end of file
+}
+
+module.exports.closure = require("./closure")
\ No newline at end of file

From 2409a7899bc16854377f65b99c1c5bf2eb4627bf Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 20 Jan 2021 20:18:40 +0100
Subject: [PATCH 252/343] Python: Remove func tag in some situations. Also make
 ArgumentNode public

---
 .../dataflow/new/internal/DataFlowPrivate.qll  | 11 -----------
 .../dataflow/new/internal/DataFlowPublic.qll   | 11 +++++++++++
 .../dataflow/TestUtil/RoutingTest.qll          | 13 ++++++++++++-
 .../dataflow/coverage/argumentPassing.py       | 18 +++++++++---------
 .../experimental/dataflow/coverage/test.py     |  2 +-
 5 files changed, 33 insertions(+), 22 deletions(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
index 4842b670cbd..570c0396037 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
@@ -703,17 +703,6 @@ class SpecialCall extends DataFlowCall, TSpecialCall {
   }
 }
 
-/** A data flow node that represents a call argument. */
-class ArgumentNode extends Node {
-  ArgumentNode() { this = any(DataFlowCall c).getArg(_) }
-
-  /** Holds if this argument occurs at the given position in the given call. */
-  predicate argumentOf(DataFlowCall call, int pos) { this = call.getArg(pos) }
-
-  /** Gets the call in which this node is an argument. */
-  final DataFlowCall getCall() { this.argumentOf(result, _) }
-}
-
 /** Gets a viable run-time target for the call `call`. */
 DataFlowCallable viableCallable(DataFlowCall call) { result = call.getCallable() }
 
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
index 4d49806fe12..edb550872f5 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -193,6 +193,17 @@ class ParameterNode extends CfgNode {
   Parameter getParameter() { result = def.getParameter() }
 }
 
+/** A data flow node that represents a call argument. */
+class ArgumentNode extends Node {
+  ArgumentNode() { this = any(DataFlowCall c).getArg(_) }
+
+  /** Holds if this argument occurs at the given position in the given call. */
+  predicate argumentOf(DataFlowCall call, int pos) { this = call.getArg(pos) }
+
+  /** Gets the call in which this node is an argument. */
+  final DataFlowCall getCall() { this.argumentOf(result, _) }
+}
+
 /**
  * A node associated with an object after an operation that might have
  * changed its state.
diff --git a/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
index 8224a510ef1..05fd7241c41 100644
--- a/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
@@ -28,8 +28,19 @@ abstract class RoutingTest extends InlineExpectationsTest {
         value = "\"" + prettyNode(fromNode).replaceAll("\"", "'") + "\""
         or
         tag = "func" and
-        value = toNode.getEnclosingCallable().getCallableValue().getScope().getQualifiedName() // TODO: More robust pretty printing?
+        not fromFunc(fromNode) = toFunc(toNode) and
+        value = toFunc(toNode)
       )
     )
   }
+
+  pragma[inline]
+  private string fromFunc(DataFlow::ArgumentNode fromNode) {
+    result = fromNode.getCall().getNode().(CallNode).getFunction().getNode().(Name).getId()
+  }
+
+  pragma[inline]
+  private string toFunc(DataFlow::Node toNode) {
+    result = toNode.getEnclosingCallable().getCallableValue().getScope().getQualifiedName() // TODO: More robust pretty printing?
+  }
 }
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
index db19860a901..56b4b2a66a3 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
+++ b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
@@ -91,7 +91,7 @@ def test_argument_passing1():
 
 @expects(7)
 def test_argument_passing2():
-    argument_passing(arg1, arg2, arg3, f=arg6)  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=argument_passing
+    argument_passing(arg1, arg2, arg3, f=arg6)  #$ arg1="arg1" arg2="arg2" arg3="arg3"
 
 
 def with_pos_only(a, /, b):
@@ -101,9 +101,9 @@ def with_pos_only(a, /, b):
 
 @expects(6)
 def test_pos_only():
-    with_pos_only(arg1, arg2)  #$ arg1="arg1" arg2="arg2" func=with_pos_only
-    with_pos_only(arg1, b=arg2)  #$ arg1="arg1" arg2="arg2" func=with_pos_only
-    with_pos_only(arg1, *(arg2,))  #$ arg1="arg1" func=with_pos_only MISSING: arg2="arg2"
+    with_pos_only(arg1, arg2)  #$ arg1="arg1" arg2="arg2"
+    with_pos_only(arg1, b=arg2)  #$ arg1="arg1" arg2="arg2"
+    with_pos_only(arg1, *(arg2,))  #$ arg1="arg1" MISSING: arg2="arg2"
 
 
 def with_multiple_kw_args(a, b, c):
@@ -114,8 +114,8 @@ def with_multiple_kw_args(a, b, c):
 
 @expects(12)
 def test_multiple_kw_args():
-    with_multiple_kw_args(b=arg2, c=arg3, a=arg1)  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=with_multiple_kw_args
-    with_multiple_kw_args(arg1, *(arg2,), arg3)  #$ arg1="arg1" func=with_multiple_kw_args MISSING: arg2="arg2" arg3="arg3"
+    with_multiple_kw_args(b=arg2, c=arg3, a=arg1)  #$ arg1="arg1" arg2="arg2" arg3="arg3"
+    with_multiple_kw_args(arg1, *(arg2,), arg3)  #$ arg1="arg1" MISSING: arg2="arg2" arg3="arg3"
     with_multiple_kw_args(arg1, **{"c": arg3}, b=arg2)  #$ arg1="arg1" arg3="arg3" func=with_multiple_kw_args MISSING: arg2="arg2"
     with_multiple_kw_args(**{"b": arg2}, **{"c": arg3}, **{"a": arg1})  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=with_multiple_kw_args
 
@@ -129,8 +129,8 @@ def with_default_arguments(a=arg1, b=arg2, c=arg3):  # Need a mechanism to test
 @expects(12)
 def test_default_arguments():
     with_default_arguments()
-    with_default_arguments(arg1)  #$ arg1="arg1" func=with_default_arguments
-    with_default_arguments(b=arg2)  #$ arg2="arg2" func=with_default_arguments
+    with_default_arguments(arg1)  #$ arg1="arg1"
+    with_default_arguments(b=arg2)  #$ arg2="arg2"
     with_default_arguments(**{"c": arg3})  #$ arg3="arg3" func=with_default_arguments
 
 
@@ -157,7 +157,7 @@ def grab_baz(baz):
 
 @expects(4)
 def test_grab():
-    grab_foo_bar_baz(baz=arg3, bar=arg2, foo=arg1)  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=grab_foo_bar_baz func=grab_bar_baz func=grab_baz
+    grab_foo_bar_baz(baz=arg3, bar=arg2, foo=arg1)  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=grab_bar_baz func=grab_baz
 
 
 # All combinations
diff --git a/python/ql/test/experimental/dataflow/coverage/test.py b/python/ql/test/experimental/dataflow/coverage/test.py
index bc328a6d9a6..9b55a7c02d7 100644
--- a/python/ql/test/experimental/dataflow/coverage/test.py
+++ b/python/ql/test/experimental/dataflow/coverage/test.py
@@ -590,4 +590,4 @@ def return_from_inner_scope(x):
         return SOURCE
 
 def test_return_from_inner_scope():
-    SINK(return_from_inner_scope([]))
+    SINK(return_from_inner_scope([]))  #$ flow="SOURCE, l:-3 -> return_from_inner_scope(..)"

From 419449fb8a3d6a9eec0088fb6e3a5c9372052276 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Wed, 20 Jan 2021 20:33:04 +0100
Subject: [PATCH 253/343] Python: default value for argN

---
 .../dataflow/TestUtil/RoutingTest.qll         |  11 +-
 .../dataflow/coverage/argumentPassing.py      |  40 +++---
 .../experimental/dataflow/coverage/classes.py | 130 +++++++++---------
 3 files changed, 93 insertions(+), 88 deletions(-)

diff --git a/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
index 05fd7241c41..03f4f8056eb 100644
--- a/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll
@@ -25,15 +25,20 @@ abstract class RoutingTest extends InlineExpectationsTest {
       element = fromNode.toString() and
       (
         tag = this.flowTag() and
-        value = "\"" + prettyNode(fromNode).replaceAll("\"", "'") + "\""
+        if "\"" + tag + "\"" = fromValue(fromNode) then value = "" else value = fromValue(fromNode)
         or
         tag = "func" and
-        not fromFunc(fromNode) = toFunc(toNode) and
-        value = toFunc(toNode)
+        value = toFunc(toNode) and
+        not value = fromFunc(fromNode)
       )
     )
   }
 
+  pragma[inline]
+  private string fromValue(DataFlow::Node fromNode) {
+    result = "\"" + prettyNode(fromNode).replaceAll("\"", "'") + "\""
+  }
+
   pragma[inline]
   private string fromFunc(DataFlow::ArgumentNode fromNode) {
     result = fromNode.getCall().getNode().(CallNode).getFunction().getNode().(Name).getId()
diff --git a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
index 56b4b2a66a3..cbbac6c0d68 100644
--- a/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
+++ b/python/ql/test/experimental/dataflow/coverage/argumentPassing.py
@@ -86,12 +86,12 @@ def argument_passing(
 
 @expects(7)
 def test_argument_passing1():
-    argument_passing(arg1, *(arg2, arg3, arg4), e=arg5, **{"f": arg6, "g": arg7})  #$ arg1="arg1" arg7="arg7" func=argument_passing MISSING: arg2="arg2" arg3="arg3 arg4="arg4" arg5="arg5" arg6="arg6"
+    argument_passing(arg1, *(arg2, arg3, arg4), e=arg5, **{"f": arg6, "g": arg7})  #$ arg1 arg7 func=argument_passing MISSING: arg2 arg3="arg3 arg4 arg5 arg6
 
 
 @expects(7)
 def test_argument_passing2():
-    argument_passing(arg1, arg2, arg3, f=arg6)  #$ arg1="arg1" arg2="arg2" arg3="arg3"
+    argument_passing(arg1, arg2, arg3, f=arg6)  #$ arg1 arg2 arg3
 
 
 def with_pos_only(a, /, b):
@@ -101,9 +101,9 @@ def with_pos_only(a, /, b):
 
 @expects(6)
 def test_pos_only():
-    with_pos_only(arg1, arg2)  #$ arg1="arg1" arg2="arg2"
-    with_pos_only(arg1, b=arg2)  #$ arg1="arg1" arg2="arg2"
-    with_pos_only(arg1, *(arg2,))  #$ arg1="arg1" MISSING: arg2="arg2"
+    with_pos_only(arg1, arg2)  #$ arg1 arg2
+    with_pos_only(arg1, b=arg2)  #$ arg1 arg2
+    with_pos_only(arg1, *(arg2,))  #$ arg1 MISSING: arg2
 
 
 def with_multiple_kw_args(a, b, c):
@@ -114,10 +114,10 @@ def with_multiple_kw_args(a, b, c):
 
 @expects(12)
 def test_multiple_kw_args():
-    with_multiple_kw_args(b=arg2, c=arg3, a=arg1)  #$ arg1="arg1" arg2="arg2" arg3="arg3"
-    with_multiple_kw_args(arg1, *(arg2,), arg3)  #$ arg1="arg1" MISSING: arg2="arg2" arg3="arg3"
-    with_multiple_kw_args(arg1, **{"c": arg3}, b=arg2)  #$ arg1="arg1" arg3="arg3" func=with_multiple_kw_args MISSING: arg2="arg2"
-    with_multiple_kw_args(**{"b": arg2}, **{"c": arg3}, **{"a": arg1})  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=with_multiple_kw_args
+    with_multiple_kw_args(b=arg2, c=arg3, a=arg1)  #$ arg1 arg2 arg3
+    with_multiple_kw_args(arg1, *(arg2,), arg3)  #$ arg1 MISSING: arg2 arg3
+    with_multiple_kw_args(arg1, **{"c": arg3}, b=arg2)  #$ arg1 arg3 func=with_multiple_kw_args MISSING: arg2
+    with_multiple_kw_args(**{"b": arg2}, **{"c": arg3}, **{"a": arg1})  #$ arg1 arg2 arg3 func=with_multiple_kw_args
 
 
 def with_default_arguments(a=arg1, b=arg2, c=arg3):  # Need a mechanism to test default arguments
@@ -129,9 +129,9 @@ def with_default_arguments(a=arg1, b=arg2, c=arg3):  # Need a mechanism to test
 @expects(12)
 def test_default_arguments():
     with_default_arguments()
-    with_default_arguments(arg1)  #$ arg1="arg1"
-    with_default_arguments(b=arg2)  #$ arg2="arg2"
-    with_default_arguments(**{"c": arg3})  #$ arg3="arg3" func=with_default_arguments
+    with_default_arguments(arg1)  #$ arg1
+    with_default_arguments(b=arg2)  #$ arg2
+    with_default_arguments(**{"c": arg3})  #$ arg3 func=with_default_arguments
 
 
 # Nested constructor pattern
@@ -157,7 +157,7 @@ def grab_baz(baz):
 
 @expects(4)
 def test_grab():
-    grab_foo_bar_baz(baz=arg3, bar=arg2, foo=arg1)  #$ arg1="arg1" arg2="arg2" arg3="arg3" func=grab_bar_baz func=grab_baz
+    grab_foo_bar_baz(baz=arg3, bar=arg2, foo=arg1)  #$ arg1 arg2 arg3 func=grab_bar_baz func=grab_baz
 
 
 # All combinations
@@ -165,14 +165,14 @@ def test_pos_pos():
     def with_pos(a):
         SINK1(a)
 
-    with_pos(arg1)  #$ arg1="arg1" func=test_pos_pos.with_pos
+    with_pos(arg1)  #$ arg1 func=test_pos_pos.with_pos
 
 
 def test_pos_pos_only():
     def with_pos_only(a, /):
         SINK1(a)
 
-    with_pos_only(arg1)  #$ arg1="arg1" func=test_pos_pos_only.with_pos_only
+    with_pos_only(arg1)  #$ arg1 func=test_pos_pos_only.with_pos_only
 
 
 def test_pos_star():
@@ -180,32 +180,32 @@ def test_pos_star():
         if len(a) > 0:
             SINK1(a[0])
 
-    with_star(arg1)  #$ arg1="arg1" func=test_pos_star.with_star
+    with_star(arg1)  #$ arg1 func=test_pos_star.with_star
 
 
 def test_pos_kw():
     def with_kw(a=""):
         SINK1(a)
 
-    with_kw(arg1)  #$ arg1="arg1" func=test_pos_kw.with_kw
+    with_kw(arg1)  #$ arg1 func=test_pos_kw.with_kw
 
 
 def test_kw_pos():
     def with_pos(a):
         SINK1(a)
 
-    with_pos(a=arg1)  #$ arg1="arg1" func=test_kw_pos.with_pos
+    with_pos(a=arg1)  #$ arg1 func=test_kw_pos.with_pos
 
 
 def test_kw_kw():
     def with_kw(a=""):
         SINK1(a)
 
-    with_kw(a=arg1)  #$ arg1="arg1" func=test_kw_kw.with_kw
+    with_kw(a=arg1)  #$ arg1 func=test_kw_kw.with_kw
 
 
 def test_kw_doublestar():
     def with_doublestar(**a):
         SINK1(a["a"])
 
-    with_doublestar(a=arg1)  #$ arg1="arg1" func=test_kw_doublestar.with_doublestar
+    with_doublestar(a=arg1)  #$ arg1 func=test_kw_doublestar.with_doublestar
diff --git a/python/ql/test/experimental/dataflow/coverage/classes.py b/python/ql/test/experimental/dataflow/coverage/classes.py
index d9586f4997f..cf55681c40a 100644
--- a/python/ql/test/experimental/dataflow/coverage/classes.py
+++ b/python/ql/test/experimental/dataflow/coverage/classes.py
@@ -122,7 +122,7 @@ class With_format:
 
 def test_format():
     with_format = With_format()  #$ MISSING: arg1="SSA variable with_format" func=With_format.__format__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_format.__format__
+    arg2 = ""  #$ MISSING: arg2 func=With_format.__format__
     format(with_format, arg2)
 
 
@@ -147,7 +147,7 @@ class With_lt:
 
 def test_lt():
     with_lt = With_lt()  #$ MISSING: arg1="SSA variable with_lt" func=With_lt.__lt__
-    arg2 = with_lt  #$ MISSING: arg2="arg2" func=With_lt.__lt__
+    arg2 = with_lt  #$ MISSING: arg2 func=With_lt.__lt__
     with_lt < arg2
 
 
@@ -162,7 +162,7 @@ class With_le:
 
 def test_le():
     with_le = With_le()  #$ MISSING: arg1="SSA variable with_le" func=With_le.__le__
-    arg2 = with_le  #$ MISSING: arg2="arg2" func=With_le.__le__
+    arg2 = with_le  #$ MISSING: arg2 func=With_le.__le__
     with_le <= arg2
 
 
@@ -205,7 +205,7 @@ class With_gt:
 
 def test_gt():
     with_gt = With_gt()  #$ MISSING: arg1="SSA variable with_gt" func=With_gt.__gt__
-    arg2 = with_gt  #$ MISSING: arg2="arg2" func=With_gt.__gt__
+    arg2 = with_gt  #$ MISSING: arg2 func=With_gt.__gt__
     with_gt > arg2
 
 
@@ -220,7 +220,7 @@ class With_ge:
 
 def test_ge():
     with_ge = With_ge()  #$ MISSING: arg1="SSA variable with_ge" func=With_ge.__ge__
-    arg2 = with_ge  #$ MISSING: arg2="arg2" func=With_ge.__ge__
+    arg2 = with_ge  #$ MISSING: arg2 func=With_ge.__ge__
     with_ge >= arg2
 
 
@@ -297,7 +297,7 @@ class With_getattribute:
 
 def test_getattribute():
     with_getattribute = With_getattribute()  #$ MISSING: arg1="SSA variable with_getattribute" func=With_getattribute.__getattribute__
-    with_getattribute.arg2  #$ MISSING: arg2="arg2" func=With_getattribute.__getattribute__
+    with_getattribute.arg2  #$ MISSING: arg2 func=With_getattribute.__getattribute__
 
 
 # object.__setattr__(self, name, value)
@@ -311,8 +311,8 @@ class With_setattr:
 
 def test_setattr():
     with_setattr = With_setattr()  #$ MISSING: arg1="SSA variable with_setattr" func=With_setattr.__setattr__
-    arg3 = ""  #$ MISSING: arg3="arg3" func=With_setattr.__setattr__
-    with_setattr.arg2 = arg3  #$ MISSING: arg2="arg2" func=With_setattr.__setattr__
+    arg3 = ""  #$ MISSING: arg3 func=With_setattr.__setattr__
+    with_setattr.arg2 = arg3  #$ MISSING: arg2 func=With_setattr.__setattr__
 
 
 # object.__delattr__(self, name)
@@ -325,7 +325,7 @@ class With_delattr:
 
 def test_delattr():
     with_delattr = With_delattr()  #$ MISSING: arg1="SSA variable with_delattr" func=With_delattr.__delattr__
-    del with_delattr.arg2  #$ MISSING: arg2="arg2" func=With_delattr.__delattr__
+    del with_delattr.arg2  #$ MISSING: arg2 func=With_delattr.__delattr__
 
 
 # object.__dir__(self)
@@ -362,7 +362,7 @@ def test_get():
 
     with_get = With_get()  #$ MISSING: arg1="SSA variable with_get" func=With_get.__get__
     arg3.attr = with_get
-    arg2 = arg3()  #$ MISSING: arg2="arg2" func=With_get.__get__
+    arg2 = arg3()  #$ MISSING: arg2 func=With_get.__get__
     arg2.attr
 
 
@@ -378,8 +378,8 @@ class With_set:
 def test_set():
     with_set = With_set()  #$ MISSING: arg1="SSA variable with_set" func=With_set.__set__
     Owner.attr = with_set
-    arg2 = Owner()  #$ MISSING: arg2="arg2" func=With_set.__set__
-    arg3 = ""  #$ MISSING: arg3="arg3" func=With_set.__set__
+    arg2 = Owner()  #$ MISSING: arg2 func=With_set.__set__
+    arg3 = ""  #$ MISSING: arg3 func=With_set.__set__
     arg2.attr = arg3
 
 
@@ -394,7 +394,7 @@ class With_delete:
 def test_delete():
     with_delete = With_delete()  #$ MISSING: arg1="SSA variable with_delete" func=With_delete.__delete__
     Owner.attr = with_delete
-    arg2 = Owner()  #$ MISSING: arg2="arg2" func=With_delete.__delete__
+    arg2 = Owner()  #$ MISSING: arg2 func=With_delete.__delete__
     del arg2.attr
 
 
@@ -409,7 +409,7 @@ class With_set_name:
 
 def test_set_name():
     with_set_name = With_set_name()  #$ MISSING: arg1="SSA variable with_set_name" func=With_set_name.__set_name__
-    type("arg2", (object,), dict(arg3=with_set_name))  #$ MISSING: arg2="arg2" arg3="arg3" func=With_set_name.__set_name__
+    type("arg2", (object,), dict(arg3=with_set_name))  #$ MISSING: arg2 arg3 func=With_set_name.__set_name__
 
 
 # 3.3.2.4. __slots__   // We are not testing the  suppression of __weakref__ and __dict__ here
@@ -463,7 +463,7 @@ class With_instancecheck:
 
 def test_instancecheck():
     with_instancecheck = With_instancecheck()  #$ MISSING: arg1="SSA variable with_instancecheck" func=With_instancecheck.__instancecheck__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_instancecheck.__instancecheck__
+    arg2 = ""  #$ MISSING: arg2 func=With_instancecheck.__instancecheck__
     isinstance(arg2, with_instancecheck)
 
 
@@ -478,7 +478,7 @@ class With_subclasscheck:
 
 def test_subclasscheck():
     with_subclasscheck = With_subclasscheck()  #$ MISSING: arg1="SSA variable with_subclasscheck" func=With_subclasscheck.__subclasscheck__
-    arg2 = object  #$ MISSING: arg2="arg2" func=With_subclasscheck.__subclasscheck__
+    arg2 = object  #$ MISSING: arg2 func=With_subclasscheck.__subclasscheck__
     issubclass(arg2, with_subclasscheck)
 
 
@@ -493,7 +493,7 @@ class With_class_getitem:  #$ MISSING: arg1="With_class_getitem" func=With_class
 
 
 def test_class_getitem():
-    arg2 = int  #$ MISSING: arg2="arg2" func=With_class_getitem.__class_getitem__
+    arg2 = int  #$ MISSING: arg2 func=With_class_getitem.__class_getitem__
     with_class_getitem = With_class_getitem[arg2]()
 
 
@@ -562,7 +562,7 @@ class With_getitem:
 def test_getitem():
     with_getitem = With_getitem() #$ arg1="SSA variable with_getitem" func=With_getitem.__getitem__
     arg2 = 0
-    with_getitem[arg2] #$ arg2="arg2" func=With_getitem.__getitem__
+    with_getitem[arg2] #$ arg2 func=With_getitem.__getitem__
 
 
 # object.__setitem__(self, key, value)
@@ -578,7 +578,7 @@ def test_setitem():
     with_setitem = With_setitem()  #$ arg1="SSA variable with_setitem" func=With_setitem.__setitem__
     arg2 = 0
     arg3 = ""
-    with_setitem[arg2] = arg3  #$ arg2="arg2" arg3="arg3" func=With_setitem.__setitem__
+    with_setitem[arg2] = arg3  #$ arg2 arg3 func=With_setitem.__setitem__
 
 
 # object.__delitem__(self, key)
@@ -592,7 +592,7 @@ class With_delitem:
 def test_delitem():
     with_delitem = With_delitem()  #$ arg1="SSA variable with_delitem" func=With_delitem.__delitem__
     arg2 = 0
-    del with_delitem[arg2]  #$ arg2="arg2" func=With_delitem.__delitem__
+    del with_delitem[arg2]  #$ arg2 func=With_delitem.__delitem__
 
 
 # object.__missing__(self, key)
@@ -606,7 +606,7 @@ class With_missing(dict):
 
 def test_missing():
     with_missing = With_missing()  #$ MISSING: arg1="SSA variable with_missing" func=With_missing.__missing__
-    arg2 = 0  #$ MISSING: arg2="arg2" func=With_missing.__missing__
+    arg2 = 0  #$ MISSING: arg2 func=With_missing.__missing__
     with_missing[arg2]
 
 
@@ -647,7 +647,7 @@ class With_contains:
 
 def test_contains():
     with_contains = With_contains()  #$ MISSING: arg1="SSA variable with_contains" func=With_contains.__contains__
-    arg2 = 0  #$ MISSING: arg2="arg2" func=With_contains.__contains__
+    arg2 = 0  #$ MISSING: arg2 func=With_contains.__contains__
     arg2 in with_contains
 
 
@@ -664,7 +664,7 @@ class With_add:
 def test_add():
     with_add = With_add()  #$ arg1="SSA variable with_add" func=With_add.__add__
     arg2 = with_add
-    with_add + arg2  #$ arg2="arg2" func=With_add.__add__
+    with_add + arg2  #$ arg2 func=With_add.__add__
 
 
 # object.__sub__(self, other)
@@ -679,7 +679,7 @@ class With_sub:
 def test_sub():
     with_sub = With_sub()  #$ arg1="SSA variable with_sub" func=With_sub.__sub__
     arg2 = with_sub
-    with_sub - arg2  #$ arg2="arg2" func=With_sub.__sub__
+    with_sub - arg2  #$ arg2 func=With_sub.__sub__
 
 
 # object.__mul__(self, other)
@@ -694,7 +694,7 @@ class With_mul:
 def test_mul():
     with_mul = With_mul()  #$ arg1="SSA variable with_mul" func=With_mul.__mul__
     arg2 = with_mul
-    with_mul * arg2  #$ arg2="arg2" func=With_mul.__mul__
+    with_mul * arg2  #$ arg2 func=With_mul.__mul__
 
 
 # object.__matmul__(self, other)
@@ -709,7 +709,7 @@ class With_matmul:
 def test_matmul():
     with_matmul = With_matmul()  #$ arg1="SSA variable with_matmul" func=With_matmul.__matmul__
     arg2 = with_matmul
-    with_matmul @ arg2  #$ arg2="arg2" func=With_matmul.__matmul__
+    with_matmul @ arg2  #$ arg2 func=With_matmul.__matmul__
 
 
 # object.__truediv__(self, other)
@@ -724,7 +724,7 @@ class With_truediv:
 def test_truediv():
     with_truediv = With_truediv()  #$ arg1="SSA variable with_truediv" func=With_truediv.__truediv__
     arg2 = with_truediv
-    with_truediv / arg2  #$ arg2="arg2" func=With_truediv.__truediv__
+    with_truediv / arg2  #$ arg2 func=With_truediv.__truediv__
 
 
 # object.__floordiv__(self, other)
@@ -739,7 +739,7 @@ class With_floordiv:
 def test_floordiv():
     with_floordiv = With_floordiv()  #$ arg1="SSA variable with_floordiv" func=With_floordiv.__floordiv__
     arg2 = with_floordiv
-    with_floordiv // arg2  #$ arg2="arg2" func=With_floordiv.__floordiv__
+    with_floordiv // arg2  #$ arg2 func=With_floordiv.__floordiv__
 
 
 # object.__mod__(self, other)
@@ -754,7 +754,7 @@ class With_mod:
 def test_mod():
     with_mod = With_mod()  #$ arg1="SSA variable with_mod" func=With_mod.__mod__
     arg2 = with_mod
-    with_mod % arg2  #$ arg2="arg2" func=With_mod.__mod__
+    with_mod % arg2  #$ arg2 func=With_mod.__mod__
 
 
 # object.__divmod__(self, other)
@@ -768,7 +768,7 @@ class With_divmod:
 
 def test_divmod():
     with_divmod = With_divmod()  #$ MISSING: arg1="SSA variable with_divmod" func=With_divmod.__divmod__
-    arg2 = With_divmod  #$ MISSING: arg2="arg2" func=With_divmod.__divmod__
+    arg2 = With_divmod  #$ MISSING: arg2 func=With_divmod.__divmod__
     divmod(with_divmod, arg2)
 
 
@@ -784,13 +784,13 @@ class With_pow:
 def test_pow():
     with_pow = With_pow()  #$ MISSING: arg1="SSA variable with_pow" func=With_pow.__pow__
     arg2 = with_pow
-    pow(with_pow, arg2)  #$ MISSING: arg2="arg2" func=With_pow.__pow__
+    pow(with_pow, arg2)  #$ MISSING: arg2 func=With_pow.__pow__
 
 
 def test_pow_op():
     with_pow = With_pow()  #$ arg1="SSA variable with_pow" func=With_pow.__pow__
     arg2 = with_pow
-    with_pow ** arg2  #$ arg2="arg2" func=With_pow.__pow__
+    with_pow ** arg2  #$ arg2 func=With_pow.__pow__
 
 
 # object.__lshift__(self, other)
@@ -805,7 +805,7 @@ class With_lshift:
 def test_lshift():
     with_lshift = With_lshift()  #$ arg1="SSA variable with_lshift" func=With_lshift.__lshift__
     arg2 = with_lshift
-    with_lshift << arg2  #$ arg2="arg2" func=With_lshift.__lshift__
+    with_lshift << arg2  #$ arg2 func=With_lshift.__lshift__
 
 
 # object.__rshift__(self, other)
@@ -820,7 +820,7 @@ class With_rshift:
 def test_rshift():
     with_rshift = With_rshift()  #$ arg1="SSA variable with_rshift" func=With_rshift.__rshift__
     arg2 = with_rshift
-    with_rshift >> arg2  #$ arg2="arg2" func=With_rshift.__rshift__
+    with_rshift >> arg2  #$ arg2 func=With_rshift.__rshift__
 
 
 # object.__and__(self, other)
@@ -835,7 +835,7 @@ class With_and:
 def test_and():
     with_and = With_and()  #$ arg1="SSA variable with_and" func=With_and.__and__
     arg2 = with_and
-    with_and & arg2  #$ arg2="arg2" func=With_and.__and__
+    with_and & arg2  #$ arg2 func=With_and.__and__
 
 
 # object.__xor__(self, other)
@@ -850,7 +850,7 @@ class With_xor:
 def test_xor():
     with_xor = With_xor()  #$ arg1="SSA variable with_xor" func=With_xor.__xor__
     arg2 = with_xor
-    with_xor ^ arg2  #$ arg2="arg2" func=With_xor.__xor__
+    with_xor ^ arg2  #$ arg2 func=With_xor.__xor__
 
 
 # object.__or__(self, other)
@@ -865,7 +865,7 @@ class With_or:
 def test_or():
     with_or = With_or()  #$ arg1="SSA variable with_or" func=With_or.__or__
     arg2 = with_or
-    with_or | arg2  #$ arg2="arg2" func=With_or.__or__
+    with_or | arg2  #$ arg2 func=With_or.__or__
 
 
 # object.__radd__(self, other)
@@ -879,7 +879,7 @@ class With_radd:
 
 def test_radd():
     with_radd = With_radd()  #$ MISSING: arg1="SSA variable with_radd" func=With_radd.__radd__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_radd.__radd__
+    arg2 = ""  #$ MISSING: arg2 func=With_radd.__radd__
     arg2 + with_radd
 
 
@@ -894,7 +894,7 @@ class With_rsub:
 
 def test_rsub():
     with_rsub = With_rsub()  #$ MISSING: arg1="SSA variable with_rsub" func=With_rsub.__rsub__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rsub.__rsub__
+    arg2 = ""  #$ MISSING: arg2 func=With_rsub.__rsub__
     arg2 - with_rsub
 
 
@@ -909,7 +909,7 @@ class With_rmul:
 
 def test_rmul():
     with_rmul = With_rmul()  #$ MISSING: arg1="SSA variable with_rmul" func=With_rmul.__rmul__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rmul.__rmul__
+    arg2 = ""  #$ MISSING: arg2 func=With_rmul.__rmul__
     arg2 * with_rmul
 
 
@@ -924,7 +924,7 @@ class With_rmatmul:
 
 def test_rmatmul():
     with_rmatmul = With_rmatmul()  #$ MISSING: arg1="SSA variable with_rmatmul" func=With_rmatmul.__rmatmul__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rmatmul.__rmatmul__
+    arg2 = ""  #$ MISSING: arg2 func=With_rmatmul.__rmatmul__
     arg2 @ with_rmatmul
 
 
@@ -939,7 +939,7 @@ class With_rtruediv:
 
 def test_rtruediv():
     with_rtruediv = With_rtruediv()  #$ MISSING: arg1="SSA variable with_rtruediv" func=With_rtruediv.__rtruediv__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rtruediv.__rtruediv__
+    arg2 = ""  #$ MISSING: arg2 func=With_rtruediv.__rtruediv__
     arg2 / with_rtruediv
 
 
@@ -954,7 +954,7 @@ class With_rfloordiv:
 
 def test_rfloordiv():
     with_rfloordiv = With_rfloordiv()  #$ MISSING: arg1="SSA variable with_rfloordiv" func=With_rfloordiv.__rfloordiv__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rfloordiv.__rfloordiv__
+    arg2 = ""  #$ MISSING: arg2 func=With_rfloordiv.__rfloordiv__
     arg2 // with_rfloordiv
 
 
@@ -969,7 +969,7 @@ class With_rmod:
 
 def test_rmod():
     with_rmod = With_rmod()  #$ MISSING: arg1="SSA variable with_rmod" func=With_rmod.__rmod__
-    arg2 = {}  #$ MISSING: arg2="arg2" func=With_rmod.__rmod__
+    arg2 = {}  #$ MISSING: arg2 func=With_rmod.__rmod__
     arg2 % with_rmod
 
 
@@ -984,7 +984,7 @@ class With_rdivmod:
 
 def test_rdivmod():
     with_rdivmod = With_rdivmod()  #$ MISSING: arg1="SSA variable with_rdivmod" func=With_rdivmod.__rdivmod__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rdivmod.__rdivmod__
+    arg2 = ""  #$ MISSING: arg2 func=With_rdivmod.__rdivmod__
     divmod(arg2, with_rdivmod)
 
 
@@ -999,13 +999,13 @@ class With_rpow:
 
 def test_rpow():
     with_rpow = With_rpow()  #$ MISSING: arg1="SSA variable with_rpow" func=With_rpow.__rpow__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rpow.__rpow__
+    arg2 = ""  #$ MISSING: arg2 func=With_rpow.__rpow__
     pow(arg2, with_rpow)
 
 
 def test_rpow_op():
     with_rpow = With_rpow()  #$ MISSING: arg1="SSA variable with_rpow" func=With_rpow.__rpow__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rpow.__rpow__
+    arg2 = ""  #$ MISSING: arg2 func=With_rpow.__rpow__
     arg2 ** with_rpow
 
 
@@ -1020,7 +1020,7 @@ class With_rlshift:
 
 def test_rlshift():
     with_rlshift = With_rlshift()  #$ MISSING: arg1="SSA variable with_rlshift" func=With_rlshift.__rlshift__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rlshift.__rlshift__
+    arg2 = ""  #$ MISSING: arg2 func=With_rlshift.__rlshift__
     arg2 << with_rlshift
 
 
@@ -1035,7 +1035,7 @@ class With_rrshift:
 
 def test_rrshift():
     with_rrshift = With_rrshift()  #$ MISSING: arg1="SSA variable with_rrshift" func=With_rrshift.__rrshift__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rrshift.__rrshift__
+    arg2 = ""  #$ MISSING: arg2 func=With_rrshift.__rrshift__
     arg2 >> with_rrshift
 
 
@@ -1050,7 +1050,7 @@ class With_rand:
 
 def test_rand():
     with_rand = With_rand()  #$ MISSING: arg1="SSA variable with_rand" func=With_rand.__rand__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rand.__rand__
+    arg2 = ""  #$ MISSING: arg2 func=With_rand.__rand__
     arg2 & with_rand
 
 
@@ -1065,7 +1065,7 @@ class With_rxor:
 
 def test_rxor():
     with_rxor = With_rxor()  #$ MISSING: arg1="SSA variable with_rxor" func=With_rxor.__rxor__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_rxor.__rxor__
+    arg2 = ""  #$ MISSING: arg2 func=With_rxor.__rxor__
     arg2 ^ with_rxor
 
 
@@ -1080,7 +1080,7 @@ class With_ror:
 
 def test_ror():
     with_ror = With_ror()  #$ MISSING: arg1="SSA variable with_ror" func=With_ror.__ror__
-    arg2 = ""  #$ MISSING: arg2="arg2" func=With_ror.__ror__
+    arg2 = ""  #$ MISSING: arg2 func=With_ror.__ror__
     arg2 | with_ror
 
 
@@ -1095,7 +1095,7 @@ class With_iadd:
 
 def test_iadd():
     with_iadd = With_iadd()  #$ MISSING: arg1="SSA variable with_iadd" func=With_iadd.__iadd__
-    arg2 = with_iadd  #$ MISSING: arg2="arg2" func=With_iadd.__iadd__
+    arg2 = with_iadd  #$ MISSING: arg2 func=With_iadd.__iadd__
     with_iadd += arg2
 
 
@@ -1110,7 +1110,7 @@ class With_isub:
 
 def test_isub():
     with_isub = With_isub()  #$ MISSING: arg1="SSA variable with_isub" func=With_isub.__isub__
-    arg2 = with_isub  #$ MISSING: arg2="arg2" func=With_isub.__isub__
+    arg2 = with_isub  #$ MISSING: arg2 func=With_isub.__isub__
     with_isub -= arg2
 
 
@@ -1125,7 +1125,7 @@ class With_imul:
 
 def test_imul():
     with_imul = With_imul()  #$ MISSING: arg1="SSA variable with_imul" func=With_imul.__imul__
-    arg2 = with_imul  #$ MISSING: arg2="arg2" func=With_imul.__imul__
+    arg2 = with_imul  #$ MISSING: arg2 func=With_imul.__imul__
     with_imul *= arg2
 
 
@@ -1140,7 +1140,7 @@ class With_imatmul:
 
 def test_imatmul():
     with_imatmul = With_imatmul()  #$ MISSING: arg1="SSA variable with_imatmul" func=With_imatmul.__imatmul__
-    arg2 = with_imatmul  #$ MISSING: arg2="arg2" func=With_imatmul.__imatmul__
+    arg2 = with_imatmul  #$ MISSING: arg2 func=With_imatmul.__imatmul__
     with_imatmul @= arg2
 
 
@@ -1155,7 +1155,7 @@ class With_itruediv:
 
 def test_itruediv():
     with_itruediv = With_itruediv()  #$ MISSING: arg1="SSA variable with_itruediv" func=With_itruediv.__itruediv__
-    arg2 = with_itruediv  #$ MISSING: arg2="arg2" func=With_itruediv.__itruediv__
+    arg2 = with_itruediv  #$ MISSING: arg2 func=With_itruediv.__itruediv__
     with_itruediv /= arg2
 
 
@@ -1170,7 +1170,7 @@ class With_ifloordiv:
 
 def test_ifloordiv():
     with_ifloordiv = With_ifloordiv()  #$ MISSING: arg1="SSA variable with_ifloordiv" func=With_ifloordiv.__ifloordiv__
-    arg2 = with_ifloordiv  #$ MISSING: arg2="arg2" func=With_ifloordiv.__ifloordiv__
+    arg2 = with_ifloordiv  #$ MISSING: arg2 func=With_ifloordiv.__ifloordiv__
     with_ifloordiv //= arg2
 
 
@@ -1185,7 +1185,7 @@ class With_imod:
 
 def test_imod():
     with_imod = With_imod()  #$ MISSING: arg1="SSA variable with_imod" func=With_imod.__imod__
-    arg2 = with_imod  #$ MISSING: arg2="arg2" func=With_imod.__imod__
+    arg2 = with_imod  #$ MISSING: arg2 func=With_imod.__imod__
     with_imod %= arg2
 
 
@@ -1200,7 +1200,7 @@ class With_ipow:
 
 def test_ipow():
     with_ipow = With_ipow()  #$ MISSING: arg1="SSA variable with_ipow" func=With_ipow.__ipow__
-    arg2 = with_ipow  #$ MISSING: arg2="arg2" func=With_ipow.__ipow__
+    arg2 = with_ipow  #$ MISSING: arg2 func=With_ipow.__ipow__
     with_ipow **= arg2
 
 
@@ -1215,7 +1215,7 @@ class With_ilshift:
 
 def test_ilshift():
     with_ilshift = With_ilshift()  #$ MISSING: arg1="SSA variable with_ilshift" func=With_ilshift.__ilshift__
-    arg2 = with_ilshift  #$ MISSING: arg2="arg2" func=With_ilshift.__ilshift__
+    arg2 = with_ilshift  #$ MISSING: arg2 func=With_ilshift.__ilshift__
     with_ilshift <<= arg2
 
 
@@ -1230,7 +1230,7 @@ class With_irshift:
 
 def test_irshift():
     with_irshift = With_irshift()  #$ MISSING: arg1="SSA variable with_irshift" func=With_irshift.__irshift__
-    arg2 = with_irshift  #$ MISSING: arg2="arg2" func=With_irshift.__irshift__
+    arg2 = with_irshift  #$ MISSING: arg2 func=With_irshift.__irshift__
     with_irshift >>= arg2
 
 
@@ -1245,7 +1245,7 @@ class With_iand:
 
 def test_iand():
     with_iand = With_iand()  #$ MISSING: arg1="SSA variable with_iand" func=With_iand.__iand__
-    arg2 = with_iand  #$ MISSING: arg2="arg2" func=With_iand.__iand__
+    arg2 = with_iand  #$ MISSING: arg2 func=With_iand.__iand__
     with_iand &= arg2
 
 
@@ -1260,7 +1260,7 @@ class With_ixor:
 
 def test_ixor():
     with_ixor = With_ixor()  #$ MISSING: arg1="SSA variable with_ixor" func=With_ixor.__ixor__
-    arg2 = with_ixor  #$ MISSING: arg2="arg2" func=With_ixor.__ixor__
+    arg2 = with_ixor  #$ MISSING: arg2 func=With_ixor.__ixor__
     with_ixor ^= arg2
 
 
@@ -1275,7 +1275,7 @@ class With_ior:
 
 def test_ior():
     with_ior = With_ior()  #$ MISSING: arg1="SSA variable with_ior" func=With_ior.__ior__
-    arg2 = with_ior  #$ MISSING: arg2="arg2" func=With_ior.__ior__
+    arg2 = with_ior  #$ MISSING: arg2 func=With_ior.__ior__
     with_ior |= arg2
 
 

From eb8a52ba8d5a4718b5bc9cd16659a3c3a7b2cd6f Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Wed, 20 Jan 2021 21:21:03 +0100
Subject: [PATCH 254/343] Add new .stats file

---
 .../ql/src/semmlecode.csharp.dbscheme.stats   | 7014 +++++++++--------
 1 file changed, 3576 insertions(+), 3438 deletions(-)

diff --git a/csharp/ql/src/semmlecode.csharp.dbscheme.stats b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
index 60d97b381d3..2795d2ddb57 100644
--- a/csharp/ql/src/semmlecode.csharp.dbscheme.stats
+++ b/csharp/ql/src/semmlecode.csharp.dbscheme.stats
@@ -1,7 +1,7 @@
 <dbstats>
   <typesizes><e>
 <k>@compilation</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 <e>
 <k>@diagnostic</k>
@@ -9,7 +9,7 @@
 </e>
 <e>
 <k>@extractor_message</k>
-<v>7615</v>
+<v>7631</v>
 </e>
 <e>
 <k>@externalDefect</k>
@@ -25,7 +25,7 @@
 </e>
 <e>
 <k>@duplication</k>
-<v>22690</v>
+<v>22748</v>
 </e>
 <e>
 <k>@similarity</k>
@@ -33,31 +33,31 @@
 </e>
 <e>
 <k>@location_default</k>
-<v>14071977</v>
+<v>14071909</v>
 </e>
 <e>
 <k>@assembly</k>
-<v>4190</v>
+<v>4200</v>
 </e>
 <e>
 <k>@file</k>
-<v>42382</v>
+<v>42489</v>
 </e>
 <e>
 <k>@folder</k>
-<v>16906</v>
+<v>16948</v>
 </e>
 <e>
 <k>@namespace</k>
-<v>21898</v>
+<v>21953</v>
 </e>
 <e>
 <k>@namespace_declaration</k>
-<v>19720</v>
+<v>19770</v>
 </e>
 <e>
 <k>@using_namespace_directive</k>
-<v>143966</v>
+<v>144329</v>
 </e>
 <e>
 <k>@using_static_directive</k>
@@ -117,23 +117,23 @@
 </e>
 <e>
 <k>@enum_type</k>
-<v>11928</v>
+<v>11958</v>
 </e>
 <e>
 <k>@struct_type</k>
-<v>49566</v>
+<v>49691</v>
 </e>
 <e>
 <k>@class_type</k>
-<v>304493</v>
+<v>305261</v>
 </e>
 <e>
 <k>@interface_type</k>
-<v>177759</v>
+<v>178207</v>
 </e>
 <e>
 <k>@delegate_type</k>
-<v>107353</v>
+<v>107624</v>
 </e>
 <e>
 <k>@null_type</k>
@@ -141,11 +141,11 @@
 </e>
 <e>
 <k>@type_parameter</k>
-<v>202195</v>
+<v>202705</v>
 </e>
 <e>
 <k>@pointer_type</k>
-<v>218</v>
+<v>219</v>
 </e>
 <e>
 <k>@nullable_type</k>
@@ -153,7 +153,7 @@
 </e>
 <e>
 <k>@array_type</k>
-<v>9104</v>
+<v>9127</v>
 </e>
 <e>
 <k>@void_type</k>
@@ -165,7 +165,7 @@
 </e>
 <e>
 <k>@tuple_type</k>
-<v>1779</v>
+<v>1783</v>
 </e>
 <e>
 <k>@uint_ptr_type</k>
@@ -189,23 +189,23 @@
 </e>
 <e>
 <k>@typeref</k>
-<v>234326</v>
+<v>234916</v>
 </e>
 <e>
 <k>@attribute</k>
-<v>743932</v>
+<v>745807</v>
 </e>
 <e>
 <k>@type_mention</k>
-<v>1246314</v>
+<v>1249451</v>
 </e>
 <e>
 <k>@oblivious</k>
-<v>1312</v>
+<v>1315</v>
 </e>
 <e>
 <k>@not_annotated</k>
-<v>617</v>
+<v>618</v>
 </e>
 <e>
 <k>@annotated</k>
@@ -213,7 +213,7 @@
 </e>
 <e>
 <k>@type_parameter_constraints</k>
-<v>590676</v>
+<v>592165</v>
 </e>
 <e>
 <k>@modifier</k>
@@ -221,47 +221,47 @@
 </e>
 <e>
 <k>@property</k>
-<v>422687</v>
+<v>423752</v>
 </e>
 <e>
 <k>@indexer</k>
-<v>17008</v>
+<v>17051</v>
 </e>
 <e>
 <k>@getter</k>
-<v>439462</v>
+<v>440570</v>
 </e>
 <e>
 <k>@setter</k>
-<v>127273</v>
+<v>127594</v>
 </e>
 <e>
 <k>@event</k>
-<v>15200</v>
+<v>15238</v>
 </e>
 <e>
 <k>@add_event_accessor</k>
-<v>15200</v>
+<v>15238</v>
 </e>
 <e>
 <k>@remove_event_accessor</k>
-<v>15200</v>
+<v>15238</v>
 </e>
 <e>
 <k>@operator</k>
-<v>12385</v>
+<v>12416</v>
 </e>
 <e>
 <k>@method</k>
-<v>1114413</v>
+<v>1117222</v>
 </e>
 <e>
 <k>@constructor</k>
-<v>277088</v>
+<v>277786</v>
 </e>
 <e>
 <k>@destructor</k>
-<v>442</v>
+<v>443</v>
 </e>
 <e>
 <k>@local_function</k>
@@ -269,15 +269,15 @@
 </e>
 <e>
 <k>@addressable_field</k>
-<v>369732</v>
+<v>370664</v>
 </e>
 <e>
 <k>@constant</k>
-<v>184846</v>
+<v>185312</v>
 </e>
 <e>
 <k>@addressable_local_variable</k>
-<v>162455</v>
+<v>162451</v>
 </e>
 <e>
 <k>@local_constant</k>
@@ -289,67 +289,67 @@
 </e>
 <e>
 <k>@parameter</k>
-<v>2412633</v>
+<v>2418714</v>
 </e>
 <e>
 <k>@block_stmt</k>
-<v>307020</v>
+<v>307795</v>
 </e>
 <e>
 <k>@expr_stmt</k>
-<v>366480</v>
+<v>367404</v>
 </e>
 <e>
 <k>@return_stmt</k>
-<v>94536</v>
+<v>94775</v>
 </e>
 <e>
 <k>@using_block_stmt</k>
-<v>1142</v>
+<v>1145</v>
 </e>
 <e>
 <k>@var_decl_stmt</k>
-<v>147605</v>
+<v>147602</v>
 </e>
 <e>
 <k>@if_stmt</k>
-<v>117920</v>
+<v>118217</v>
 </e>
 <e>
 <k>@switch_stmt</k>
-<v>3071</v>
+<v>3078</v>
 </e>
 <e>
 <k>@while_stmt</k>
-<v>4455</v>
+<v>4466</v>
 </e>
 <e>
 <k>@do_stmt</k>
-<v>983</v>
+<v>985</v>
 </e>
 <e>
 <k>@for_stmt</k>
-<v>6806</v>
+<v>6824</v>
 </e>
 <e>
 <k>@foreach_stmt</k>
-<v>5342</v>
+<v>5355</v>
 </e>
 <e>
 <k>@break_stmt</k>
-<v>11024</v>
+<v>11052</v>
 </e>
 <e>
 <k>@continue_stmt</k>
-<v>2222</v>
+<v>2227</v>
 </e>
 <e>
 <k>@goto_stmt</k>
-<v>2738</v>
+<v>2745</v>
 </e>
 <e>
 <k>@goto_case_stmt</k>
-<v>329</v>
+<v>330</v>
 </e>
 <e>
 <k>@goto_default_stmt</k>
@@ -357,7 +357,7 @@
 </e>
 <e>
 <k>@throw_stmt</k>
-<v>75270</v>
+<v>75459</v>
 </e>
 <e>
 <k>@yield_stmt</k>
@@ -365,11 +365,11 @@
 </e>
 <e>
 <k>@try_stmt</k>
-<v>4302</v>
+<v>4313</v>
 </e>
 <e>
 <k>@checked_stmt</k>
-<v>253</v>
+<v>254</v>
 </e>
 <e>
 <k>@unchecked_stmt</k>
@@ -377,7 +377,7 @@
 </e>
 <e>
 <k>@lock_stmt</k>
-<v>1526</v>
+<v>1530</v>
 </e>
 <e>
 <k>@const_decl_stmt</k>
@@ -385,27 +385,27 @@
 </e>
 <e>
 <k>@empty_stmt</k>
-<v>352</v>
+<v>353</v>
 </e>
 <e>
 <k>@unsafe_stmt</k>
-<v>182</v>
+<v>183</v>
 </e>
 <e>
 <k>@fixed_stmt</k>
-<v>1150</v>
+<v>1153</v>
 </e>
 <e>
 <k>@label_stmt</k>
-<v>1019</v>
+<v>1022</v>
 </e>
 <e>
 <k>@catch</k>
-<v>3425</v>
+<v>3434</v>
 </e>
 <e>
 <k>@case_stmt</k>
-<v>22759</v>
+<v>22817</v>
 </e>
 <e>
 <k>@local_function_stmt</k>
@@ -417,79 +417,79 @@
 </e>
 <e>
 <k>@bool_literal_expr</k>
-<v>69419</v>
+<v>69594</v>
 </e>
 <e>
 <k>@int_literal_expr</k>
-<v>747703</v>
+<v>755166</v>
 </e>
 <e>
 <k>@long_literal_expr</k>
-<v>332</v>
+<v>333</v>
 </e>
 <e>
 <k>@double_literal_expr</k>
-<v>866</v>
+<v>868</v>
 </e>
 <e>
 <k>@string_literal_expr</k>
-<v>410826</v>
+<v>411862</v>
 </e>
 <e>
 <k>@null_literal_expr</k>
-<v>108012</v>
+<v>108283</v>
 </e>
 <e>
 <k>@local_variable_access_expr</k>
-<v>522612</v>
+<v>522593</v>
 </e>
 <e>
 <k>@parameter_access_expr</k>
-<v>354327</v>
+<v>355221</v>
 </e>
 <e>
 <k>@field_access_expr</k>
-<v>458716</v>
+<v>459873</v>
 </e>
 <e>
 <k>@property_access_expr</k>
-<v>358392</v>
+<v>359295</v>
 </e>
 <e>
 <k>@type_access_expr</k>
-<v>346534</v>
+<v>346635</v>
 </e>
 <e>
 <k>@typeof_expr</k>
-<v>29968</v>
+<v>30041</v>
 </e>
 <e>
 <k>@method_invocation_expr</k>
-<v>547087</v>
+<v>547076</v>
 </e>
 <e>
 <k>@cast_expr</k>
-<v>264717</v>
+<v>265384</v>
 </e>
 <e>
 <k>@object_creation_expr</k>
-<v>62624</v>
+<v>62782</v>
 </e>
 <e>
 <k>@array_creation_expr</k>
-<v>178981</v>
+<v>180322</v>
 </e>
 <e>
 <k>@array_init_expr</k>
-<v>178530</v>
+<v>179872</v>
 </e>
 <e>
 <k>@local_var_decl_expr</k>
-<v>163323</v>
+<v>163319</v>
 </e>
 <e>
 <k>@char_literal_expr</k>
-<v>16212</v>
+<v>16253</v>
 </e>
 <e>
 <k>@decimal_literal_expr</k>
@@ -497,23 +497,23 @@
 </e>
 <e>
 <k>@uint_literal_expr</k>
-<v>2411</v>
+<v>2417</v>
 </e>
 <e>
 <k>@ulong_literal_expr</k>
-<v>390</v>
+<v>391</v>
 </e>
 <e>
 <k>@float_literal_expr</k>
-<v>455</v>
+<v>456</v>
 </e>
 <e>
 <k>@this_access_expr</k>
-<v>590642</v>
+<v>592131</v>
 </e>
 <e>
 <k>@base_access_expr</k>
-<v>2845</v>
+<v>2852</v>
 </e>
 <e>
 <k>@method_access_expr</k>
@@ -521,35 +521,35 @@
 </e>
 <e>
 <k>@event_access_expr</k>
-<v>434</v>
+<v>435</v>
 </e>
 <e>
 <k>@indexer_access_expr</k>
-<v>30696</v>
+<v>30774</v>
 </e>
 <e>
 <k>@array_access_expr</k>
-<v>19392</v>
+<v>19441</v>
 </e>
 <e>
 <k>@delegate_invocation_expr</k>
-<v>2005</v>
+<v>2010</v>
 </e>
 <e>
 <k>@operator_invocation_expr</k>
-<v>29948</v>
+<v>29952</v>
 </e>
 <e>
 <k>@explicit_delegate_creation_expr</k>
-<v>680</v>
+<v>682</v>
 </e>
 <e>
 <k>@implicit_delegate_creation_expr</k>
-<v>5099</v>
+<v>5111</v>
 </e>
 <e>
 <k>@default_expr</k>
-<v>6155</v>
+<v>6171</v>
 </e>
 <e>
 <k>@plus_expr</k>
@@ -557,123 +557,123 @@
 </e>
 <e>
 <k>@minus_expr</k>
-<v>7081</v>
+<v>7099</v>
 </e>
 <e>
 <k>@bit_not_expr</k>
-<v>739</v>
+<v>741</v>
 </e>
 <e>
 <k>@log_not_expr</k>
-<v>26331</v>
+<v>26398</v>
 </e>
 <e>
 <k>@post_incr_expr</k>
-<v>12335</v>
+<v>12366</v>
 </e>
 <e>
 <k>@post_decr_expr</k>
-<v>1700</v>
+<v>1704</v>
 </e>
 <e>
 <k>@pre_incr_expr</k>
-<v>1263</v>
+<v>1266</v>
 </e>
 <e>
 <k>@pre_decr_expr</k>
-<v>407</v>
+<v>408</v>
 </e>
 <e>
 <k>@mul_expr</k>
-<v>4635</v>
+<v>4647</v>
 </e>
 <e>
 <k>@div_expr</k>
-<v>1795</v>
+<v>1799</v>
 </e>
 <e>
 <k>@rem_expr</k>
-<v>705</v>
+<v>707</v>
 </e>
 <e>
 <k>@add_expr</k>
-<v>27803</v>
+<v>27873</v>
 </e>
 <e>
 <k>@sub_expr</k>
-<v>12596</v>
+<v>12628</v>
 </e>
 <e>
 <k>@lshift_expr</k>
-<v>4129</v>
+<v>4139</v>
 </e>
 <e>
 <k>@rshift_expr</k>
-<v>1766</v>
+<v>1770</v>
 </e>
 <e>
 <k>@lt_expr</k>
-<v>15951</v>
+<v>15991</v>
 </e>
 <e>
 <k>@gt_expr</k>
-<v>9397</v>
+<v>9421</v>
 </e>
 <e>
 <k>@le_expr</k>
-<v>3836</v>
+<v>3846</v>
 </e>
 <e>
 <k>@ge_expr</k>
-<v>6025</v>
+<v>6040</v>
 </e>
 <e>
 <k>@eq_expr</k>
-<v>53613</v>
+<v>53748</v>
 </e>
 <e>
 <k>@ne_expr</k>
-<v>37287</v>
+<v>37381</v>
 </e>
 <e>
 <k>@bit_and_expr</k>
-<v>6310</v>
+<v>6326</v>
 </e>
 <e>
 <k>@bit_xor_expr</k>
-<v>529</v>
+<v>530</v>
 </e>
 <e>
 <k>@bit_or_expr</k>
-<v>15255</v>
+<v>15294</v>
 </e>
 <e>
 <k>@log_and_expr</k>
-<v>20419</v>
+<v>20470</v>
 </e>
 <e>
 <k>@log_or_expr</k>
-<v>14022</v>
+<v>14057</v>
 </e>
 <e>
 <k>@is_expr</k>
-<v>6498</v>
+<v>6514</v>
 </e>
 <e>
 <k>@as_expr</k>
-<v>2733</v>
+<v>2740</v>
 </e>
 <e>
 <k>@null_coalescing_expr</k>
-<v>3622</v>
+<v>3631</v>
 </e>
 <e>
 <k>@conditional_expr</k>
-<v>8989</v>
+<v>9011</v>
 </e>
 <e>
 <k>@simple_assign_expr</k>
-<v>166871</v>
+<v>167291</v>
 </e>
 <e>
 <k>@assign_add_expr</k>
@@ -681,11 +681,11 @@
 </e>
 <e>
 <k>@assign_sub_expr</k>
-<v>1023</v>
+<v>1025</v>
 </e>
 <e>
 <k>@assign_mul_expr</k>
-<v>182</v>
+<v>183</v>
 </e>
 <e>
 <k>@assign_div_expr</k>
@@ -705,7 +705,7 @@
 </e>
 <e>
 <k>@assign_or_expr</k>
-<v>1415</v>
+<v>1418</v>
 </e>
 <e>
 <k>@assign_lshift_expr</k>
@@ -713,27 +713,27 @@
 </e>
 <e>
 <k>@assign_rshift_expr</k>
-<v>216</v>
+<v>217</v>
 </e>
 <e>
 <k>@object_init_expr</k>
-<v>7670</v>
+<v>7689</v>
 </e>
 <e>
 <k>@collection_init_expr</k>
-<v>593</v>
+<v>594</v>
 </e>
 <e>
 <k>@checked_expr</k>
-<v>327</v>
+<v>328</v>
 </e>
 <e>
 <k>@unchecked_expr</k>
-<v>1424</v>
+<v>1427</v>
 </e>
 <e>
 <k>@constructor_init_expr</k>
-<v>5807</v>
+<v>5821</v>
 </e>
 <e>
 <k>@add_event_expr</k>
@@ -741,7 +741,7 @@
 </e>
 <e>
 <k>@remove_event_expr</k>
-<v>121</v>
+<v>122</v>
 </e>
 <e>
 <k>@par_expr</k>
@@ -749,7 +749,7 @@
 </e>
 <e>
 <k>@lambda_expr</k>
-<v>48672</v>
+<v>48795</v>
 </e>
 <e>
 <k>@anonymous_method_expr</k>
@@ -761,31 +761,31 @@
 </e>
 <e>
 <k>@dynamic_element_access_expr</k>
-<v>330</v>
+<v>331</v>
 </e>
 <e>
 <k>@dynamic_member_access_expr</k>
-<v>6829</v>
+<v>6846</v>
 </e>
 <e>
 <k>@pointer_indirection_expr</k>
-<v>4149</v>
+<v>4159</v>
 </e>
 <e>
 <k>@address_of_expr</k>
-<v>1292</v>
+<v>1295</v>
 </e>
 <e>
 <k>@sizeof_expr</k>
-<v>1063</v>
+<v>1065</v>
 </e>
 <e>
 <k>@await_expr</k>
-<v>54641</v>
+<v>54779</v>
 </e>
 <e>
 <k>@nameof_expr</k>
-<v>15612</v>
+<v>15652</v>
 </e>
 <e>
 <k>@interpolated_string_expr</k>
@@ -797,7 +797,7 @@
 </e>
 <e>
 <k>@throw_expr</k>
-<v>1529</v>
+<v>1533</v>
 </e>
 <e>
 <k>@tuple_expr</k>
@@ -809,7 +809,7 @@
 </e>
 <e>
 <k>@ref_expr</k>
-<v>460</v>
+<v>461</v>
 </e>
 <e>
 <k>@discard_expr</k>
@@ -825,7 +825,7 @@
 </e>
 <e>
 <k>@switch_expr</k>
-<v>509</v>
+<v>510</v>
 </e>
 <e>
 <k>@recursive_pattern_expr</k>
@@ -841,15 +841,15 @@
 </e>
 <e>
 <k>@switch_case_expr</k>
-<v>4342</v>
+<v>4353</v>
 </e>
 <e>
 <k>@assign_coalesce_expr</k>
-<v>545</v>
+<v>546</v>
 </e>
 <e>
 <k>@suppress_nullable_warning_expr</k>
-<v>13875</v>
+<v>13910</v>
 </e>
 <e>
 <k>@namespace_access_expr</k>
@@ -873,7 +873,7 @@
 </e>
 <e>
 <k>@not_pattern_expr</k>
-<v>70</v>
+<v>71</v>
 </e>
 <e>
 <k>@function_pointer_invocation_expr</k>
@@ -905,19 +905,19 @@
 </e>
 <e>
 <k>@singlelinecomment</k>
-<v>188909</v>
+<v>189385</v>
 </e>
 <e>
 <k>@multilinecomment</k>
-<v>22609</v>
+<v>22666</v>
 </e>
 <e>
 <k>@xmldoccomment</k>
-<v>208332</v>
+<v>208857</v>
 </e>
 <e>
 <k>@commentblock</k>
-<v>147571</v>
+<v>147943</v>
 </e>
 <e>
 <k>@asp_close_tag</k>
@@ -957,7 +957,7 @@
 </e>
 <e>
 <k>@cil_nop</k>
-<v>838867</v>
+<v>840983</v>
 </e>
 <e>
 <k>@cil_break</k>
@@ -965,147 +965,147 @@
 </e>
 <e>
 <k>@cil_ldarg_0</k>
-<v>3961775</v>
+<v>3971760</v>
 </e>
 <e>
 <k>@cil_ldarg_1</k>
-<v>1212541</v>
+<v>1215597</v>
 </e>
 <e>
 <k>@cil_ldarg_2</k>
-<v>442374</v>
+<v>443489</v>
 </e>
 <e>
 <k>@cil_ldarg_3</k>
-<v>208456</v>
+<v>208981</v>
 </e>
 <e>
 <k>@cil_ldloc_0</k>
-<v>926110</v>
+<v>928444</v>
 </e>
 <e>
 <k>@cil_ldloc_1</k>
-<v>492252</v>
+<v>493493</v>
 </e>
 <e>
 <k>@cil_ldloc_2</k>
-<v>287743</v>
+<v>288468</v>
 </e>
 <e>
 <k>@cil_ldloc_3</k>
-<v>191409</v>
+<v>191891</v>
 </e>
 <e>
 <k>@cil_stloc_0</k>
-<v>523187</v>
+<v>524506</v>
 </e>
 <e>
 <k>@cil_stloc_1</k>
-<v>259627</v>
+<v>260281</v>
 </e>
 <e>
 <k>@cil_stloc_2</k>
-<v>197640</v>
+<v>198138</v>
 </e>
 <e>
 <k>@cil_stloc_3</k>
-<v>137831</v>
+<v>138179</v>
 </e>
 <e>
 <k>@cil_ldarg_s</k>
-<v>263623</v>
+<v>264287</v>
 </e>
 <e>
 <k>@cil_ldarga_s</k>
-<v>74518</v>
+<v>74705</v>
 </e>
 <e>
 <k>@cil_starg_s</k>
-<v>37050</v>
+<v>37143</v>
 </e>
 <e>
 <k>@cil_ldloc_s</k>
-<v>684055</v>
+<v>685779</v>
 </e>
 <e>
 <k>@cil_ldloca_s</k>
-<v>627124</v>
+<v>628704</v>
 </e>
 <e>
 <k>@cil_stloc_s</k>
-<v>479225</v>
+<v>480433</v>
 </e>
 <e>
 <k>@cil_ldnull</k>
-<v>601686</v>
+<v>603203</v>
 </e>
 <e>
 <k>@cil_ldc_i4_m1</k>
-<v>125776</v>
+<v>126093</v>
 </e>
 <e>
 <k>@cil_ldc_i4_0</k>
-<v>623478</v>
+<v>625049</v>
 </e>
 <e>
 <k>@cil_ldc_i4_1</k>
-<v>492991</v>
+<v>494233</v>
 </e>
 <e>
 <k>@cil_ldc_i4_2</k>
-<v>120624</v>
+<v>120928</v>
 </e>
 <e>
 <k>@cil_ldc_i4_3</k>
-<v>63935</v>
+<v>64097</v>
 </e>
 <e>
 <k>@cil_ldc_i4_4</k>
-<v>58681</v>
+<v>58829</v>
 </e>
 <e>
 <k>@cil_ldc_i4_5</k>
-<v>38552</v>
+<v>38649</v>
 </e>
 <e>
 <k>@cil_ldc_i4_6</k>
-<v>23186</v>
+<v>23245</v>
 </e>
 <e>
 <k>@cil_ldc_i4_7</k>
-<v>20683</v>
+<v>20735</v>
 </e>
 <e>
 <k>@cil_ldc_i4_8</k>
-<v>33370</v>
+<v>33454</v>
 </e>
 <e>
 <k>@cil_ldc_i4_s</k>
-<v>421909</v>
+<v>422973</v>
 </e>
 <e>
 <k>@cil_ldc_i4</k>
-<v>509134</v>
+<v>510417</v>
 </e>
 <e>
 <k>@cil_ldc_i8</k>
-<v>4870</v>
+<v>4882</v>
 </e>
 <e>
 <k>@cil_ldc_r4</k>
-<v>10227</v>
+<v>10253</v>
 </e>
 <e>
 <k>@cil_ldc_r8</k>
-<v>10295</v>
+<v>10321</v>
 </e>
 <e>
 <k>@cil_dup</k>
-<v>839357</v>
+<v>841472</v>
 </e>
 <e>
 <k>@cil_pop</k>
-<v>255602</v>
+<v>256246</v>
 </e>
 <e>
 <k>@cil_jmp</k>
@@ -1113,103 +1113,103 @@
 </e>
 <e>
 <k>@cil_call</k>
-<v>2732590</v>
+<v>2739477</v>
 </e>
 <e>
 <k>@cil_calli</k>
-<v>0</v>
+<v>4</v>
 </e>
 <e>
 <k>@cil_ret</k>
-<v>1780663</v>
+<v>1785151</v>
 </e>
 <e>
 <k>@cil_br_s</k>
-<v>344698</v>
+<v>345567</v>
 </e>
 <e>
 <k>@cil_brfalse_s</k>
-<v>464457</v>
+<v>465628</v>
 </e>
 <e>
 <k>@cil_brtrue_s</k>
-<v>429313</v>
+<v>430395</v>
 </e>
 <e>
 <k>@cil_beq_s</k>
-<v>81994</v>
+<v>82200</v>
 </e>
 <e>
 <k>@cil_bge_s</k>
-<v>34814</v>
+<v>34901</v>
 </e>
 <e>
 <k>@cil_bgt_s</k>
-<v>16444</v>
+<v>16485</v>
 </e>
 <e>
 <k>@cil_ble_s</k>
-<v>29107</v>
+<v>29180</v>
 </e>
 <e>
 <k>@cil_blt_s</k>
-<v>60737</v>
+<v>60890</v>
 </e>
 <e>
 <k>@cil_bne_un_s</k>
-<v>102327</v>
+<v>102585</v>
 </e>
 <e>
 <k>@cil_bge_un_s</k>
-<v>2177</v>
+<v>2183</v>
 </e>
 <e>
 <k>@cil_bgt_un_s</k>
-<v>8705</v>
+<v>8727</v>
 </e>
 <e>
 <k>@cil_ble_un_s</k>
-<v>6100</v>
+<v>6115</v>
 </e>
 <e>
 <k>@cil_blt_un_s</k>
-<v>1463</v>
+<v>1466</v>
 </e>
 <e>
 <k>@cil_br</k>
-<v>95847</v>
+<v>96089</v>
 </e>
 <e>
 <k>@cil_brfalse</k>
-<v>32291</v>
+<v>32372</v>
 </e>
 <e>
 <k>@cil_brtrue</k>
-<v>27245</v>
+<v>27314</v>
 </e>
 <e>
 <k>@cil_beq</k>
-<v>21441</v>
+<v>21495</v>
 </e>
 <e>
 <k>@cil_bge</k>
-<v>1385</v>
+<v>1388</v>
 </e>
 <e>
 <k>@cil_bgt</k>
-<v>1458</v>
+<v>1461</v>
 </e>
 <e>
 <k>@cil_ble</k>
-<v>4627</v>
+<v>4639</v>
 </e>
 <e>
 <k>@cil_blt</k>
-<v>7908</v>
+<v>7928</v>
 </e>
 <e>
 <k>@cil_bne_un</k>
-<v>7213</v>
+<v>7231</v>
 </e>
 <e>
 <k>@cil_bge_un</k>
@@ -1217,19 +1217,19 @@
 </e>
 <e>
 <k>@cil_bgt_un</k>
-<v>690</v>
+<v>691</v>
 </e>
 <e>
 <k>@cil_ble_un</k>
-<v>1098</v>
+<v>1101</v>
 </e>
 <e>
 <k>@cil_blt_un</k>
-<v>179</v>
+<v>180</v>
 </e>
 <e>
 <k>@cil_switch</k>
-<v>23804</v>
+<v>23864</v>
 </e>
 <e>
 <k>@cil_ldind_i1</k>
@@ -1237,27 +1237,27 @@
 </e>
 <e>
 <k>@cil_ldind_u1</k>
-<v>5492</v>
+<v>5506</v>
 </e>
 <e>
 <k>@cil_ldind_i2</k>
-<v>510</v>
+<v>511</v>
 </e>
 <e>
 <k>@cil_ldind_u2</k>
-<v>2500</v>
+<v>2507</v>
 </e>
 <e>
 <k>@cil_ldind_i4</k>
-<v>9746</v>
+<v>9770</v>
 </e>
 <e>
 <k>@cil_ldind_u4</k>
-<v>1477</v>
+<v>1481</v>
 </e>
 <e>
 <k>@cil_ldind_i8</k>
-<v>1963</v>
+<v>1968</v>
 </e>
 <e>
 <k>@cil_ldind_i</k>
@@ -1265,139 +1265,139 @@
 </e>
 <e>
 <k>@cil_ldind_r4</k>
-<v>699</v>
+<v>701</v>
 </e>
 <e>
 <k>@cil_ldind_r8</k>
-<v>262</v>
+<v>263</v>
 </e>
 <e>
 <k>@cil_ldind_ref</k>
-<v>6635</v>
+<v>6651</v>
 </e>
 <e>
 <k>@cil_stind_ref</k>
-<v>16882</v>
+<v>16924</v>
 </e>
 <e>
 <k>@cil_stind_i1</k>
-<v>8496</v>
+<v>8518</v>
 </e>
 <e>
 <k>@cil_stind_i2</k>
-<v>1407</v>
+<v>1411</v>
 </e>
 <e>
 <k>@cil_stind_i4</k>
-<v>10329</v>
+<v>10355</v>
 </e>
 <e>
 <k>@cil_stind_i8</k>
-<v>2338</v>
+<v>2344</v>
 </e>
 <e>
 <k>@cil_stind_r4</k>
-<v>184</v>
+<v>185</v>
 </e>
 <e>
 <k>@cil_stind_r8</k>
-<v>223</v>
+<v>224</v>
 </e>
 <e>
 <k>@cil_add</k>
-<v>223267</v>
+<v>223830</v>
 </e>
 <e>
 <k>@cil_sub</k>
-<v>85012</v>
+<v>85227</v>
 </e>
 <e>
 <k>@cil_mul</k>
-<v>29855</v>
+<v>29931</v>
 </e>
 <e>
 <k>@cil_div</k>
-<v>9094</v>
+<v>9117</v>
 </e>
 <e>
 <k>@cil_div_un</k>
-<v>252</v>
+<v>253</v>
 </e>
 <e>
 <k>@cil_rem</k>
-<v>3397</v>
+<v>3406</v>
 </e>
 <e>
 <k>@cil_rem_un</k>
-<v>228</v>
+<v>229</v>
 </e>
 <e>
 <k>@cil_and</k>
-<v>59147</v>
+<v>59296</v>
 </e>
 <e>
 <k>@cil_or</k>
-<v>22078</v>
+<v>22134</v>
 </e>
 <e>
 <k>@cil_xor</k>
-<v>22642</v>
+<v>22699</v>
 </e>
 <e>
 <k>@cil_shl</k>
-<v>18909</v>
+<v>18956</v>
 </e>
 <e>
 <k>@cil_shr</k>
-<v>9148</v>
+<v>9171</v>
 </e>
 <e>
 <k>@cil_shr_un</k>
-<v>26025</v>
+<v>26091</v>
 </e>
 <e>
 <k>@cil_neg</k>
-<v>2328</v>
+<v>2334</v>
 </e>
 <e>
 <k>@cil_not</k>
-<v>1453</v>
+<v>1457</v>
 </e>
 <e>
 <k>@cil_conv_i1</k>
-<v>1380</v>
+<v>1383</v>
 </e>
 <e>
 <k>@cil_conv_i2</k>
-<v>1443</v>
+<v>1447</v>
 </e>
 <e>
 <k>@cil_conv_i4</k>
-<v>59590</v>
+<v>59740</v>
 </e>
 <e>
 <k>@cil_conv_i8</k>
-<v>50130</v>
+<v>50257</v>
 </e>
 <e>
 <k>@cil_conv_r4</k>
-<v>2459</v>
+<v>2465</v>
 </e>
 <e>
 <k>@cil_conv_r8</k>
-<v>5264</v>
+<v>5277</v>
 </e>
 <e>
 <k>@cil_conv_u4</k>
-<v>7806</v>
+<v>7826</v>
 </e>
 <e>
 <k>@cil_conv_u8</k>
-<v>19482</v>
+<v>19531</v>
 </e>
 <e>
 <k>@cil_callvirt</k>
-<v>2043936</v>
+<v>2049088</v>
 </e>
 <e>
 <k>@cil_cpobj</k>
@@ -1405,63 +1405,63 @@
 </e>
 <e>
 <k>@cil_ldobj</k>
-<v>12614</v>
+<v>12645</v>
 </e>
 <e>
 <k>@cil_ldstr</k>
-<v>923821</v>
+<v>926149</v>
 </e>
 <e>
 <k>@cil_newobj</k>
-<v>654996</v>
+<v>656647</v>
 </e>
 <e>
 <k>@cil_castclass</k>
-<v>96761</v>
+<v>97005</v>
 </e>
 <e>
 <k>@cil_isinst</k>
-<v>56270</v>
+<v>56412</v>
 </e>
 <e>
 <k>@cil_conv_r_un</k>
-<v>262</v>
+<v>263</v>
 </e>
 <e>
 <k>@cil_unbox</k>
-<v>135</v>
+<v>136</v>
 </e>
 <e>
 <k>@cil_throw</k>
-<v>380023</v>
+<v>380980</v>
 </e>
 <e>
 <k>@cil_ldfld</k>
-<v>1671404</v>
+<v>1675616</v>
 </e>
 <e>
 <k>@cil_ldflda</k>
-<v>299754</v>
+<v>300510</v>
 </e>
 <e>
 <k>@cil_stfld</k>
-<v>1069707</v>
+<v>1072403</v>
 </e>
 <e>
 <k>@cil_ldsfld</k>
-<v>406053</v>
+<v>407076</v>
 </e>
 <e>
 <k>@cil_ldsflda</k>
-<v>2522</v>
+<v>2529</v>
 </e>
 <e>
 <k>@cil_stsfld</k>
-<v>130506</v>
+<v>130835</v>
 </e>
 <e>
 <k>@cil_stobj</k>
-<v>6999</v>
+<v>7017</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1_un</k>
@@ -1505,47 +1505,47 @@
 </e>
 <e>
 <k>@cil_box</k>
-<v>79588</v>
+<v>79788</v>
 </e>
 <e>
 <k>@cil_newarr</k>
-<v>111757</v>
+<v>112039</v>
 </e>
 <e>
 <k>@cil_ldlen</k>
-<v>55157</v>
+<v>55296</v>
 </e>
 <e>
 <k>@cil_ldelema</k>
-<v>9838</v>
+<v>9863</v>
 </e>
 <e>
 <k>@cil_ldelem_i1</k>
-<v>174</v>
+<v>175</v>
 </e>
 <e>
 <k>@cil_ldelem_u1</k>
-<v>15525</v>
+<v>15564</v>
 </e>
 <e>
 <k>@cil_ldelem_i2</k>
-<v>427</v>
+<v>428</v>
 </e>
 <e>
 <k>@cil_ldelem_u2</k>
-<v>6071</v>
+<v>6086</v>
 </e>
 <e>
 <k>@cil_ldelem_i4</k>
-<v>17528</v>
+<v>17572</v>
 </e>
 <e>
 <k>@cil_ldelem_u4</k>
-<v>19054</v>
+<v>19102</v>
 </e>
 <e>
 <k>@cil_ldelem_i8</k>
-<v>11884</v>
+<v>11914</v>
 </e>
 <e>
 <k>@cil_ldelem_i</k>
@@ -1553,15 +1553,15 @@
 </e>
 <e>
 <k>@cil_ldelem_r4</k>
-<v>281</v>
+<v>282</v>
 </e>
 <e>
 <k>@cil_ldelem_r8</k>
-<v>456</v>
+<v>458</v>
 </e>
 <e>
 <k>@cil_ldelem_ref</k>
-<v>30604</v>
+<v>30681</v>
 </e>
 <e>
 <k>@cil_stelem_i</k>
@@ -1569,19 +1569,19 @@
 </e>
 <e>
 <k>@cil_stelem_i1</k>
-<v>8764</v>
+<v>8786</v>
 </e>
 <e>
 <k>@cil_stelem_i2</k>
-<v>8958</v>
+<v>8981</v>
 </e>
 <e>
 <k>@cil_stelem_i4</k>
-<v>22754</v>
+<v>22811</v>
 </e>
 <e>
 <k>@cil_stelem_i8</k>
-<v>9396</v>
+<v>9419</v>
 </e>
 <e>
 <k>@cil_stelem_r4</k>
@@ -1589,23 +1589,23 @@
 </e>
 <e>
 <k>@cil_stelem_r8</k>
-<v>476</v>
+<v>477</v>
 </e>
 <e>
 <k>@cil_stelem_ref</k>
-<v>361804</v>
+<v>362716</v>
 </e>
 <e>
 <k>@cil_ldelem</k>
-<v>2270</v>
+<v>2275</v>
 </e>
 <e>
 <k>@cil_stelem</k>
-<v>53450</v>
+<v>53585</v>
 </e>
 <e>
 <k>@cil_unbox_any</k>
-<v>14344</v>
+<v>14380</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i1</k>
@@ -1613,7 +1613,7 @@
 </e>
 <e>
 <k>@cil_conv_ovf_u1</k>
-<v>111</v>
+<v>112</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i2</k>
@@ -1625,7 +1625,7 @@
 </e>
 <e>
 <k>@cil_conv_ovf_i4</k>
-<v>286</v>
+<v>287</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u4</k>
@@ -1653,23 +1653,23 @@
 </e>
 <e>
 <k>@cil_ldtoken</k>
-<v>71091</v>
+<v>71270</v>
 </e>
 <e>
 <k>@cil_conv_u2</k>
-<v>4326</v>
+<v>4337</v>
 </e>
 <e>
 <k>@cil_conv_u1</k>
-<v>11223</v>
+<v>11252</v>
 </e>
 <e>
 <k>@cil_conv_i</k>
-<v>3747</v>
+<v>3756</v>
 </e>
 <e>
 <k>@cil_conv_ovf_i</k>
-<v>267</v>
+<v>268</v>
 </e>
 <e>
 <k>@cil_conv_ovf_u</k>
@@ -1677,23 +1677,23 @@
 </e>
 <e>
 <k>@cil_add_ovf</k>
-<v>1725</v>
+<v>1729</v>
 </e>
 <e>
 <k>@cil_add_ovf_un</k>
-<v>150</v>
+<v>151</v>
 </e>
 <e>
 <k>@cil_mul_ovf</k>
-<v>442</v>
+<v>443</v>
 </e>
 <e>
 <k>@cil_mul_ovf_un</k>
-<v>252</v>
+<v>253</v>
 </e>
 <e>
 <k>@cil_sub_ovf</k>
-<v>1108</v>
+<v>1111</v>
 </e>
 <e>
 <k>@cil_sub_ovf_un</k>
@@ -1701,15 +1701,15 @@
 </e>
 <e>
 <k>@cil_endfinally</k>
-<v>56722</v>
+<v>56865</v>
 </e>
 <e>
 <k>@cil_leave</k>
-<v>66653</v>
+<v>66821</v>
 </e>
 <e>
 <k>@cil_leave_s</k>
-<v>148875</v>
+<v>149251</v>
 </e>
 <e>
 <k>@cil_stind_i</k>
@@ -1717,7 +1717,7 @@
 </e>
 <e>
 <k>@cil_conv_u</k>
-<v>5942</v>
+<v>5957</v>
 </e>
 <e>
 <k>@cil_arglist</k>
@@ -1725,31 +1725,31 @@
 </e>
 <e>
 <k>@cil_ceq</k>
-<v>99216</v>
+<v>99466</v>
 </e>
 <e>
 <k>@cil_cgt</k>
-<v>11834</v>
+<v>11864</v>
 </e>
 <e>
 <k>@cil_cgt_un</k>
-<v>37558</v>
+<v>37653</v>
 </e>
 <e>
 <k>@cil_clt</k>
-<v>19973</v>
+<v>20024</v>
 </e>
 <e>
 <k>@cil_clt_un</k>
-<v>1344</v>
+<v>1347</v>
 </e>
 <e>
 <k>@cil_ldftn</k>
-<v>79680</v>
+<v>79881</v>
 </e>
 <e>
 <k>@cil_ldvirtftn</k>
-<v>1108</v>
+<v>1111</v>
 </e>
 <e>
 <k>@cil_ldarg</k>
@@ -1777,11 +1777,11 @@
 </e>
 <e>
 <k>@cil_localloc</k>
-<v>1000</v>
+<v>1003</v>
 </e>
 <e>
 <k>@cil_endfilter</k>
-<v>806</v>
+<v>808</v>
 </e>
 <e>
 <k>@cil_unaligned</k>
@@ -1789,7 +1789,7 @@
 </e>
 <e>
 <k>@cil_volatile</k>
-<v>8511</v>
+<v>8532</v>
 </e>
 <e>
 <k>@cil_tail</k>
@@ -1797,11 +1797,11 @@
 </e>
 <e>
 <k>@cil_initobj</k>
-<v>101457</v>
+<v>101713</v>
 </e>
 <e>
 <k>@cil_constrained</k>
-<v>25233</v>
+<v>25296</v>
 </e>
 <e>
 <k>@cil_cpblk</k>
@@ -1813,11 +1813,11 @@
 </e>
 <e>
 <k>@cil_rethrow</k>
-<v>3757</v>
+<v>3766</v>
 </e>
 <e>
 <k>@cil_sizeof</k>
-<v>1725</v>
+<v>1729</v>
 </e>
 <e>
 <k>@cil_refanytype</k>
@@ -1829,80 +1829,84 @@
 </e>
 <e>
 <k>@cil_valueorreftype</k>
-<v>594030</v>
+<v>595527</v>
 </e>
 <e>
 <k>@cil_typeparameter</k>
-<v>184385</v>
+<v>184849</v>
 </e>
 <e>
 <k>@cil_array_type</k>
-<v>14140</v>
+<v>14176</v>
 </e>
 <e>
 <k>@cil_pointer_type</k>
-<v>622</v>
+<v>599</v>
+</e>
+<e>
+<k>@cil_function_pointer_type</k>
+<v>9</v>
 </e>
 <e>
 <k>@cil_method</k>
-<v>2307141</v>
+<v>2312956</v>
 </e>
 <e>
 <k>@cil_method_implementation</k>
-<v>1722264</v>
+<v>1726604</v>
 </e>
 <e>
 <k>@cil_field</k>
-<v>1006301</v>
+<v>1008837</v>
 </e>
 <e>
 <k>@cil_parameter</k>
-<v>4537393</v>
+<v>4548828</v>
 </e>
 <e>
 <k>@cil_property</k>
-<v>379138</v>
+<v>380094</v>
 </e>
 <e>
 <k>@cil_event</k>
-<v>20799</v>
+<v>20852</v>
 </e>
 <e>
 <k>@cil_local_variable</k>
-<v>1148313</v>
+<v>1151207</v>
 </e>
 <e>
 <k>@cil_catch_handler</k>
-<v>43719</v>
+<v>43829</v>
 </e>
 <e>
 <k>@cil_filter_handler</k>
-<v>806</v>
+<v>808</v>
 </e>
 <e>
 <k>@cil_finally_handler</k>
-<v>55254</v>
+<v>55393</v>
 </e>
 <e>
 <k>@cil_fault_handler</k>
-<v>1468</v>
+<v>1471</v>
 </e>
 <e>
 <k>@cil_attribute</k>
-<v>327607</v>
+<v>328433</v>
 </e>
 </typesizes>
   <stats><relation>
 <name>compilations</name>
-<cardinality>1093</cardinality>
+<cardinality>1096</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 <e>
 <k>cwd</k>
-<v>782</v>
+<v>784</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1916,7 +1920,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -1932,7 +1936,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>471</v>
+<v>472</v>
 </b>
 <b>
 <a>2</a>
@@ -1947,11 +1951,11 @@
 </relation>
 <relation>
 <name>compilation_args</name>
-<cardinality>4472</cardinality>
+<cardinality>4585</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 <e>
 <k>num</k>
@@ -1959,7 +1963,7 @@
 </e>
 <e>
 <k>arg</k>
-<v>1118</v>
+<v>1120</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -1973,12 +1977,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>996</v>
+<v>896</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>97</v>
+<v>199</v>
 </b>
 </bs>
 </hist>
@@ -1994,12 +1998,12 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>996</v>
+<v>896</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>97</v>
+<v>199</v>
 </b>
 </bs>
 </hist>
@@ -2013,8 +2017,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>20</a>
-<b>21</b>
+<a>41</a>
+<b>42</b>
 <v>4</v>
 </b>
 <b>
@@ -2039,13 +2043,13 @@
 <v>14</v>
 </b>
 <b>
-<a>20</a>
-<b>21</b>
+<a>41</a>
+<b>42</b>
 <v>4</v>
 </b>
 <b>
-<a>206</a>
-<b>207</b>
+<a>185</a>
+<b>186</b>
 <v>4</v>
 </b>
 </bs>
@@ -2062,10 +2066,10 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 <b>
-<a>20</a>
+<a>41</a>
 <b>226</b>
 <v>24</v>
 </b>
@@ -2083,7 +2087,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1108</v>
+<v>1111</v>
 </b>
 <b>
 <a>2</a>
@@ -2098,19 +2102,19 @@
 </relation>
 <relation>
 <name>compilation_compiling_files</name>
-<cardinality>22540</cardinality>
+<cardinality>22596</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 <e>
 <k>num</k>
-<v>709</v>
+<v>711</v>
 </e>
 <e>
 <k>file</k>
-<v>22535</v>
+<v>22592</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2448,7 +2452,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22530</v>
+<v>22587</v>
 </b>
 <b>
 <a>2</a>
@@ -2469,7 +2473,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22530</v>
+<v>22587</v>
 </b>
 <b>
 <a>2</a>
@@ -2484,19 +2488,19 @@
 </relation>
 <relation>
 <name>compilation_referencing_files</name>
-<cardinality>358547</cardinality>
+<cardinality>359451</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 <e>
 <k>num</k>
-<v>2736</v>
+<v>2743</v>
 </e>
 <e>
 <k>file</k>
-<v>3407</v>
+<v>3416</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2540,7 +2544,7 @@
 <b>
 <a>328</a>
 <b>344</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>344</a>
@@ -2616,7 +2620,7 @@
 <b>
 <a>328</a>
 <b>344</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>344</a>
@@ -2662,7 +2666,7 @@
 <b>
 <a>1</a>
 <b>4</b>
-<v>218</v>
+<v>219</v>
 </b>
 <b>
 <a>4</a>
@@ -2672,12 +2676,12 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>695</v>
+<v>696</v>
 </b>
 <b>
 <a>8</a>
 <b>118</b>
-<v>218</v>
+<v>219</v>
 </b>
 <b>
 <a>118</a>
@@ -2687,12 +2691,12 @@
 <b>
 <a>222</a>
 <b>223</b>
-<v>636</v>
+<v>638</v>
 </b>
 <b>
 <a>224</a>
 <b>225</b>
-<v>709</v>
+<v>711</v>
 </b>
 <b>
 <a>225</a>
@@ -2713,62 +2717,62 @@
 <b>
 <a>1</a>
 <b>4</b>
-<v>218</v>
+<v>219</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>126</v>
+<v>136</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>578</v>
+<v>570</v>
 </b>
 <b>
 <a>7</a>
 <b>20</b>
-<v>233</v>
+<v>199</v>
 </b>
 <b>
 <a>20</a>
 <b>25</b>
-<v>233</v>
+<v>219</v>
 </b>
 <b>
 <a>25</a>
 <b>30</b>
-<v>228</v>
+<v>219</v>
 </b>
 <b>
 <a>30</a>
-<b>37</b>
+<b>35</b>
 <v>209</v>
 </b>
 <b>
-<a>37</a>
-<b>48</b>
+<a>35</a>
+<b>46</b>
 <v>209</v>
 </b>
 <b>
-<a>48</a>
-<b>58</b>
-<v>213</v>
+<a>46</a>
+<b>57</b>
+<v>214</v>
 </b>
 <b>
-<a>58</a>
+<a>57</a>
 <b>60</b>
-<v>199</v>
+<v>233</v>
 </b>
 <b>
 <a>60</a>
 <b>63</b>
-<v>209</v>
+<v>214</v>
 </b>
 <b>
 <a>63</a>
-<b>67</b>
-<v>77</v>
+<b>69</b>
+<v>97</v>
 </b>
 </bs>
 </hist>
@@ -2784,12 +2788,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>524</v>
+<v>526</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>6</a>
@@ -2799,7 +2803,7 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>315</v>
+<v>316</v>
 </b>
 <b>
 <a>8</a>
@@ -2809,12 +2813,12 @@
 <b>
 <a>10</a>
 <b>23</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>23</a>
 <b>122</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>124</a>
@@ -2824,17 +2828,17 @@
 <b>
 <a>220</a>
 <b>221</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>222</a>
 <b>223</b>
-<v>481</v>
+<v>482</v>
 </b>
 <b>
 <a>224</a>
 <b>225</b>
-<v>714</v>
+<v>716</v>
 </b>
 </bs>
 </hist>
@@ -2850,62 +2854,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>559</v>
+<v>560</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>199</v>
+<v>209</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>301</v>
+<v>268</v>
 </b>
 <b>
 <a>7</a>
-<b>11</b>
-<v>296</v>
+<b>10</b>
+<v>287</v>
 </b>
 <b>
-<a>11</a>
-<b>18</b>
-<v>257</v>
-</b>
-<b>
-<a>18</a>
-<b>22</b>
-<v>306</v>
-</b>
-<b>
-<a>22</a>
-<b>27</b>
-<v>272</v>
-</b>
-<b>
-<a>27</a>
-<b>58</b>
-<v>277</v>
-</b>
-<b>
-<a>58</a>
-<b>61</b>
-<v>272</v>
-</b>
-<b>
-<a>61</a>
-<b>66</b>
+<a>10</a>
+<b>19</b>
 <v>311</v>
 </b>
 <b>
+<a>19</a>
+<b>23</b>
+<v>268</v>
+</b>
+<b>
+<a>23</a>
+<b>28</b>
+<v>282</v>
+</b>
+<b>
+<a>28</a>
+<b>59</b>
+<v>268</v>
+</b>
+<b>
+<a>59</a>
+<b>62</b>
+<v>263</v>
+</b>
+<b>
+<a>62</a>
+<b>66</b>
+<v>297</v>
+</b>
+<b>
 <a>66</a>
-<b>71</b>
-<v>97</v>
+<b>72</b>
+<v>141</v>
 </b>
 </bs>
 </hist>
@@ -2915,11 +2919,11 @@
 </relation>
 <relation>
 <name>compilation_time</name>
-<cardinality>7655</cardinality>
+<cardinality>7675</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 <e>
 <k>num</k>
@@ -2931,7 +2935,7 @@
 </e>
 <e>
 <k>seconds</k>
-<v>5896</v>
+<v>5443</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -2945,7 +2949,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -2961,7 +2965,7 @@
 <b>
 <a>7</a>
 <b>8</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -2977,129 +2981,134 @@
 <b>
 <a>6</a>
 <b>7</b>
+<v>4</v>
+</b>
+<b>
+<a>7</a>
+<b>8</b>
+<v>1091</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>225</a>
+<b>226</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>7</a>
+<b>8</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>num</src>
+<trg>seconds</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1117</a>
+<b>1118</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>225</a>
+<b>226</b>
+<v>34</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>num</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>34</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>seconds</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>159</a>
+<b>160</b>
+<v>4</v>
+</b>
+<b>
+<a>166</a>
+<b>167</b>
+<v>4</v>
+</b>
+<b>
+<a>172</a>
+<b>173</b>
+<v>4</v>
+</b>
+<b>
+<a>177</a>
+<b>178</b>
+<v>4</v>
+</b>
+<b>
+<a>224</a>
+<b>225</b>
+<v>4</v>
+</b>
+<b>
+<a>225</a>
+<b>226</b>
 <v>9</v>
 </b>
-<b>
-<a>7</a>
-<b>8</b>
-<v>1083</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>225</a>
-<b>226</b>
-<v>4</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num</src>
-<trg>kind</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>7</a>
-<b>8</b>
-<v>4</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>num</src>
-<trg>seconds</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1213</a>
-<b>1214</b>
-<v>4</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>kind</src>
-<trg>id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>225</a>
-<b>226</b>
-<v>34</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>kind</src>
-<trg>num</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>34</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>kind</src>
-<trg>seconds</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>168</a>
-<b>169</b>
-<v>4</v>
-</b>
-<b>
-<a>176</a>
-<b>177</b>
-<v>4</v>
-</b>
-<b>
-<a>192</a>
-<b>193</b>
-<v>4</v>
-</b>
-<b>
-<a>193</a>
-<b>194</b>
-<v>4</v>
-</b>
-<b>
-<a>225</a>
-<b>226</b>
-<v>14</v>
-</b>
 </bs>
 </hist>
 </val>
@@ -3114,64 +3123,64 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4807</v>
+<v>4249</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>612</v>
-</b>
-<b>
-<a>3</a>
-<b>6</b>
-<v>461</v>
-</b>
-<b>
-<a>6</a>
-<b>9</b>
-<v>14</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>seconds</src>
-<trg>num</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>5896</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>seconds</src>
-<trg>kind</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>5079</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>719</v>
+<v>584</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>97</v>
+<v>492</v>
+</b>
+<b>
+<a>5</a>
+<b>8</b>
+<v>116</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>seconds</src>
+<trg>num</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5443</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>seconds</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>4522</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>730</v>
+</b>
+<b>
+<a>3</a>
+<b>5</b>
+<v>190</v>
 </b>
 </bs>
 </hist>
@@ -4414,11 +4423,11 @@
 </relation>
 <relation>
 <name>extractor_messages</name>
-<cardinality>7615</cardinality>
+<cardinality>7631</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>7615</v>
+<v>7631</v>
 </e>
 <e>
 <k>severity</k>
@@ -4442,7 +4451,7 @@
 </e>
 <e>
 <k>stack_trace</k>
-<v>210</v>
+<v>212</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -4456,7 +4465,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7615</v>
+<v>7631</v>
 </b>
 </bs>
 </hist>
@@ -4472,7 +4481,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7615</v>
+<v>7631</v>
 </b>
 </bs>
 </hist>
@@ -4488,7 +4497,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7615</v>
+<v>7631</v>
 </b>
 </bs>
 </hist>
@@ -4504,7 +4513,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7615</v>
+<v>7631</v>
 </b>
 </bs>
 </hist>
@@ -4520,7 +4529,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7615</v>
+<v>7631</v>
 </b>
 </bs>
 </hist>
@@ -4536,7 +4545,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>7615</v>
+<v>7631</v>
 </b>
 </bs>
 </hist>
@@ -4560,8 +4569,8 @@
 <v>1</v>
 </b>
 <b>
-<a>7586</a>
-<b>7587</b>
+<a>7602</a>
+<b>7603</b>
 <v>1</v>
 </b>
 </bs>
@@ -4670,8 +4679,8 @@
 <v>2</v>
 </b>
 <b>
-<a>209</a>
-<b>210</b>
+<a>211</a>
+<b>212</b>
 <v>1</v>
 </b>
 </bs>
@@ -4686,8 +4695,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>7615</a>
-<b>7616</b>
+<a>7631</a>
+<b>7632</b>
 <v>1</v>
 </b>
 </bs>
@@ -4766,8 +4775,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>210</a>
-<b>211</b>
+<a>212</a>
+<b>213</b>
 <v>1</v>
 </b>
 </bs>
@@ -4792,11 +4801,6 @@
 <v>1</v>
 </b>
 <b>
-<a>8</a>
-<b>9</b>
-<v>1</v>
-</b>
-<b>
 <a>11</a>
 <b>12</b>
 <v>1</v>
@@ -4809,7 +4813,7 @@
 <b>
 <a>24</a>
 <b>25</b>
-<v>1</v>
+<v>2</v>
 </b>
 <b>
 <a>38</a>
@@ -4827,13 +4831,13 @@
 <v>1</v>
 </b>
 <b>
-<a>326</a>
-<b>327</b>
+<a>324</a>
+<b>325</b>
 <v>1</v>
 </b>
 <b>
-<a>2411</a>
-<b>2412</b>
+<a>2413</a>
+<b>2414</b>
 <v>1</v>
 </b>
 <b>
@@ -4920,13 +4924,13 @@
 <v>1</v>
 </b>
 <b>
-<a>275</a>
-<b>276</b>
+<a>274</a>
+<b>275</b>
 <v>1</v>
 </b>
 <b>
-<a>1647</a>
-<b>1648</b>
+<a>1648</a>
+<b>1649</b>
 <v>1</v>
 </b>
 <b>
@@ -4981,13 +4985,13 @@
 <v>1</v>
 </b>
 <b>
-<a>326</a>
-<b>327</b>
+<a>324</a>
+<b>325</b>
 <v>1</v>
 </b>
 <b>
-<a>2017</a>
-<b>2018</b>
+<a>2019</a>
+<b>2020</b>
 <v>1</v>
 </b>
 <b>
@@ -5009,7 +5013,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4</v>
+<v>5</v>
 </b>
 <b>
 <a>2</a>
@@ -5019,16 +5023,11 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>1</v>
+<v>2</v>
 </b>
 <b>
-<a>4</a>
-<b>5</b>
-<v>1</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
+<a>7</a>
+<b>8</b>
 <v>1</v>
 </b>
 <b>
@@ -5037,18 +5036,13 @@
 <v>1</v>
 </b>
 <b>
-<a>9</a>
-<b>10</b>
+<a>56</a>
+<b>57</b>
 <v>1</v>
 </b>
 <b>
-<a>53</a>
-<b>54</b>
-<v>1</v>
-</b>
-<b>
-<a>123</a>
-<b>124</b>
+<a>129</a>
+<b>130</b>
 <v>1</v>
 </b>
 </bs>
@@ -5170,12 +5164,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5210</v>
+<v>5220</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>83</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -5199,8 +5193,8 @@
 <v>902</v>
 </b>
 <b>
-<a>13</a>
-<b>14</b>
+<a>29</a>
+<b>30</b>
 <v>1</v>
 </b>
 </bs>
@@ -5296,12 +5290,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6687</v>
+<v>6689</v>
 </b>
 <b>
 <a>2</a>
-<b>7</b>
-<v>14</v>
+<b>3</b>
+<v>12</v>
 </b>
 </bs>
 </hist>
@@ -5317,52 +5311,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>61</v>
+<v>60</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37</v>
+<v>43</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12</v>
+<v>19</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>16</v>
+<b>6</b>
+<v>18</v>
 </b>
 <b>
-<a>5</a>
-<b>7</b>
-<v>16</v>
-</b>
-<b>
-<a>7</a>
+<a>6</a>
 <b>10</b>
-<v>16</v>
+<v>17</v>
 </b>
 <b>
 <a>10</a>
-<b>16</b>
+<b>15</b>
+<v>17</v>
+</b>
+<b>
+<a>17</a>
+<b>59</b>
 <v>16</v>
 </b>
 <b>
-<a>20</a>
-<b>74</b>
+<a>60</a>
+<b>340</b>
 <v>16</v>
 </b>
 <b>
-<a>76</a>
-<b>432</b>
-<v>16</v>
-</b>
-<b>
-<a>563</a>
-<b>1147</b>
-<v>4</v>
+<a>412</a>
+<b>1173</b>
+<v>6</v>
 </b>
 </bs>
 </hist>
@@ -5378,7 +5367,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>209</v>
+<v>211</v>
 </b>
 <b>
 <a>2</a>
@@ -5399,7 +5388,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>210</v>
+<v>212</v>
 </b>
 </bs>
 </hist>
@@ -5415,7 +5404,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>209</v>
+<v>211</v>
 </b>
 <b>
 <a>2</a>
@@ -5436,47 +5425,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>76</v>
+<v>78</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32</v>
+<v>35</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>16</v>
+<v>25</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>12</v>
+<b>6</b>
+<v>14</v>
 </b>
 <b>
-<a>5</a>
-<b>7</b>
+<a>6</a>
+<b>10</b>
 <v>18</v>
 </b>
 <b>
-<a>7</a>
-<b>12</b>
-<v>18</v>
-</b>
-<b>
-<a>12</a>
-<b>43</b>
+<a>10</a>
+<b>20</b>
 <v>16</v>
 </b>
 <b>
-<a>45</a>
-<b>250</b>
+<a>20</a>
+<b>117</b>
 <v>16</v>
 </b>
 <b>
-<a>277</a>
-<b>925</b>
-<v>6</v>
+<a>129</a>
+<b>946</b>
+<v>10</v>
 </b>
 </bs>
 </hist>
@@ -5492,47 +5476,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>71</v>
+<v>69</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>32</v>
+<v>39</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>15</v>
+<v>22</v>
 </b>
 <b>
 <a>4</a>
-<b>5</b>
-<v>15</v>
+<b>6</b>
+<v>19</v>
 </b>
 <b>
-<a>5</a>
-<b>7</b>
-<v>14</v>
-</b>
-<b>
-<a>7</a>
+<a>6</a>
 <b>11</b>
-<v>16</v>
+<v>18</v>
 </b>
 <b>
 <a>11</a>
-<b>22</b>
+<b>20</b>
 <v>16</v>
 </b>
 <b>
-<a>28</a>
-<b>102</b>
+<a>21</a>
+<b>119</b>
 <v>16</v>
 </b>
 <b>
-<a>102</a>
-<b>1147</b>
-<v>15</v>
+<a>121</a>
+<b>1173</b>
+<v>13</v>
 </b>
 </bs>
 </hist>
@@ -5542,19 +5521,19 @@
 </relation>
 <relation>
 <name>compilation_finished</name>
-<cardinality>1093</cardinality>
+<cardinality>1096</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 <e>
 <k>cpu_seconds</k>
-<v>1001</v>
+<v>945</v>
 </e>
 <e>
 <k>elapsed_seconds</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5568,7 +5547,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5584,7 +5563,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5600,12 +5579,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>918</v>
+<v>808</v>
 </b>
 <b>
 <a>2</a>
+<b>3</b>
+<v>121</v>
+</b>
+<b>
+<a>3</a>
 <b>4</b>
-<v>82</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -5621,12 +5605,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>918</v>
+<v>808</v>
 </b>
 <b>
 <a>2</a>
+<b>3</b>
+<v>121</v>
+</b>
+<b>
+<a>3</a>
 <b>4</b>
-<v>82</v>
+<v>14</v>
 </b>
 </bs>
 </hist>
@@ -5642,7 +5631,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5658,7 +5647,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5668,15 +5657,15 @@
 </relation>
 <relation>
 <name>compilation_assembly</name>
-<cardinality>1093</cardinality>
+<cardinality>1096</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 <e>
 <k>assembly</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -5690,7 +5679,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -5706,7 +5695,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -6368,19 +6357,19 @@
 </relation>
 <relation>
 <name>duplicateCode</name>
-<cardinality>22690</cardinality>
+<cardinality>22748</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>22690</v>
+<v>22748</v>
 </e>
 <e>
 <k>relativePath</k>
-<v>3796</v>
+<v>3805</v>
 </e>
 <e>
 <k>equivClass</k>
-<v>6994</v>
+<v>7012</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -6394,7 +6383,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22690</v>
+<v>22748</v>
 </b>
 </bs>
 </hist>
@@ -6410,7 +6399,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22690</v>
+<v>22748</v>
 </b>
 </bs>
 </hist>
@@ -6426,32 +6415,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1059</v>
+<v>1062</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>563</v>
+<v>565</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>422</v>
+<v>423</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>218</v>
+<v>219</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>218</v>
+<v>219</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>335</v>
+<v>336</v>
 </b>
 <b>
 <a>8</a>
@@ -6461,12 +6450,12 @@
 <b>
 <a>10</a>
 <b>14</b>
-<v>315</v>
+<v>316</v>
 </b>
 <b>
 <a>14</a>
 <b>28</b>
-<v>286</v>
+<v>287</v>
 </b>
 <b>
 <a>29</a>
@@ -6487,17 +6476,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1127</v>
+<v>1130</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>520</v>
+<v>521</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>442</v>
+<v>443</v>
 </b>
 <b>
 <a>4</a>
@@ -6507,12 +6496,12 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>228</v>
+<v>229</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>325</v>
+<v>326</v>
 </b>
 <b>
 <a>8</a>
@@ -6527,7 +6516,7 @@
 <b>
 <a>14</a>
 <b>32</b>
-<v>291</v>
+<v>292</v>
 </b>
 <b>
 <a>33</a>
@@ -6548,32 +6537,32 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3757</v>
+<v>3766</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1142</v>
+<v>1145</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>782</v>
+<v>784</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>427</v>
+<v>428</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>568</v>
+<v>570</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>315</v>
+<v>316</v>
 </b>
 </bs>
 </hist>
@@ -6589,22 +6578,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>675</v>
+<v>677</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3431</v>
+<v>3440</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1074</v>
+<v>1076</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>675</v>
+<v>677</v>
 </b>
 <b>
 <a>5</a>
@@ -6614,12 +6603,12 @@
 <b>
 <a>6</a>
 <b>9</b>
-<v>578</v>
+<v>579</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>174</v>
+<v>175</v>
 </b>
 </bs>
 </hist>
@@ -8697,11 +8686,11 @@
 </relation>
 <relation>
 <name>locations_default</name>
-<cardinality>14071977</cardinality>
+<cardinality>14071909</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14071977</v>
+<v>14071909</v>
 </e>
 <e>
 <k>file</k>
@@ -8735,7 +8724,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071977</v>
+<v>14071909</v>
 </b>
 </bs>
 </hist>
@@ -8751,7 +8740,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071977</v>
+<v>14071909</v>
 </b>
 </bs>
 </hist>
@@ -8767,7 +8756,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071977</v>
+<v>14071909</v>
 </b>
 </bs>
 </hist>
@@ -8783,7 +8772,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071977</v>
+<v>14071909</v>
 </b>
 </bs>
 </hist>
@@ -8799,7 +8788,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14071977</v>
+<v>14071909</v>
 </b>
 </bs>
 </hist>
@@ -9259,7 +9248,7 @@
 </b>
 <b>
 <a>301</a>
-<b>10778</b>
+<b>10779</b>
 <v>9050</v>
 </b>
 </bs>
@@ -9544,12 +9533,12 @@
 </b>
 <b>
 <a>5447</a>
-<b>74977</b>
+<b>74975</b>
 <v>110</v>
 </b>
 <b>
 <a>76212</a>
-<b>2221242</b>
+<b>2221230</b>
 <v>24</v>
 </b>
 </bs>
@@ -10148,7 +10137,7 @@
 <v>124</v>
 </b>
 <b>
-<a>82672</a>
+<a>82670</a>
 <b>908062</b>
 <v>42</v>
 </b>
@@ -10915,27 +10904,27 @@
 </relation>
 <relation>
 <name>assemblies</name>
-<cardinality>4190</cardinality>
+<cardinality>4200</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4190</v>
+<v>4200</v>
 </e>
 <e>
 <k>file</k>
-<v>4190</v>
+<v>4200</v>
 </e>
 <e>
 <k>fullname</k>
-<v>3431</v>
+<v>3440</v>
 </e>
 <e>
 <k>name</k>
-<v>3164</v>
+<v>3172</v>
 </e>
 <e>
 <k>version</k>
-<v>369</v>
+<v>370</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -10949,7 +10938,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4190</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10965,7 +10954,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4190</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10981,7 +10970,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4190</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -10997,7 +10986,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4190</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -11013,7 +11002,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4190</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -11029,7 +11018,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4190</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -11045,7 +11034,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4190</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -11061,7 +11050,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4190</v>
+<v>4200</v>
 </b>
 </bs>
 </hist>
@@ -11077,12 +11066,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2673</v>
+<v>2680</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>758</v>
+<v>760</v>
 </b>
 </bs>
 </hist>
@@ -11098,12 +11087,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2673</v>
+<v>2680</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>758</v>
+<v>760</v>
 </b>
 </bs>
 </hist>
@@ -11119,7 +11108,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3431</v>
+<v>3440</v>
 </b>
 </bs>
 </hist>
@@ -11135,7 +11124,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3431</v>
+<v>3440</v>
 </b>
 </bs>
 </hist>
@@ -11151,12 +11140,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2182</v>
+<v>2188</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>938</v>
+<v>940</v>
 </b>
 <b>
 <a>3</a>
@@ -11177,12 +11166,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2182</v>
+<v>2188</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>938</v>
+<v>940</v>
 </b>
 <b>
 <a>3</a>
@@ -11203,12 +11192,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2940</v>
+<v>2948</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>223</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -11224,12 +11213,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2940</v>
+<v>2948</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>223</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -11403,19 +11392,19 @@
 </relation>
 <relation>
 <name>files</name>
-<cardinality>42382</cardinality>
+<cardinality>42489</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>42382</v>
+<v>42489</v>
 </e>
 <e>
 <k>name</k>
-<v>42382</v>
+<v>42489</v>
 </e>
 <e>
 <k>simple</k>
-<v>22890</v>
+<v>22947</v>
 </e>
 <e>
 <k>ext</k>
@@ -11437,7 +11426,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42382</v>
+<v>42489</v>
 </b>
 </bs>
 </hist>
@@ -11453,7 +11442,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42382</v>
+<v>42489</v>
 </b>
 </bs>
 </hist>
@@ -11469,7 +11458,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42382</v>
+<v>42489</v>
 </b>
 </bs>
 </hist>
@@ -11485,7 +11474,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42382</v>
+<v>42489</v>
 </b>
 </bs>
 </hist>
@@ -11501,7 +11490,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42382</v>
+<v>42489</v>
 </b>
 </bs>
 </hist>
@@ -11517,7 +11506,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42382</v>
+<v>42489</v>
 </b>
 </bs>
 </hist>
@@ -11533,7 +11522,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42382</v>
+<v>42489</v>
 </b>
 </bs>
 </hist>
@@ -11549,7 +11538,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>42382</v>
+<v>42489</v>
 </b>
 </bs>
 </hist>
@@ -11565,12 +11554,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21485</v>
+<v>21539</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>1404</v>
+<v>1408</v>
 </b>
 </bs>
 </hist>
@@ -11586,12 +11575,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21485</v>
+<v>21539</v>
 </b>
 <b>
 <a>2</a>
 <b>154</b>
-<v>1404</v>
+<v>1408</v>
 </b>
 </bs>
 </hist>
@@ -11607,12 +11596,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22102</v>
+<v>22158</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>787</v>
+<v>789</v>
 </b>
 </bs>
 </hist>
@@ -11628,7 +11617,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22890</v>
+<v>22947</v>
 </b>
 </bs>
 </hist>
@@ -11866,19 +11855,19 @@
 </relation>
 <relation>
 <name>folders</name>
-<cardinality>16906</cardinality>
+<cardinality>16948</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16906</v>
+<v>16948</v>
 </e>
 <e>
 <k>name</k>
-<v>14694</v>
+<v>14731</v>
 </e>
 <e>
 <k>simple</k>
-<v>2770</v>
+<v>2777</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -11892,7 +11881,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16906</v>
+<v>16948</v>
 </b>
 </bs>
 </hist>
@@ -11908,7 +11897,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16906</v>
+<v>16948</v>
 </b>
 </bs>
 </hist>
@@ -11924,7 +11913,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14694</v>
+<v>14731</v>
 </b>
 </bs>
 </hist>
@@ -11940,12 +11929,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12482</v>
+<v>12514</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2211</v>
+<v>2217</v>
 </b>
 </bs>
 </hist>
@@ -11961,12 +11950,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1817</v>
+<v>1822</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>374</v>
+<v>375</v>
 </b>
 <b>
 <a>3</a>
@@ -11997,12 +11986,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1817</v>
+<v>1822</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>374</v>
+<v>375</v>
 </b>
 <b>
 <a>3</a>
@@ -12027,15 +12016,15 @@
 </relation>
 <relation>
 <name>containerparent</name>
-<cardinality>57067</cardinality>
+<cardinality>57211</cardinality>
 <columnsizes>
 <e>
 <k>parent</k>
-<v>14694</v>
+<v>14731</v>
 </e>
 <e>
 <k>child</k>
-<v>57067</v>
+<v>57211</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12049,37 +12038,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>8239</v>
+<v>8260</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1934</v>
+<v>1939</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>768</v>
+<v>769</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>967</v>
+<v>969</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>1103</v>
+<v>1106</v>
 </b>
 <b>
 <a>9</a>
 <b>18</b>
-<v>1137</v>
+<v>1140</v>
 </b>
 <b>
 <a>18</a>
 <b>170</b>
-<v>544</v>
+<v>545</v>
 </b>
 </bs>
 </hist>
@@ -12095,7 +12084,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>57067</v>
+<v>57211</v>
 </b>
 </bs>
 </hist>
@@ -12105,11 +12094,11 @@
 </relation>
 <relation>
 <name>file_extraction_mode</name>
-<cardinality>26725</cardinality>
+<cardinality>26792</cardinality>
 <columnsizes>
 <e>
 <k>file</k>
-<v>26725</v>
+<v>26792</v>
 </e>
 <e>
 <k>mode</k>
@@ -12127,7 +12116,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26725</v>
+<v>26792</v>
 </b>
 </bs>
 </hist>
@@ -12153,15 +12142,15 @@
 </relation>
 <relation>
 <name>namespaces</name>
-<cardinality>21898</cardinality>
+<cardinality>21953</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>21898</v>
+<v>21953</v>
 </e>
 <e>
 <k>name</k>
-<v>4880</v>
+<v>4892</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12175,7 +12164,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>21898</v>
+<v>21953</v>
 </b>
 </bs>
 </hist>
@@ -12196,7 +12185,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>3485</v>
+<v>3494</v>
 </b>
 <b>
 <a>3</a>
@@ -12206,17 +12195,17 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>622</v>
+<v>623</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>369</v>
+<v>370</v>
 </b>
 <b>
 <a>10</a>
 <b>101</b>
-<v>369</v>
+<v>370</v>
 </b>
 <b>
 <a>110</a>
@@ -12231,15 +12220,15 @@
 </relation>
 <relation>
 <name>namespace_declarations</name>
-<cardinality>19720</cardinality>
+<cardinality>19770</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19720</v>
+<v>19770</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>3879</v>
+<v>3888</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12253,7 +12242,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19720</v>
+<v>19770</v>
 </b>
 </bs>
 </hist>
@@ -12269,42 +12258,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1395</v>
+<v>1398</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>797</v>
+<v>799</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>413</v>
+<v>414</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>306</v>
+<v>307</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>223</v>
+<v>224</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>330</v>
+<v>331</v>
 </b>
 <b>
 <a>9</a>
 <b>17</b>
-<v>301</v>
+<v>302</v>
 </b>
 <b>
 <a>17</a>
 <b>996</b>
-<v>111</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -12314,15 +12303,15 @@
 </relation>
 <relation>
 <name>namespace_declaration_location</name>
-<cardinality>19720</cardinality>
+<cardinality>19770</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>19720</v>
+<v>19770</v>
 </e>
 <e>
 <k>loc</k>
-<v>19720</v>
+<v>19770</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12336,7 +12325,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19720</v>
+<v>19770</v>
 </b>
 </bs>
 </hist>
@@ -12352,7 +12341,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19720</v>
+<v>19770</v>
 </b>
 </bs>
 </hist>
@@ -12362,15 +12351,15 @@
 </relation>
 <relation>
 <name>parent_namespace</name>
-<cardinality>775518</cardinality>
+<cardinality>777473</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>775518</v>
+<v>777473</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>13527</v>
+<v>13562</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12384,7 +12373,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>775518</v>
+<v>777473</v>
 </b>
 </bs>
 </hist>
@@ -12400,52 +12389,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3320</v>
+<v>3328</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1623</v>
+<v>1627</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1025</v>
+<v>1028</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>913</v>
+<v>916</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>1249</v>
+<v>1252</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>1088</v>
+<v>1091</v>
 </b>
 <b>
 <a>10</a>
 <b>15</b>
-<v>1137</v>
+<v>1140</v>
 </b>
 <b>
 <a>15</a>
 <b>23</b>
-<v>1059</v>
+<v>1062</v>
 </b>
 <b>
 <a>23</a>
 <b>51</b>
-<v>1025</v>
+<v>1028</v>
 </b>
 <b>
 <a>51</a>
 <b>835</b>
-<v>1015</v>
+<v>1018</v>
 </b>
 <b>
 <a>900</a>
@@ -12460,15 +12449,15 @@
 </relation>
 <relation>
 <name>parent_namespace_declaration</name>
-<cardinality>88128</cardinality>
+<cardinality>88350</cardinality>
 <columnsizes>
 <e>
 <k>child_id</k>
-<v>87613</v>
+<v>87834</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>19720</v>
+<v>19770</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12482,12 +12471,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87462</v>
+<v>87683</v>
 </b>
 <b>
 <a>2</a>
 <b>60</b>
-<v>150</v>
+<v>151</v>
 </b>
 </bs>
 </hist>
@@ -12503,27 +12492,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13751</v>
+<v>13786</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>1711</v>
+<v>1715</v>
 </b>
 <b>
 <a>9</a>
 <b>13</b>
-<v>1273</v>
+<v>1276</v>
 </b>
 <b>
 <a>13</a>
 <b>16</b>
-<v>1424</v>
+<v>1427</v>
 </b>
 <b>
 <a>16</a>
 <b>32</b>
-<v>1506</v>
+<v>1510</v>
 </b>
 <b>
 <a>32</a>
@@ -12538,15 +12527,15 @@
 </relation>
 <relation>
 <name>using_namespace_directives</name>
-<cardinality>143966</cardinality>
+<cardinality>144329</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>143966</v>
+<v>144329</v>
 </e>
 <e>
 <k>namespace_id</k>
-<v>4219</v>
+<v>4229</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12560,7 +12549,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>143966</v>
+<v>144329</v>
 </b>
 </bs>
 </hist>
@@ -12576,17 +12565,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1492</v>
+<v>1496</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>471</v>
+<v>472</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>296</v>
+<v>297</v>
 </b>
 <b>
 <a>4</a>
@@ -12596,27 +12585,27 @@
 <b>
 <a>5</a>
 <b>8</b>
-<v>364</v>
+<v>365</v>
 </b>
 <b>
 <a>8</a>
 <b>14</b>
-<v>335</v>
+<v>336</v>
 </b>
 <b>
 <a>14</a>
 <b>25</b>
-<v>320</v>
+<v>321</v>
 </b>
 <b>
 <a>25</a>
 <b>63</b>
-<v>325</v>
+<v>326</v>
 </b>
 <b>
 <a>64</a>
 <b>465</b>
-<v>320</v>
+<v>321</v>
 </b>
 <b>
 <a>510</a>
@@ -12719,15 +12708,15 @@
 </relation>
 <relation>
 <name>using_directive_location</name>
-<cardinality>144024</cardinality>
+<cardinality>144387</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>144024</v>
+<v>144387</v>
 </e>
 <e>
 <k>loc</k>
-<v>143980</v>
+<v>144343</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12741,7 +12730,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>144024</v>
+<v>144387</v>
 </b>
 </bs>
 </hist>
@@ -12757,7 +12746,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>143937</v>
+<v>144299</v>
 </b>
 <b>
 <a>2</a>
@@ -12772,11 +12761,11 @@
 </relation>
 <relation>
 <name>types</name>
-<cardinality>865446</cardinality>
+<cardinality>867627</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>865446</v>
+<v>867627</v>
 </e>
 <e>
 <k>kind</k>
@@ -12784,7 +12773,7 @@
 </e>
 <e>
 <k>name</k>
-<v>366130</v>
+<v>367053</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12798,7 +12787,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>865446</v>
+<v>867627</v>
 </b>
 </bs>
 </hist>
@@ -12814,7 +12803,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>865446</v>
+<v>867627</v>
 </b>
 </bs>
 </hist>
@@ -12912,17 +12901,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>323966</v>
+<v>324783</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>28781</v>
+<v>28854</v>
 </b>
 <b>
 <a>5</a>
 <b>6356</b>
-<v>13382</v>
+<v>13415</v>
 </b>
 </bs>
 </hist>
@@ -12938,12 +12927,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>364696</v>
+<v>365615</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1433</v>
+<v>1437</v>
 </b>
 </bs>
 </hist>
@@ -12953,15 +12942,15 @@
 </relation>
 <relation>
 <name>typerefs</name>
-<cardinality>234326</cardinality>
+<cardinality>234916</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>234326</v>
+<v>234916</v>
 </e>
 <e>
 <k>name</k>
-<v>176631</v>
+<v>177077</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -12975,7 +12964,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>234326</v>
+<v>234916</v>
 </b>
 </bs>
 </hist>
@@ -12991,17 +12980,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162112</v>
+<v>162520</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>13455</v>
+<v>13488</v>
 </b>
 <b>
 <a>7</a>
 <b>2183</b>
-<v>1064</v>
+<v>1067</v>
 </b>
 </bs>
 </hist>
@@ -13011,15 +13000,15 @@
 </relation>
 <relation>
 <name>typeref_type</name>
-<cardinality>234146</cardinality>
+<cardinality>234736</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>234146</v>
+<v>234736</v>
 </e>
 <e>
 <k>typeId</k>
-<v>234146</v>
+<v>234736</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13033,7 +13022,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>234146</v>
+<v>234736</v>
 </b>
 </bs>
 </hist>
@@ -13049,7 +13038,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>234146</v>
+<v>234736</v>
 </b>
 </bs>
 </hist>
@@ -13059,11 +13048,11 @@
 </relation>
 <relation>
 <name>array_element_type</name>
-<cardinality>9104</cardinality>
+<cardinality>9127</cardinality>
 <columnsizes>
 <e>
 <k>array</k>
-<v>9104</v>
+<v>9127</v>
 </e>
 <e>
 <k>dimension</k>
@@ -13075,7 +13064,7 @@
 </e>
 <e>
 <k>element</k>
-<v>9094</v>
+<v>9117</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13089,7 +13078,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9104</v>
+<v>9127</v>
 </b>
 </bs>
 </hist>
@@ -13105,7 +13094,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9104</v>
+<v>9127</v>
 </b>
 </bs>
 </hist>
@@ -13121,7 +13110,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9104</v>
+<v>9127</v>
 </b>
 </bs>
 </hist>
@@ -13263,7 +13252,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9085</v>
+<v>9107</v>
 </b>
 <b>
 <a>2</a>
@@ -13284,7 +13273,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9094</v>
+<v>9117</v>
 </b>
 </bs>
 </hist>
@@ -13300,7 +13289,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>9085</v>
+<v>9107</v>
 </b>
 <b>
 <a>2</a>
@@ -13363,15 +13352,15 @@
 </relation>
 <relation>
 <name>pointer_referent_type</name>
-<cardinality>218</cardinality>
+<cardinality>219</cardinality>
 <columnsizes>
 <e>
 <k>pointer</k>
-<v>218</v>
+<v>219</v>
 </e>
 <e>
 <k>referent</k>
-<v>218</v>
+<v>219</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13385,7 +13374,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>218</v>
+<v>219</v>
 </b>
 </bs>
 </hist>
@@ -13401,7 +13390,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>218</v>
+<v>219</v>
 </b>
 </bs>
 </hist>
@@ -13411,11 +13400,11 @@
 </relation>
 <relation>
 <name>enum_underlying_type</name>
-<cardinality>11928</cardinality>
+<cardinality>11958</cardinality>
 <columnsizes>
 <e>
 <k>enum_id</k>
-<v>11928</v>
+<v>11958</v>
 </e>
 <e>
 <k>underlying_type_id</k>
@@ -13433,7 +13422,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11928</v>
+<v>11958</v>
 </b>
 </bs>
 </hist>
@@ -13489,15 +13478,15 @@
 </relation>
 <relation>
 <name>delegate_return_type</name>
-<cardinality>107339</cardinality>
+<cardinality>107609</cardinality>
 <columnsizes>
 <e>
 <k>delegate_id</k>
-<v>107339</v>
+<v>107609</v>
 </e>
 <e>
 <k>return_type_id</k>
-<v>55400</v>
+<v>55539</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13511,7 +13500,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107339</v>
+<v>107609</v>
 </b>
 </bs>
 </hist>
@@ -13527,12 +13516,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>52094</v>
+<v>52225</v>
 </b>
 <b>
 <a>2</a>
 <b>4178</b>
-<v>3305</v>
+<v>3313</v>
 </b>
 </bs>
 </hist>
@@ -13600,15 +13589,15 @@
 </relation>
 <relation>
 <name>extend</name>
-<cardinality>322844</cardinality>
+<cardinality>323657</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>322844</v>
+<v>323657</v>
 </e>
 <e>
 <k>super</k>
-<v>31503</v>
+<v>31583</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13622,7 +13611,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>322844</v>
+<v>323657</v>
 </b>
 </bs>
 </hist>
@@ -13638,22 +13627,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22583</v>
+<v>22640</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3971</v>
+<v>3981</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2411</v>
+<v>2417</v>
 </b>
 <b>
 <a>5</a>
 <b>70</b>
-<v>2372</v>
+<v>2378</v>
 </b>
 <b>
 <a>70</a>
@@ -13668,26 +13657,26 @@
 </relation>
 <relation>
 <name>anonymous_types</name>
-<cardinality>1210</cardinality>
+<cardinality>1213</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1210</v>
+<v>1213</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>implement</name>
-<cardinality>540550</cardinality>
+<cardinality>541913</cardinality>
 <columnsizes>
 <e>
 <k>sub</k>
-<v>225902</v>
+<v>226471</v>
 </e>
 <e>
 <k>super</k>
-<v>122301</v>
+<v>122609</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13701,27 +13690,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100572</v>
+<v>100826</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>56931</v>
+<v>57074</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>36038</v>
+<v>36129</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>18933</v>
+<v>18981</v>
 </b>
 <b>
 <a>7</a>
 <b>21</b>
-<v>13425</v>
+<v>13459</v>
 </b>
 </bs>
 </hist>
@@ -13737,27 +13726,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>66818</v>
+<v>66986</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29724</v>
+<v>29799</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10227</v>
+<v>10253</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>8676</v>
+<v>8698</v>
 </b>
 <b>
 <a>6</a>
 <b>21807</b>
-<v>6853</v>
+<v>6871</v>
 </b>
 </bs>
 </hist>
@@ -13767,15 +13756,15 @@
 </relation>
 <relation>
 <name>type_location</name>
-<cardinality>552591</cardinality>
+<cardinality>553984</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>466037</v>
+<v>467212</v>
 </e>
 <e>
 <k>loc</k>
-<v>29816</v>
+<v>29892</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13789,17 +13778,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>406578</v>
+<v>407603</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>39154</v>
+<v>39253</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>20304</v>
+<v>20355</v>
 </b>
 </bs>
 </hist>
@@ -13815,17 +13804,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>25952</v>
+<v>26017</v>
 </b>
 <b>
 <a>2</a>
 <b>26</b>
-<v>2265</v>
+<v>2270</v>
 </b>
 <b>
 <a>26</a>
 <b>12195</b>
-<v>1599</v>
+<v>1603</v>
 </b>
 </bs>
 </hist>
@@ -13835,15 +13824,15 @@
 </relation>
 <relation>
 <name>tuple_underlying_type</name>
-<cardinality>1779</cardinality>
+<cardinality>1783</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>1779</v>
+<v>1783</v>
 </e>
 <e>
 <k>struct</k>
-<v>1137</v>
+<v>1140</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13857,7 +13846,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1779</v>
+<v>1783</v>
 </b>
 </bs>
 </hist>
@@ -13873,17 +13862,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>641</v>
+<v>643</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>422</v>
+<v>423</v>
 </b>
 <b>
 <a>3</a>
 <b>9</b>
-<v>72</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -13893,11 +13882,11 @@
 </relation>
 <relation>
 <name>tuple_element</name>
-<cardinality>6776</cardinality>
+<cardinality>6793</cardinality>
 <columnsizes>
 <e>
 <k>tuple</k>
-<v>1774</v>
+<v>1778</v>
 </e>
 <e>
 <k>index</k>
@@ -13905,7 +13894,7 @@
 </e>
 <e>
 <k>field</k>
-<v>6776</v>
+<v>6793</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -13924,12 +13913,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1132</v>
+<v>1135</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>145</v>
+<v>146</v>
 </b>
 <b>
 <a>4</a>
@@ -13939,17 +13928,17 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>140</v>
+<v>141</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>140</v>
+<v>141</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>106</v>
+<v>107</v>
 </b>
 </bs>
 </hist>
@@ -13970,12 +13959,12 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>1132</v>
+<v>1135</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>145</v>
+<v>146</v>
 </b>
 <b>
 <a>4</a>
@@ -13985,17 +13974,17 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>140</v>
+<v>141</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>140</v>
+<v>141</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>106</v>
+<v>107</v>
 </b>
 </bs>
 </hist>
@@ -14243,7 +14232,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6776</v>
+<v>6793</v>
 </b>
 </bs>
 </hist>
@@ -14259,7 +14248,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6776</v>
+<v>6793</v>
 </b>
 </bs>
 </hist>
@@ -14269,19 +14258,19 @@
 </relation>
 <relation>
 <name>attributes</name>
-<cardinality>743932</cardinality>
+<cardinality>745807</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>743932</v>
+<v>745807</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1681</v>
+<v>1686</v>
 </e>
 <e>
 <k>target</k>
-<v>426172</v>
+<v>427247</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14295,7 +14284,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>743932</v>
+<v>745807</v>
 </b>
 </bs>
 </hist>
@@ -14311,7 +14300,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>743932</v>
+<v>745807</v>
 </b>
 </bs>
 </hist>
@@ -14327,7 +14316,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>189</v>
+<v>190</v>
 </b>
 <b>
 <a>2</a>
@@ -14342,12 +14331,12 @@
 <b>
 <a>4</a>
 <b>7</b>
-<v>140</v>
+<v>141</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>150</v>
+<v>151</v>
 </b>
 <b>
 <a>10</a>
@@ -14403,7 +14392,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>315</v>
+<v>316</v>
 </b>
 <b>
 <a>2</a>
@@ -14418,12 +14407,12 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>140</v>
+<v>141</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>140</v>
+<v>141</v>
 </b>
 <b>
 <a>9</a>
@@ -14458,7 +14447,7 @@
 <b>
 <a>596</a>
 <b>39377</b>
-<v>111</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -14474,17 +14463,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>364351</v>
+<v>365269</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>47384</v>
+<v>47503</v>
 </b>
 <b>
 <a>3</a>
 <b>957</b>
-<v>14436</v>
+<v>14473</v>
 </b>
 </bs>
 </hist>
@@ -14500,17 +14489,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>393497</v>
+<v>394489</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>32305</v>
+<v>32387</v>
 </b>
 <b>
 <a>16</a>
 <b>20</b>
-<v>369</v>
+<v>370</v>
 </b>
 </bs>
 </hist>
@@ -14520,15 +14509,15 @@
 </relation>
 <relation>
 <name>attribute_location</name>
-<cardinality>811854</cardinality>
+<cardinality>813900</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>743932</v>
+<v>745807</v>
 </e>
 <e>
 <k>loc</k>
-<v>72184</v>
+<v>72366</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14542,12 +14531,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>676010</v>
+<v>677714</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>67921</v>
+<v>68093</v>
 </b>
 </bs>
 </hist>
@@ -14563,12 +14552,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>67989</v>
+<v>68161</v>
 </b>
 <b>
 <a>4</a>
 <b>26598</b>
-<v>4194</v>
+<v>4205</v>
 </b>
 </bs>
 </hist>
@@ -14578,19 +14567,19 @@
 </relation>
 <relation>
 <name>type_mention</name>
-<cardinality>1246314</cardinality>
+<cardinality>1249451</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1246314</v>
+<v>1249451</v>
 </e>
 <e>
 <k>type_id</k>
-<v>35250</v>
+<v>35336</v>
 </e>
 <e>
 <k>parent</k>
-<v>1028293</v>
+<v>1030880</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14604,7 +14593,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1246314</v>
+<v>1249451</v>
 </b>
 </bs>
 </hist>
@@ -14620,7 +14609,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1246314</v>
+<v>1249451</v>
 </b>
 </bs>
 </hist>
@@ -14636,52 +14625,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5804</v>
+<v>5816</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7126</v>
+<v>7144</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3598</v>
+<v>3607</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4000</v>
+<v>4011</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2063</v>
+<v>2069</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>2763</v>
+<v>2771</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>2845</v>
+<v>2851</v>
 </b>
 <b>
 <a>12</a>
 <b>22</b>
-<v>2713</v>
+<v>2720</v>
 </b>
 <b>
 <a>22</a>
 <b>69</b>
-<v>2644</v>
+<v>2650</v>
 </b>
 <b>
 <a>69</a>
 <b>80292</b>
-<v>1688</v>
+<v>1692</v>
 </b>
 </bs>
 </hist>
@@ -14697,52 +14686,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10003</v>
+<v>10026</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5779</v>
+<v>5794</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3438</v>
+<v>3446</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>2992</v>
+<v>3000</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2029</v>
+<v>2034</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>2530</v>
+<v>2537</v>
 </b>
 <b>
 <a>8</a>
 <b>13</b>
-<v>2749</v>
+<v>2756</v>
 </b>
 <b>
 <a>13</a>
 <b>29</b>
-<v>2675</v>
+<v>2681</v>
 </b>
 <b>
 <a>29</a>
 <b>263</b>
-<v>2644</v>
+<v>2650</v>
 </b>
 <b>
 <a>263</a>
 <b>66416</b>
-<v>407</v>
+<v>408</v>
 </b>
 </bs>
 </hist>
@@ -14758,17 +14747,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>874321</v>
+<v>876519</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>137800</v>
+<v>138147</v>
 </b>
 <b>
 <a>3</a>
 <b>182</b>
-<v>16171</v>
+<v>16212</v>
 </b>
 </bs>
 </hist>
@@ -14784,12 +14773,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1009031</v>
+<v>1011566</v>
 </b>
 <b>
 <a>2</a>
 <b>22</b>
-<v>19261</v>
+<v>19313</v>
 </b>
 </bs>
 </hist>
@@ -14799,15 +14788,15 @@
 </relation>
 <relation>
 <name>type_mention_location</name>
-<cardinality>1246314</cardinality>
+<cardinality>1249451</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1246314</v>
+<v>1249451</v>
 </e>
 <e>
 <k>loc</k>
-<v>1165481</v>
+<v>1168411</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14821,7 +14810,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1246314</v>
+<v>1249451</v>
 </b>
 </bs>
 </hist>
@@ -14837,12 +14826,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1137104</v>
+<v>1139966</v>
 </b>
 <b>
 <a>2</a>
 <b>199</b>
-<v>28376</v>
+<v>28445</v>
 </b>
 </bs>
 </hist>
@@ -14852,11 +14841,11 @@
 </relation>
 <relation>
 <name>type_annotation</name>
-<cardinality>50825</cardinality>
+<cardinality>50954</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>50825</v>
+<v>50954</v>
 </e>
 <e>
 <k>annotation</k>
@@ -14874,7 +14863,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50825</v>
+<v>50954</v>
 </b>
 </bs>
 </hist>
@@ -14910,11 +14899,11 @@
 </relation>
 <relation>
 <name>nullability</name>
-<cardinality>1992</cardinality>
+<cardinality>1998</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>1992</v>
+<v>1998</v>
 </e>
 <e>
 <k>kind</k>
@@ -14932,7 +14921,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1992</v>
+<v>1998</v>
 </b>
 </bs>
 </hist>
@@ -14968,11 +14957,11 @@
 </relation>
 <relation>
 <name>nullability_parent</name>
-<cardinality>6265</cardinality>
+<cardinality>6281</cardinality>
 <columnsizes>
 <e>
 <k>nullability</k>
-<v>520</v>
+<v>521</v>
 </e>
 <e>
 <k>index</k>
@@ -14980,7 +14969,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>1978</v>
+<v>1983</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -14994,7 +14983,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>340</v>
+<v>341</v>
 </b>
 <b>
 <a>2</a>
@@ -15223,12 +15212,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>593</v>
+<v>594</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1224</v>
+<v>1228</v>
 </b>
 <b>
 <a>3</a>
@@ -15249,17 +15238,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>495</v>
+<v>497</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>719</v>
+<v>721</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>291</v>
+<v>292</v>
 </b>
 <b>
 <a>4</a>
@@ -15269,7 +15258,7 @@
 <b>
 <a>5</a>
 <b>8</b>
-<v>140</v>
+<v>141</v>
 </b>
 <b>
 <a>8</a>
@@ -15289,15 +15278,15 @@
 </relation>
 <relation>
 <name>type_nullability</name>
-<cardinality>4590847</cardinality>
+<cardinality>4591439</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4523602</v>
+<v>4524289</v>
 </e>
 <e>
 <k>nullability</k>
-<v>953</v>
+<v>954</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15311,12 +15300,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4462766</v>
+<v>4463547</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>60836</v>
+<v>60742</v>
 </b>
 </bs>
 </hist>
@@ -15332,17 +15321,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>159</v>
+<v>160</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>143</v>
+<v>142</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>59</v>
+<v>60</v>
 </b>
 <b>
 <a>4</a>
@@ -15352,7 +15341,7 @@
 <b>
 <a>5</a>
 <b>7</b>
-<v>85</v>
+<v>83</v>
 </b>
 <b>
 <a>7</a>
@@ -15362,32 +15351,32 @@
 <b>
 <a>10</a>
 <b>14</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>14</a>
 <b>23</b>
-<v>76</v>
+<v>78</v>
 </b>
 <b>
 <a>23</a>
-<b>41</b>
+<b>42</b>
+<v>73</v>
+</b>
+<b>
+<a>43</a>
+<b>124</b>
 <v>72</v>
 </b>
 <b>
-<a>41</a>
-<b>123</b>
+<a>124</a>
+<b>5441</b>
 <v>72</v>
 </b>
 <b>
-<a>123</a>
-<b>4104</b>
-<v>72</v>
-</b>
-<b>
-<a>4576</a>
-<b>3672463</b>
-<v>10</v>
+<a>6284</a>
+<b>3670296</b>
+<v>8</v>
 </b>
 </bs>
 </hist>
@@ -15397,11 +15386,11 @@
 </relation>
 <relation>
 <name>expr_flowstate</name>
-<cardinality>2975621</cardinality>
+<cardinality>2983119</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2975621</v>
+<v>2983119</v>
 </e>
 <e>
 <k>state</k>
@@ -15419,7 +15408,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2975621</v>
+<v>2983119</v>
 </b>
 </bs>
 </hist>
@@ -15433,13 +15422,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>197302</a>
-<b>197303</b>
+<a>197299</a>
+<b>197300</b>
 <v>1</v>
 </b>
 <b>
-<a>2193035</a>
-<b>2193036</b>
+<a>2193033</a>
+<b>2193034</b>
 <v>1</v>
 </b>
 </bs>
@@ -15450,11 +15439,11 @@
 </relation>
 <relation>
 <name>type_parameters</name>
-<cardinality>202283</cardinality>
+<cardinality>202792</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>202283</v>
+<v>202792</v>
 </e>
 <e>
 <k>index</k>
@@ -15462,7 +15451,7 @@
 </e>
 <e>
 <k>generic_id</k>
-<v>103499</v>
+<v>103759</v>
 </e>
 <e>
 <k>variance</k>
@@ -15480,7 +15469,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>202283</v>
+<v>202792</v>
 </b>
 </bs>
 </hist>
@@ -15496,7 +15485,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>202283</v>
+<v>202792</v>
 </b>
 </bs>
 </hist>
@@ -15512,7 +15501,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>202283</v>
+<v>202792</v>
 </b>
 </bs>
 </hist>
@@ -15786,22 +15775,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80419</v>
+<v>80622</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10752</v>
+<v>10779</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8331</v>
+<v>8352</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>3995</v>
+<v>4005</v>
 </b>
 </bs>
 </hist>
@@ -15817,22 +15806,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80419</v>
+<v>80622</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10752</v>
+<v>10779</v>
 </b>
 <b>
 <a>3</a>
 <b>11</b>
-<v>8331</v>
+<v>8352</v>
 </b>
 <b>
 <a>11</a>
 <b>22</b>
-<v>3995</v>
+<v>4005</v>
 </b>
 </bs>
 </hist>
@@ -15848,12 +15837,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>103348</v>
+<v>103608</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>150</v>
+<v>151</v>
 </b>
 </bs>
 </hist>
@@ -15941,11 +15930,11 @@
 </relation>
 <relation>
 <name>type_arguments</name>
-<cardinality>642489</cardinality>
+<cardinality>644108</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>272708</v>
+<v>273395</v>
 </e>
 <e>
 <k>index</k>
@@ -15953,7 +15942,7 @@
 </e>
 <e>
 <k>constructed_id</k>
-<v>412056</v>
+<v>413095</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -15967,17 +15956,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>234195</v>
+<v>234785</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37040</v>
+<v>37133</v>
 </b>
 <b>
 <a>3</a>
 <b>21</b>
-<v>1472</v>
+<v>1476</v>
 </b>
 </bs>
 </hist>
@@ -15993,27 +15982,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>173584</v>
+<v>174021</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>56357</v>
+<v>56499</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>20527</v>
+<v>20579</v>
 </b>
 <b>
 <a>5</a>
 <b>23</b>
-<v>20610</v>
+<v>20662</v>
 </b>
 <b>
 <a>23</a>
 <b>2800</b>
-<v>1628</v>
+<v>1632</v>
 </b>
 </bs>
 </hist>
@@ -16241,17 +16230,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>289468</v>
+<v>290198</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>96037</v>
+<v>96279</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>26550</v>
+<v>26617</v>
 </b>
 </bs>
 </hist>
@@ -16267,17 +16256,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>287310</v>
+<v>288034</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>97034</v>
+<v>97278</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27712</v>
+<v>27782</v>
 </b>
 </bs>
 </hist>
@@ -16287,15 +16276,15 @@
 </relation>
 <relation>
 <name>constructed_generic</name>
-<cardinality>412056</cardinality>
+<cardinality>413095</cardinality>
 <columnsizes>
 <e>
 <k>constructed</k>
-<v>412056</v>
+<v>413095</v>
 </e>
 <e>
 <k>generic</k>
-<v>8560</v>
+<v>8581</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16309,7 +16298,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>412056</v>
+<v>413095</v>
 </b>
 </bs>
 </hist>
@@ -16325,42 +16314,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3436</v>
+<v>3445</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1152</v>
+<v>1154</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>617</v>
+<v>618</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>651</v>
+<v>653</v>
 </b>
 <b>
 <a>6</a>
 <b>11</b>
-<v>724</v>
+<v>726</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>646</v>
+<v>648</v>
 </b>
 <b>
 <a>26</a>
 <b>63</b>
-<v>656</v>
+<v>657</v>
 </b>
 <b>
 <a>63</a>
 <b>2866</b>
-<v>646</v>
+<v>648</v>
 </b>
 <b>
 <a>2964</a>
@@ -16375,15 +16364,15 @@
 </relation>
 <relation>
 <name>type_parameter_constraints</name>
-<cardinality>590676</cardinality>
+<cardinality>592165</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>590676</v>
+<v>592165</v>
 </e>
 <e>
 <k>param_id</k>
-<v>202195</v>
+<v>202705</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -16397,7 +16386,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>590676</v>
+<v>592165</v>
 </b>
 </bs>
 </hist>
@@ -16413,17 +16402,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>166914</v>
+<v>167335</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19944</v>
+<v>19994</v>
 </b>
 <b>
 <a>3</a>
 <b>307</b>
-<v>15170</v>
+<v>15209</v>
 </b>
 <b>
 <a>310</a>
@@ -16474,11 +16463,11 @@
 </relation>
 <relation>
 <name>general_type_parameter_constraints</name>
-<cardinality>106685</cardinality>
+<cardinality>106728</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>60446</v>
+<v>60487</v>
 </e>
 <e>
 <k>kind</k>
@@ -16496,12 +16485,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14207</v>
+<v>14246</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>46239</v>
+<v>46241</v>
 </b>
 </bs>
 </hist>
@@ -16520,23 +16509,23 @@
 <v>1</v>
 </b>
 <b>
-<a>277</a>
-<b>278</b>
+<a>283</a>
+<b>284</b>
 <v>1</v>
 </b>
 <b>
-<a>5837</a>
-<b>5838</b>
+<a>5855</a>
+<b>5856</b>
 <v>1</v>
 </b>
 <b>
-<a>46182</a>
-<b>46183</b>
+<a>46184</a>
+<b>46185</b>
 <v>1</v>
 </b>
 <b>
-<a>54385</a>
-<b>54386</b>
+<a>54402</a>
+<b>54403</b>
 <v>1</v>
 </b>
 </bs>
@@ -16547,11 +16536,11 @@
 </relation>
 <relation>
 <name>specific_type_parameter_constraints</name>
-<cardinality>46329</cardinality>
+<cardinality>46402</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>45629</v>
+<v>45696</v>
 </e>
 <e>
 <k>base_id</k>
@@ -16569,12 +16558,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>44975</v>
+<v>45036</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>654</v>
+<v>660</v>
 </b>
 </bs>
 </hist>
@@ -16600,22 +16589,22 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>74</v>
+<v>70</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>90</v>
+<v>94</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>60</v>
+<v>57</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>137</v>
+<v>139</v>
 </b>
 <b>
 <a>7</a>
@@ -16625,17 +16614,17 @@
 <b>
 <a>10</a>
 <b>15</b>
-<v>99</v>
+<v>100</v>
 </b>
 <b>
 <a>15</a>
 <b>21</b>
-<v>111</v>
+<v>110</v>
 </b>
 <b>
 <a>21</a>
 <b>37</b>
-<v>97</v>
+<v>98</v>
 </b>
 <b>
 <a>37</a>
@@ -16644,7 +16633,7 @@
 </b>
 <b>
 <a>108</a>
-<b>4902</b>
+<b>4910</b>
 <v>60</v>
 </b>
 </bs>
@@ -16655,15 +16644,15 @@
 </relation>
 <relation>
 <name>specific_type_parameter_nullability</name>
-<cardinality>31481</cardinality>
+<cardinality>31539</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>31339</v>
+<v>31391</v>
 </e>
 <e>
 <k>base_id</k>
-<v>912</v>
+<v>911</v>
 </e>
 <e>
 <k>nullability</k>
@@ -16681,12 +16670,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31197</v>
+<v>31243</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>142</v>
+<v>148</v>
 </b>
 </bs>
 </hist>
@@ -16702,7 +16691,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31339</v>
+<v>31391</v>
 </b>
 </bs>
 </hist>
@@ -16723,57 +16712,62 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>151</v>
+<v>150</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50</v>
+<v>45</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>39</v>
+<v>44</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>53</v>
+<v>51</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>102</v>
+<v>103</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>73</v>
+<v>72</v>
 </b>
 <b>
 <a>9</a>
-<b>13</b>
-<v>83</v>
+<b>12</b>
+<v>44</v>
 </b>
 <b>
-<a>14</a>
-<b>20</b>
-<v>66</v>
-</b>
-<b>
-<a>20</a>
-<b>29</b>
-<v>70</v>
-</b>
-<b>
-<a>29</a>
-<b>76</b>
+<a>12</a>
+<b>16</b>
 <v>71</v>
 </b>
 <b>
-<a>77</a>
+<a>16</a>
+<b>22</b>
+<v>71</v>
+</b>
+<b>
+<a>22</a>
+<b>39</b>
+<v>71</v>
+</b>
+<b>
+<a>39</a>
+<b>186</b>
+<v>69</v>
+</b>
+<b>
+<a>190</a>
 <b>4327</b>
-<v>57</v>
+<v>23</v>
 </b>
 </bs>
 </hist>
@@ -16789,7 +16783,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>890</v>
+<v>889</v>
 </b>
 <b>
 <a>2</a>
@@ -16873,8 +16867,8 @@
 <v>1</v>
 </b>
 <b>
-<a>30586</a>
-<b>30587</b>
+<a>30638</a>
+<b>30639</b>
 <v>1</v>
 </b>
 </bs>
@@ -16924,8 +16918,8 @@
 <v>1</v>
 </b>
 <b>
-<a>836</a>
-<b>837</b>
+<a>835</a>
+<b>836</b>
 <v>1</v>
 </b>
 </bs>
@@ -17112,11 +17106,11 @@
 </relation>
 <relation>
 <name>has_modifiers</name>
-<cardinality>5484722</cardinality>
+<cardinality>5498545</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3683263</v>
+<v>3692546</v>
 </e>
 <e>
 <k>mod_id</k>
@@ -17134,17 +17128,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2017016</v>
+<v>2022100</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1532872</v>
+<v>1536735</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>133374</v>
+<v>133710</v>
 </b>
 </bs>
 </hist>
@@ -17250,26 +17244,26 @@
 </relation>
 <relation>
 <name>compiler_generated</name>
-<cardinality>135571</cardinality>
+<cardinality>135913</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>135571</v>
+<v>135913</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>exprorstmt_name</name>
-<cardinality>3758</cardinality>
+<cardinality>3767</cardinality>
 <columnsizes>
 <e>
 <k>parent_id</k>
-<v>3758</v>
+<v>3767</v>
 </e>
 <e>
 <k>name</k>
-<v>374</v>
+<v>375</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17283,7 +17277,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3758</v>
+<v>3767</v>
 </b>
 </bs>
 </hist>
@@ -17299,7 +17293,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>110</v>
+<v>111</v>
 </b>
 <b>
 <a>3</a>
@@ -17349,19 +17343,19 @@
 </relation>
 <relation>
 <name>nested_types</name>
-<cardinality>111709</cardinality>
+<cardinality>111990</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>111709</v>
+<v>111990</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>40515</v>
+<v>40618</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>80954</v>
+<v>81158</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17375,7 +17369,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>111709</v>
+<v>111990</v>
 </b>
 </bs>
 </hist>
@@ -17391,7 +17385,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>111709</v>
+<v>111990</v>
 </b>
 </bs>
 </hist>
@@ -17407,32 +17401,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23439</v>
+<v>23498</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6324</v>
+<v>6340</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3222</v>
+<v>3230</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3349</v>
+<v>3357</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>3086</v>
+<v>3094</v>
 </b>
 <b>
 <a>12</a>
 <b>262</b>
-<v>1093</v>
+<v>1096</v>
 </b>
 </bs>
 </hist>
@@ -17448,32 +17442,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>23473</v>
+<v>23532</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6406</v>
+<v>6422</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3140</v>
+<v>3148</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>3378</v>
+<v>3386</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>3072</v>
+<v>3079</v>
 </b>
 <b>
 <a>12</a>
 <b>206</b>
-<v>1045</v>
+<v>1047</v>
 </b>
 </bs>
 </hist>
@@ -17489,12 +17483,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>77945</v>
+<v>78141</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>3008</v>
+<v>3016</v>
 </b>
 </bs>
 </hist>
@@ -17510,12 +17504,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78683</v>
+<v>78882</v>
 </b>
 <b>
 <a>2</a>
 <b>415</b>
-<v>2270</v>
+<v>2275</v>
 </b>
 </bs>
 </hist>
@@ -17525,27 +17519,27 @@
 </relation>
 <relation>
 <name>properties</name>
-<cardinality>422687</cardinality>
+<cardinality>423752</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>422687</v>
+<v>423752</v>
 </e>
 <e>
 <k>name</k>
-<v>84191</v>
+<v>84403</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>116142</v>
+<v>116435</v>
 </e>
 <e>
 <k>type_id</k>
-<v>52021</v>
+<v>52152</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>333178</v>
+<v>334018</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -17559,7 +17553,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>422687</v>
+<v>423752</v>
 </b>
 </bs>
 </hist>
@@ -17575,7 +17569,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>422687</v>
+<v>423752</v>
 </b>
 </bs>
 </hist>
@@ -17591,7 +17585,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>422687</v>
+<v>423752</v>
 </b>
 </bs>
 </hist>
@@ -17607,7 +17601,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>422687</v>
+<v>423752</v>
 </b>
 </bs>
 </hist>
@@ -17623,12 +17617,53 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>50650</v>
+<v>50778</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13965</v>
+<v>14000</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>5755</v>
+</b>
+<b>
+<a>4</a>
+<b>7</b>
+<v>6651</v>
+</b>
+<b>
+<a>7</a>
+<b>49</b>
+<v>6340</v>
+</b>
+<b>
+<a>49</a>
+<b>2611</b>
+<v>877</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>name</src>
+<trg>declaring_type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>50778</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>14068</v>
 </b>
 <b>
 <a>3</a>
@@ -17638,58 +17673,17 @@
 <b>
 <a>4</a>
 <b>7</b>
-<v>6635</v>
-</b>
-<b>
-<a>7</a>
-<b>49</b>
-<v>6324</v>
-</b>
-<b>
-<a>49</a>
-<b>2611</b>
-<v>874</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>name</src>
-<trg>declaring_type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>50650</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>14033</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>5726</v>
-</b>
-<b>
-<a>4</a>
-<b>7</b>
-<v>6669</v>
+<v>6686</v>
 </b>
 <b>
 <a>7</a>
 <b>51</b>
-<v>6319</v>
+<v>6335</v>
 </b>
 <b>
 <a>51</a>
 <b>2578</b>
-<v>792</v>
+<v>794</v>
 </b>
 </bs>
 </hist>
@@ -17705,17 +17699,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72690</v>
+<v>72873</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6917</v>
+<v>6934</v>
 </b>
 <b>
 <a>3</a>
 <b>524</b>
-<v>4583</v>
+<v>4595</v>
 </b>
 </bs>
 </hist>
@@ -17731,32 +17725,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>51078</v>
+<v>51207</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14227</v>
+<v>14263</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5726</v>
+<v>5740</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>6431</v>
+<v>6447</v>
 </b>
 <b>
 <a>7</a>
 <b>68</b>
-<v>6314</v>
+<v>6330</v>
 </b>
 <b>
 <a>68</a>
 <b>2018</b>
-<v>413</v>
+<v>414</v>
 </b>
 </bs>
 </hist>
@@ -17772,68 +17766,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39305</v>
+<v>39404</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29807</v>
+<v>29882</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10878</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>7826</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>7116</v>
-</b>
-<b>
-<a>6</a>
-<b>8</b>
-<v>9308</v>
-</b>
-<b>
-<a>8</a>
-<b>16</b>
-<v>9546</v>
-</b>
-<b>
-<a>16</a>
-<b>250</b>
-<v>2352</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>name</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>43806</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>25383</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>10873</v>
+<v>10906</v>
 </b>
 <b>
 <a>4</a>
@@ -17843,114 +17786,165 @@
 <b>
 <a>5</a>
 <b>6</b>
-<v>7130</v>
+<v>7134</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9264</v>
-</b>
-<b>
-<a>8</a>
-<b>14</b>
-<v>8725</v>
-</b>
-<b>
-<a>14</a>
-<b>250</b>
-<v>3111</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>45357</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>32548</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>13809</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>7529</v>
-</b>
-<b>
-<a>5</a>
-<b>7</b>
-<v>9362</v>
-</b>
-<b>
-<a>7</a>
-<b>48</b>
-<v>7534</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>unbound_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>39305</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>29807</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>10878</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>7826</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>7116</v>
-</b>
-<b>
-<a>6</a>
-<b>8</b>
-<v>9308</v>
+<v>9332</v>
 </b>
 <b>
 <a>8</a>
 <b>16</b>
-<v>9546</v>
+<v>9570</v>
 </b>
 <b>
 <a>16</a>
 <b>250</b>
-<v>2352</v>
+<v>2358</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>43917</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>25447</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>10901</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7865</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>7148</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>9288</v>
+</b>
+<b>
+<a>8</a>
+<b>14</b>
+<v>8747</v>
+</b>
+<b>
+<a>14</a>
+<b>250</b>
+<v>3118</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>45471</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>32630</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>13844</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7548</v>
+</b>
+<b>
+<a>5</a>
+<b>7</b>
+<v>9385</v>
+</b>
+<b>
+<a>7</a>
+<b>48</b>
+<v>7553</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>unbound_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>39404</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>29882</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>10906</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7845</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>7134</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>9332</v>
+</b>
+<b>
+<a>8</a>
+<b>16</b>
+<v>9570</v>
+</b>
+<b>
+<a>16</a>
+<b>250</b>
+<v>2358</v>
 </b>
 </bs>
 </hist>
@@ -17966,27 +17960,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31353</v>
+<v>31432</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10757</v>
+<v>10784</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4622</v>
+<v>4634</v>
 </b>
 <b>
 <a>5</a>
 <b>21</b>
-<v>3937</v>
+<v>3947</v>
 </b>
 <b>
 <a>21</a>
 <b>12516</b>
-<v>1351</v>
+<v>1354</v>
 </b>
 </bs>
 </hist>
@@ -18002,17 +17996,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43986</v>
+<v>44097</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4389</v>
+<v>4400</v>
 </b>
 <b>
 <a>3</a>
 <b>3289</b>
-<v>3645</v>
+<v>3654</v>
 </b>
 </bs>
 </hist>
@@ -18028,27 +18022,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32534</v>
+<v>32616</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10460</v>
+<v>10487</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4413</v>
+<v>4424</v>
 </b>
 <b>
 <a>5</a>
 <b>33</b>
-<v>3903</v>
+<v>3913</v>
 </b>
 <b>
 <a>33</a>
 <b>6176</b>
-<v>709</v>
+<v>711</v>
 </b>
 </bs>
 </hist>
@@ -18064,27 +18058,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31494</v>
+<v>31573</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10888</v>
+<v>10915</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>4656</v>
+<v>4668</v>
 </b>
 <b>
 <a>5</a>
 <b>22</b>
-<v>3903</v>
+<v>3913</v>
 </b>
 <b>
 <a>22</a>
 <b>10632</b>
-<v>1079</v>
+<v>1081</v>
 </b>
 </bs>
 </hist>
@@ -18100,12 +18094,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328016</v>
+<v>328842</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5162</v>
+<v>5175</v>
 </b>
 </bs>
 </hist>
@@ -18121,7 +18115,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>333178</v>
+<v>334018</v>
 </b>
 </bs>
 </hist>
@@ -18137,12 +18131,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>328016</v>
+<v>328842</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>5162</v>
+<v>5175</v>
 </b>
 </bs>
 </hist>
@@ -18158,12 +18152,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>331972</v>
+<v>332809</v>
 </b>
 <b>
 <a>2</a>
 <b>439</b>
-<v>1205</v>
+<v>1208</v>
 </b>
 </bs>
 </hist>
@@ -18173,15 +18167,15 @@
 </relation>
 <relation>
 <name>property_location</name>
-<cardinality>533380</cardinality>
+<cardinality>534725</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>422687</v>
+<v>423752</v>
 </e>
 <e>
 <k>loc</k>
-<v>52789</v>
+<v>52922</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18195,17 +18189,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>337431</v>
+<v>338282</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>63979</v>
+<v>64140</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>21276</v>
+<v>21329</v>
 </b>
 </bs>
 </hist>
@@ -18221,12 +18215,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49314</v>
+<v>49438</v>
 </b>
 <b>
 <a>2</a>
 <b>7080</b>
-<v>3475</v>
+<v>3484</v>
 </b>
 </bs>
 </hist>
@@ -18236,11 +18230,11 @@
 </relation>
 <relation>
 <name>indexers</name>
-<cardinality>17008</cardinality>
+<cardinality>17051</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>17008</v>
+<v>17051</v>
 </e>
 <e>
 <k>name</k>
@@ -18248,15 +18242,15 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>13523</v>
+<v>13557</v>
 </e>
 <e>
 <k>type_id</k>
-<v>3961</v>
+<v>3971</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>4428</v>
+<v>4439</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18270,7 +18264,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17008</v>
+<v>17051</v>
 </b>
 </bs>
 </hist>
@@ -18286,7 +18280,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17008</v>
+<v>17051</v>
 </b>
 </bs>
 </hist>
@@ -18302,7 +18296,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17008</v>
+<v>17051</v>
 </b>
 </bs>
 </hist>
@@ -18318,7 +18312,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>17008</v>
+<v>17051</v>
 </b>
 </bs>
 </hist>
@@ -18453,17 +18447,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10485</v>
+<v>10511</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2741</v>
+<v>2748</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>296</v>
+<v>297</v>
 </b>
 </bs>
 </hist>
@@ -18479,7 +18473,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13513</v>
+<v>13547</v>
 </b>
 <b>
 <a>2</a>
@@ -18500,12 +18494,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11024</v>
+<v>11052</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2498</v>
+<v>2504</v>
 </b>
 </bs>
 </hist>
@@ -18521,17 +18515,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>10485</v>
+<v>10511</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2741</v>
+<v>2748</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>296</v>
+<v>297</v>
 </b>
 </bs>
 </hist>
@@ -18547,27 +18541,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>874</v>
+<v>877</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>870</v>
+<v>872</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1623</v>
+<v>1627</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>6</a>
 <b>18</b>
-<v>301</v>
+<v>302</v>
 </b>
 <b>
 <a>18</a>
@@ -18588,7 +18582,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3956</v>
+<v>3966</v>
 </b>
 <b>
 <a>2</a>
@@ -18609,17 +18603,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1030</v>
+<v>1033</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>777</v>
+<v>779</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1657</v>
+<v>1661</v>
 </b>
 <b>
 <a>4</a>
@@ -18629,7 +18623,7 @@
 <b>
 <a>6</a>
 <b>978</b>
-<v>257</v>
+<v>258</v>
 </b>
 </bs>
 </hist>
@@ -18645,27 +18639,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>874</v>
+<v>877</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>870</v>
+<v>872</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1647</v>
+<v>1652</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>6</a>
 <b>198</b>
-<v>301</v>
+<v>302</v>
 </b>
 </bs>
 </hist>
@@ -18681,12 +18675,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4092</v>
+<v>4103</v>
 </b>
 <b>
 <a>2</a>
 <b>452</b>
-<v>335</v>
+<v>336</v>
 </b>
 </bs>
 </hist>
@@ -18702,7 +18696,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4428</v>
+<v>4439</v>
 </b>
 </bs>
 </hist>
@@ -18718,12 +18712,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4092</v>
+<v>4103</v>
 </b>
 <b>
 <a>2</a>
 <b>452</b>
-<v>335</v>
+<v>336</v>
 </b>
 </bs>
 </hist>
@@ -18739,12 +18733,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4238</v>
+<v>4249</v>
 </b>
 <b>
 <a>2</a>
 <b>452</b>
-<v>189</v>
+<v>190</v>
 </b>
 </bs>
 </hist>
@@ -18754,7 +18748,7 @@
 </relation>
 <relation>
 <name>indexer_location</name>
-<cardinality>23715</cardinality>
+<cardinality>23808</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -18762,7 +18756,7 @@
 </e>
 <e>
 <k>loc</k>
-<v>221</v>
+<v>222</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18776,22 +18770,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4492</v>
+<v>4407</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>6615</v>
+<v>6696</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>285</v>
+<v>287</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>1115</v>
+<v>1117</v>
 </b>
 <b>
 <a>5</a>
@@ -18817,7 +18811,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>23</v>
+<v>22</v>
 </b>
 <b>
 <a>3</a>
@@ -18842,7 +18836,7 @@
 <b>
 <a>13</a>
 <b>21</b>
-<v>18</v>
+<v>19</v>
 </b>
 <b>
 <a>23</a>
@@ -18851,13 +18845,13 @@
 </b>
 <b>
 <a>47</a>
-<b>2230</b>
+<b>1552</b>
 <v>17</v>
 </b>
 <b>
-<a>3540</a>
+<a>2318</a>
 <b>5425</b>
-<v>3</v>
+<v>4</v>
 </b>
 </bs>
 </hist>
@@ -18867,11 +18861,11 @@
 </relation>
 <relation>
 <name>accessors</name>
-<cardinality>566736</cardinality>
+<cardinality>568165</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>566736</v>
+<v>568165</v>
 </e>
 <e>
 <k>kind</k>
@@ -18879,15 +18873,15 @@
 </e>
 <e>
 <k>name</k>
-<v>121003</v>
+<v>121308</v>
 </e>
 <e>
 <k>declaring_member_id</k>
-<v>439696</v>
+<v>440804</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>439545</v>
+<v>440653</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -18901,7 +18895,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>566736</v>
+<v>568165</v>
 </b>
 </bs>
 </hist>
@@ -18917,7 +18911,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>566736</v>
+<v>568165</v>
 </b>
 </bs>
 </hist>
@@ -18933,7 +18927,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>566736</v>
+<v>568165</v>
 </b>
 </bs>
 </hist>
@@ -18949,7 +18943,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>566736</v>
+<v>568165</v>
 </b>
 </bs>
 </hist>
@@ -19049,27 +19043,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75043</v>
+<v>75232</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19910</v>
+<v>19960</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7913</v>
+<v>7933</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10105</v>
+<v>10131</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8030</v>
+<v>8050</v>
 </b>
 </bs>
 </hist>
@@ -19085,7 +19079,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>121003</v>
+<v>121308</v>
 </b>
 </bs>
 </hist>
@@ -19101,27 +19095,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75052</v>
+<v>75242</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19900</v>
+<v>19950</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7913</v>
+<v>7933</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>10105</v>
+<v>10131</v>
 </b>
 <b>
 <a>8</a>
 <b>2558</b>
-<v>8030</v>
+<v>8050</v>
 </b>
 </bs>
 </hist>
@@ -19137,27 +19131,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75689</v>
+<v>75880</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20576</v>
+<v>20628</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7748</v>
+<v>7767</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>9634</v>
+<v>9658</v>
 </b>
 <b>
 <a>8</a>
 <b>1202</b>
-<v>7354</v>
+<v>7373</v>
 </b>
 </bs>
 </hist>
@@ -19173,12 +19167,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>312665</v>
+<v>313453</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127026</v>
+<v>127346</v>
 </b>
 <b>
 <a>4</a>
@@ -19199,12 +19193,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>312665</v>
+<v>313453</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127030</v>
+<v>127351</v>
 </b>
 </bs>
 </hist>
@@ -19220,12 +19214,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>312665</v>
+<v>313453</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127030</v>
+<v>127351</v>
 </b>
 </bs>
 </hist>
@@ -19241,12 +19235,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>312665</v>
+<v>313453</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>127026</v>
+<v>127346</v>
 </b>
 <b>
 <a>4</a>
@@ -19267,12 +19261,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>432895</v>
+<v>433986</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6649</v>
+<v>6666</v>
 </b>
 </bs>
 </hist>
@@ -19288,7 +19282,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>439545</v>
+<v>440653</v>
 </b>
 </bs>
 </hist>
@@ -19304,7 +19298,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>439545</v>
+<v>440653</v>
 </b>
 </bs>
 </hist>
@@ -19320,12 +19314,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>432895</v>
+<v>433986</v>
 </b>
 <b>
 <a>2</a>
 <b>705</b>
-<v>6649</v>
+<v>6666</v>
 </b>
 </bs>
 </hist>
@@ -19346,15 +19340,15 @@
 </relation>
 <relation>
 <name>accessor_location</name>
-<cardinality>746275</cardinality>
+<cardinality>748156</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>566736</v>
+<v>568165</v>
 </e>
 <e>
 <k>loc</k>
-<v>93028</v>
+<v>93263</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19368,17 +19362,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>431845</v>
+<v>432934</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98210</v>
+<v>98457</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>36680</v>
+<v>36773</v>
 </b>
 </bs>
 </hist>
@@ -19394,12 +19388,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89431</v>
+<v>89656</v>
 </b>
 <b>
 <a>2</a>
 <b>8294</b>
-<v>3597</v>
+<v>3606</v>
 </b>
 </bs>
 </hist>
@@ -19409,27 +19403,27 @@
 </relation>
 <relation>
 <name>events</name>
-<cardinality>15200</cardinality>
+<cardinality>15238</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15200</v>
+<v>15238</v>
 </e>
 <e>
 <k>name</k>
-<v>12964</v>
+<v>12996</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>1224</v>
+<v>1228</v>
 </e>
 <e>
 <k>type_id</k>
-<v>6353</v>
+<v>6369</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>15190</v>
+<v>15228</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19443,7 +19437,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15200</v>
+<v>15238</v>
 </b>
 </bs>
 </hist>
@@ -19459,7 +19453,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15200</v>
+<v>15238</v>
 </b>
 </bs>
 </hist>
@@ -19475,7 +19469,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15200</v>
+<v>15238</v>
 </b>
 </bs>
 </hist>
@@ -19491,7 +19485,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15200</v>
+<v>15238</v>
 </b>
 </bs>
 </hist>
@@ -19507,12 +19501,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11977</v>
+<v>12007</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>977</v>
+<v>979</v>
 </b>
 <b>
 <a>14</a>
@@ -19533,12 +19527,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11977</v>
+<v>12007</v>
 </b>
 <b>
 <a>2</a>
 <b>10</b>
-<v>977</v>
+<v>979</v>
 </b>
 <b>
 <a>14</a>
@@ -19559,12 +19553,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12823</v>
+<v>12855</v>
 </b>
 <b>
 <a>2</a>
 <b>10</b>
-<v>140</v>
+<v>141</v>
 </b>
 </bs>
 </hist>
@@ -19580,12 +19574,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11977</v>
+<v>12007</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>977</v>
+<v>979</v>
 </b>
 <b>
 <a>14</a>
@@ -19606,12 +19600,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>617</v>
+<v>618</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>228</v>
+<v>229</v>
 </b>
 <b>
 <a>3</a>
@@ -19621,7 +19615,7 @@
 <b>
 <a>4</a>
 <b>8</b>
-<v>106</v>
+<v>107</v>
 </b>
 <b>
 <a>8</a>
@@ -19631,7 +19625,7 @@
 <b>
 <a>58</a>
 <b>465</b>
-<v>72</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -19647,7 +19641,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>617</v>
+<v>618</v>
 </b>
 <b>
 <a>2</a>
@@ -19672,7 +19666,7 @@
 <b>
 <a>58</a>
 <b>465</b>
-<v>72</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -19688,7 +19682,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>768</v>
+<v>769</v>
 </b>
 <b>
 <a>2</a>
@@ -19724,12 +19718,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>617</v>
+<v>618</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>228</v>
+<v>229</v>
 </b>
 <b>
 <a>3</a>
@@ -19739,7 +19733,7 @@
 <b>
 <a>4</a>
 <b>8</b>
-<v>106</v>
+<v>107</v>
 </b>
 <b>
 <a>8</a>
@@ -19749,7 +19743,7 @@
 <b>
 <a>58</a>
 <b>465</b>
-<v>72</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -19765,17 +19759,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4404</v>
+<v>4415</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1161</v>
+<v>1164</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>515</v>
+<v>516</v>
 </b>
 <b>
 <a>6</a>
@@ -19796,22 +19790,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4792</v>
+<v>4804</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>913</v>
+<v>916</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>500</v>
+<v>501</v>
 </b>
 <b>
 <a>8</a>
 <b>242</b>
-<v>145</v>
+<v>146</v>
 </b>
 </bs>
 </hist>
@@ -19827,12 +19821,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5740</v>
+<v>5755</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>520</v>
+<v>521</v>
 </b>
 <b>
 <a>4</a>
@@ -19853,17 +19847,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4404</v>
+<v>4415</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1161</v>
+<v>1164</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>515</v>
+<v>516</v>
 </b>
 <b>
 <a>6</a>
@@ -19884,7 +19878,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15180</v>
+<v>15218</v>
 </b>
 <b>
 <a>2</a>
@@ -19905,7 +19899,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15190</v>
+<v>15228</v>
 </b>
 </bs>
 </hist>
@@ -19921,7 +19915,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15180</v>
+<v>15218</v>
 </b>
 <b>
 <a>2</a>
@@ -19942,7 +19936,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>15180</v>
+<v>15218</v>
 </b>
 <b>
 <a>2</a>
@@ -19957,15 +19951,15 @@
 </relation>
 <relation>
 <name>event_location</name>
-<cardinality>15836</cardinality>
+<cardinality>15876</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>15200</v>
+<v>15238</v>
 </e>
 <e>
 <k>loc</k>
-<v>325</v>
+<v>326</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -19979,12 +19973,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14563</v>
+<v>14600</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>636</v>
+<v>638</v>
 </b>
 </bs>
 </hist>
@@ -20060,11 +20054,11 @@
 </relation>
 <relation>
 <name>event_accessors</name>
-<cardinality>30400</cardinality>
+<cardinality>30476</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30400</v>
+<v>30476</v>
 </e>
 <e>
 <k>kind</k>
@@ -20072,15 +20066,15 @@
 </e>
 <e>
 <k>name</k>
-<v>26637</v>
+<v>26705</v>
 </e>
 <e>
 <k>declaring_event_id</k>
-<v>15200</v>
+<v>15238</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>30380</v>
+<v>30457</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20094,7 +20088,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30400</v>
+<v>30476</v>
 </b>
 </bs>
 </hist>
@@ -20110,7 +20104,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30400</v>
+<v>30476</v>
 </b>
 </bs>
 </hist>
@@ -20126,7 +20120,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30400</v>
+<v>30476</v>
 </b>
 </bs>
 </hist>
@@ -20142,7 +20136,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30400</v>
+<v>30476</v>
 </b>
 </bs>
 </hist>
@@ -20222,12 +20216,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24654</v>
+<v>24716</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1983</v>
+<v>1988</v>
 </b>
 </bs>
 </hist>
@@ -20243,7 +20237,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>26637</v>
+<v>26705</v>
 </b>
 </bs>
 </hist>
@@ -20259,12 +20253,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24654</v>
+<v>24716</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1983</v>
+<v>1988</v>
 </b>
 </bs>
 </hist>
@@ -20280,12 +20274,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>24654</v>
+<v>24716</v>
 </b>
 <b>
 <a>2</a>
 <b>16</b>
-<v>1983</v>
+<v>1988</v>
 </b>
 </bs>
 </hist>
@@ -20301,7 +20295,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15200</v>
+<v>15238</v>
 </b>
 </bs>
 </hist>
@@ -20317,7 +20311,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15200</v>
+<v>15238</v>
 </b>
 </bs>
 </hist>
@@ -20333,7 +20327,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15200</v>
+<v>15238</v>
 </b>
 </bs>
 </hist>
@@ -20349,7 +20343,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>15200</v>
+<v>15238</v>
 </b>
 </bs>
 </hist>
@@ -20365,7 +20359,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30361</v>
+<v>30437</v>
 </b>
 <b>
 <a>2</a>
@@ -20386,7 +20380,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30380</v>
+<v>30457</v>
 </b>
 </bs>
 </hist>
@@ -20402,7 +20396,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30380</v>
+<v>30457</v>
 </b>
 </bs>
 </hist>
@@ -20418,7 +20412,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>30361</v>
+<v>30437</v>
 </b>
 <b>
 <a>2</a>
@@ -20433,15 +20427,15 @@
 </relation>
 <relation>
 <name>event_accessor_location</name>
-<cardinality>31673</cardinality>
+<cardinality>31753</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>30400</v>
+<v>30476</v>
 </e>
 <e>
 <k>loc</k>
-<v>325</v>
+<v>326</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20455,12 +20449,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>29126</v>
+<v>29200</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1273</v>
+<v>1276</v>
 </b>
 </bs>
 </hist>
@@ -20536,11 +20530,11 @@
 </relation>
 <relation>
 <name>operators</name>
-<cardinality>12385</cardinality>
+<cardinality>12416</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>12385</v>
+<v>12416</v>
 </e>
 <e>
 <k>name</k>
@@ -20552,15 +20546,15 @@
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>3018</v>
+<v>3026</v>
 </e>
 <e>
 <k>type_id</k>
-<v>1618</v>
+<v>1622</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>11632</v>
+<v>11661</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -20574,7 +20568,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12385</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -20590,7 +20584,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12385</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -20606,7 +20600,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12385</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -20622,7 +20616,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12385</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -20638,7 +20632,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12385</v>
+<v>12416</v>
 </b>
 </bs>
 </hist>
@@ -21040,7 +21034,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106</v>
+<v>107</v>
 </b>
 <b>
 <a>2</a>
@@ -21259,12 +21253,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>471</v>
+<v>472</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1565</v>
+<v>1569</v>
 </b>
 <b>
 <a>3</a>
@@ -21274,22 +21268,22 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>286</v>
+<v>287</v>
 </b>
 <b>
 <a>7</a>
 <b>16</b>
-<v>228</v>
+<v>229</v>
 </b>
 <b>
 <a>16</a>
 <b>73</b>
-<v>111</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -21305,12 +21299,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>627</v>
+<v>628</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1536</v>
+<v>1539</v>
 </b>
 <b>
 <a>3</a>
@@ -21346,12 +21340,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>627</v>
+<v>628</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1540</v>
+<v>1544</v>
 </b>
 <b>
 <a>3</a>
@@ -21366,12 +21360,12 @@
 <b>
 <a>5</a>
 <b>9</b>
-<v>228</v>
+<v>229</v>
 </b>
 <b>
 <a>9</a>
 <b>22</b>
-<v>111</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -21387,17 +21381,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2017</v>
+<v>2022</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>418</v>
+<v>419</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>291</v>
+<v>292</v>
 </b>
 <b>
 <a>4</a>
@@ -21423,12 +21417,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>471</v>
+<v>472</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1565</v>
+<v>1569</v>
 </b>
 <b>
 <a>3</a>
@@ -21438,22 +21432,22 @@
 <b>
 <a>4</a>
 <b>6</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>286</v>
+<v>287</v>
 </b>
 <b>
 <a>7</a>
 <b>16</b>
-<v>228</v>
+<v>229</v>
 </b>
 <b>
 <a>16</a>
 <b>73</b>
-<v>111</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -21469,12 +21463,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>792</v>
+<v>794</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>369</v>
+<v>370</v>
 </b>
 <b>
 <a>3</a>
@@ -21510,12 +21504,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1205</v>
+<v>1208</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>150</v>
+<v>151</v>
 </b>
 <b>
 <a>3</a>
@@ -21546,7 +21540,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1205</v>
+<v>1208</v>
 </b>
 <b>
 <a>2</a>
@@ -21582,7 +21576,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1263</v>
+<v>1267</v>
 </b>
 <b>
 <a>2</a>
@@ -21597,7 +21591,7 @@
 <b>
 <a>6</a>
 <b>501</b>
-<v>106</v>
+<v>107</v>
 </b>
 </bs>
 </hist>
@@ -21613,12 +21607,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>792</v>
+<v>794</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>369</v>
+<v>370</v>
 </b>
 <b>
 <a>3</a>
@@ -21654,12 +21648,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11486</v>
+<v>11515</v>
 </b>
 <b>
 <a>2</a>
 <b>26</b>
-<v>145</v>
+<v>146</v>
 </b>
 </bs>
 </hist>
@@ -21675,7 +21669,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11632</v>
+<v>11661</v>
 </b>
 </bs>
 </hist>
@@ -21691,7 +21685,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11632</v>
+<v>11661</v>
 </b>
 </bs>
 </hist>
@@ -21707,12 +21701,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11486</v>
+<v>11515</v>
 </b>
 <b>
 <a>2</a>
 <b>26</b>
-<v>145</v>
+<v>146</v>
 </b>
 </bs>
 </hist>
@@ -21728,7 +21722,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11573</v>
+<v>11603</v>
 </b>
 <b>
 <a>2</a>
@@ -21743,15 +21737,15 @@
 </relation>
 <relation>
 <name>operator_location</name>
-<cardinality>22798</cardinality>
+<cardinality>22855</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>5773</v>
+<v>5788</v>
 </e>
 <e>
 <k>loc</k>
-<v>3235</v>
+<v>3243</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21765,27 +21759,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>860</v>
+<v>862</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3226</v>
+<v>3234</v>
 </b>
 <b>
 <a>3</a>
 <b>9</b>
-<v>395</v>
+<v>396</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>460</v>
+<v>461</v>
 </b>
 <b>
 <a>11</a>
 <b>12</b>
-<v>596</v>
+<v>597</v>
 </b>
 <b>
 <a>12</a>
@@ -21806,17 +21800,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2835</v>
+<v>2842</v>
 </b>
 <b>
 <a>2</a>
 <b>9</b>
-<v>242</v>
+<v>243</v>
 </b>
 <b>
 <a>9</a>
 <b>2695</b>
-<v>156</v>
+<v>157</v>
 </b>
 </bs>
 </hist>
@@ -21826,15 +21820,15 @@
 </relation>
 <relation>
 <name>constant_value</name>
-<cardinality>184982</cardinality>
+<cardinality>185449</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>184871</v>
+<v>185337</v>
 </e>
 <e>
 <k>value</k>
-<v>47758</v>
+<v>47879</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21848,12 +21842,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>184759</v>
+<v>185225</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>111</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -21869,27 +21863,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32825</v>
+<v>32908</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7203</v>
+<v>7222</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3879</v>
+<v>3888</v>
 </b>
 <b>
 <a>4</a>
 <b>61</b>
-<v>3582</v>
+<v>3591</v>
 </b>
 <b>
 <a>61</a>
 <b>2421</b>
-<v>267</v>
+<v>268</v>
 </b>
 </bs>
 </hist>
@@ -21899,27 +21893,27 @@
 </relation>
 <relation>
 <name>methods</name>
-<cardinality>1114413</cardinality>
+<cardinality>1117222</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1114413</v>
+<v>1117222</v>
 </e>
 <e>
 <k>name</k>
-<v>133325</v>
+<v>133661</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>201631</v>
+<v>202139</v>
 </e>
 <e>
 <k>type_id</k>
-<v>112652</v>
+<v>112936</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>695172</v>
+<v>696924</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -21933,7 +21927,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1114413</v>
+<v>1117222</v>
 </b>
 </bs>
 </hist>
@@ -21949,7 +21943,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1114413</v>
+<v>1117222</v>
 </b>
 </bs>
 </hist>
@@ -21965,7 +21959,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1114413</v>
+<v>1117222</v>
 </b>
 </bs>
 </hist>
@@ -21981,7 +21975,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1114413</v>
+<v>1117222</v>
 </b>
 </bs>
 </hist>
@@ -21997,32 +21991,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>69005</v>
+<v>69179</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23570</v>
+<v>23630</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10810</v>
+<v>10837</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10402</v>
+<v>10428</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>10548</v>
+<v>10574</v>
 </b>
 <b>
 <a>12</a>
 <b>5621</b>
-<v>8987</v>
+<v>9010</v>
 </b>
 </bs>
 </hist>
@@ -22038,32 +22032,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>79354</v>
+<v>79554</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19302</v>
+<v>19351</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11291</v>
+<v>11320</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>11024</v>
+<v>11052</v>
 </b>
 <b>
 <a>7</a>
 <b>33</b>
-<v>10086</v>
+<v>10111</v>
 </b>
 <b>
 <a>33</a>
 <b>4959</b>
-<v>2265</v>
+<v>2270</v>
 </b>
 </bs>
 </hist>
@@ -22079,17 +22073,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>112632</v>
+<v>112916</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10572</v>
+<v>10599</v>
 </b>
 <b>
 <a>3</a>
 <b>174</b>
-<v>10003</v>
+<v>10029</v>
 </b>
 <b>
 <a>177</a>
@@ -22110,32 +22104,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70741</v>
+<v>70919</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24435</v>
+<v>24497</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>10883</v>
+<v>10911</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>10698</v>
+<v>10725</v>
 </b>
 <b>
 <a>6</a>
 <b>12</b>
-<v>10008</v>
+<v>10033</v>
 </b>
 <b>
 <a>12</a>
 <b>4958</b>
-<v>6557</v>
+<v>6573</v>
 </b>
 </bs>
 </hist>
@@ -22151,42 +22145,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>59604</v>
+<v>59755</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>42897</v>
+<v>43005</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31231</v>
+<v>31310</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14223</v>
+<v>14258</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14757</v>
+<v>14795</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>16065</v>
+<v>16105</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>15623</v>
+<v>15662</v>
 </b>
 <b>
 <a>23</a>
 <b>1309</b>
-<v>7228</v>
+<v>7246</v>
 </b>
 </bs>
 </hist>
@@ -22202,37 +22196,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64660</v>
+<v>64823</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44579</v>
+<v>44692</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>34323</v>
+<v>34409</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18155</v>
+<v>18201</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>18121</v>
+<v>18167</v>
 </b>
 <b>
 <a>8</a>
 <b>18</b>
-<v>15219</v>
+<v>15257</v>
 </b>
 <b>
 <a>18</a>
 <b>457</b>
-<v>6571</v>
+<v>6588</v>
 </b>
 </bs>
 </hist>
@@ -22248,32 +22242,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97602</v>
+<v>97848</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>48808</v>
+<v>48931</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22899</v>
+<v>22957</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11598</v>
+<v>11627</v>
 </b>
 <b>
 <a>5</a>
 <b>10</b>
-<v>15175</v>
+<v>15214</v>
 </b>
 <b>
 <a>10</a>
 <b>738</b>
-<v>5546</v>
+<v>5560</v>
 </b>
 </bs>
 </hist>
@@ -22289,42 +22283,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>59711</v>
+<v>59862</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>42975</v>
+<v>43083</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>31231</v>
+<v>31310</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>14257</v>
+<v>14293</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>14777</v>
+<v>14814</v>
 </b>
 <b>
 <a>6</a>
 <b>10</b>
-<v>15982</v>
+<v>16023</v>
 </b>
 <b>
 <a>10</a>
 <b>23</b>
-<v>16079</v>
+<v>16120</v>
 </b>
 <b>
 <a>23</a>
 <b>698</b>
-<v>6615</v>
+<v>6632</v>
 </b>
 </bs>
 </hist>
@@ -22340,27 +22334,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75286</v>
+<v>75475</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14451</v>
+<v>14487</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8292</v>
+<v>8313</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8808</v>
+<v>8830</v>
 </b>
 <b>
 <a>10</a>
 <b>62149</b>
-<v>5813</v>
+<v>5828</v>
 </b>
 </bs>
 </hist>
@@ -22376,22 +22370,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>91385</v>
+<v>91615</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9595</v>
+<v>9619</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8647</v>
+<v>8669</v>
 </b>
 <b>
 <a>8</a>
 <b>7666</b>
-<v>3023</v>
+<v>3031</v>
 </b>
 </bs>
 </hist>
@@ -22407,22 +22401,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87219</v>
+<v>87439</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13950</v>
+<v>13986</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>8783</v>
+<v>8805</v>
 </b>
 <b>
 <a>8</a>
 <b>19632</b>
-<v>2697</v>
+<v>2704</v>
 </b>
 </bs>
 </hist>
@@ -22438,27 +22432,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75398</v>
+<v>75588</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14509</v>
+<v>14546</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8365</v>
+<v>8386</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>8744</v>
+<v>8766</v>
 </b>
 <b>
 <a>10</a>
 <b>44480</b>
-<v>5633</v>
+<v>5648</v>
 </b>
 </bs>
 </hist>
@@ -22474,12 +22468,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>668393</v>
+<v>670078</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>26778</v>
+<v>26846</v>
 </b>
 </bs>
 </hist>
@@ -22495,7 +22489,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>695172</v>
+<v>696924</v>
 </b>
 </bs>
 </hist>
@@ -22511,12 +22505,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>670255</v>
+<v>671944</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>24917</v>
+<v>24979</v>
 </b>
 </bs>
 </hist>
@@ -22532,12 +22526,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>684828</v>
+<v>686554</v>
 </b>
 <b>
 <a>2</a>
 <b>1367</b>
-<v>10344</v>
+<v>10370</v>
 </b>
 </bs>
 </hist>
@@ -22547,15 +22541,15 @@
 </relation>
 <relation>
 <name>method_location</name>
-<cardinality>1277794</cardinality>
+<cardinality>1281015</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1114413</v>
+<v>1117222</v>
 </e>
 <e>
 <k>loc</k>
-<v>40749</v>
+<v>40851</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22569,17 +22563,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>984300</v>
+<v>986781</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>98069</v>
+<v>98316</v>
 </b>
 <b>
 <a>3</a>
 <b>119</b>
-<v>32043</v>
+<v>32124</v>
 </b>
 </bs>
 </hist>
@@ -22595,17 +22589,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>36145</v>
+<v>36237</v>
 </b>
 <b>
 <a>2</a>
 <b>51</b>
-<v>3072</v>
+<v>3079</v>
 </b>
 <b>
 <a>51</a>
 <b>27729</b>
-<v>1531</v>
+<v>1535</v>
 </b>
 </bs>
 </hist>
@@ -22615,23 +22609,23 @@
 </relation>
 <relation>
 <name>constructors</name>
-<cardinality>277088</cardinality>
+<cardinality>277786</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>277088</v>
+<v>277786</v>
 </e>
 <e>
 <k>name</k>
-<v>133199</v>
+<v>133535</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>211557</v>
+<v>212090</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>222805</v>
+<v>223367</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22645,7 +22639,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>277088</v>
+<v>277786</v>
 </b>
 </bs>
 </hist>
@@ -22661,7 +22655,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>277088</v>
+<v>277786</v>
 </b>
 </bs>
 </hist>
@@ -22677,7 +22671,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>277088</v>
+<v>277786</v>
 </b>
 </bs>
 </hist>
@@ -22693,22 +22687,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101982</v>
+<v>102239</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19132</v>
+<v>19180</v>
 </b>
 <b>
 <a>3</a>
 <b>8</b>
-<v>10227</v>
+<v>10253</v>
 </b>
 <b>
 <a>8</a>
 <b>2183</b>
-<v>1856</v>
+<v>1861</v>
 </b>
 </bs>
 </hist>
@@ -22724,17 +22718,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>122237</v>
+<v>122546</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>10062</v>
+<v>10087</v>
 </b>
 <b>
 <a>11</a>
 <b>2183</b>
-<v>899</v>
+<v>901</v>
 </b>
 </bs>
 </hist>
@@ -22750,22 +22744,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102862</v>
+<v>103121</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19288</v>
+<v>19336</v>
 </b>
 <b>
 <a>3</a>
 <b>10</b>
-<v>10067</v>
+<v>10092</v>
 </b>
 <b>
 <a>10</a>
 <b>2183</b>
-<v>981</v>
+<v>984</v>
 </b>
 </bs>
 </hist>
@@ -22781,17 +22775,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>178955</v>
+<v>179406</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19711</v>
+<v>19760</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12891</v>
+<v>12923</v>
 </b>
 </bs>
 </hist>
@@ -22807,7 +22801,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>211557</v>
+<v>212090</v>
 </b>
 </bs>
 </hist>
@@ -22823,17 +22817,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>178955</v>
+<v>179406</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>19711</v>
+<v>19760</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>12891</v>
+<v>12923</v>
 </b>
 </bs>
 </hist>
@@ -22849,12 +22843,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>220380</v>
+<v>220935</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2425</v>
+<v>2431</v>
 </b>
 </bs>
 </hist>
@@ -22870,7 +22864,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>222805</v>
+<v>223367</v>
 </b>
 </bs>
 </hist>
@@ -22886,12 +22880,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>220380</v>
+<v>220935</v>
 </b>
 <b>
 <a>2</a>
 <b>780</b>
-<v>2425</v>
+<v>2431</v>
 </b>
 </bs>
 </hist>
@@ -22901,15 +22895,15 @@
 </relation>
 <relation>
 <name>constructor_location</name>
-<cardinality>320729</cardinality>
+<cardinality>321537</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>277088</v>
+<v>277786</v>
 </e>
 <e>
 <k>loc</k>
-<v>24722</v>
+<v>24785</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -22923,17 +22917,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>237845</v>
+<v>238445</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>37565</v>
+<v>37660</v>
 </b>
 <b>
 <a>3</a>
 <b>87</b>
-<v>1677</v>
+<v>1681</v>
 </b>
 </bs>
 </hist>
@@ -22949,22 +22943,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18962</v>
+<v>19010</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3174</v>
+<v>3182</v>
 </b>
 <b>
 <a>3</a>
 <b>59</b>
-<v>1861</v>
+<v>1866</v>
 </b>
 <b>
 <a>59</a>
 <b>4796</b>
-<v>724</v>
+<v>726</v>
 </b>
 </bs>
 </hist>
@@ -22974,23 +22968,23 @@
 </relation>
 <relation>
 <name>destructors</name>
-<cardinality>442</cardinality>
+<cardinality>443</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>442</v>
+<v>443</v>
 </e>
 <e>
 <k>name</k>
-<v>413</v>
+<v>414</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>442</v>
+<v>443</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>427</v>
+<v>428</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23004,7 +22998,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>442</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -23020,7 +23014,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>442</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -23036,7 +23030,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>442</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -23052,7 +23046,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>393</v>
+<v>394</v>
 </b>
 <b>
 <a>2</a>
@@ -23073,7 +23067,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>393</v>
+<v>394</v>
 </b>
 <b>
 <a>2</a>
@@ -23094,7 +23088,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>398</v>
+<v>399</v>
 </b>
 <b>
 <a>2</a>
@@ -23115,7 +23109,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>442</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -23131,7 +23125,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>442</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -23147,7 +23141,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>442</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -23163,7 +23157,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>418</v>
+<v>419</v>
 </b>
 <b>
 <a>2</a>
@@ -23184,7 +23178,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>427</v>
+<v>428</v>
 </b>
 </bs>
 </hist>
@@ -23200,7 +23194,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>418</v>
+<v>419</v>
 </b>
 <b>
 <a>2</a>
@@ -23215,7 +23209,7 @@
 </relation>
 <relation>
 <name>destructor_location</name>
-<cardinality>661</cardinality>
+<cardinality>662</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
@@ -23223,7 +23217,7 @@
 </e>
 <e>
 <k>loc</k>
-<v>329</v>
+<v>330</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23318,15 +23312,15 @@
 </relation>
 <relation>
 <name>overrides</name>
-<cardinality>273383</cardinality>
+<cardinality>274072</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>273359</v>
+<v>274048</v>
 </e>
 <e>
 <k>base_id</k>
-<v>65272</v>
+<v>65437</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23340,7 +23334,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>273335</v>
+<v>274024</v>
 </b>
 <b>
 <a>2</a>
@@ -23361,32 +23355,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>40170</v>
+<v>40272</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10451</v>
+<v>10477</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4277</v>
+<v>4288</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>5327</v>
+<v>5341</v>
 </b>
 <b>
 <a>7</a>
 <b>184</b>
-<v>4899</v>
+<v>4912</v>
 </b>
 <b>
 <a>215</a>
 <b>1329</b>
-<v>145</v>
+<v>146</v>
 </b>
 </bs>
 </hist>
@@ -23396,15 +23390,15 @@
 </relation>
 <relation>
 <name>explicitly_implements</name>
-<cardinality>155632</cardinality>
+<cardinality>156024</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>155632</v>
+<v>156024</v>
 </e>
 <e>
 <k>interface_id</k>
-<v>13255</v>
+<v>13289</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23418,7 +23412,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>155632</v>
+<v>156024</v>
 </b>
 </bs>
 </hist>
@@ -23434,37 +23428,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>6756</v>
+<v>6773</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2483</v>
+<v>2490</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1181</v>
+<v>1184</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>456</v>
+<v>458</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>1205</v>
+<v>1208</v>
 </b>
 <b>
 <a>7</a>
 <b>58</b>
-<v>996</v>
+<v>999</v>
 </b>
 <b>
 <a>58</a>
 <b>7851</b>
-<v>174</v>
+<v>175</v>
 </b>
 </bs>
 </hist>
@@ -23818,11 +23812,11 @@
 </relation>
 <relation>
 <name>fields</name>
-<cardinality>554579</cardinality>
+<cardinality>555977</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>554579</v>
+<v>555977</v>
 </e>
 <e>
 <k>kind</k>
@@ -23830,19 +23824,19 @@
 </e>
 <e>
 <k>name</k>
-<v>217784</v>
+<v>218333</v>
 </e>
 <e>
 <k>declaring_type_id</k>
-<v>103372</v>
+<v>103633</v>
 </e>
 <e>
 <k>type_id</k>
-<v>89334</v>
+<v>89559</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>546899</v>
+<v>548277</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -23856,7 +23850,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>554579</v>
+<v>555977</v>
 </b>
 </bs>
 </hist>
@@ -23872,7 +23866,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>554579</v>
+<v>555977</v>
 </b>
 </bs>
 </hist>
@@ -23888,7 +23882,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>554579</v>
+<v>555977</v>
 </b>
 </bs>
 </hist>
@@ -23904,7 +23898,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>554579</v>
+<v>555977</v>
 </b>
 </bs>
 </hist>
@@ -23920,7 +23914,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>554579</v>
+<v>555977</v>
 </b>
 </bs>
 </hist>
@@ -24041,22 +24035,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>175820</v>
+<v>176263</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22520</v>
+<v>22577</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>16522</v>
+<v>16563</v>
 </b>
 <b>
 <a>14</a>
 <b>4800</b>
-<v>2921</v>
+<v>2928</v>
 </b>
 </bs>
 </hist>
@@ -24072,12 +24066,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>208446</v>
+<v>208972</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9337</v>
+<v>9361</v>
 </b>
 </bs>
 </hist>
@@ -24093,22 +24087,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>175844</v>
+<v>176287</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22506</v>
+<v>22562</v>
 </b>
 <b>
 <a>3</a>
 <b>14</b>
-<v>16512</v>
+<v>16554</v>
 </b>
 <b>
 <a>14</a>
 <b>4800</b>
-<v>2921</v>
+<v>2928</v>
 </b>
 </bs>
 </hist>
@@ -24124,17 +24118,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>188302</v>
+<v>188777</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17620</v>
+<v>17665</v>
 </b>
 <b>
 <a>3</a>
 <b>2459</b>
-<v>11860</v>
+<v>11890</v>
 </b>
 </bs>
 </hist>
@@ -24150,22 +24144,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>176208</v>
+<v>176653</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22525</v>
+<v>22582</v>
 </b>
 <b>
 <a>3</a>
 <b>15</b>
-<v>16439</v>
+<v>16481</v>
 </b>
 <b>
 <a>15</a>
 <b>4800</b>
-<v>2610</v>
+<v>2616</v>
 </b>
 </bs>
 </hist>
@@ -24181,130 +24175,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27264</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>21106</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>12546</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>10081</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>7918</v>
-</b>
-<b>
-<a>6</a>
-<b>8</b>
-<v>9255</v>
-</b>
-<b>
-<a>8</a>
-<b>12</b>
-<v>8132</v>
-</b>
-<b>
-<a>12</a>
-<b>4204</b>
-<v>7067</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>kind</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>102283</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1088</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>name</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>27264</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>21111</v>
-</b>
-<b>
-<a>3</a>
-<b>4</b>
-<v>12550</v>
-</b>
-<b>
-<a>4</a>
-<b>5</b>
-<v>10076</v>
-</b>
-<b>
-<a>5</a>
-<b>6</b>
-<v>7918</v>
-</b>
-<b>
-<a>6</a>
-<b>8</b>
-<v>9260</v>
-</b>
-<b>
-<a>8</a>
-<b>12</b>
-<v>8132</v>
-</b>
-<b>
-<a>12</a>
-<b>4204</b>
-<v>7058</v>
-</b>
-</bs>
-</hist>
-</val>
-</dep>
-<dep>
-<src>declaring_type_id</src>
-<trg>type_id</trg>
-<val>
-<hist>
-<budget>12</budget>
-<bs>
-<b>
-<a>1</a>
-<b>2</b>
-<v>44438</v>
+<v>27333</v>
 </b>
 <b>
 <a>2</a>
@@ -24314,27 +24185,150 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>9415</v>
+<v>12577</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>7349</v>
+<v>10106</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>6149</v>
+<v>7938</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>9278</v>
+</b>
+<b>
+<a>8</a>
+<b>12</b>
+<v>8152</v>
+</b>
+<b>
+<a>12</a>
+<b>4204</b>
+<v>7085</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>102541</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>1091</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>name</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>27333</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21164</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>12582</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>10102</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>7938</v>
+</b>
+<b>
+<a>6</a>
+<b>8</b>
+<v>9283</v>
+</b>
+<b>
+<a>8</a>
+<b>12</b>
+<v>8152</v>
+</b>
+<b>
+<a>12</a>
+<b>4204</b>
+<v>7075</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>declaring_type_id</src>
+<trg>type_id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>44550</v>
+</b>
+<b>
+<a>2</a>
+<b>3</b>
+<v>21212</v>
+</b>
+<b>
+<a>3</a>
+<b>4</b>
+<v>9439</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>7368</v>
+</b>
+<b>
+<a>5</a>
+<b>6</b>
+<v>6164</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>9571</v>
+<v>9595</v>
 </b>
 <b>
 <a>9</a>
 <b>132</b>
-<v>5288</v>
+<v>5302</v>
 </b>
 </bs>
 </hist>
@@ -24350,42 +24344,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>27264</v>
+<v>27333</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21106</v>
+<v>21159</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>12546</v>
+<v>12577</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>10081</v>
+<v>10106</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>7918</v>
+<v>7938</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>9255</v>
+<v>9278</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>8132</v>
+<v>8152</v>
 </b>
 <b>
 <a>12</a>
 <b>4204</b>
-<v>7067</v>
+<v>7085</v>
 </b>
 </bs>
 </hist>
@@ -24401,32 +24395,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55686</v>
+<v>55827</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10859</v>
+<v>10886</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6197</v>
+<v>6213</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7952</v>
+<v>7972</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>6776</v>
+<v>6793</v>
 </b>
 <b>
 <a>27</a>
 <b>9290</b>
-<v>1861</v>
+<v>1866</v>
 </b>
 </bs>
 </hist>
@@ -24442,12 +24436,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>87142</v>
+<v>87361</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2192</v>
+<v>2197</v>
 </b>
 </bs>
 </hist>
@@ -24463,27 +24457,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>63600</v>
+<v>63760</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9298</v>
+<v>9322</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>7869</v>
+<v>7889</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>6824</v>
+<v>6841</v>
 </b>
 <b>
 <a>18</a>
 <b>5213</b>
-<v>1740</v>
+<v>1744</v>
 </b>
 </bs>
 </hist>
@@ -24499,22 +24493,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>68174</v>
+<v>68346</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10018</v>
+<v>10043</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>7218</v>
+<v>7236</v>
 </b>
 <b>
 <a>7</a>
 <b>5746</b>
-<v>3922</v>
+<v>3932</v>
 </b>
 </bs>
 </hist>
@@ -24530,32 +24524,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>55730</v>
+<v>55871</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11185</v>
+<v>11213</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5910</v>
+<v>5925</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>7928</v>
+<v>7948</v>
 </b>
 <b>
 <a>7</a>
 <b>27</b>
-<v>6732</v>
+<v>6749</v>
 </b>
 <b>
 <a>27</a>
 <b>9185</b>
-<v>1847</v>
+<v>1851</v>
 </b>
 </bs>
 </hist>
@@ -24571,12 +24565,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>545990</v>
+<v>547366</v>
 </b>
 <b>
 <a>2</a>
 <b>234</b>
-<v>908</v>
+<v>911</v>
 </b>
 </bs>
 </hist>
@@ -24592,7 +24586,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>546899</v>
+<v>548277</v>
 </b>
 </bs>
 </hist>
@@ -24608,7 +24602,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>546899</v>
+<v>548277</v>
 </b>
 </bs>
 </hist>
@@ -24624,12 +24618,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>545990</v>
+<v>547366</v>
 </b>
 <b>
 <a>2</a>
 <b>234</b>
-<v>908</v>
+<v>911</v>
 </b>
 </bs>
 </hist>
@@ -24645,12 +24639,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>546403</v>
+<v>547780</v>
 </b>
 <b>
 <a>2</a>
 <b>138</b>
-<v>495</v>
+<v>497</v>
 </b>
 </bs>
 </hist>
@@ -24660,15 +24654,15 @@
 </relation>
 <relation>
 <name>field_location</name>
-<cardinality>635173</cardinality>
+<cardinality>636774</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>547229</v>
+<v>548608</v>
 </e>
 <e>
 <k>loc</k>
-<v>52741</v>
+<v>52874</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24682,17 +24676,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>465288</v>
+<v>466461</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>77940</v>
+<v>78136</v>
 </b>
 <b>
 <a>3</a>
 <b>57</b>
-<v>4000</v>
+<v>4010</v>
 </b>
 </bs>
 </hist>
@@ -24708,12 +24702,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>49241</v>
+<v>49365</v>
 </b>
 <b>
 <a>2</a>
 <b>8882</b>
-<v>3499</v>
+<v>3508</v>
 </b>
 </bs>
 </hist>
@@ -24723,11 +24717,11 @@
 </relation>
 <relation>
 <name>localvars</name>
-<cardinality>163272</cardinality>
+<cardinality>163268</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163272</v>
+<v>163268</v>
 </e>
 <e>
 <k>kind</k>
@@ -24735,7 +24729,7 @@
 </e>
 <e>
 <k>name</k>
-<v>22595</v>
+<v>22594</v>
 </e>
 <e>
 <k>implicitly_typed</k>
@@ -24747,7 +24741,7 @@
 </e>
 <e>
 <k>parent_id</k>
-<v>163272</v>
+<v>163268</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -24761,7 +24755,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -24777,7 +24771,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -24793,7 +24787,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -24809,7 +24803,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -24825,7 +24819,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -24849,8 +24843,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162455</a>
-<b>162456</b>
+<a>162451</a>
+<b>162452</b>
 <v>1</v>
 </b>
 </bs>
@@ -24875,8 +24869,8 @@
 <v>1</v>
 </b>
 <b>
-<a>22382</a>
-<b>22383</b>
+<a>22381</a>
+<b>22382</b>
 <v>1</v>
 </b>
 </bs>
@@ -24948,8 +24942,8 @@
 <v>1</v>
 </b>
 <b>
-<a>162455</a>
-<b>162456</b>
+<a>162451</a>
+<b>162452</b>
 <v>1</v>
 </b>
 </bs>
@@ -24966,7 +24960,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14115</v>
+<v>14114</v>
 </b>
 <b>
 <a>2</a>
@@ -25002,7 +24996,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22503</v>
+<v>22502</v>
 </b>
 <b>
 <a>2</a>
@@ -25023,7 +25017,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19935</v>
+<v>19934</v>
 </b>
 <b>
 <a>2</a>
@@ -25044,7 +25038,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>19225</v>
+<v>19224</v>
 </b>
 <b>
 <a>2</a>
@@ -25070,7 +25064,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14115</v>
+<v>14114</v>
 </b>
 <b>
 <a>2</a>
@@ -25104,13 +25098,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36625</a>
-<b>36626</b>
+<a>36624</a>
+<b>36625</b>
 <v>1</v>
 </b>
 <b>
-<a>126647</a>
-<b>126648</b>
+<a>126644</a>
+<b>126645</b>
 <v>1</v>
 </b>
 </bs>
@@ -25151,8 +25145,8 @@
 <v>1</v>
 </b>
 <b>
-<a>16706</a>
-<b>16707</b>
+<a>16705</a>
+<b>16706</b>
 <v>1</v>
 </b>
 </bs>
@@ -25188,13 +25182,13 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>36625</a>
-<b>36626</b>
+<a>36624</a>
+<b>36625</b>
 <v>1</v>
 </b>
 <b>
-<a>126647</a>
-<b>126648</b>
+<a>126644</a>
+<b>126645</b>
 <v>1</v>
 </b>
 </bs>
@@ -25240,7 +25234,7 @@
 </b>
 <b>
 <a>35</a>
-<b>37236</b>
+<b>37235</b>
 <v>317</v>
 </b>
 </bs>
@@ -25369,7 +25363,7 @@
 </b>
 <b>
 <a>35</a>
-<b>37236</b>
+<b>37235</b>
 <v>317</v>
 </b>
 </bs>
@@ -25386,7 +25380,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -25402,7 +25396,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -25418,7 +25412,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -25434,7 +25428,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -25450,7 +25444,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -25460,15 +25454,15 @@
 </relation>
 <relation>
 <name>localvar_location</name>
-<cardinality>163272</cardinality>
+<cardinality>163268</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>163272</v>
+<v>163268</v>
 </e>
 <e>
 <k>loc</k>
-<v>163192</v>
+<v>163188</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25482,7 +25476,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163272</v>
+<v>163268</v>
 </b>
 </bs>
 </hist>
@@ -25498,7 +25492,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>163112</v>
+<v>163108</v>
 </b>
 <b>
 <a>2</a>
@@ -25513,19 +25507,19 @@
 </relation>
 <relation>
 <name>params</name>
-<cardinality>2412633</cardinality>
+<cardinality>2418714</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2412633</v>
+<v>2418714</v>
 </e>
 <e>
 <k>name</k>
-<v>80647</v>
+<v>80851</v>
 </e>
 <e>
 <k>type_id</k>
-<v>329916</v>
+<v>330748</v>
 </e>
 <e>
 <k>index</k>
@@ -25537,11 +25531,11 @@
 </e>
 <e>
 <k>parent_id</k>
-<v>1366871</v>
+<v>1370316</v>
 </e>
 <e>
 <k>unbound_id</k>
-<v>1432095</v>
+<v>1435704</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -25555,7 +25549,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2412633</v>
+<v>2418714</v>
 </b>
 </bs>
 </hist>
@@ -25571,7 +25565,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2412633</v>
+<v>2418714</v>
 </b>
 </bs>
 </hist>
@@ -25587,7 +25581,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2412633</v>
+<v>2418714</v>
 </b>
 </bs>
 </hist>
@@ -25603,7 +25597,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2412633</v>
+<v>2418714</v>
 </b>
 </bs>
 </hist>
@@ -25619,7 +25613,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2412633</v>
+<v>2418714</v>
 </b>
 </bs>
 </hist>
@@ -25635,7 +25629,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2412633</v>
+<v>2418714</v>
 </b>
 </bs>
 </hist>
@@ -25651,42 +25645,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31051</v>
+<v>31129</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13824</v>
+<v>13859</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7043</v>
+<v>7061</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4826</v>
+<v>4839</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6635</v>
+<v>6651</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6883</v>
+<v>6900</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6066</v>
+<v>6081</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4316</v>
+<v>4327</v>
 </b>
 </bs>
 </hist>
@@ -25702,22 +25696,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>64081</v>
+<v>64243</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8142</v>
+<v>8162</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>6158</v>
+<v>6174</v>
 </b>
 <b>
 <a>12</a>
 <b>6855</b>
-<v>2265</v>
+<v>2270</v>
 </b>
 </bs>
 </hist>
@@ -25733,22 +25727,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54894</v>
+<v>55032</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14534</v>
+<v>14570</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5502</v>
+<v>5516</v>
 </b>
 <b>
 <a>4</a>
 <b>33</b>
-<v>5716</v>
+<v>5730</v>
 </b>
 </bs>
 </hist>
@@ -25764,12 +25758,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>75626</v>
+<v>75817</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>5021</v>
+<v>5034</v>
 </b>
 </bs>
 </hist>
@@ -25785,42 +25779,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31051</v>
+<v>31129</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>13824</v>
+<v>13859</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7043</v>
+<v>7061</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4826</v>
+<v>4839</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6635</v>
+<v>6651</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6883</v>
+<v>6900</v>
 </b>
 <b>
 <a>13</a>
 <b>41</b>
-<v>6066</v>
+<v>6081</v>
 </b>
 <b>
 <a>41</a>
 <b>46351</b>
-<v>4316</v>
+<v>4327</v>
 </b>
 </bs>
 </hist>
@@ -25836,42 +25830,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31440</v>
+<v>31519</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14052</v>
+<v>14088</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>7058</v>
+<v>7075</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4943</v>
+<v>4956</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>6465</v>
+<v>6481</v>
 </b>
 <b>
 <a>7</a>
 <b>13</b>
-<v>6897</v>
+<v>6915</v>
 </b>
 <b>
 <a>13</a>
 <b>43</b>
-<v>6139</v>
+<v>6154</v>
 </b>
 <b>
 <a>43</a>
 <b>36753</b>
-<v>3650</v>
+<v>3659</v>
 </b>
 </bs>
 </hist>
@@ -25887,27 +25881,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>227107</v>
+<v>227680</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>38863</v>
+<v>38961</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30021</v>
+<v>30096</v>
 </b>
 <b>
 <a>6</a>
 <b>24</b>
-<v>25009</v>
+<v>25072</v>
 </b>
 <b>
 <a>24</a>
 <b>48952</b>
-<v>8914</v>
+<v>8937</v>
 </b>
 </bs>
 </hist>
@@ -25923,17 +25917,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>288511</v>
+<v>289238</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>30429</v>
+<v>30506</v>
 </b>
 <b>
 <a>4</a>
 <b>2470</b>
-<v>10975</v>
+<v>11003</v>
 </b>
 </bs>
 </hist>
@@ -25949,17 +25943,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>291568</v>
+<v>292303</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25024</v>
+<v>25087</v>
 </b>
 <b>
 <a>3</a>
 <b>36</b>
-<v>13323</v>
+<v>13357</v>
 </b>
 </bs>
 </hist>
@@ -25975,12 +25969,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>321225</v>
+<v>322034</v>
 </b>
 <b>
 <a>2</a>
 <b>5</b>
-<v>8691</v>
+<v>8713</v>
 </b>
 </bs>
 </hist>
@@ -25996,27 +25990,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>229601</v>
+<v>230180</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36909</v>
+<v>37002</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>30434</v>
+<v>30511</v>
 </b>
 <b>
 <a>6</a>
 <b>25</b>
-<v>24970</v>
+<v>25033</v>
 </b>
 <b>
 <a>25</a>
 <b>40409</b>
-<v>8001</v>
+<v>8021</v>
 </b>
 </bs>
 </hist>
@@ -26032,27 +26026,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>232785</v>
+<v>233372</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>34833</v>
+<v>34921</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>25690</v>
+<v>25754</v>
 </b>
 <b>
 <a>5</a>
 <b>16</b>
-<v>25257</v>
+<v>25321</v>
 </b>
 <b>
 <a>16</a>
 <b>33990</b>
-<v>11350</v>
+<v>11378</v>
 </b>
 </bs>
 </hist>
@@ -26750,27 +26744,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>802905</v>
+<v>804928</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>331972</v>
+<v>332809</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>128931</v>
+<v>129256</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102551</v>
+<v>102809</v>
 </b>
 <b>
 <a>17</a>
 <b>42</b>
-<v>510</v>
+<v>511</v>
 </b>
 </bs>
 </hist>
@@ -26786,27 +26780,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>802905</v>
+<v>804928</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>331972</v>
+<v>332809</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>128931</v>
+<v>129256</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102551</v>
+<v>102809</v>
 </b>
 <b>
 <a>17</a>
 <b>42</b>
-<v>510</v>
+<v>511</v>
 </b>
 </bs>
 </hist>
@@ -26822,22 +26816,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>852355</v>
+<v>854503</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>332269</v>
+<v>333106</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>113050</v>
+<v>113335</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>69195</v>
+<v>69369</v>
 </b>
 </bs>
 </hist>
@@ -26853,27 +26847,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>802905</v>
+<v>804928</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>331972</v>
+<v>332809</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>128931</v>
+<v>129256</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102551</v>
+<v>102809</v>
 </b>
 <b>
 <a>17</a>
 <b>42</b>
-<v>510</v>
+<v>511</v>
 </b>
 </bs>
 </hist>
@@ -26889,12 +26883,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1298502</v>
+<v>1301774</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>68369</v>
+<v>68541</v>
 </b>
 </bs>
 </hist>
@@ -26910,27 +26904,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>802905</v>
+<v>804928</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>331972</v>
+<v>332809</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>128931</v>
+<v>129256</v>
 </b>
 <b>
 <a>4</a>
 <b>17</b>
-<v>102551</v>
+<v>102809</v>
 </b>
 <b>
 <a>17</a>
 <b>42</b>
-<v>510</v>
+<v>511</v>
 </b>
 </bs>
 </hist>
@@ -26946,12 +26940,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1381915</v>
+<v>1385398</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50179</v>
+<v>50305</v>
 </b>
 </bs>
 </hist>
@@ -26967,7 +26961,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1432095</v>
+<v>1435704</v>
 </b>
 </bs>
 </hist>
@@ -26983,12 +26977,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1414027</v>
+<v>1417591</v>
 </b>
 <b>
 <a>2</a>
 <b>3718</b>
-<v>18068</v>
+<v>18113</v>
 </b>
 </bs>
 </hist>
@@ -27004,7 +26998,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1432095</v>
+<v>1435704</v>
 </b>
 </bs>
 </hist>
@@ -27020,7 +27014,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1432095</v>
+<v>1435704</v>
 </b>
 </bs>
 </hist>
@@ -27036,12 +27030,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1381915</v>
+<v>1385398</v>
 </b>
 <b>
 <a>2</a>
 <b>11328</b>
-<v>50179</v>
+<v>50305</v>
 </b>
 </bs>
 </hist>
@@ -27051,15 +27045,15 @@
 </relation>
 <relation>
 <name>param_location</name>
-<cardinality>2681720</cardinality>
+<cardinality>2688479</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2408949</v>
+<v>2415020</v>
 </e>
 <e>
 <k>loc</k>
-<v>137263</v>
+<v>137609</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27073,17 +27067,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2146351</v>
+<v>2151761</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>255806</v>
+<v>256451</v>
 </b>
 <b>
 <a>3</a>
 <b>60</b>
-<v>6790</v>
+<v>6807</v>
 </b>
 </bs>
 </hist>
@@ -27099,12 +27093,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>132951</v>
+<v>133286</v>
 </b>
 <b>
 <a>2</a>
 <b>99581</b>
-<v>4311</v>
+<v>4322</v>
 </b>
 </bs>
 </hist>
@@ -27114,11 +27108,11 @@
 </relation>
 <relation>
 <name>statements</name>
-<cardinality>984506</cardinality>
+<cardinality>986989</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>984506</v>
+<v>986989</v>
 </e>
 <e>
 <k>kind</k>
@@ -27136,7 +27130,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>984506</v>
+<v>986989</v>
 </b>
 </bs>
 </hist>
@@ -27237,19 +27231,19 @@
 </relation>
 <relation>
 <name>stmt_parent</name>
-<cardinality>812665</cardinality>
+<cardinality>814715</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>812665</v>
+<v>814715</v>
 </e>
 <e>
 <k>index</k>
-<v>449</v>
+<v>450</v>
 </e>
 <e>
 <k>parent</k>
-<v>430564</v>
+<v>431649</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27263,7 +27257,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>812665</v>
+<v>814715</v>
 </b>
 </bs>
 </hist>
@@ -27279,7 +27273,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>812665</v>
+<v>814715</v>
 </b>
 </bs>
 </hist>
@@ -27437,22 +27431,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>291527</v>
+<v>292262</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>74507</v>
+<v>74694</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>37519</v>
+<v>37614</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27009</v>
+<v>27077</v>
 </b>
 </bs>
 </hist>
@@ -27468,22 +27462,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>291527</v>
+<v>292262</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>74507</v>
+<v>74694</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>37519</v>
+<v>37614</v>
 </b>
 <b>
 <a>5</a>
 <b>361</b>
-<v>27009</v>
+<v>27077</v>
 </b>
 </bs>
 </hist>
@@ -27493,11 +27487,11 @@
 </relation>
 <relation>
 <name>stmt_parent_top_level</name>
-<cardinality>171840</cardinality>
+<cardinality>172274</cardinality>
 <columnsizes>
 <e>
 <k>stmt</k>
-<v>171840</v>
+<v>172274</v>
 </e>
 <e>
 <k>index</k>
@@ -27505,7 +27499,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>125941</v>
+<v>126259</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27519,7 +27513,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171840</v>
+<v>172274</v>
 </b>
 </bs>
 </hist>
@@ -27535,7 +27529,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>171840</v>
+<v>172274</v>
 </b>
 </bs>
 </hist>
@@ -27583,17 +27577,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>80692</v>
+<v>80896</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44606</v>
+<v>44719</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>642</v>
+<v>643</v>
 </b>
 </bs>
 </hist>
@@ -27609,7 +27603,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>125941</v>
+<v>126259</v>
 </b>
 </bs>
 </hist>
@@ -27619,15 +27613,15 @@
 </relation>
 <relation>
 <name>stmt_location</name>
-<cardinality>984506</cardinality>
+<cardinality>986989</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>984506</v>
+<v>986989</v>
 </e>
 <e>
 <k>loc</k>
-<v>981617</v>
+<v>984092</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27641,7 +27635,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>984506</v>
+<v>986989</v>
 </b>
 </bs>
 </hist>
@@ -27657,12 +27651,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>978728</v>
+<v>981196</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2889</v>
+<v>2896</v>
 </b>
 </bs>
 </hist>
@@ -27672,11 +27666,11 @@
 </relation>
 <relation>
 <name>catch_type</name>
-<cardinality>3425</cardinality>
+<cardinality>3434</cardinality>
 <columnsizes>
 <e>
 <k>catch_id</k>
-<v>3425</v>
+<v>3434</v>
 </e>
 <e>
 <k>type_id</k>
@@ -27698,7 +27692,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3425</v>
+<v>3434</v>
 </b>
 </bs>
 </hist>
@@ -27714,7 +27708,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3425</v>
+<v>3434</v>
 </b>
 </bs>
 </hist>
@@ -27838,19 +27832,19 @@
 </relation>
 <relation>
 <name>expressions</name>
-<cardinality>4241202</cardinality>
+<cardinality>4251891</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4241202</v>
+<v>4251891</v>
 </e>
 <e>
 <k>kind</k>
-<v>403</v>
+<v>404</v>
 </e>
 <e>
 <k>type_id</k>
-<v>70157</v>
+<v>70334</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -27864,7 +27858,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4241202</v>
+<v>4251891</v>
 </b>
 </bs>
 </hist>
@@ -27880,7 +27874,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4241202</v>
+<v>4251891</v>
 </b>
 </bs>
 </hist>
@@ -28028,47 +28022,47 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12808</v>
+<v>12840</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21592</v>
+<v>21646</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3329</v>
+<v>3338</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5585</v>
+<v>5599</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>5594</v>
+<v>5609</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>5580</v>
+<v>5594</v>
 </b>
 <b>
 <a>11</a>
 <b>20</b>
-<v>5526</v>
+<v>5540</v>
 </b>
 <b>
 <a>20</a>
 <b>51</b>
-<v>5298</v>
+<v>5311</v>
 </b>
 <b>
 <a>51</a>
 <b>139922</b>
-<v>4841</v>
+<v>4853</v>
 </b>
 </bs>
 </hist>
@@ -28084,27 +28078,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31119</v>
+<v>31198</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24888</v>
+<v>24950</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>5259</v>
+<v>5272</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>5094</v>
+<v>5107</v>
 </b>
 <b>
 <a>6</a>
 <b>34</b>
-<v>3796</v>
+<v>3805</v>
 </b>
 </bs>
 </hist>
@@ -28114,19 +28108,19 @@
 </relation>
 <relation>
 <name>expr_parent</name>
-<cardinality>3919202</cardinality>
+<cardinality>3929084</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>3919202</v>
+<v>3929084</v>
 </e>
 <e>
 <k>index</k>
-<v>81592</v>
+<v>81798</v>
 </e>
 <e>
 <k>parent</k>
-<v>2570313</v>
+<v>2576793</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28140,7 +28134,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3919202</v>
+<v>3929084</v>
 </b>
 </bs>
 </hist>
@@ -28156,7 +28150,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3919202</v>
+<v>3929084</v>
 </b>
 </bs>
 </hist>
@@ -28172,22 +28166,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>67665</v>
+<v>67835</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6335</v>
+<v>6351</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6175</v>
+<v>6191</v>
 </b>
 <b>
 <a>13</a>
-<b>1585226</b>
-<v>1416</v>
+<b>1585224</b>
+<v>1420</v>
 </b>
 </bs>
 </hist>
@@ -28203,22 +28197,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>67665</v>
+<v>67835</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>6335</v>
+<v>6351</v>
 </b>
 <b>
 <a>6</a>
 <b>13</b>
-<v>6175</v>
+<v>6191</v>
 </b>
 <b>
 <a>13</a>
-<b>1585226</b>
-<v>1416</v>
+<b>1585224</b>
+<v>1420</v>
 </b>
 </bs>
 </hist>
@@ -28234,17 +28228,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1614187</v>
+<v>1618257</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>828683</v>
+<v>830773</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>127441</v>
+<v>127763</v>
 </b>
 </bs>
 </hist>
@@ -28260,17 +28254,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1614187</v>
+<v>1618257</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>828683</v>
+<v>830773</v>
 </b>
 <b>
 <a>3</a>
 <b>65537</b>
-<v>127441</v>
+<v>127763</v>
 </b>
 </bs>
 </hist>
@@ -28280,11 +28274,11 @@
 </relation>
 <relation>
 <name>expr_parent_top_level</name>
-<cardinality>498984</cardinality>
+<cardinality>500242</cardinality>
 <columnsizes>
 <e>
 <k>expr</k>
-<v>498984</v>
+<v>500242</v>
 </e>
 <e>
 <k>index</k>
@@ -28292,7 +28286,7 @@
 </e>
 <e>
 <k>parent</k>
-<v>430936</v>
+<v>432022</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28306,7 +28300,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>498984</v>
+<v>500242</v>
 </b>
 </bs>
 </hist>
@@ -28322,7 +28316,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>498984</v>
+<v>500242</v>
 </b>
 </bs>
 </hist>
@@ -28450,17 +28444,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>391004</v>
+<v>391989</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35577</v>
+<v>35666</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4355</v>
+<v>4366</v>
 </b>
 </bs>
 </hist>
@@ -28476,17 +28470,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>391183</v>
+<v>392169</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>35455</v>
+<v>35545</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>4297</v>
+<v>4307</v>
 </b>
 </bs>
 </hist>
@@ -28507,22 +28501,22 @@
 </relation>
 <relation>
 <name>explicitly_sized_array_creation</name>
-<cardinality>4269</cardinality>
+<cardinality>4280</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4269</v>
+<v>4280</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>stackalloc_array_creation</name>
-<cardinality>834</cardinality>
+<cardinality>836</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>834</v>
+<v>836</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -28588,22 +28582,22 @@
 </relation>
 <relation>
 <name>expr_compiler_generated</name>
-<cardinality>1626197</cardinality>
+<cardinality>1630295</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1626197</v>
+<v>1630295</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_value</name>
-<cardinality>1394019</cardinality>
+<cardinality>1401859</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1394019</v>
+<v>1401859</v>
 </e>
 <e>
 <k>value</k>
@@ -28621,7 +28615,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1394019</v>
+<v>1401859</v>
 </b>
 </bs>
 </hist>
@@ -28637,27 +28631,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72306</v>
+<v>72298</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>14951</v>
+<v>14950</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>7873</v>
+<v>7874</v>
 </b>
 <b>
 <a>6</a>
-<b>2586</b>
+<b>2062</b>
 <v>7716</v>
 </b>
 <b>
-<a>2635</a>
-<b>269984</b>
-<v>31</v>
+<a>2136</a>
+<b>273444</b>
+<v>39</v>
 </b>
 </bs>
 </hist>
@@ -28667,15 +28661,15 @@
 </relation>
 <relation>
 <name>expr_call</name>
-<cardinality>677219</cardinality>
+<cardinality>677209</cardinality>
 <columnsizes>
 <e>
 <k>caller_id</k>
-<v>677219</v>
+<v>677209</v>
 </e>
 <e>
 <k>target_id</k>
-<v>53767</v>
+<v>53763</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28689,7 +28683,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>677219</v>
+<v>677209</v>
 </b>
 </bs>
 </hist>
@@ -28705,17 +28699,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28800</v>
+<v>28793</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10037</v>
+<v>10043</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>4350</v>
+<v>4349</v>
 </b>
 <b>
 <a>4</a>
@@ -28725,7 +28719,7 @@
 <b>
 <a>7</a>
 <b>24</b>
-<v>4068</v>
+<v>4066</v>
 </b>
 <b>
 <a>24</a>
@@ -28740,15 +28734,15 @@
 </relation>
 <relation>
 <name>expr_access</name>
-<cardinality>1377653</cardinality>
+<cardinality>1381128</cardinality>
 <columnsizes>
 <e>
 <k>accesser_id</k>
-<v>1377653</v>
+<v>1381128</v>
 </e>
 <e>
 <k>target_id</k>
-<v>338815</v>
+<v>339670</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28762,7 +28756,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1377653</v>
+<v>1381128</v>
 </b>
 </bs>
 </hist>
@@ -28778,37 +28772,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>110292</v>
+<v>110570</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>71168</v>
+<v>71347</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>54695</v>
+<v>54833</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>33113</v>
+<v>33196</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>19857</v>
+<v>19907</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>25695</v>
+<v>25759</v>
 </b>
 <b>
 <a>9</a>
 <b>7782</b>
-<v>23993</v>
+<v>24053</v>
 </b>
 </bs>
 </hist>
@@ -28818,15 +28812,15 @@
 </relation>
 <relation>
 <name>expr_location</name>
-<cardinality>4241202</cardinality>
+<cardinality>4251891</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4241202</v>
+<v>4251891</v>
 </e>
 <e>
 <k>loc</k>
-<v>3004401</v>
+<v>3004286</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28840,7 +28834,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4241202</v>
+<v>4251891</v>
 </b>
 </bs>
 </hist>
@@ -28856,17 +28850,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2758180</v>
+<v>2758070</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>241569</v>
+<v>241567</v>
 </b>
 <b>
 <a>3</a>
 <b>542807</b>
-<v>4652</v>
+<v>4649</v>
 </b>
 </bs>
 </hist>
@@ -28876,15 +28870,15 @@
 </relation>
 <relation>
 <name>dynamic_member_name</name>
-<cardinality>13600</cardinality>
+<cardinality>13635</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>13600</v>
+<v>13635</v>
 </e>
 <e>
 <k>name</k>
-<v>1404</v>
+<v>1408</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -28898,7 +28892,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13600</v>
+<v>13635</v>
 </b>
 </bs>
 </hist>
@@ -28914,12 +28908,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>408</v>
+<v>409</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>247</v>
+<v>248</v>
 </b>
 <b>
 <a>3</a>
@@ -28929,7 +28923,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>111</v>
+<v>112</v>
 </b>
 <b>
 <a>5</a>
@@ -28944,12 +28938,12 @@
 <b>
 <a>11</a>
 <b>19</b>
-<v>106</v>
+<v>107</v>
 </b>
 <b>
 <a>20</a>
 <b>97</b>
-<v>106</v>
+<v>107</v>
 </b>
 <b>
 <a>122</a>
@@ -28964,22 +28958,22 @@
 </relation>
 <relation>
 <name>conditional_access</name>
-<cardinality>3067</cardinality>
+<cardinality>3074</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>3067</v>
+<v>3074</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>expr_argument</name>
-<cardinality>873885</cardinality>
+<cardinality>873870</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>873885</v>
+<v>873870</v>
 </e>
 <e>
 <k>mode</k>
@@ -28997,7 +28991,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>873885</v>
+<v>873870</v>
 </b>
 </bs>
 </hist>
@@ -29026,8 +29020,8 @@
 <v>1</v>
 </b>
 <b>
-<a>863708</a>
-<b>863709</b>
+<a>863693</a>
+<b>863694</b>
 <v>1</v>
 </b>
 </bs>
@@ -33580,11 +33574,11 @@
 </relation>
 <relation>
 <name>commentline</name>
-<cardinality>419850</cardinality>
+<cardinality>420909</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>419850</v>
+<v>420909</v>
 </e>
 <e>
 <k>kind</k>
@@ -33592,11 +33586,11 @@
 </e>
 <e>
 <k>text</k>
-<v>201407</v>
+<v>201915</v>
 </e>
 <e>
 <k>rawtext</k>
-<v>204077</v>
+<v>204592</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33610,7 +33604,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>419850</v>
+<v>420909</v>
 </b>
 </bs>
 </hist>
@@ -33626,7 +33620,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>419850</v>
+<v>420909</v>
 </b>
 </bs>
 </hist>
@@ -33642,7 +33636,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>419850</v>
+<v>420909</v>
 </b>
 </bs>
 </hist>
@@ -33736,17 +33730,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>165029</v>
+<v>165445</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>24005</v>
+<v>24066</v>
 </b>
 <b>
 <a>3</a>
 <b>24462</b>
-<v>12372</v>
+<v>12403</v>
 </b>
 </bs>
 </hist>
@@ -33762,12 +33756,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>200293</v>
+<v>200798</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>1114</v>
+<v>1116</v>
 </b>
 </bs>
 </hist>
@@ -33783,12 +33777,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>199285</v>
+<v>199787</v>
 </b>
 <b>
 <a>2</a>
 <b>51</b>
-<v>2122</v>
+<v>2127</v>
 </b>
 </bs>
 </hist>
@@ -33804,17 +33798,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>168426</v>
+<v>168851</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>23528</v>
+<v>23588</v>
 </b>
 <b>
 <a>3</a>
 <b>24457</b>
-<v>12122</v>
+<v>12152</v>
 </b>
 </bs>
 </hist>
@@ -33830,7 +33824,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>204077</v>
+<v>204592</v>
 </b>
 </bs>
 </hist>
@@ -33846,7 +33840,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>204077</v>
+<v>204592</v>
 </b>
 </bs>
 </hist>
@@ -33856,15 +33850,15 @@
 </relation>
 <relation>
 <name>commentline_location</name>
-<cardinality>419850</cardinality>
+<cardinality>420909</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>419850</v>
+<v>420909</v>
 </e>
 <e>
 <k>loc</k>
-<v>419850</v>
+<v>420909</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33878,7 +33872,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>419850</v>
+<v>420909</v>
 </b>
 </bs>
 </hist>
@@ -33894,7 +33888,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>419850</v>
+<v>420909</v>
 </b>
 </bs>
 </hist>
@@ -33904,26 +33898,26 @@
 </relation>
 <relation>
 <name>commentblock</name>
-<cardinality>147571</cardinality>
+<cardinality>147943</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>147571</v>
+<v>147943</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>commentblock_location</name>
-<cardinality>147571</cardinality>
+<cardinality>147943</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>147571</v>
+<v>147943</v>
 </e>
 <e>
 <k>loc</k>
-<v>147571</v>
+<v>147943</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -33937,7 +33931,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>147571</v>
+<v>147943</v>
 </b>
 </bs>
 </hist>
@@ -33953,7 +33947,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>147571</v>
+<v>147943</v>
 </b>
 </bs>
 </hist>
@@ -33963,15 +33957,15 @@
 </relation>
 <relation>
 <name>commentblock_binding</name>
-<cardinality>511118</cardinality>
+<cardinality>512407</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>147511</v>
+<v>147883</v>
 </e>
 <e>
 <k>entity</k>
-<v>220905</v>
+<v>221462</v>
 </e>
 <e>
 <k>bindtype</k>
@@ -33989,22 +33983,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18463</v>
+<v>18510</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>29708</v>
+<v>29783</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>99041</v>
+<v>99291</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>297</v>
+<v>298</v>
 </b>
 </bs>
 </hist>
@@ -34020,22 +34014,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13247</v>
+<v>13281</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5339</v>
+<v>5352</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>29661</v>
+<v>29735</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>99263</v>
+<v>99513</v>
 </b>
 </bs>
 </hist>
@@ -34051,17 +34045,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>161890</v>
+<v>162299</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43010</v>
+<v>43119</v>
 </b>
 <b>
 <a>3</a>
 <b>9895</b>
-<v>16003</v>
+<v>16044</v>
 </b>
 </bs>
 </hist>
@@ -34077,22 +34071,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96446</v>
+<v>96689</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>94859</v>
+<v>95098</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>28710</v>
+<v>28782</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>890</v>
+<v>892</v>
 </b>
 </bs>
 </hist>
@@ -34164,19 +34158,19 @@
 </relation>
 <relation>
 <name>commentblock_child</name>
-<cardinality>556101</cardinality>
+<cardinality>557503</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>147571</v>
+<v>147943</v>
 </e>
 <e>
 <k>commentline</k>
-<v>419762</v>
+<v>420820</v>
 </e>
 <e>
 <k>index</k>
-<v>5101</v>
+<v>5114</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -34190,32 +34184,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>78632</v>
+<v>78830</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>20367</v>
+<v>20418</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>19406</v>
+<v>19454</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>9167</v>
+<v>9190</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>11733</v>
+<v>11763</v>
 </b>
 <b>
 <a>8</a>
 <b>4098</b>
-<v>8264</v>
+<v>8285</v>
 </b>
 </bs>
 </hist>
@@ -34231,37 +34225,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4300</v>
+<v>4311</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>75253</v>
+<v>75443</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22155</v>
+<v>22211</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>17613</v>
+<v>17657</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>8817</v>
+<v>8839</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>11447</v>
+<v>11476</v>
 </b>
 <b>
 <a>9</a>
 <b>4099</b>
-<v>7982</v>
+<v>8002</v>
 </b>
 </bs>
 </hist>
@@ -34277,7 +34271,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>419753</v>
+<v>420812</v>
 </b>
 <b>
 <a>2</a>
@@ -34298,12 +34292,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>283432</v>
+<v>284146</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>136330</v>
+<v>136674</v>
 </b>
 </bs>
 </hist>
@@ -34319,27 +34313,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2276</v>
+<v>2282</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1410</v>
+<v>1413</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>407</v>
+<v>408</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>449</v>
+<v>450</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>388</v>
+<v>389</v>
 </b>
 <b>
 <a>28</a>
@@ -34360,27 +34354,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2276</v>
+<v>2282</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>1410</v>
+<v>1413</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>407</v>
+<v>408</v>
 </b>
 <b>
 <a>7</a>
 <b>10</b>
-<v>449</v>
+<v>450</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>388</v>
+<v>389</v>
 </b>
 <b>
 <a>28</a>
@@ -35189,7 +35183,7 @@
 </e>
 <e>
 <k>name</k>
-<v>6</v>
+<v>3</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35217,19 +35211,9 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>1</a>
-<b>2</b>
-<v>4</v>
-</b>
-<b>
-<a>2</a>
-<b>3</b>
-<v>1</v>
-</b>
-<b>
 <a>3</a>
 <b>4</b>
-<v>1</v>
+<v>3</v>
 </b>
 </bs>
 </hist>
@@ -35250,23 +35234,23 @@
 </relation>
 <relation>
 <name>cil_instruction</name>
-<cardinality>32096629</cardinality>
+<cardinality>32177521</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32096629</v>
+<v>32177521</v>
 </e>
 <e>
 <k>opcode</k>
-<v>962</v>
+<v>964</v>
 </e>
 <e>
 <k>index</k>
-<v>331661</v>
+<v>332497</v>
 </e>
 <e>
 <k>impl</k>
-<v>1722264</v>
+<v>1726604</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35280,7 +35264,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32096629</v>
+<v>32177521</v>
 </b>
 </bs>
 </hist>
@@ -35296,7 +35280,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32096629</v>
+<v>32177521</v>
 </b>
 </bs>
 </hist>
@@ -35312,7 +35296,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>32096629</v>
+<v>32177521</v>
 </b>
 </bs>
 </hist>
@@ -35333,62 +35317,62 @@
 <b>
 <a>7</a>
 <b>42</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>46</a>
 <b>106</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>128</a>
 <b>302</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>304</a>
 <b>953</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>1002</a>
 <b>1752</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>1791</a>
 <b>2952</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>3194</a>
 <b>4898</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>5191</a>
 <b>11577</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>11669</a>
 <b>19719</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>19906</a>
 <b>53412</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>54233</a>
 <b>104298</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>104740</a>
 <b>420483</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>562153</a>
@@ -35414,22 +35398,22 @@
 <b>
 <a>10</a>
 <b>31</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>32</a>
 <b>68</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>75</a>
 <b>148</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>150</a>
 <b>214</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>214</a>
@@ -35439,37 +35423,37 @@
 <b>
 <a>323</a>
 <b>468</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>486</a>
 <b>699</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>714</a>
 <b>872</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>879</a>
 <b>1176</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>1185</a>
 <b>1360</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>1382</a>
 <b>2349</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>2641</a>
 <b>31606</b>
-<v>72</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -35490,62 +35474,62 @@
 <b>
 <a>7</a>
 <b>22</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>26</a>
 <b>58</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>62</a>
 <b>191</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>192</a>
 <b>422</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>434</a>
 <b>696</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>703</a>
 <b>993</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>1012</a>
 <b>2698</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>2754</a>
 <b>5088</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>5150</a>
 <b>9841</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>10112</a>
 <b>16999</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>18955</a>
 <b>42845</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>44005</a>
 <b>171634</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>243198</a>
@@ -35566,22 +35550,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>259787</v>
+<v>260442</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30526</v>
+<v>30603</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25432</v>
+<v>25496</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15914</v>
+<v>15954</v>
 </b>
 </bs>
 </hist>
@@ -35597,22 +35581,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>260380</v>
+<v>261037</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17640</v>
+<v>17684</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>28664</v>
+<v>28737</v>
 </b>
 <b>
 <a>5</a>
 <b>160</b>
-<v>24878</v>
+<v>24940</v>
 </b>
 <b>
 <a>160</a>
@@ -35633,22 +35617,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>259787</v>
+<v>260442</v>
 </b>
 <b>
 <a>2</a>
 <b>11</b>
-<v>30526</v>
+<v>30603</v>
 </b>
 <b>
 <a>11</a>
 <b>25</b>
-<v>25432</v>
+<v>25496</v>
 </b>
 <b>
 <a>25</a>
 <b>354308</b>
-<v>15914</v>
+<v>15954</v>
 </b>
 </bs>
 </hist>
@@ -35664,57 +35648,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>83812</v>
+<v>84023</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>251242</v>
+<v>251875</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>331549</v>
+<v>332385</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>195404</v>
+<v>195897</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>106809</v>
+<v>107078</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>157611</v>
+<v>158008</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>150635</v>
+<v>151015</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>133520</v>
+<v>133856</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131177</v>
+<v>131507</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129208</v>
+<v>129534</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51292</v>
+<v>51421</v>
 </b>
 </bs>
 </hist>
@@ -35730,57 +35714,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>83812</v>
+<v>84023</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>251529</v>
+<v>252163</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>337504</v>
+<v>338355</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>238885</v>
+<v>239487</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>132115</v>
+<v>132448</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>96095</v>
+<v>96338</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>147427</v>
+<v>147798</v>
 </b>
 <b>
 <a>9</a>
 <b>12</b>
-<v>128547</v>
+<v>128871</v>
 </b>
 <b>
 <a>12</a>
 <b>17</b>
-<v>135479</v>
+<v>135820</v>
 </b>
 <b>
 <a>17</a>
 <b>33</b>
-<v>131770</v>
+<v>132102</v>
 </b>
 <b>
 <a>33</a>
 <b>74</b>
-<v>39096</v>
+<v>39195</v>
 </b>
 </bs>
 </hist>
@@ -35796,57 +35780,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>83812</v>
+<v>84023</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>251242</v>
+<v>251875</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>331549</v>
+<v>332385</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>195404</v>
+<v>195897</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>106809</v>
+<v>107078</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>157611</v>
+<v>158008</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>150635</v>
+<v>151015</v>
 </b>
 <b>
 <a>14</a>
 <b>21</b>
-<v>133520</v>
+<v>133856</v>
 </b>
 <b>
 <a>21</a>
 <b>35</b>
-<v>131177</v>
+<v>131507</v>
 </b>
 <b>
 <a>35</a>
 <b>106</b>
-<v>129208</v>
+<v>129534</v>
 </b>
 <b>
 <a>106</a>
 <b>68231</b>
-<v>51292</v>
+<v>51421</v>
 </b>
 </bs>
 </hist>
@@ -35856,15 +35840,15 @@
 </relation>
 <relation>
 <name>cil_jump</name>
-<cardinality>1999371</cardinality>
+<cardinality>2004410</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>1999371</v>
+<v>2004410</v>
 </e>
 <e>
 <k>target</k>
-<v>1601290</v>
+<v>1605325</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35878,7 +35862,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1999371</v>
+<v>2004410</v>
 </b>
 </bs>
 </hist>
@@ -35894,17 +35878,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1388118</v>
+<v>1391616</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>143397</v>
+<v>143759</v>
 </b>
 <b>
 <a>3</a>
 <b>360</b>
-<v>69773</v>
+<v>69949</v>
 </b>
 </bs>
 </hist>
@@ -35914,15 +35898,15 @@
 </relation>
 <relation>
 <name>cil_access</name>
-<cardinality>11901276</cardinality>
+<cardinality>11931270</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>11901276</v>
+<v>11931270</v>
 </e>
 <e>
 <k>target</k>
-<v>2659331</v>
+<v>2666033</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -35936,7 +35920,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11901276</v>
+<v>11931270</v>
 </b>
 </bs>
 </hist>
@@ -35952,37 +35936,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>943060</v>
+<v>945437</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>738507</v>
+<v>740368</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>268518</v>
+<v>269194</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>186752</v>
+<v>187223</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>226237</v>
+<v>226807</v>
 </b>
 <b>
 <a>7</a>
 <b>14</b>
-<v>203133</v>
+<v>203645</v>
 </b>
 <b>
 <a>14</a>
 <b>25741</b>
-<v>93120</v>
+<v>93355</v>
 </b>
 </bs>
 </hist>
@@ -35992,15 +35976,15 @@
 </relation>
 <relation>
 <name>cil_value</name>
-<cardinality>1880259</cardinality>
+<cardinality>1884998</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>1880259</v>
+<v>1884998</v>
 </e>
 <e>
 <k>value</k>
-<v>493866</v>
+<v>495111</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36014,7 +35998,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1880259</v>
+<v>1884998</v>
 </b>
 </bs>
 </hist>
@@ -36030,27 +36014,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>333703</v>
+<v>334544</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>78849</v>
+<v>79047</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>40627</v>
+<v>40730</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>37176</v>
+<v>37270</v>
 </b>
 <b>
 <a>33</a>
 <b>86799</b>
-<v>3509</v>
+<v>3518</v>
 </b>
 </bs>
 </hist>
@@ -36060,19 +36044,19 @@
 </relation>
 <relation>
 <name>cil_switch</name>
-<cardinality>194014</cardinality>
+<cardinality>194503</cardinality>
 <columnsizes>
 <e>
 <k>instruction</k>
-<v>23804</v>
+<v>23864</v>
 </e>
 <e>
 <k>index</k>
-<v>2513</v>
+<v>2519</v>
 </e>
 <e>
 <k>target</k>
-<v>130346</v>
+<v>130674</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36086,42 +36070,42 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>7004</v>
+<v>7022</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>4583</v>
+<v>4595</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>3222</v>
+<v>3230</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>1681</v>
+<v>1686</v>
 </b>
 <b>
 <a>7</a>
 <b>8</b>
-<v>1438</v>
+<v>1442</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>2153</v>
+<v>2158</v>
 </b>
 <b>
 <a>11</a>
 <b>17</b>
-<v>1842</v>
+<v>1846</v>
 </b>
 <b>
 <a>17</a>
 <b>128</b>
-<v>1788</v>
+<v>1793</v>
 </b>
 <b>
 <a>141</a>
@@ -36142,42 +36126,42 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>1054</v>
+<v>1057</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8229</v>
+<v>8250</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>5478</v>
+<v>5492</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>2566</v>
+<v>2573</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>1837</v>
+<v>1842</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>1696</v>
+<v>1700</v>
 </b>
 <b>
 <a>9</a>
 <b>14</b>
-<v>1793</v>
+<v>1798</v>
 </b>
 <b>
 <a>14</a>
 <b>204</b>
-<v>1147</v>
+<v>1150</v>
 </b>
 </bs>
 </hist>
@@ -36198,7 +36182,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>986</v>
+<v>989</v>
 </b>
 <b>
 <a>3</a>
@@ -36208,7 +36192,7 @@
 <b>
 <a>4</a>
 <b>5</b>
-<v>359</v>
+<v>360</v>
 </b>
 <b>
 <a>6</a>
@@ -36223,7 +36207,7 @@
 <b>
 <a>18</a>
 <b>24</b>
-<v>189</v>
+<v>190</v>
 </b>
 <b>
 <a>25</a>
@@ -36233,12 +36217,12 @@
 <b>
 <a>47</a>
 <b>225</b>
-<v>189</v>
+<v>190</v>
 </b>
 <b>
 <a>238</a>
 <b>4898</b>
-<v>106</v>
+<v>107</v>
 </b>
 </bs>
 </hist>
@@ -36259,7 +36243,7 @@
 <b>
 <a>2</a>
 <b>3</b>
-<v>972</v>
+<v>974</v>
 </b>
 <b>
 <a>3</a>
@@ -36294,7 +36278,7 @@
 <b>
 <a>47</a>
 <b>271</b>
-<v>189</v>
+<v>190</v>
 </b>
 <b>
 <a>289</a>
@@ -36315,12 +36299,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>128717</v>
+<v>129042</v>
 </b>
 <b>
 <a>2</a>
 <b>12</b>
-<v>1628</v>
+<v>1632</v>
 </b>
 </bs>
 </hist>
@@ -36336,17 +36320,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>117979</v>
+<v>118277</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>9979</v>
+<v>10004</v>
 </b>
 <b>
 <a>7</a>
 <b>253</b>
-<v>2386</v>
+<v>2392</v>
 </b>
 </bs>
 </hist>
@@ -36424,15 +36408,15 @@
 </relation>
 <relation>
 <name>cil_type_location</name>
-<cardinality>276791</cardinality>
+<cardinality>277489</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>254465</v>
+<v>255106</v>
 </e>
 <e>
 <k>loc</k>
-<v>3407</v>
+<v>3416</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36446,12 +36430,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>232138</v>
+<v>232723</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22326</v>
+<v>22382</v>
 </b>
 </bs>
 </hist>
@@ -36467,12 +36451,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>286</v>
+<v>287</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>218</v>
+<v>219</v>
 </b>
 <b>
 <a>4</a>
@@ -36482,7 +36466,7 @@
 <b>
 <a>6</a>
 <b>9</b>
-<v>296</v>
+<v>297</v>
 </b>
 <b>
 <a>9</a>
@@ -36492,37 +36476,37 @@
 <b>
 <a>13</a>
 <b>17</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>17</a>
 <b>23</b>
-<v>281</v>
+<v>282</v>
 </b>
 <b>
 <a>23</a>
 <b>32</b>
-<v>262</v>
+<v>263</v>
 </b>
 <b>
 <a>32</a>
 <b>43</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>43</a>
 <b>66</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>66</a>
 <b>110</b>
-<v>262</v>
+<v>263</v>
 </b>
 <b>
 <a>112</a>
 <b>238</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>239</a>
@@ -36537,15 +36521,15 @@
 </relation>
 <relation>
 <name>cil_method_location</name>
-<cardinality>1880215</cardinality>
+<cardinality>1884954</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1792981</v>
+<v>1797499</v>
 </e>
 <e>
 <k>loc</k>
-<v>3120</v>
+<v>3128</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36559,12 +36543,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1705746</v>
+<v>1710045</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>87234</v>
+<v>87454</v>
 </b>
 </bs>
 </hist>
@@ -36580,7 +36564,7 @@
 <b>
 <a>1</a>
 <b>11</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>11</a>
@@ -36595,7 +36579,7 @@
 <b>
 <a>38</a>
 <b>53</b>
-<v>252</v>
+<v>253</v>
 </b>
 <b>
 <a>53</a>
@@ -36610,7 +36594,7 @@
 <b>
 <a>107</a>
 <b>138</b>
-<v>247</v>
+<v>248</v>
 </b>
 <b>
 <a>140</a>
@@ -36650,15 +36634,15 @@
 </relation>
 <relation>
 <name>cil_type</name>
-<cardinality>793178</cardinality>
+<cardinality>795153</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>793178</v>
+<v>795153</v>
 </e>
 <e>
 <k>name</k>
-<v>178712</v>
+<v>179138</v>
 </e>
 <e>
 <k>kind</k>
@@ -36666,11 +36650,11 @@
 </e>
 <e>
 <k>parent</k>
-<v>155117</v>
+<v>155508</v>
 </e>
 <e>
 <k>sourceDecl</k>
-<v>463679</v>
+<v>464824</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -36684,7 +36668,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>793178</v>
+<v>795153</v>
 </b>
 </bs>
 </hist>
@@ -36700,7 +36684,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>793178</v>
+<v>795153</v>
 </b>
 </bs>
 </hist>
@@ -36716,7 +36700,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>793178</v>
+<v>795153</v>
 </b>
 </bs>
 </hist>
@@ -36732,7 +36716,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>793178</v>
+<v>795153</v>
 </b>
 </bs>
 </hist>
@@ -36748,22 +36732,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>137384</v>
+<v>137706</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22447</v>
+<v>22504</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>14121</v>
+<v>14156</v>
 </b>
 <b>
 <a>7</a>
 <b>21324</b>
-<v>4758</v>
+<v>4770</v>
 </b>
 </bs>
 </hist>
@@ -36779,7 +36763,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>178712</v>
+<v>179138</v>
 </b>
 </bs>
 </hist>
@@ -36795,17 +36779,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>162097</v>
+<v>162481</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>13615</v>
+<v>13649</v>
 </b>
 <b>
 <a>4</a>
 <b>21324</b>
-<v>2999</v>
+<v>3006</v>
 </b>
 </bs>
 </hist>
@@ -36821,17 +36805,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145828</v>
+<v>146171</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22472</v>
+<v>22528</v>
 </b>
 <b>
 <a>3</a>
 <b>21324</b>
-<v>10412</v>
+<v>10438</v>
 </b>
 </bs>
 </hist>
@@ -36845,8 +36829,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>128</a>
-<b>129</b>
+<a>123</a>
+<b>124</b>
 <v>4</v>
 </b>
 <b>
@@ -36881,8 +36865,8 @@
 <v>4</v>
 </b>
 <b>
-<a>106</a>
-<b>107</b>
+<a>101</a>
+<b>102</b>
 <v>4</v>
 </b>
 <b>
@@ -36912,8 +36896,8 @@
 <v>4</v>
 </b>
 <b>
-<a>32</a>
-<b>33</b>
+<a>31</a>
+<b>32</b>
 <v>4</v>
 </b>
 <b>
@@ -36938,8 +36922,8 @@
 <budget>12</budget>
 <bs>
 <b>
-<a>128</a>
-<b>129</b>
+<a>123</a>
+<b>124</b>
 <v>4</v>
 </b>
 <b>
@@ -36971,27 +36955,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101574</v>
+<v>101830</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>26740</v>
+<v>26807</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13314</v>
+<v>13347</v>
 </b>
 <b>
 <a>6</a>
 <b>33</b>
-<v>11675</v>
+<v>11705</v>
 </b>
 <b>
 <a>33</a>
-<b>26080</b>
-<v>1813</v>
+<b>26076</b>
+<v>1817</v>
 </b>
 </bs>
 </hist>
@@ -37007,27 +36991,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102147</v>
+<v>102405</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27158</v>
+<v>27226</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13212</v>
+<v>13245</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11661</v>
+<v>11690</v>
 </b>
 <b>
 <a>38</a>
-<b>1430</b>
-<v>938</v>
+<b>1426</b>
+<v>940</v>
 </b>
 </bs>
 </hist>
@@ -37043,12 +37027,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>151918</v>
+<v>152306</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>3198</v>
+<v>3201</v>
 </b>
 </bs>
 </hist>
@@ -37064,27 +37048,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>102045</v>
+<v>102302</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27177</v>
+<v>27245</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>13119</v>
+<v>13152</v>
 </b>
 <b>
 <a>6</a>
 <b>38</b>
-<v>11641</v>
+<v>11671</v>
 </b>
 <b>
 <a>38</a>
-<b>3477</b>
-<v>1132</v>
+<b>3473</b>
+<v>1135</v>
 </b>
 </bs>
 </hist>
@@ -37100,12 +37084,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>436949</v>
+<v>438026</v>
 </b>
 <b>
 <a>2</a>
 <b>3705</b>
-<v>26730</v>
+<v>26797</v>
 </b>
 </bs>
 </hist>
@@ -37121,7 +37105,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>463679</v>
+<v>464824</v>
 </b>
 </bs>
 </hist>
@@ -37137,7 +37121,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>463679</v>
+<v>464824</v>
 </b>
 </bs>
 </hist>
@@ -37153,12 +37137,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>455372</v>
+<v>456495</v>
 </b>
 <b>
 <a>2</a>
 <b>225</b>
-<v>8307</v>
+<v>8328</v>
 </b>
 </bs>
 </hist>
@@ -37168,15 +37152,15 @@
 </relation>
 <relation>
 <name>cil_pointer_type</name>
-<cardinality>622</cardinality>
+<cardinality>599</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>622</v>
+<v>599</v>
 </e>
 <e>
 <k>pointee</k>
-<v>622</v>
+<v>599</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37190,7 +37174,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>622</v>
+<v>599</v>
 </b>
 </bs>
 </hist>
@@ -37206,7 +37190,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>622</v>
+<v>599</v>
 </b>
 </bs>
 </hist>
@@ -37216,15 +37200,15 @@
 </relation>
 <relation>
 <name>cil_array_type</name>
-<cardinality>14140</cardinality>
+<cardinality>14176</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14140</v>
+<v>14176</v>
 </e>
 <e>
 <k>element_type</k>
-<v>14062</v>
+<v>14098</v>
 </e>
 <e>
 <k>rank</k>
@@ -37242,7 +37226,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14140</v>
+<v>14176</v>
 </b>
 </bs>
 </hist>
@@ -37258,7 +37242,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14140</v>
+<v>14176</v>
 </b>
 </bs>
 </hist>
@@ -37274,12 +37258,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13989</v>
+<v>14025</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>72</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -37295,12 +37279,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>13989</v>
+<v>14025</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>72</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -37361,24 +37345,77 @@
 </dependencies>
 </relation>
 <relation>
-<name>cil_method</name>
-<cardinality>2307141</cardinality>
+<name>cil_function_pointer_return_type</name>
+<cardinality>9</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>2307141</v>
-</e>
-<e>
-<k>name</k>
-<v>438748</v>
-</e>
-<e>
-<k>parent</k>
-<v>379143</v>
+<v>9</v>
 </e>
 <e>
 <k>return_type</k>
-<v>213424</v>
+<v>6</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>return_type</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>9</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>return_type</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>5</v>
+</b>
+<b>
+<a>4</a>
+<b>5</b>
+<v>1</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>cil_method</name>
+<cardinality>2312956</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>2312956</v>
+</e>
+<e>
+<k>name</k>
+<v>439853</v>
+</e>
+<e>
+<k>parent</k>
+<v>380098</v>
+</e>
+<e>
+<k>return_type</k>
+<v>213962</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37392,7 +37429,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2307141</v>
+<v>2312956</v>
 </b>
 </bs>
 </hist>
@@ -37408,7 +37445,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2307141</v>
+<v>2312956</v>
 </b>
 </bs>
 </hist>
@@ -37424,7 +37461,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2307141</v>
+<v>2312956</v>
 </b>
 </bs>
 </hist>
@@ -37440,27 +37477,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>270321</v>
+<v>271002</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>79403</v>
+<v>79603</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>24970</v>
+<v>25033</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>33409</v>
+<v>33493</v>
 </b>
 <b>
 <a>7</a>
 <b>64064</b>
-<v>30643</v>
+<v>30720</v>
 </b>
 </bs>
 </hist>
@@ -37476,27 +37513,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>284296</v>
+<v>285013</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>76370</v>
+<v>76562</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>39767</v>
+<v>39867</v>
 </b>
 <b>
 <a>5</a>
 <b>25</b>
-<v>33073</v>
+<v>33157</v>
 </b>
 <b>
 <a>25</a>
 <b>52725</b>
-<v>5240</v>
+<v>5253</v>
 </b>
 </bs>
 </hist>
@@ -37512,17 +37549,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>383119</v>
+<v>384085</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>40127</v>
+<v>40228</v>
 </b>
 <b>
 <a>4</a>
 <b>2803</b>
-<v>15501</v>
+<v>15540</v>
 </b>
 </bs>
 </hist>
@@ -37538,42 +37575,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>107694</v>
+<v>107965</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>84288</v>
+<v>84501</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49819</v>
+<v>49945</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28494</v>
+<v>28566</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>30789</v>
+<v>30866</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>32830</v>
+<v>32913</v>
 </b>
 <b>
 <a>11</a>
 <b>21</b>
-<v>28878</v>
+<v>28951</v>
 </b>
 <b>
 <a>21</a>
 <b>3536</b>
-<v>16347</v>
+<v>16388</v>
 </b>
 </bs>
 </hist>
@@ -37589,42 +37626,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>114066</v>
+<v>114354</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86437</v>
+<v>86655</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>50373</v>
+<v>50500</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>28839</v>
+<v>28912</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>32787</v>
+<v>32869</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>29933</v>
+<v>30009</v>
 </b>
 <b>
 <a>11</a>
 <b>26</b>
-<v>28616</v>
+<v>28688</v>
 </b>
 <b>
 <a>26</a>
 <b>1885</b>
-<v>8088</v>
+<v>8108</v>
 </b>
 </bs>
 </hist>
@@ -37640,32 +37677,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>161737</v>
+<v>162145</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>93446</v>
+<v>93682</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>46271</v>
+<v>46387</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23235</v>
+<v>23293</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>28319</v>
+<v>28391</v>
 </b>
 <b>
 <a>7</a>
 <b>1924</b>
-<v>26132</v>
+<v>26198</v>
 </b>
 </bs>
 </hist>
@@ -37681,27 +37718,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>131619</v>
+<v>131951</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>38138</v>
+<v>38235</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>18792</v>
+<v>18839</v>
 </b>
 <b>
 <a>5</a>
 <b>13</b>
-<v>16522</v>
+<v>16563</v>
 </b>
 <b>
 <a>13</a>
 <b>190707</b>
-<v>8351</v>
+<v>8372</v>
 </b>
 </bs>
 </hist>
@@ -37717,22 +37754,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>153134</v>
+<v>153520</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30264</v>
+<v>30340</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>19093</v>
+<v>19141</v>
 </b>
 <b>
 <a>6</a>
 <b>28461</b>
-<v>10932</v>
+<v>10959</v>
 </b>
 </bs>
 </hist>
@@ -37748,22 +37785,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>145006</v>
+<v>145372</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>35295</v>
+<v>35384</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>17504</v>
+<v>17548</v>
 </b>
 <b>
 <a>5</a>
 <b>62018</b>
-<v>15618</v>
+<v>15657</v>
 </b>
 </bs>
 </hist>
@@ -37773,15 +37810,15 @@
 </relation>
 <relation>
 <name>cil_method_source_declaration</name>
-<cardinality>2101441</cardinality>
+<cardinality>2106737</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>2101441</v>
+<v>2106737</v>
 </e>
 <e>
 <k>source</k>
-<v>1859473</v>
+<v>1864160</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37795,7 +37832,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>2101441</v>
+<v>2106737</v>
 </b>
 </bs>
 </hist>
@@ -37811,12 +37848,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1754813</v>
+<v>1759235</v>
 </b>
 <b>
 <a>2</a>
 <b>1021</b>
-<v>104660</v>
+<v>104924</v>
 </b>
 </bs>
 </hist>
@@ -37826,19 +37863,19 @@
 </relation>
 <relation>
 <name>cil_method_implementation</name>
-<cardinality>1722264</cardinality>
+<cardinality>1726604</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1722264</v>
+<v>1726604</v>
 </e>
 <e>
 <k>method</k>
-<v>1635671</v>
+<v>1639793</v>
 </e>
 <e>
 <k>location</k>
-<v>3086</v>
+<v>3094</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -37852,7 +37889,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1722264</v>
+<v>1726604</v>
 </b>
 </bs>
 </hist>
@@ -37868,7 +37905,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1722264</v>
+<v>1726604</v>
 </b>
 </bs>
 </hist>
@@ -37884,12 +37921,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1549078</v>
+<v>1552982</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86592</v>
+<v>86810</v>
 </b>
 </bs>
 </hist>
@@ -37905,12 +37942,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1549078</v>
+<v>1552982</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>86592</v>
+<v>86810</v>
 </b>
 </bs>
 </hist>
@@ -37951,7 +37988,7 @@
 <b>
 <a>74</a>
 <b>104</b>
-<v>247</v>
+<v>248</v>
 </b>
 <b>
 <a>104</a>
@@ -37971,7 +38008,7 @@
 <b>
 <a>271</a>
 <b>365</b>
-<v>247</v>
+<v>248</v>
 </b>
 <b>
 <a>372</a>
@@ -37986,7 +38023,7 @@
 <b>
 <a>1599</a>
 <b>33053</b>
-<v>189</v>
+<v>190</v>
 </b>
 </bs>
 </hist>
@@ -38027,7 +38064,7 @@
 <b>
 <a>74</a>
 <b>104</b>
-<v>247</v>
+<v>248</v>
 </b>
 <b>
 <a>104</a>
@@ -38047,7 +38084,7 @@
 <b>
 <a>271</a>
 <b>365</b>
-<v>247</v>
+<v>248</v>
 </b>
 <b>
 <a>372</a>
@@ -38062,7 +38099,7 @@
 <b>
 <a>1599</a>
 <b>33053</b>
-<v>189</v>
+<v>190</v>
 </b>
 </bs>
 </hist>
@@ -38072,15 +38109,15 @@
 </relation>
 <relation>
 <name>cil_implements</name>
-<cardinality>106838</cardinality>
+<cardinality>107107</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>106080</v>
+<v>106347</v>
 </e>
 <e>
 <k>decl</k>
-<v>17684</v>
+<v>17728</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38094,12 +38131,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>105321</v>
+<v>105587</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>758</v>
+<v>760</v>
 </b>
 </bs>
 </hist>
@@ -38115,27 +38152,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11510</v>
+<v>11539</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2697</v>
+<v>2704</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>1574</v>
+<v>1578</v>
 </b>
 <b>
 <a>5</a>
 <b>18</b>
-<v>1327</v>
+<v>1330</v>
 </b>
 <b>
 <a>18</a>
 <b>2180</b>
-<v>573</v>
+<v>575</v>
 </b>
 </bs>
 </hist>
@@ -38145,23 +38182,23 @@
 </relation>
 <relation>
 <name>cil_field</name>
-<cardinality>1006301</cardinality>
+<cardinality>1008837</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1006301</v>
+<v>1008837</v>
 </e>
 <e>
 <k>parent</k>
-<v>200712</v>
+<v>201218</v>
 </e>
 <e>
 <k>name</k>
-<v>360088</v>
+<v>360996</v>
 </e>
 <e>
 <k>field_type</k>
-<v>165505</v>
+<v>165922</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -38175,7 +38212,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1006301</v>
+<v>1008837</v>
 </b>
 </bs>
 </hist>
@@ -38191,7 +38228,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1006301</v>
+<v>1008837</v>
 </b>
 </bs>
 </hist>
@@ -38207,7 +38244,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1006301</v>
+<v>1008837</v>
 </b>
 </bs>
 </hist>
@@ -38223,42 +38260,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60489</v>
+<v>60641</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>40943</v>
+<v>41046</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22243</v>
+<v>22299</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15448</v>
+<v>15486</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11685</v>
+<v>11715</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16911</v>
+<v>16953</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17815</v>
+<v>17860</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15059</v>
+<v>15097</v>
 </b>
 <b>
 <a>237</a>
@@ -38279,42 +38316,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>60489</v>
+<v>60641</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>40943</v>
+<v>41046</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>22243</v>
+<v>22299</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>15448</v>
+<v>15486</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>11685</v>
+<v>11715</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>16911</v>
+<v>16953</v>
 </b>
 <b>
 <a>8</a>
 <b>12</b>
-<v>17815</v>
+<v>17860</v>
 </b>
 <b>
 <a>12</a>
 <b>227</b>
-<v>15059</v>
+<v>15097</v>
 </b>
 <b>
 <a>237</a>
@@ -38335,37 +38372,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>70255</v>
+<v>70432</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>59629</v>
+<v>59779</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>20377</v>
+<v>20428</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11437</v>
+<v>11466</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>15652</v>
+<v>15691</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>16021</v>
+<v>16062</v>
 </b>
 <b>
 <a>11</a>
 <b>132</b>
-<v>7340</v>
+<v>7358</v>
 </b>
 </bs>
 </hist>
@@ -38381,22 +38418,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>261289</v>
+<v>261948</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55234</v>
+<v>55374</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30006</v>
+<v>30082</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13557</v>
+<v>13591</v>
 </b>
 </bs>
 </hist>
@@ -38412,22 +38449,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>261289</v>
+<v>261948</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55234</v>
+<v>55374</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>30006</v>
+<v>30082</v>
 </b>
 <b>
 <a>7</a>
 <b>5664</b>
-<v>13557</v>
+<v>13591</v>
 </b>
 </bs>
 </hist>
@@ -38443,17 +38480,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>304746</v>
+<v>305514</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>33982</v>
+<v>34068</v>
 </b>
 <b>
 <a>3</a>
 <b>2790</b>
-<v>21358</v>
+<v>21412</v>
 </b>
 </bs>
 </hist>
@@ -38469,32 +38506,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>82441</v>
+<v>82649</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>43670</v>
+<v>43780</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8939</v>
+<v>8961</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>15224</v>
+<v>15262</v>
 </b>
 <b>
 <a>7</a>
 <b>31</b>
-<v>12512</v>
+<v>12543</v>
 </b>
 <b>
 <a>31</a>
 <b>21103</b>
-<v>2717</v>
+<v>2724</v>
 </b>
 </bs>
 </hist>
@@ -38510,22 +38547,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96489</v>
+<v>96732</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44394</v>
+<v>44506</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>14198</v>
+<v>14234</v>
 </b>
 <b>
 <a>6</a>
 <b>12257</b>
-<v>10421</v>
+<v>10448</v>
 </b>
 </bs>
 </hist>
@@ -38541,27 +38578,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>119554</v>
+<v>119856</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17922</v>
+<v>17967</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>13212</v>
+<v>13245</v>
 </b>
 <b>
 <a>5</a>
 <b>20</b>
-<v>12439</v>
+<v>12470</v>
 </b>
 <b>
 <a>20</a>
 <b>8901</b>
-<v>2376</v>
+<v>2382</v>
 </b>
 </bs>
 </hist>
@@ -38571,15 +38608,15 @@
 </relation>
 <relation>
 <name>cil_parameter</name>
-<cardinality>4537393</cardinality>
+<cardinality>4548828</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4537393</v>
+<v>4548828</v>
 </e>
 <e>
-<k>method</k>
-<v>2215824</v>
+<k>parameterizable</k>
+<v>2221408</v>
 </e>
 <e>
 <k>index</k>
@@ -38587,13 +38624,13 @@
 </e>
 <e>
 <k>param_type</k>
-<v>551390</v>
+<v>552780</v>
 </e>
 </columnsizes>
 <dependencies>
 <dep>
 <src>id</src>
-<trg>method</trg>
+<trg>parameterizable</trg>
 <val>
 <hist>
 <budget>12</budget>
@@ -38601,7 +38638,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4537393</v>
+<v>4548828</v>
 </b>
 </bs>
 </hist>
@@ -38617,7 +38654,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4537393</v>
+<v>4548828</v>
 </b>
 </bs>
 </hist>
@@ -38633,14 +38670,14 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4537393</v>
+<v>4548828</v>
 </b>
 </bs>
 </hist>
 </val>
 </dep>
 <dep>
-<src>method</src>
+<src>parameterizable</src>
 <trg>id</trg>
 <val>
 <hist>
@@ -38649,34 +38686,34 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>898738</v>
+<v>901003</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>785814</v>
+<v>787794</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>323966</v>
+<v>324783</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>174570</v>
+<v>175010</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32733</v>
+<v>32816</v>
 </b>
 </bs>
 </hist>
 </val>
 </dep>
 <dep>
-<src>method</src>
+<src>parameterizable</src>
 <trg>index</trg>
 <val>
 <hist>
@@ -38685,34 +38722,34 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>898738</v>
+<v>901003</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>785814</v>
+<v>787794</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>323966</v>
+<v>324783</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>174570</v>
+<v>175010</v>
 </b>
 <b>
 <a>7</a>
 <b>42</b>
-<v>32733</v>
+<v>32816</v>
 </b>
 </bs>
 </hist>
 </val>
 </dep>
 <dep>
-<src>method</src>
+<src>parameterizable</src>
 <trg>param_type</trg>
 <val>
 <hist>
@@ -38721,22 +38758,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>946672</v>
+<v>949058</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>796299</v>
+<v>798306</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>312354</v>
+<v>313141</v>
 </b>
 <b>
 <a>4</a>
 <b>23</b>
-<v>160498</v>
+<v>160902</v>
 </b>
 </bs>
 </hist>
@@ -38820,7 +38857,7 @@
 </dep>
 <dep>
 <src>index</src>
-<trg>method</trg>
+<trg>parameterizable</trg>
 <val>
 <hist>
 <budget>12</budget>
@@ -38985,42 +39022,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>185021</v>
+<v>185488</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>136781</v>
+<v>137126</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>44924</v>
+<v>45038</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>38372</v>
+<v>38468</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>43763</v>
+<v>43873</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42674</v>
+<v>42781</v>
 </b>
 <b>
 <a>11</a>
 <b>27</b>
-<v>41794</v>
+<v>41899</v>
 </b>
 <b>
 <a>27</a>
 <b>58010</b>
-<v>18058</v>
+<v>18103</v>
 </b>
 </bs>
 </hist>
@@ -39028,7 +39065,7 @@
 </dep>
 <dep>
 <src>param_type</src>
-<trg>method</trg>
+<trg>parameterizable</trg>
 <val>
 <hist>
 <budget>12</budget>
@@ -39036,42 +39073,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>188220</v>
+<v>188694</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>135484</v>
+<v>135825</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>45337</v>
+<v>45452</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>37157</v>
+<v>37250</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>44210</v>
+<v>44321</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>42732</v>
+<v>42840</v>
 </b>
 <b>
 <a>11</a>
 <b>28</b>
-<v>41633</v>
+<v>41738</v>
 </b>
 <b>
 <a>28</a>
 <b>46068</b>
-<v>16614</v>
+<v>16656</v>
 </b>
 </bs>
 </hist>
@@ -39087,22 +39124,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>384791</v>
+<v>385761</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>109604</v>
+<v>109880</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>44375</v>
+<v>44487</v>
 </b>
 <b>
 <a>4</a>
 <b>36</b>
-<v>12618</v>
+<v>12650</v>
 </b>
 </bs>
 </hist>
@@ -39112,37 +39149,37 @@
 </relation>
 <relation>
 <name>cil_parameter_in</name>
-<cardinality>32286</cardinality>
+<cardinality>32367</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>32286</v>
+<v>32367</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_parameter_out</name>
-<cardinality>45930</cardinality>
+<cardinality>46046</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>45930</v>
+<v>46046</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_setter</name>
-<cardinality>106542</cardinality>
+<cardinality>106810</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>106542</v>
+<v>106810</v>
 </e>
 <e>
 <k>method</k>
-<v>106542</v>
+<v>106810</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39156,7 +39193,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106542</v>
+<v>106810</v>
 </b>
 </bs>
 </hist>
@@ -39172,7 +39209,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>106542</v>
+<v>106810</v>
 </b>
 </bs>
 </hist>
@@ -39182,11 +39219,11 @@
 </relation>
 <relation>
 <name>cil_custom_modifiers</name>
-<cardinality>4097</cardinality>
+<cardinality>4108</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>4097</v>
+<v>4108</v>
 </e>
 <e>
 <k>modifier</k>
@@ -39208,7 +39245,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4097</v>
+<v>4108</v>
 </b>
 </bs>
 </hist>
@@ -39224,7 +39261,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4097</v>
+<v>4108</v>
 </b>
 </bs>
 </hist>
@@ -39347,16 +39384,64 @@
 </dependencies>
 </relation>
 <relation>
+<name>cil_type_annotation</name>
+<cardinality>196160</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>196160</v>
+</e>
+<e>
+<k>annotation</k>
+<v>4</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>annotation</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>196160</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>annotation</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>40253</a>
+<b>40254</b>
+<v>4</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
 <name>cil_getter</name>
-<cardinality>378594</cardinality>
+<cardinality>379548</cardinality>
 <columnsizes>
 <e>
 <k>prop</k>
-<v>378594</v>
+<v>379548</v>
 </e>
 <e>
 <k>method</k>
-<v>378594</v>
+<v>379548</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39370,7 +39455,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>378594</v>
+<v>379548</v>
 </b>
 </bs>
 </hist>
@@ -39386,7 +39471,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>378594</v>
+<v>379548</v>
 </b>
 </bs>
 </hist>
@@ -39396,15 +39481,15 @@
 </relation>
 <relation>
 <name>cil_adder</name>
-<cardinality>20829</cardinality>
+<cardinality>20881</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20829</v>
+<v>20881</v>
 </e>
 <e>
 <k>method</k>
-<v>20829</v>
+<v>20881</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39418,7 +39503,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20829</v>
+<v>20881</v>
 </b>
 </bs>
 </hist>
@@ -39434,7 +39519,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20829</v>
+<v>20881</v>
 </b>
 </bs>
 </hist>
@@ -39444,15 +39529,15 @@
 </relation>
 <relation>
 <name>cil_remover</name>
-<cardinality>20829</cardinality>
+<cardinality>20881</cardinality>
 <columnsizes>
 <e>
 <k>event</k>
-<v>20829</v>
+<v>20881</v>
 </e>
 <e>
 <k>method</k>
-<v>20829</v>
+<v>20881</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39466,7 +39551,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20829</v>
+<v>20881</v>
 </b>
 </bs>
 </hist>
@@ -39482,7 +39567,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20829</v>
+<v>20881</v>
 </b>
 </bs>
 </hist>
@@ -39540,23 +39625,23 @@
 </relation>
 <relation>
 <name>cil_property</name>
-<cardinality>379138</cardinality>
+<cardinality>380094</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>379138</v>
+<v>380094</v>
 </e>
 <e>
 <k>parent</k>
-<v>93461</v>
+<v>93696</v>
 </e>
 <e>
 <k>name</k>
-<v>106017</v>
+<v>106284</v>
 </e>
 <e>
 <k>property_type</k>
-<v>49722</v>
+<v>49847</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39570,7 +39655,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>379138</v>
+<v>380094</v>
 </b>
 </bs>
 </hist>
@@ -39586,7 +39671,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>379138</v>
+<v>380094</v>
 </b>
 </bs>
 </hist>
@@ -39602,7 +39687,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>379138</v>
+<v>380094</v>
 </b>
 </bs>
 </hist>
@@ -39618,42 +39703,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>28805</v>
+<v>28878</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>22229</v>
+<v>22285</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11389</v>
+<v>11417</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8433</v>
+<v>8454</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5726</v>
+<v>5740</v>
 </b>
 <b>
 <a>6</a>
 <b>9</b>
-<v>8642</v>
+<v>8664</v>
 </b>
 <b>
 <a>9</a>
 <b>25</b>
-<v>7082</v>
+<v>7100</v>
 </b>
 <b>
 <a>25</a>
 <b>1883</b>
-<v>1152</v>
+<v>1154</v>
 </b>
 </bs>
 </hist>
@@ -39669,42 +39754,42 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33540</v>
+<v>33625</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>17752</v>
+<v>17796</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>11287</v>
+<v>11315</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8443</v>
+<v>8464</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>5706</v>
+<v>5721</v>
 </b>
 <b>
 <a>6</a>
 <b>8</b>
-<v>6610</v>
+<v>6627</v>
 </b>
 <b>
 <a>8</a>
 <b>15</b>
-<v>7199</v>
+<v>7217</v>
 </b>
 <b>
 <a>15</a>
 <b>1883</b>
-<v>2921</v>
+<v>2928</v>
 </b>
 </bs>
 </hist>
@@ -39720,32 +39805,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>34984</v>
+<v>35072</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>25704</v>
+<v>25769</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13445</v>
+<v>13479</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>8083</v>
+<v>8104</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>7738</v>
+<v>7758</v>
 </b>
 <b>
 <a>8</a>
 <b>50</b>
-<v>3504</v>
+<v>3513</v>
 </b>
 </bs>
 </hist>
@@ -39761,27 +39846,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62501</v>
+<v>62659</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21388</v>
+<v>21442</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6465</v>
+<v>6481</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8739</v>
+<v>8761</v>
 </b>
 <b>
 <a>8</a>
 <b>2134</b>
-<v>6921</v>
+<v>6939</v>
 </b>
 </bs>
 </hist>
@@ -39797,27 +39882,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62501</v>
+<v>62659</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21461</v>
+<v>21515</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>6440</v>
+<v>6456</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>8754</v>
+<v>8776</v>
 </b>
 <b>
 <a>8</a>
 <b>1400</b>
-<v>6858</v>
+<v>6876</v>
 </b>
 </bs>
 </hist>
@@ -39833,17 +39918,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>89222</v>
+<v>89447</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10946</v>
+<v>10974</v>
 </b>
 <b>
 <a>3</a>
 <b>568</b>
-<v>5847</v>
+<v>5862</v>
 </b>
 </bs>
 </hist>
@@ -39859,27 +39944,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>31353</v>
+<v>31432</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7500</v>
+<v>7519</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3174</v>
+<v>3182</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>4355</v>
+<v>4366</v>
 </b>
 <b>
 <a>8</a>
 <b>15452</b>
-<v>3339</v>
+<v>3347</v>
 </b>
 </bs>
 </hist>
@@ -39895,27 +39980,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>33137</v>
+<v>33220</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>7014</v>
+<v>7032</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>3038</v>
+<v>3045</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>3854</v>
+<v>3864</v>
 </b>
 <b>
 <a>8</a>
 <b>5858</b>
-<v>2678</v>
+<v>2685</v>
 </b>
 </bs>
 </hist>
@@ -39931,22 +40016,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>39845</v>
+<v>39945</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5298</v>
+<v>5311</v>
 </b>
 <b>
 <a>3</a>
 <b>12</b>
-<v>3791</v>
+<v>3801</v>
 </b>
 <b>
 <a>12</a>
 <b>6253</b>
-<v>787</v>
+<v>789</v>
 </b>
 </bs>
 </hist>
@@ -39956,23 +40041,23 @@
 </relation>
 <relation>
 <name>cil_event</name>
-<cardinality>20799</cardinality>
+<cardinality>20852</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>20799</v>
+<v>20852</v>
 </e>
 <e>
 <k>parent</k>
-<v>6445</v>
+<v>6461</v>
 </e>
 <e>
 <k>name</k>
-<v>13037</v>
+<v>13069</v>
 </e>
 <e>
 <k>event_type</k>
-<v>6781</v>
+<v>6798</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -39986,7 +40071,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20799</v>
+<v>20852</v>
 </b>
 </bs>
 </hist>
@@ -40002,7 +40087,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20799</v>
+<v>20852</v>
 </b>
 </bs>
 </hist>
@@ -40018,7 +40103,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>20799</v>
+<v>20852</v>
 </b>
 </bs>
 </hist>
@@ -40034,17 +40119,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5731</v>
+<v>5745</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>490</v>
+<v>492</v>
 </b>
 <b>
 <a>7</a>
 <b>465</b>
-<v>223</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -40060,17 +40145,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5731</v>
+<v>5745</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>490</v>
+<v>492</v>
 </b>
 <b>
 <a>7</a>
 <b>465</b>
-<v>223</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -40086,12 +40171,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5906</v>
+<v>5920</v>
 </b>
 <b>
 <a>2</a>
 <b>20</b>
-<v>486</v>
+<v>487</v>
 </b>
 <b>
 <a>30</a>
@@ -40112,17 +40197,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11632</v>
+<v>11661</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>962</v>
+<v>964</v>
 </b>
 <b>
 <a>4</a>
 <b>566</b>
-<v>442</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -40138,17 +40223,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>11632</v>
+<v>11661</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>962</v>
+<v>964</v>
 </b>
 <b>
 <a>4</a>
 <b>566</b>
-<v>442</v>
+<v>443</v>
 </b>
 </bs>
 </hist>
@@ -40164,12 +40249,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12444</v>
+<v>12475</v>
 </b>
 <b>
 <a>2</a>
 <b>566</b>
-<v>593</v>
+<v>594</v>
 </b>
 </bs>
 </hist>
@@ -40185,27 +40270,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>943</v>
+<v>945</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4506</v>
+<v>4517</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>583</v>
+<v>584</v>
 </b>
 <b>
 <a>4</a>
 <b>8</b>
-<v>573</v>
+<v>575</v>
 </b>
 <b>
 <a>8</a>
 <b>318</b>
-<v>174</v>
+<v>175</v>
 </b>
 </bs>
 </hist>
@@ -40221,17 +40306,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1419</v>
+<v>1422</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>5074</v>
+<v>5087</v>
 </b>
 <b>
 <a>3</a>
 <b>32</b>
-<v>286</v>
+<v>287</v>
 </b>
 </bs>
 </hist>
@@ -40247,27 +40332,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1307</v>
+<v>1310</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>4335</v>
+<v>4346</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>495</v>
+<v>497</v>
 </b>
 <b>
 <a>4</a>
 <b>10</b>
-<v>529</v>
+<v>531</v>
 </b>
 <b>
 <a>10</a>
 <b>243</b>
-<v>111</v>
+<v>112</v>
 </b>
 </bs>
 </hist>
@@ -40277,23 +40362,23 @@
 </relation>
 <relation>
 <name>cil_local_variable</name>
-<cardinality>1148313</cardinality>
+<cardinality>1151207</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1148313</v>
+<v>1151207</v>
 </e>
 <e>
 <k>impl</k>
-<v>347916</v>
+<v>348793</v>
 </e>
 <e>
 <k>index</k>
-<v>690</v>
+<v>691</v>
 </e>
 <e>
 <k>var_type</k>
-<v>153926</v>
+<v>154294</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40307,7 +40392,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1148313</v>
+<v>1151207</v>
 </b>
 </bs>
 </hist>
@@ -40323,7 +40408,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1148313</v>
+<v>1151207</v>
 </b>
 </bs>
 </hist>
@@ -40339,7 +40424,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1148313</v>
+<v>1151207</v>
 </b>
 </bs>
 </hist>
@@ -40355,37 +40440,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>139610</v>
+<v>139962</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>61904</v>
+<v>62060</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49216</v>
+<v>49341</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23424</v>
+<v>23483</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31809</v>
+<v>31890</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28796</v>
+<v>28868</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13153</v>
+<v>13186</v>
 </b>
 </bs>
 </hist>
@@ -40401,37 +40486,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>139610</v>
+<v>139962</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>61904</v>
+<v>62060</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>49216</v>
+<v>49341</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>23424</v>
+<v>23483</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>31809</v>
+<v>31890</v>
 </b>
 <b>
 <a>7</a>
 <b>12</b>
-<v>28796</v>
+<v>28868</v>
 </b>
 <b>
 <a>12</a>
 <b>143</b>
-<v>13153</v>
+<v>13186</v>
 </b>
 </bs>
 </hist>
@@ -40447,32 +40532,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>168207</v>
+<v>168427</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>69871</v>
+<v>70149</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>37754</v>
+<v>37952</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>20561</v>
+<v>20652</v>
 </b>
 <b>
 <a>5</a>
 <b>7</b>
-<v>27634</v>
+<v>27679</v>
 </b>
 <b>
 <a>7</a>
 <b>47</b>
-<v>23886</v>
+<v>23932</v>
 </b>
 </bs>
 </hist>
@@ -40630,7 +40715,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>72</v>
+<v>73</v>
 </b>
 <b>
 <a>2</a>
@@ -40679,17 +40764,17 @@
 </b>
 <b>
 <a>143</a>
-<b>541</b>
+<b>539</b>
 <v>53</v>
 </b>
 <b>
-<a>600</a>
-<b>4921</b>
+<a>599</a>
+<b>4919</b>
 <v>53</v>
 </b>
 <b>
-<a>7228</a>
-<b>19499</b>
+<a>7226</a>
+<b>19498</b>
 <v>14</v>
 </b>
 </bs>
@@ -40706,37 +40791,37 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>81114</v>
+<v>81328</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>27201</v>
+<v>27250</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8351</v>
+<v>8377</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11802</v>
+<v>11827</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>12759</v>
+<v>12792</v>
 </b>
 <b>
 <a>8</a>
 <b>76</b>
-<v>11554</v>
+<v>11578</v>
 </b>
 <b>
 <a>76</a>
-<b>35710</b>
-<v>1142</v>
+<b>35712</b>
+<v>1140</v>
 </b>
 </bs>
 </hist>
@@ -40752,32 +40837,32 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85139</v>
+<v>85358</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30935</v>
+<v>30993</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>8365</v>
+<v>8386</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>11671</v>
+<v>11705</v>
 </b>
 <b>
 <a>5</a>
 <b>14</b>
-<v>11996</v>
+<v>12027</v>
 </b>
 <b>
 <a>14</a>
 <b>21451</b>
-<v>5818</v>
+<v>5823</v>
 </b>
 </bs>
 </hist>
@@ -40793,27 +40878,80 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>96416</v>
+<v>96664</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>28626</v>
+<v>28688</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>13737</v>
+<v>13776</v>
 </b>
 <b>
 <a>4</a>
 <b>9</b>
-<v>11850</v>
+<v>11866</v>
 </b>
 <b>
 <a>9</a>
 <b>122</b>
-<v>3295</v>
+<v>3299</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+</dependencies>
+</relation>
+<relation>
+<name>cil_function_pointer_calling_conventions</name>
+<cardinality>9</cardinality>
+<columnsizes>
+<e>
+<k>id</k>
+<v>9</v>
+</e>
+<e>
+<k>kind</k>
+<v>2</v>
+</e>
+</columnsizes>
+<dependencies>
+<dep>
+<src>id</src>
+<trg>kind</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>9</v>
+</b>
+</bs>
+</hist>
+</val>
+</dep>
+<dep>
+<src>kind</src>
+<trg>id</trg>
+<val>
+<hist>
+<budget>12</budget>
+<bs>
+<b>
+<a>1</a>
+<b>2</b>
+<v>1</v>
+</b>
+<b>
+<a>8</a>
+<b>9</b>
+<v>1</v>
 </b>
 </bs>
 </hist>
@@ -40823,15 +40961,15 @@
 </relation>
 <relation>
 <name>cil_handler</name>
-<cardinality>101248</cardinality>
+<cardinality>101503</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>101248</v>
+<v>101503</v>
 </e>
 <e>
 <k>impl</k>
-<v>71280</v>
+<v>71460</v>
 </e>
 <e>
 <k>index</k>
@@ -40843,15 +40981,15 @@
 </e>
 <e>
 <k>try_start</k>
-<v>97418</v>
+<v>97663</v>
 </e>
 <e>
 <k>try_end</k>
-<v>99629</v>
+<v>99880</v>
 </e>
 <e>
 <k>handler_start</k>
-<v>101248</v>
+<v>101503</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -40865,7 +41003,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -40881,7 +41019,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -40897,7 +41035,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -40913,7 +41051,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -40929,7 +41067,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -40945,7 +41083,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -40961,22 +41099,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53669</v>
+<v>53804</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11131</v>
+<v>11159</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5415</v>
+<v>5428</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>1064</v>
+<v>1067</v>
 </b>
 </bs>
 </hist>
@@ -40992,22 +41130,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53669</v>
+<v>53804</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11131</v>
+<v>11159</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5415</v>
+<v>5428</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>1064</v>
+<v>1067</v>
 </b>
 </bs>
 </hist>
@@ -41023,17 +41161,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>61738</v>
+<v>61894</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>9318</v>
+<v>9341</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>223</v>
+<v>224</v>
 </b>
 </bs>
 </hist>
@@ -41049,17 +41187,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54695</v>
+<v>54833</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>10825</v>
+<v>10852</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>5517</v>
+<v>5531</v>
 </b>
 <b>
 <a>7</a>
@@ -41080,22 +41218,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>54218</v>
+<v>54355</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11044</v>
+<v>11071</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>5512</v>
+<v>5526</v>
 </b>
 <b>
 <a>6</a>
 <b>16</b>
-<v>505</v>
+<v>506</v>
 </b>
 </bs>
 </hist>
@@ -41111,22 +41249,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>53669</v>
+<v>53804</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>11131</v>
+<v>11159</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>5415</v>
+<v>5428</v>
 </b>
 <b>
 <a>5</a>
 <b>17</b>
-<v>1064</v>
+<v>1067</v>
 </b>
 </bs>
 </hist>
@@ -41789,12 +41927,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94127</v>
+<v>94364</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3290</v>
+<v>3299</v>
 </b>
 </bs>
 </hist>
@@ -41810,7 +41948,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>97418</v>
+<v>97663</v>
 </b>
 </bs>
 </hist>
@@ -41826,12 +41964,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94127</v>
+<v>94364</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3290</v>
+<v>3299</v>
 </b>
 </bs>
 </hist>
@@ -41847,12 +41985,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95162</v>
+<v>95402</v>
 </b>
 <b>
 <a>2</a>
 <b>4</b>
-<v>2255</v>
+<v>2261</v>
 </b>
 </bs>
 </hist>
@@ -41868,12 +42006,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>95206</v>
+<v>95446</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2211</v>
+<v>2217</v>
 </b>
 </bs>
 </hist>
@@ -41889,12 +42027,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>94127</v>
+<v>94364</v>
 </b>
 <b>
 <a>2</a>
 <b>8</b>
-<v>3290</v>
+<v>3299</v>
 </b>
 </bs>
 </hist>
@@ -41910,12 +42048,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98404</v>
+<v>98652</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>1224</v>
+<v>1228</v>
 </b>
 </bs>
 </hist>
@@ -41931,7 +42069,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99629</v>
+<v>99880</v>
 </b>
 </bs>
 </hist>
@@ -41947,12 +42085,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98404</v>
+<v>98652</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>1224</v>
+<v>1228</v>
 </b>
 </bs>
 </hist>
@@ -41968,12 +42106,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99454</v>
+<v>99705</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>174</v>
+<v>175</v>
 </b>
 </bs>
 </hist>
@@ -41989,7 +42127,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>99629</v>
+<v>99880</v>
 </b>
 </bs>
 </hist>
@@ -42005,12 +42143,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>98404</v>
+<v>98652</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>1224</v>
+<v>1228</v>
 </b>
 </bs>
 </hist>
@@ -42026,7 +42164,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -42042,7 +42180,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -42058,7 +42196,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -42074,7 +42212,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -42090,7 +42228,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -42106,7 +42244,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>101248</v>
+<v>101503</v>
 </b>
 </bs>
 </hist>
@@ -42116,15 +42254,15 @@
 </relation>
 <relation>
 <name>cil_handler_filter</name>
-<cardinality>806</cardinality>
+<cardinality>808</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>806</v>
+<v>808</v>
 </e>
 <e>
 <k>filter_start</k>
-<v>806</v>
+<v>808</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42138,7 +42276,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806</v>
+<v>808</v>
 </b>
 </bs>
 </hist>
@@ -42154,7 +42292,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>806</v>
+<v>808</v>
 </b>
 </bs>
 </hist>
@@ -42164,15 +42302,15 @@
 </relation>
 <relation>
 <name>cil_handler_type</name>
-<cardinality>43719</cardinality>
+<cardinality>43829</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>43719</v>
+<v>43829</v>
 </e>
 <e>
 <k>catch_type</k>
-<v>1258</v>
+<v>1262</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42186,7 +42324,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>43719</v>
+<v>43829</v>
 </b>
 </bs>
 </hist>
@@ -42202,17 +42340,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>437</v>
+<v>438</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>150</v>
+<v>151</v>
 </b>
 <b>
 <a>4</a>
@@ -42247,11 +42385,11 @@
 </relation>
 <relation>
 <name>cil_method_stack_size</name>
-<cardinality>1722264</cardinality>
+<cardinality>1726604</cardinality>
 <columnsizes>
 <e>
 <k>method</k>
-<v>1722264</v>
+<v>1726604</v>
 </e>
 <e>
 <k>size</k>
@@ -42269,7 +42407,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1722264</v>
+<v>1726604</v>
 </b>
 </bs>
 </hist>
@@ -42350,121 +42488,121 @@
 </relation>
 <relation>
 <name>cil_public</name>
-<cardinality>1906085</cardinality>
+<cardinality>1910889</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1906085</v>
+<v>1910889</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_private</name>
-<cardinality>926421</cardinality>
+<cardinality>928756</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>926421</v>
+<v>928756</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_protected</name>
-<cardinality>1813678</cardinality>
+<cardinality>1818249</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1813678</v>
+<v>1818249</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_internal</name>
-<cardinality>41580</cardinality>
+<cardinality>41685</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>41580</v>
+<v>41685</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_static</name>
-<cardinality>792901</cardinality>
+<cardinality>794899</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>792901</v>
+<v>794899</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_sealed</name>
-<cardinality>355655</cardinality>
+<cardinality>356551</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>355655</v>
+<v>356551</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_virtual</name>
-<cardinality>675889</cardinality>
+<cardinality>677592</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>675889</v>
+<v>677592</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_abstract</name>
-<cardinality>164766</cardinality>
+<cardinality>165181</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>164766</v>
+<v>165181</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_class</name>
-<cardinality>237957</cardinality>
+<cardinality>238557</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>237957</v>
+<v>238557</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_interface</name>
-<cardinality>16507</cardinality>
+<cardinality>16549</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>16507</v>
+<v>16549</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_security</name>
-<cardinality>1907</cardinality>
+<cardinality>1908</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>1907</v>
+<v>1908</v>
 </e>
 </columnsizes>
 <dependencies/>
@@ -42482,37 +42620,37 @@
 </relation>
 <relation>
 <name>cil_specialname</name>
-<cardinality>808942</cardinality>
+<cardinality>810981</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>808942</v>
+<v>810981</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_newslot</name>
-<cardinality>421205</cardinality>
+<cardinality>422266</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>421205</v>
+<v>422266</v>
 </e>
 </columnsizes>
 <dependencies/>
 </relation>
 <relation>
 <name>cil_base_class</name>
-<cardinality>234982</cardinality>
+<cardinality>235574</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>234982</v>
+<v>235574</v>
 </e>
 <e>
 <k>base</k>
-<v>21354</v>
+<v>21407</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42526,7 +42664,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>234982</v>
+<v>235574</v>
 </b>
 </bs>
 </hist>
@@ -42542,27 +42680,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12283</v>
+<v>12314</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3849</v>
+<v>3859</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>1608</v>
+<v>1613</v>
 </b>
 <b>
 <a>4</a>
 <b>7</b>
-<v>1886</v>
+<v>1890</v>
 </b>
 <b>
 <a>7</a>
 <b>84</b>
-<v>1604</v>
+<v>1608</v>
 </b>
 <b>
 <a>86</a>
@@ -42577,15 +42715,15 @@
 </relation>
 <relation>
 <name>cil_base_interface</name>
-<cardinality>124887</cardinality>
+<cardinality>125201</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>68422</v>
+<v>68595</v>
 </e>
 <e>
 <k>base</k>
-<v>31114</v>
+<v>31193</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42599,27 +42737,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>47573</v>
+<v>47693</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>8093</v>
+<v>8113</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>6246</v>
+<v>6262</v>
 </b>
 <b>
 <a>5</a>
 <b>9</b>
-<v>5361</v>
+<v>5375</v>
 </b>
 <b>
 <a>9</a>
 <b>25</b>
-<v>1147</v>
+<v>1150</v>
 </b>
 </bs>
 </hist>
@@ -42635,27 +42773,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>22418</v>
+<v>22475</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>3422</v>
+<v>3430</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>2513</v>
+<v>2519</v>
 </b>
 <b>
 <a>5</a>
 <b>30</b>
-<v>2338</v>
+<v>2344</v>
 </b>
 <b>
 <a>30</a>
 <b>2180</b>
-<v>422</v>
+<v>423</v>
 </b>
 </bs>
 </hist>
@@ -42665,11 +42803,11 @@
 </relation>
 <relation>
 <name>cil_enum_underlying_type</name>
-<cardinality>14033</cardinality>
+<cardinality>14068</cardinality>
 <columnsizes>
 <e>
 <k>id</k>
-<v>14033</v>
+<v>14068</v>
 </e>
 <e>
 <k>underlying</k>
@@ -42687,7 +42825,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>14033</v>
+<v>14068</v>
 </b>
 </bs>
 </hist>
@@ -42748,11 +42886,11 @@
 </relation>
 <relation>
 <name>cil_type_parameter</name>
-<cardinality>184385</cardinality>
+<cardinality>184849</cardinality>
 <columnsizes>
 <e>
 <k>unbound</k>
-<v>103649</v>
+<v>103910</v>
 </e>
 <e>
 <k>index</k>
@@ -42760,7 +42898,7 @@
 </e>
 <e>
 <k>param</k>
-<v>184385</v>
+<v>184849</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -42774,22 +42912,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>74795</v>
+<v>74983</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18952</v>
+<v>19000</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8137</v>
+<v>8157</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>1764</v>
+<v>1768</v>
 </b>
 </bs>
 </hist>
@@ -42805,22 +42943,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>74795</v>
+<v>74983</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>18952</v>
+<v>19000</v>
 </b>
 <b>
 <a>3</a>
 <b>13</b>
-<v>8137</v>
+<v>8157</v>
 </b>
 <b>
 <a>13</a>
 <b>22</b>
-<v>1764</v>
+<v>1768</v>
 </b>
 </bs>
 </hist>
@@ -43068,7 +43206,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>184385</v>
+<v>184849</v>
 </b>
 </bs>
 </hist>
@@ -43084,7 +43222,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>184385</v>
+<v>184849</v>
 </b>
 </bs>
 </hist>
@@ -43094,11 +43232,11 @@
 </relation>
 <relation>
 <name>cil_type_argument</name>
-<cardinality>735508</cardinality>
+<cardinality>737362</cardinality>
 <columnsizes>
 <e>
 <k>bound</k>
-<v>480304</v>
+<v>481514</v>
 </e>
 <e>
 <k>index</k>
@@ -43106,7 +43244,7 @@
 </e>
 <e>
 <k>t</k>
-<v>251655</v>
+<v>252289</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43120,17 +43258,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>335453</v>
+<v>336298</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>117104</v>
+<v>117399</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>27746</v>
+<v>27816</v>
 </b>
 </bs>
 </hist>
@@ -43146,17 +43284,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>340348</v>
+<v>341206</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>114995</v>
+<v>115285</v>
 </b>
 <b>
 <a>3</a>
 <b>22</b>
-<v>24960</v>
+<v>25023</v>
 </b>
 </bs>
 </hist>
@@ -43384,27 +43522,27 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>100101</v>
+<v>100353</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>72593</v>
+<v>72776</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>42397</v>
+<v>42503</v>
 </b>
 <b>
 <a>4</a>
 <b>6</b>
-<v>20061</v>
+<v>20111</v>
 </b>
 <b>
 <a>6</a>
 <b>4208</b>
-<v>16502</v>
+<v>16544</v>
 </b>
 </bs>
 </hist>
@@ -43420,17 +43558,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>190393</v>
+<v>190873</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>55366</v>
+<v>55505</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>5896</v>
+<v>5911</v>
 </b>
 </bs>
 </hist>
@@ -43531,19 +43669,19 @@
 </relation>
 <relation>
 <name>cil_attribute</name>
-<cardinality>327607</cardinality>
+<cardinality>328433</cardinality>
 <columnsizes>
 <e>
 <k>attributeid</k>
-<v>327607</v>
+<v>328433</v>
 </e>
 <e>
 <k>element</k>
-<v>248073</v>
+<v>248698</v>
 </e>
 <e>
 <k>constructor</k>
-<v>3368</v>
+<v>3377</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43557,7 +43695,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>327607</v>
+<v>328433</v>
 </b>
 </bs>
 </hist>
@@ -43573,7 +43711,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>327607</v>
+<v>328433</v>
 </b>
 </bs>
 </hist>
@@ -43589,17 +43727,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>196931</v>
+<v>197427</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>36617</v>
+<v>36709</v>
 </b>
 <b>
 <a>3</a>
 <b>92</b>
-<v>14524</v>
+<v>14561</v>
 </b>
 </bs>
 </hist>
@@ -43615,17 +43753,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>212753</v>
+<v>213289</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>30930</v>
+<v>31008</v>
 </b>
 <b>
 <a>3</a>
 <b>7</b>
-<v>4389</v>
+<v>4400</v>
 </b>
 </bs>
 </hist>
@@ -43641,57 +43779,57 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>554</v>
+<v>555</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>398</v>
+<v>399</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>286</v>
+<v>287</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>315</v>
+<v>316</v>
 </b>
 <b>
 <a>5</a>
 <b>8</b>
-<v>306</v>
+<v>307</v>
 </b>
 <b>
 <a>8</a>
 <b>11</b>
-<v>262</v>
+<v>263</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>19</a>
 <b>33</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>33</a>
 <b>64</b>
-<v>252</v>
+<v>253</v>
 </b>
 <b>
 <a>64</a>
 <b>179</b>
-<v>252</v>
+<v>253</v>
 </b>
 <b>
 <a>187</a>
 <b>15289</b>
-<v>213</v>
+<v>214</v>
 </b>
 </bs>
 </hist>
@@ -43707,7 +43845,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>597</v>
+<v>599</v>
 </b>
 <b>
 <a>2</a>
@@ -43717,12 +43855,12 @@
 <b>
 <a>3</a>
 <b>4</b>
-<v>281</v>
+<v>282</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>315</v>
+<v>316</v>
 </b>
 <b>
 <a>5</a>
@@ -43732,27 +43870,27 @@
 <b>
 <a>7</a>
 <b>10</b>
-<v>281</v>
+<v>282</v>
 </b>
 <b>
 <a>10</a>
 <b>17</b>
-<v>252</v>
+<v>253</v>
 </b>
 <b>
 <a>17</a>
 <b>31</b>
-<v>262</v>
+<v>263</v>
 </b>
 <b>
 <a>31</a>
 <b>50</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>50</a>
 <b>151</b>
-<v>252</v>
+<v>253</v>
 </b>
 <b>
 <a>152</a>
@@ -43767,11 +43905,11 @@
 </relation>
 <relation>
 <name>cil_attribute_named_argument</name>
-<cardinality>5546</cardinality>
+<cardinality>5560</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>4613</v>
+<v>4624</v>
 </e>
 <e>
 <k>param</k>
@@ -43779,7 +43917,7 @@
 </e>
 <e>
 <k>value</k>
-<v>1093</v>
+<v>1096</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -43793,17 +43931,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>3752</v>
+<v>3762</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>787</v>
+<v>789</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>72</v>
+<v>73</v>
 </b>
 </bs>
 </hist>
@@ -43819,12 +43957,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>4044</v>
+<v>4054</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>554</v>
+<v>555</v>
 </b>
 <b>
 <a>3</a>
@@ -43967,7 +44105,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>719</v>
+<v>721</v>
 </b>
 <b>
 <a>2</a>
@@ -43998,7 +44136,7 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>1064</v>
+<v>1067</v>
 </b>
 <b>
 <a>2</a>
@@ -44013,11 +44151,11 @@
 </relation>
 <relation>
 <name>cil_attribute_positional_argument</name>
-<cardinality>95954</cardinality>
+<cardinality>96196</cardinality>
 <columnsizes>
 <e>
 <k>attribute_id</k>
-<v>89844</v>
+<v>90071</v>
 </e>
 <e>
 <k>index</k>
@@ -44025,7 +44163,7 @@
 </e>
 <e>
 <k>value</k>
-<v>17076</v>
+<v>17119</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44039,12 +44177,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85173</v>
+<v>85388</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4671</v>
+<v>4683</v>
 </b>
 </bs>
 </hist>
@@ -44060,12 +44198,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>85183</v>
+<v>85397</v>
 </b>
 <b>
 <a>2</a>
 <b>7</b>
-<v>4661</v>
+<v>4673</v>
 </b>
 </bs>
 </hist>
@@ -44158,22 +44296,22 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>12312</v>
+<v>12343</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>2454</v>
+<v>2460</v>
 </b>
 <b>
 <a>3</a>
 <b>6</b>
-<v>1424</v>
+<v>1427</v>
 </b>
 <b>
 <a>6</a>
 <b>5555</b>
-<v>884</v>
+<v>886</v>
 </b>
 </bs>
 </hist>
@@ -44189,12 +44327,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>16750</v>
+<v>16793</v>
 </b>
 <b>
 <a>2</a>
 <b>6</b>
-<v>325</v>
+<v>326</v>
 </b>
 </bs>
 </hist>
@@ -44204,19 +44342,19 @@
 </relation>
 <relation>
 <name>metadata_handle</name>
-<cardinality>6162511</cardinality>
+<cardinality>6178043</cardinality>
 <columnsizes>
 <e>
 <k>entity</k>
-<v>5673695</v>
+<v>5687995</v>
 </e>
 <e>
 <k>location</k>
-<v>3407</v>
+<v>3416</v>
 </e>
 <e>
 <k>handle</k>
-<v>273476</v>
+<v>274165</v>
 </e>
 </columnsizes>
 <dependencies>
@@ -44230,17 +44368,17 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5203021</v>
+<v>5216134</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>461677</v>
+<v>462840</v>
 </b>
 <b>
 <a>3</a>
 <b>638</b>
-<v>8997</v>
+<v>9020</v>
 </b>
 </bs>
 </hist>
@@ -44256,12 +44394,12 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>5434421</v>
+<v>5448117</v>
 </b>
 <b>
 <a>2</a>
 <b>59</b>
-<v>239274</v>
+<v>239877</v>
 </b>
 </bs>
 </hist>
@@ -44277,67 +44415,67 @@
 <b>
 <a>1</a>
 <b>3</b>
-<v>286</v>
+<v>287</v>
 </b>
 <b>
 <a>3</a>
 <b>36</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>36</a>
 <b>79</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>79</a>
 <b>130</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>130</a>
 <b>200</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>200</a>
 <b>288</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>288</a>
 <b>400</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>403</a>
 <b>527</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>528</a>
 <b>744</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>747</a>
 <b>1109</b>
-<v>262</v>
+<v>263</v>
 </b>
 <b>
 <a>1116</a>
 <b>1915</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>1920</a>
 <b>4051</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>4053</a>
 <b>50922</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>67370</a>
@@ -44358,62 +44496,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>286</v>
+<v>287</v>
 </b>
 <b>
 <a>3</a>
 <b>20</b>
-<v>281</v>
+<v>282</v>
 </b>
 <b>
 <a>20</a>
 <b>46</b>
-<v>267</v>
+<v>268</v>
 </b>
 <b>
 <a>46</a>
 <b>76</b>
-<v>262</v>
+<v>263</v>
 </b>
 <b>
 <a>77</a>
 <b>119</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>119</a>
 <b>176</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>176</a>
 <b>253</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>255</a>
 <b>332</b>
-<v>262</v>
+<v>263</v>
 </b>
 <b>
 <a>338</a>
 <b>481</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>483</a>
 <b>683</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>685</a>
 <b>1273</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>1295</a>
 <b>2685</b>
-<v>257</v>
+<v>258</v>
 </b>
 <b>
 <a>2710</a>
@@ -44434,62 +44572,62 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>18889</v>
+<v>18937</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>44915</v>
+<v>45028</v>
 </b>
 <b>
 <a>3</a>
 <b>5</b>
-<v>23857</v>
+<v>23917</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>17470</v>
+<v>17514</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>30064</v>
+<v>30140</v>
 </b>
 <b>
 <a>7</a>
 <b>9</b>
-<v>18928</v>
+<v>18976</v>
 </b>
 <b>
 <a>9</a>
 <b>11</b>
-<v>22034</v>
+<v>22090</v>
 </b>
 <b>
 <a>11</a>
 <b>13</b>
-<v>20984</v>
+<v>21037</v>
 </b>
 <b>
 <a>13</a>
 <b>21</b>
-<v>21412</v>
+<v>21466</v>
 </b>
 <b>
 <a>21</a>
 <b>39</b>
-<v>21077</v>
+<v>21130</v>
 </b>
 <b>
 <a>39</a>
 <b>83</b>
-<v>20522</v>
+<v>20574</v>
 </b>
 <b>
 <a>83</a>
 <b>1061</b>
-<v>13318</v>
+<v>13352</v>
 </b>
 </bs>
 </hist>
@@ -44505,52 +44643,52 @@
 <b>
 <a>1</a>
 <b>2</b>
-<v>62754</v>
+<v>62912</v>
 </b>
 <b>
 <a>2</a>
 <b>3</b>
-<v>21042</v>
+<v>21096</v>
 </b>
 <b>
 <a>3</a>
 <b>4</b>
-<v>46874</v>
+<v>46992</v>
 </b>
 <b>
 <a>4</a>
 <b>5</b>
-<v>18889</v>
+<v>18937</v>
 </b>
 <b>
 <a>5</a>
 <b>6</b>
-<v>19351</v>
+<v>19400</v>
 </b>
 <b>
 <a>6</a>
 <b>7</b>
-<v>22010</v>
+<v>22065</v>
 </b>
 <b>
 <a>7</a>
 <b>11</b>
-<v>23235</v>
+<v>23293</v>
 </b>
 <b>
 <a>11</a>
 <b>19</b>
-<v>21942</v>
+<v>21997</v>
 </b>
 <b>
 <a>19</a>
 <b>41</b>
-<v>20804</v>
+<v>20857</v>
 </b>
 <b>
 <a>41</a>
 <b>702</b>
-<v>16570</v>
+<v>16612</v>
 </b>
 </bs>
 </hist>

From 9e3cc3b1b2a3d1721acdde76cd7f916b01862112 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Tue, 19 Jan 2021 09:08:59 +0100
Subject: [PATCH 255/343] JS: add qhelp and changenotes for js/server-crash

---
 .../change-notes/2021-01-18-server-crash.md   |  2 +
 .../ql/src/Security/CWE-730/ServerCrash.qhelp | 84 ++++++++++++++++---
 .../CWE-730/examples/server-crash.BAD.js      | 21 +++++
 .../CWE-730/examples/server-crash.GOOD-A.js   | 14 ++++
 .../CWE-730/examples/server-crash.GOOD-B.js   | 13 +++
 5 files changed, 124 insertions(+), 10 deletions(-)
 create mode 100644 javascript/change-notes/2021-01-18-server-crash.md
 create mode 100644 javascript/ql/src/Security/CWE-730/examples/server-crash.BAD.js
 create mode 100644 javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-A.js
 create mode 100644 javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js

diff --git a/javascript/change-notes/2021-01-18-server-crash.md b/javascript/change-notes/2021-01-18-server-crash.md
new file mode 100644
index 00000000000..bf5383c3bd8
--- /dev/null
+++ b/javascript/change-notes/2021-01-18-server-crash.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* The `js/server-crash` query has been added. It highlights servers may be terminated by a malicious user.
diff --git a/javascript/ql/src/Security/CWE-730/ServerCrash.qhelp b/javascript/ql/src/Security/CWE-730/ServerCrash.qhelp
index c3258c4e5f1..e46616ade47 100644
--- a/javascript/ql/src/Security/CWE-730/ServerCrash.qhelp
+++ b/javascript/ql/src/Security/CWE-730/ServerCrash.qhelp
@@ -1,22 +1,86 @@
 <!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
+"-//Semmle//qhelp//EN"
+"qhelp.dtd">
 <qhelp>
 
-	<overview>
+<overview>
 
-	</overview>
+	<p>
 
-	<recommendation>
+		Servers handle requests from clients until terminated
+		deliberately by a server administrator. A client request that results
+		in an uncaught server-side exception causes the current server
+		response generation to fail, and should not have an effect on
+		subsequent client requests.
 
-	</recommendation>
+	</p>
 
-	<example>
+	<p>
 
-	</example>
+		Under some circumstances, uncaught exceptions can however
+		cause the entire server to terminate abruptly. Such a behavior is
+		highly undesirable, especially if it gives malicious users the ability
+		to turn off the server at will, which is an efficient
+		denial-of-service attack.
 
-	<references>
+	</p>
 
-	</references>
+</overview>
+
+<recommendation>
+
+	<p>
+
+		Ensure that the processing of client requests can not cause
+		uncaught exceptions to terminate the entire server abruptly.
+
+	</p>
+
+</recommendation>
+
+<example>
+
+	<p>
+
+		The following server implementation checks if a client-provided
+		file path is valid and throws an exception if the check fails. It can
+		be seen that the exception is uncaught, and it is therefore reasonable to
+		expect the server to respond with an error response to client requests
+		that cause the check to fail.
+
+		But since the exception is uncaught in the context of an
+		asynchronous callback invocation (<code>fs.access(...)</code>), the
+		entire server will terminate instead.
+
+	</p>
+
+	<sample src="examples/server-crash.BAD.js"/>
+
+	<p>
+		To remedy this, the server can catch the exception explicitly with
+		a <code>try/catch</code> block, and generate an appropriate error
+		response instead:
+
+	</p>
+
+	<sample src="examples/server-crash.GOOD-A.js"/>
+
+	<p>
+
+		An alternative is to use an <code>async</code> and
+		<code>await</code> for the asynchronous behavior, since the server
+		will then print warning messages about uncaught exceptions instead of
+		terminating, unless the server was started with the commandline option
+		<code>--unhandled-rejections=strict</code>:
+
+	</p>
+
+	<sample src="examples/server-crash.GOOD-B.js"/>
+
+</example>
+
+<references>
+
+</references>
 
 </qhelp>
diff --git a/javascript/ql/src/Security/CWE-730/examples/server-crash.BAD.js b/javascript/ql/src/Security/CWE-730/examples/server-crash.BAD.js
new file mode 100644
index 00000000000..1b7001666ff
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-730/examples/server-crash.BAD.js
@@ -0,0 +1,21 @@
+const express = require("express"),
+      fs = require("fs");
+
+function save(rootDir, path, content){
+	if (!isValidPath(rootDir, req.query.filePath)) {
+		throw new Error(`Invalid filePath: ${req.query.filePath}`); // BAD crashes the server
+	}
+	// write content to disk
+}
+express().post("/save", (req, res) => {
+	fs.access(rootDir, (err) => {
+		if (err) {
+			console.error(`Server setup is corrupted, ${rootDir} does not exist!`);
+			res.status(500);
+			res.end();
+		}
+		save(rootDir, req.query.path, req.body);
+		res.status(200);
+		res.end();
+	});
+});
diff --git a/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-A.js b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-A.js
new file mode 100644
index 00000000000..60314259dc0
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-A.js
@@ -0,0 +1,14 @@
+// ...
+express().post("/save", (req, res) => {
+  fs.access(rootDir, (err) => {
+    // ...
+    try {
+      save(rootDir, req.query.path, req.body); // GOOD no uncaught exception
+      res.status(200);
+      res.end();
+    } catch (e) {
+      res.status(500);
+      res.end();
+    }
+  });
+});
diff --git a/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js
new file mode 100644
index 00000000000..1d02956a341
--- /dev/null
+++ b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js
@@ -0,0 +1,13 @@
+// ...
+express().post("/save", async (req, res) => {
+  try {
+    await fs.access(rootDir);
+  } catch (e) {
+    console.error(`Server setup is corrupted, ${rootDir} does not exist!`);
+    res.status(500);
+    res.end();
+  }
+  save(rootDir, req.query.path, req.body); // MAYBE BAD, depends on the commandline options
+  res.status(200);
+  res.end();
+});

From 5a6e6928073603eda6cffbd0930f16c68197c198 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Tue, 19 Jan 2021 09:58:08 +0100
Subject: [PATCH 256/343] add js/server-crash to the security suite

---
 javascript/config/suites/javascript/security | 1 +
 1 file changed, 1 insertion(+)

diff --git a/javascript/config/suites/javascript/security b/javascript/config/suites/javascript/security
index 3e87d292d7b..9f826d04314 100644
--- a/javascript/config/suites/javascript/security
+++ b/javascript/config/suites/javascript/security
@@ -49,6 +49,7 @@
 + semmlecode-javascript-queries/Security/CWE-640/HostHeaderPoisoningInEmailGeneration.ql: /Security/CWE/CWE-640
 + semmlecode-javascript-queries/Security/CWE-643/XpathInjection.ql: /Security/CWE/CWE-643
 + semmlecode-javascript-queries/Security/CWE-730/RegExpInjection.ql: /Security/CWE/CWE-730
++ semmlecode-javascript-queries/Security/CWE-730/ServerCrash.ql: /Security/CWE/CWE-730
 + semmlecode-javascript-queries/Security/CWE-754/UnvalidatedDynamicMethodCall.ql: /Security/CWE/CWE-754
 + semmlecode-javascript-queries/Security/CWE-770/MissingRateLimiting.ql: /Security/CWE/CWE-770
 + semmlecode-javascript-queries/Security/CWE-776/XmlBomb.ql: /Security/CWE/CWE-776

From b90dd89746b6d8d3a01b22db76426dab4a95405c Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Thu, 21 Jan 2021 09:02:11 +0100
Subject: [PATCH 257/343] JS: move js/resource-exhaustion to experimental

---
 javascript/config/suites/javascript/security  |  1 -
 .../Security/CWE-770/ResourceExhaustion.qhelp |  0
 .../Security/CWE-770/ResourceExhaustion.ql    |  2 +-
 .../examples/ResourceExhaustion_timeout.js    |  0
 .../ResourceExhaustion_timeout_fixed.js       |  0
 .../security/dataflow/ResourceExhaustion.qll  |  0
 .../ResourceExhaustionCustomizations.qll      |  0
 .../CWE-770/ResourceExhaustion.expected       | 36 +++++++++----------
 .../Security/CWE-770/ResourceExhaustion.qlref |  1 +
 .../ResourceExhaustion_timeout.js             |  0
 .../ResourceExhaustion_timeout_fixed.js       |  0
 .../Security/CWE-770/resource-exhaustion.js   |  0
 .../Security/CWE-770/ResourceExhaustion.qlref |  1 -
 13 files changed, 20 insertions(+), 21 deletions(-)
 rename javascript/ql/src/{ => experimental}/Security/CWE-770/ResourceExhaustion.qhelp (100%)
 rename javascript/ql/src/{ => experimental}/Security/CWE-770/ResourceExhaustion.ql (86%)
 rename javascript/ql/src/{ => experimental}/Security/CWE-770/examples/ResourceExhaustion_timeout.js (100%)
 rename javascript/ql/src/{ => experimental}/Security/CWE-770/examples/ResourceExhaustion_timeout_fixed.js (100%)
 rename javascript/ql/src/{ => experimental}/semmle/javascript/security/dataflow/ResourceExhaustion.qll (100%)
 rename javascript/ql/src/{ => experimental}/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll (100%)
 rename javascript/ql/test/{query-tests => experimental}/Security/CWE-770/ResourceExhaustion.expected (63%)
 create mode 100644 javascript/ql/test/experimental/Security/CWE-770/ResourceExhaustion.qlref
 rename javascript/ql/test/{query-tests/Security/CWE-770/documentation_examples => experimental/Security/CWE-770/documentaion-examples}/ResourceExhaustion_timeout.js (100%)
 rename javascript/ql/test/{query-tests/Security/CWE-770/documentation_examples => experimental/Security/CWE-770/documentaion-examples}/ResourceExhaustion_timeout_fixed.js (100%)
 rename javascript/ql/test/{query-tests => experimental}/Security/CWE-770/resource-exhaustion.js (100%)
 delete mode 100644 javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.qlref

diff --git a/javascript/config/suites/javascript/security b/javascript/config/suites/javascript/security
index 9c9f2e007f8..3e87d292d7b 100644
--- a/javascript/config/suites/javascript/security
+++ b/javascript/config/suites/javascript/security
@@ -51,7 +51,6 @@
 + semmlecode-javascript-queries/Security/CWE-730/RegExpInjection.ql: /Security/CWE/CWE-730
 + semmlecode-javascript-queries/Security/CWE-754/UnvalidatedDynamicMethodCall.ql: /Security/CWE/CWE-754
 + semmlecode-javascript-queries/Security/CWE-770/MissingRateLimiting.ql: /Security/CWE/CWE-770
-+ semmlecode-javascript-queries/Security/CWE-770/ResourceExhaustion.ql: /Security/CWE/CWE-770
 + semmlecode-javascript-queries/Security/CWE-776/XmlBomb.ql: /Security/CWE/CWE-776
 + semmlecode-javascript-queries/Security/CWE-798/HardcodedCredentials.ql: /Security/CWE/CWE-798
 + semmlecode-javascript-queries/Security/CWE-807/ConditionalBypass.ql: /Security/CWE/CWE-807
diff --git a/javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp b/javascript/ql/src/experimental/Security/CWE-770/ResourceExhaustion.qhelp
similarity index 100%
rename from javascript/ql/src/Security/CWE-770/ResourceExhaustion.qhelp
rename to javascript/ql/src/experimental/Security/CWE-770/ResourceExhaustion.qhelp
diff --git a/javascript/ql/src/Security/CWE-770/ResourceExhaustion.ql b/javascript/ql/src/experimental/Security/CWE-770/ResourceExhaustion.ql
similarity index 86%
rename from javascript/ql/src/Security/CWE-770/ResourceExhaustion.ql
rename to javascript/ql/src/experimental/Security/CWE-770/ResourceExhaustion.ql
index adb8663085e..473522f6a86 100644
--- a/javascript/ql/src/Security/CWE-770/ResourceExhaustion.ql
+++ b/javascript/ql/src/experimental/Security/CWE-770/ResourceExhaustion.ql
@@ -12,7 +12,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import semmle.javascript.security.dataflow.ResourceExhaustion::ResourceExhaustion
+import experimental.semmle.javascript.security.dataflow.ResourceExhaustion::ResourceExhaustion
 
 from Configuration dataflow, DataFlow::PathNode source, DataFlow::PathNode sink
 where dataflow.hasFlowPath(source, sink)
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout.js b/javascript/ql/src/experimental/Security/CWE-770/examples/ResourceExhaustion_timeout.js
similarity index 100%
rename from javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout.js
rename to javascript/ql/src/experimental/Security/CWE-770/examples/ResourceExhaustion_timeout.js
diff --git a/javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout_fixed.js b/javascript/ql/src/experimental/Security/CWE-770/examples/ResourceExhaustion_timeout_fixed.js
similarity index 100%
rename from javascript/ql/src/Security/CWE-770/examples/ResourceExhaustion_timeout_fixed.js
rename to javascript/ql/src/experimental/Security/CWE-770/examples/ResourceExhaustion_timeout_fixed.js
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll b/javascript/ql/src/experimental/semmle/javascript/security/dataflow/ResourceExhaustion.qll
similarity index 100%
rename from javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustion.qll
rename to javascript/ql/src/experimental/semmle/javascript/security/dataflow/ResourceExhaustion.qll
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll b/javascript/ql/src/experimental/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
similarity index 100%
rename from javascript/ql/src/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
rename to javascript/ql/src/experimental/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected b/javascript/ql/test/experimental/Security/CWE-770/ResourceExhaustion.expected
similarity index 63%
rename from javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected
rename to javascript/ql/test/experimental/Security/CWE-770/ResourceExhaustion.expected
index e3bb6853d19..e1670319206 100644
--- a/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.expected
+++ b/javascript/ql/test/experimental/Security/CWE-770/ResourceExhaustion.expected
@@ -1,13 +1,13 @@
 nodes
-| documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay |
-| documentation_examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) |
-| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
-| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:52 | url.par ... ).query |
-| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay |
-| documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url |
-| documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url |
-| documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
-| documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:52 | url.par ... ).query |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url |
+| documentaion-examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
+| documentaion-examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
 | resource-exhaustion.js:9:7:9:42 | s |
 | resource-exhaustion.js:9:11:9:34 | url.par ... , true) |
 | resource-exhaustion.js:9:11:9:40 | url.par ... ).query |
@@ -30,14 +30,14 @@ nodes
 | resource-exhaustion.js:88:18:88:18 | s |
 | resource-exhaustion.js:88:18:88:18 | s |
 edges
-| documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
-| documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
-| documentation_examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) | documentation_examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay |
-| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:52 | url.par ... ).query |
-| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:52 | url.par ... ).query | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay |
-| documentation_examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay | documentation_examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) |
-| documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
-| documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentation_examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay | documentaion-examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay | documentaion-examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) | documentaion-examples/ResourceExhaustion_timeout.js:5:6:5:59 | delay |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) | documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:52 | url.par ... ).query |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:52 | url.par ... ).query | documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:58 | url.par ... y.delay | documentaion-examples/ResourceExhaustion_timeout.js:5:14:5:59 | parseIn ... .delay) |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
+| documentaion-examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentaion-examples/ResourceExhaustion_timeout.js:5:23:5:46 | url.par ... , true) |
 | resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:10:20:10:20 | s |
 | resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:39:12:39:12 | s |
 | resource-exhaustion.js:9:7:9:42 | s | resource-exhaustion.js:39:12:39:12 | s |
@@ -59,7 +59,7 @@ edges
 | resource-exhaustion.js:10:11:10:21 | parseInt(s) | resource-exhaustion.js:10:7:10:21 | n |
 | resource-exhaustion.js:10:20:10:20 | s | resource-exhaustion.js:10:11:10:21 | parseInt(s) |
 #select
-| documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay | documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentation_examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay | This creates a timer with a user-controlled duration from $@. | documentation_examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | here |
+| documentaion-examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay | documentaion-examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | documentaion-examples/ResourceExhaustion_timeout.js:7:16:7:20 | delay | This creates a timer with a user-controlled duration from $@. | documentaion-examples/ResourceExhaustion_timeout.js:5:33:5:39 | req.url | here |
 | resource-exhaustion.js:38:12:38:12 | n | resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:38:12:38:12 | n | This creates a string with a user-controlled length from $@. | resource-exhaustion.js:9:21:9:27 | req.url | here |
 | resource-exhaustion.js:39:12:39:12 | s | resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:39:12:39:12 | s | This creates a string with a user-controlled length from $@. | resource-exhaustion.js:9:21:9:27 | req.url | here |
 | resource-exhaustion.js:85:17:85:17 | n | resource-exhaustion.js:9:21:9:27 | req.url | resource-exhaustion.js:85:17:85:17 | n | This creates a timer with a user-controlled duration from $@. | resource-exhaustion.js:9:21:9:27 | req.url | here |
diff --git a/javascript/ql/test/experimental/Security/CWE-770/ResourceExhaustion.qlref b/javascript/ql/test/experimental/Security/CWE-770/ResourceExhaustion.qlref
new file mode 100644
index 00000000000..13cbfcb0db6
--- /dev/null
+++ b/javascript/ql/test/experimental/Security/CWE-770/ResourceExhaustion.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE-770/ResourceExhaustion.ql
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout.js b/javascript/ql/test/experimental/Security/CWE-770/documentaion-examples/ResourceExhaustion_timeout.js
similarity index 100%
rename from javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout.js
rename to javascript/ql/test/experimental/Security/CWE-770/documentaion-examples/ResourceExhaustion_timeout.js
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout_fixed.js b/javascript/ql/test/experimental/Security/CWE-770/documentaion-examples/ResourceExhaustion_timeout_fixed.js
similarity index 100%
rename from javascript/ql/test/query-tests/Security/CWE-770/documentation_examples/ResourceExhaustion_timeout_fixed.js
rename to javascript/ql/test/experimental/Security/CWE-770/documentaion-examples/ResourceExhaustion_timeout_fixed.js
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js b/javascript/ql/test/experimental/Security/CWE-770/resource-exhaustion.js
similarity index 100%
rename from javascript/ql/test/query-tests/Security/CWE-770/resource-exhaustion.js
rename to javascript/ql/test/experimental/Security/CWE-770/resource-exhaustion.js
diff --git a/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.qlref b/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.qlref
deleted file mode 100644
index 38e612d406f..00000000000
--- a/javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Security/CWE-770/ResourceExhaustion.ql

From dafec3ceaa24f80796812777aa7460dc56af2945 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 21 Jan 2021 11:06:46 +0100
Subject: [PATCH 258/343] rename to `AnalyzedCompoundNumericAssignExpr`

---
 .../javascript/dataflow/internal/BasicExprTypeInference.qll   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/dataflow/internal/BasicExprTypeInference.qll b/javascript/ql/src/semmle/javascript/dataflow/internal/BasicExprTypeInference.qll
index 776eacb5804..4054a97466f 100644
--- a/javascript/ql/src/semmle/javascript/dataflow/internal/BasicExprTypeInference.qll
+++ b/javascript/ql/src/semmle/javascript/dataflow/internal/BasicExprTypeInference.qll
@@ -388,10 +388,10 @@ private class AnalyzedUpdateExpr extends DataFlow::AnalyzedValueNode {
 /**
  * Flow analysis for compound assignments.
  */
-private class AnalyzedCompoundAssignExpr extends DataFlow::AnalyzedValueNode {
+private class AnalyzedCompoundNumericAssignExpr extends DataFlow::AnalyzedValueNode {
   override CompoundAssignExpr astNode;
 
-  AnalyzedCompoundAssignExpr() { astNode.isNumeric() }
+  AnalyzedCompoundNumericAssignExpr() { astNode.isNumeric() }
 
   override AbstractValue getALocalValue() { result = abstractValueOfType(TTNumber()) }
 }

From a9a901d1e24491ffd6817925b93dd16fdf2f8d06 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 21 Jan 2021 11:08:39 +0100
Subject: [PATCH 259/343] add change note

---
 javascript/change-notes/2021-01-21-type-inference-compound.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 javascript/change-notes/2021-01-21-type-inference-compound.md

diff --git a/javascript/change-notes/2021-01-21-type-inference-compound.md b/javascript/change-notes/2021-01-21-type-inference-compound.md
new file mode 100644
index 00000000000..6969555f2d7
--- /dev/null
+++ b/javascript/change-notes/2021-01-21-type-inference-compound.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added support for modern compound assignments (`||=`, `&&=`, and `??=`) in the type inference. 

From 34280f90b0646ff778b2dd320af8c2ae41b75953 Mon Sep 17 00:00:00 2001
From: Asger F <asgerf@github.com>
Date: Thu, 21 Jan 2021 10:51:46 +0000
Subject: [PATCH 260/343] Update QLDoc for getATemplateArgument

Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
---
 .../ql/src/semmle/javascript/frameworks/Angular2.qll      | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 3f33a07ce3d..3c27a37ec26 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -356,7 +356,13 @@ module Angular2 {
     /** Gets an HTML element that instantiates this component. */
     HTML::Element getATemplateInstantiation() { result.getName() = getSelector() }
 
-    /** Gets an argument that flows into the `name` field of this component. */
+    /** 
+      * Gets an argument that flows into the `name` field of this component. 
+      * 
+      * For example, if the selector for this component is `"my-class"`, then this  
+      * predicate can match an attribute like: `<my-class [foo]="1+2"/>`.  
+      * The result of this predicate would be the `1+2` expression, and `name` would be `"foo"`. 
+      */
     DataFlow::Node getATemplateArgument(string name) {
       result =
         getAttributeValueAsNode(getATemplateInstantiation().getAttributeByName("[" + name + "]"))

From 7c6704a63fe726e185fee63fb6bb11346451ab98 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 21 Jan 2021 11:07:57 +0000
Subject: [PATCH 261/343] JS: Shift line numbers in test case

---
 .../frameworks/Angular2/sink.component.ts          |  1 +
 .../frameworks/Angular2/test.expected              | 14 +++++++-------
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
index 48698860f70..9c21f6348d7 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
@@ -15,6 +15,7 @@ export class SinkComponent {
     sink7: string;
     sink8: string;
 
+
     constructor(private sanitizer: DomSanitizer) {}
 
     foo() {
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index c63ccd8d624..f278eb464f7 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -22,12 +22,12 @@ pipeClassRef
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:5:22:5:29 | testPipe |
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:6:19:6:26 | testPipe |
 taintFlow
-| inline.component.ts:15:22:15:29 | source() | sink.component.ts:27:48:27:57 | this.sink7 |
+| inline.component.ts:15:22:15:29 | source() | sink.component.ts:28:48:28:57 | this.sink7 |
 | source.component.ts:14:22:14:29 | source() | TestPipe.ts:6:31:6:35 | value |
-| source.component.ts:14:22:14:29 | source() | sink.component.ts:21:48:21:57 | this.sink1 |
-| source.component.ts:14:22:14:29 | source() | sink.component.ts:24:48:24:57 | this.sink4 |
-| source.component.ts:14:22:14:29 | source() | sink.component.ts:25:48:25:57 | this.sink5 |
-| source.component.ts:14:22:14:29 | source() | sink.component.ts:26:48:26:57 | this.sink6 |
-| source.component.ts:14:22:14:29 | source() | sink.component.ts:28:48:28:57 | this.sink8 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:22:48:22:57 | this.sink1 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:25:48:25:57 | this.sink4 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:26:48:26:57 | this.sink5 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:27:48:27:57 | this.sink6 |
+| source.component.ts:14:22:14:29 | source() | sink.component.ts:29:48:29:57 | this.sink8 |
 | source.component.ts:14:22:14:29 | source() | source.component.ts:20:48:20:48 | x |
-| source.component.ts:15:33:15:40 | source() | sink.component.ts:21:48:21:57 | this.sink1 |
+| source.component.ts:15:33:15:40 | source() | sink.component.ts:22:48:22:57 | this.sink1 |

From 144d04f3ceee931d4252c65d6dcab73be39ee2d1 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 21 Jan 2021 11:25:39 +0000
Subject: [PATCH 262/343] JS: Add test exposing source location of attribute
 after line break

---
 .../library-tests/frameworks/Angular2/inline.component.ts    | 2 +-
 .../test/library-tests/frameworks/Angular2/sink.component.ts | 3 ++-
 .../ql/test/library-tests/frameworks/Angular2/test.expected  | 3 +++
 javascript/ql/test/library-tests/frameworks/Angular2/test.ql | 5 +++++
 4 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/inline.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/inline.component.ts
index 7bcae20cb8c..5fa4f3ee802 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/inline.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/inline.component.ts
@@ -5,7 +5,7 @@ import { Input, Component } from '@angular/core';
     template: `
         <sink-component [sink7]="taint"></sink-component>
 
-        \n<sink-component [sink7]="taint"></sink-component>
+        \n<sink-component [sink9]="taint" [testAttr]="taint"></sink-component>
 `
 })
 export class InlineComponent {
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
index 9c21f6348d7..4db18a7e2d6 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/sink.component.ts
@@ -14,7 +14,7 @@ export class SinkComponent {
     sink6: string;
     sink7: string;
     sink8: string;
-
+    sink9: string;
 
     constructor(private sanitizer: DomSanitizer) {}
 
@@ -27,5 +27,6 @@ export class SinkComponent {
         this.sanitizer.bypassSecurityTrustHtml(this.sink6);
         this.sanitizer.bypassSecurityTrustHtml(this.sink7);
         this.sanitizer.bypassSecurityTrustHtml(this.sink8);
+        this.sanitizer.bypassSecurityTrustHtml(this.sink9);
     }
 }
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
index f278eb464f7..5d1f2a7061b 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.expected
@@ -23,6 +23,7 @@ pipeClassRef
 | TestPipe.ts:4:8:9:1 | class T ... ;\\n  }\\n} | source.component.html:6:19:6:26 | testPipe |
 taintFlow
 | inline.component.ts:15:22:15:29 | source() | sink.component.ts:28:48:28:57 | this.sink7 |
+| inline.component.ts:15:22:15:29 | source() | sink.component.ts:30:48:30:57 | this.sink9 |
 | source.component.ts:14:22:14:29 | source() | TestPipe.ts:6:31:6:35 | value |
 | source.component.ts:14:22:14:29 | source() | sink.component.ts:22:48:22:57 | this.sink1 |
 | source.component.ts:14:22:14:29 | source() | sink.component.ts:25:48:25:57 | this.sink4 |
@@ -31,3 +32,5 @@ taintFlow
 | source.component.ts:14:22:14:29 | source() | sink.component.ts:29:48:29:57 | this.sink8 |
 | source.component.ts:14:22:14:29 | source() | source.component.ts:20:48:20:48 | x |
 | source.component.ts:15:33:15:40 | source() | sink.component.ts:22:48:22:57 | this.sink1 |
+testAttrSourceLocation
+| inline.component.ts:8:43:8:61 | [testAttr]=taint | inline.component.ts:8:55:8:59 | <toplevel> |
diff --git a/javascript/ql/test/library-tests/frameworks/Angular2/test.ql b/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
index ba3b30649f0..a4892df4b93 100644
--- a/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
+++ b/javascript/ql/test/library-tests/frameworks/Angular2/test.ql
@@ -27,3 +27,8 @@ class TaintConfig extends TaintTracking::Configuration {
 query predicate taintFlow(DataFlow::Node source, DataFlow::Node sink) {
   any(TaintConfig c).hasFlow(source, sink)
 }
+
+query predicate testAttrSourceLocation(HTML::Attribute attrib, Angular2::TemplateTopLevel top) {
+  attrib.getName() = "[testAttr]" and
+  top = attrib.getCodeInAttribute()
+}

From e786be06aef074639e3bc56e8f8465bd30813c06 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Thu, 21 Jan 2021 12:40:35 +0100
Subject: [PATCH 263/343] Python: Fix broken references

---
 .../ql/test/experimental/dataflow/TestUtil/MaximalFlowTest.qll  | 2 +-
 python/ql/test/experimental/dataflow/callGraphConfig.qll        | 2 +-
 .../ql/test/experimental/dataflow/coverage/classesCallGraph.ql  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/python/ql/test/experimental/dataflow/TestUtil/MaximalFlowTest.qll b/python/ql/test/experimental/dataflow/TestUtil/MaximalFlowTest.qll
index eb84d197c69..4956aecadc2 100644
--- a/python/ql/test/experimental/dataflow/TestUtil/MaximalFlowTest.qll
+++ b/python/ql/test/experimental/dataflow/TestUtil/MaximalFlowTest.qll
@@ -35,7 +35,7 @@ class MaximalFlowsConfig extends DataFlow::Configuration {
   override predicate isSink(DataFlow::Node node) {
     exists(node.getLocation().getFile().getRelativePath()) and
     not any(CallNode c).getArg(_) = node.asCfgNode() and
-    not node instanceof ArgumentNode and
+    not node instanceof DataFlow::ArgumentNode and
     not node.asCfgNode().(NameNode).getId().matches("SINK%") and
     not exists(DataFlow::Node succ | DataFlow::localFlowStep(node, succ))
   }
diff --git a/python/ql/test/experimental/dataflow/callGraphConfig.qll b/python/ql/test/experimental/dataflow/callGraphConfig.qll
index c2846192e4d..ceb39bafcd6 100644
--- a/python/ql/test/experimental/dataflow/callGraphConfig.qll
+++ b/python/ql/test/experimental/dataflow/callGraphConfig.qll
@@ -11,7 +11,7 @@ class CallGraphConfig extends DataFlow::Configuration {
   override predicate isSource(DataFlow::Node node) {
     node instanceof DataFlowPrivate::ReturnNode
     or
-    node instanceof DataFlowPrivate::ArgumentNode
+    node instanceof DataFlow::ArgumentNode
   }
 
   override predicate isSink(DataFlow::Node node) {
diff --git a/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql b/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql
index 3c74e722b3d..1f8edfc1c79 100644
--- a/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql
+++ b/python/ql/test/experimental/dataflow/coverage/classesCallGraph.ql
@@ -11,7 +11,7 @@ class CallGraphConfig extends DataFlow::Configuration {
     node instanceof DataFlowPrivate::ReturnNode
     or
     // These sources should allow for the non-standard call syntax
-    node instanceof DataFlowPrivate::ArgumentNode
+    node instanceof DataFlow::ArgumentNode
   }
 
   override predicate isSink(DataFlow::Node node) {

From 1d1149f4cd3dc48cdee4968346108efb196e45d6 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 21 Jan 2021 12:08:22 +0000
Subject: [PATCH 264/343] JS: Test and QLDoc for RxJS model

---
 .../ql/src/semmle/javascript/frameworks/RxJS.qll      | 10 ++++++++--
 .../TaintTracking/BasicTaintTracking.expected         |  1 +
 .../ql/test/library-tests/TaintTracking/rxjs.js       | 11 +++++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/TaintTracking/rxjs.js

diff --git a/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll b/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll
index 0016c05c41c..5fc662ef3d5 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/RxJS.qll
@@ -17,7 +17,10 @@ private class RxJsSubscribeStep extends TaintTracking::AdditionalTaintStep, Data
 }
 
 /**
- * Holds if a tainted value sent into the given `pipe` should propagate to `arg`.
+ * Gets a data flow node that can take the value of any input sent to `pipe`.
+ *
+ * For example, in `map(x => ...)`, `x` refers to any value sent to the pipe
+ * created by the `map` call.
  */
 private DataFlow::Node pipeInput(DataFlow::CallNode pipe) {
   pipe = DataFlow::moduleMember("rxjs/operators", ["map", "filter"]).getACall() and
@@ -25,7 +28,10 @@ private DataFlow::Node pipeInput(DataFlow::CallNode pipe) {
 }
 
 /**
- * Holds if a tainted value in `output` should propagate to the output of the given pipe.
+ * Gets a data flow node whose value becomes the output of the given `pipe`.
+ *
+ * For example, in `map(x => x + 1)`, the `x + 1` node becomes the output of
+ * the pipe.
  */
 private DataFlow::Node pipeOutput(DataFlow::CallNode pipe) {
   pipe = DataFlow::moduleMember("rxjs/operators", "map").getACall() and
diff --git a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
index b0a729f5189..24fcbb5a6ef 100644
--- a/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
+++ b/javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected
@@ -97,6 +97,7 @@ typeInferenceMismatch
 | promise.js:5:25:5:32 | source() | promise.js:5:8:5:33 | bluebir ... urce()) |
 | promise.js:10:24:10:31 | source() | promise.js:10:8:10:32 | Promise ... urce()) |
 | promise.js:12:20:12:27 | source() | promise.js:13:8:13:23 | resolver.promise |
+| rxjs.js:3:1:3:8 | source() | rxjs.js:10:14:10:17 | data |
 | sanitizer-function.js:12:17:12:24 | source() | sanitizer-function.js:14:10:14:14 | taint |
 | sanitizer-function.js:12:17:12:24 | source() | sanitizer-function.js:33:14:33:18 | taint |
 | sanitizer-guards.js:2:11:2:18 | source() | sanitizer-guards.js:4:8:4:8 | x |
diff --git a/javascript/ql/test/library-tests/TaintTracking/rxjs.js b/javascript/ql/test/library-tests/TaintTracking/rxjs.js
new file mode 100644
index 00000000000..f3ef209d392
--- /dev/null
+++ b/javascript/ql/test/library-tests/TaintTracking/rxjs.js
@@ -0,0 +1,11 @@
+import { map, catchError } from 'rxjs/operators';
+
+source()
+    .pipe(
+        map(x => x + 'foo'),
+        map(x => x + 'bar'),
+        catchError(err => {})
+    )
+    .subscribe(data => {
+        sink(data)
+    });

From 2f58683f2debf81e3fe0231e145f76df7aa5f40b Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 21 Jan 2021 12:12:17 +0000
Subject: [PATCH 265/343] JS: Remove PipeCallExpr

---
 .../src/semmle/javascript/frameworks/Angular2.qll   | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 3c27a37ec26..f44a4b90fb8 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -241,19 +241,6 @@ module Angular2 {
     override string getAPrimaryQlClass() { result = "Angular2::PipeRefExpr" }
   }
 
-  /**
-   * A call derived from a pipe expression.
-   *
-   * For example, the expression `x | f: y` is desugared to `f(x, y)` where
-   * `f` is a `PipeRefExpr` and the call itself is a `PipeCallExpr`.
-   */
-  class PipeCallExpr extends CallExpr {
-    PipeCallExpr() { getCallee() instanceof PipeRefExpr }
-
-    /** Gets the name of the pipe being invoked, such as `f` in `x | f`. */
-    string getPipeName() { result = getCallee().(PipeRefExpr).getName() }
-  }
-
   /**
    * A reference to a variable in a template expression, corresponding
    * to a property on the component class.

From ac77a8b8a846a72b29cc2edcc5c71ad50d7fcb17 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Wed, 20 Jan 2021 17:38:35 +0100
Subject: [PATCH 266/343] Python: Add proper HTTP response tests for Tornado

---
 .../frameworks/tornado/ConceptsTest.ql        | 20 ++---
 .../frameworks/tornado/response_test.py       | 85 +++++++++++++++++++
 .../frameworks/tornado/responses.py           | 35 --------
 3 files changed, 95 insertions(+), 45 deletions(-)
 create mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py
 delete mode 100644 python/ql/test/experimental/library-tests/frameworks/tornado/responses.py

diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql b/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql
index a946c6befb9..1e2c1fab3ee 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/ConceptsTest.ql
@@ -1,12 +1,12 @@
 import python
 import experimental.meta.ConceptsTest
-//
-// class DedicatedResponseTest extends HttpServerHttpResponseTest {
-//   DedicatedResponseTest() { file.getShortName() = "response_test.py" }
-// }
-//
-// class OtherResponseTest extends HttpServerHttpResponseTest {
-//   OtherResponseTest() { not this instanceof DedicatedResponseTest }
-//
-//   override string getARelevantTag() { result = "HttpResponse" }
-// }
+
+class DedicatedResponseTest extends HttpServerHttpResponseTest {
+  DedicatedResponseTest() { file.getShortName() = "response_test.py" }
+}
+
+class OtherResponseTest extends HttpServerHttpResponseTest {
+  OtherResponseTest() { not this instanceof DedicatedResponseTest }
+
+  override string getARelevantTag() { result = "HttpResponse" }
+}
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py b/python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py
new file mode 100644
index 00000000000..644ebd261a8
--- /dev/null
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py
@@ -0,0 +1,85 @@
+import tornado.web
+import tornado.httputil
+
+
+class ResponseWriting(tornado.web.RequestHandler):
+    def get(self, type_):  # $ requestHandler routedParameter=type_
+        if type_ == "str":
+            self.write("foo") # $ MISSING: HttpResponse mimetype=text/html responseBody="foo"
+        elif type_ == "bytes":
+            self.write(b"foo") # $ MISSING: HttpResponse mimetype=text/html responseBody=b"foo"
+        elif type_ == "dict":
+            d = {"foo": 42}
+            # Content-type will be set to `application/json`
+            self.write(d) # $ MISSING: HttpResponse mimetype=application/json responseBody=d
+        else:
+            raise Exception("Bad type {} {}".format(type_, type(type_)))
+
+
+class ExplicitContentType(tornado.web.RequestHandler):
+    def get(self):  # $ requestHandler
+        # Note: Our current modeling makes it quite hard to give a good annotation here
+        # this write is technically while the HTTP response has mimetype text/html, but
+        # the returned HTTP response will have mimetype text/plain, which is _really_
+        # what matters.
+
+        self.write("foo") # $ MISSING: HttpResponse mimetype=text/html responseBody=b"foo"
+        self.set_header("Content-Type", "text/plain; charset=utf-8")
+
+    def post(self): # $ requestHandler
+        self.set_header("Content-Type", "text/plain; charset=utf-8")
+        self.write("foo") # $ MISSING: HttpResponse mimetype=text/plain responseBody=b"foo"
+
+
+class ExampleRedirect(tornado.web.RequestHandler):
+    def get(self): # $ requestHandler
+        self.redirect("http://example.com") # TODO: Model redirect
+
+
+class ExampleConnectionWrite(tornado.web.RequestHandler):
+    def get(self, stream=False): # $ requestHandler routedParameter=stream
+
+        if not stream:
+            self.request.connection.write_headers(
+                tornado.httputil.ResponseStartLine('', 200, 'OK'),
+                tornado.httputil.HTTPHeaders(),
+            )
+            self.request.connection.write(b"foo") # $ MISSING: HttpResponse responseBody="foo"
+            self.request.connection.finish()
+        else:
+            # Note: The documentation says that connection.detach(): "May only be called
+            # during HTTPMessageDelegate.headers_received". Doing it here actually
+            # works, but does make tornado spit out some errors... good enough to
+            # illustrate the behavior.
+            #
+            # https://www.tornadoweb.org/en/stable/http1connection.html#tornado.http1connection.HTTP1Connection.detach
+            stream = self.request.connection.detach()
+            stream.write(b"foo stream") # $ MISSING: HttpResponse responseBody="foo stream"
+            stream.close()
+
+def make_app():
+    return tornado.web.Application(
+        [
+            (r"/ResponseWriting/(str|bytes|dict)", ResponseWriting),  # $ routeSetup="/ResponseWriting/(str|bytes|dict)"
+            (r"/ExplicitContentType", ExplicitContentType), # $ routeSetup="/ExplicitContentType"
+            (r"/ExampleRedirect", ExampleRedirect), # $ routeSetup="/ExampleRedirect"
+            (r"/ExampleConnectionWrite", ExampleConnectionWrite), # $ routeSetup="/ExampleConnectionWrite"
+            (r"/ExampleConnectionWrite/(stream)", ExampleConnectionWrite), # $ routeSetup="/ExampleConnectionWrite/(stream)"
+        ],
+        debug=True,
+    )
+
+
+if __name__ == "__main__":
+    import tornado.ioloop
+
+    app = make_app()
+    app.listen(8888)
+    tornado.ioloop.IOLoop.current().start()
+
+    # http://localhost:8888/ResponseWriting/str
+    # http://localhost:8888/ResponseWriting/bytes
+    # http://localhost:8888/ResponseWriting/dict
+    # http://localhost:8888/ExplicitContentType
+    # http://localhost:8888/ExampleRedirect
+    # http://localhost:8888/ExampleConnectionWrite
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py b/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py
deleted file mode 100644
index fed6da1527b..00000000000
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/responses.py
+++ /dev/null
@@ -1,35 +0,0 @@
-import tornado.web
-
-
-class ResponseWriting(tornado.web.RequestHandler):
-    def get(self, type_):  # $ requestHandler routedParameter=type_
-        if type_ == "str":
-            self.write("foo")
-        elif type_ == "bytes":
-            self.write(b"foo")
-        elif type_ == "dict":
-            # Content-type will be set to `application/json`
-            self.write({"foo": 42})
-        else:
-            raise Exception("Bad type {} {}".format(type_, type(type_)))
-
-
-def make_app():
-    return tornado.web.Application(
-        [
-            (r"/ResponseWriting/(str|bytes|dict)", ResponseWriting),  # $ routeSetup="/ResponseWriting/(str|bytes|dict)"
-        ],
-        debug=True,
-    )
-
-
-if __name__ == "__main__":
-    import tornado.ioloop
-
-    app = make_app()
-    app.listen(8888)
-    tornado.ioloop.IOLoop.current().start()
-
-    # http://localhost:8888/ResponseWriting/str
-    # http://localhost:8888/ResponseWriting/bytes
-    # http://localhost:8888/ResponseWriting/dict

From b55817a5b2af945f2e47507dcd198a809f818cda Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Thu, 21 Jan 2021 13:26:31 +0100
Subject: [PATCH 267/343] Python: Model HTTP responses in tornado

This is quite a simpel model, but ends up matching what we were able to do with
points-to.

I think this modeling excercise really shows that we need a bit of a different
way to model HTTP responses... but I'm not going to try to fix that in this PR.
---
 .../src/semmle/python/frameworks/Tornado.qll  | 36 +++++++++++++++++++
 .../library-tests/frameworks/tornado/basic.py | 10 +++---
 .../frameworks/tornado/response_test.py       | 14 ++++----
 .../frameworks/tornado/routing_test.py        | 20 +++++------
 4 files changed, 58 insertions(+), 22 deletions(-)

diff --git a/python/ql/src/semmle/python/frameworks/Tornado.qll b/python/ql/src/semmle/python/frameworks/Tornado.qll
index 995fb19747d..4082b45b97e 100644
--- a/python/ql/src/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/src/semmle/python/frameworks/Tornado.qll
@@ -216,6 +216,17 @@ private module Tornado {
         /** Gets a reference to one of the methods `get_arguments`, `get_body_arguments`, `get_query_arguments`. */
         DataFlow::Node argumentsMethod() { result = argumentsMethod(DataFlow::TypeTracker::end()) }
 
+        /** Gets a reference to the `write` method. */
+        private DataFlow::Node writeMethod(DataFlow::TypeTracker t) {
+          t.startInAttr("write") and
+          result = instance()
+          or
+          exists(DataFlow::TypeTracker t2 | result = writeMethod(t2).track(t2, t))
+        }
+
+        /** Gets a reference to the `write` method. */
+        DataFlow::Node writeMethod() { result = writeMethod(DataFlow::TypeTracker::end()) }
+
         private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
           override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
             // Method access
@@ -540,4 +551,29 @@ private module Tornado {
       not result = this.getArg(0)
     }
   }
+
+  // ---------------------------------------------------------------------------
+  // Response modeling
+  // ---------------------------------------------------------------------------
+  /**
+   * A call to `tornado.web.RequestHandler.write` method.
+   *
+   * See https://www.tornadoweb.org/en/stable/web.html?highlight=write#tornado.web.RequestHandler.write
+   */
+  private class TornadoRequestHandlerWriteCall extends HTTP::Server::HttpResponse::Range,
+    DataFlow::CfgNode {
+    override CallNode node;
+
+    TornadoRequestHandlerWriteCall() {
+      node.getFunction() = tornado::web::RequestHandler::writeMethod().asCfgNode()
+    }
+
+    override DataFlow::Node getBody() {
+      result.asCfgNode() in [node.getArg(0), node.getArgByName("chunk")]
+    }
+
+    override string getMimetypeDefault() { result = "text/html" }
+
+    override DataFlow::Node getMimetypeOrContentTypeArg() { none() }
+  }
 }
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
index 6733de040b1..61e4d388320 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/basic.py
@@ -3,21 +3,21 @@ import tornado.web
 
 class BasicHandler(tornado.web.RequestHandler):
     def get(self):  # $ requestHandler
-        self.write("BasicHandler " + self.get_argument("xss"))
+        self.write("BasicHandler " + self.get_argument("xss")) # $ HttpResponse
 
     def post(self):  # $ requestHandler
-        self.write("BasicHandler (POST)")
+        self.write("BasicHandler (POST)") # $ HttpResponse
 
 
 class DeepInheritance(BasicHandler):
     def get(self):  # $ requestHandler
-        self.write("DeepInheritance" + self.get_argument("also_xss"))
+        self.write("DeepInheritance" + self.get_argument("also_xss")) # $ HttpResponse
 
 
 class FormHandler(tornado.web.RequestHandler):
     def post(self):  # $ requestHandler
         name = self.get_body_argument("name")
-        self.write(name)
+        self.write(name) # $ HttpResponse
 
 
 class RedirectHandler(tornado.web.RequestHandler):
@@ -30,7 +30,7 @@ class RedirectHandler(tornado.web.RequestHandler):
 
 class BaseReverseInheritance(tornado.web.RequestHandler):
     def get(self):  # $ requestHandler
-        self.write("hello from BaseReverseInheritance")
+        self.write("hello from BaseReverseInheritance") # $ HttpResponse
 
 
 class ReverseInheritance(BaseReverseInheritance):
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py b/python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py
index 644ebd261a8..d8af7f3895a 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/response_test.py
@@ -5,13 +5,13 @@ import tornado.httputil
 class ResponseWriting(tornado.web.RequestHandler):
     def get(self, type_):  # $ requestHandler routedParameter=type_
         if type_ == "str":
-            self.write("foo") # $ MISSING: HttpResponse mimetype=text/html responseBody="foo"
+            self.write("foo") # $ HttpResponse mimetype=text/html responseBody="foo"
         elif type_ == "bytes":
-            self.write(b"foo") # $ MISSING: HttpResponse mimetype=text/html responseBody=b"foo"
+            self.write(b"foo") # $ HttpResponse mimetype=text/html responseBody=b"foo"
         elif type_ == "dict":
             d = {"foo": 42}
             # Content-type will be set to `application/json`
-            self.write(d) # $ MISSING: HttpResponse mimetype=application/json responseBody=d
+            self.write(d) # $ HttpResponse responseBody=d MISSING: mimetype=application/json SPURIOUS: mimetype=text/html
         else:
             raise Exception("Bad type {} {}".format(type_, type(type_)))
 
@@ -23,12 +23,12 @@ class ExplicitContentType(tornado.web.RequestHandler):
         # the returned HTTP response will have mimetype text/plain, which is _really_
         # what matters.
 
-        self.write("foo") # $ MISSING: HttpResponse mimetype=text/html responseBody=b"foo"
+        self.write("foo") # $ HttpResponse mimetype=text/html responseBody="foo"
         self.set_header("Content-Type", "text/plain; charset=utf-8")
 
     def post(self): # $ requestHandler
         self.set_header("Content-Type", "text/plain; charset=utf-8")
-        self.write("foo") # $ MISSING: HttpResponse mimetype=text/plain responseBody=b"foo"
+        self.write("foo") # $ HttpResponse responseBody="foo" MISSING: mimetype=text/plain SPURIOUS: mimetype=text/html
 
 
 class ExampleRedirect(tornado.web.RequestHandler):
@@ -44,7 +44,7 @@ class ExampleConnectionWrite(tornado.web.RequestHandler):
                 tornado.httputil.ResponseStartLine('', 200, 'OK'),
                 tornado.httputil.HTTPHeaders(),
             )
-            self.request.connection.write(b"foo") # $ MISSING: HttpResponse responseBody="foo"
+            self.request.connection.write(b"foo") # $ MISSING: HttpResponse responseBody=b"foo"
             self.request.connection.finish()
         else:
             # Note: The documentation says that connection.detach(): "May only be called
@@ -54,7 +54,7 @@ class ExampleConnectionWrite(tornado.web.RequestHandler):
             #
             # https://www.tornadoweb.org/en/stable/http1connection.html#tornado.http1connection.HTTP1Connection.detach
             stream = self.request.connection.detach()
-            stream.write(b"foo stream") # $ MISSING: HttpResponse responseBody="foo stream"
+            stream.write(b"foo stream") # $ MISSING: HttpResponse responseBody=b"foo stream"
             stream.close()
 
 def make_app():
diff --git a/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py b/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
index c9fbc0c91e0..2b596c20ce5 100644
--- a/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
+++ b/python/ql/test/experimental/library-tests/frameworks/tornado/routing_test.py
@@ -4,47 +4,47 @@ import tornado.routing
 
 class FooHandler(tornado.web.RequestHandler):
     def get(self, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y
-        self.write("FooHandler {} {}".format(x, y))
+        self.write("FooHandler {} {}".format(x, y)) # $ HttpResponse
 
 
 class BarHandler(tornado.web.RequestHandler):
     def get(self, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y SPURIOUS: routedParameter=not_used
-        self.write("BarHandler {} {}".format(x, y))
+        self.write("BarHandler {} {}".format(x, y)) # $ HttpResponse
 
 
 class BazHandler(tornado.web.RequestHandler):
     def get(self, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y SPURIOUS: routedParameter=not_used
-        self.write("BazHandler {} {}".format(x, y))
+        self.write("BazHandler {} {}".format(x, y)) # $ HttpResponse
 
 
 class KwArgs(tornado.web.RequestHandler):
     def get(self, *, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y
-        self.write("KwArgs {} {}".format(x, y))
+        self.write("KwArgs {} {}".format(x, y)) # $ HttpResponse
 
 
 class OnlyLocalhost(tornado.web.RequestHandler):
     def get(self):  # $ requestHandler
-        self.write("OnlyLocalhost")
+        self.write("OnlyLocalhost") # $ HttpResponse
 
 
 class One(tornado.web.RequestHandler):
     def get(self):  # $ requestHandler
-        self.write("One")
+        self.write("One") # $ HttpResponse
 
 
 class Two(tornado.web.RequestHandler):
     def get(self):  # $ requestHandler
-        self.write("Two")
+        self.write("Two") # $ HttpResponse
 
 
 class Three(tornado.web.RequestHandler):
     def get(self):  # $ requestHandler
-        self.write("Three")
+        self.write("Three") # $ HttpResponse
 
 
 class AddedLater(tornado.web.RequestHandler):
     def get(self, x, y=None, not_used=None):  # $ requestHandler routedParameter=x routedParameter=y
-        self.write("AddedLater {} {}".format(x, y))
+        self.write("AddedLater {} {}".format(x, y)) # $ HttpResponse
 
 
 class PossiblyNotRouted(tornado.web.RequestHandler):
@@ -52,7 +52,7 @@ class PossiblyNotRouted(tornado.web.RequestHandler):
     # consider it to be a handle incoming HTTP requests
 
     def get(self):  # $ requestHandler
-        self.write("NotRouted")
+        self.write("NotRouted") # $ HttpResponse
 
 
 def make_app():

From 1c100bbbc279087538c3415ca5035510adbef901 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Thu, 21 Jan 2021 14:14:00 +0100
Subject: [PATCH 268/343] JS: recognize event emitters in nodejs client
 requests

---
 .../javascript/frameworks/NodeJSLib.qll       | 16 +++++++++++++--
 .../frameworks/EventEmitter/test.expected     | 20 +++++++++++++++++++
 .../frameworks/EventEmitter/test.ql           |  2 ++
 .../frameworks/EventEmitter/tst2.js           | 20 +++++++++++++++++--
 .../frameworks/NodeJSLib/http.js              |  2 ++
 .../frameworks/NodeJSLib/tests.expected       |  1 +
 6 files changed, 57 insertions(+), 4 deletions(-)
 create mode 100644 javascript/ql/test/library-tests/frameworks/NodeJSLib/http.js

diff --git a/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll b/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
index add7809eeb2..070ef0fb181 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
@@ -826,7 +826,7 @@ module NodeJSLib {
   /**
    * A model of a URL request in the Node.js `http` library.
    */
-  private class NodeHttpUrlRequest extends NodeJSClientRequest::Range {
+  private class NodeHttpUrlRequest extends NodeJSClientRequest::Range, NodeJSEventEmitter {
     DataFlow::Node url;
 
     NodeHttpUrlRequest() {
@@ -881,8 +881,11 @@ module NodeJSLib {
       exists(DataFlow::MethodCallNode mcn |
         clientRequest.getAMethodCall(EventEmitter::on()) = mcn and
         mcn.getArgument(0).mayHaveStringValue(handledEvent) and
-        flowsTo(mcn.getArgument(1))
+        this.flowsTo(mcn.getArgument(1))
       )
+      or
+      this.flowsTo(clientRequest.(DataFlow::CallNode).getLastArgument()) and
+      handledEvent = "connection"
     }
 
     /**
@@ -1060,6 +1063,15 @@ module NodeJSLib {
     }
   }
 
+  private class ClientRequestEventEmitter extends NodeJSEventEmitter {
+    ClientRequestEventEmitter() {
+      exists(ClientRequestHandler handler |
+        not handler.getAHandledEvent() = "error" and
+        this = handler.getAParameter()
+      )
+    }
+  }
+
   /**
    * A registration of an event handler on a NodeJS EventEmitter instance.
    */
diff --git a/javascript/ql/test/library-tests/frameworks/EventEmitter/test.expected b/javascript/ql/test/library-tests/frameworks/EventEmitter/test.expected
index 7c8466e15ec..4918d26fa9f 100644
--- a/javascript/ql/test/library-tests/frameworks/EventEmitter/test.expected
+++ b/javascript/ql/test/library-tests/frameworks/EventEmitter/test.expected
@@ -1,3 +1,4 @@
+taintSteps
 | customEmitter.js:5:20:5:24 | "bar" | customEmitter.js:6:19:6:22 | data |
 | customEmitter.js:12:21:12:25 | "baz" | customEmitter.js:13:23:13:26 | data |
 | customEmitter.js:12:21:12:25 | "baz" | customEmitter.js:22:14:22:18 | yData |
@@ -15,3 +16,22 @@
 | tst.js:40:20:40:27 | "yabity" | tst.js:39:19:39:19 | x |
 | tst.js:46:28:46:38 | 'FirstData' | tst.js:43:45:43:49 | first |
 | tst.js:47:29:47:40 | 'SecondData' | tst.js:44:37:44:42 | second |
+eventEmitter
+| customEmitter.js:3:1:8:1 | class M ... );\\n\\t}\\n} |
+| customEmitter.js:17:9:17:29 | new MyS ... itter() |
+| customEmitter.js:20:9:20:29 | new MyS ... itter() |
+| tst2.js:6:12:6:42 | new Con ... , opts) |
+| tst2.js:16:10:16:24 | new Connector() |
+| tst2.js:22:12:24:2 | http.re ... {});\\n}) |
+| tst2.js:22:37:22:39 | res |
+| tst2.js:25:28:25:33 | socket |
+| tst2.js:29:12:31:2 | http.re ... {});\\n}) |
+| tst2.js:29:37:29:39 | res |
+| tst2.js:32:28:32:33 | socket |
+| tst.js:3:10:3:22 | new emitter() |
+| tst.js:13:11:13:23 | new emitter() |
+| tst.js:18:11:18:23 | new emitter() |
+| tst.js:24:11:24:23 | new emitter() |
+| tst.js:32:11:32:30 | new MyEventEmitter() |
+| tst.js:38:11:38:38 | new Ext ... itter() |
+| tst.js:42:15:42:32 | require('process') |
diff --git a/javascript/ql/test/library-tests/frameworks/EventEmitter/test.ql b/javascript/ql/test/library-tests/frameworks/EventEmitter/test.ql
index e8de4ff4c53..9b0f16161c4 100644
--- a/javascript/ql/test/library-tests/frameworks/EventEmitter/test.ql
+++ b/javascript/ql/test/library-tests/frameworks/EventEmitter/test.ql
@@ -3,3 +3,5 @@ import javascript
 query predicate taintSteps(DataFlow::Node pred, DataFlow::Node succ) {
   exists(DataFlow::AdditionalFlowStep step | step.step(pred, succ))
 }
+
+query predicate eventEmitter(EventEmitter e) { any() }
diff --git a/javascript/ql/test/library-tests/frameworks/EventEmitter/tst2.js b/javascript/ql/test/library-tests/frameworks/EventEmitter/tst2.js
index 23cc0ffb5ba..617c5be480e 100644
--- a/javascript/ql/test/library-tests/frameworks/EventEmitter/tst2.js
+++ b/javascript/ql/test/library-tests/frameworks/EventEmitter/tst2.js
@@ -1,5 +1,5 @@
-var util = require('util');
-var EventEmitter = require('events').EventEmitter;
+var util = require("util");
+var EventEmitter = require("events").EventEmitter;
 
 var Connector = function() {
   if (!(this instanceof Connector)) {
@@ -16,3 +16,19 @@ Connector.prototype.foo = function() {};
 var em = new Connector();
 em.on("foo", bar => {});
 em.emit("foo", "bar");
+
+var http = require("http");
+
+let req1 = http.request(x, function(res) {
+  res.on("data", function(data) {});
+});
+req1.on("socket", function(socket) {
+  socket.on("data", function(data) {});
+});
+
+let req2 = http.request(x, function(res) {
+  res.on("error", function(error) {});
+});
+req2.on("socket", function(socket) {
+  socket.on("error", function(error) {});
+});
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/http.js b/javascript/ql/test/library-tests/frameworks/NodeJSLib/http.js
new file mode 100644
index 00000000000..af26259997d
--- /dev/null
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/http.js
@@ -0,0 +1,2 @@
+var http = require("http");
+http.request(x, data => data.on("data", d => undefined));
diff --git a/javascript/ql/test/library-tests/frameworks/NodeJSLib/tests.expected b/javascript/ql/test/library-tests/frameworks/NodeJSLib/tests.expected
index 2e048dc43b8..c80b0059cb6 100644
--- a/javascript/ql/test/library-tests/frameworks/NodeJSLib/tests.expected
+++ b/javascript/ql/test/library-tests/frameworks/NodeJSLib/tests.expected
@@ -96,6 +96,7 @@ test_RouteSetup_getServer
 | src/indirect2.js:18:14:18:35 | http.cr ... er(get) | src/indirect2.js:18:14:18:35 | http.cr ... er(get) |
 | src/indirect.js:34:14:34:58 | http.cr ... dler()) | src/indirect.js:34:14:34:58 | http.cr ... dler()) |
 test_ClientRequest
+| http.js:2:1:2:56 | http.re ... fined)) |
 | src/http.js:18:1:18:30 | http.re ... uth" }) |
 | src/http.js:21:15:26:6 | http.re ... \\n    }) |
 | src/http.js:27:16:27:73 | http.re ... POST'}) |

From 9c53e39394939674b49750af8ce28c2c7d680ccb Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 21 Jan 2021 16:52:00 +0300
Subject: [PATCH 269/343] Update CompilerRemovalOfCodeToClearBuffers.ql

---
 .../CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql      | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
index b0c412df4cc..435d2f8f96a 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -23,7 +23,12 @@ class CompilerRemovaMemset extends FunctionCall {
     exists(DataFlow::Node source, DataFlow::Node sink, LocalVariable isv, Expr exp |
       DataFlow::localFlow(source, sink) and
       this.getArgument(0) = isv.getAnAccess() and
-      source.asExpr() = exp and
+      (
+        source.asExpr() = exp
+        or
+        // handle the case where exp is defined by an address being passed into some function.
+        source.asDefiningArgument() = exp
+      ) and
       exp.getLocation().getEndLine() < this.getArgument(0).getLocation().getStartLine() and
       sink.asExpr() = this.getArgument(0)
     )

From c29014f1227740676b738b2e9820192b0d64497c Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Thu, 21 Jan 2021 13:55:21 +0000
Subject: [PATCH 270/343] JS: Autoformat

---
 .../src/semmle/javascript/frameworks/Angular2.qll  | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index f44a4b90fb8..976a2e7a472 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -343,13 +343,13 @@ module Angular2 {
     /** Gets an HTML element that instantiates this component. */
     HTML::Element getATemplateInstantiation() { result.getName() = getSelector() }
 
-    /** 
-      * Gets an argument that flows into the `name` field of this component. 
-      * 
-      * For example, if the selector for this component is `"my-class"`, then this  
-      * predicate can match an attribute like: `<my-class [foo]="1+2"/>`.  
-      * The result of this predicate would be the `1+2` expression, and `name` would be `"foo"`. 
-      */
+    /**
+     * Gets an argument that flows into the `name` field of this component.
+     *
+     * For example, if the selector for this component is `"my-class"`, then this
+     * predicate can match an attribute like: `<my-class [foo]="1+2"/>`.
+     * The result of this predicate would be the `1+2` expression, and `name` would be `"foo"`.
+     */
     DataFlow::Node getATemplateArgument(string name) {
       result =
         getAttributeValueAsNode(getATemplateInstantiation().getAttributeByName("[" + name + "]"))

From cb25f2ab205172f47f14f53672dd42b4f8e75c1d Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Thu, 21 Jan 2021 20:46:34 +0100
Subject: [PATCH 271/343] JS: add docstring with source examples

---
 .../src/semmle/javascript/frameworks/NodeJSLib.qll   | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll b/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
index 070ef0fb181..a472b33aa8a 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/NodeJSLib.qll
@@ -1063,6 +1063,18 @@ module NodeJSLib {
     }
   }
 
+  /**
+   * An HTTP request event handler parameter as an EventEmitter, for
+   * example the function `emitter` in either of the following:
+   *
+   * ```
+   * http.request(x, emitter => {...})
+   * ```
+   *
+   * ```
+   * http.request(...).on(y, emitter => { ...})
+   * ```
+   */
   private class ClientRequestEventEmitter extends NodeJSEventEmitter {
     ClientRequestEventEmitter() {
       exists(ClientRequestHandler handler |

From 62746bbbaca2cc55450f3beafd29cf04dfe73411 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 21 Jan 2021 22:31:42 +0100
Subject: [PATCH 272/343] skip analyzing regular expressions in minified files
 for ReDoS

---
 .../src/semmle/javascript/security/performance/ReDoSUtil.qll  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll b/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
index 425cee3ff6f..ddac5984e16 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
@@ -112,7 +112,9 @@ class RegExpRoot extends RegExpTerm {
     // there are no lookbehinds
     not exists(RegExpLookbehind lbh | getRoot(lbh) = this) and
     // is actually used as a RegExp
-    isUsedAsRegExp()
+    isUsedAsRegExp() and
+    // is not inside a minified file.
+    not getRootTerm().getParent().(Expr).getTopLevel().isMinified()
   }
 }
 

From 11f35a5193b0a024c15cc644790404ab13dcfbea Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Thu, 21 Jan 2021 23:11:50 +0100
Subject: [PATCH 273/343] Update
 javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll

Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
---
 .../ql/src/semmle/javascript/security/performance/ReDoSUtil.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll b/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
index ddac5984e16..ae2917920d7 100644
--- a/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
+++ b/javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll
@@ -113,7 +113,7 @@ class RegExpRoot extends RegExpTerm {
     not exists(RegExpLookbehind lbh | getRoot(lbh) = this) and
     // is actually used as a RegExp
     isUsedAsRegExp() and
-    // is not inside a minified file.
+    // pragmatic performance optimization: ignore minified files.
     not getRootTerm().getParent().(Expr).getTopLevel().isMinified()
   }
 }

From c257f6617f92a6d59ffc771669e974878f808cb5 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 22 Jan 2021 09:33:25 +0000
Subject: [PATCH 274/343] JS: Capitalize enum members in ScopeKind and
 TopLevelKind

---
 .../com/semmle/js/extractor/ASTExtractor.java |  2 +-
 .../semmle/js/extractor/HTMLExtractor.java    |  8 ++--
 .../com/semmle/js/extractor/ScopeKind.java    | 34 ++++++-------
 .../com/semmle/js/extractor/ScopeManager.java | 48 +++++++++----------
 .../semmle/js/extractor/ScriptExtractor.java  |  2 +-
 .../com/semmle/js/extractor/TopLevelKind.java | 10 ++--
 .../js/extractor/TypeScriptExtractor.java     |  2 +-
 7 files changed, 53 insertions(+), 53 deletions(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 75b26223a2a..4df5d1afb82 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -704,7 +704,7 @@ public class ASTExtractor {
                     + locationManager.getStartLine()
                     + ","
                     + locationManager.getStartColumn());
-        Scope moduleScope = scopeManager.enterScope(ScopeKind.module, moduleScopeKey, toplevelLabel);
+        Scope moduleScope = scopeManager.enterScope(ScopeKind.MODULE, moduleScopeKey, toplevelLabel);
         if (sourceType.hasNoGlobalScope()) {
           scopeManager.setImplicitVariableScope(moduleScope);
         }
diff --git a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
index ce2a28969ea..f18d3a8b337 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java
@@ -74,7 +74,7 @@ public class HTMLExtractor implements IExtractor {
           source = source.replace("<![CDATA[", "         ").replace("]]>", "   ");
           if (!source.trim().isEmpty()) {
             extractSnippet(
-                TopLevelKind.inlineScript,
+                TopLevelKind.INLINE_SCRIPT,
                 config.withSourceType(sourceType),
                 scopeManager,
                 textualExtractor,
@@ -97,7 +97,7 @@ public class HTMLExtractor implements IExtractor {
             int valueStart = attr.getValueSegment().getBegin();
             if (JS_ATTRIBUTE.matcher(attr.getName()).matches()) {
               extractSnippet(
-                  TopLevelKind.eventHandler,
+                  TopLevelKind.EVENT_HANDLER,
                   config,
                   scopeManager,
                   textualExtractor,
@@ -118,7 +118,7 @@ public class HTMLExtractor implements IExtractor {
                 }
               }
               extractSnippet(
-                  TopLevelKind.angularTemplate,
+                  TopLevelKind.ANGULAR_TEMPLATE,
                   config.withSourceType(SourceType.ANGULAR_TEMPLATE),
                   scopeManager,
                   textualExtractor,
@@ -130,7 +130,7 @@ public class HTMLExtractor implements IExtractor {
             } else if (source.startsWith("javascript:")) {
               source = source.substring(11);
               extractSnippet(
-                  TopLevelKind.javascriptUrl,
+                  TopLevelKind.JAVASCRIPT_URL,
                   config,
                   scopeManager,
                   textualExtractor,
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ScopeKind.java b/javascript/extractor/src/com/semmle/js/extractor/ScopeKind.java
index c20a5bcc265..4ac78c16ea0 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ScopeKind.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ScopeKind.java
@@ -4,23 +4,23 @@ package com.semmle.js.extractor;
  * A kind of scope, corresponding to the <code>@scope</code> type in the dbscheme.
  */
 public enum ScopeKind {
-  global(0),
-  function(1),
-  catch_(2),
-  module(3),
-  block(4),
-  for_(5),
-  forIn(6),
-  comprehensionBlock(7),
-  classExpr(8),
-  namespace(9),
-  classDecl(10),
-  interface_(11),
-  typeAlias(12),
-  mappedType(13),
-  enum_(14),
-  externalModule(15),
-  conditionalType(16);
+  GLOBAL(0),
+  FUNCTION(1),
+  CATCH(2),
+  MODULE(3),
+  BLOCK(4),
+  FOR(5),
+  FOR_IN(6),
+  COMPREHENSION_BLOCK(7),
+  CLASS_EXPR(8),
+  NAMESPACE(9),
+  CLASS_DECL(10),
+  INTERFACE(11),
+  TYPE_ALIAS(12),
+  MAPPED_TYPE(13),
+  ENUM(14),
+  EXTERNAL_MODULE(15),
+  CONDITIONAL_TYPE(16);
   
   private int value;
   
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java b/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
index eada6aa1d35..14e88a92c9d 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java
@@ -106,7 +106,7 @@ public class ScopeManager {
 
   public ScopeManager(TrapWriter trapWriter, ECMAVersion ecmaVersion) {
     this.trapWriter = trapWriter;
-    this.toplevelScope = enterScope(ScopeKind.global, trapWriter.globalID("global_scope"), null);
+    this.toplevelScope = enterScope(ScopeKind.GLOBAL, trapWriter.globalID("global_scope"), null);
     this.ecmaVersion = ecmaVersion;
     this.implicitVariableScope = toplevelScope; 
   }
@@ -176,29 +176,29 @@ public class ScopeManager {
   private static final Map<String, ScopeKind> scopeKinds = new LinkedHashMap<String, ScopeKind>();
 
   static {
-    scopeKinds.put("Program", ScopeKind.global);
-    scopeKinds.put("FunctionDeclaration", ScopeKind.function);
-    scopeKinds.put("FunctionExpression", ScopeKind.function);
-    scopeKinds.put("ArrowFunctionExpression", ScopeKind.function);
-    scopeKinds.put("CatchClause", ScopeKind.catch_);
-    scopeKinds.put("Module", ScopeKind.module);
-    scopeKinds.put("BlockStatement", ScopeKind.block);
-    scopeKinds.put("SwitchStatement", ScopeKind.block);
-    scopeKinds.put("ForStatement", ScopeKind.for_);
-    scopeKinds.put("ForInStatement", ScopeKind.forIn);
-    scopeKinds.put("ForOfStatement", ScopeKind.forIn);
-    scopeKinds.put("ComprehensionBlock", ScopeKind.comprehensionBlock);
-    scopeKinds.put("LetStatement", ScopeKind.block);
-    scopeKinds.put("LetExpression", ScopeKind.block);
-    scopeKinds.put("ClassExpression", ScopeKind.classExpr);
-    scopeKinds.put("NamespaceDeclaration", ScopeKind.namespace);
-    scopeKinds.put("ClassDeclaration", ScopeKind.classDecl);
-    scopeKinds.put("InterfaceDeclaration", ScopeKind.interface_);
-    scopeKinds.put("TypeAliasDeclaration", ScopeKind.typeAlias);
-    scopeKinds.put("MappedTypeExpr", ScopeKind.mappedType);
-    scopeKinds.put("EnumDeclaration", ScopeKind.enum_);
-    scopeKinds.put("ExternalModuleDeclaration", ScopeKind.externalModule);
-    scopeKinds.put("ConditionalTypeExpr", ScopeKind.conditionalType);
+    scopeKinds.put("Program", ScopeKind.GLOBAL);
+    scopeKinds.put("FunctionDeclaration", ScopeKind.FUNCTION);
+    scopeKinds.put("FunctionExpression", ScopeKind.FUNCTION);
+    scopeKinds.put("ArrowFunctionExpression", ScopeKind.FUNCTION);
+    scopeKinds.put("CatchClause", ScopeKind.CATCH);
+    scopeKinds.put("Module", ScopeKind.MODULE);
+    scopeKinds.put("BlockStatement", ScopeKind.BLOCK);
+    scopeKinds.put("SwitchStatement", ScopeKind.BLOCK);
+    scopeKinds.put("ForStatement", ScopeKind.FOR);
+    scopeKinds.put("ForInStatement", ScopeKind.FOR_IN);
+    scopeKinds.put("ForOfStatement", ScopeKind.FOR_IN);
+    scopeKinds.put("ComprehensionBlock", ScopeKind.COMPREHENSION_BLOCK);
+    scopeKinds.put("LetStatement", ScopeKind.BLOCK);
+    scopeKinds.put("LetExpression", ScopeKind.BLOCK);
+    scopeKinds.put("ClassExpression", ScopeKind.CLASS_EXPR);
+    scopeKinds.put("NamespaceDeclaration", ScopeKind.NAMESPACE);
+    scopeKinds.put("ClassDeclaration", ScopeKind.CLASS_DECL);
+    scopeKinds.put("InterfaceDeclaration", ScopeKind.INTERFACE);
+    scopeKinds.put("TypeAliasDeclaration", ScopeKind.TYPE_ALIAS);
+    scopeKinds.put("MappedTypeExpr", ScopeKind.MAPPED_TYPE);
+    scopeKinds.put("EnumDeclaration", ScopeKind.ENUM);
+    scopeKinds.put("ExternalModuleDeclaration", ScopeKind.EXTERNAL_MODULE);
+    scopeKinds.put("ConditionalTypeExpr", ScopeKind.CONDITIONAL_TYPE);
   }
 
   /**
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ScriptExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ScriptExtractor.java
index 637e461fdee..344c144648e 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ScriptExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ScriptExtractor.java
@@ -82,7 +82,7 @@ public class ScriptExtractor implements IExtractor {
     LoCInfo loc;
     try {
       Pair<Label, LoCInfo> res =
-          new JSExtractor(config).extract(textualExtractor, source, TopLevelKind.script, scopeManager);
+          new JSExtractor(config).extract(textualExtractor, source, TopLevelKind.SCRIPT, scopeManager);
       toplevelLabel = res.fst();
       loc = res.snd();
     } catch (ParseError e) {
diff --git a/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java b/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java
index 2755329621b..97a7d3647f9 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/TopLevelKind.java
@@ -4,11 +4,11 @@ package com.semmle.js.extractor;
  * A kind of top-level, corresponding to the <code>@toplevel</code> type in the dbscheme.
  */
 public enum TopLevelKind {
-  script(0),
-  inlineScript(1),
-  eventHandler(2),
-  javascriptUrl(3),
-  angularTemplate(4);
+  SCRIPT(0),
+  INLINE_SCRIPT(1),
+  EVENT_HANDLER(2),
+  JAVASCRIPT_URL(3),
+  ANGULAR_TEMPLATE(4);
   
   private int value;
   
diff --git a/javascript/extractor/src/com/semmle/js/extractor/TypeScriptExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/TypeScriptExtractor.java
index c1940344862..219dc46a9bc 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/TypeScriptExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/TypeScriptExtractor.java
@@ -27,7 +27,7 @@ public class TypeScriptExtractor implements IExtractor {
     try {
       FileSnippet snippet = state.getSnippets().get(sourceFile.toPath());
       SourceType sourceType = snippet != null ? snippet.getSourceType() : jsExtractor.establishSourceType(source, false);
-      TopLevelKind toplevelKind = snippet != null ? snippet.getTopLevelKind() : TopLevelKind.script;
+      TopLevelKind toplevelKind = snippet != null ? snippet.getTopLevelKind() : TopLevelKind.SCRIPT;
       return jsExtractor.extract(textualExtractor, source, toplevelKind, scopeManager, sourceType, res).snd();
     } catch (ParseError e) {
       e.setPosition(locationManager.translatePosition(e.getPosition()));

From 0ffa720d3b1e51279266928e2f234b0ab258384f Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 22 Jan 2021 09:48:11 +0000
Subject: [PATCH 275/343] JS: Capitalize other enum constants

---
 .../com/semmle/js/extractor/ASTExtractor.java | 320 +++++++++---------
 .../com/semmle/js/extractor/ExprKinds.java    |  22 +-
 .../semmle/js/extractor/TypeExprKinds.java    |  24 +-
 .../src/com/semmle/ts/ast/UnaryTypeExpr.java  |   4 +-
 .../ts/extractor/TypeScriptASTConverter.java  |   4 +-
 5 files changed, 187 insertions(+), 187 deletions(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index 4df5d1afb82..e8ff2abb5b6 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -225,31 +225,31 @@ public class ASTExtractor {
    */
   public enum IdContext {
     /** An identifier that binds to a variable. */
-    varBind,
+    VAR_BIND,
 
     /** An identifier that declares a variable. */
-    varDecl,
+    VAR_DECL,
 
     /** An identifier that declares both a variable and a type. */
-    varAndTypeDecl,
+    VAR_AND_TYPE_DECL,
 
     /**
      * An identifier that is not associated with variables or types, such as a property name and
      * statement label.
      */
-    label,
+    LABEL,
 
     /** An identifier that binds to a type (and not a variable). */
-    typeBind,
+    TYPE_BIND,
 
     /** An identifier that declares a type (and not a variable). */
-    typeDecl,
+    TYPE_DECL,
 
     /**
      * An identifier that is part of a type, but should not bind to a type name. Unlike {@link
      * #label}, this will not result in an expression.
      */
-    typeLabel,
+    TYPE_LABEL,
 
     /**
      * An identifier that refers to a variable from inside a type, i.e. the operand to a
@@ -257,16 +257,16 @@ public class ASTExtractor {
      *
      * <p>This is generally treated as a type, except a variable binding will be emitted for it.
      */
-    varInTypeBind,
+    VAR_IN_TYPE_BIND,
 
     /** An identifier that refers to a namespace from inside a type. */
-    namespaceBind,
+    NAMESPACE_BIND,
 
     /** An identifier that declares a namespace. */
-    namespaceDecl,
+    NAMESPACE_DECL,
 
     /** An identifier that declares a variable and a namespace. */
-    varAndNamespaceDecl,
+    VAR_AND_NAMESPACE_DECL,
 
     /**
      * An identifier that occurs in a type-only import.
@@ -274,7 +274,7 @@ public class ASTExtractor {
      * These may declare a type and/or a namespace, but for compatibility with our AST,
      * must be emitted as a VarDecl (with no variable binding).
      */
-    typeOnlyImport,
+    TYPE_ONLY_IMPORT,
 
     /**
      * An identifier that occurs in a type-only export.
@@ -282,10 +282,10 @@ public class ASTExtractor {
      * These may refer to a type and/or a namespace, but for compatibility with our AST,
      * must be emitted as an ExportVarAccess (with no variable binding).
      */
-    typeOnlyExport,
+    TYPE_ONLY_EXPORT,
 
     /** An identifier that declares a variable, type, and namepsace. */
-    varAndTypeAndNamespaceDecl,
+    VAR_AND_TYPE_AND_NAMESPACE_DECL,
 
     /**
      * An identifier that occurs as part of a named export, such as <tt>export { A }</tt>.
@@ -297,30 +297,30 @@ public class ASTExtractor {
      * explicitly declared, since TypeScript only emits the export code when it refers to a declared
      * variable.
      */
-    export,
+    EXPORT,
 
     /**
      * An identifier that occurs as a qualified name in a default export expression, such as
      * <tt>A</tt> in <tt>export default A.B</tt>.
      *
-     * <p>This acts like {@link #export}, except it cannot refer to a type (i.e. it must be a
+     * <p>This acts like {@link #EXPORT}, except it cannot refer to a type (i.e. it must be a
      * variable and/or a namespace).
      */
-    exportBase;
+    EXPORT_BASE;
 
     /**
-     * True if this occurs as part of a type annotation, i.e. it is {@link #typeBind} or {@link
-     * #typeDecl}, {@link #typeLabel}, {@link #varInTypeBind}, or {@link #namespaceBind}.
+     * True if this occurs as part of a type annotation, i.e. it is {@link #TYPE_BIND} or {@link
+     * #TYPE_DECL}, {@link #TYPE_LABEL}, {@link #VAR_IN_TYPE_BIND}, or {@link #NAMESPACE_BIND}.
      *
-     * <p>Does not hold for {@link #varAndTypeDecl}, {@link #typeOnlyImport}, or @{link {@link #typeOnlyExport}
+     * <p>Does not hold for {@link #VAR_AND_TYPE_DECL}, {@link #TYPE_ONLY_IMPORT}, or @{link {@link #TYPE_ONLY_EXPORT}
      * as these do not occur in type annotations.
      */
     public boolean isInsideType() {
-      return this == typeBind
-          || this == typeDecl
-          || this == typeLabel
-          || this == varInTypeBind
-          || this == namespaceBind;
+      return this == TYPE_BIND
+          || this == TYPE_DECL
+          || this == TYPE_LABEL
+          || this == VAR_IN_TYPE_BIND
+          || this == NAMESPACE_BIND;
     }
   };
 
@@ -354,11 +354,11 @@ public class ASTExtractor {
     }
 
     private Label visit(INode child, Label parent, int childIndex) {
-      return visit(child, parent, childIndex, IdContext.varBind);
+      return visit(child, parent, childIndex, IdContext.VAR_BIND);
     }
 
     private Label visitAll(List<? extends INode> children, Label parent) {
-      return visitAll(children, parent, IdContext.varBind, 0);
+      return visitAll(children, parent, IdContext.VAR_BIND, 0);
     }
 
     private Label visit(INode child, Label parent, int childIndex, IdContext idContext) {
@@ -441,7 +441,7 @@ public class ASTExtractor {
     public Label visit(InvokeExpression nd, Context c) {
       Label key = super.visit(nd, c);
       visit(nd.getCallee(), key, -1);
-      visitAll(nd.getTypeArguments(), key, IdContext.typeBind, -2, -1);
+      visitAll(nd.getTypeArguments(), key, IdContext.TYPE_BIND, -2, -1);
       visitAll(nd.getArguments(), key);
       if (nd.getResolvedSignatureId() != -1) {
         Label signature = trapwriter.globalID("signature;" + nd.getResolvedSignatureId());
@@ -496,51 +496,51 @@ public class ASTExtractor {
       emitNodeSymbol(nd, key);
       trapwriter.addTuple("literals", name, name, key);
       switch (c.idcontext) {
-        case varBind:
-        case varInTypeBind:
+        case VAR_BIND:
+        case VAR_IN_TYPE_BIND:
           addVariableBinding("bind", key, name);
           break;
-        case varDecl:
+        case VAR_DECL:
           addVariableBinding("decl", key, name);
           break;
-        case varAndTypeDecl:
+        case VAR_AND_TYPE_DECL:
           addVariableBinding("decl", key, name);
           addTypeBinding("typedecl", key, name);
           break;
-        case typeBind:
+        case TYPE_BIND:
           addTypeBinding("typebind", key, name);
           break;
-        case typeDecl:
+        case TYPE_DECL:
           addTypeBinding("typedecl", key, name);
           break;
-        case namespaceBind:
+        case NAMESPACE_BIND:
           addNamespaceBinding("namespacebind", key, name);
           break;
-        case namespaceDecl:
+        case NAMESPACE_DECL:
           addNamespaceBinding("namespacedecl", key, name);
           break;
-        case varAndNamespaceDecl:
+        case VAR_AND_NAMESPACE_DECL:
           addVariableBinding("decl", key, name);
           addNamespaceBinding("namespacedecl", key, name);
           break;
-        case typeOnlyImport:
+        case TYPE_ONLY_IMPORT:
           addTypeBinding("typedecl", key, name);
           addNamespaceBinding("namespacedecl", key, name);
           break;
-        case typeOnlyExport:
+        case TYPE_ONLY_EXPORT:
           addTypeBinding("typebind", key, name);
           addNamespaceBinding("namespacebind", key, name);
           break;
-        case varAndTypeAndNamespaceDecl:
+        case VAR_AND_TYPE_AND_NAMESPACE_DECL:
           addVariableBinding("decl", key, name);
           addTypeBinding("typedecl", key, name);
           addNamespaceBinding("namespacedecl", key, name);
           break;
-        case export:
-        case exportBase:
+        case EXPORT:
+        case EXPORT_BASE:
           // At the time of writing, this kind of export is only allowed at the top-level.
           boolean resolved = false;
-          if (c.idcontext != IdContext.exportBase) {
+          if (c.idcontext != IdContext.EXPORT_BASE) {
             resolved |= addTypeBinding("typebind", key, name);
           }
           resolved |= addNamespaceBinding("namespacebind", key, name);
@@ -549,8 +549,8 @@ public class ASTExtractor {
             addVariableBinding("bind", key, name);
           }
           break;
-        case label:
-        case typeLabel:
+        case LABEL:
+        case TYPE_LABEL:
           break;
       }
       return key;
@@ -662,20 +662,20 @@ public class ASTExtractor {
 
         // The context can either be typeBind, namespaceBind, or varInTypeBind.
         IdContext baseIdContext =
-            c.idcontext == IdContext.varInTypeBind
-                ? IdContext.varInTypeBind
-                : IdContext.namespaceBind;
+            c.idcontext == IdContext.VAR_IN_TYPE_BIND
+                ? IdContext.VAR_IN_TYPE_BIND
+                : IdContext.NAMESPACE_BIND;
         visit(nd.getObject(), key, 0, baseIdContext);
 
         // Ensure the property name is not a TypeAccess, since this would create two
         // TypeAccesses from the same type usage, easily leading to duplicate query
         // results. The qualified access is the one we prefer to select.
-        visit(nd.getProperty(), key, 1, IdContext.typeLabel);
+        visit(nd.getProperty(), key, 1, IdContext.TYPE_LABEL);
       } else {
         IdContext baseIdContext =
-            c.idcontext == IdContext.export ? IdContext.exportBase : IdContext.varBind;
+            c.idcontext == IdContext.EXPORT ? IdContext.EXPORT_BASE : IdContext.VAR_BIND;
         visit(nd.getObject(), key, 0, baseIdContext);
-        visit(nd.getProperty(), key, 1, nd.isComputed() ? IdContext.varBind : IdContext.label);
+        visit(nd.getProperty(), key, 1, nd.isComputed() ? IdContext.VAR_BIND : IdContext.LABEL);
       }
       if (nd.isOptional()) {
         trapwriter.addTuple("isOptionalChaining", key);
@@ -781,7 +781,7 @@ public class ASTExtractor {
           scopeManager.collectDeclaredNames(nd.getLeft(), isStrict, true, DeclKind.var);
       scopeManager.enterScope(nd);
       scopeManager.addNames(lexicals);
-      visit(nd.getLeft(), key, 0, IdContext.varDecl);
+      visit(nd.getLeft(), key, 0, IdContext.VAR_DECL);
       visit(nd.getRight(), key, 1);
       return key;
     }
@@ -789,7 +789,7 @@ public class ASTExtractor {
     @Override
     public Label visit(ComprehensionExpression nd, Context c) {
       Label key = super.visit(nd, c);
-      visitAll(nd.getBlocks(), key, IdContext.varBind, 1);
+      visitAll(nd.getBlocks(), key, IdContext.VAR_BIND, 1);
       visit(nd.getFilter(), key, -1);
       visit(nd.getBody(), key, 0);
       for (int i = nd.getBlocks().size(); i > 0; --i) scopeManager.leaveScope();
@@ -863,7 +863,7 @@ public class ASTExtractor {
       scopeManager.enterScope(nd);
       scopeManager.addNames(lexicals);
       visitAll(head, key);
-      visit(body, key, -1, IdContext.varBind);
+      visit(body, key, -1, IdContext.VAR_BIND);
       scopeManager.leaveScope();
       return key;
     }
@@ -871,9 +871,9 @@ public class ASTExtractor {
     @Override
     public Label visit(VariableDeclarator nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getId(), key, 0, IdContext.varDecl);
+      visit(nd.getId(), key, 0, IdContext.VAR_DECL);
       visit(nd.getInit(), key, 1);
-      visit(nd.getTypeAnnotation(), key, 2, IdContext.typeBind);
+      visit(nd.getTypeAnnotation(), key, 2, IdContext.TYPE_BIND);
       for (int i = 0; i < DeclarationFlags.numberOfFlags; ++i) {
         if (DeclarationFlags.hasNthFlag(nd.getFlags(), i)) {
           trapwriter.addTuple(DeclarationFlags.relationNames.get(i), key);
@@ -931,7 +931,7 @@ public class ASTExtractor {
 
       // The name of a function declaration binds to the outer scope.
       if (nd instanceof FunctionDeclaration) {
-        visit(nd.getId(), key, -1, IdContext.varDecl);
+        visit(nd.getId(), key, -1, IdContext.VAR_DECL);
       }
 
       DeclaredNames locals =
@@ -943,7 +943,7 @@ public class ASTExtractor {
       // The name of a function expression binds to its own scope.
       if (nd.getId() != null && nd instanceof AFunctionExpression) {
         scopeManager.addVariables(nd.getId().getName());
-        visit(nd.getId(), key, -1, IdContext.varDecl);
+        visit(nd.getId(), key, -1, IdContext.VAR_DECL);
       }
 
       for (TypeParameter tp : nd.getTypeParameters()) {
@@ -954,7 +954,7 @@ public class ASTExtractor {
       for (IPattern param : nd.getAllParams()) {
         scopeManager.addNames(
             scopeManager.collectDeclaredNames(param, isStrict, false, DeclKind.var));
-        Label paramKey = visit(param, key, i, IdContext.varDecl);
+        Label paramKey = visit(param, key, i, IdContext.VAR_DECL);
 
         // Extract optional parameters
         if (nd.getOptionalParameterIndices().contains(i)) {
@@ -971,10 +971,10 @@ public class ASTExtractor {
       }
 
       // add return type at index -3
-      visit(nd.getReturnType(), key, -3, IdContext.typeBind);
+      visit(nd.getReturnType(), key, -3, IdContext.TYPE_BIND);
 
       // add 'this' type at index -4
-      visit(nd.getThisParameterType(), key, -4, IdContext.typeBind);
+      visit(nd.getThisParameterType(), key, -4, IdContext.TYPE_BIND);
 
       // add parameter stuff at index -5 and down
       extractParameterDefaultsAndTypes(nd, key, i);
@@ -1003,12 +1003,12 @@ public class ASTExtractor {
         if (nd.hasDefault(j)) this.visit(nd.getDefault(j), key, -(4 * j + 5));
         // parameter type annotations are populated at indices -6, -10, ...
         if (nd.hasParameterType(j))
-          this.visit(nd.getParameterType(j), key, -(4 * j + 6), IdContext.typeBind);
+          this.visit(nd.getParameterType(j), key, -(4 * j + 6), IdContext.TYPE_BIND);
       }
       // type parameters are at indices -7, -11, -15, ...
-      visitAll(nd.getTypeParameters(), key, IdContext.typeDecl, -7, -4);
+      visitAll(nd.getTypeParameters(), key, IdContext.TYPE_DECL, -7, -4);
       // parameter decorators are at indices -8, -12, -16, ...
-      visitAll(nd.getParameterDecorators(), key, IdContext.varBind, -8, -4);
+      visitAll(nd.getParameterDecorators(), key, IdContext.VAR_BIND, -8, -4);
     }
 
     @Override
@@ -1061,14 +1061,14 @@ public class ASTExtractor {
        */
       if (!lexicals.isEmpty()) {
         VariableDeclaration decl = (VariableDeclaration) nd.getInit();
-        Label declkey = visit((Statement) decl, new Context(key, 0, IdContext.varBind));
+        Label declkey = visit((Statement) decl, new Context(key, 0, IdContext.VAR_BIND));
         int idx = 0;
         for (VariableDeclarator declarator : decl.getDeclarations()) {
           Label declaratorKey =
-              visit((Expression) declarator, new Context(declkey, idx++, IdContext.varBind));
+              visit((Expression) declarator, new Context(declkey, idx++, IdContext.VAR_BIND));
 
           // the 'let' bound variable lives in the new scope
-          visit(declarator.getId(), declaratorKey, 0, IdContext.varDecl);
+          visit(declarator.getId(), declaratorKey, 0, IdContext.VAR_DECL);
 
           // but its initialiser does not
           scopeManager.leaveScope();
@@ -1110,7 +1110,7 @@ public class ASTExtractor {
     @Override
     public Label visit(ArrayExpression nd, Context c) {
       Label key = super.visit(nd, c);
-      visitAll(nd.getElements(), key, IdContext.varBind, 0);
+      visitAll(nd.getElements(), key, IdContext.VAR_BIND, 0);
       trapwriter.addTuple("array_size", key, nd.getElements().size());
       return key;
     }
@@ -1120,7 +1120,7 @@ public class ASTExtractor {
       Label key = super.visit(nd, c);
       visitAll(nd.getElements(), key, c.idcontext, 0);
       visit(nd.getRest(), key, -1, c.idcontext);
-      visitAll(nd.getDefaults(), key, IdContext.varBind, -2, -1);
+      visitAll(nd.getDefaults(), key, IdContext.VAR_BIND, -2, -1);
       trapwriter.addTuple("array_size", key, nd.getElements().size());
       return key;
     }
@@ -1136,7 +1136,7 @@ public class ASTExtractor {
     @Override
     public Label visit(ObjectExpression nd, Context c) {
       Label key = super.visit(nd, c);
-      visitAll(nd.getProperties(), key, IdContext.varBind, 0);
+      visitAll(nd.getProperties(), key, IdContext.VAR_BIND, 0);
       return key;
     }
 
@@ -1147,10 +1147,10 @@ public class ASTExtractor {
       String tostring = lexicalExtractor.mkToString(nd);
       trapwriter.addTuple("properties", propkey, c.parent, c.childIndex, kind, tostring);
       locationManager.emitNodeLocation(nd, propkey);
-      visitAll(nd.getDecorators(), propkey, IdContext.varBind, -1, -1);
-      visit(nd.getKey(), propkey, 0, nd.isComputed() ? IdContext.varBind : IdContext.label);
+      visitAll(nd.getDecorators(), propkey, IdContext.VAR_BIND, -1, -1);
+      visit(nd.getKey(), propkey, 0, nd.isComputed() ? IdContext.VAR_BIND : IdContext.LABEL);
       Label valueLabel = visit(nd.getValue(), propkey, 1, c.idcontext);
-      visit(nd.getDefaultValue(), propkey, 2, IdContext.varBind);
+      visit(nd.getDefaultValue(), propkey, 2, IdContext.VAR_BIND);
       if (nd.isComputed()) trapwriter.addTuple("is_computed", propkey);
       if (nd.isMethod()) trapwriter.addTuple("is_method", propkey);
 
@@ -1243,7 +1243,7 @@ public class ASTExtractor {
     @Override
     public Label visit(LabeledStatement nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getLabel(), key, 0, IdContext.label);
+      visit(nd.getLabel(), key, 0, IdContext.LABEL);
       contextManager.enterLabeledStatement(nd);
       visit(nd.getBody(), key, 1);
       contextManager.leaveLabeledStatement(nd);
@@ -1285,7 +1285,7 @@ public class ASTExtractor {
       if (nd.getParam() != null) {
         scopeManager.addNames(
             scopeManager.collectDeclaredNames(nd.getParam(), isStrict, false, DeclKind.var));
-        visit(nd.getParam(), key, 0, IdContext.varDecl);
+        visit(nd.getParam(), key, 0, IdContext.VAR_DECL);
       }
       visit(nd.getGuard(), key, 2);
       visit(nd.getBody(), key, 1);
@@ -1297,7 +1297,7 @@ public class ASTExtractor {
     public Label visit(TryStatement nd, Context c) {
       Label key = super.visit(nd, c);
       visit(nd.getBlock(), key, 0);
-      visitAll(nd.getAllHandlers(), key, IdContext.varBind, 1);
+      visitAll(nd.getAllHandlers(), key, IdContext.VAR_BIND, 1);
       visit(nd.getFinalizer(), key, -1);
       return key;
     }
@@ -1305,7 +1305,7 @@ public class ASTExtractor {
     @Override
     public Label visit(JumpStatement nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getLabel(), key, 0, IdContext.label);
+      visit(nd.getLabel(), key, 0, IdContext.LABEL);
       Label targetKey = trapwriter.localID(contextManager.getTarget(nd));
       trapwriter.addTuple("jump_targets", key, targetKey);
       return key;
@@ -1314,28 +1314,28 @@ public class ASTExtractor {
     @Override
     public Label visit(ReturnStatement nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getArgument(), key, 0, IdContext.varBind);
+      visit(nd.getArgument(), key, 0, IdContext.VAR_BIND);
       return key;
     }
 
     @Override
     public Label visit(ThrowStatement nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getArgument(), key, 0, IdContext.varBind);
+      visit(nd.getArgument(), key, 0, IdContext.VAR_BIND);
       return key;
     }
 
     @Override
     public Label visit(SequenceExpression nd, Context c) {
       Label key = super.visit(nd, c);
-      visitAll(nd.getExpressions(), key, IdContext.varBind, 0);
+      visitAll(nd.getExpressions(), key, IdContext.VAR_BIND, 0);
       return key;
     }
 
     @Override
     public Label visit(ParenthesizedExpression nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getExpression(), key, 0, IdContext.varBind);
+      visit(nd.getExpression(), key, 0, IdContext.VAR_BIND);
       return key;
     }
 
@@ -1344,21 +1344,21 @@ public class ASTExtractor {
       Label key = super.visit(nd, c);
       visit(nd.getTag(), key, 0);
       visit(nd.getQuasi(), key, 1);
-      visitAll(nd.getTypeArguments(), key, IdContext.typeBind, 2);
+      visitAll(nd.getTypeArguments(), key, IdContext.TYPE_BIND, 2);
       return key;
     }
 
     @Override
     public Label visit(TemplateLiteral nd, Context c) {
       Label key = super.visit(nd, c);
-      visitAll(nd.getChildren(), key, IdContext.varBind, 0);
+      visitAll(nd.getChildren(), key, IdContext.VAR_BIND, 0);
       return key;
     }
 
     @Override
     public Label visit(TemplateLiteralTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visitAll(nd.getChildren(), key, IdContext.typeBind, 0);
+      visitAll(nd.getChildren(), key, IdContext.TYPE_BIND, 0);
       return key;
     }
 
@@ -1393,18 +1393,18 @@ public class ASTExtractor {
     @Override
     public Label visit(TypeParameter nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getId(), key, 0, IdContext.typeDecl);
-      visit(nd.getBound(), key, 1, IdContext.typeBind);
-      visit(nd.getDefault(), key, 2, IdContext.typeBind);
+      visit(nd.getId(), key, 0, IdContext.TYPE_DECL);
+      visit(nd.getBound(), key, 1, IdContext.TYPE_BIND);
+      visit(nd.getDefault(), key, 2, IdContext.TYPE_BIND);
       return key;
     }
 
     private Label visit(AClass ac, Label key, Node scopeNode, boolean isClassExpression) {
-      visitAll(ac.getDecorators(), key, IdContext.varBind, -2, -3);
+      visitAll(ac.getDecorators(), key, IdContext.VAR_BIND, -2, -3);
       // The identifier of a class declaration is visited before entering the
       // class scope, since it must resolve to the enclosing block, not its own scope.
       if (!isClassExpression) {
-        visit(ac.getId(), key, 0, IdContext.varAndTypeDecl);
+        visit(ac.getId(), key, 0, IdContext.VAR_AND_TYPE_DECL);
       }
       if (ac.hasId() || ac.hasTypeParameters()) {
         scopeManager.enterScope(scopeNode);
@@ -1420,10 +1420,10 @@ public class ASTExtractor {
         }
       }
       if (isClassExpression) {
-        visit(ac.getId(), key, 0, IdContext.varAndTypeDecl);
+        visit(ac.getId(), key, 0, IdContext.VAR_AND_TYPE_DECL);
       }
-      visitAll(ac.getTypeParameters(), key, IdContext.typeDecl, -3, -3);
-      visitAll(ac.getSuperInterfaces(), key, IdContext.typeBind, -1, -3);
+      visitAll(ac.getTypeParameters(), key, IdContext.TYPE_DECL, -3, -3);
+      visitAll(ac.getSuperInterfaces(), key, IdContext.TYPE_BIND, -1, -3);
       visit(ac.getSuperClass(), key, 1);
       MethodDefinition constructor = ac.getBody().getConstructor();
       if (constructor == null) {
@@ -1450,7 +1450,7 @@ public class ASTExtractor {
       Label lbl = super.visit(nd, c);
       emitNodeSymbol(nd, lbl);
       IdContext context =
-          nd.isInstantiated() ? IdContext.varAndNamespaceDecl : IdContext.namespaceDecl;
+          nd.isInstantiated() ? IdContext.VAR_AND_NAMESPACE_DECL : IdContext.NAMESPACE_DECL;
       visit(nd.getName(), lbl, -1, context);
       if (nd.hasDeclareKeyword()) {
         trapwriter.addTuple("has_declare_keyword", lbl);
@@ -1596,7 +1596,7 @@ public class ASTExtractor {
       String tostring = lexicalExtractor.mkToString(nd);
       trapwriter.addTuple("properties", methkey, c.parent, c.childIndex, kind, tostring);
       locationManager.emitNodeLocation(nd, methkey);
-      visitAll(nd.getDecorators(), methkey, IdContext.varBind, -1, -1);
+      visitAll(nd.getDecorators(), methkey, IdContext.VAR_BIND, -1, -1);
 
       // the name and initialiser expression of an instance field is evaluated as part of
       // the constructor, so we adjust our syntactic context to reflect this
@@ -1607,7 +1607,7 @@ public class ASTExtractor {
         constructorKey = trapwriter.localID(ctor.getValue());
         contextManager.enterContainer(constructorKey);
       }
-      visit(nd.getKey(), methkey, 0, nd.isComputed() ? IdContext.varBind : IdContext.label);
+      visit(nd.getKey(), methkey, 0, nd.isComputed() ? IdContext.VAR_BIND : IdContext.LABEL);
       visit(nd.getValue(), methkey, 1, c.idcontext);
       if (ctor != null) contextManager.leaveContainer();
 
@@ -1626,7 +1626,7 @@ public class ASTExtractor {
           trapwriter.addTuple(
               "parameter_fields", methkey, constructorKey, field.getFieldParameterIndex());
         } else {
-          visit(field.getTypeAnnotation(), methkey, 2, IdContext.typeBind);
+          visit(field.getTypeAnnotation(), methkey, 2, IdContext.TYPE_BIND);
         }
       }
 
@@ -1652,7 +1652,7 @@ public class ASTExtractor {
     @Override
     public Label visit(ExportDefaultDeclaration nd, Context c) {
       Label lbl = super.visit(nd, c);
-      visit(nd.getDeclaration(), lbl, 0, IdContext.export);
+      visit(nd.getDeclaration(), lbl, 0, IdContext.EXPORT);
       return lbl;
     }
 
@@ -1662,9 +1662,9 @@ public class ASTExtractor {
       visit(nd.getDeclaration(), lbl, -1);
       visit(nd.getSource(), lbl, -2);
       IdContext childContext =
-          nd.hasSource() ? IdContext.label :
-          nd.hasTypeKeyword() ? IdContext.typeOnlyExport :
-          IdContext.export;
+          nd.hasSource() ? IdContext.LABEL :
+          nd.hasTypeKeyword() ? IdContext.TYPE_ONLY_EXPORT :
+          IdContext.EXPORT;
       visitAll(nd.getSpecifiers(), lbl, childContext, 0);
       if (nd.hasTypeKeyword()) {
         trapwriter.addTuple("has_type_keyword", lbl);
@@ -1676,7 +1676,7 @@ public class ASTExtractor {
     public Label visit(ExportSpecifier nd, Context c) {
       Label lbl = super.visit(nd, c);
       visit(nd.getLocal(), lbl, 0, c.idcontext);
-      visit(nd.getExported(), lbl, 1, IdContext.label);
+      visit(nd.getExported(), lbl, 1, IdContext.LABEL);
       return lbl;
     }
 
@@ -1684,7 +1684,7 @@ public class ASTExtractor {
     public Label visit(ImportDeclaration nd, Context c) {
       Label lbl = super.visit(nd, c);
       visit(nd.getSource(), lbl, -1);
-      IdContext childContext = nd.hasTypeKeyword() ? IdContext.typeOnlyImport : IdContext.varAndTypeAndNamespaceDecl;
+      IdContext childContext = nd.hasTypeKeyword() ? IdContext.TYPE_ONLY_IMPORT : IdContext.VAR_AND_TYPE_AND_NAMESPACE_DECL;
       visitAll(nd.getSpecifiers(), lbl, childContext, 0);
       emitNodeSymbol(nd, lbl);
       if (nd.hasTypeKeyword()) {
@@ -1696,7 +1696,7 @@ public class ASTExtractor {
     @Override
     public Label visit(ImportSpecifier nd, Context c) {
       Label lbl = super.visit(nd, c);
-      visit(nd.getImported(), lbl, 0, IdContext.label);
+      visit(nd.getImported(), lbl, 0, IdContext.LABEL);
       visit(nd.getLocal(), lbl, 1, c.idcontext);
       return lbl;
     }
@@ -1716,9 +1716,9 @@ public class ASTExtractor {
        * A spread attribute is represented as an attribute without
        * a name, whose value is a spread element.
        */
-      visit(name, lbl, -1, isTagName(name) ? IdContext.label : IdContext.varBind);
-      visitAll(open.getAttributes(), lbl, IdContext.varBind, 0, 1);
-      visitAll(nd.getChildren(), lbl, IdContext.varBind, -2, -1);
+      visit(name, lbl, -1, isTagName(name) ? IdContext.LABEL : IdContext.VAR_BIND);
+      visitAll(open.getAttributes(), lbl, IdContext.VAR_BIND, 0, 1);
+      visitAll(nd.getChildren(), lbl, IdContext.VAR_BIND, -2, -1);
       return lbl;
     }
 
@@ -1748,15 +1748,15 @@ public class ASTExtractor {
     public Label visit(JSXMemberExpression nd, Context c) {
       Label key = super.visit(nd, c);
       visit(nd.getObject(), key, 0);
-      visit(nd.getName(), key, 1, IdContext.label);
+      visit(nd.getName(), key, 1, IdContext.LABEL);
       return key;
     }
 
     @Override
     public Label visit(JSXNamespacedName nd, Context c) {
       Label lbl = super.visit(nd, c);
-      visit(nd.getNamespace(), lbl, 0, IdContext.label);
-      visit(nd.getName(), lbl, 1, IdContext.label);
+      visit(nd.getNamespace(), lbl, 0, IdContext.LABEL);
+      visit(nd.getName(), lbl, 1, IdContext.LABEL);
       return lbl;
     }
 
@@ -1766,7 +1766,7 @@ public class ASTExtractor {
       String tostring = lexicalExtractor.mkToString(nd);
       trapwriter.addTuple("properties", propkey, c.parent, c.childIndex, 3, tostring);
       locationManager.emitNodeLocation(nd, propkey);
-      visit(nd.getName(), propkey, 0, IdContext.label);
+      visit(nd.getName(), propkey, 0, IdContext.LABEL);
       visit(nd.getValue(), propkey, 1, c.idcontext);
       return propkey;
     }
@@ -1789,7 +1789,7 @@ public class ASTExtractor {
       // now populate the spread expression, stripping off the surrounding
       // braces for its tostring
       tostring = tostring.substring(1, tostring.length() - 1).trim();
-      Label valkey = visit(nd, 66, tostring, new Context(propkey, 1, IdContext.varBind));
+      Label valkey = visit(nd, 66, tostring, new Context(propkey, 1, IdContext.VAR_BIND));
       visit(nd.getArgument(), valkey, 0);
       return propkey;
     }
@@ -1829,15 +1829,15 @@ public class ASTExtractor {
     @Override
     public Label visit(ImportWholeDeclaration nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getLhs(), key, 0, IdContext.varAndTypeAndNamespaceDecl);
-      visit(nd.getRhs(), key, 1, IdContext.export);
+      visit(nd.getLhs(), key, 0, IdContext.VAR_AND_TYPE_AND_NAMESPACE_DECL);
+      visit(nd.getRhs(), key, 1, IdContext.EXPORT);
       return key;
     }
 
     @Override
     public Label visit(ExportWholeDeclaration nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getRhs(), key, 0, IdContext.export);
+      visit(nd.getRhs(), key, 0, IdContext.EXPORT);
       return key;
     }
 
@@ -1865,10 +1865,10 @@ public class ASTExtractor {
           scopeManager.addTypeName(tp.getId().getName());
         }
       }
-      visitAll(nd.getTypeParameters(), key, IdContext.typeBind, -2, -2);
-      visitAll(nd.getSuperInterfaces(), key, IdContext.typeBind, -1, -2);
-      visit(nd.getName(), key, 0, IdContext.typeDecl);
-      visitAll(nd.getBody(), key, IdContext.label, 2);
+      visitAll(nd.getTypeParameters(), key, IdContext.TYPE_BIND, -2, -2);
+      visitAll(nd.getSuperInterfaces(), key, IdContext.TYPE_BIND, -1, -2);
+      visit(nd.getName(), key, 0, IdContext.TYPE_DECL);
+      visitAll(nd.getBody(), key, IdContext.LABEL, 2);
       if (nd.hasTypeParameters()) {
         scopeManager.leaveScope();
       }
@@ -1886,36 +1886,36 @@ public class ASTExtractor {
     @Override
     public Label visit(ArrayTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getElementType(), key, 0, IdContext.typeBind);
+      visit(nd.getElementType(), key, 0, IdContext.TYPE_BIND);
       return key;
     }
 
     @Override
     public Label visit(UnionTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visitAll(nd.getElementTypes(), key, IdContext.typeBind, 0);
+      visitAll(nd.getElementTypes(), key, IdContext.TYPE_BIND, 0);
       return key;
     }
 
     @Override
     public Label visit(IndexedAccessTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getObjectType(), key, 0, IdContext.typeBind);
-      visit(nd.getIndexType(), key, 1, IdContext.typeBind);
+      visit(nd.getObjectType(), key, 0, IdContext.TYPE_BIND);
+      visit(nd.getIndexType(), key, 1, IdContext.TYPE_BIND);
       return key;
     }
 
     @Override
     public Label visit(IntersectionTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visitAll(nd.getElementTypes(), key, IdContext.typeBind, 0);
+      visitAll(nd.getElementTypes(), key, IdContext.TYPE_BIND, 0);
       return key;
     }
 
     @Override
     public Label visit(ParenthesizedTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getElementType(), key, 0, IdContext.typeBind);
+      visit(nd.getElementType(), key, 0, IdContext.TYPE_BIND);
       return key;
     }
 
@@ -1924,39 +1924,39 @@ public class ASTExtractor {
       Label key = super.visit(nd, c);
       if (nd.getElementNames() != null) {
         // Element names are index -1, -2, -3...
-        visitAll(nd.getElementNames(), key, IdContext.typeLabel, -1, -1);
+        visitAll(nd.getElementNames(), key, IdContext.TYPE_LABEL, -1, -1);
       }
-      visitAll(nd.getElementTypes(), key, IdContext.typeBind, 0);
+      visitAll(nd.getElementTypes(), key, IdContext.TYPE_BIND, 0);
       return key;
     }
 
     @Override
     public Label visit(UnaryTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getElementType(), key, 0, IdContext.typeBind);
+      visit(nd.getElementType(), key, 0, IdContext.TYPE_BIND);
       return key;
     }
 
     @Override
     public Label visit(GenericTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getTypeName(), key, -1, IdContext.typeBind);
-      visitAll(nd.getTypeArguments(), key, IdContext.typeBind, 0);
+      visit(nd.getTypeName(), key, -1, IdContext.TYPE_BIND);
+      visitAll(nd.getTypeArguments(), key, IdContext.TYPE_BIND, 0);
       return key;
     }
 
     @Override
     public Label visit(TypeofTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getExpression(), key, 0, IdContext.varInTypeBind);
+      visit(nd.getExpression(), key, 0, IdContext.VAR_IN_TYPE_BIND);
       return key;
     }
 
     @Override
     public Label visit(PredicateTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getExpression(), key, 0, IdContext.varInTypeBind);
-      visit(nd.getTypeExpr(), key, 1, IdContext.typeBind);
+      visit(nd.getExpression(), key, 0, IdContext.VAR_IN_TYPE_BIND);
+      visit(nd.getTypeExpr(), key, 1, IdContext.TYPE_BIND);
       if (nd.hasAssertsKeyword()) {
         trapwriter.addTuple("has_asserts_keyword", key);
       }
@@ -1973,8 +1973,8 @@ public class ASTExtractor {
     @Override
     public Label visit(ExpressionWithTypeArguments nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getExpression(), key, -1, IdContext.varBind);
-      visitAll(nd.getTypeArguments(), key, IdContext.typeBind, 0);
+      visit(nd.getExpression(), key, -1, IdContext.VAR_BIND);
+      visitAll(nd.getTypeArguments(), key, IdContext.TYPE_BIND, 0);
       return key;
     }
 
@@ -1989,7 +1989,7 @@ public class ASTExtractor {
     public Label visit(TypeAssertion nd, Context c) {
       Label key = super.visit(nd, c);
       visit(nd.getExpression(), key, 0);
-      visit(nd.getTypeAnnotation(), key, 1, IdContext.typeBind);
+      visit(nd.getTypeAnnotation(), key, 1, IdContext.TYPE_BIND);
       return key;
     }
 
@@ -1998,8 +1998,8 @@ public class ASTExtractor {
       Label key = super.visit(nd, c);
       scopeManager.enterScope(nd);
       scopeManager.addTypeName(nd.getTypeParameter().getId().getName());
-      visit(nd.getTypeParameter(), key, 0, IdContext.typeDecl);
-      visit(nd.getElementType(), key, 1, IdContext.typeBind);
+      visit(nd.getTypeParameter(), key, 0, IdContext.TYPE_DECL);
+      visit(nd.getElementType(), key, 1, IdContext.TYPE_BIND);
       scopeManager.leaveScope();
       return key;
     }
@@ -2007,15 +2007,15 @@ public class ASTExtractor {
     @Override
     public Label visit(TypeAliasDeclaration nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getId(), key, 0, IdContext.typeDecl);
+      visit(nd.getId(), key, 0, IdContext.TYPE_DECL);
       if (nd.hasTypeParameters()) {
         scopeManager.enterScope(nd);
         for (TypeParameter tp : nd.getTypeParameters()) {
           scopeManager.addTypeName(tp.getId().getName());
         }
       }
-      visitAll(nd.getTypeParameters(), key, IdContext.typeDecl, 2, 1);
-      visit(nd.getDefinition(), key, 1, IdContext.typeBind);
+      visitAll(nd.getTypeParameters(), key, IdContext.TYPE_DECL, 2, 1);
+      visit(nd.getDefinition(), key, 1, IdContext.TYPE_BIND);
       if (nd.hasTypeParameters()) {
         scopeManager.leaveScope();
       }
@@ -2026,14 +2026,14 @@ public class ASTExtractor {
     @Override
     public Label visit(EnumDeclaration nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getId(), key, 0, IdContext.varAndTypeAndNamespaceDecl);
-      visitAll(nd.getDecorators(), key, IdContext.varBind, -1, -1);
+      visit(nd.getId(), key, 0, IdContext.VAR_AND_TYPE_AND_NAMESPACE_DECL);
+      visitAll(nd.getDecorators(), key, IdContext.VAR_BIND, -1, -1);
       scopeManager.enterScope(nd);
       for (EnumMember member : nd.getMembers()) {
         scopeManager.addVariables(member.getId().getName());
         scopeManager.addTypeName(member.getId().getName());
       }
-      visitAll(nd.getMembers(), key, IdContext.varAndTypeDecl, 1, 1);
+      visitAll(nd.getMembers(), key, IdContext.VAR_AND_TYPE_DECL, 1, 1);
       scopeManager.leaveScope();
       if (nd.isConst()) {
         trapwriter.addTuple("is_const_enum", key);
@@ -2051,8 +2051,8 @@ public class ASTExtractor {
       String tostring = lexicalExtractor.mkToString(nd);
       trapwriter.addTuple("properties", key, c.parent, c.childIndex, 7, tostring);
       locationManager.emitNodeLocation(nd, key);
-      visit(nd.getId(), key, 0, IdContext.varAndTypeDecl);
-      visit(nd.getInitializer(), key, 1, IdContext.varBind);
+      visit(nd.getId(), key, 0, IdContext.VAR_AND_TYPE_DECL);
+      visit(nd.getInitializer(), key, 1, IdContext.VAR_BIND);
       emitNodeSymbol(nd, key);
       return key;
     }
@@ -2061,7 +2061,7 @@ public class ASTExtractor {
     public Label visit(ExternalModuleDeclaration nd, Context c) {
       Label key = super.visit(nd, c);
       trapwriter.addTuple("has_declare_keyword", key);
-      visit(nd.getName(), key, -1, IdContext.label);
+      visit(nd.getName(), key, -1, IdContext.LABEL);
       DeclaredNames hoistedVars =
           scopeManager.collectDeclaredNames(nd.getBody(), isStrict, false, DeclKind.none);
       DeclaredNames lexicalVars =
@@ -2079,14 +2079,14 @@ public class ASTExtractor {
     @Override
     public Label visit(ExportAsNamespaceDeclaration nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getId(), key, 0, IdContext.label);
+      visit(nd.getId(), key, 0, IdContext.LABEL);
       return key;
     }
 
     @Override
     public Label visit(DecoratorList nd, Context c) {
       Label key = super.visit(nd, c);
-      visitAll(nd.getDecorators(), key, IdContext.varBind, 0);
+      visitAll(nd.getDecorators(), key, IdContext.VAR_BIND, 0);
       return key;
     }
 
@@ -2130,53 +2130,53 @@ public class ASTExtractor {
     @Override
     public Label visit(ConditionalTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getCheckType(), key, 0, IdContext.typeBind);
+      visit(nd.getCheckType(), key, 0, IdContext.TYPE_BIND);
       Set<String> boundTypes = scopeManager.collectDeclaredInferTypes(nd.getExtendsType());
       if (!boundTypes.isEmpty()) {
         scopeManager.enterScope(nd);
         scopeManager.addTypeNames(boundTypes);
       }
-      visit(nd.getExtendsType(), key, 1, IdContext.typeBind);
-      visit(nd.getTrueType(), key, 2, IdContext.typeBind);
+      visit(nd.getExtendsType(), key, 1, IdContext.TYPE_BIND);
+      visit(nd.getTrueType(), key, 2, IdContext.TYPE_BIND);
       if (!boundTypes.isEmpty()) {
         scopeManager.leaveScope();
       }
-      visit(nd.getFalseType(), key, 3, IdContext.typeBind);
+      visit(nd.getFalseType(), key, 3, IdContext.TYPE_BIND);
       return key;
     }
 
     @Override
     public Label visit(InferTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getTypeParameter(), key, 0, IdContext.typeDecl);
+      visit(nd.getTypeParameter(), key, 0, IdContext.TYPE_DECL);
       return key;
     }
 
     @Override
     public Label visit(ImportTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getPath(), key, 0, IdContext.typeBind);
+      visit(nd.getPath(), key, 0, IdContext.TYPE_BIND);
       return key;
     }
 
     @Override
     public Label visit(OptionalTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getElementType(), key, 0, IdContext.typeBind);
+      visit(nd.getElementType(), key, 0, IdContext.TYPE_BIND);
       return key;
     }
 
     @Override
     public Label visit(RestTypeExpr nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getArrayType(), key, 0, IdContext.typeBind);
+      visit(nd.getArrayType(), key, 0, IdContext.TYPE_BIND);
       return key;
     }
 
     @Override
     public Label visit(XMLAttributeSelector nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getAttribute(), key, 0, IdContext.label);
+      visit(nd.getAttribute(), key, 0, IdContext.LABEL);
       return key;
     }
 
@@ -2192,7 +2192,7 @@ public class ASTExtractor {
     public Label visit(XMLQualifiedIdentifier nd, Context c) {
       Label key = super.visit(nd, c);
       visit(nd.getLeft(), key, 0);
-      visit(nd.getRight(), key, 1, nd.isComputed() ? IdContext.varBind : IdContext.label);
+      visit(nd.getRight(), key, 1, nd.isComputed() ? IdContext.VAR_BIND : IdContext.LABEL);
       return key;
     }
 
@@ -2200,7 +2200,7 @@ public class ASTExtractor {
     public Label visit(XMLDotDotExpression nd, Context c) {
       Label key = super.visit(nd, c);
       visit(nd.getLeft(), key, 0);
-      visit(nd.getRight(), key, 1, IdContext.label);
+      visit(nd.getRight(), key, 1, IdContext.LABEL);
       return key;
     }
 
@@ -2214,7 +2214,7 @@ public class ASTExtractor {
     @Override
     public Label visit(AngularPipeRef nd, Context c) {
       Label key = super.visit(nd, c);
-      visit(nd.getIdentifier(), key, 0, IdContext.label);
+      visit(nd.getIdentifier(), key, 0, IdContext.LABEL);
       return key;
     }
   }
diff --git a/javascript/extractor/src/com/semmle/js/extractor/ExprKinds.java b/javascript/extractor/src/com/semmle/js/extractor/ExprKinds.java
index f4acf6c57ec..cfaa252a9f5 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ExprKinds.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ExprKinds.java
@@ -155,17 +155,17 @@ public class ExprKinds {
       new EnumMap<IdContext, Integer>(IdContext.class);
 
   static {
-    idKinds.put(IdContext.label, 0);
-    idKinds.put(IdContext.varDecl, 78);
-    idKinds.put(IdContext.varAndTypeDecl, 78);
-    idKinds.put(IdContext.namespaceDecl, 78);
-    idKinds.put(IdContext.varAndNamespaceDecl, 78);
-    idKinds.put(IdContext.varAndTypeAndNamespaceDecl, 78);
-    idKinds.put(IdContext.typeOnlyImport, 78);
-    idKinds.put(IdContext.typeOnlyExport, 103);
-    idKinds.put(IdContext.varBind, 79);
-    idKinds.put(IdContext.export, 103);
-    idKinds.put(IdContext.exportBase, 103);
+    idKinds.put(IdContext.LABEL, 0);
+    idKinds.put(IdContext.VAR_DECL, 78);
+    idKinds.put(IdContext.VAR_AND_TYPE_DECL, 78);
+    idKinds.put(IdContext.NAMESPACE_DECL, 78);
+    idKinds.put(IdContext.VAR_AND_NAMESPACE_DECL, 78);
+    idKinds.put(IdContext.VAR_AND_TYPE_AND_NAMESPACE_DECL, 78);
+    idKinds.put(IdContext.TYPE_ONLY_IMPORT, 78);
+    idKinds.put(IdContext.TYPE_ONLY_EXPORT, 103);
+    idKinds.put(IdContext.VAR_BIND, 79);
+    idKinds.put(IdContext.EXPORT, 103);
+    idKinds.put(IdContext.EXPORT_BASE, 103);
   }
 
   public static int getExprKind(final Expression expr, final IdContext idContext) {
diff --git a/javascript/extractor/src/com/semmle/js/extractor/TypeExprKinds.java b/javascript/extractor/src/com/semmle/js/extractor/TypeExprKinds.java
index 0d2769d9e66..a1c7b219a8a 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/TypeExprKinds.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/TypeExprKinds.java
@@ -78,13 +78,13 @@ public class TypeExprKinds {
               @Override
               public Integer visit(Identifier nd, Void c) {
                 switch (idcontext) {
-                  case typeDecl:
+                  case TYPE_DECL:
                     return TypeExprKinds.typeDecl;
-                  case typeBind:
+                  case TYPE_BIND:
                     return simpleTypeAccess;
-                  case varInTypeBind:
+                  case VAR_IN_TYPE_BIND:
                     return simpleVarTypeAccess;
-                  case namespaceBind:
+                  case NAMESPACE_BIND:
                     return simpleNamespaceAccess;
                   default:
                     return typeLabel;
@@ -93,7 +93,7 @@ public class TypeExprKinds {
 
               @Override
               public Integer visit(KeywordTypeExpr nd, Void c) {
-                if (idcontext == IdContext.varInTypeBind && nd.getKeyword().equals("this")) {
+                if (idcontext == IdContext.VAR_IN_TYPE_BIND && nd.getKeyword().equals("this")) {
                   return thisVarTypeAccess;
                 }
                 return keywordTypeExpr;
@@ -132,9 +132,9 @@ public class TypeExprKinds {
               @Override
               public Integer visit(UnaryTypeExpr nd, Void c) {
                 switch (nd.getKind()) {
-                  case Keyof:
+                  case KEYOF:
                     return keyofTypeExpr;
-                  case Readonly:
+                  case READONLY:
                     return readonlyTypeExpr;
                 }
                 throw new CatastrophicError("Unhandled UnaryTypeExpr kind: " + nd.getKind());
@@ -142,9 +142,9 @@ public class TypeExprKinds {
 
               @Override
               public Integer visit(MemberExpression nd, Void c) {
-                if (idcontext == IdContext.varInTypeBind) {
+                if (idcontext == IdContext.VAR_IN_TYPE_BIND) {
                   return qualifiedVarTypeAccess;
-                } else if (idcontext == IdContext.namespaceBind) {
+                } else if (idcontext == IdContext.NAMESPACE_BIND) {
                   return qualifiedNamespaceAccess;
                 } else {
                   return qualifiedTypeAccess;
@@ -224,11 +224,11 @@ public class TypeExprKinds {
               @Override
               public Integer visit(ImportTypeExpr nd, Void c) {
                 switch (idcontext) {
-                  case namespaceBind:
+                  case NAMESPACE_BIND:
                     return importNamespaceAccess;
-                  case typeBind:
+                  case TYPE_BIND:
                     return importTypeAccess;
-                  case varInTypeBind:
+                  case VAR_IN_TYPE_BIND:
                     return importVarTypeAccess;
                   default:
                     return importTypeAccess;
diff --git a/javascript/extractor/src/com/semmle/ts/ast/UnaryTypeExpr.java b/javascript/extractor/src/com/semmle/ts/ast/UnaryTypeExpr.java
index 67575a4fdca..5682bb11d03 100644
--- a/javascript/extractor/src/com/semmle/ts/ast/UnaryTypeExpr.java
+++ b/javascript/extractor/src/com/semmle/ts/ast/UnaryTypeExpr.java
@@ -13,8 +13,8 @@ public class UnaryTypeExpr extends TypeExpression {
   private final Kind kind;
 
   public enum Kind {
-    Keyof,
-    Readonly
+    KEYOF,
+    READONLY
   }
 
   public UnaryTypeExpr(SourceLocation loc, Kind kind, ITypeExpression elementType) {
diff --git a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
index 7ec9c8cbeaa..0824ad9be17 100644
--- a/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
+++ b/javascript/extractor/src/com/semmle/ts/extractor/TypeScriptASTConverter.java
@@ -2256,10 +2256,10 @@ public class TypeScriptASTConverter {
   private Node convertTypeOperator(JsonObject node, SourceLocation loc) throws ParseError {
     String operator = metadata.getSyntaxKindName(node.get("operator").getAsInt());
     if (operator.equals("KeyOfKeyword")) {
-      return new UnaryTypeExpr(loc, UnaryTypeExpr.Kind.Keyof, convertChildAsType(node, "type"));
+      return new UnaryTypeExpr(loc, UnaryTypeExpr.Kind.KEYOF, convertChildAsType(node, "type"));
     }
     if (operator.equals("ReadonlyKeyword")) {
-      return new UnaryTypeExpr(loc, UnaryTypeExpr.Kind.Readonly, convertChildAsType(node, "type"));
+      return new UnaryTypeExpr(loc, UnaryTypeExpr.Kind.READONLY, convertChildAsType(node, "type"));
     }
     if (operator.equals("UniqueKeyword")) {
       return new KeywordTypeExpr(loc, "unique symbol");

From b36593a76b70c1248c8ec99ab8a8df0db4012dcc Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Fri, 22 Jan 2021 10:11:16 +0000
Subject: [PATCH 276/343] JS: Fix broken link tag

---
 .../extractor/src/com/semmle/js/extractor/ASTExtractor.java     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
index e8ff2abb5b6..73cefdae30d 100644
--- a/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/ASTExtractor.java
@@ -247,7 +247,7 @@ public class ASTExtractor {
 
     /**
      * An identifier that is part of a type, but should not bind to a type name. Unlike {@link
-     * #label}, this will not result in an expression.
+     * #LABEL}, this will not result in an expression.
      */
     TYPE_LABEL,
 

From 718f6eb3fde9837192c282ad35357094f5f1c98a Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Fri, 22 Jan 2021 13:17:38 +0100
Subject: [PATCH 277/343] JS: update and prettify examples

---
 .../CWE-730/examples/server-crash.BAD.js      | 33 ++++++++++---------
 .../CWE-730/examples/server-crash.GOOD-A.js   |  2 +-
 .../CWE-730/examples/server-crash.GOOD-B.js   |  5 ++-
 3 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/javascript/ql/src/Security/CWE-730/examples/server-crash.BAD.js b/javascript/ql/src/Security/CWE-730/examples/server-crash.BAD.js
index 1b7001666ff..9642ced4c1a 100644
--- a/javascript/ql/src/Security/CWE-730/examples/server-crash.BAD.js
+++ b/javascript/ql/src/Security/CWE-730/examples/server-crash.BAD.js
@@ -1,21 +1,22 @@
 const express = require("express"),
-      fs = require("fs");
+  fs = require("fs");
 
-function save(rootDir, path, content){
-	if (!isValidPath(rootDir, req.query.filePath)) {
-		throw new Error(`Invalid filePath: ${req.query.filePath}`); // BAD crashes the server
-	}
-	// write content to disk
+function save(rootDir, path, content) {
+  if (!isValidPath(rootDir, req.query.filePath)) {
+    throw new Error(`Invalid filePath: ${req.query.filePath}`); // BAD crashes the server
+  }
+  // write content to disk
 }
 express().post("/save", (req, res) => {
-	fs.access(rootDir, (err) => {
-		if (err) {
-			console.error(`Server setup is corrupted, ${rootDir} does not exist!`);
-			res.status(500);
-			res.end();
-		}
-		save(rootDir, req.query.path, req.body);
-		res.status(200);
-		res.end();
-	});
+  fs.exists(rootDir, (exists) => {
+    if (!exists) {
+      console.error(`Server setup is corrupted, ${rootDir} does not exist!`);
+      res.status(500);
+      res.end();
+      return;
+    }
+    save(rootDir, req.query.path, req.body);
+    res.status(200);
+    res.end();
+  });
 });
diff --git a/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-A.js b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-A.js
index 60314259dc0..b23071ea53c 100644
--- a/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-A.js
+++ b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-A.js
@@ -1,6 +1,6 @@
 // ...
 express().post("/save", (req, res) => {
-  fs.access(rootDir, (err) => {
+  fs.exists(rootDir, (exists) => {
     // ...
     try {
       save(rootDir, req.query.path, req.body); // GOOD no uncaught exception
diff --git a/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js
index 1d02956a341..4e6e3c3bc72 100644
--- a/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js
+++ b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js
@@ -1,11 +1,10 @@
 // ...
 express().post("/save", async (req, res) => {
-  try {
-    await fs.access(rootDir);
-  } catch (e) {
+  if (await fs.promises.exists(rootDir)) {
     console.error(`Server setup is corrupted, ${rootDir} does not exist!`);
     res.status(500);
     res.end();
+    return;
   }
   save(rootDir, req.query.path, req.body); // MAYBE BAD, depends on the commandline options
   res.status(200);

From 682b2464411d9ff54f5b6ed7ca35b480644b9eee Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 22 Jan 2021 13:40:44 +0100
Subject: [PATCH 278/343] C++: Fix path-problem format.

---
 .../Security/CWE/CWE-359/PrivateCleartextWrite.ql    |  6 +++---
 .../semmle/tests/PrivateCleartextWrite.expected      | 12 ++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql b/cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
index 60b13525aff..205f17c06c9 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
@@ -16,6 +16,6 @@ import DataFlow::PathGraph
 
 from WriteConfig b, DataFlow::PathNode source, DataFlow::PathNode sink
 where b.hasFlowPath(source, sink)
-select sink.getNode(),
-  "This write into the external location '" + sink + "' may contain unencrypted data from $@",
-  source, "this source."
+select sink.getNode(), source, sink,
+  "This write into the external location '" + sink.getNode() +
+    "' may contain unencrypted data from $@", source, "this source."
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.expected
index c263d7e6dfd..887547f2c2e 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.expected
@@ -13,9 +13,9 @@ nodes
 | test.cpp:96:37:96:46 | theZipcode | semmle.label | theZipcode |
 | test.cpp:99:42:99:51 | theZipcode | semmle.label | theZipcode |
 #select
-| test.cpp:57:9:57:18 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:57:9:57:18 | theZipcode | this source. |
-| test.cpp:74:24:74:30 | medical | This write into the external location 'medical' may contain unencrypted data from $@ | test.cpp:74:24:74:30 | medical | this source. |
-| test.cpp:78:24:78:27 | temp | This write into the external location 'temp' may contain unencrypted data from $@ | test.cpp:77:16:77:22 | medical | this source. |
-| test.cpp:82:24:82:28 | buff5 | This write into the external location 'buff5' may contain unencrypted data from $@ | test.cpp:81:22:81:28 | medical | this source. |
-| test.cpp:96:37:96:46 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:96:37:96:46 | theZipcode | this source. |
-| test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:99:42:99:51 | theZipcode | this source. |
+| test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:57:9:57:18 | theZipcode | this source. |
+| test.cpp:74:24:74:30 | medical | test.cpp:74:24:74:30 | medical | test.cpp:74:24:74:30 | medical | This write into the external location 'medical' may contain unencrypted data from $@ | test.cpp:74:24:74:30 | medical | this source. |
+| test.cpp:78:24:78:27 | temp | test.cpp:77:16:77:22 | medical | test.cpp:78:24:78:27 | temp | This write into the external location 'temp' may contain unencrypted data from $@ | test.cpp:77:16:77:22 | medical | this source. |
+| test.cpp:82:24:82:28 | buff5 | test.cpp:81:22:81:28 | medical | test.cpp:82:24:82:28 | buff5 | This write into the external location 'buff5' may contain unencrypted data from $@ | test.cpp:81:22:81:28 | medical | this source. |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:96:37:96:46 | theZipcode | this source. |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@ | test.cpp:99:42:99:51 | theZipcode | this source. |

From 3f3962f7a9d3d4a252985e7dc6ce61c5fb71e2a3 Mon Sep 17 00:00:00 2001
From: Esben Sparre Andreasen <esbena@github.com>
Date: Fri, 22 Jan 2021 14:03:21 +0100
Subject: [PATCH 279/343] Update
 javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js

Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
---
 .../ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js
index 4e6e3c3bc72..2a795ac001f 100644
--- a/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js
+++ b/javascript/ql/src/Security/CWE-730/examples/server-crash.GOOD-B.js
@@ -1,6 +1,6 @@
 // ...
 express().post("/save", async (req, res) => {
-  if (await fs.promises.exists(rootDir)) {
+  if (!(await fs.promises.exists(rootDir))) {
     console.error(`Server setup is corrupted, ${rootDir} does not exist!`);
     res.status(500);
     res.end();

From b4f9b1590d0413b182bf63121b003e5401883a88 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 22 Jan 2021 14:20:18 +0100
Subject: [PATCH 280/343] C++: Restore lost result on git/git. We lost the
 result in a00bd7ae027d17a2cd2e2931a37baa31943d1245 because the added check
 for type T to type T* conversion didn't handle const qualifiers.

---
 .../ir/dataflow/internal/DataFlowPrivate.qll  |  9 +++++----
 .../dataflow/fields/by_reference.cpp          | 12 +++++++++++-
 .../fields/dataflow-consistency.expected      |  3 +++
 .../dataflow/fields/ir-path-flow.expected     | 19 +++++++++++++++++++
 .../fields/partial-definition-diff.expected   |  2 ++
 .../fields/partial-definition.expected        |  2 ++
 .../dataflow/fields/path-flow.expected        |  8 ++++++++
 7 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
index 422c63559ce..68b31a732f4 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -451,7 +451,7 @@ Type getResultTypeOfSourceValue(CopyValueInstruction copy) {
  * pops the `ArrayContent` off the access path when a value-to-pointer or value-to-reference conversion
  * happens on the argument that is ends up as the target of such a store.
  */
-private predicate innerReadSteap(Node node1, Content a, Node node2) {
+private predicate innerReadStep(Node node1, Content a, Node node2) {
   a = TArrayContent() and
   exists(WriteSideEffectInstruction write, CallInstruction call, CopyValueInstruction copyValue |
     write.getPrimaryInstruction() = call and
@@ -463,8 +463,9 @@ private predicate innerReadSteap(Node node1, Content a, Node node2) {
     ) and
     node2.asInstruction() = write and
     copyValue = call.getArgument(write.getIndex()) and
-    [getPointerType(copyValue).getBaseType(), getReferenceType(copyValue).getBaseType()] =
-      getResultTypeOfSourceValue(copyValue)
+    // Check that `copyValue` is actually doing a T to a T* conversion.
+    [getPointerType(copyValue).getBaseType(), getReferenceType(copyValue).getBaseType()].stripType() =
+      getResultTypeOfSourceValue(copyValue).stripType()
   )
 }
 
@@ -477,7 +478,7 @@ predicate readStep(Node node1, Content f, Node node2) {
   aliasedReadStep(node1, f, node2) or
   arrayReadStep(node1, f, node2) or
   instrToFieldNodeReadStep(node1, f, node2) or
-  innerReadSteap(node1, f, node2)
+  innerReadStep(node1, f, node2)
 }
 
 /**
diff --git a/cpp/ql/test/library-tests/dataflow/fields/by_reference.cpp b/cpp/ql/test/library-tests/dataflow/fields/by_reference.cpp
index 8e84d39be3b..46abcd62c07 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/by_reference.cpp
+++ b/cpp/ql/test/library-tests/dataflow/fields/by_reference.cpp
@@ -1,4 +1,4 @@
-void sink(void *o);
+void sink(void *o); void sink(const char *o);
 void *user_input(void);
 
 struct S {
@@ -135,3 +135,13 @@ void test_outer_with_ref(Outer *pouter) {
   sink(pouter->inner_ptr->a); // $ ast MISSING: ir
   sink(pouter->a); // $ ast,ir
 }
+
+void taint_a_ptr(const char **pa) {
+  *pa = (char*)user_input();
+}
+
+void test_const_char_ref() {
+  const char* s;
+  taint_a_ptr(&s);
+  sink(s); // $ ast ir=140:9 ir=140:16
+}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected b/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected
index c402843e64d..500faa38eb1 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected
@@ -123,6 +123,9 @@ postWithInFlow
 | by_reference.cpp:108:24:108:24 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
 | by_reference.cpp:123:28:123:36 | inner_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
 | by_reference.cpp:127:30:127:38 | inner_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:140:3:140:5 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:140:4:140:5 | pa [inner post update] | PostUpdateNode should not be the target of local flow. |
+| by_reference.cpp:145:16:145:16 | s [inner post update] | PostUpdateNode should not be the target of local flow. |
 | complex.cpp:11:22:11:23 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
 | complex.cpp:12:22:12:23 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
 | conflated.cpp:10:3:10:7 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
index e787b9a5f0e..0f25daa307d 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
@@ -195,6 +195,14 @@ edges
 | by_reference.cpp:134:16:134:27 | inner_nested [a, a] | by_reference.cpp:134:29:134:29 | a [a] |
 | by_reference.cpp:134:29:134:29 | a [a] | by_reference.cpp:134:29:134:29 | a |
 | by_reference.cpp:136:16:136:16 | a [a] | by_reference.cpp:136:16:136:16 | a |
+| by_reference.cpp:140:3:140:27 | Chi [array content] | by_reference.cpp:145:15:145:16 | taint_a_ptr output argument [array content] |
+| by_reference.cpp:140:3:140:27 | ChiTotal [post update] [array content] | by_reference.cpp:140:3:140:27 | Chi [array content] |
+| by_reference.cpp:140:3:140:27 | ChiTotal [post update] [array content] | by_reference.cpp:145:15:145:16 | taint_a_ptr output argument [array content] |
+| by_reference.cpp:140:9:140:27 | (char *)... | by_reference.cpp:140:3:140:27 | ChiTotal [post update] [array content] |
+| by_reference.cpp:140:9:140:27 | (const char *)... | by_reference.cpp:140:3:140:27 | ChiTotal [post update] [array content] |
+| by_reference.cpp:140:16:140:25 | call to user_input | by_reference.cpp:140:3:140:27 | ChiTotal [post update] [array content] |
+| by_reference.cpp:145:15:145:16 | taint_a_ptr output argument | by_reference.cpp:146:8:146:8 | s |
+| by_reference.cpp:145:15:145:16 | taint_a_ptr output argument [array content] | by_reference.cpp:145:15:145:16 | taint_a_ptr output argument |
 | complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:42:18:42:18 | call to a |
 | complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:42:16:42:16 | a output argument [b_] |
 | complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:43:18:43:18 | call to b |
@@ -504,6 +512,14 @@ nodes
 | by_reference.cpp:134:29:134:29 | a [a] | semmle.label | a [a] |
 | by_reference.cpp:136:16:136:16 | a | semmle.label | a |
 | by_reference.cpp:136:16:136:16 | a [a] | semmle.label | a [a] |
+| by_reference.cpp:140:3:140:27 | Chi [array content] | semmle.label | Chi [array content] |
+| by_reference.cpp:140:3:140:27 | ChiTotal [post update] [array content] | semmle.label | ChiTotal [post update] [array content] |
+| by_reference.cpp:140:9:140:27 | (char *)... | semmle.label | (char *)... |
+| by_reference.cpp:140:9:140:27 | (const char *)... | semmle.label | (const char *)... |
+| by_reference.cpp:140:16:140:25 | call to user_input | semmle.label | call to user_input |
+| by_reference.cpp:145:15:145:16 | taint_a_ptr output argument | semmle.label | taint_a_ptr output argument |
+| by_reference.cpp:145:15:145:16 | taint_a_ptr output argument [array content] | semmle.label | taint_a_ptr output argument [array content] |
+| by_reference.cpp:146:8:146:8 | s | semmle.label | s |
 | complex.cpp:40:17:40:17 | *b [a_] | semmle.label | *b [a_] |
 | complex.cpp:40:17:40:17 | *b [b_] | semmle.label | *b [b_] |
 | complex.cpp:40:17:40:17 | *b [f, f, a_] | semmle.label | *b [f, f, a_] |
@@ -649,6 +665,9 @@ nodes
 | by_reference.cpp:132:14:132:14 | a | by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:132:14:132:14 | a | a flows from $@ | by_reference.cpp:96:8:96:17 | call to user_input | call to user_input |
 | by_reference.cpp:134:29:134:29 | a | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:134:29:134:29 | a | a flows from $@ | by_reference.cpp:88:13:88:22 | call to user_input | call to user_input |
 | by_reference.cpp:136:16:136:16 | a | by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:136:16:136:16 | a | a flows from $@ | by_reference.cpp:96:8:96:17 | call to user_input | call to user_input |
+| by_reference.cpp:146:8:146:8 | s | by_reference.cpp:140:9:140:27 | (char *)... | by_reference.cpp:146:8:146:8 | s | s flows from $@ | by_reference.cpp:140:9:140:27 | (char *)... | (char *)... |
+| by_reference.cpp:146:8:146:8 | s | by_reference.cpp:140:9:140:27 | (const char *)... | by_reference.cpp:146:8:146:8 | s | s flows from $@ | by_reference.cpp:140:9:140:27 | (const char *)... | (const char *)... |
+| by_reference.cpp:146:8:146:8 | s | by_reference.cpp:140:16:140:25 | call to user_input | by_reference.cpp:146:8:146:8 | s | s flows from $@ | by_reference.cpp:140:16:140:25 | call to user_input | call to user_input |
 | complex.cpp:42:18:42:18 | call to a | complex.cpp:53:19:53:28 | call to user_input | complex.cpp:42:18:42:18 | call to a | call to a flows from $@ | complex.cpp:53:19:53:28 | call to user_input | call to user_input |
 | complex.cpp:42:18:42:18 | call to a | complex.cpp:55:19:55:28 | call to user_input | complex.cpp:42:18:42:18 | call to a | call to a flows from $@ | complex.cpp:55:19:55:28 | call to user_input | call to user_input |
 | complex.cpp:43:18:43:18 | call to b | complex.cpp:54:19:54:28 | call to user_input | complex.cpp:43:18:43:18 | call to b | call to b flows from $@ | complex.cpp:54:19:54:28 | call to user_input | call to user_input |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
index 78d9b3888b3..d7939750db6 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected
@@ -242,6 +242,8 @@
 | by_reference.cpp:134:29:134:29 | a | AST only |
 | by_reference.cpp:135:27:135:27 | a | AST only |
 | by_reference.cpp:136:16:136:16 | a | AST only |
+| by_reference.cpp:140:3:140:5 | * ... | AST only |
+| by_reference.cpp:145:15:145:16 | & ... | AST only |
 | complex.cpp:9:20:9:21 | this | IR only |
 | complex.cpp:10:20:10:21 | this | IR only |
 | complex.cpp:11:22:11:23 | a_ | AST only |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected b/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected
index 15e247ed83d..9821d527b87 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected
@@ -352,6 +352,8 @@
 | by_reference.cpp:135:27:135:27 | a |
 | by_reference.cpp:136:8:136:13 | pouter |
 | by_reference.cpp:136:16:136:16 | a |
+| by_reference.cpp:140:3:140:5 | * ... |
+| by_reference.cpp:145:15:145:16 | & ... |
 | complex.cpp:11:22:11:23 | a_ |
 | complex.cpp:11:22:11:23 | this |
 | complex.cpp:12:22:12:23 | b_ |
diff --git a/cpp/ql/test/library-tests/dataflow/fields/path-flow.expected b/cpp/ql/test/library-tests/dataflow/fields/path-flow.expected
index 123b8a3ce81..6ea374d0ddf 100644
--- a/cpp/ql/test/library-tests/dataflow/fields/path-flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/fields/path-flow.expected
@@ -323,6 +323,9 @@ edges
 | by_reference.cpp:135:8:135:13 | pouter [inner_ptr, a] | by_reference.cpp:135:16:135:24 | inner_ptr [a] |
 | by_reference.cpp:135:16:135:24 | inner_ptr [a] | by_reference.cpp:135:27:135:27 | a |
 | by_reference.cpp:136:8:136:13 | pouter [a] | by_reference.cpp:136:16:136:16 | a |
+| by_reference.cpp:140:4:140:5 | pa [inner post update] | by_reference.cpp:145:15:145:16 | ref arg & ... |
+| by_reference.cpp:140:16:140:25 | call to user_input | by_reference.cpp:140:4:140:5 | pa [inner post update] |
+| by_reference.cpp:145:15:145:16 | ref arg & ... | by_reference.cpp:146:8:146:8 | s |
 | complex.cpp:40:17:40:17 | b [inner, f, a_] | complex.cpp:42:8:42:8 | b [inner, f, a_] |
 | complex.cpp:40:17:40:17 | b [inner, f, b_] | complex.cpp:43:8:43:8 | b [inner, f, b_] |
 | complex.cpp:42:8:42:8 | b [inner, f, a_] | complex.cpp:42:10:42:14 | inner [f, a_] |
@@ -855,6 +858,10 @@ nodes
 | by_reference.cpp:135:27:135:27 | a | semmle.label | a |
 | by_reference.cpp:136:8:136:13 | pouter [a] | semmle.label | pouter [a] |
 | by_reference.cpp:136:16:136:16 | a | semmle.label | a |
+| by_reference.cpp:140:4:140:5 | pa [inner post update] | semmle.label | pa [inner post update] |
+| by_reference.cpp:140:16:140:25 | call to user_input | semmle.label | call to user_input |
+| by_reference.cpp:145:15:145:16 | ref arg & ... | semmle.label | ref arg & ... |
+| by_reference.cpp:146:8:146:8 | s | semmle.label | s |
 | complex.cpp:40:17:40:17 | b [inner, f, a_] | semmle.label | b [inner, f, a_] |
 | complex.cpp:40:17:40:17 | b [inner, f, b_] | semmle.label | b [inner, f, b_] |
 | complex.cpp:42:8:42:8 | b [inner, f, a_] | semmle.label | b [inner, f, a_] |
@@ -1117,6 +1124,7 @@ nodes
 | by_reference.cpp:134:29:134:29 | a | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:134:29:134:29 | a | a flows from $@ | by_reference.cpp:88:13:88:22 | call to user_input | call to user_input |
 | by_reference.cpp:135:27:135:27 | a | by_reference.cpp:88:13:88:22 | call to user_input | by_reference.cpp:135:27:135:27 | a | a flows from $@ | by_reference.cpp:88:13:88:22 | call to user_input | call to user_input |
 | by_reference.cpp:136:16:136:16 | a | by_reference.cpp:96:8:96:17 | call to user_input | by_reference.cpp:136:16:136:16 | a | a flows from $@ | by_reference.cpp:96:8:96:17 | call to user_input | call to user_input |
+| by_reference.cpp:146:8:146:8 | s | by_reference.cpp:140:16:140:25 | call to user_input | by_reference.cpp:146:8:146:8 | s | s flows from $@ | by_reference.cpp:140:16:140:25 | call to user_input | call to user_input |
 | complex.cpp:42:18:42:18 | call to a | complex.cpp:53:19:53:28 | call to user_input | complex.cpp:42:18:42:18 | call to a | call to a flows from $@ | complex.cpp:53:19:53:28 | call to user_input | call to user_input |
 | complex.cpp:42:18:42:18 | call to a | complex.cpp:55:19:55:28 | call to user_input | complex.cpp:42:18:42:18 | call to a | call to a flows from $@ | complex.cpp:55:19:55:28 | call to user_input | call to user_input |
 | complex.cpp:43:18:43:18 | call to b | complex.cpp:54:19:54:28 | call to user_input | complex.cpp:43:18:43:18 | call to b | call to b flows from $@ | complex.cpp:54:19:54:28 | call to user_input | call to user_input |

From b3497191b1a8e32776c0e246ddae7e1740ca191f Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Fri, 22 Jan 2021 14:44:18 +0100
Subject: [PATCH 281/343] add .venv/ to .gitignore

---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index b14dab0a6b1..0951496d45c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,6 +17,9 @@
 # Byte-compiled python files
 *.pyc
 
+# python virtual environment folder 
+.venv/
+
 # It's useful (though not required) to be able to unpack codeql in the ql checkout itself
 /codeql/
 

From 6fc14976cfbffb77087c93139f64b53a33ff20f5 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Fri, 22 Jan 2021 14:26:45 +0100
Subject: [PATCH 282/343] C#: Remove uses of `getAQlClass()`

---
 .../experimental/ir/implementation/IRType.qll |   2 +-
 .../src/semmle/code/cil/ConsistencyChecks.qll |   6 +-
 csharp/ql/src/semmle/code/csharp/Element.qll  |  13 --
 csharp/ql/src/semmle/code/dotnet/Element.qll  |  13 ++
 .../library-tests/comments/Comments.expected  | 169 +++++++++---------
 .../test/library-tests/comments/Comments.ql   |  27 ++-
 .../frameworks/test/Test.expected             |  56 ++----
 .../library-tests/frameworks/test/Test.ql     |  18 +-
 .../generics/ConsistencyChecks.ql             |   2 +-
 9 files changed, 145 insertions(+), 161 deletions(-)

diff --git a/csharp/ql/src/experimental/ir/implementation/IRType.qll b/csharp/ql/src/experimental/ir/implementation/IRType.qll
index 3bf3bf2e276..e0bccafae6b 100644
--- a/csharp/ql/src/experimental/ir/implementation/IRType.qll
+++ b/csharp/ql/src/experimental/ir/implementation/IRType.qll
@@ -341,7 +341,7 @@ module IRTypeConsistency {
   query predicate multipleIRTypes(Language::LanguageType type, string message) {
     strictcount(type.getIRType()) > 1 and
     message =
-      "`LanguageType` " + type.getAQlClass() + " has multiple `IRType`s: " +
+      "`LanguageType` " + type + " has multiple `IRType`s: " +
         concat(type.getIRType().toString(), ", ")
   }
 
diff --git a/csharp/ql/src/semmle/code/cil/ConsistencyChecks.qll b/csharp/ql/src/semmle/code/cil/ConsistencyChecks.qll
index f5ebe9a5103..bd6a1bc8885 100644
--- a/csharp/ql/src/semmle/code/cil/ConsistencyChecks.qll
+++ b/csharp/ql/src/semmle/code/cil/ConsistencyChecks.qll
@@ -473,7 +473,7 @@ class InvalidOverride extends MethodViolation {
   InvalidOverride() {
     base = getMethod().getOverriddenMethod() and
     not getMethod().getDeclaringType().getABaseType+() = base.getDeclaringType() and
-    base.getDeclaringType().isSourceDeclaration() // Bases classes of constructed types aren't extracted properly.
+    base.getDeclaringType().isUnboundDeclaration() // Bases classes of constructed types aren't extracted properly.
   }
 
   override string getMessage() {
@@ -664,7 +664,7 @@ class MissingCilDeclaration extends ConsistencyViolation, MissingCSharpCheck {
   override string getMessage() {
     result =
       "Cannot locate CIL for " + getDeclaration().toStringWithTypes() + " of class " +
-        getDeclaration().getAQlClass()
+        getDeclaration().getAPrimaryQlClass()
   }
 
   override string toString() { result = getDeclaration().toStringWithTypes() }
@@ -753,7 +753,7 @@ class DeclarationWithMultipleLabels extends DeclarationViolation {
 class DeclarationWithoutLabel extends DeclarationViolation {
   DeclarationWithoutLabel() {
     exists(Declaration d | this = DeclarationCheck(d) |
-      d.isSourceDeclaration() and
+      d.isUnboundDeclaration() and
       not d instanceof TypeParameter and
       not exists(d.getLabel()) and
       (d instanceof Callable or d instanceof Type)
diff --git a/csharp/ql/src/semmle/code/csharp/Element.qll b/csharp/ql/src/semmle/code/csharp/Element.qll
index f9ebbc5bef9..521138db1b5 100644
--- a/csharp/ql/src/semmle/code/csharp/Element.qll
+++ b/csharp/ql/src/semmle/code/csharp/Element.qll
@@ -48,17 +48,4 @@ class Element extends DotNet::Element, @element {
    * other children (zero-based).
    */
   int getIndex() { exists(Element parent | parent.getChild(result) = this) }
-
-  /**
-   * Gets the name of a primary CodeQL class to which this element belongs.
-   *
-   * For most elements, this is simply the most precise syntactic category to
-   * which they belong; for example, `AddExpr` is a primary class, but
-   * `BinaryOperation` is not.
-   *
-   * This predicate always has a result. If no primary class can be
-   * determined, the result is `"???"`. If multiple primary classes match,
-   * this predicate can have multiple results.
-   */
-  string getAPrimaryQlClass() { result = "???" }
 }
diff --git a/csharp/ql/src/semmle/code/dotnet/Element.qll b/csharp/ql/src/semmle/code/dotnet/Element.qll
index 10a688d8ddd..956a5f2c052 100644
--- a/csharp/ql/src/semmle/code/dotnet/Element.qll
+++ b/csharp/ql/src/semmle/code/dotnet/Element.qll
@@ -36,6 +36,19 @@ class Element extends @dotnet_element {
 
   /** Gets the full textual representation of this element, including type information. */
   string toStringWithTypes() { result = this.toString() }
+
+  /**
+   * Gets the name of a primary CodeQL class to which this element belongs.
+   *
+   * For most elements, this is simply the most precise syntactic category to
+   * which they belong; for example, `AddExpr` is a primary class, but
+   * `BinaryOperation` is not.
+   *
+   * This predicate always has a result. If no primary class can be
+   * determined, the result is `"???"`. If multiple primary classes match,
+   * this predicate can have multiple results.
+   */
+  string getAPrimaryQlClass() { result = "???" }
 }
 
 /** An element that has a name. */
diff --git a/csharp/ql/test/library-tests/comments/Comments.expected b/csharp/ql/test/library-tests/comments/Comments.expected
index 28cf81d9754..388687e7857 100644
--- a/csharp/ql/test/library-tests/comments/Comments.expected
+++ b/csharp/ql/test/library-tests/comments/Comments.expected
@@ -1,83 +1,86 @@
-| comments1.cs:1:1:2:46 | // ... | 2 | comments1.cs:1:1:1:23 | // ... | Start of comment1.cs | // Start of comment1.cs | SinglelineComment |
-| comments1.cs:1:1:2:46 | // ... | 2 | comments1.cs:2:1:2:46 | // ... | This tests the basic types of comment block | // This tests the basic types of comment block | SinglelineComment |
-| comments1.cs:4:1:4:25 | // ... | 1 | comments1.cs:4:1:4:25 | // ... | 1) Basic comment types | // 1) Basic comment types | SinglelineComment |
-| comments1.cs:6:1:6:24 | // ... | 1 | comments1.cs:6:1:6:24 | // ... | A single-line comment | // A single-line comment | SinglelineComment |
-| comments1.cs:8:1:8:18 | /// ... | 1 | comments1.cs:8:1:8:18 | /// ... | An XML comment | /// An XML comment | XmlComment |
-| comments1.cs:11:1:11:25 | /* ... */ | 1 | comments1.cs:11:1:11:25 | /* ... */ | A multiline comment | /* A multiline comment */ | MultilineComment |
-| comments1.cs:14:1:14:20 | // ... | 1 | comments1.cs:14:1:14:20 | // ... | 2) Comment blocks | // 2) Comment blocks | SinglelineComment |
-| comments1.cs:16:1:16:38 | // ... | 1 | comments1.cs:16:1:16:38 | // ... | A line on its own is a commentblock | // A line on its own is a commentblock | SinglelineComment |
-| comments1.cs:18:1:19:31 | // ... | 2 | comments1.cs:18:1:18:21 | // ... | Two lines together | // Two lines together | SinglelineComment |
-| comments1.cs:18:1:19:31 | // ... | 2 | comments1.cs:19:1:19:31 | // ... | are in the same commentblock | // are in the same commentblock | SinglelineComment |
-| comments1.cs:21:1:23:15 | // ... | 3 | comments1.cs:21:1:21:14 | // ... | Three lines | // Three lines | SinglelineComment |
-| comments1.cs:21:1:23:15 | // ... | 3 | comments1.cs:22:1:22:14 | // ... | in the same | // in the same | SinglelineComment |
-| comments1.cs:21:1:23:15 | // ... | 3 | comments1.cs:23:1:23:15 | // ... | commentblock | // commentblock | SinglelineComment |
-| comments1.cs:25:1:25:43 | /* ... */ | 2 | comments1.cs:25:1:25:15 | /* ... */ | This is a | /* This is a */ | MultilineComment |
-| comments1.cs:25:1:25:43 | /* ... */ | 2 | comments1.cs:25:18:25:43 | /* ... */ | single comment block | /* single comment block */ | MultilineComment |
-| comments1.cs:27:1:29:13 | /* ... */ | 3 | comments1.cs:27:1:27:12 | /* ... */ | This is a | /* This is a | MultilineComment |
-| comments1.cs:27:1:29:13 | /* ... */ | 3 | comments1.cs:28:1:28:17 | /* ... */ | true multiline |    true multiline | MultilineComment |
-| comments1.cs:27:1:29:13 | /* ... */ | 3 | comments1.cs:29:1:29:13 | /* ... */ | comment |    comment */ | MultilineComment |
-| comments1.cs:31:1:33:30 | // ... | 3 | comments1.cs:31:1:31:21 | // ... | These three lines, | // These three lines, | SinglelineComment |
-| comments1.cs:31:1:33:30 | // ... | 3 | comments1.cs:32:1:32:61 | /* ... */ | even though they are using different commenting styles, | /* even though they are using different commenting styles, */ | MultilineComment |
-| comments1.cs:31:1:33:30 | // ... | 3 | comments1.cs:33:1:33:30 | /// ... | form a single commentblock | /// form a single commentblock | XmlComment |
-| comments1.cs:37:5:39:41 | /* ... */ | 3 | comments1.cs:37:5:37:6 | /* ... */ |  | /* | MultilineComment |
-| comments1.cs:37:5:39:41 | /* ... */ | 3 | comments1.cs:38:1:38:6 | /* ... */ |  |     */ | MultilineComment |
-| comments1.cs:37:5:39:41 | /* ... */ | 3 | comments1.cs:39:5:39:41 | // ... | This is not the same comment block | // This is not the same comment block | SinglelineComment |
-| comments1.cs:40:13:41:51 | // ... | 2 | comments1.cs:40:13:40:27 | // ... | as this line | // as this line | SinglelineComment |
-| comments1.cs:40:13:41:51 | // ... | 2 | comments1.cs:41:13:41:51 | // ... | because they are offset differently. | // because they are offset differently. | SinglelineComment |
-| comments1.cs:43:15:43:36 | // ... | 1 | comments1.cs:43:15:43:36 | // ... | These are different | // These are different | SinglelineComment |
-| comments1.cs:44:15:44:32 | // ... | 1 | comments1.cs:44:15:44:32 | // ... | comment blocks. | // comment blocks. | SinglelineComment |
-| comments1.cs:47:1:47:21 | // ... | 1 | comments1.cs:47:1:47:21 | // ... | End of comment1.cs | // End of comment1.cs | SinglelineComment |
-| comments2.cs:1:1:2:15 | // ... | 2 | comments2.cs:1:1:1:23 | // ... | Start of comment2.cs | // Start of comment2.cs | SinglelineComment |
-| comments2.cs:1:1:2:15 | // ... | 2 | comments2.cs:2:1:2:15 | // ... | Unassociated | // Unassociated | SinglelineComment |
-| comments2.cs:5:27:5:41 | // ... | 1 | comments2.cs:5:27:5:41 | // ... | Unassociated | // Unassociated | SinglelineComment |
-| comments2.cs:8:1:8:15 | // ... | 1 | comments2.cs:8:1:8:15 | // ... | Unassociated | // Unassociated | SinglelineComment |
-| comments2.cs:10:1:10:6 | /// ... | 1 | comments2.cs:10:1:10:6 | /// ... | C2 | /// C2 | XmlComment |
-| comments2.cs:13:17:13:25 | // ... | 1 | comments2.cs:13:17:13:25 | // ... | field1 | // field1 | SinglelineComment |
-| comments2.cs:14:17:14:25 | // ... | 1 | comments2.cs:14:17:14:25 | // ... | field2 | // field2 | SinglelineComment |
-| comments2.cs:16:5:16:9 | // ... | 1 | comments2.cs:16:5:16:9 | // ... | C2 | // C2 | SinglelineComment |
-| comments2.cs:18:5:18:8 | // ... | 1 | comments2.cs:18:5:18:8 | // ... | f | // f | SinglelineComment |
-| comments2.cs:21:9:21:16 | // ... | 1 | comments2.cs:21:9:21:16 | // ... | {...} | // {...} | SinglelineComment |
-| comments2.cs:23:15:23:21 | // ... | 1 | comments2.cs:23:15:23:21 | // ... | ...; | // ...; | SinglelineComment |
-| comments2.cs:25:9:25:15 | // ... | 1 | comments2.cs:25:9:25:15 | // ... | ...; | // ...; | SinglelineComment |
-| comments2.cs:31:9:31:15 | // ... | 1 | comments2.cs:31:9:31:15 | // ... | ...; | // ...; | SinglelineComment |
-| comments2.cs:33:9:33:16 | // ... | 1 | comments2.cs:33:9:33:16 | // ... | {...} | // {...} | SinglelineComment |
-| comments2.cs:36:9:36:16 | // ... | 1 | comments2.cs:36:9:36:16 | // ... | {...} | // {...} | SinglelineComment |
-| comments2.cs:39:5:39:9 | // ... | 1 | comments2.cs:39:5:39:9 | // ... | C3 | // C3 | SinglelineComment |
-| comments2.cs:42:9:42:13 | // ... | 1 | comments2.cs:42:9:42:13 | // ... | C3 | // C3 | SinglelineComment |
-| comments2.cs:45:5:45:9 | // ... | 1 | comments2.cs:45:5:45:9 | // ... | C2 | // C2 | SinglelineComment |
-| comments2.cs:47:5:47:9 | // ... | 1 | comments2.cs:47:5:47:9 | // ... | S1 | // S1 | SinglelineComment |
-| comments2.cs:50:9:50:13 | // ... | 1 | comments2.cs:50:9:50:13 | // ... | S1 | // S1 | SinglelineComment |
-| comments2.cs:52:28:52:35 | // ... | 1 | comments2.cs:52:28:52:35 | // ... | {...} | // {...} | SinglelineComment |
-| comments2.cs:53:13:53:17 | // ... | 1 | comments2.cs:53:13:53:17 | // ... | S1 | // S1 | SinglelineComment |
-| comments2.cs:55:13:55:20 | // ... | 1 | comments2.cs:55:13:55:20 | // ... | {...} | // {...} | SinglelineComment |
-| comments2.cs:56:11:56:18 | // ... | 1 | comments2.cs:56:11:56:18 | // ... | {...} | // {...} | SinglelineComment |
-| comments2.cs:58:5:58:9 | // ... | 1 | comments2.cs:58:5:58:9 | // ... | S1 | // S1 | SinglelineComment |
-| comments2.cs:60:5:60:13 | // ... | 1 | comments2.cs:60:5:60:13 | // ... | Values | // Values | SinglelineComment |
-| comments2.cs:63:9:63:17 | // ... | 1 | comments2.cs:63:9:63:17 | // ... | Values | // Values | SinglelineComment |
-| comments2.cs:65:9:65:16 | // ... | 1 | comments2.cs:65:9:65:16 | // ... | First | // First | SinglelineComment |
-| comments2.cs:66:17:66:24 | // ... | 1 | comments2.cs:66:17:66:24 | // ... | First | // First | SinglelineComment |
-| comments2.cs:67:17:67:25 | // ... | 1 | comments2.cs:67:17:67:25 | // ... | Second | // Second | SinglelineComment |
-| comments2.cs:69:9:70:10 | // ... | 2 | comments2.cs:69:9:69:17 | // ... | Values | // Values | SinglelineComment |
-| comments2.cs:69:9:70:10 | // ... | 2 | comments2.cs:70:9:70:10 | // ... |  | // | SinglelineComment |
-| comments2.cs:72:9:72:16 | // ... | 1 | comments2.cs:72:9:72:16 | // ... | Third | // Third | SinglelineComment |
-| comments2.cs:75:9:75:17 | // ... | 1 | comments2.cs:75:9:75:17 | // ... | Values | // Values | SinglelineComment |
-| comments2.cs:78:5:78:21 | // ... | 1 | comments2.cs:78:5:78:21 | // ... | C2 Constructor | // C2 Constructor | SinglelineComment |
-| comments2.cs:79:10:79:26 | // ... | 1 | comments2.cs:79:10:79:26 | // ... | C2 Constructor | // C2 Constructor | SinglelineComment |
-| comments2.cs:81:9:81:16 | // ... | 1 | comments2.cs:81:9:81:16 | // ... | {...} | // {...} | SinglelineComment |
-| comments2.cs:84:5:84:10 | // ... | 1 | comments2.cs:84:5:84:10 | // ... | ~C2 | // ~C2 | SinglelineComment |
-| comments2.cs:85:11:85:16 | // ... | 1 | comments2.cs:85:11:85:16 | // ... | ~C2 | // ~C2 | SinglelineComment |
-| comments2.cs:89:5:89:8 | // ... | 1 | comments2.cs:89:5:89:8 | // ... | + | // + | SinglelineComment |
-| comments2.cs:90:46:90:49 | // ... | 1 | comments2.cs:90:46:90:49 | // ... | + | // + | SinglelineComment |
-| comments2.cs:96:15:96:18 | // ... | 1 | comments2.cs:96:15:96:18 | // ... | x | // x | SinglelineComment |
-| comments2.cs:97:13:97:16 | // ... | 1 | comments2.cs:97:13:97:16 | // ... | y | // y | SinglelineComment |
-| comments2.cs:102:5:102:8 | // ... | 1 | comments2.cs:102:5:102:8 | // ... | D | // D | SinglelineComment |
-| comments2.cs:103:31:104:34 | // ... | 2 | comments2.cs:103:31:103:34 | // ... | D | // D | SinglelineComment |
-| comments2.cs:103:31:104:34 | // ... | 2 | comments2.cs:104:31:104:34 | // ... | D | // D | SinglelineComment |
-| comments2.cs:106:5:106:8 | // ... | 1 | comments2.cs:106:5:106:8 | // ... | E | // E | SinglelineComment |
-| comments2.cs:107:23:108:26 | // ... | 2 | comments2.cs:107:23:107:26 | // ... | E | // E | SinglelineComment |
-| comments2.cs:107:23:108:26 | // ... | 2 | comments2.cs:108:23:108:26 | // ... | E | // E | SinglelineComment |
-| comments2.cs:118:5:118:21 | // ... | 1 | comments2.cs:118:5:118:21 | // ... | GenericClass<> | // GenericClass<> | SinglelineComment |
-| comments2.cs:121:17:121:20 | // ... | 1 | comments2.cs:121:17:121:20 | // ... | f | // f | SinglelineComment |
-| comments2.cs:124:5:124:16 | // ... | 1 | comments2.cs:124:5:124:16 | // ... | GenericFn | // GenericFn | SinglelineComment |
-| comments2.cs:127:20:127:23 | // ... | 1 | comments2.cs:127:20:127:23 | // ... | x | // x | SinglelineComment |
-| comments2.cs:132:1:132:21 | // ... | 1 | comments2.cs:132:1:132:21 | // ... | End of comment2.cs | // End of comment2.cs | SinglelineComment |
+singlelineComment
+| comments1.cs:1:1:2:46 | // ... | comments1.cs:1:1:1:23 | // ... | 2 | Start of comment1.cs | // Start of comment1.cs |
+| comments1.cs:1:1:2:46 | // ... | comments1.cs:2:1:2:46 | // ... | 2 | This tests the basic types of comment block | // This tests the basic types of comment block |
+| comments1.cs:4:1:4:25 | // ... | comments1.cs:4:1:4:25 | // ... | 1 | 1) Basic comment types | // 1) Basic comment types |
+| comments1.cs:6:1:6:24 | // ... | comments1.cs:6:1:6:24 | // ... | 1 | A single-line comment | // A single-line comment |
+| comments1.cs:14:1:14:20 | // ... | comments1.cs:14:1:14:20 | // ... | 1 | 2) Comment blocks | // 2) Comment blocks |
+| comments1.cs:16:1:16:38 | // ... | comments1.cs:16:1:16:38 | // ... | 1 | A line on its own is a commentblock | // A line on its own is a commentblock |
+| comments1.cs:18:1:19:31 | // ... | comments1.cs:18:1:18:21 | // ... | 2 | Two lines together | // Two lines together |
+| comments1.cs:18:1:19:31 | // ... | comments1.cs:19:1:19:31 | // ... | 2 | are in the same commentblock | // are in the same commentblock |
+| comments1.cs:21:1:23:15 | // ... | comments1.cs:21:1:21:14 | // ... | 3 | Three lines | // Three lines |
+| comments1.cs:21:1:23:15 | // ... | comments1.cs:22:1:22:14 | // ... | 3 | in the same | // in the same |
+| comments1.cs:21:1:23:15 | // ... | comments1.cs:23:1:23:15 | // ... | 3 | commentblock | // commentblock |
+| comments1.cs:31:1:33:30 | // ... | comments1.cs:31:1:31:21 | // ... | 3 | These three lines, | // These three lines, |
+| comments1.cs:37:5:39:41 | /* ... */ | comments1.cs:39:5:39:41 | // ... | 3 | This is not the same comment block | // This is not the same comment block |
+| comments1.cs:40:13:41:51 | // ... | comments1.cs:40:13:40:27 | // ... | 2 | as this line | // as this line |
+| comments1.cs:40:13:41:51 | // ... | comments1.cs:41:13:41:51 | // ... | 2 | because they are offset differently. | // because they are offset differently. |
+| comments1.cs:43:15:43:36 | // ... | comments1.cs:43:15:43:36 | // ... | 1 | These are different | // These are different |
+| comments1.cs:44:15:44:32 | // ... | comments1.cs:44:15:44:32 | // ... | 1 | comment blocks. | // comment blocks. |
+| comments1.cs:47:1:47:21 | // ... | comments1.cs:47:1:47:21 | // ... | 1 | End of comment1.cs | // End of comment1.cs |
+| comments2.cs:1:1:2:15 | // ... | comments2.cs:1:1:1:23 | // ... | 2 | Start of comment2.cs | // Start of comment2.cs |
+| comments2.cs:1:1:2:15 | // ... | comments2.cs:2:1:2:15 | // ... | 2 | Unassociated | // Unassociated |
+| comments2.cs:5:27:5:41 | // ... | comments2.cs:5:27:5:41 | // ... | 1 | Unassociated | // Unassociated |
+| comments2.cs:8:1:8:15 | // ... | comments2.cs:8:1:8:15 | // ... | 1 | Unassociated | // Unassociated |
+| comments2.cs:13:17:13:25 | // ... | comments2.cs:13:17:13:25 | // ... | 1 | field1 | // field1 |
+| comments2.cs:14:17:14:25 | // ... | comments2.cs:14:17:14:25 | // ... | 1 | field2 | // field2 |
+| comments2.cs:16:5:16:9 | // ... | comments2.cs:16:5:16:9 | // ... | 1 | C2 | // C2 |
+| comments2.cs:18:5:18:8 | // ... | comments2.cs:18:5:18:8 | // ... | 1 | f | // f |
+| comments2.cs:21:9:21:16 | // ... | comments2.cs:21:9:21:16 | // ... | 1 | {...} | // {...} |
+| comments2.cs:23:15:23:21 | // ... | comments2.cs:23:15:23:21 | // ... | 1 | ...; | // ...; |
+| comments2.cs:25:9:25:15 | // ... | comments2.cs:25:9:25:15 | // ... | 1 | ...; | // ...; |
+| comments2.cs:31:9:31:15 | // ... | comments2.cs:31:9:31:15 | // ... | 1 | ...; | // ...; |
+| comments2.cs:33:9:33:16 | // ... | comments2.cs:33:9:33:16 | // ... | 1 | {...} | // {...} |
+| comments2.cs:36:9:36:16 | // ... | comments2.cs:36:9:36:16 | // ... | 1 | {...} | // {...} |
+| comments2.cs:39:5:39:9 | // ... | comments2.cs:39:5:39:9 | // ... | 1 | C3 | // C3 |
+| comments2.cs:42:9:42:13 | // ... | comments2.cs:42:9:42:13 | // ... | 1 | C3 | // C3 |
+| comments2.cs:45:5:45:9 | // ... | comments2.cs:45:5:45:9 | // ... | 1 | C2 | // C2 |
+| comments2.cs:47:5:47:9 | // ... | comments2.cs:47:5:47:9 | // ... | 1 | S1 | // S1 |
+| comments2.cs:50:9:50:13 | // ... | comments2.cs:50:9:50:13 | // ... | 1 | S1 | // S1 |
+| comments2.cs:52:28:52:35 | // ... | comments2.cs:52:28:52:35 | // ... | 1 | {...} | // {...} |
+| comments2.cs:53:13:53:17 | // ... | comments2.cs:53:13:53:17 | // ... | 1 | S1 | // S1 |
+| comments2.cs:55:13:55:20 | // ... | comments2.cs:55:13:55:20 | // ... | 1 | {...} | // {...} |
+| comments2.cs:56:11:56:18 | // ... | comments2.cs:56:11:56:18 | // ... | 1 | {...} | // {...} |
+| comments2.cs:58:5:58:9 | // ... | comments2.cs:58:5:58:9 | // ... | 1 | S1 | // S1 |
+| comments2.cs:60:5:60:13 | // ... | comments2.cs:60:5:60:13 | // ... | 1 | Values | // Values |
+| comments2.cs:63:9:63:17 | // ... | comments2.cs:63:9:63:17 | // ... | 1 | Values | // Values |
+| comments2.cs:65:9:65:16 | // ... | comments2.cs:65:9:65:16 | // ... | 1 | First | // First |
+| comments2.cs:66:17:66:24 | // ... | comments2.cs:66:17:66:24 | // ... | 1 | First | // First |
+| comments2.cs:67:17:67:25 | // ... | comments2.cs:67:17:67:25 | // ... | 1 | Second | // Second |
+| comments2.cs:69:9:70:10 | // ... | comments2.cs:69:9:69:17 | // ... | 2 | Values | // Values |
+| comments2.cs:69:9:70:10 | // ... | comments2.cs:70:9:70:10 | // ... | 2 |  | // |
+| comments2.cs:72:9:72:16 | // ... | comments2.cs:72:9:72:16 | // ... | 1 | Third | // Third |
+| comments2.cs:75:9:75:17 | // ... | comments2.cs:75:9:75:17 | // ... | 1 | Values | // Values |
+| comments2.cs:78:5:78:21 | // ... | comments2.cs:78:5:78:21 | // ... | 1 | C2 Constructor | // C2 Constructor |
+| comments2.cs:79:10:79:26 | // ... | comments2.cs:79:10:79:26 | // ... | 1 | C2 Constructor | // C2 Constructor |
+| comments2.cs:81:9:81:16 | // ... | comments2.cs:81:9:81:16 | // ... | 1 | {...} | // {...} |
+| comments2.cs:84:5:84:10 | // ... | comments2.cs:84:5:84:10 | // ... | 1 | ~C2 | // ~C2 |
+| comments2.cs:85:11:85:16 | // ... | comments2.cs:85:11:85:16 | // ... | 1 | ~C2 | // ~C2 |
+| comments2.cs:89:5:89:8 | // ... | comments2.cs:89:5:89:8 | // ... | 1 | + | // + |
+| comments2.cs:90:46:90:49 | // ... | comments2.cs:90:46:90:49 | // ... | 1 | + | // + |
+| comments2.cs:96:15:96:18 | // ... | comments2.cs:96:15:96:18 | // ... | 1 | x | // x |
+| comments2.cs:97:13:97:16 | // ... | comments2.cs:97:13:97:16 | // ... | 1 | y | // y |
+| comments2.cs:102:5:102:8 | // ... | comments2.cs:102:5:102:8 | // ... | 1 | D | // D |
+| comments2.cs:103:31:104:34 | // ... | comments2.cs:103:31:103:34 | // ... | 2 | D | // D |
+| comments2.cs:103:31:104:34 | // ... | comments2.cs:104:31:104:34 | // ... | 2 | D | // D |
+| comments2.cs:106:5:106:8 | // ... | comments2.cs:106:5:106:8 | // ... | 1 | E | // E |
+| comments2.cs:107:23:108:26 | // ... | comments2.cs:107:23:107:26 | // ... | 2 | E | // E |
+| comments2.cs:107:23:108:26 | // ... | comments2.cs:108:23:108:26 | // ... | 2 | E | // E |
+| comments2.cs:118:5:118:21 | // ... | comments2.cs:118:5:118:21 | // ... | 1 | GenericClass<> | // GenericClass<> |
+| comments2.cs:121:17:121:20 | // ... | comments2.cs:121:17:121:20 | // ... | 1 | f | // f |
+| comments2.cs:124:5:124:16 | // ... | comments2.cs:124:5:124:16 | // ... | 1 | GenericFn | // GenericFn |
+| comments2.cs:127:20:127:23 | // ... | comments2.cs:127:20:127:23 | // ... | 1 | x | // x |
+| comments2.cs:132:1:132:21 | // ... | comments2.cs:132:1:132:21 | // ... | 1 | End of comment2.cs | // End of comment2.cs |
+multilineComment
+| comments1.cs:11:1:11:25 | /* ... */ | comments1.cs:11:1:11:25 | /* ... */ | 1 | A multiline comment | /* A multiline comment */ |
+| comments1.cs:25:1:25:43 | /* ... */ | comments1.cs:25:1:25:15 | /* ... */ | 2 | This is a | /* This is a */ |
+| comments1.cs:25:1:25:43 | /* ... */ | comments1.cs:25:18:25:43 | /* ... */ | 2 | single comment block | /* single comment block */ |
+| comments1.cs:27:1:29:13 | /* ... */ | comments1.cs:27:1:27:12 | /* ... */ | 3 | This is a | /* This is a |
+| comments1.cs:27:1:29:13 | /* ... */ | comments1.cs:28:1:28:17 | /* ... */ | 3 | true multiline |    true multiline |
+| comments1.cs:27:1:29:13 | /* ... */ | comments1.cs:29:1:29:13 | /* ... */ | 3 | comment |    comment */ |
+| comments1.cs:31:1:33:30 | // ... | comments1.cs:32:1:32:61 | /* ... */ | 3 | even though they are using different commenting styles, | /* even though they are using different commenting styles, */ |
+| comments1.cs:37:5:39:41 | /* ... */ | comments1.cs:37:5:37:6 | /* ... */ | 3 |  | /* |
+| comments1.cs:37:5:39:41 | /* ... */ | comments1.cs:38:1:38:6 | /* ... */ | 3 |  |     */ |
+xmlComment
+| comments1.cs:8:1:8:18 | /// ... | comments1.cs:8:1:8:18 | /// ... | 1 | An XML comment | /// An XML comment |
+| comments1.cs:31:1:33:30 | // ... | comments1.cs:33:1:33:30 | /// ... | 3 | form a single commentblock | /// form a single commentblock |
+| comments2.cs:10:1:10:6 | /// ... | comments2.cs:10:1:10:6 | /// ... | 1 | C2 | /// C2 |
diff --git a/csharp/ql/test/library-tests/comments/Comments.ql b/csharp/ql/test/library-tests/comments/Comments.ql
index ab01b83572a..5ef8d3d75b9 100644
--- a/csharp/ql/test/library-tests/comments/Comments.ql
+++ b/csharp/ql/test/library-tests/comments/Comments.ql
@@ -1,5 +1,26 @@
 import csharp
 
-from CommentBlock c, CommentLine l
-where l.getParent() = c
-select c, c.getNumLines(), l, l.getText(), l.getRawText(), l.getAQlClass()
+private predicate commentLine(
+  CommentBlock c, CommentLine l, int numLines, string text, string rawText
+) {
+  l.getParent() = c and
+  numLines = c.getNumLines() and
+  text = l.getText() and
+  rawText = l.getRawText()
+}
+
+query predicate singlelineComment(
+  CommentBlock c, SinglelineComment l, int numLines, string text, string rawText
+) {
+  commentLine(c, l, numLines, text, rawText)
+}
+
+query predicate multilineComment(
+  CommentBlock c, MultilineComment l, int numLines, string text, string rawText
+) {
+  commentLine(c, l, numLines, text, rawText)
+}
+
+query predicate xmlComment(CommentBlock c, XmlComment l, int numLines, string text, string rawText) {
+  commentLine(c, l, numLines, text, rawText)
+}
diff --git a/csharp/ql/test/library-tests/frameworks/test/Test.expected b/csharp/ql/test/library-tests/frameworks/test/Test.expected
index 3ac740f05d8..2d16ac51cfa 100644
--- a/csharp/ql/test/library-tests/frameworks/test/Test.expected
+++ b/csharp/ql/test/library-tests/frameworks/test/Test.expected
@@ -1,42 +1,14 @@
-| VisualStudio.cs:9:11:9:21 | MyTestSuite | TestClass | LeafType |
-| VisualStudio.cs:9:11:9:21 | MyTestSuite | TestClass | VSTestClass |
-| VisualStudio.cs:12:21:12:25 | Test1 | TestMethod | CallableTree |
-| VisualStudio.cs:12:21:12:25 | Test1 | TestMethod | CfgScope |
-| VisualStudio.cs:12:21:12:25 | Test1 | TestMethod | InstanceCallable |
-| VisualStudio.cs:12:21:12:25 | Test1 | TestMethod | VSTestMethod |
-| VisualStudio.cs:17:21:17:25 | Test2 | TestMethod | CallableTree |
-| VisualStudio.cs:17:21:17:25 | Test2 | TestMethod | CfgScope |
-| VisualStudio.cs:17:21:17:25 | Test2 | TestMethod | InstanceCallable |
-| VisualStudio.cs:17:21:17:25 | Test2 | TestMethod | VSTestMethod |
-| XUnit.cs:22:11:22:21 | MyTestSuite | TestClass | LeafType |
-| XUnit.cs:22:11:22:21 | MyTestSuite | TestClass | XUnitTestClass |
-| XUnit.cs:25:21:25:25 | Test1 | TestMethod | CallableTree |
-| XUnit.cs:25:21:25:25 | Test1 | TestMethod | CfgScope |
-| XUnit.cs:25:21:25:25 | Test1 | TestMethod | InstanceCallable |
-| XUnit.cs:25:21:25:25 | Test1 | TestMethod | XUnitTestMethod |
-| XUnit.cs:30:21:30:25 | Test2 | TestMethod | CallableTree |
-| XUnit.cs:30:21:30:25 | Test2 | TestMethod | CfgScope |
-| XUnit.cs:30:21:30:25 | Test2 | TestMethod | InstanceCallable |
-| XUnit.cs:30:21:30:25 | Test2 | TestMethod | XUnitTestMethod |
-| nunit.cs:75:11:75:21 | MyTestSuite | TestClass | LeafType |
-| nunit.cs:75:11:75:21 | MyTestSuite | TestClass | NUnitFixture |
-| nunit.cs:85:21:85:25 | Test1 | TestMethod | CallableTree |
-| nunit.cs:85:21:85:25 | Test1 | TestMethod | CfgScope |
-| nunit.cs:85:21:85:25 | Test1 | TestMethod | InstanceCallable |
-| nunit.cs:85:21:85:25 | Test1 | TestMethod | NUnitTestMethod |
-| nunit.cs:90:21:90:25 | Test2 | TestMethod | CallableTree |
-| nunit.cs:90:21:90:25 | Test2 | TestMethod | CfgScope |
-| nunit.cs:90:21:90:25 | Test2 | TestMethod | InstanceCallable |
-| nunit.cs:90:21:90:25 | Test2 | TestMethod | NUnitTestMethod |
-| nunit.cs:95:21:95:25 | Test3 | TestMethod | CallableTree |
-| nunit.cs:95:21:95:25 | Test3 | TestMethod | CfgScope |
-| nunit.cs:95:21:95:25 | Test3 | TestMethod | InstanceCallable |
-| nunit.cs:95:21:95:25 | Test3 | TestMethod | NUnitTestMethod |
-| nunit.cs:100:21:100:25 | Test4 | TestMethod | CallableTree |
-| nunit.cs:100:21:100:25 | Test4 | TestMethod | CfgScope |
-| nunit.cs:100:21:100:25 | Test4 | TestMethod | InstanceCallable |
-| nunit.cs:100:21:100:25 | Test4 | TestMethod | NUnitTestMethod |
-| nunit.cs:105:21:105:25 | Test5 | TestMethod | CallableTree |
-| nunit.cs:105:21:105:25 | Test5 | TestMethod | CfgScope |
-| nunit.cs:105:21:105:25 | Test5 | TestMethod | InstanceCallable |
-| nunit.cs:105:21:105:25 | Test5 | TestMethod | NUnitTestMethod |
+testClass
+| VisualStudio.cs:9:11:9:21 | MyTestSuite |
+| XUnit.cs:22:11:22:21 | MyTestSuite |
+| nunit.cs:75:11:75:21 | MyTestSuite |
+testMethod
+| VisualStudio.cs:12:21:12:25 | Test1 |
+| VisualStudio.cs:17:21:17:25 | Test2 |
+| XUnit.cs:25:21:25:25 | Test1 |
+| XUnit.cs:30:21:30:25 | Test2 |
+| nunit.cs:85:21:85:25 | Test1 |
+| nunit.cs:90:21:90:25 | Test2 |
+| nunit.cs:95:21:95:25 | Test3 |
+| nunit.cs:100:21:100:25 | Test4 |
+| nunit.cs:105:21:105:25 | Test5 |
diff --git a/csharp/ql/test/library-tests/frameworks/test/Test.ql b/csharp/ql/test/library-tests/frameworks/test/Test.ql
index 0288245f7c1..faa71788c7e 100644
--- a/csharp/ql/test/library-tests/frameworks/test/Test.ql
+++ b/csharp/ql/test/library-tests/frameworks/test/Test.ql
@@ -1,18 +1,6 @@
 import csharp
 import semmle.code.csharp.frameworks.Test
 
-from Element e, string type, string framework
-where
-  (
-    framework = e.(TestClass).getAQlClass() and type = "TestClass"
-    or
-    framework = e.(TestMethod).getAQlClass() and type = "TestMethod"
-  ) and
-  not framework = "NonNestedType" and
-  not framework = "UnboundDeclarationType" and
-  not framework = "SourceDeclarationCallable" and
-  not framework = "SourceDeclarationMethod" and
-  not framework = "NonConstructedMethod" and
-  not framework = "RuntimeInstanceMethod" and
-  not framework = "SummarizableMethod"
-select e, type, framework
+query predicate testClass(TestClass c) { any() }
+
+query predicate testMethod(TestMethod m) { any() }
diff --git a/csharp/ql/test/library-tests/generics/ConsistencyChecks.ql b/csharp/ql/test/library-tests/generics/ConsistencyChecks.ql
index 83f2597f856..def07f2c435 100644
--- a/csharp/ql/test/library-tests/generics/ConsistencyChecks.ql
+++ b/csharp/ql/test/library-tests/generics/ConsistencyChecks.ql
@@ -6,4 +6,4 @@ import semmle.code.csharp.commons.ConsistencyChecks
 
 from Element e, string m
 where consistencyFailure(e, m)
-select e, "Element class " + e.getAQlClass() + " has consistency check failed: " + m
+select e, "Element class " + e.getAPrimaryQlClass() + " has consistency check failed: " + m

From baf0917524be86a2c968e21d700b223a75bdb6cf Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sun, 24 Jan 2021 15:30:59 +0100
Subject: [PATCH 283/343] On saltstack this drops the number of consistency
 errors of type uniqueEnclosingCallable from 4026 to 614.

---
 .../semmle/python/dataflow/new/internal/DataFlowPublic.qll  | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
index edb550872f5..6b36f10f779 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -179,7 +179,11 @@ ExprNode exprNode(DataFlowExpr e) { result.getNode().getNode() = e }
 class ParameterNode extends CfgNode {
   ParameterDefinition def;
 
-  ParameterNode() { node = def.getDefiningNode() }
+  ParameterNode() {
+    node = def.getDefiningNode() and
+    // Disregard parameters to the function the extractor has synthesised for comprehensions
+    not def.getScope() = any(Comp comp).getNthInnerLoop(0).getIter().getScope()
+  }
 
   /**
    * Holds if this node is the parameter of callable `c` at the

From 89e56707c3895876f6efd0512706cb9713d4481d Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sun, 24 Jan 2021 16:16:07 +0100
Subject: [PATCH 284/343] Python: Omit all unresolved parameter nodes. Drops
 the results further to 139.

---
 .../semmle/python/dataflow/new/internal/DataFlowPublic.qll    | 4 ++--
 .../dataflow/consistency/dataflow-consistency.expected        | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
index 6b36f10f779..d28eb856e19 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -181,8 +181,8 @@ class ParameterNode extends CfgNode {
 
   ParameterNode() {
     node = def.getDefiningNode() and
-    // Disregard parameters to the function the extractor has synthesised for comprehensions
-    not def.getScope() = any(Comp comp).getNthInnerLoop(0).getIter().getScope()
+    // Disregard parameters that we cannot resolve
+    exists(DataFlowCallable c | node = c.getParameter(_))
   }
 
   /**
diff --git a/python/ql/test/experimental/dataflow/consistency/dataflow-consistency.expected b/python/ql/test/experimental/dataflow/consistency/dataflow-consistency.expected
index 8cfcd63dda6..6f03f2f621e 100644
--- a/python/ql/test/experimental/dataflow/consistency/dataflow-consistency.expected
+++ b/python/ql/test/experimental/dataflow/consistency/dataflow-consistency.expected
@@ -1,5 +1,4 @@
 uniqueEnclosingCallable
-| test.py:239:27:239:27 | ControlFlowNode for p | Node should have one enclosing callable but has 0. |
 uniqueType
 uniqueNodeLocation
 missingLocation

From 20d1b24e9c6790e0c3afa869b89d6b78d69b26a8 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Sun, 24 Jan 2021 22:35:11 +0300
Subject: [PATCH 285/343] Add files via upload

---
 ...moryLocationAfterEndOfBufferUsingStrncat.c |  4 ++
 ...LocationAfterEndOfBufferUsingStrncat.qhelp | 33 ++++++++++
 ...oryLocationAfterEndOfBufferUsingStrncat.ql | 65 +++++++++++++++++++
 3 files changed, 102 insertions(+)
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp
 create mode 100644 cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c
new file mode 100644
index 00000000000..9b08034dec5
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c
@@ -0,0 +1,4 @@
+ 
+strncat(dest, src, sizeof(dest) - strlen(dest)); //bad:
+
+strncat(dest, src, sizeof(dest) - strlen(dest) -1); //good:
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp
new file mode 100644
index 00000000000..182279f6b6b
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp
@@ -0,0 +1,33 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>The standard library function <code> strncat </code> appends the source string to the target string. The third argument specifies the maximum number of characters to add and must be less than the remaining space in the target buffer. Calls of the form <code> strncat (dest, src, sizeof (dest) - strlen (dest)) </code> set the third argument to one more than possible. So when the buffer is full, the expression <code> sizeof (dest) - strlen (dest) </code> will be equal to one, and not zero as the programmer might think. Making a call of this type may result in a zero byte being written just outside the buffer.</p>
+
+<p>Loss of detection includes cases of use of situations when memory allocation for a buffer occurs with a strong nesting or outside the limits of the function. It is also worth paying attention to the exclusion from the detection of situations when the second argument of the function is a constant string, since this situation creates a large number of false detection.</p>
+
+</overview>
+<recommendation>
+
+<p>We recommend using an extra byte call. for example <code> strncat(dest, src, sizeof(dest)-strlen(dest)-1) </code>.</p>
+
+</recommendation>
+<example>
+<p>The following example demonstrates an erroneous and corrected use of the strncat function.</p>
+<sample src="AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c" />
+
+</example>
+<references>
+
+<li>
+  CERT C Coding Standard:
+<a href="https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator">STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator</a>.
+</li>
+<li>
+  CERT C Coding Standard:
+  <a href="https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts">ARR30-C. Do not form or use out-of-bounds pointers or array subscripts</a>.
+</li>
+
+</references>
+</qhelp>
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
new file mode 100644
index 00000000000..fd82fc86fc3
--- /dev/null
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
@@ -0,0 +1,65 @@
+/**
+ * @name Access Of Memory Location After The End Of A Buffer Using Strncat
+ * @description --Calls of the form strncat(dest, src, sizeof (dest) - strlen (dest)) set the third argument to one more than possible.
+ *              --So when the buffer is full, the expression sizeof(dest) - strlen (dest) will be equal to one, and not zero as the programmer might think.
+ *              --Making a call of this type may result in a zero byte being written just outside the buffer.
+ * @kind problem
+ * @id cpp/access-memory-location-after-end-buffer
+ * @problem.severity warning
+ * @precision medium
+ * @tags correctness
+ *       security
+ *       external/cwe/cwe-788
+ */
+
+import cpp
+import semmle.code.cpp.valuenumbering.HashCons
+
+/**
+ * A call to `strncat` of the form `strncat(buff, str, someExpr - strlen(buf))`, for some expression `someExpr` equal to `sizeof(buff)`.
+ */
+class WrongCallStrncat extends FunctionCall {
+  Expr leftsomeExpr;
+
+  WrongCallStrncat() {
+    this.getTarget().hasGlobalOrStdName("strncat") and
+    // the expression of the first argument in `strncat` and `strnlen` is identical
+    hashCons(this.getArgument(0)) =
+      hashCons(this.getArgument(2).(SubExpr).getRightOperand().(StrlenCall).getStringExpr()) and
+    // using a string constant often speaks of manually calculating the length of the required buffer.
+    (
+      not this.getArgument(1) instanceof StringLiteral and
+      not this.getArgument(1) instanceof CharLiteral
+    ) and
+    // for use in predicates
+    leftsomeExpr = this.getArgument(2).(SubExpr).getLeftOperand()
+  }
+
+  /**
+   * Holds if the left side of the expression `someExpr` equal to `sizeof(buf)`.
+   */
+  predicate isExpressionEqualSizeof() {
+    // the left side of the expression `someExpr` is `sizeof(buf)`.
+    hashCons(this.getArgument(0)) = hashCons(leftsomeExpr.(SizeofExprOperator).getExprOperand())
+    or
+    // value of the left side of the expression `someExpr` equal  `sizeof(buf)` value, and `buf` is array.
+    leftsomeExpr.getValue().toInt() = this.getArgument(0).getType().getSize()
+  }
+
+  /**
+   * Holds if the left side of the expression `someExpr` equal to variable containing the length of the memory allocated for the buffer.
+   */
+  predicate isVariableEqualValueSizegBuffer() {
+    // the left side of expression `someExpr` is the variable that was used in the function of allocating memory for the buffer`.
+    exists(AllocationExpr alc |
+      leftsomeExpr.(VariableAccess).getTarget() =
+        alc.(FunctionCall).getArgument(0).(VariableAccess).getTarget()
+    )
+  }
+}
+
+from WrongCallStrncat sc
+where
+  sc.isExpressionEqualSizeof() or
+  sc.isVariableEqualValueSizegBuffer()
+select sc, "if the used buffer is full, writing out of the buffer is possible"

From fcd532522d1e928f01afd78a814309a981a380d4 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Sun, 24 Jan 2021 22:36:42 +0300
Subject: [PATCH 286/343] Add files via upload

---
 ...ationAfterEndOfBufferUsingStrncat.expected |  3 ++
 ...LocationAfterEndOfBufferUsingStrncat.qlref |  1 +
 .../Security/CWE/CWE-788/semmle/tests/test.c  | 28 +++++++++++++++++++
 3 files changed, 32 insertions(+)
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qlref
 create mode 100644 cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
new file mode 100644
index 00000000000..af52dac0144
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.expected
@@ -0,0 +1,3 @@
+| test.c:4:3:4:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
+| test.c:11:3:11:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
+| test.c:19:3:19:9 | call to strncat | if the used buffer is full, writing out of the buffer is possible |
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qlref
new file mode 100644
index 00000000000..8fd8b1b3217
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
new file mode 100644
index 00000000000..212baf83497
--- /dev/null
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
@@ -0,0 +1,28 @@
+void workFunction_0(char *s) {
+  char buf[80];
+  strncat(buf, s, sizeof(buf)-strlen(buf)-1); // GOOD
+  strncat(buf, s, sizeof(buf)-strlen(buf));  // BAD
+  strncat(buf, "fix", sizeof(buf)-strlen(buf)); // BAD but usually the size of the buffer is calculated manually. 
+}
+void workFunction_1(char *s) {
+#define MAX_SIZE 80
+  char buf[MAX_SIZE];
+  strncat(buf, s, MAX_SIZE-strlen(buf)-1); // GOOD
+  strncat(buf, s, MAX_SIZE-strlen(buf));  // BAD
+  strncat(buf, "fix", MAX_SIZE-strlen(buf)); // BAD but usually the size of the buffer is calculated manually. 
+}
+void workFunction_2_0(char *s) {
+  char * buf;
+  int len=80;
+  buf = (char *) malloc(len);
+  strncat(buf, s, len-strlen(buf)-1); // GOOD
+  strncat(buf, s, len-strlen(buf));  // BAD
+  strncat(buf, "fix", len-strlen(buf)); // BAD but usually the size of the buffer is calculated manually. 
+}
+void workFunction_2_1(char *s) {
+  char * buf;
+  int len=80;
+  buf = (char *) malloc(len+1);
+  strncat(buf, s, len-strlen(buf)-1); // GOOD
+  strncat(buf, s, len-strlen(buf));  // GOOD
+}

From c235462f7d224b047134b463bf14bb811426eea3 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 25 Jan 2021 09:43:57 +0100
Subject: [PATCH 287/343] C++: Sync `IRType.qll`

---
 cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll
index 3bf3bf2e276..e0bccafae6b 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll
@@ -341,7 +341,7 @@ module IRTypeConsistency {
   query predicate multipleIRTypes(Language::LanguageType type, string message) {
     strictcount(type.getIRType()) > 1 and
     message =
-      "`LanguageType` " + type.getAQlClass() + " has multiple `IRType`s: " +
+      "`LanguageType` " + type + " has multiple `IRType`s: " +
         concat(type.getIRType().toString(), ", ")
   }
 

From d86705fe7ada209e7e1602a69162b25ed3441d00 Mon Sep 17 00:00:00 2001
From: Erik Krogh Kristensen <erik-krogh@github.com>
Date: Mon, 25 Jan 2021 10:43:39 +0100
Subject: [PATCH 288/343] remove benign result for
 js/whitespace-contradicts-precedence related to " | 0" expressions

---
 .../Expressions/WhitespaceContradictsPrecedence.ql  | 13 ++++++++++++-
 .../WhitespaceContradictsPrecedence/tst.js          |  3 +++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/javascript/ql/src/Expressions/WhitespaceContradictsPrecedence.ql b/javascript/ql/src/Expressions/WhitespaceContradictsPrecedence.ql
index 3c6b1d3f381..36d9f773708 100644
--- a/javascript/ql/src/Expressions/WhitespaceContradictsPrecedence.ql
+++ b/javascript/ql/src/Expressions/WhitespaceContradictsPrecedence.ql
@@ -61,6 +61,16 @@ class HarmlessNestedExpr extends BinaryExpr {
   }
 }
 
+/**
+ * Holds if contradicting whitespace for `binop` is unlikely to cause confusion.
+ */
+predicate benignWhitespace(BinaryExpr binop) {
+  // asm.js like `expr |0` binary expression.
+  not binop.getParent() instanceof BinaryExpr and
+  binop.getOperator() = "|" and
+  binop.getRightOperand().getIntValue() = 0
+}
+
 /**
  * Holds if `inner` is an operand of `outer`, and the relative precedence
  * may not be immediately clear, but is important for the semantics of
@@ -69,7 +79,8 @@ class HarmlessNestedExpr extends BinaryExpr {
 predicate interestingNesting(BinaryExpr inner, BinaryExpr outer) {
   inner = outer.getAChildExpr() and
   not inner instanceof AssocNestedExpr and
-  not inner instanceof HarmlessNestedExpr
+  not inner instanceof HarmlessNestedExpr and
+  not benignWhitespace(outer)
 }
 
 from BinaryExpr inner, BinaryExpr outer
diff --git a/javascript/ql/test/query-tests/Expressions/WhitespaceContradictsPrecedence/tst.js b/javascript/ql/test/query-tests/Expressions/WhitespaceContradictsPrecedence/tst.js
index 3131563fc7a..d9942a5ec4a 100644
--- a/javascript/ql/test/query-tests/Expressions/WhitespaceContradictsPrecedence/tst.js
+++ b/javascript/ql/test/query-tests/Expressions/WhitespaceContradictsPrecedence/tst.js
@@ -50,3 +50,6 @@ x  +  x >> 1
 
 // OK
 x +   x >> 1
+
+// OK (asm.js-like)
+x = x - 1|0;
\ No newline at end of file

From b434a0f395b69cc28bd12f7bfe499b0cc3a08b3f Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 25 Jan 2021 11:27:13 +0100
Subject: [PATCH 289/343] Add change notes

---
 csharp/change-notes/2021-01-25-Function-pointer-cil.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 csharp/change-notes/2021-01-25-Function-pointer-cil.md

diff --git a/csharp/change-notes/2021-01-25-Function-pointer-cil.md b/csharp/change-notes/2021-01-25-Function-pointer-cil.md
new file mode 100644
index 00000000000..097df002d0f
--- /dev/null
+++ b/csharp/change-notes/2021-01-25-Function-pointer-cil.md
@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Function pointer types (`FunctionPointerType`) are extracted from IL. Also, `pinned` and `by-reference` (`cil_type_annotation`) type extraction is fixed.

From eac69c16749336429b29f57b3dcf139ba286a9fc Mon Sep 17 00:00:00 2001
From: Tamas Vajk <tamasvajk@github.com>
Date: Mon, 25 Jan 2021 11:34:47 +0100
Subject: [PATCH 290/343] Add DB upgrade folder for CIL fnptr support

---
 .../old.dbscheme                              | 1940 ++++++++++++++++
 .../semmlecode.csharp.dbscheme                | 1956 +++++++++++++++++
 .../upgrade.properties                        |    4 +
 3 files changed, 3900 insertions(+)
 create mode 100644 csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/old.dbscheme
 create mode 100644 csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/semmlecode.csharp.dbscheme
 create mode 100644 csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/upgrade.properties

diff --git a/csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/old.dbscheme b/csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/old.dbscheme
new file mode 100644
index 00000000000..dd813977f70
--- /dev/null
+++ b/csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/old.dbscheme
@@ -0,0 +1,1940 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 129 = @function_pointer_invocation_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field; // todo: add function pointer type
+
+#keyset[method, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int method: @cil_method ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/semmlecode.csharp.dbscheme b/csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/semmlecode.csharp.dbscheme
new file mode 100644
index 00000000000..2fb07f0b8c6
--- /dev/null
+++ b/csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/semmlecode.csharp.dbscheme
@@ -0,0 +1,1956 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+    unique int id : @compilation,
+    string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | --compiler
+ * 1   | *path to compiler*
+ * 2   | --cil
+ * 3   | f1.cs
+ * 4   | f2.cs
+ * 5   | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | f1.cs
+ * 1   | f2.cs
+ * 2   | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ *   csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0   | ref1.dll
+ * 1   | ref2.dll
+ * 2   | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+    int id : @compilation ref,
+    int num : int ref,
+    int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1    | CPU seconds used by the extractor frontend
+ * 2    | Elapsed seconds during the extractor frontend
+ * 3    | CPU seconds used by the extractor backend
+ * 4    | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+    int id : @compilation ref,
+    int num : int ref,
+    /* kind:
+       1 = frontend_cpu_seconds
+       2 = frontend_elapsed_seconds
+       3 = extractor_cpu_seconds
+       4 = extractor_elapsed_seconds
+    */
+    int kind : int ref,
+    float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+    unique int diagnostic : @diagnostic ref,
+    int compilation : @compilation ref,
+    int file_number : int ref,
+    int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+    unique int id: @diagnostic,
+    int severity: int ref,
+    string error_tag: string ref,
+    string error_message: string ref,
+    string full_error_message: string ref,
+    int location: @location_default ref
+);
+
+extractor_messages(
+    unique int id: @extractor_message,
+    int severity: int ref,
+    string origin : string ref,
+    string text : string ref,
+    string entity : string ref,
+    int location: @location_default ref,
+    string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+    unique int id : @compilation ref,
+    float cpu_seconds : float ref,
+    float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+  unique int id : @compilation ref,
+  int assembly: @assembly ref
+)
+
+/*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id: @externalDefect,
+  string queryPath: string ref,
+  int location: @location ref,
+  string message: string ref,
+  float severity: float ref);
+
+externalMetrics(
+  unique int id: @externalMetric,
+  string queryPath: string ref,
+  int location: @location ref,
+  float value: float ref);
+
+externalData(
+  int id: @externalDataElement,
+  string path: string ref,
+  int column: int ref,
+  string value: string ref);
+
+snapshotDate(
+  unique date snapshotDate: date ref);
+
+sourceLocationPrefix(
+  string prefix: string ref);
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id: @duplication,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+similarCode(
+  unique int id: @similarity,
+  string relativePath: string ref,
+  int equivClass: int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id: @duplication_or_similarity ref,
+  int offset: int ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+         | @using_directive | @type_parameter_constraints | @external_element
+         | @xmllocatable | @asp_element | @namespace;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@external_element = @externalMetric | @externalDefect | @externalDataElement;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+              | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+              | @local_function;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+locations_default(
+  unique int id: @location_default,
+  int file: @file ref,
+  int beginLine: int ref,
+  int beginColumn: int ref,
+  int endLine: int ref,
+  int endColumn: int ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+  int element_id: @sourceline ref,
+  int num_lines: int ref,
+  int num_code: int ref,
+  int num_comment: int ref);
+
+assemblies(
+  unique int id: @assembly,
+  int file: @file ref,
+  string fullname: string ref,
+  string name: string ref,
+  string version: string ref);
+
+/*
+  fromSource(0) = unknown,
+  fromSource(1) = from source,
+  fromSource(2) = from library
+*/
+files(
+  unique int id: @file,
+  string name: string ref,
+  string simple: string ref,
+  string ext: string ref,
+  int fromSource: int ref);
+
+folders(
+  unique int id: @folder,
+  string name: string ref,
+  string simple: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+  int parent: @container ref,
+  unique int child: @container ref);
+
+file_extraction_mode(
+  unique int file: @file ref,
+  int mode: int ref
+  /* 0 = normal, 1 = standalone extractor */
+  );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+  unique int id: @namespace,
+  string name: string ref);
+
+namespace_declarations(
+  unique int id: @namespace_declaration,
+  int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+  unique int id: @namespace_declaration ref,
+  int loc: @location ref);
+
+parent_namespace(
+  unique int child_id: @type_container ref,
+  int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+  int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+  int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_namespace_directives(
+  unique int id: @using_namespace_directive,
+  int namespace_id: @namespace ref);
+
+using_static_directives(
+  unique int id: @using_static_directive,
+  int type_id: @type_or_ref ref);
+
+using_directive_location(
+  unique int id: @using_directive ref,
+  int loc: @location ref);
+
+/** TYPES **/
+
+types(
+  unique int id: @type,
+  int kind: int ref,
+  string name: string ref);
+
+case @type.kind of
+   1 = @bool_type
+|  2 = @char_type
+|  3 = @decimal_type
+|  4 = @sbyte_type
+|  5 = @short_type
+|  6 = @int_type
+|  7 = @long_type
+|  8 = @byte_type
+|  9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+  ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type  | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+            | @uint_ptr_type | @tuple_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+          | @dynamic_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+  unique int id: @typeref,
+  string name: string ref);
+
+typeref_type(
+  int id: @typeref ref,
+  unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+  unique int array: @array_type ref,
+  int dimension: int ref,
+  int rank: int ref,
+  int element: @type_or_ref ref);
+
+nullable_underlying_type(
+  unique int nullable: @nullable_type ref,
+  int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+  unique int pointer: @pointer_type ref,
+  int referent: @type_or_ref ref);
+
+enum_underlying_type(
+  unique int enum_id: @enum_type ref,
+  int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+  unique int delegate_id: @delegate_type ref,
+  int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+    unique int function_pointer_id: @function_pointer_type ref,
+    int return_type_id: @type_or_ref ref);
+
+extend(
+  unique int sub: @type ref,
+  int super: @type_or_ref ref);
+
+anonymous_types(
+  unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+  int sub: @type ref,
+  int super: @type_or_ref ref);
+
+type_location(
+  int id: @type ref,
+  int loc: @location ref);
+
+tuple_underlying_type(
+  unique int tuple: @tuple_type ref,
+  int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+  int tuple: @tuple_type ref,
+  int index: int ref,
+  unique int field: @field ref);
+
+attributes(
+  unique int id: @attribute,
+  int type_id: @type_or_ref ref,
+  int target:  @attributable ref);
+
+attribute_location(
+  int id: @attribute ref,
+  int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+  unique int id: @type_mention,
+  int type_id: @type_or_ref ref,
+  int parent: @type_mention_parent ref);
+
+type_mention_location(
+  unique int id: @type_mention ref,
+  int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+  0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ *   0 = none (default, not populated)
+ *   1 = not null
+ *   2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+  unique int id: @type_parameter ref,
+  int index: int ref,
+  int generic_id: @generic ref,
+  int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+  int id: @type_or_ref ref,
+  int index: int ref,
+  int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+  unique int constructed: @generic ref,
+  int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+  unique int id: @type_parameter_constraints,
+  int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+  int id: @type_parameter_constraints ref,
+  int loc: @location ref);
+
+general_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+  int id: @type_parameter_constraints ref,
+  int base_id: @type_or_ref ref,
+  int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+  int id: @function_pointer_type ref,
+  int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+  int id: @function_pointer_type ref,
+  int index: int ref,
+  int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+  unique int id: @modifier,
+  string name: string ref);
+
+has_modifiers(
+  int id: @modifiable_direct ref,
+  int mod_id: @modifier ref);
+
+compiler_generated(unique int id: @modifiable_direct ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event;
+
+exprorstmt_name(
+  unique int parent_id: @named_exprorstmt ref,
+  string name: string ref);
+
+nested_types(
+  unique int id: @type ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @type ref);
+
+properties(
+  unique int id: @property,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @property ref);
+
+property_location(
+  int id: @property ref,
+  int loc: @location ref);
+
+indexers(
+  unique int id: @indexer,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @indexer ref);
+
+indexer_location(
+  int id: @indexer ref,
+  int loc: @location ref);
+
+accessors(
+  unique int id: @accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_member_id: @member ref,
+  int unbound_id: @accessor ref);
+
+case @accessor.kind of
+  1 = @getter
+| 2 = @setter
+  ;
+
+init_only_accessors(
+  unique int id: @accessor ref);
+
+accessor_location(
+  int id: @accessor ref,
+  int loc: @location ref);
+
+events(
+  unique int id: @event,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @event ref);
+
+event_location(
+  int id: @event ref,
+  int loc: @location ref);
+
+event_accessors(
+  unique int id: @event_accessor,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_event_id: @event ref,
+  int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+  1 = @add_event_accessor
+| 2 = @remove_event_accessor
+  ;
+
+event_accessor_location(
+  int id: @event_accessor ref,
+  int loc: @location ref);
+
+operators(
+  unique int id: @operator,
+  string name: string ref,
+  string symbol: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @operator ref);
+
+operator_location(
+  int id: @operator ref,
+  int loc: @location ref);
+
+constant_value(
+  int id: @variable ref,
+  string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+  unique int id: @method,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @method ref);
+
+method_location(
+  int id: @method ref,
+  int loc: @location ref);
+
+constructors(
+  unique int id: @constructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @constructor ref);
+
+constructor_location(
+  int id: @constructor ref,
+  int loc: @location ref);
+
+destructors(
+  unique int id: @destructor,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int unbound_id: @destructor ref);
+
+destructor_location(
+  int id: @destructor ref,
+  int loc: @location ref);
+
+overrides(
+  int id: @callable ref,
+  int base_id: @callable ref);
+
+explicitly_implements(
+  int id: @member ref,
+  int interface_id: @interface_or_ref ref);
+
+local_functions(
+    unique int id: @local_function,
+    string name: string ref,
+    int return_type: @type ref,
+    int unbound_id: @local_function ref);
+
+local_function_stmts(
+    unique int fn: @local_function_stmt ref,
+    int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+  unique int id: @field,
+  int kind: int ref,
+  string name: string ref,
+  int declaring_type_id: @type ref,
+  int type_id: @type_or_ref ref,
+  int unbound_id: @field ref);
+
+case @field.kind of
+  1 = @addressable_field
+| 2 = @constant
+  ;
+
+field_location(
+  int id: @field ref,
+  int loc: @location ref);
+
+localvars(
+  unique int id: @local_variable,
+  int kind: int ref,
+  string name: string ref,
+  int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+  int type_id: @type_or_ref ref,
+  int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+  1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+  ;
+
+localvar_location(
+  unique int id: @local_variable ref,
+  int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+  unique int id: @parameter,
+  string name: string ref,
+  int type_id: @type_or_ref ref,
+  int index: int ref,
+  int mode: int ref, /* value = 0, ref = 1, out = 2, array = 3, this = 4 */
+  int parent_id: @parameterizable ref,
+  int unbound_id: @parameter ref);
+
+param_location(
+  int id: @parameter ref,
+  int loc: @location ref);
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+  unique int id: @stmt,
+  int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+  unique int stmt: @stmt ref,
+  int index: int ref,
+  int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+   1 = @block_stmt
+|  2 = @expr_stmt
+|  3 = @if_stmt
+|  4 = @switch_stmt
+|  5 = @while_stmt
+|  6 = @do_stmt
+|  7 = @for_stmt
+|  8 = @foreach_stmt
+|  9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+  ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+           | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+  unique int id: @stmt ref,
+  int loc: @location ref);
+
+catch_type(
+  unique int catch_id: @catch ref,
+  int type_id: @type_or_ref ref,
+  int kind: int ref /* explicit = 1, implicit = 2 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+  unique int id: @expr,
+  int kind: int ref,
+  int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+  unique int expr: @expr ref,
+  int index: int ref,
+  int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+   1 = @bool_literal_expr
+|  2 = @char_literal_expr
+|  3 = @decimal_literal_expr
+|  4 = @int_literal_expr
+|  5 = @long_literal_expr
+|  6 = @uint_literal_expr
+|  7 = @ulong_literal_expr
+|  8 = @float_literal_expr
+|  9 = @double_literal_expr
+| 10 = @string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 129 = @function_pointer_invocation_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+              | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_expr =  @assign_arith_expr | @assign_bitwise_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+                   | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+                   | @assign_lshift_expr | @assign_rshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+                    | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+                        | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr =  @pre_incr_expr | @post_incr_expr;
+@decr_op_expr =  @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr =  @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+                 | @rshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr =  @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @assign_expr | @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+       | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@call = @method_invocation_expr | @constructor_init_expr | @operator_invocation_expr
+      | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+      | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+                    | @object_creation_expr | @method_invocation_expr | @operator_invocation_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+  unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+  unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+  unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+  unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+  unique int id: @operator_invocation_expr ref,
+  int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_compiler_generated(
+  unique int id: @expr ref);
+
+expr_value(
+  unique int id: @expr ref,
+  string value: string ref);
+
+expr_call(
+  unique int caller_id: @expr ref,
+  int target_id: @callable ref);
+
+expr_access(
+  unique int accesser_id: @access_expr ref,
+  int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+  unique int id: @expr ref,
+  int loc: @location ref);
+
+dynamic_member_name(
+  unique int id: @late_bindable_expr ref,
+  string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+                  | @method_invocation_expr
+                  | @element_access_expr;
+
+conditional_access(
+  unique int id: @qualifiable_expr ref);
+
+expr_argument(
+  unique int id: @expr ref,
+  int mode: int ref);
+  /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+  unique int id: @expr ref,
+  string name: string ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding  (
+  unique int id: @file ref,
+  string encoding: string ref);
+
+xmlDTDs(
+  unique int id: @xmldtd,
+  string root: string ref,
+  string publicId: string ref,
+  string systemId: string ref,
+  int fileid: @file ref);
+
+xmlElements(
+  unique int id: @xmlelement,
+  string name: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlAttrs(
+  unique int id: @xmlattribute,
+  int elementid: @xmlelement ref,
+  string name: string ref,
+  string value: string ref,
+  int idx: int ref,
+  int fileid: @file ref);
+
+xmlNs(
+  int id: @xmlnamespace,
+  string prefixName: string ref,
+  string URI: string ref,
+  int fileid: @file ref);
+
+xmlHasNs(
+  int elementId: @xmlnamespaceable ref,
+  int nsId: @xmlnamespace ref,
+  int fileid: @file ref);
+
+xmlComments(
+  unique int id: @xmlcomment,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int fileid: @file ref);
+
+xmlChars(
+  unique int id: @xmlcharacters,
+  string text: string ref,
+  int parentid: @xmlparent ref,
+  int idx: int ref,
+  int isCDATA: int ref,
+  int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+  int xmlElement: @xmllocatable ref,
+  int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+  unique int id: @commentline,
+  int kind: int ref,
+  string text: string ref,
+  string rawtext: string ref);
+
+case @commentline.kind of
+  0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+  unique int id: @commentline ref,
+  int loc: @location ref);
+
+commentblock(
+  unique int id : @commentblock);
+
+commentblock_location(
+  unique int id: @commentblock ref,
+  int loc: @location ref);
+
+commentblock_binding(
+  int id: @commentblock ref,
+  int entity: @element ref,
+  int bindtype: int ref);    /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+  int id: @commentblock ref,
+  int commentline: @commentline ref,
+  int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+  0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+  unique int id: @asp_element,
+  int kind: int ref,
+  int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+  int directive: @asp_directive ref,
+  int index: int ref,
+  string name: string ref,
+  int value: @asp_quoted_string ref);
+asp_directive_name(
+  unique int directive: @asp_directive ref,
+  string name: string ref);
+asp_element_body(
+  unique int element: @asp_element ref,
+  string body: string ref);
+asp_tag_attribute(
+  int tag: @asp_open_tag ref,
+  int index: int ref,
+  string name: string ref,
+  int attribute: @asp_attribute ref);
+asp_tag_name(
+  unique int tag: @asp_open_tag ref,
+  string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
+
+/* Common Intermediate Language - CIL */
+
+case @cil_instruction.opcode of
+  0 = @cil_nop
+| 1 = @cil_break
+| 2 = @cil_ldarg_0
+| 3 = @cil_ldarg_1
+| 4 = @cil_ldarg_2
+| 5 = @cil_ldarg_3
+| 6 = @cil_ldloc_0
+| 7 = @cil_ldloc_1
+| 8 = @cil_ldloc_2
+| 9 = @cil_ldloc_3
+| 10 = @cil_stloc_0
+| 11 = @cil_stloc_1
+| 12 = @cil_stloc_2
+| 13 = @cil_stloc_3
+| 14 = @cil_ldarg_s
+| 15 = @cil_ldarga_s
+| 16 = @cil_starg_s
+| 17 = @cil_ldloc_s
+| 18 = @cil_ldloca_s
+| 19 = @cil_stloc_s
+| 20 = @cil_ldnull
+| 21 = @cil_ldc_i4_m1
+| 22 = @cil_ldc_i4_0
+| 23 = @cil_ldc_i4_1
+| 24 = @cil_ldc_i4_2
+| 25 = @cil_ldc_i4_3
+| 26 = @cil_ldc_i4_4
+| 27 = @cil_ldc_i4_5
+| 28 = @cil_ldc_i4_6
+| 29 = @cil_ldc_i4_7
+| 30 = @cil_ldc_i4_8
+| 31 = @cil_ldc_i4_s
+| 32 = @cil_ldc_i4
+| 33 = @cil_ldc_i8
+| 34 = @cil_ldc_r4
+| 35 = @cil_ldc_r8
+| 37 = @cil_dup
+| 38 = @cil_pop
+| 39 = @cil_jmp
+| 40 = @cil_call
+| 41 = @cil_calli
+| 42 = @cil_ret
+| 43 = @cil_br_s
+| 44 = @cil_brfalse_s
+| 45 = @cil_brtrue_s
+| 46 = @cil_beq_s
+| 47 = @cil_bge_s
+| 48 = @cil_bgt_s
+| 49 = @cil_ble_s
+| 50 = @cil_blt_s
+| 51 = @cil_bne_un_s
+| 52 = @cil_bge_un_s
+| 53 = @cil_bgt_un_s
+| 54 = @cil_ble_un_s
+| 55 = @cil_blt_un_s
+| 56 = @cil_br
+| 57 = @cil_brfalse
+| 58 = @cil_brtrue
+| 59 = @cil_beq
+| 60 = @cil_bge
+| 61 = @cil_bgt
+| 62 = @cil_ble
+| 63 = @cil_blt
+| 64 = @cil_bne_un
+| 65 = @cil_bge_un
+| 66 = @cil_bgt_un
+| 67 = @cil_ble_un
+| 68 = @cil_blt_un
+| 69 = @cil_switch
+| 70 = @cil_ldind_i1
+| 71 = @cil_ldind_u1
+| 72 = @cil_ldind_i2
+| 73 = @cil_ldind_u2
+| 74 = @cil_ldind_i4
+| 75 = @cil_ldind_u4
+| 76 = @cil_ldind_i8
+| 77 = @cil_ldind_i
+| 78 = @cil_ldind_r4
+| 79 = @cil_ldind_r8
+| 80 = @cil_ldind_ref
+| 81 = @cil_stind_ref
+| 82 = @cil_stind_i1
+| 83 = @cil_stind_i2
+| 84 = @cil_stind_i4
+| 85 = @cil_stind_i8
+| 86 = @cil_stind_r4
+| 87 = @cil_stind_r8
+| 88 = @cil_add
+| 89 = @cil_sub
+| 90 = @cil_mul
+| 91 = @cil_div
+| 92 = @cil_div_un
+| 93 = @cil_rem
+| 94 = @cil_rem_un
+| 95 = @cil_and
+| 96 = @cil_or
+| 97 = @cil_xor
+| 98 = @cil_shl
+| 99 = @cil_shr
+| 100 = @cil_shr_un
+| 101 = @cil_neg
+| 102 = @cil_not
+| 103 = @cil_conv_i1
+| 104 = @cil_conv_i2
+| 105 = @cil_conv_i4
+| 106 = @cil_conv_i8
+| 107 = @cil_conv_r4
+| 108 = @cil_conv_r8
+| 109 = @cil_conv_u4
+| 110 = @cil_conv_u8
+| 111 = @cil_callvirt
+| 112 = @cil_cpobj
+| 113 = @cil_ldobj
+| 114 = @cil_ldstr
+| 115 = @cil_newobj
+| 116 = @cil_castclass
+| 117 = @cil_isinst
+| 118 = @cil_conv_r_un
+| 121 = @cil_unbox
+| 122 = @cil_throw
+| 123 = @cil_ldfld
+| 124 = @cil_ldflda
+| 125 = @cil_stfld
+| 126 = @cil_ldsfld
+| 127 = @cil_ldsflda
+| 128 = @cil_stsfld
+| 129 = @cil_stobj
+| 130 = @cil_conv_ovf_i1_un
+| 131 = @cil_conv_ovf_i2_un
+| 132 = @cil_conv_ovf_i4_un
+| 133 = @cil_conv_ovf_i8_un
+| 134 = @cil_conv_ovf_u1_un
+| 135 = @cil_conv_ovf_u2_un
+| 136 = @cil_conv_ovf_u4_un
+| 137 = @cil_conv_ovf_u8_un
+| 138 = @cil_conv_ovf_i_un
+| 139 = @cil_conv_ovf_u_un
+| 140 = @cil_box
+| 141 = @cil_newarr
+| 142 = @cil_ldlen
+| 143 = @cil_ldelema
+| 144 = @cil_ldelem_i1
+| 145 = @cil_ldelem_u1
+| 146 = @cil_ldelem_i2
+| 147 = @cil_ldelem_u2
+| 148 = @cil_ldelem_i4
+| 149 = @cil_ldelem_u4
+| 150 = @cil_ldelem_i8
+| 151 = @cil_ldelem_i
+| 152 = @cil_ldelem_r4
+| 153 = @cil_ldelem_r8
+| 154 = @cil_ldelem_ref
+| 155 = @cil_stelem_i
+| 156 = @cil_stelem_i1
+| 157 = @cil_stelem_i2
+| 158 = @cil_stelem_i4
+| 159 = @cil_stelem_i8
+| 160 = @cil_stelem_r4
+| 161 = @cil_stelem_r8
+| 162 = @cil_stelem_ref
+| 163 = @cil_ldelem
+| 164 = @cil_stelem
+| 165 = @cil_unbox_any
+| 179 = @cil_conv_ovf_i1
+| 180 = @cil_conv_ovf_u1
+| 181 = @cil_conv_ovf_i2
+| 182 = @cil_conv_ovf_u2
+| 183 = @cil_conv_ovf_i4
+| 184 = @cil_conv_ovf_u4
+| 185 = @cil_conv_ovf_i8
+| 186 = @cil_conv_ovf_u8
+| 194 = @cil_refanyval
+| 195 = @cil_ckinfinite
+| 198 = @cil_mkrefany
+| 208 = @cil_ldtoken
+| 209 = @cil_conv_u2
+| 210 = @cil_conv_u1
+| 211 = @cil_conv_i
+| 212 = @cil_conv_ovf_i
+| 213 = @cil_conv_ovf_u
+| 214 = @cil_add_ovf
+| 215 = @cil_add_ovf_un
+| 216 = @cil_mul_ovf
+| 217 = @cil_mul_ovf_un
+| 218 = @cil_sub_ovf
+| 219 = @cil_sub_ovf_un
+| 220 = @cil_endfinally
+| 221 = @cil_leave
+| 222 = @cil_leave_s
+| 223 = @cil_stind_i
+| 224 = @cil_conv_u
+| 65024 = @cil_arglist
+| 65025 = @cil_ceq
+| 65026 = @cil_cgt
+| 65027 = @cil_cgt_un
+| 65028 = @cil_clt
+| 65029 = @cil_clt_un
+| 65030 = @cil_ldftn
+| 65031 = @cil_ldvirtftn
+| 65033 = @cil_ldarg
+| 65034 = @cil_ldarga
+| 65035 = @cil_starg
+| 65036 = @cil_ldloc
+| 65037 = @cil_ldloca
+| 65038 = @cil_stloc
+| 65039 = @cil_localloc
+| 65041 = @cil_endfilter
+| 65042 = @cil_unaligned
+| 65043 = @cil_volatile
+| 65044 = @cil_tail
+| 65045 = @cil_initobj
+| 65046 = @cil_constrained
+| 65047 = @cil_cpblk
+| 65048 = @cil_initblk
+| 65050 = @cil_rethrow
+| 65052 = @cil_sizeof
+| 65053 = @cil_refanytype
+| 65054 = @cil_readonly
+;
+
+// CIL ignored instructions
+
+@cil_ignore = @cil_nop | @cil_break | @cil_volatile | @cil_unaligned;
+
+// CIL local/parameter/field access
+
+@cil_ldarg_any = @cil_ldarg_0 | @cil_ldarg_1 | @cil_ldarg_2 | @cil_ldarg_3 | @cil_ldarg_s | @cil_ldarga_s | @cil_ldarg | @cil_ldarga;
+@cil_starg_any = @cil_starg | @cil_starg_s;
+
+@cil_ldloc_any = @cil_ldloc_0 | @cil_ldloc_1 | @cil_ldloc_2 | @cil_ldloc_3 | @cil_ldloc_s | @cil_ldloca_s | @cil_ldloc | @cil_ldloca;
+@cil_stloc_any = @cil_stloc_0 | @cil_stloc_1 | @cil_stloc_2 | @cil_stloc_3 | @cil_stloc_s | @cil_stloc;
+
+@cil_ldfld_any = @cil_ldfld | @cil_ldsfld | @cil_ldsflda | @cil_ldflda;
+@cil_stfld_any = @cil_stfld | @cil_stsfld;
+
+@cil_local_access = @cil_stloc_any | @cil_ldloc_any;
+@cil_arg_access = @cil_starg_any | @cil_ldarg_any;
+@cil_read_access = @cil_ldloc_any | @cil_ldarg_any | @cil_ldfld_any;
+@cil_write_access = @cil_stloc_any | @cil_starg_any | @cil_stfld_any;
+
+@cil_stack_access = @cil_local_access | @cil_arg_access;
+@cil_field_access = @cil_ldfld_any | @cil_stfld_any;
+
+@cil_access = @cil_read_access | @cil_write_access;
+
+// CIL constant/literal instructions
+
+@cil_ldc_i = @cil_ldc_i4_any | @cil_ldc_i8;
+
+@cil_ldc_i4_any = @cil_ldc_i4_m1 | @cil_ldc_i4_0 | @cil_ldc_i4_1 | @cil_ldc_i4_2 | @cil_ldc_i4_3 |
+  @cil_ldc_i4_4 | @cil_ldc_i4_5 | @cil_ldc_i4_6 | @cil_ldc_i4_7 | @cil_ldc_i4_8 | @cil_ldc_i4_s | @cil_ldc_i4;
+
+@cil_ldc_r = @cil_ldc_r4 | @cil_ldc_r8;
+
+@cil_literal = @cil_ldnull | @cil_ldc_i | @cil_ldc_r | @cil_ldstr;
+
+// Control flow
+
+@cil_conditional_jump = @cil_binary_jump | @cil_unary_jump;
+@cil_binary_jump = @cil_beq_s | @cil_bge_s | @cil_bgt_s | @cil_ble_s | @cil_blt_s |
+    @cil_bne_un_s | @cil_bge_un_s | @cil_bgt_un_s | @cil_ble_un_s | @cil_blt_un_s |
+    @cil_beq | @cil_bge | @cil_bgt | @cil_ble | @cil_blt |
+    @cil_bne_un | @cil_bge_un | @cil_bgt_un | @cil_ble_un | @cil_blt_un;
+@cil_unary_jump = @cil_brfalse_s | @cil_brtrue_s | @cil_brfalse | @cil_brtrue | @cil_switch;
+@cil_unconditional_jump = @cil_br | @cil_br_s | @cil_leave_any;
+@cil_leave_any = @cil_leave | @cil_leave_s;
+@cil_jump = @cil_unconditional_jump | @cil_conditional_jump;
+
+// CIL call instructions
+
+@cil_call_any = @cil_jmp | @cil_call | @cil_calli | @cil_tail | @cil_callvirt | @cil_newobj;
+
+// CIL expression instructions
+
+@cil_expr = @cil_literal | @cil_binary_expr | @cil_unary_expr | @cil_call_any | @cil_read_access |
+  @cil_newarr | @cil_ldtoken | @cil_sizeof |
+  @cil_ldftn | @cil_ldvirtftn | @cil_localloc | @cil_mkrefany | @cil_refanytype | @cil_arglist | @cil_dup;
+
+@cil_unary_expr =
+  @cil_conversion_operation | @cil_unary_arithmetic_operation | @cil_unary_bitwise_operation|
+  @cil_ldlen | @cil_isinst | @cil_box | @cil_ldobj | @cil_castclass | @cil_unbox_any |
+  @cil_ldind | @cil_unbox;
+
+@cil_conversion_operation =
+  @cil_conv_i1 | @cil_conv_i2 | @cil_conv_i4 | @cil_conv_i8 |
+  @cil_conv_u1 | @cil_conv_u2 | @cil_conv_u4 | @cil_conv_u8 |
+  @cil_conv_ovf_i | @cil_conv_ovf_i_un | @cil_conv_ovf_i1 | @cil_conv_ovf_i1_un |
+  @cil_conv_ovf_i2 | @cil_conv_ovf_i2_un | @cil_conv_ovf_i4 | @cil_conv_ovf_i4_un |
+  @cil_conv_ovf_i8 | @cil_conv_ovf_i8_un | @cil_conv_ovf_u | @cil_conv_ovf_u_un |
+  @cil_conv_ovf_u1 | @cil_conv_ovf_u1_un | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_ovf_u4 | @cil_conv_ovf_u4_un | @cil_conv_ovf_u8 | @cil_conv_ovf_u8_un |
+  @cil_conv_r4 | @cil_conv_r8 | @cil_conv_ovf_u2 | @cil_conv_ovf_u2_un |
+  @cil_conv_i | @cil_conv_u | @cil_conv_r_un;
+
+@cil_ldind = @cil_ldind_i | @cil_ldind_i1 | @cil_ldind_i2 | @cil_ldind_i4 | @cil_ldind_i8 |
+  @cil_ldind_r4 | @cil_ldind_r8 | @cil_ldind_ref | @cil_ldind_u1 | @cil_ldind_u2 | @cil_ldind_u4;
+
+@cil_stind = @cil_stind_i | @cil_stind_i1 | @cil_stind_i2 | @cil_stind_i4 | @cil_stind_i8 |
+  @cil_stind_r4 | @cil_stind_r8 | @cil_stind_ref;
+
+@cil_bitwise_operation = @cil_binary_bitwise_operation | @cil_unary_bitwise_operation;
+
+@cil_binary_bitwise_operation = @cil_and | @cil_or | @cil_xor | @cil_shr | @cil_shr | @cil_shr_un | @cil_shl;
+
+@cil_binary_arithmetic_operation = @cil_add | @cil_sub | @cil_mul | @cil_div | @cil_div_un |
+  @cil_rem | @cil_rem_un | @cil_add_ovf | @cil_add_ovf_un | @cil_mul_ovf | @cil_mul_ovf_un |
+  @cil_sub_ovf | @cil_sub_ovf_un;
+
+@cil_unary_bitwise_operation = @cil_not;
+
+@cil_binary_expr = @cil_binary_arithmetic_operation | @cil_binary_bitwise_operation | @cil_read_array | @cil_comparison_operation;
+
+@cil_unary_arithmetic_operation = @cil_neg;
+
+@cil_comparison_operation = @cil_cgt_un | @cil_ceq | @cil_cgt | @cil_clt | @cil_clt_un;
+
+// Elements that retrieve an address of something
+@cil_read_ref = @cil_ldloca_s | @cil_ldarga_s | @cil_ldflda | @cil_ldsflda | @cil_ldelema;
+
+// CIL array instructions
+
+@cil_read_array =
+  @cil_ldelem | @cil_ldelema | @cil_ldelem_i1 | @cil_ldelem_ref | @cil_ldelem_i |
+  @cil_ldelem_i1 | @cil_ldelem_i2 | @cil_ldelem_i4 | @cil_ldelem_i8 | @cil_ldelem_r4 |
+  @cil_ldelem_r8 | @cil_ldelem_u1 | @cil_ldelem_u2 | @cil_ldelem_u4;
+
+@cil_write_array = @cil_stelem | @cil_stelem_ref |
+  @cil_stelem_i | @cil_stelem_i1 | @cil_stelem_i2 | @cil_stelem_i4 | @cil_stelem_i8 |
+  @cil_stelem_r4 | @cil_stelem_r8;
+
+@cil_throw_any = @cil_throw | @cil_rethrow;
+
+#keyset[impl, index]
+cil_instruction(
+  unique int id: @cil_instruction,
+  int opcode: int ref,
+  int index: int ref,
+  int impl: @cil_method_implementation ref);
+
+cil_jump(
+  unique int instruction: @cil_jump ref,
+  int target: @cil_instruction ref);
+
+cil_access(
+  unique int instruction: @cil_instruction ref,
+  int target: @cil_accessible ref);
+
+cil_value(
+  unique int instruction: @cil_literal ref,
+  string value: string ref);
+
+#keyset[instruction, index]
+cil_switch(
+  int instruction: @cil_switch ref,
+  int index: int ref,
+  int target: @cil_instruction ref);
+
+cil_instruction_location(
+  unique int id: @cil_instruction ref,
+  int loc: @location ref);
+
+cil_type_location(
+  int id: @cil_type ref,
+  int loc: @location ref);
+
+cil_method_location(
+  int id: @cil_method ref,
+  int loc: @location ref);
+
+@cil_namespace = @namespace;
+
+@cil_type_container = @cil_type | @cil_namespace | @cil_method;
+
+case @cil_type.kind of
+  0 = @cil_valueorreftype
+| 1 = @cil_typeparameter
+| 2 = @cil_array_type
+| 3 = @cil_pointer_type
+| 4 = @cil_function_pointer_type
+;
+
+cil_type(
+  unique int id: @cil_type,
+  string name: string ref,
+  int kind: int ref,
+  int parent: @cil_type_container ref,
+  int sourceDecl: @cil_type ref);
+
+cil_pointer_type(
+  unique int id: @cil_pointer_type ref,
+  int pointee: @cil_type ref);
+
+cil_array_type(
+  unique int id: @cil_array_type ref,
+  int element_type: @cil_type ref,
+  int rank: int ref);
+
+cil_function_pointer_return_type(
+  unique int id: @cil_function_pointer_type ref,
+  int return_type: @cil_type ref);
+
+cil_method(
+  unique int id: @cil_method,
+  string name: string ref,
+  int parent: @cil_type ref,
+  int return_type: @cil_type ref);
+
+cil_method_source_declaration(
+  unique int method: @cil_method ref,
+  int source: @cil_method ref);
+
+cil_method_implementation(
+  unique int id: @cil_method_implementation,
+  int method: @cil_method ref,
+  int location: @assembly ref);
+
+cil_implements(
+  int id: @cil_method ref,
+  int decl: @cil_method ref);
+
+#keyset[parent, name]
+cil_field(
+  unique int id: @cil_field,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int field_type: @cil_type ref);
+
+@cil_element = @cil_instruction | @cil_declaration | @cil_handler | @cil_attribute | @cil_namespace;
+@cil_named_element = @cil_declaration | @cil_namespace;
+@cil_declaration = @cil_variable | @cil_method | @cil_type | @cil_member;
+@cil_accessible = @cil_declaration;
+@cil_variable = @cil_field | @cil_stack_variable;
+@cil_stack_variable = @cil_local_variable | @cil_parameter;
+@cil_member = @cil_method | @cil_type | @cil_field | @cil_property | @cil_event;
+@cil_custom_modifier_receiver = @cil_method | @cil_property | @cil_parameter | @cil_field | @cil_function_pointer_type;
+@cil_parameterizable = @cil_method | @cil_function_pointer_type;
+@cil_has_type_annotation = @cil_stack_variable | @cil_property | @cil_method | @cil_function_pointer_type;
+
+#keyset[parameterizable, index]
+cil_parameter(
+  unique int id: @cil_parameter,
+  int parameterizable: @cil_parameterizable ref,
+  int index: int ref,
+  int param_type: @cil_type ref);
+
+cil_parameter_in(unique int id: @cil_parameter ref);
+cil_parameter_out(unique int id: @cil_parameter ref);
+
+cil_setter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+#keyset[id, modifier]
+cil_custom_modifiers(
+  int id: @cil_custom_modifier_receiver ref,
+  int modifier: @cil_type ref,
+  int kind: int ref); // modreq: 1, modopt: 0
+
+cil_type_annotation(
+  int id: @cil_has_type_annotation ref,
+  int annotation: int ref);
+
+cil_getter(unique int prop: @cil_property ref,
+  int method: @cil_method ref);
+
+cil_adder(unique int event: @cil_event ref,
+  int method: @cil_method ref);
+
+cil_remover(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_raiser(unique int event: @cil_event ref, int method: @cil_method ref);
+
+cil_property(
+  unique int id: @cil_property,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int property_type: @cil_type ref);
+
+#keyset[parent, name]
+cil_event(unique int id: @cil_event,
+  int parent: @cil_type ref,
+  string name: string ref,
+  int event_type: @cil_type ref);
+
+#keyset[impl, index]
+cil_local_variable(
+  unique int id: @cil_local_variable,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int var_type: @cil_type ref);
+
+cil_function_pointer_calling_conventions(
+  int id: @cil_function_pointer_type ref,
+  int kind: int ref);
+
+// CIL handlers (exception handlers etc).
+
+case @cil_handler.kind of
+  0 = @cil_catch_handler
+| 1 = @cil_filter_handler
+| 2 = @cil_finally_handler
+| 4 = @cil_fault_handler
+;
+
+#keyset[impl, index]
+cil_handler(
+  unique int id: @cil_handler,
+  int impl: @cil_method_implementation ref,
+  int index: int ref,
+  int kind: int ref,
+  int try_start: @cil_instruction ref,
+  int try_end: @cil_instruction ref,
+  int handler_start: @cil_instruction ref);
+
+cil_handler_filter(
+  unique int id: @cil_handler ref,
+  int filter_start: @cil_instruction ref);
+
+cil_handler_type(
+  unique int id: @cil_handler ref,
+  int catch_type: @cil_type ref);
+
+@cil_controlflow_node = @cil_entry_point | @cil_instruction;
+
+@cil_entry_point = @cil_method_implementation | @cil_handler;
+
+@cil_dataflow_node = @cil_instruction | @cil_variable | @cil_method;
+
+cil_method_stack_size(
+  unique int method: @cil_method_implementation ref,
+  int size: int ref);
+
+// CIL modifiers
+
+cil_public(int id: @cil_member ref);
+cil_private(int id: @cil_member ref);
+cil_protected(int id: @cil_member ref);
+cil_internal(int id: @cil_member ref);
+cil_static(int id: @cil_member ref);
+cil_sealed(int id: @cil_member ref);
+cil_virtual(int id: @cil_method ref);
+cil_abstract(int id: @cil_member ref);
+cil_class(int id: @cil_type ref);
+cil_interface(int id: @cil_type ref);
+cil_security(int id: @cil_member ref);
+cil_requiresecobject(int id: @cil_method ref);
+cil_specialname(int id: @cil_method ref);
+cil_newslot(int id: @cil_method ref);
+
+cil_base_class(unique int id: @cil_type ref, int base: @cil_type ref);
+cil_base_interface(int id: @cil_type ref, int base: @cil_type ref);
+cil_enum_underlying_type(unique int id: @cil_type ref, int underlying: @cil_type ref);
+
+#keyset[unbound, index]
+cil_type_parameter(
+  int unbound: @cil_member ref,
+  int index: int ref,
+  int param: @cil_typeparameter ref);
+
+#keyset[bound, index]
+cil_type_argument(
+  int bound: @cil_member ref,
+  int index: int ref,
+  int t: @cil_type ref);
+
+// CIL type parameter constraints
+
+cil_typeparam_covariant(int tp: @cil_typeparameter ref);
+cil_typeparam_contravariant(int tp: @cil_typeparameter ref);
+cil_typeparam_class(int tp: @cil_typeparameter ref);
+cil_typeparam_struct(int tp: @cil_typeparameter ref);
+cil_typeparam_new(int tp: @cil_typeparameter ref);
+cil_typeparam_constraint(int tp: @cil_typeparameter ref, int supertype: @cil_type ref);
+
+// CIL attributes
+
+cil_attribute(
+  unique int attributeid: @cil_attribute,
+  int element: @cil_declaration ref,
+  int constructor: @cil_method ref);
+
+#keyset[attribute_id, param]
+cil_attribute_named_argument(
+  int attribute_id: @cil_attribute ref,
+  string param: string ref,
+  string value: string ref);
+
+#keyset[attribute_id, index]
+cil_attribute_positional_argument(
+  int attribute_id: @cil_attribute ref,
+  int index: int ref,
+  string value: string ref);
+
+
+// Common .Net data model covering both C# and CIL
+
+// Common elements
+@dotnet_element = @element | @cil_element;
+@dotnet_named_element = @named_element | @cil_named_element;
+@dotnet_callable = @callable | @cil_method;
+@dotnet_variable = @variable | @cil_variable;
+@dotnet_field = @field | @cil_field;
+@dotnet_parameter = @parameter | @cil_parameter;
+@dotnet_declaration = @declaration | @cil_declaration;
+@dotnet_member = @member | @cil_member;
+@dotnet_event = @event | @cil_event;
+@dotnet_property = @property | @cil_property | @indexer;
+@dotnet_parameterizable = @parameterizable | @cil_parameterizable;
+
+// Common types
+@dotnet_type = @type | @cil_type;
+@dotnet_call = @call | @cil_call_any;
+@dotnet_throw = @throw_element | @cil_throw_any;
+@dotnet_valueorreftype = @cil_valueorreftype | @value_or_ref_type | @cil_array_type | @void_type;
+@dotnet_typeparameter = @type_parameter | @cil_typeparameter;
+@dotnet_array_type = @array_type | @cil_array_type;
+@dotnet_pointer_type = @pointer_type | @cil_pointer_type;
+@dotnet_type_parameter = @type_parameter | @cil_typeparameter;
+@dotnet_generic = @dotnet_valueorreftype | @dotnet_callable;
+
+// Attributes
+@dotnet_attribute = @attribute | @cil_attribute;
+
+// Expressions
+@dotnet_expr = @expr | @cil_expr;
+
+// Literals
+@dotnet_literal = @literal_expr | @cil_literal;
+@dotnet_string_literal = @string_literal_expr | @cil_ldstr;
+@dotnet_int_literal = @integer_literal_expr | @cil_ldc_i;
+@dotnet_float_literal = @float_literal_expr | @cil_ldc_r;
+@dotnet_null_literal = @null_literal_expr | @cil_ldnull;
+
+@metadata_entity = @cil_method | @cil_type | @cil_field | @cil_property | @field | @property |
+    @callable | @value_or_ref_type | @void_type;
+
+#keyset[entity, location]
+metadata_handle(int entity : @metadata_entity ref, int location: @assembly ref, int handle: int ref)
diff --git a/csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/upgrade.properties b/csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/upgrade.properties
new file mode 100644
index 00000000000..76895754bd0
--- /dev/null
+++ b/csharp/upgrades/dd813977f70fcbf737b0bbe9dc8297edff713168/upgrade.properties
@@ -0,0 +1,4 @@
+description: Added '@cil_function_pointer_type' and related relations ('cil_function_pointer_return_type',
+'cil_function_pointer_calling_conventions'). Introduced 'cil_type_annotation' and '@cil_has_type_annotation'
+to store by-reference type annotation. Added '@cil_parameterizable' to represent methods and type parameters.
+compatibility: backwards

From e7b43e50b6e014deb0ecbcc777c6b7ae524051b5 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Fri, 22 Jan 2021 10:25:10 +0100
Subject: [PATCH 291/343] C#: Remove `ReadKind` from the shared SSA library

---
 .../src/semmle/code/csharp/dataflow/SSA.qll   |  7 +-
 .../code/csharp/dataflow/internal/SsaImpl.qll |  8 ++-
 .../dataflow/internal/SsaImplCommon.qll       | 67 +++++++++----------
 .../dataflow/internal/SsaImplSpecific.qll     |  6 +-
 4 files changed, 42 insertions(+), 46 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index f1ba9523c31..7fe19636f58 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -233,10 +233,11 @@ module Ssa {
      *   node between lines 9 and 10.
      */
     final AssignableRead getAReadAtNode(ControlFlow::Node cfn) {
-      exists(ControlFlow::BasicBlock bb, int i |
-        SsaImpl::ssaDefReachesRead(_, this, bb, i, SsaImpl::ActualRead()) and
+      exists(SourceVariable v, ControlFlow::BasicBlock bb, int i |
+        SsaImpl::ssaDefReachesRead(v, this, bb, i) and
         cfn = bb.getNode(i) and
-        result.getAControlFlowNode() = cfn
+        cfn = result.getAControlFlowNode() and
+        result = v.getAnAccess().(AssignableRead)
       )
     }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index 54cf939e50c..47a3c84263b 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -1114,10 +1114,12 @@ private module Cached {
     Ssa::ExplicitDefinition def, Ssa::ImplicitEntryDefinition edef,
     ControlFlow::Nodes::ElementNode c, boolean additionalCalls
   ) {
-    exists(Definition def0, ControlFlow::BasicBlock bb, int i |
-      capturedReadIn(_, _, def.getSourceVariable(), edef.getSourceVariable(), c, additionalCalls) and
+    exists(Ssa::SourceVariable v, Definition def0, ControlFlow::BasicBlock bb, int i |
+      v = def.getSourceVariable() and
+      capturedReadIn(_, _, v, edef.getSourceVariable(), c, additionalCalls) and
       def = def0.getAnUltimateDefinition() and
-      ssaDefReachesRead(_, def0, bb, i, CapturedVarCallRead()) and
+      ssaDefReachesRead(_, def0, bb, i) and
+      variableRead(bb, i, v, CapturedVarCallRead()) and
       c = bb.getNode(i)
     )
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
index f1ffd7ff489..a3c3417f0aa 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
@@ -19,18 +19,18 @@ private module Cached {
      * (certain or uncertain) writes.
      */
     private newtype TRefKind =
-      Read(ReadKind rk) or
+      Read() or
       Write(boolean certain) { certain = true or certain = false }
 
     private class RefKind extends TRefKind {
       string toString() {
-        exists(ReadKind rk | this = Read(rk) and result = "read (" + rk + ")")
+        this = Read() and result = "read"
         or
         exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
       }
 
       int getOrder() {
-        this = Read(_) and
+        this = Read() and
         result = 0
         or
         this = Write(_) and
@@ -42,7 +42,7 @@ private module Cached {
      * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
      */
     private predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-      exists(ReadKind rk | variableRead(bb, i, v, rk) | k = Read(rk))
+      variableRead(bb, i, v) and k = Read()
       or
       exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
     }
@@ -94,40 +94,38 @@ private module Cached {
 
     /**
      * Holds if source variable `v` is live at the beginning of basic block `bb`.
-     * The read that witnesses the liveness of `v` is of kind `rk`.
      */
-    predicate liveAtEntry(BasicBlock bb, SourceVariable v, ReadKind rk) {
+    predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
       // The first read or certain write to `v` inside `bb` is a read
-      refRank(bb, _, v, Read(rk)) = firstReadOrCertainWrite(bb, v)
+      refRank(bb, _, v, Read()) = firstReadOrCertainWrite(bb, v)
       or
       // There is no certain write to `v` inside `bb`, but `v` is live at entry
       // to a successor basic block of `bb`
       not exists(firstReadOrCertainWrite(bb, v)) and
-      liveAtExit(bb, v, rk)
+      liveAtExit(bb, v)
     }
 
     /**
      * Holds if source variable `v` is live at the end of basic block `bb`.
-     * The read that witnesses the liveness of `v` is of kind `rk`.
      */
-    predicate liveAtExit(BasicBlock bb, SourceVariable v, ReadKind rk) {
-      liveAtEntry(getABasicBlockSuccessor(bb), v, rk)
+    predicate liveAtExit(BasicBlock bb, SourceVariable v) {
+      liveAtEntry(getABasicBlockSuccessor(bb), v)
     }
 
     /**
      * Holds if variable `v` is live in basic block `bb` at index `i`.
      * The rank of `i` is `rnk` as defined by `refRank()`.
      */
-    private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk, ReadKind rk) {
+    private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
       exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
         rnk = maxRefRank(bb, v) and
-        liveAtExit(bb, v, rk)
+        liveAtExit(bb, v)
         or
         ref(bb, i, v, kind) and
-        kind = Read(rk)
+        kind = Read()
         or
         exists(RefKind nextKind |
-          liveAtRank(bb, _, v, rnk + 1, rk) and
+          liveAtRank(bb, _, v, rnk + 1) and
           rnk + 1 = refRank(bb, _, v, nextKind) and
           nextKind != Write(true)
         )
@@ -136,11 +134,10 @@ private module Cached {
 
     /**
      * Holds if variable `v` is live after the (certain or uncertain) write at
-     * index `i` inside basic block `bb`. The read that witnesses the liveness of
-     * `v` is of kind `rk`.
+     * index `i` inside basic block `bb`.
      */
-    predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v, ReadKind rk) {
-      exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk, rk))
+    predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
+      exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
     }
   }
 
@@ -182,11 +179,11 @@ private module Cached {
   newtype TDefinition =
     TWriteDef(SourceVariable v, BasicBlock bb, int i) {
       variableWrite(bb, i, v, _) and
-      liveAfterWrite(bb, i, v, _)
+      liveAfterWrite(bb, i, v)
     } or
     TPhiNode(SourceVariable v, BasicBlock bb) {
       inDefDominanceFrontier(bb, v) and
-      liveAtEntry(bb, v, _)
+      liveAtEntry(bb, v)
     }
 
   private module SsaDefReaches {
@@ -223,7 +220,7 @@ private module Cached {
      * Unlike `Liveness::ref`, this includes `phi` nodes.
      */
     predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-      variableRead(bb, i, v, _) and
+      variableRead(bb, i, v) and
       k = SsaRead()
       or
       exists(Definition def | def.definesAt(v, bb, i)) and
@@ -287,16 +284,12 @@ private module Cached {
     /**
      * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
      * basic block `bb`, without crossing another SSA definition of `v`.
-     *
-     * The read at `i` is of kind `rk`.
      */
-    predicate ssaDefReachesReadWithinBlock(
-      SourceVariable v, Definition def, BasicBlock bb, int i, ReadKind rk
-    ) {
+    predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
       exists(int rnk |
         ssaDefReachesRank(bb, def, rnk, v) and
         rnk = ssaRefRank(bb, i, v, SsaRead()) and
-        variableRead(bb, i, v, rk)
+        variableRead(bb, i, v)
       )
     }
 
@@ -321,7 +314,7 @@ private module Cached {
       v = def.getSourceVariable() and
       result = ssaRefRank(bb, i, v, k) and
       (
-        ssaDefReachesRead(_, def, bb, i, _)
+        ssaDefReachesRead(_, def, bb, i)
         or
         def.definesAt(_, bb, i)
       )
@@ -362,7 +355,7 @@ private module Cached {
     predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
       varBlockReaches(def, bb1, bb2) and
       ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1 and
-      variableRead(bb2, i2, _, _)
+      variableRead(bb2, i2, _)
     }
   }
 
@@ -390,11 +383,11 @@ private module Cached {
   predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
     exists(int last | last = maxSsaRefRank(bb, v) |
       ssaDefReachesRank(bb, def, last, v) and
-      liveAtExit(bb, v, _)
+      liveAtExit(bb, v)
     )
     or
     ssaDefReachesEndOfBlockRec(bb, def, v) and
-    liveAtExit(bb, v, _) and
+    liveAtExit(bb, v) and
     not ssaRef(bb, _, v, SsaDef())
   }
 
@@ -404,12 +397,12 @@ private module Cached {
    * is of kind `rk`.
    */
   cached
-  predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i, ReadKind rk) {
-    ssaDefReachesReadWithinBlock(v, def, bb, i, rk)
+  predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
+    ssaDefReachesReadWithinBlock(v, def, bb, i)
     or
-    variableRead(bb, i, v, rk) and
+    variableRead(bb, i, v) and
     ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-    not ssaDefReachesReadWithinBlock(v, _, bb, i, _)
+    not ssaDefReachesReadWithinBlock(v, _, bb, i)
   }
 
   /**
@@ -439,7 +432,7 @@ private module Cached {
     exists(int rnk |
       rnk = ssaDefRank(def, _, bb1, i1, _) and
       rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaRead()) and
-      variableRead(bb1, i2, _, _) and
+      variableRead(bb1, i2, _) and
       bb2 = bb1
     )
     or
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
index e71b469368a..3c18ad905c7 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
@@ -12,10 +12,10 @@ BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor()
 
 class ExitBasicBlock = ControlFlow::BasicBlocks::ExitBlock;
 
-class ReadKind = SsaImpl::ReadKind;
-
 class SourceVariable = SsaImpl::TSourceVariable;
 
 predicate variableWrite = SsaImpl::variableWrite/4;
 
-predicate variableRead = SsaImpl::variableRead/4;
+predicate variableRead(BasicBlock bb, int i, SourceVariable v) {
+  SsaImpl::variableRead(bb, i, v, _)
+}

From 008035715329b2e68df70ba497e9d07f5dc559b1 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 24 Nov 2020 12:54:14 +0100
Subject: [PATCH 292/343] C#: Add unary pattern CFG tests

---
 .../controlflow/graph/BasicBlock.expected     |  18 +-
 .../controlflow/graph/Condition.expected      |  21 +-
 .../controlflow/graph/Dominance.expected      | 206 ++++++++++++--
 .../graph/EnclosingCallable.expected          | 257 +++++++++++-------
 .../controlflow/graph/EntryElement.expected   |  44 +++
 .../controlflow/graph/ExitElement.expected    |  46 ++++
 .../controlflow/graph/ExtractorOptions.cs     |   1 -
 .../controlflow/graph/NodeGraph.expected      |  60 +++-
 .../controlflow/graph/Nodes.expected          |   7 +-
 .../controlflow/graph/Patterns.cs             |  31 ++-
 10 files changed, 557 insertions(+), 134 deletions(-)
 delete mode 100644 csharp/ql/test/library-tests/controlflow/graph/ExtractorOptions.cs

diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
index 6f3b0b5e956..4b6d6aea058 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
@@ -924,7 +924,7 @@
 | NullCoalescing.cs:15:31:15:31 | 0 | NullCoalescing.cs:16:17:16:18 | "" | 5 |
 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | NullCoalescing.cs:17:13:17:19 | (...) ... | 5 |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:13:10:13:11 | exit M6 | 4 |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:8:13:8:23 | ... is ... | 9 |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:8:13:8:23 | ... is ... | 9 |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:10:13:10:42 | call to method WriteLine | 6 |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:18:12:31 | ... is ... | 4 |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:14:13:14:45 | call to method WriteLine | 6 |
@@ -942,7 +942,21 @@
 | Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:33:18:33:23 | Object v2 | 2 |
 | Patterns.cs:34:17:34:22 | break; | Patterns.cs:34:17:34:22 | break; | 1 |
 | Patterns.cs:35:13:35:20 | default: | Patterns.cs:37:17:37:22 | break; | 5 |
-| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:13 | exit Test | 4 |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | exit M1 | 4 |
+| Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:47:24:47:25 | exit M2 | 7 |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:21 | ... is ... | 5 |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | exit M3 | 3 |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:25:51:30 | ... is ... | 3 |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:34:51:39 | ... is ... | 3 |
+| Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:53:24:53:25 | exit M4 | 10 |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:13:60:17 | not ... | 5 |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:56:26:56:27 | exit M5 | 4 |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:13:60:28 | ... => ... | 2 |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:13:61:13 | _ | 1 |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:13:61:24 | ... => ... | 2 |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:69:13:69:17 | not ... | 5 |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 | 1 |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | exit M6 | 6 |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | exit M1 | 7 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:13:12:21 | ... is ... | 6 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | exit M2 | 2 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
index 3f1653363c8..a65a25d0a89 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
@@ -1783,11 +1783,11 @@ conditionBlock
 | NullCoalescing.cs:15:31:15:31 | 0 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | false |
 | NullCoalescing.cs:15:31:15:31 | 0 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | false |
 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... | false |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:9:9:11:9 | {...} | true |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:12:14:18:9 | if (...) ... | false |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:13:9:15:9 | {...} | false |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:16:14:18:9 | if (...) ... | false |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:17:9:18:9 | {...} | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:9:9:11:9 | {...} | true |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:12:14:18:9 | if (...) ... | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:13:9:15:9 | {...} | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:16:14:18:9 | if (...) ... | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:17:9:18:9 | {...} | false |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:13:9:15:9 | {...} | true |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:16:14:18:9 | if (...) ... | false |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:17:9:18:9 | {...} | false |
@@ -1818,6 +1818,15 @@ conditionBlock
 | Patterns.cs:30:13:30:27 | case ...: | Patterns.cs:35:13:35:20 | default: | false |
 | Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:34:17:34:22 | break; | true |
 | Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:35:13:35:20 | default: | false |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:25:51:25 | access to parameter c | true |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:34:51:34 | access to parameter c | false |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:22:60:28 | "not 1" | true |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:13:61:13 | _ | false |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:18:61:24 | "other" | false |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:18:61:24 | "other" | true |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:13:70:13 | 2 | false |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:18:70:27 | "possible" | false |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" | true |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:13:13:13:19 | return ...; | true |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:14:9:14:29 | ...; | false |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:20:45:20:53 | nameof(...) | true |
@@ -2711,6 +2720,8 @@ conditionFlow
 | Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:20:9:38:9 | switch (...) {...} | false |
 | Patterns.cs:24:30:24:35 | ... > ... | Patterns.cs:25:17:25:52 | ...; | true |
 | Patterns.cs:24:30:24:35 | ... > ... | Patterns.cs:27:13:27:24 | case ...: | false |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:25:51:25 | access to parameter c | true |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:34:51:34 | access to parameter c | false |
 | PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:13:13:13:19 | return ...; | true |
 | PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:14:9:14:29 | ...; | false |
 | PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:20:45:20:53 | nameof(...) | true |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
index 8fe3dbbf796..04ec56a11a4 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
@@ -3050,8 +3050,8 @@ dominance
 | NullCoalescing.cs:17:13:17:19 | (...) ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:17:9:17:24 | ... = ... |
 | NullCoalescing.cs:17:19:17:19 | access to parameter i | NullCoalescing.cs:17:13:17:19 | (...) ... |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:6:5:43:5 | {...} |
-| Patterns.cs:5:10:5:13 | exit Test (normal) | Patterns.cs:5:10:5:13 | exit Test |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:6:5:43:5 | {...} |
+| Patterns.cs:5:10:5:11 | exit M1 (normal) | Patterns.cs:5:10:5:11 | exit M1 |
 | Patterns.cs:6:5:43:5 | {...} | Patterns.cs:7:9:7:24 | ... ...; |
 | Patterns.cs:7:9:7:24 | ... ...; | Patterns.cs:7:20:7:23 | null |
 | Patterns.cs:7:16:7:23 | Object o = ... | Patterns.cs:8:9:18:9 | if (...) ... |
@@ -3120,7 +3120,57 @@ dominance
 | Patterns.cs:36:17:36:52 | ...; | Patterns.cs:36:35:36:50 | "Something else" |
 | Patterns.cs:36:35:36:50 | "Something else" | Patterns.cs:36:17:36:51 | call to method WriteLine |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:40:17:40:17 | access to local variable o |
-| Patterns.cs:40:17:40:17 | access to local variable o | Patterns.cs:5:10:5:13 | exit Test (normal) |
+| Patterns.cs:40:17:40:17 | access to local variable o | Patterns.cs:5:10:5:11 | exit M1 (normal) |
+| Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:48:9:48:9 | access to parameter c |
+| Patterns.cs:47:24:47:25 | exit M2 (normal) | Patterns.cs:47:24:47:25 | exit M2 |
+| Patterns.cs:48:9:48:9 | access to parameter c | Patterns.cs:48:18:48:20 | a |
+| Patterns.cs:48:9:48:20 | ... is ... | Patterns.cs:47:24:47:25 | exit M2 (normal) |
+| Patterns.cs:48:14:48:20 | not ... | Patterns.cs:48:9:48:20 | ... is ... |
+| Patterns.cs:48:18:48:20 | a | Patterns.cs:48:14:48:20 | not ... |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:9 | access to parameter c |
+| Patterns.cs:50:24:50:25 | exit M3 (normal) | Patterns.cs:50:24:50:25 | exit M3 |
+| Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:51:18:51:21 | null |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | exit M3 (normal) |
+| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:9:51:21 | ... is ... |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:14:51:21 | not ... |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:30:51:30 | 1 |
+| Patterns.cs:51:30:51:30 | 1 | Patterns.cs:51:25:51:30 | ... is ... |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:39:51:39 | 2 |
+| Patterns.cs:51:39:51:39 | 2 | Patterns.cs:51:34:51:39 | ... is ... |
+| Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:54:9:54:9 | access to parameter c |
+| Patterns.cs:53:24:53:25 | exit M4 (normal) | Patterns.cs:53:24:53:25 | exit M4 |
+| Patterns.cs:54:9:54:9 | access to parameter c | Patterns.cs:54:18:54:37 | Patterns u |
+| Patterns.cs:54:9:54:37 | ... is ... | Patterns.cs:53:24:53:25 | exit M4 (normal) |
+| Patterns.cs:54:14:54:37 | not ... | Patterns.cs:54:9:54:37 | ... is ... |
+| Patterns.cs:54:18:54:37 | Patterns u | Patterns.cs:54:33:54:33 | 1 |
+| Patterns.cs:54:18:54:37 | { ... } | Patterns.cs:54:14:54:37 | not ... |
+| Patterns.cs:54:27:54:35 | { ... } | Patterns.cs:54:18:54:37 | { ... } |
+| Patterns.cs:54:33:54:33 | 1 | Patterns.cs:54:27:54:35 | { ... } |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:57:5:63:5 | {...} |
+| Patterns.cs:56:26:56:27 | exit M5 (normal) | Patterns.cs:56:26:56:27 | exit M5 |
+| Patterns.cs:57:5:63:5 | {...} | Patterns.cs:58:16:58:16 | access to parameter i |
+| Patterns.cs:58:9:62:10 | return ...; | Patterns.cs:56:26:56:27 | exit M5 (normal) |
+| Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:60:17:60:17 | 1 |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:9:62:10 | return ...; |
+| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:13:60:17 | not ... |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:13:60:28 | ... => ... |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:18:61:24 | "other" |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:13:61:24 | ... => ... |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:66:5:72:5 | {...} |
+| Patterns.cs:65:26:65:27 | exit M6 (normal) | Patterns.cs:65:26:65:27 | exit M6 |
+| Patterns.cs:66:5:72:5 | {...} | Patterns.cs:67:16:67:16 | 2 |
+| Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:65:26:65:27 | exit M6 (normal) |
+| Patterns.cs:67:16:67:16 | 2 | Patterns.cs:69:17:69:17 | 2 |
+| Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:67:9:71:10 | return ...; |
+| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:13:69:17 | not ... |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" |
+| Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:67:16:71:9 | ... switch { ... } |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:27 | ... => ... |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:6:5:8:5 | {...} |
 | PostDominance.cs:5:10:5:11 | exit M1 (normal) | PostDominance.cs:5:10:5:11 | exit M1 |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:7:9:7:29 | ...; |
@@ -6992,9 +7042,9 @@ postDominance
 | NullCoalescing.cs:17:13:17:19 | (...) ... | NullCoalescing.cs:17:19:17:19 | access to parameter i |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:17:13:17:19 | (...) ... |
 | NullCoalescing.cs:17:19:17:19 | access to parameter i | NullCoalescing.cs:17:9:17:25 | ...; |
-| Patterns.cs:5:10:5:13 | exit Test | Patterns.cs:5:10:5:13 | exit Test (normal) |
-| Patterns.cs:5:10:5:13 | exit Test (normal) | Patterns.cs:40:17:40:17 | access to local variable o |
-| Patterns.cs:6:5:43:5 | {...} | Patterns.cs:5:10:5:13 | enter Test |
+| Patterns.cs:5:10:5:11 | exit M1 | Patterns.cs:5:10:5:11 | exit M1 (normal) |
+| Patterns.cs:5:10:5:11 | exit M1 (normal) | Patterns.cs:40:17:40:17 | access to local variable o |
+| Patterns.cs:6:5:43:5 | {...} | Patterns.cs:5:10:5:11 | enter M1 |
 | Patterns.cs:7:9:7:24 | ... ...; | Patterns.cs:6:5:43:5 | {...} |
 | Patterns.cs:7:16:7:23 | Object o = ... | Patterns.cs:7:20:7:23 | null |
 | Patterns.cs:7:20:7:23 | null | Patterns.cs:7:9:7:24 | ... ...; |
@@ -7057,6 +7107,56 @@ postDominance
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:34:17:34:22 | break; |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:37:17:37:22 | break; |
 | Patterns.cs:40:17:40:17 | access to local variable o | Patterns.cs:40:9:42:9 | switch (...) {...} |
+| Patterns.cs:47:24:47:25 | exit M2 | Patterns.cs:47:24:47:25 | exit M2 (normal) |
+| Patterns.cs:47:24:47:25 | exit M2 (normal) | Patterns.cs:48:9:48:20 | ... is ... |
+| Patterns.cs:48:9:48:9 | access to parameter c | Patterns.cs:47:24:47:25 | enter M2 |
+| Patterns.cs:48:9:48:20 | ... is ... | Patterns.cs:48:14:48:20 | not ... |
+| Patterns.cs:48:14:48:20 | not ... | Patterns.cs:48:18:48:20 | a |
+| Patterns.cs:48:18:48:20 | a | Patterns.cs:48:9:48:9 | access to parameter c |
+| Patterns.cs:50:24:50:25 | exit M3 | Patterns.cs:50:24:50:25 | exit M3 (normal) |
+| Patterns.cs:50:24:50:25 | exit M3 (normal) | Patterns.cs:51:9:51:39 | ... ? ... : ... |
+| Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:50:24:50:25 | enter M3 |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:14:51:21 | not ... |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:25:51:30 | ... is ... |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:34:51:39 | ... is ... |
+| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:18:51:21 | null |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:9:51:9 | access to parameter c |
+| Patterns.cs:51:25:51:30 | ... is ... | Patterns.cs:51:30:51:30 | 1 |
+| Patterns.cs:51:30:51:30 | 1 | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:34:51:39 | ... is ... | Patterns.cs:51:39:51:39 | 2 |
+| Patterns.cs:51:39:51:39 | 2 | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:53:24:53:25 | exit M4 | Patterns.cs:53:24:53:25 | exit M4 (normal) |
+| Patterns.cs:53:24:53:25 | exit M4 (normal) | Patterns.cs:54:9:54:37 | ... is ... |
+| Patterns.cs:54:9:54:9 | access to parameter c | Patterns.cs:53:24:53:25 | enter M4 |
+| Patterns.cs:54:9:54:37 | ... is ... | Patterns.cs:54:14:54:37 | not ... |
+| Patterns.cs:54:14:54:37 | not ... | Patterns.cs:54:18:54:37 | { ... } |
+| Patterns.cs:54:18:54:37 | Patterns u | Patterns.cs:54:9:54:9 | access to parameter c |
+| Patterns.cs:54:18:54:37 | { ... } | Patterns.cs:54:27:54:35 | { ... } |
+| Patterns.cs:54:27:54:35 | { ... } | Patterns.cs:54:33:54:33 | 1 |
+| Patterns.cs:54:33:54:33 | 1 | Patterns.cs:54:18:54:37 | Patterns u |
+| Patterns.cs:56:26:56:27 | exit M5 | Patterns.cs:56:26:56:27 | exit M5 (normal) |
+| Patterns.cs:56:26:56:27 | exit M5 (normal) | Patterns.cs:58:9:62:10 | return ...; |
+| Patterns.cs:57:5:63:5 | {...} | Patterns.cs:56:26:56:27 | enter M5 |
+| Patterns.cs:58:9:62:10 | return ...; | Patterns.cs:58:16:62:9 | ... switch { ... } |
+| Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:57:5:63:5 | {...} |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:60:13:60:28 | ... => ... |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:61:13:61:24 | ... => ... |
+| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:17:60:17 | 1 |
+| Patterns.cs:60:13:60:28 | ... => ... | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:58:16:58:16 | access to parameter i |
+| Patterns.cs:61:13:61:24 | ... => ... | Patterns.cs:61:18:61:24 | "other" |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:65:26:65:27 | exit M6 | Patterns.cs:65:26:65:27 | exit M6 (normal) |
+| Patterns.cs:65:26:65:27 | exit M6 (normal) | Patterns.cs:67:9:71:10 | return ...; |
+| Patterns.cs:66:5:72:5 | {...} | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:67:16:71:9 | ... switch { ... } |
+| Patterns.cs:67:16:67:16 | 2 | Patterns.cs:66:5:72:5 | {...} |
+| Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:70:13:70:27 | ... => ... |
+| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:69:17:69:17 | 2 |
+| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:67:16:67:16 | 2 |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:69:13:69:17 | not ... |
+| Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:70:18:70:27 | "possible" |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:13 | 2 |
 | PostDominance.cs:5:10:5:11 | exit M1 | PostDominance.cs:5:10:5:11 | exit M1 (normal) |
 | PostDominance.cs:5:10:5:11 | exit M1 (normal) | PostDominance.cs:7:9:7:28 | call to method WriteLine |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:5:10:5:11 | enter M1 |
@@ -11410,25 +11510,25 @@ blockDominance
 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | NullCoalescing.cs:16:17:16:25 | ... ?? ... |
 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:5:10:5:13 | enter Test |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:9:9:11:9 | {...} |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:12:14:18:9 | if (...) ... |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:13:9:15:9 | {...} |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:16:14:18:9 | if (...) ... |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:17:9:18:9 | {...} |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:20:9:38:9 | switch (...) {...} |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:23:17:23:22 | break; |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:24:13:24:36 | case ...: |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:24:30:24:31 | access to local variable i2 |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:25:17:25:52 | ...; |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:27:13:27:24 | case ...: |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:28:17:28:47 | ...; |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:30:13:30:27 | case ...: |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:31:17:31:50 | ...; |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:33:13:33:24 | case ...: |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:34:17:34:22 | break; |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:35:13:35:20 | default: |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:40:9:42:9 | switch (...) {...} |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:5:10:5:11 | enter M1 |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:9:9:11:9 | {...} |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:12:14:18:9 | if (...) ... |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:13:9:15:9 | {...} |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:17:9:18:9 | {...} |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:20:9:38:9 | switch (...) {...} |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:23:17:23:22 | break; |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:24:13:24:36 | case ...: |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:24:30:24:31 | access to local variable i2 |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:25:17:25:52 | ...; |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:27:13:27:24 | case ...: |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:28:17:28:47 | ...; |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:30:13:30:27 | case ...: |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:31:17:31:50 | ...; |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:33:13:33:24 | case ...: |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:34:17:34:22 | break; |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:35:13:35:20 | default: |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:40:9:42:9 | switch (...) {...} |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:14:18:9 | if (...) ... |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:13:9:15:9 | {...} |
@@ -11485,6 +11585,31 @@ blockDominance
 | Patterns.cs:34:17:34:22 | break; | Patterns.cs:34:17:34:22 | break; |
 | Patterns.cs:35:13:35:20 | default: | Patterns.cs:35:13:35:20 | default: |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:40:9:42:9 | switch (...) {...} |
+| Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:47:24:47:25 | enter M2 |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:50:24:50:25 | enter M3 |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:39 | ... ? ... : ... |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:9:51:39 | ... ? ... : ... |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:53:24:53:25 | enter M4 |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:56:26:56:27 | enter M5 |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:58:16:62:9 | ... switch { ... } |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:18:61:24 | "other" |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:16:62:9 | ... switch { ... } |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:18:61:24 | "other" |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:18:61:24 | "other" |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:18:70:27 | "possible" |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | enter M1 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | enter M2 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | exit M2 (normal) |
@@ -14694,13 +14819,13 @@ postBlockDominance
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:15:31:15:31 | 0 |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:16:17:16:25 | ... ?? ... |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:5:10:5:13 | enter Test |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:5:10:5:11 | enter M1 |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:14:18:9 | if (...) ... |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:13:9:15:9 | {...} |
 | Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:14:18:9 | if (...) ... |
 | Patterns.cs:17:9:18:9 | {...} | Patterns.cs:17:9:18:9 | {...} |
-| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:5:10:5:13 | enter Test |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | enter M1 |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:12:14:18:9 | if (...) ... |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:13:9:15:9 | {...} |
@@ -14718,7 +14843,7 @@ postBlockDominance
 | Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:33:13:33:24 | case ...: |
 | Patterns.cs:34:17:34:22 | break; | Patterns.cs:34:17:34:22 | break; |
 | Patterns.cs:35:13:35:20 | default: | Patterns.cs:35:13:35:20 | default: |
-| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:13 | enter Test |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | enter M1 |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:12:14:18:9 | if (...) ... |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:13:9:15:9 | {...} |
@@ -14737,6 +14862,31 @@ postBlockDominance
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:34:17:34:22 | break; |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:35:13:35:20 | default: |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:40:9:42:9 | switch (...) {...} |
+| Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:47:24:47:25 | enter M2 |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:50:24:50:25 | enter M3 |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | enter M3 |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:9:51:39 | ... ? ... : ... |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:53:24:53:25 | enter M4 |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:56:26:56:27 | enter M5 |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:56:26:56:27 | enter M5 |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:16:62:9 | ... switch { ... } |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:61:18:61:24 | "other" |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:18:61:24 | "other" |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | enter M1 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | enter M2 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | enter M2 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
index 3ab6261019f..ff77b166891 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
@@ -3484,80 +3484,137 @@ nodeEnclosing
 | NullCoalescing.cs:17:13:17:19 | (...) ... | NullCoalescing.cs:13:10:13:11 | M6 |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:13:10:13:11 | M6 |
 | NullCoalescing.cs:17:19:17:19 | access to parameter i | NullCoalescing.cs:13:10:13:11 | M6 |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:5:10:5:13 | exit Test | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:5:10:5:13 | exit Test (normal) | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:6:5:43:5 | {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:7:9:7:24 | ... ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:7:16:7:23 | Object o = ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:7:20:7:23 | null | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:8:9:18:9 | if (...) ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:8:13:8:13 | access to local variable o | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:9:9:11:9 | {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:10:13:10:42 | call to method WriteLine | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:10:13:10:43 | ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:10:31:10:41 | $"..." | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:10:33:10:36 | "int " | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:10:38:10:39 | access to local variable i1 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:12:18:12:18 | access to local variable o | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:13:9:15:9 | {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:14:13:14:45 | call to method WriteLine | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:14:13:14:46 | ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:14:31:14:44 | $"..." | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:14:33:14:39 | "string " | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:14:41:14:42 | access to local variable s1 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:16:18:16:18 | access to local variable o | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:17:9:18:9 | {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:20:17:20:17 | access to local variable o | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:22:13:22:23 | case ...: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:22:18:22:22 | "xyz" | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:23:17:23:22 | break; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:24:13:24:36 | case ...: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:24:18:24:23 | Int32 i2 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:24:30:24:31 | access to local variable i2 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:24:30:24:35 | ... > ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:24:35:24:35 | 0 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:25:17:25:51 | call to method WriteLine | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:25:17:25:52 | ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:25:35:25:50 | $"..." | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:25:37:25:45 | "positive " | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:25:47:25:48 | access to local variable i2 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:26:17:26:22 | break; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:27:13:27:24 | case ...: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:27:18:27:23 | Int32 i3 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:28:17:28:46 | call to method WriteLine | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:28:17:28:47 | ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:28:35:28:45 | $"..." | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:28:37:28:40 | "int " | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:28:42:28:43 | access to local variable i3 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:29:17:29:22 | break; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:30:13:30:27 | case ...: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:30:18:30:26 | String s2 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:31:17:31:49 | call to method WriteLine | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:31:17:31:50 | ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:31:35:31:48 | $"..." | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:31:37:31:43 | "string " | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:31:45:31:46 | access to local variable s2 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:32:17:32:22 | break; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:33:18:33:23 | Object v2 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:34:17:34:22 | break; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:35:13:35:20 | default: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:36:17:36:51 | call to method WriteLine | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:36:17:36:52 | ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:36:35:36:50 | "Something else" | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:37:17:37:22 | break; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:40:17:40:17 | access to local variable o | Patterns.cs:5:10:5:13 | Test |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:5:10:5:11 | exit M1 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:5:10:5:11 | exit M1 (normal) | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:6:5:43:5 | {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:7:9:7:24 | ... ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:7:16:7:23 | Object o = ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:7:20:7:23 | null | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:8:9:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:8:13:8:13 | access to local variable o | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:9:9:11:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:10:13:10:42 | call to method WriteLine | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:10:13:10:43 | ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:10:31:10:41 | $"..." | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:10:33:10:36 | "int " | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:10:38:10:39 | access to local variable i1 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:12:18:12:18 | access to local variable o | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:13:9:15:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:14:13:14:45 | call to method WriteLine | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:14:13:14:46 | ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:14:31:14:44 | $"..." | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:14:33:14:39 | "string " | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:14:41:14:42 | access to local variable s1 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:16:18:16:18 | access to local variable o | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:17:9:18:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:20:17:20:17 | access to local variable o | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:22:13:22:23 | case ...: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:22:18:22:22 | "xyz" | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:23:17:23:22 | break; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:24:13:24:36 | case ...: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:24:18:24:23 | Int32 i2 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:24:30:24:31 | access to local variable i2 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:24:30:24:35 | ... > ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:24:35:24:35 | 0 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:25:17:25:51 | call to method WriteLine | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:25:17:25:52 | ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:25:35:25:50 | $"..." | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:25:37:25:45 | "positive " | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:25:47:25:48 | access to local variable i2 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:26:17:26:22 | break; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:27:13:27:24 | case ...: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:27:18:27:23 | Int32 i3 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:28:17:28:46 | call to method WriteLine | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:28:17:28:47 | ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:28:35:28:45 | $"..." | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:28:37:28:40 | "int " | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:28:42:28:43 | access to local variable i3 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:29:17:29:22 | break; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:30:13:30:27 | case ...: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:30:18:30:26 | String s2 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:31:17:31:49 | call to method WriteLine | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:31:17:31:50 | ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:31:35:31:48 | $"..." | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:31:37:31:43 | "string " | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:31:45:31:46 | access to local variable s2 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:32:17:32:22 | break; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:33:18:33:23 | Object v2 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:34:17:34:22 | break; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:35:13:35:20 | default: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:36:17:36:51 | call to method WriteLine | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:36:17:36:52 | ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:36:35:36:50 | "Something else" | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:37:17:37:22 | break; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:40:17:40:17 | access to local variable o | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:47:24:47:25 | M2 |
+| Patterns.cs:47:24:47:25 | exit M2 | Patterns.cs:47:24:47:25 | M2 |
+| Patterns.cs:47:24:47:25 | exit M2 (normal) | Patterns.cs:47:24:47:25 | M2 |
+| Patterns.cs:48:9:48:9 | access to parameter c | Patterns.cs:47:24:47:25 | M2 |
+| Patterns.cs:48:9:48:20 | ... is ... | Patterns.cs:47:24:47:25 | M2 |
+| Patterns.cs:48:14:48:20 | not ... | Patterns.cs:47:24:47:25 | M2 |
+| Patterns.cs:48:18:48:20 | a | Patterns.cs:47:24:47:25 | M2 |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:50:24:50:25 | exit M3 | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:50:24:50:25 | exit M3 (normal) | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:25:51:30 | ... is ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:30:51:30 | 1 | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:34:51:39 | ... is ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:39:51:39 | 2 | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:53:24:53:25 | exit M4 | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:53:24:53:25 | exit M4 (normal) | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:54:9:54:9 | access to parameter c | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:54:9:54:37 | ... is ... | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:54:14:54:37 | not ... | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:54:18:54:37 | Patterns u | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:54:18:54:37 | { ... } | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:54:27:54:35 | { ... } | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:54:33:54:33 | 1 | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:56:26:56:27 | exit M5 | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:56:26:56:27 | exit M5 (normal) | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:57:5:63:5 | {...} | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:58:9:62:10 | return ...; | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:60:13:60:28 | ... => ... | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:61:13:61:24 | ... => ... | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:65:26:65:27 | exit M6 | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:65:26:65:27 | exit M6 (normal) | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:66:5:72:5 | {...} | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:67:16:67:16 | 2 | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | M6 |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | M1 |
 | PostDominance.cs:5:10:5:11 | exit M1 | PostDominance.cs:5:10:5:11 | M1 |
 | PostDominance.cs:5:10:5:11 | exit M1 (normal) | PostDominance.cs:5:10:5:11 | M1 |
@@ -5634,25 +5691,39 @@ blockEnclosing
 | NullCoalescing.cs:15:31:15:31 | 0 | NullCoalescing.cs:13:10:13:11 | M6 |
 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | NullCoalescing.cs:13:10:13:11 | M6 |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:13:10:13:11 | M6 |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:9:9:11:9 | {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:13:9:15:9 | {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:17:9:18:9 | {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:23:17:23:22 | break; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:24:13:24:36 | case ...: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:24:30:24:31 | access to local variable i2 | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:25:17:25:52 | ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:27:13:27:24 | case ...: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:28:17:28:47 | ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:30:13:30:27 | case ...: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:31:17:31:50 | ...; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:34:17:34:22 | break; | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:35:13:35:20 | default: | Patterns.cs:5:10:5:13 | Test |
-| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:13 | Test |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:9:9:11:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:13:9:15:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:17:9:18:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:23:17:23:22 | break; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:24:13:24:36 | case ...: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:24:30:24:31 | access to local variable i2 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:25:17:25:52 | ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:27:13:27:24 | case ...: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:28:17:28:47 | ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:30:13:30:27 | case ...: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:31:17:31:50 | ...; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:34:17:34:22 | break; | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:35:13:35:20 | default: | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:47:24:47:25 | M2 |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:53:24:53:25 | M4 |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | M6 |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | M1 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | M2 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected b/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
index 610c8d7f8eb..087bcc9b5d3 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
@@ -2216,6 +2216,50 @@
 | Patterns.cs:37:17:37:22 | break; | Patterns.cs:37:17:37:22 | break; |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:40:9:42:9 | switch (...) {...} |
 | Patterns.cs:40:17:40:17 | access to local variable o | Patterns.cs:40:17:40:17 | access to local variable o |
+| Patterns.cs:48:9:48:9 | access to parameter c | Patterns.cs:48:9:48:9 | access to parameter c |
+| Patterns.cs:48:9:48:20 | ... is ... | Patterns.cs:48:9:48:9 | access to parameter c |
+| Patterns.cs:48:14:48:20 | not ... | Patterns.cs:48:18:48:20 | a |
+| Patterns.cs:48:18:48:20 | a | Patterns.cs:48:18:48:20 | a |
+| Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:51:9:51:9 | access to parameter c |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:9:51:9 | access to parameter c |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:9:51:9 | access to parameter c |
+| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:18:51:21 | null |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:18:51:21 | null |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:25:51:30 | ... is ... | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:30:51:30 | 1 | Patterns.cs:51:30:51:30 | 1 |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:34:51:39 | ... is ... | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:39:51:39 | 2 | Patterns.cs:51:39:51:39 | 2 |
+| Patterns.cs:54:9:54:9 | access to parameter c | Patterns.cs:54:9:54:9 | access to parameter c |
+| Patterns.cs:54:9:54:37 | ... is ... | Patterns.cs:54:9:54:9 | access to parameter c |
+| Patterns.cs:54:14:54:37 | not ... | Patterns.cs:54:18:54:37 | Patterns u |
+| Patterns.cs:54:18:54:37 | Patterns u | Patterns.cs:54:18:54:37 | Patterns u |
+| Patterns.cs:54:18:54:37 | { ... } | Patterns.cs:54:18:54:37 | Patterns u |
+| Patterns.cs:54:27:54:35 | { ... } | Patterns.cs:54:33:54:33 | 1 |
+| Patterns.cs:54:33:54:33 | 1 | Patterns.cs:54:33:54:33 | 1 |
+| Patterns.cs:57:5:63:5 | {...} | Patterns.cs:57:5:63:5 | {...} |
+| Patterns.cs:58:9:62:10 | return ...; | Patterns.cs:58:16:58:16 | access to parameter i |
+| Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:58:16:58:16 | access to parameter i |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:16:58:16 | access to parameter i |
+| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:17:60:17 | 1 |
+| Patterns.cs:60:13:60:28 | ... => ... | Patterns.cs:60:17:60:17 | 1 |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:17:60:17 | 1 |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:61:13:61:24 | ... => ... | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:18:61:24 | "other" |
+| Patterns.cs:66:5:72:5 | {...} | Patterns.cs:66:5:72:5 | {...} |
+| Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:67:16:67:16 | 2 |
+| Patterns.cs:67:16:67:16 | 2 | Patterns.cs:67:16:67:16 | 2 |
+| Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:67:16:67:16 | 2 |
+| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:69:17:69:17 | 2 |
+| Patterns.cs:69:13:69:33 | ... => ... | Patterns.cs:69:17:69:17 | 2 |
+| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:17:69:17 | 2 |
+| Patterns.cs:69:22:69:33 | "impossible" | Patterns.cs:69:22:69:33 | "impossible" |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:6:5:8:5 | {...} |
 | PostDominance.cs:7:9:7:28 | call to method WriteLine | PostDominance.cs:7:27:7:27 | access to parameter s |
 | PostDominance.cs:7:9:7:29 | ...; | PostDominance.cs:7:9:7:29 | ...; |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
index 07a0a9cffc7..c89d35533a5 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
@@ -2906,6 +2906,52 @@
 | Patterns.cs:37:17:37:22 | break; | Patterns.cs:37:17:37:22 | break; | break |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:40:17:40:17 | access to local variable o | normal |
 | Patterns.cs:40:17:40:17 | access to local variable o | Patterns.cs:40:17:40:17 | access to local variable o | normal |
+| Patterns.cs:48:9:48:9 | access to parameter c | Patterns.cs:48:9:48:9 | access to parameter c | normal |
+| Patterns.cs:48:9:48:20 | ... is ... | Patterns.cs:48:9:48:20 | ... is ... | normal |
+| Patterns.cs:48:14:48:20 | not ... | Patterns.cs:48:14:48:20 | not ... | normal |
+| Patterns.cs:48:18:48:20 | a | Patterns.cs:48:18:48:20 | a | normal |
+| Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:51:9:51:9 | access to parameter c | normal |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:9:51:21 | ... is ... | false |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:9:51:21 | ... is ... | true |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:9:51:39 | ... ? ... : ... | normal |
+| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:14:51:21 | not ... | normal |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:18:51:21 | null | normal |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:25:51:25 | access to parameter c | normal |
+| Patterns.cs:51:25:51:30 | ... is ... | Patterns.cs:51:25:51:30 | ... is ... | normal |
+| Patterns.cs:51:30:51:30 | 1 | Patterns.cs:51:30:51:30 | 1 | normal |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:34:51:34 | access to parameter c | normal |
+| Patterns.cs:51:34:51:39 | ... is ... | Patterns.cs:51:34:51:39 | ... is ... | normal |
+| Patterns.cs:51:39:51:39 | 2 | Patterns.cs:51:39:51:39 | 2 | normal |
+| Patterns.cs:54:9:54:9 | access to parameter c | Patterns.cs:54:9:54:9 | access to parameter c | normal |
+| Patterns.cs:54:9:54:37 | ... is ... | Patterns.cs:54:9:54:37 | ... is ... | normal |
+| Patterns.cs:54:14:54:37 | not ... | Patterns.cs:54:14:54:37 | not ... | normal |
+| Patterns.cs:54:18:54:37 | Patterns u | Patterns.cs:54:18:54:37 | Patterns u | normal |
+| Patterns.cs:54:18:54:37 | { ... } | Patterns.cs:54:18:54:37 | { ... } | normal |
+| Patterns.cs:54:27:54:35 | { ... } | Patterns.cs:54:27:54:35 | { ... } | normal |
+| Patterns.cs:54:33:54:33 | 1 | Patterns.cs:54:33:54:33 | 1 | normal |
+| Patterns.cs:57:5:63:5 | {...} | Patterns.cs:58:9:62:10 | return ...; | return |
+| Patterns.cs:58:9:62:10 | return ...; | Patterns.cs:58:9:62:10 | return ...; | return |
+| Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:58:16:58:16 | access to parameter i | normal |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:16:62:9 | ... switch { ... } | normal |
+| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:13:60:17 | not ... | match |
+| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:13:60:17 | not ... | no-match |
+| Patterns.cs:60:13:60:28 | ... => ... | Patterns.cs:60:13:60:28 | ... => ... | normal |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:17:60:17 | 1 | normal |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:22:60:28 | "not 1" | normal |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:13:61:13 | _ | match |
+| Patterns.cs:61:13:61:24 | ... => ... | Patterns.cs:61:13:61:24 | ... => ... | normal |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:18:61:24 | "other" | normal |
+| Patterns.cs:66:5:72:5 | {...} | Patterns.cs:67:9:71:10 | return ...; | return |
+| Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:67:9:71:10 | return ...; | return |
+| Patterns.cs:67:16:67:16 | 2 | Patterns.cs:67:16:67:16 | 2 | normal |
+| Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:67:16:71:9 | ... switch { ... } | normal |
+| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:69:13:69:17 | not ... | no-match |
+| Patterns.cs:69:13:69:33 | ... => ... | Patterns.cs:69:13:69:33 | ... => ... | normal |
+| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:17:69:17 | 2 | normal |
+| Patterns.cs:69:22:69:33 | "impossible" | Patterns.cs:69:22:69:33 | "impossible" | normal |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 | match |
+| Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:70:13:70:27 | ... => ... | normal |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" | normal |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:7:9:7:28 | call to method WriteLine | normal |
 | PostDominance.cs:7:9:7:28 | call to method WriteLine | PostDominance.cs:7:9:7:28 | call to method WriteLine | normal |
 | PostDominance.cs:7:9:7:29 | ...; | PostDominance.cs:7:9:7:28 | call to method WriteLine | normal |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ExtractorOptions.cs b/csharp/ql/test/library-tests/controlflow/graph/ExtractorOptions.cs
deleted file mode 100644
index 69249fa473a..00000000000
--- a/csharp/ql/test/library-tests/controlflow/graph/ExtractorOptions.cs
+++ /dev/null
@@ -1 +0,0 @@
-// semmle-extractor-options: /langversion:8.0
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
index 6218a3a3b46..af80244b25f 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
@@ -3510,8 +3510,8 @@
 | NullCoalescing.cs:17:13:17:19 | (...) ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... | semmle.label | non-null |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:17:9:17:24 | ... = ... | semmle.label | successor |
 | NullCoalescing.cs:17:19:17:19 | access to parameter i | NullCoalescing.cs:17:13:17:19 | (...) ... | semmle.label | successor |
-| Patterns.cs:5:10:5:13 | enter Test | Patterns.cs:6:5:43:5 | {...} | semmle.label | successor |
-| Patterns.cs:5:10:5:13 | exit Test (normal) | Patterns.cs:5:10:5:13 | exit Test | semmle.label | successor |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:6:5:43:5 | {...} | semmle.label | successor |
+| Patterns.cs:5:10:5:11 | exit M1 (normal) | Patterns.cs:5:10:5:11 | exit M1 | semmle.label | successor |
 | Patterns.cs:6:5:43:5 | {...} | Patterns.cs:7:9:7:24 | ... ...; | semmle.label | successor |
 | Patterns.cs:7:9:7:24 | ... ...; | Patterns.cs:7:20:7:23 | null | semmle.label | successor |
 | Patterns.cs:7:16:7:23 | Object o = ... | Patterns.cs:8:9:18:9 | if (...) ... | semmle.label | successor |
@@ -3591,7 +3591,61 @@
 | Patterns.cs:36:35:36:50 | "Something else" | Patterns.cs:36:17:36:51 | call to method WriteLine | semmle.label | successor |
 | Patterns.cs:37:17:37:22 | break; | Patterns.cs:40:9:42:9 | switch (...) {...} | semmle.label | break |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:40:17:40:17 | access to local variable o | semmle.label | successor |
-| Patterns.cs:40:17:40:17 | access to local variable o | Patterns.cs:5:10:5:13 | exit Test (normal) | semmle.label | successor |
+| Patterns.cs:40:17:40:17 | access to local variable o | Patterns.cs:5:10:5:11 | exit M1 (normal) | semmle.label | successor |
+| Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:48:9:48:9 | access to parameter c | semmle.label | successor |
+| Patterns.cs:47:24:47:25 | exit M2 (normal) | Patterns.cs:47:24:47:25 | exit M2 | semmle.label | successor |
+| Patterns.cs:48:9:48:9 | access to parameter c | Patterns.cs:48:18:48:20 | a | semmle.label | successor |
+| Patterns.cs:48:9:48:20 | ... is ... | Patterns.cs:47:24:47:25 | exit M2 (normal) | semmle.label | successor |
+| Patterns.cs:48:14:48:20 | not ... | Patterns.cs:48:9:48:20 | ... is ... | semmle.label | successor |
+| Patterns.cs:48:18:48:20 | a | Patterns.cs:48:14:48:20 | not ... | semmle.label | successor |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:9 | access to parameter c | semmle.label | successor |
+| Patterns.cs:50:24:50:25 | exit M3 (normal) | Patterns.cs:50:24:50:25 | exit M3 | semmle.label | successor |
+| Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:51:18:51:21 | null | semmle.label | successor |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:25:51:25 | access to parameter c | semmle.label | true |
+| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:34:51:34 | access to parameter c | semmle.label | false |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | exit M3 (normal) | semmle.label | successor |
+| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:9:51:21 | ... is ... | semmle.label | successor |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:14:51:21 | not ... | semmle.label | successor |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:30:51:30 | 1 | semmle.label | successor |
+| Patterns.cs:51:25:51:30 | ... is ... | Patterns.cs:51:9:51:39 | ... ? ... : ... | semmle.label | successor |
+| Patterns.cs:51:30:51:30 | 1 | Patterns.cs:51:25:51:30 | ... is ... | semmle.label | successor |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:39:51:39 | 2 | semmle.label | successor |
+| Patterns.cs:51:34:51:39 | ... is ... | Patterns.cs:51:9:51:39 | ... ? ... : ... | semmle.label | successor |
+| Patterns.cs:51:39:51:39 | 2 | Patterns.cs:51:34:51:39 | ... is ... | semmle.label | successor |
+| Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:54:9:54:9 | access to parameter c | semmle.label | successor |
+| Patterns.cs:53:24:53:25 | exit M4 (normal) | Patterns.cs:53:24:53:25 | exit M4 | semmle.label | successor |
+| Patterns.cs:54:9:54:9 | access to parameter c | Patterns.cs:54:18:54:37 | Patterns u | semmle.label | successor |
+| Patterns.cs:54:9:54:37 | ... is ... | Patterns.cs:53:24:53:25 | exit M4 (normal) | semmle.label | successor |
+| Patterns.cs:54:14:54:37 | not ... | Patterns.cs:54:9:54:37 | ... is ... | semmle.label | successor |
+| Patterns.cs:54:18:54:37 | Patterns u | Patterns.cs:54:33:54:33 | 1 | semmle.label | successor |
+| Patterns.cs:54:18:54:37 | { ... } | Patterns.cs:54:14:54:37 | not ... | semmle.label | successor |
+| Patterns.cs:54:27:54:35 | { ... } | Patterns.cs:54:18:54:37 | { ... } | semmle.label | successor |
+| Patterns.cs:54:33:54:33 | 1 | Patterns.cs:54:27:54:35 | { ... } | semmle.label | successor |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:57:5:63:5 | {...} | semmle.label | successor |
+| Patterns.cs:56:26:56:27 | exit M5 (normal) | Patterns.cs:56:26:56:27 | exit M5 | semmle.label | successor |
+| Patterns.cs:57:5:63:5 | {...} | Patterns.cs:58:16:58:16 | access to parameter i | semmle.label | successor |
+| Patterns.cs:58:9:62:10 | return ...; | Patterns.cs:56:26:56:27 | exit M5 (normal) | semmle.label | return |
+| Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:60:17:60:17 | 1 | semmle.label | successor |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:9:62:10 | return ...; | semmle.label | successor |
+| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:22:60:28 | "not 1" | semmle.label | match |
+| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:61:13:61:13 | _ | semmle.label | no-match |
+| Patterns.cs:60:13:60:28 | ... => ... | Patterns.cs:58:16:62:9 | ... switch { ... } | semmle.label | successor |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:13:60:17 | not ... | semmle.label | successor |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:13:60:28 | ... => ... | semmle.label | successor |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:18:61:24 | "other" | semmle.label | match |
+| Patterns.cs:61:13:61:24 | ... => ... | Patterns.cs:58:16:62:9 | ... switch { ... } | semmle.label | successor |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:13:61:24 | ... => ... | semmle.label | successor |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:66:5:72:5 | {...} | semmle.label | successor |
+| Patterns.cs:65:26:65:27 | exit M6 (normal) | Patterns.cs:65:26:65:27 | exit M6 | semmle.label | successor |
+| Patterns.cs:66:5:72:5 | {...} | Patterns.cs:67:16:67:16 | 2 | semmle.label | successor |
+| Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:65:26:65:27 | exit M6 (normal) | semmle.label | return |
+| Patterns.cs:67:16:67:16 | 2 | Patterns.cs:69:17:69:17 | 2 | semmle.label | successor |
+| Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:67:9:71:10 | return ...; | semmle.label | successor |
+| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:70:13:70:13 | 2 | semmle.label | no-match |
+| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:13:69:17 | not ... | semmle.label | successor |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" | semmle.label | match |
+| Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:67:16:71:9 | ... switch { ... } | semmle.label | successor |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:27 | ... => ... | semmle.label | successor |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:6:5:8:5 | {...} | semmle.label | successor |
 | PostDominance.cs:5:10:5:11 | exit M1 (normal) | PostDominance.cs:5:10:5:11 | exit M1 | semmle.label | successor |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:7:9:7:29 | ...; | semmle.label | successor |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
index fd138aea838..9c66acba802 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
@@ -1218,7 +1218,12 @@ entryPoint
 | NullCoalescing.cs:9:12:9:13 | M4 | NullCoalescing.cs:9:37:9:37 | access to parameter b |
 | NullCoalescing.cs:11:9:11:10 | M5 | NullCoalescing.cs:11:44:11:45 | access to parameter b1 |
 | NullCoalescing.cs:13:10:13:11 | M6 | NullCoalescing.cs:14:5:18:5 | {...} |
-| Patterns.cs:5:10:5:13 | Test | Patterns.cs:6:5:43:5 | {...} |
+| Patterns.cs:5:10:5:11 | M1 | Patterns.cs:6:5:43:5 | {...} |
+| Patterns.cs:47:24:47:25 | M2 | Patterns.cs:48:9:48:9 | access to parameter c |
+| Patterns.cs:50:24:50:25 | M3 | Patterns.cs:51:9:51:9 | access to parameter c |
+| Patterns.cs:53:24:53:25 | M4 | Patterns.cs:54:9:54:9 | access to parameter c |
+| Patterns.cs:56:26:56:27 | M5 | Patterns.cs:57:5:63:5 | {...} |
+| Patterns.cs:65:26:65:27 | M6 | Patterns.cs:66:5:72:5 | {...} |
 | PostDominance.cs:5:10:5:11 | M1 | PostDominance.cs:6:5:8:5 | {...} |
 | PostDominance.cs:10:10:10:11 | M2 | PostDominance.cs:11:5:15:5 | {...} |
 | PostDominance.cs:17:10:17:11 | M3 | PostDominance.cs:18:5:22:5 | {...} |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Patterns.cs b/csharp/ql/test/library-tests/controlflow/graph/Patterns.cs
index 70bf7e29063..86a6e34d708 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Patterns.cs
+++ b/csharp/ql/test/library-tests/controlflow/graph/Patterns.cs
@@ -2,7 +2,7 @@ using System;
 
 class Patterns
 {
-    void Test()
+    void M1()
     {
         object o = null;
         if (o is int i1)
@@ -41,4 +41,33 @@ class Patterns
         {
         }
     }
+
+    public int P1 { get; set; }
+
+    public static bool M2(char c) =>
+        c is not 'a';
+
+    public static bool M3(object c) =>
+        c is not null ? c is 1 : c is 2;
+
+    public static bool M4(object c) =>
+        c is not Patterns { P1: 1 } u;
+
+    public static string M5(int i)
+    {
+        return i switch
+        {
+            not 1 => "not 1",
+            _ => "other"
+        };
+    }
+
+    public static string M6()
+    {
+        return 2 switch
+        {
+            not 2 => "impossible",
+            2 => "possible"
+        };
+    }
 }

From ab85b2c2d2ae2cddc106da7c40c455362936decd Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 24 Nov 2020 15:30:48 +0100
Subject: [PATCH 293/343] C#: Add `is not null` guards test

---
 .../library-tests/controlflow/guards/AbstractValue.expected | 1 +
 .../controlflow/guards/BooleanGuardedExpr.expected          | 1 +
 .../library-tests/controlflow/guards/ExtractorOptions.cs    | 2 +-
 .../controlflow/guards/GuardedControlFlowNode.expected      | 2 ++
 .../library-tests/controlflow/guards/GuardedExpr.expected   | 2 ++
 csharp/ql/test/library-tests/controlflow/guards/Guards.cs   | 6 ++++++
 .../library-tests/controlflow/guards/Implications.expected  | 1 +
 .../controlflow/guards/NullGuardedExpr.expected             | 1 +
 8 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/csharp/ql/test/library-tests/controlflow/guards/AbstractValue.expected b/csharp/ql/test/library-tests/controlflow/guards/AbstractValue.expected
index 1dd7f2c4da4..2303633e4f4 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/AbstractValue.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/AbstractValue.expected
@@ -370,6 +370,7 @@ abstractValue
 | non-null | Guards.cs:341:31:341:32 | "" |
 | non-null | Guards.cs:343:13:343:19 | access to type Console |
 | non-null | Guards.cs:343:31:343:31 | access to local variable s |
+| non-null | Guards.cs:349:13:349:13 | access to parameter o |
 | non-null | Splitting.cs:13:17:13:17 | access to parameter o |
 | non-null | Splitting.cs:23:24:23:24 | access to parameter o |
 | non-null | Splitting.cs:33:24:33:25 | "" |
diff --git a/csharp/ql/test/library-tests/controlflow/guards/BooleanGuardedExpr.expected b/csharp/ql/test/library-tests/controlflow/guards/BooleanGuardedExpr.expected
index f87600ebed5..120e3e2c5ce 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/BooleanGuardedExpr.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/BooleanGuardedExpr.expected
@@ -103,6 +103,7 @@
 | Guards.cs:342:27:342:27 | access to parameter b | Guards.cs:341:20:341:20 | access to parameter b | Guards.cs:341:20:341:20 | access to parameter b | false |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:21 | ... != ... | Guards.cs:342:13:342:13 | access to local variable s | true |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:27 | ... && ... | Guards.cs:342:13:342:13 | access to local variable s | true |
+| Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:25 | ... is ... | Guards.cs:348:13:348:13 | access to parameter o | true |
 | Splitting.cs:13:17:13:17 | access to parameter o | Splitting.cs:12:17:12:25 | ... != ... | Splitting.cs:12:17:12:17 | access to parameter o | true |
 | Splitting.cs:23:24:23:24 | access to parameter o | Splitting.cs:22:17:22:25 | ... != ... | Splitting.cs:22:17:22:17 | access to parameter o | true |
 | Splitting.cs:25:13:25:13 | access to parameter o | Splitting.cs:22:17:22:25 | ... != ... | Splitting.cs:22:17:22:17 | access to parameter o | false |
diff --git a/csharp/ql/test/library-tests/controlflow/guards/ExtractorOptions.cs b/csharp/ql/test/library-tests/controlflow/guards/ExtractorOptions.cs
index 5b68aaea481..3353234761a 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/ExtractorOptions.cs
+++ b/csharp/ql/test/library-tests/controlflow/guards/ExtractorOptions.cs
@@ -1,2 +1,2 @@
-// semmle-extractor-options: --cil /langversion:8.0
+// semmle-extractor-options: --cil
 #nullable enable
diff --git a/csharp/ql/test/library-tests/controlflow/guards/GuardedControlFlowNode.expected b/csharp/ql/test/library-tests/controlflow/guards/GuardedControlFlowNode.expected
index 8f0a09d0389..3db5997056c 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/GuardedControlFlowNode.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/GuardedControlFlowNode.expected
@@ -242,6 +242,8 @@
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:13 | access to local variable s | Guards.cs:342:13:342:13 | access to local variable s | non-null |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:21 | ... != ... | Guards.cs:342:13:342:13 | access to local variable s | true |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:27 | ... && ... | Guards.cs:342:13:342:13 | access to local variable s | true |
+| Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:13 | access to parameter o | Guards.cs:348:13:348:13 | access to parameter o | non-null |
+| Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:25 | ... is ... | Guards.cs:348:13:348:13 | access to parameter o | true |
 | Splitting.cs:13:17:13:17 | [b (line 9): true] access to parameter o | Splitting.cs:12:17:12:17 | access to parameter o | Splitting.cs:12:17:12:17 | access to parameter o | non-null |
 | Splitting.cs:13:17:13:17 | [b (line 9): true] access to parameter o | Splitting.cs:12:17:12:25 | ... != ... | Splitting.cs:12:17:12:17 | access to parameter o | true |
 | Splitting.cs:14:13:14:13 | [b (line 9): false] access to parameter b | Splitting.cs:11:13:11:13 | access to parameter b | Splitting.cs:11:13:11:13 | access to parameter b | false |
diff --git a/csharp/ql/test/library-tests/controlflow/guards/GuardedExpr.expected b/csharp/ql/test/library-tests/controlflow/guards/GuardedExpr.expected
index 05537dcf8d9..aad97097f21 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/GuardedExpr.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/GuardedExpr.expected
@@ -223,6 +223,8 @@
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:13 | access to local variable s | Guards.cs:342:13:342:13 | access to local variable s | non-null |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:21 | ... != ... | Guards.cs:342:13:342:13 | access to local variable s | true |
 | Guards.cs:343:31:343:31 | access to local variable s | Guards.cs:342:13:342:27 | ... && ... | Guards.cs:342:13:342:13 | access to local variable s | true |
+| Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:13 | access to parameter o | Guards.cs:348:13:348:13 | access to parameter o | non-null |
+| Guards.cs:349:13:349:13 | access to parameter o | Guards.cs:348:13:348:25 | ... is ... | Guards.cs:348:13:348:13 | access to parameter o | true |
 | Splitting.cs:13:17:13:17 | access to parameter o | Splitting.cs:12:17:12:17 | access to parameter o | Splitting.cs:12:17:12:17 | access to parameter o | non-null |
 | Splitting.cs:13:17:13:17 | access to parameter o | Splitting.cs:12:17:12:25 | ... != ... | Splitting.cs:12:17:12:17 | access to parameter o | true |
 | Splitting.cs:23:24:23:24 | access to parameter o | Splitting.cs:22:17:22:17 | access to parameter o | Splitting.cs:22:17:22:17 | access to parameter o | non-null |
diff --git a/csharp/ql/test/library-tests/controlflow/guards/Guards.cs b/csharp/ql/test/library-tests/controlflow/guards/Guards.cs
index 0c4563b3c9f..3e1008b1971 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/Guards.cs
+++ b/csharp/ql/test/library-tests/controlflow/guards/Guards.cs
@@ -342,5 +342,11 @@ public class Guards
         if (s != null && !b)
             Console.WriteLine(s.Length); // null guarded
     }
+
+    void M29(object? o)
+    {
+        if (o is not null)
+            o.ToString(); // null guarded
+    }
 }
 
diff --git a/csharp/ql/test/library-tests/controlflow/guards/Implications.expected b/csharp/ql/test/library-tests/controlflow/guards/Implications.expected
index 00e09ccfbda..ee5a0bb7017 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/Implications.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/Implications.expected
@@ -442,6 +442,7 @@
 | Guards.cs:342:26:342:27 | !... | true | Guards.cs:342:27:342:27 | access to parameter b | false |
 | Guards.cs:343:31:343:31 | access to local variable s | non-null | Guards.cs:341:20:341:32 | ... ? ... : ... | non-null |
 | Guards.cs:343:31:343:31 | access to local variable s | null | Guards.cs:341:20:341:32 | ... ? ... : ... | null |
+| Guards.cs:348:13:348:25 | ... is ... | true | Guards.cs:348:13:348:13 | access to parameter o | non-null |
 | Splitting.cs:12:17:12:25 | ... != ... | false | Splitting.cs:12:17:12:17 | access to parameter o | null |
 | Splitting.cs:12:17:12:25 | ... != ... | true | Splitting.cs:12:17:12:17 | access to parameter o | non-null |
 | Splitting.cs:22:17:22:25 | ... != ... | false | Splitting.cs:22:17:22:17 | access to parameter o | null |
diff --git a/csharp/ql/test/library-tests/controlflow/guards/NullGuardedExpr.expected b/csharp/ql/test/library-tests/controlflow/guards/NullGuardedExpr.expected
index eea5a4dadd3..fa21b5cb312 100644
--- a/csharp/ql/test/library-tests/controlflow/guards/NullGuardedExpr.expected
+++ b/csharp/ql/test/library-tests/controlflow/guards/NullGuardedExpr.expected
@@ -46,6 +46,7 @@
 | Guards.cs:283:17:283:17 | access to parameter o |
 | Guards.cs:287:17:287:17 | access to parameter o |
 | Guards.cs:343:31:343:31 | access to local variable s |
+| Guards.cs:349:13:349:13 | access to parameter o |
 | Splitting.cs:13:17:13:17 | access to parameter o |
 | Splitting.cs:23:24:23:24 | access to parameter o |
 | Splitting.cs:35:13:35:13 | access to parameter o |

From 063733ad52dd5ee8da7cced94dc9daab072e0073 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 24 Nov 2020 14:27:27 +0100
Subject: [PATCH 294/343] C#: Implement CFG for `not` patterns

---
 .../controlflow/internal/Completion.qll       | 112 ++++++---
 .../internal/ControlFlowGraphImpl.qll         |  31 ++-
 .../csharp/controlflow/internal/Splitting.qll |   6 +
 .../controlflow/graph/BasicBlock.expected     |  37 ++-
 .../controlflow/graph/Condition.expected      |  98 ++++++--
 .../controlflow/graph/Dominance.expected      | 232 +++++++++++++++---
 .../graph/EnclosingCallable.expected          |  48 +++-
 .../controlflow/graph/ExitElement.expected    |  30 ++-
 .../controlflow/graph/NodeGraph.expected      |  63 +++--
 .../library-tests/csharp7/IsFlow.expected     |   7 +-
 .../csharp7/LocalTaintFlow.expected           |   9 +-
 .../csharp8/ispatternflow.expected            |  35 +--
 .../csharp8/switchexprcontrolflow.expected    |   7 +-
 .../query-tests/Nullness/NullMaybe.expected   |  12 +-
 14 files changed, 543 insertions(+), 184 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
index 8f61d0f7c25..dc6dfd91622 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
@@ -232,37 +232,61 @@ private Expr getQualifier(QualifiableExpr e) {
   result = e.getChildExpr(-1)
 }
 
+pragma[noinline]
+private predicate typePatternMustHaveMatchingCompletion(
+  TypePatternExpr tpe, Type t, Type strippedType
+) {
+  exists(Expr e, Expr stripped | mustHaveMatchingCompletion(e, tpe) |
+    stripped = e.stripCasts() and
+    t = tpe.getCheckedType() and
+    strippedType = stripped.getType() and
+    not t.containsTypeParameters() and
+    not strippedType.containsTypeParameters()
+  )
+}
+
+pragma[noinline]
+private Type typePatternCommonSubTypeLeft(Type t) {
+  typePatternMustHaveMatchingCompletion(_, t, _) and
+  result.isImplicitlyConvertibleTo(t) and
+  not result instanceof DynamicType
+}
+
+pragma[noinline]
+private Type typePatternCommonSubTypeRight(Type strippedType) {
+  typePatternMustHaveMatchingCompletion(_, _, strippedType) and
+  result.isImplicitlyConvertibleTo(strippedType) and
+  not result instanceof DynamicType
+}
+
+pragma[noinline]
+private predicate typePatternCommonSubType(Type t, Type strippedType) {
+  typePatternCommonSubTypeLeft(t) = typePatternCommonSubTypeRight(strippedType)
+}
+
 /**
- * Holds if expression `e` constantly matches (`value = true`) or constantly
- * non-matches (`value = false`).
+ * Holds if pattern expression `pe` constantly matches (`value = true`) or
+ * constantly non-matches (`value = false`).
  */
-private predicate isMatchingConstant(Expr e, boolean value) {
-  exists(Switch s | mustHaveMatchingCompletion(s, e) |
-    exists(Expr stripped | stripped = s.getExpr().stripCasts() |
-      exists(Case c, string strippedValue |
-        c = s.getACase() and
-        e = c.getPattern() and
-        strippedValue = stripped.getValue()
-      |
-        if strippedValue = e.getValue() then value = true else value = false
-      )
-      or
-      exists(Case c, TypePatternExpr tpe, Type t, Type strippedType | c = s.getACase() |
-        tpe = c.getPattern() and
-        e = tpe and
-        t = tpe.getCheckedType() and
-        strippedType = stripped.getType() and
-        not t.isImplicitlyConvertibleTo(strippedType) and
-        not t instanceof Interface and
-        not t.containsTypeParameters() and
-        not strippedType.containsTypeParameters() and
-        value = false
+private predicate isMatchingConstant(PatternExpr pe, boolean value) {
+  exists(Expr e | mustHaveMatchingCompletion(e, pe) |
+    exists(Expr stripped | stripped = e.stripCasts() |
+      exists(string strippedValue, string patternValue |
+        strippedValue = stripped.getValue() and
+        patternValue = pe.getValue() and
+        if strippedValue = patternValue then value = true else value = false
       )
     )
     or
-    e instanceof DiscardPatternExpr and
+    pe instanceof DiscardPatternExpr and
     value = true
   )
+  or
+  exists(Type t, Type strippedType |
+    typePatternMustHaveMatchingCompletion(pe, t, strippedType) and
+    not typePatternCommonSubType(t, strippedType) and
+    value = false
+  )
 }
 
 private class Overflowable extends UnaryOperation {
@@ -518,7 +542,20 @@ predicate switchMatching(Switch s, Case c, PatternExpr pe) {
   pe = c.getPattern()
 }
 
-private predicate mustHaveMatchingCompletion(Switch s, PatternExpr pe) { switchMatching(s, _, pe) }
+/**
+ * Holds if `pe` must have a matching completion, and `e` is the expression
+ * that is being matched.
+ */
+private predicate mustHaveMatchingCompletion(Expr e, PatternExpr pe) {
+  exists(Switch s |
+    switchMatching(s, _, pe) and
+    e = s.getExpr()
+  )
+  or
+  pe = any(IsExpr ie | inBooleanContext(ie) and e = ie.getExpr()).getPattern()
+  or
+  pe = any(UnaryPatternExpr upe | mustHaveMatchingCompletion(e, upe)).getPattern()
+}
 
 /**
  * Holds if a normal completion of `cfe` must be a matching completion. Thats is,
@@ -565,7 +602,13 @@ class SimpleCompletion extends NonNestedNormalCompletion, TSimpleCompletion {
  * completion (`NullnessCompletion`), a matching completion (`MatchingCompletion`),
  * or an emptiness completion (`EmptinessCompletion`).
  */
-abstract class ConditionalCompletion extends NonNestedNormalCompletion { }
+abstract class ConditionalCompletion extends NonNestedNormalCompletion {
+  /** Gets the Boolean value of this completion. */
+  abstract boolean getValue();
+
+  /** Gets the dual completion. */
+  abstract ConditionalCompletion getDual();
+}
 
 /**
  * A completion that represents evaluation of an expression
@@ -576,10 +619,9 @@ class BooleanCompletion extends ConditionalCompletion {
 
   BooleanCompletion() { this = TBooleanCompletion(value) }
 
-  /** Gets the Boolean value of this completion. */
-  boolean getValue() { result = value }
+  override boolean getValue() { result = value }
 
-  BooleanCompletion getDual() { result = TBooleanCompletion(value.booleanNot()) }
+  override BooleanCompletion getDual() { result = TBooleanCompletion(value.booleanNot()) }
 
   override BooleanSuccessor getAMatchingSuccessorType() { result.getValue() = value }
 
@@ -611,6 +653,10 @@ class NullnessCompletion extends ConditionalCompletion, TNullnessCompletion {
   /** Holds if the last sub expression of this expression evaluates to a non-`null` value. */
   predicate isNonNull() { value = false }
 
+  override boolean getValue() { result = value }
+
+  override NullnessCompletion getDual() { result = TNullnessCompletion(value.booleanNot()) }
+
   override NullnessSuccessor getAMatchingSuccessorType() { result.getValue() = value }
 
   override string toString() { if this.isNull() then result = "null" else result = "non-null" }
@@ -631,6 +677,10 @@ class MatchingCompletion extends ConditionalCompletion, TMatchingCompletion {
   /** Holds if there is not a match. */
   predicate isNonMatch() { value = false }
 
+  override boolean getValue() { result = value }
+
+  override MatchingCompletion getDual() { result = TMatchingCompletion(value.booleanNot()) }
+
   override MatchingSuccessor getAMatchingSuccessorType() { result.getValue() = value }
 
   override string toString() { if this.isMatch() then result = "match" else result = "no-match" }
@@ -648,6 +698,10 @@ class EmptinessCompletion extends ConditionalCompletion, TEmptinessCompletion {
   /** Holds if the emptiness test evaluates to `true`. */
   predicate isEmpty() { value = true }
 
+  override boolean getValue() { result = value }
+
+  override EmptinessCompletion getDual() { result = TEmptinessCompletion(value.booleanNot()) }
+
   override EmptinessSuccessor getAMatchingSuccessorType() { result.getValue() = value }
 
   override string toString() { if this.isEmpty() then result = "empty" else result = "non-empty" }
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
index c2a170080b1..cb22d51aee8 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
@@ -368,7 +368,8 @@ module Expressions {
       not this instanceof NoNodeExpr and
       not this instanceof SwitchExpr and
       not this instanceof SwitchCaseExpr and
-      not this instanceof ConstructorInitializer
+      not this instanceof ConstructorInitializer and
+      not this instanceof NotPatternExpr
     }
 
     final override ControlFlowElement getChildElement(int i) { result = getExprChild(this, i) }
@@ -515,20 +516,14 @@ module Expressions {
 
     LogicalNotExprTree() { operand = this.getOperand() }
 
-    final override predicate propagatesAbnormal(ControlFlowElement child) {
-      child = this.getOperand()
-    }
+    final override predicate propagatesAbnormal(ControlFlowElement child) { child = operand }
 
     final override predicate first(ControlFlowElement first) { first(operand, first) }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       succ = this and
-      (
-        last(operand, pred, c.(BooleanCompletion).getDual())
-        or
-        last(operand, pred, c) and
-        c instanceof SimpleCompletion
-      )
+      last(operand, pred, c) and
+      c instanceof NormalCompletion
     }
   }
 
@@ -925,6 +920,22 @@ module Expressions {
       )
     }
   }
+
+  private class NotPatternExprTree extends PostOrderTree, NotPatternExpr {
+    private PatternExpr operand;
+
+    NotPatternExprTree() { operand = this.getPattern() }
+
+    final override predicate propagatesAbnormal(ControlFlowElement child) { child = operand }
+
+    final override predicate first(ControlFlowElement first) { first(operand, first) }
+
+    final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
+      succ = this and
+      last(operand, pred, c) and
+      c instanceof NormalCompletion
+    }
+  }
 }
 
 module Statements {
diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/Splitting.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/Splitting.qll
index d8e881a4e93..a1d9bc249d7 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/Splitting.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/Splitting.qll
@@ -465,6 +465,12 @@ module ConditionalCompletionSplitting {
         or
         last(succ.(SwitchCaseExpr).getBody(), pred, c) and
         completion = c
+        or
+        last(succ.(NotPatternExpr).getPattern(), pred, c) and
+        completion.(MatchingCompletion).getDual() = c
+        or
+        last(succ.(IsExpr).getPattern(), pred, c) and
+        completion.(BooleanCompletion).getValue() = c.(MatchingCompletion).getValue()
       )
     }
 
diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
index 4b6d6aea058..557f5ea4df6 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
@@ -924,11 +924,17 @@
 | NullCoalescing.cs:15:31:15:31 | 0 | NullCoalescing.cs:16:17:16:18 | "" | 5 |
 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | NullCoalescing.cs:17:13:17:19 | (...) ... | 5 |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:13:10:13:11 | exit M6 | 4 |
-| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:8:13:8:23 | ... is ... | 9 |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:8:18:8:23 | Int32 i1 | 8 |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:8:13:8:23 | [false] ... is ... | 1 |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:8:13:8:23 | [true] ... is ... | 1 |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:10:13:10:42 | call to method WriteLine | 6 |
-| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:18:12:31 | ... is ... | 4 |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:23:12:31 | String s1 | 3 |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:12:18:12:31 | [false] ... is ... | 1 |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:12:18:12:31 | [true] ... is ... | 1 |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:14:13:14:45 | call to method WriteLine | 6 |
-| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:18:16:28 | ... is ... | 4 |
+| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:23:16:28 | Object v1 | 3 |
+| Patterns.cs:16:18:16:28 | [false] ... is ... | Patterns.cs:16:18:16:28 | [false] ... is ... | 1 |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:16:18:16:28 | [true] ... is ... | 1 |
 | Patterns.cs:17:9:18:9 | {...} | Patterns.cs:17:9:18:9 | {...} | 1 |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:22:18:22:22 | "xyz" | 4 |
 | Patterns.cs:23:17:23:22 | break; | Patterns.cs:23:17:23:22 | break; | 1 |
@@ -944,26 +950,37 @@
 | Patterns.cs:35:13:35:20 | default: | Patterns.cs:37:17:37:22 | break; | 5 |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | exit M1 | 4 |
 | Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:47:24:47:25 | exit M2 | 7 |
-| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:21 | ... is ... | 5 |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:18:51:21 | null | 3 |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:9:51:21 | [false] ... is ... | 1 |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:9:51:21 | [true] ... is ... | 1 |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | exit M3 | 3 |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:51:14:51:21 | [match] not ... | 1 |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:51:14:51:21 | [no-match] not ... | 1 |
 | Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:25:51:30 | ... is ... | 3 |
 | Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:34:51:39 | ... is ... | 3 |
 | Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:53:24:53:25 | exit M4 | 10 |
-| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:13:60:17 | not ... | 5 |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:17:60:17 | 1 | 4 |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:56:26:56:27 | exit M5 | 4 |
+| Patterns.cs:60:13:60:17 | [match] not ... | Patterns.cs:60:13:60:17 | [match] not ... | 1 |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:60:13:60:17 | [no-match] not ... | 1 |
 | Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:13:60:28 | ... => ... | 2 |
 | Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:13:61:13 | _ | 1 |
 | Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:13:61:24 | ... => ... | 2 |
-| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:69:13:69:17 | not ... | 5 |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:69:17:69:17 | 2 | 4 |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:69:13:69:17 | [no-match] not ... | 1 |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 | 1 |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | exit M6 | 6 |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | exit M1 | 7 |
-| PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:13:12:21 | ... is ... | 6 |
+| PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:18:12:21 | null | 5 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | exit M2 | 2 |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:12:13:12:21 | [false] ... is ... | 1 |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:12:13:12:21 | [true] ... is ... | 1 |
 | PostDominance.cs:13:13:13:19 | return ...; | PostDominance.cs:13:13:13:19 | return ...; | 1 |
 | PostDominance.cs:14:9:14:29 | ...; | PostDominance.cs:14:9:14:28 | call to method WriteLine | 3 |
-| PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:19:13:19:21 | ... is ... | 6 |
+| PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:19:18:19:21 | null | 5 |
 | PostDominance.cs:17:10:17:11 | exit M3 | PostDominance.cs:17:10:17:11 | exit M3 | 1 |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:19:13:19:21 | [false] ... is ... | 1 |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:19:13:19:21 | [true] ... is ... | 1 |
 | PostDominance.cs:20:45:20:53 | nameof(...) | PostDominance.cs:17:10:17:11 | exit M3 (abnormal) | 4 |
 | PostDominance.cs:21:9:21:29 | ...; | PostDominance.cs:17:10:17:11 | exit M3 (normal) | 4 |
 | Qualifiers.cs:7:16:7:21 | enter Method | Qualifiers.cs:7:16:7:21 | exit Method | 4 |
@@ -1079,7 +1096,9 @@
 | Switch.cs:156:50:156:52 | "b" | Switch.cs:156:41:156:52 | ... => ... | 2 |
 | Switch.cs:158:13:158:49 | ...; | Switch.cs:158:13:158:48 | call to method WriteLine | 5 |
 | Switch.cs:160:13:160:49 | ...; | Switch.cs:160:13:160:48 | call to method WriteLine | 5 |
-| TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:7:13:7:22 | ... is ... | 14 |
+| TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:7:18:7:22 | Int32 j | 13 |
+| TypeAccesses.cs:7:13:7:22 | [false] ... is ... | TypeAccesses.cs:7:13:7:22 | [false] ... is ... | 1 |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:7:13:7:22 | [true] ... is ... | 1 |
 | TypeAccesses.cs:7:25:7:25 | ; | TypeAccesses.cs:7:25:7:25 | ; | 1 |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:3:10:3:10 | exit M | 5 |
 | VarDecls.cs:5:18:5:19 | enter M1 | VarDecls.cs:5:18:5:19 | exit M1 | 19 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
index a65a25d0a89..3f8406344b7 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
@@ -1783,15 +1783,42 @@ conditionBlock
 | NullCoalescing.cs:15:31:15:31 | 0 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | false |
 | NullCoalescing.cs:15:31:15:31 | 0 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | false |
 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:8:13:8:23 | [false] ... is ... | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:8:13:8:23 | [true] ... is ... | true |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:9:9:11:9 | {...} | true |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:12:14:18:9 | if (...) ... | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:12:18:12:31 | [false] ... is ... | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:12:18:12:31 | [true] ... is ... | false |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:13:9:15:9 | {...} | false |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:16:14:18:9 | if (...) ... | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:16:18:16:28 | [false] ... is ... | false |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:16:18:16:28 | [true] ... is ... | false |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:17:9:18:9 | {...} | false |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:12:14:18:9 | if (...) ... | false |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:12:18:12:31 | [false] ... is ... | false |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:12:18:12:31 | [true] ... is ... | false |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:13:9:15:9 | {...} | false |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:16:14:18:9 | if (...) ... | false |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:16:18:16:28 | [false] ... is ... | false |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:16:18:16:28 | [true] ... is ... | false |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:17:9:18:9 | {...} | false |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:9:9:11:9 | {...} | true |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:18:12:31 | [false] ... is ... | false |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:18:12:31 | [true] ... is ... | true |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:13:9:15:9 | {...} | true |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:16:14:18:9 | if (...) ... | false |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:16:18:16:28 | [false] ... is ... | false |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:16:18:16:28 | [true] ... is ... | false |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:17:9:18:9 | {...} | false |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:16:14:18:9 | if (...) ... | false |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:16:18:16:28 | [false] ... is ... | false |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:16:18:16:28 | [true] ... is ... | false |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:17:9:18:9 | {...} | false |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:13:9:15:9 | {...} | true |
+| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:18:16:28 | [false] ... is ... | false |
+| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:18:16:28 | [true] ... is ... | true |
 | Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:17:9:18:9 | {...} | true |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:17:9:18:9 | {...} | true |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:23:17:23:22 | break; | true |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:24:13:24:36 | case ...: | false |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:24:30:24:31 | access to local variable i2 | false |
@@ -1818,19 +1845,45 @@ conditionBlock
 | Patterns.cs:30:13:30:27 | case ...: | Patterns.cs:35:13:35:20 | default: | false |
 | Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:34:17:34:22 | break; | true |
 | Patterns.cs:33:13:33:24 | case ...: | Patterns.cs:35:13:35:20 | default: | false |
-| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:25:51:25 | access to parameter c | true |
-| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:34:51:34 | access to parameter c | false |
-| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:22:60:28 | "not 1" | true |
-| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:13:61:13 | _ | false |
-| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:18:61:24 | "other" | false |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:21 | [false] ... is ... | true |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:21 | [true] ... is ... | false |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:14:51:21 | [match] not ... | false |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:14:51:21 | [no-match] not ... | true |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:25:51:25 | access to parameter c | false |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:34:51:34 | access to parameter c | true |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:34:51:34 | access to parameter c | false |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:25:51:25 | access to parameter c | true |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:51:9:51:21 | [true] ... is ... | true |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:51:25:51:25 | access to parameter c | true |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:51:9:51:21 | [false] ... is ... | false |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:51:34:51:34 | access to parameter c | false |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:13:60:17 | [match] not ... | false |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:13:60:17 | [no-match] not ... | true |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:22:60:28 | "not 1" | false |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:13:61:13 | _ | true |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:18:61:24 | "other" | true |
+| Patterns.cs:60:13:60:17 | [match] not ... | Patterns.cs:60:22:60:28 | "not 1" | true |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:61:13:61:13 | _ | false |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:61:18:61:24 | "other" | false |
 | Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:18:61:24 | "other" | true |
-| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:13:70:13 | 2 | false |
-| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:18:70:27 | "possible" | false |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:69:13:69:17 | [no-match] not ... | true |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:13:70:13 | 2 | true |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:18:70:27 | "possible" | true |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:70:13:70:13 | 2 | false |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:70:18:70:27 | "possible" | false |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" | true |
+| PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:13:12:21 | [false] ... is ... | false |
+| PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:13:12:21 | [true] ... is ... | true |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:13:13:13:19 | return ...; | true |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:14:9:14:29 | ...; | false |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:14:9:14:29 | ...; | false |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:13:13:13:19 | return ...; | true |
+| PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:19:13:19:21 | [false] ... is ... | false |
+| PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:19:13:19:21 | [true] ... is ... | true |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:20:45:20:53 | nameof(...) | true |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:21:9:21:29 | ...; | false |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:21:9:21:29 | ...; | false |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:20:45:20:53 | nameof(...) | true |
 | Switch.cs:10:10:10:11 | enter M2 | Switch.cs:10:10:10:11 | exit M2 (abnormal) | false |
 | Switch.cs:10:10:10:11 | enter M2 | Switch.cs:15:17:15:23 | return ...; | true |
 | Switch.cs:10:10:10:11 | enter M2 | Switch.cs:16:13:16:19 | case ...: | false |
@@ -1999,7 +2052,10 @@ conditionBlock
 | Switch.cs:156:17:156:54 | ... switch { ... } | Switch.cs:158:13:158:49 | ...; | true |
 | Switch.cs:156:17:156:54 | ... switch { ... } | Switch.cs:160:13:160:49 | ...; | false |
 | Switch.cs:156:41:156:45 | false | Switch.cs:156:50:156:52 | "b" | true |
+| TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:7:13:7:22 | [false] ... is ... | false |
+| TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:7:13:7:22 | [true] ... is ... | true |
 | TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:7:25:7:25 | ; | true |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:7:25:7:25 | ; | true |
 | VarDecls.cs:19:7:19:8 | enter M3 | VarDecls.cs:25:24:25:24 | access to local variable x | true |
 | VarDecls.cs:19:7:19:8 | enter M3 | VarDecls.cs:25:28:25:28 | access to local variable y | false |
 | cflow.cs:5:17:5:20 | enter Main | cflow.cs:12:13:12:49 | ...; | true |
@@ -2712,20 +2768,20 @@ conditionFlow
 | NullCoalescing.cs:11:51:11:58 | [true] ... && ... | NullCoalescing.cs:11:44:11:59 | [true] ... ?? ... | true |
 | NullCoalescing.cs:11:57:11:58 | access to parameter b3 | NullCoalescing.cs:11:51:11:58 | [false] ... && ... | false |
 | NullCoalescing.cs:11:57:11:58 | access to parameter b3 | NullCoalescing.cs:11:51:11:58 | [true] ... && ... | true |
-| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:9:9:11:9 | {...} | true |
-| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:12:14:18:9 | if (...) ... | false |
-| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:13:9:15:9 | {...} | true |
-| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:16:14:18:9 | if (...) ... | false |
-| Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:17:9:18:9 | {...} | true |
-| Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:20:9:38:9 | switch (...) {...} | false |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:12:14:18:9 | if (...) ... | false |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:9:9:11:9 | {...} | true |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:16:14:18:9 | if (...) ... | false |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:13:9:15:9 | {...} | true |
+| Patterns.cs:16:18:16:28 | [false] ... is ... | Patterns.cs:20:9:38:9 | switch (...) {...} | false |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:17:9:18:9 | {...} | true |
 | Patterns.cs:24:30:24:35 | ... > ... | Patterns.cs:25:17:25:52 | ...; | true |
 | Patterns.cs:24:30:24:35 | ... > ... | Patterns.cs:27:13:27:24 | case ...: | false |
-| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:25:51:25 | access to parameter c | true |
-| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:34:51:34 | access to parameter c | false |
-| PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:13:13:13:19 | return ...; | true |
-| PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:14:9:14:29 | ...; | false |
-| PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:20:45:20:53 | nameof(...) | true |
-| PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:21:9:21:29 | ...; | false |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:34:51:34 | access to parameter c | false |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:25:51:25 | access to parameter c | true |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:14:9:14:29 | ...; | false |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:13:13:13:19 | return ...; | true |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:21:9:21:29 | ...; | false |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:20:45:20:53 | nameof(...) | true |
 | Switch.cs:21:21:21:29 | ... == ... | Switch.cs:22:21:22:27 | return ...; | true |
 | Switch.cs:21:21:21:29 | ... == ... | Switch.cs:23:27:23:27 | 0 | false |
 | Switch.cs:24:32:24:43 | ... > ... | Switch.cs:24:32:24:55 | [false] ... && ... | false |
@@ -2752,8 +2808,8 @@ conditionFlow
 | Switch.cs:125:42:125:46 | false | Switch.cs:125:37:125:46 | [false] ... => ... | false |
 | Switch.cs:157:13:157:13 | access to parameter b | Switch.cs:158:13:158:49 | ...; | true |
 | Switch.cs:157:13:157:13 | access to parameter b | Switch.cs:160:13:160:49 | ...; | false |
-| TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:7:25:7:25 | ; | true |
-| TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:8:9:8:28 | ... ...; | false |
+| TypeAccesses.cs:7:13:7:22 | [false] ... is ... | TypeAccesses.cs:8:9:8:28 | ... ...; | false |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:7:25:7:25 | ; | true |
 | VarDecls.cs:25:20:25:20 | access to parameter b | VarDecls.cs:25:24:25:24 | access to local variable x | true |
 | VarDecls.cs:25:20:25:20 | access to parameter b | VarDecls.cs:25:28:25:28 | access to local variable y | false |
 | cflow.cs:11:13:11:17 | ... > ... | cflow.cs:12:13:12:49 | ...; | true |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
index 04ec56a11a4..e0f56f17f5c 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
@@ -3058,9 +3058,10 @@ dominance
 | Patterns.cs:7:20:7:23 | null | Patterns.cs:7:16:7:23 | Object o = ... |
 | Patterns.cs:8:9:18:9 | if (...) ... | Patterns.cs:8:13:8:13 | access to local variable o |
 | Patterns.cs:8:13:8:13 | access to local variable o | Patterns.cs:8:18:8:23 | Int32 i1 |
-| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:9:9:11:9 | {...} |
-| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:12:14:18:9 | if (...) ... |
-| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:13:8:23 | ... is ... |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:12:14:18:9 | if (...) ... |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:9:9:11:9 | {...} |
+| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:13:8:23 | [false] ... is ... |
+| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:13:8:23 | [true] ... is ... |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:10:13:10:43 | ...; |
 | Patterns.cs:10:13:10:43 | ...; | Patterns.cs:10:33:10:36 | "int " |
 | Patterns.cs:10:31:10:41 | $"..." | Patterns.cs:10:13:10:42 | call to method WriteLine |
@@ -3068,9 +3069,10 @@ dominance
 | Patterns.cs:10:38:10:39 | access to local variable i1 | Patterns.cs:10:31:10:41 | $"..." |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:18:12:18 | access to local variable o |
 | Patterns.cs:12:18:12:18 | access to local variable o | Patterns.cs:12:23:12:31 | String s1 |
-| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:13:9:15:9 | {...} |
-| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:16:14:18:9 | if (...) ... |
-| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:18:12:31 | ... is ... |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:13:9:15:9 | {...} |
+| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:18:12:31 | [false] ... is ... |
+| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:18:12:31 | [true] ... is ... |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:14:13:14:46 | ...; |
 | Patterns.cs:14:13:14:46 | ...; | Patterns.cs:14:33:14:39 | "string " |
 | Patterns.cs:14:31:14:44 | $"..." | Patterns.cs:14:13:14:45 | call to method WriteLine |
@@ -3078,8 +3080,9 @@ dominance
 | Patterns.cs:14:41:14:42 | access to local variable s1 | Patterns.cs:14:31:14:44 | $"..." |
 | Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:18:16:18 | access to local variable o |
 | Patterns.cs:16:18:16:18 | access to local variable o | Patterns.cs:16:23:16:28 | Object v1 |
-| Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:17:9:18:9 | {...} |
-| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:18:16:28 | ... is ... |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:17:9:18:9 | {...} |
+| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:18:16:28 | [true] ... is ... |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:20:17:20:17 | access to local variable o |
 | Patterns.cs:20:17:20:17 | access to local variable o | Patterns.cs:22:13:22:23 | case ...: |
 | Patterns.cs:22:13:22:23 | case ...: | Patterns.cs:22:18:22:22 | "xyz" |
@@ -3130,11 +3133,13 @@ dominance
 | Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:9 | access to parameter c |
 | Patterns.cs:50:24:50:25 | exit M3 (normal) | Patterns.cs:50:24:50:25 | exit M3 |
 | Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:51:18:51:21 | null |
-| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:25:51:25 | access to parameter c |
-| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:25:51:25 | access to parameter c |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | exit M3 (normal) |
-| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:9:51:21 | ... is ... |
-| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:14:51:21 | not ... |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:51:9:51:21 | [true] ... is ... |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:51:9:51:21 | [false] ... is ... |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:14:51:21 | [match] not ... |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:14:51:21 | [no-match] not ... |
 | Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:30:51:30 | 1 |
 | Patterns.cs:51:30:51:30 | 1 | Patterns.cs:51:25:51:30 | ... is ... |
 | Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:39:51:39 | 2 |
@@ -3154,9 +3159,10 @@ dominance
 | Patterns.cs:58:9:62:10 | return ...; | Patterns.cs:56:26:56:27 | exit M5 (normal) |
 | Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:60:17:60:17 | 1 |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:9:62:10 | return ...; |
-| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:22:60:28 | "not 1" |
-| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:61:13:61:13 | _ |
-| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:13:60:17 | not ... |
+| Patterns.cs:60:13:60:17 | [match] not ... | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:13:60:17 | [match] not ... |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:13:60:17 | [no-match] not ... |
 | Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:13:60:28 | ... => ... |
 | Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:18:61:24 | "other" |
 | Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:13:61:24 | ... => ... |
@@ -3166,8 +3172,8 @@ dominance
 | Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:65:26:65:27 | exit M6 (normal) |
 | Patterns.cs:67:16:67:16 | 2 | Patterns.cs:69:17:69:17 | 2 |
 | Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:67:9:71:10 | return ...; |
-| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:70:13:70:13 | 2 |
-| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:13:69:17 | not ... |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:13:69:17 | [no-match] not ... |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:67:16:71:9 | ... switch { ... } |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:27 | ... => ... |
@@ -3182,18 +3188,20 @@ dominance
 | PostDominance.cs:11:5:15:5 | {...} | PostDominance.cs:12:9:13:19 | if (...) ... |
 | PostDominance.cs:12:9:13:19 | if (...) ... | PostDominance.cs:12:13:12:13 | access to parameter s |
 | PostDominance.cs:12:13:12:13 | access to parameter s | PostDominance.cs:12:18:12:21 | null |
-| PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:13:13:13:19 | return ...; |
-| PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:14:9:14:29 | ...; |
-| PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:13:12:21 | ... is ... |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:14:9:14:29 | ...; |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:13:13:13:19 | return ...; |
+| PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:13:12:21 | [false] ... is ... |
+| PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:13:12:21 | [true] ... is ... |
 | PostDominance.cs:14:9:14:29 | ...; | PostDominance.cs:14:27:14:27 | access to parameter s |
 | PostDominance.cs:14:27:14:27 | access to parameter s | PostDominance.cs:14:9:14:28 | call to method WriteLine |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:18:5:22:5 | {...} |
 | PostDominance.cs:18:5:22:5 | {...} | PostDominance.cs:19:9:20:55 | if (...) ... |
 | PostDominance.cs:19:9:20:55 | if (...) ... | PostDominance.cs:19:13:19:13 | access to parameter s |
 | PostDominance.cs:19:13:19:13 | access to parameter s | PostDominance.cs:19:18:19:21 | null |
-| PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:20:45:20:53 | nameof(...) |
-| PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:21:9:21:29 | ...; |
-| PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:13:19:21 | ... is ... |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:21:9:21:29 | ...; |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:20:45:20:53 | nameof(...) |
+| PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:13:19:21 | [false] ... is ... |
+| PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:13:19:21 | [true] ... is ... |
 | PostDominance.cs:20:13:20:55 | throw ...; | PostDominance.cs:17:10:17:11 | exit M3 (abnormal) |
 | PostDominance.cs:20:19:20:54 | object creation of type ArgumentNullException | PostDominance.cs:20:13:20:55 | throw ...; |
 | PostDominance.cs:20:45:20:53 | nameof(...) | PostDominance.cs:20:19:20:54 | object creation of type ArgumentNullException |
@@ -3517,9 +3525,9 @@ dominance
 | TypeAccesses.cs:6:13:6:23 | ... as ... | TypeAccesses.cs:6:9:6:23 | ... = ... |
 | TypeAccesses.cs:7:9:7:25 | if (...) ... | TypeAccesses.cs:7:13:7:13 | access to parameter o |
 | TypeAccesses.cs:7:13:7:13 | access to parameter o | TypeAccesses.cs:7:18:7:22 | Int32 j |
-| TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:7:25:7:25 | ; |
-| TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:8:9:8:28 | ... ...; |
-| TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:13:7:22 | ... is ... |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:7:25:7:25 | ; |
+| TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:13:7:22 | [false] ... is ... |
+| TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:13:7:22 | [true] ... is ... |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:8:17:8:27 | typeof(...) |
 | TypeAccesses.cs:8:13:8:27 | Type t = ... | TypeAccesses.cs:3:10:3:10 | exit M (normal) |
 | TypeAccesses.cs:8:17:8:27 | typeof(...) | TypeAccesses.cs:8:13:8:27 | Type t = ... |
@@ -7050,27 +7058,29 @@ postDominance
 | Patterns.cs:7:20:7:23 | null | Patterns.cs:7:9:7:24 | ... ...; |
 | Patterns.cs:8:9:18:9 | if (...) ... | Patterns.cs:7:16:7:23 | Object o = ... |
 | Patterns.cs:8:13:8:13 | access to local variable o | Patterns.cs:8:9:18:9 | if (...) ... |
-| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:8:18:8:23 | Int32 i1 |
 | Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:13:8:13 | access to local variable o |
+| Patterns.cs:9:9:11:9 | {...} | Patterns.cs:8:13:8:23 | [true] ... is ... |
 | Patterns.cs:10:13:10:42 | call to method WriteLine | Patterns.cs:10:31:10:41 | $"..." |
 | Patterns.cs:10:13:10:43 | ...; | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:10:31:10:41 | $"..." | Patterns.cs:10:38:10:39 | access to local variable i1 |
 | Patterns.cs:10:33:10:36 | "int " | Patterns.cs:10:13:10:43 | ...; |
 | Patterns.cs:10:38:10:39 | access to local variable i1 | Patterns.cs:10:33:10:36 | "int " |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:8:13:8:23 | [false] ... is ... |
 | Patterns.cs:12:18:12:18 | access to local variable o | Patterns.cs:12:14:18:9 | if (...) ... |
-| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:12:23:12:31 | String s1 |
 | Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:18:12:18 | access to local variable o |
+| Patterns.cs:13:9:15:9 | {...} | Patterns.cs:12:18:12:31 | [true] ... is ... |
 | Patterns.cs:14:13:14:45 | call to method WriteLine | Patterns.cs:14:31:14:44 | $"..." |
 | Patterns.cs:14:13:14:46 | ...; | Patterns.cs:13:9:15:9 | {...} |
 | Patterns.cs:14:31:14:44 | $"..." | Patterns.cs:14:41:14:42 | access to local variable s1 |
 | Patterns.cs:14:33:14:39 | "string " | Patterns.cs:14:13:14:46 | ...; |
 | Patterns.cs:14:41:14:42 | access to local variable s1 | Patterns.cs:14:33:14:39 | "string " |
+| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:12:18:12:31 | [false] ... is ... |
 | Patterns.cs:16:18:16:18 | access to local variable o | Patterns.cs:16:14:18:9 | if (...) ... |
-| Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:16:23:16:28 | Object v1 |
 | Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:18:16:18 | access to local variable o |
+| Patterns.cs:17:9:18:9 | {...} | Patterns.cs:16:18:16:28 | [true] ... is ... |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:10:13:10:42 | call to method WriteLine |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:14:13:14:45 | call to method WriteLine |
-| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:16:18:16:28 | ... is ... |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:16:18:16:28 | [false] ... is ... |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:17:9:18:9 | {...} |
 | Patterns.cs:20:17:20:17 | access to local variable o | Patterns.cs:20:9:38:9 | switch (...) {...} |
 | Patterns.cs:22:13:22:23 | case ...: | Patterns.cs:20:17:20:17 | access to local variable o |
@@ -7116,13 +7126,15 @@ postDominance
 | Patterns.cs:50:24:50:25 | exit M3 | Patterns.cs:50:24:50:25 | exit M3 (normal) |
 | Patterns.cs:50:24:50:25 | exit M3 (normal) | Patterns.cs:51:9:51:39 | ... ? ... : ... |
 | Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:50:24:50:25 | enter M3 |
-| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:14:51:21 | not ... |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:14:51:21 | [no-match] not ... |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:14:51:21 | [match] not ... |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:25:51:30 | ... is ... |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:34:51:39 | ... is ... |
-| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:18:51:21 | null |
 | Patterns.cs:51:18:51:21 | null | Patterns.cs:51:9:51:9 | access to parameter c |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:9:51:21 | [true] ... is ... |
 | Patterns.cs:51:25:51:30 | ... is ... | Patterns.cs:51:30:51:30 | 1 |
 | Patterns.cs:51:30:51:30 | 1 | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:9:51:21 | [false] ... is ... |
 | Patterns.cs:51:34:51:39 | ... is ... | Patterns.cs:51:39:51:39 | 2 |
 | Patterns.cs:51:39:51:39 | 2 | Patterns.cs:51:34:51:34 | access to parameter c |
 | Patterns.cs:53:24:53:25 | exit M4 | Patterns.cs:53:24:53:25 | exit M4 (normal) |
@@ -7141,9 +7153,10 @@ postDominance
 | Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:57:5:63:5 | {...} |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:60:13:60:28 | ... => ... |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:61:13:61:24 | ... => ... |
-| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:17:60:17 | 1 |
 | Patterns.cs:60:13:60:28 | ... => ... | Patterns.cs:60:22:60:28 | "not 1" |
 | Patterns.cs:60:17:60:17 | 1 | Patterns.cs:58:16:58:16 | access to parameter i |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:13:60:17 | [match] not ... |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:60:13:60:17 | [no-match] not ... |
 | Patterns.cs:61:13:61:24 | ... => ... | Patterns.cs:61:18:61:24 | "other" |
 | Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:13:61:13 | _ |
 | Patterns.cs:65:26:65:27 | exit M6 | Patterns.cs:65:26:65:27 | exit M6 (normal) |
@@ -7152,9 +7165,9 @@ postDominance
 | Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:67:16:71:9 | ... switch { ... } |
 | Patterns.cs:67:16:67:16 | 2 | Patterns.cs:66:5:72:5 | {...} |
 | Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:70:13:70:27 | ... => ... |
-| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:69:17:69:17 | 2 |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:69:17:69:17 | 2 |
 | Patterns.cs:69:17:69:17 | 2 | Patterns.cs:67:16:67:16 | 2 |
-| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:69:13:69:17 | not ... |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:69:13:69:17 | [no-match] not ... |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:70:18:70:27 | "possible" |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:13 | 2 |
 | PostDominance.cs:5:10:5:11 | exit M1 | PostDominance.cs:5:10:5:11 | exit M1 (normal) |
@@ -7169,21 +7182,22 @@ postDominance
 | PostDominance.cs:11:5:15:5 | {...} | PostDominance.cs:10:10:10:11 | enter M2 |
 | PostDominance.cs:12:9:13:19 | if (...) ... | PostDominance.cs:11:5:15:5 | {...} |
 | PostDominance.cs:12:13:12:13 | access to parameter s | PostDominance.cs:12:9:13:19 | if (...) ... |
-| PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:12:18:12:21 | null |
 | PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:13:12:13 | access to parameter s |
+| PostDominance.cs:13:13:13:19 | return ...; | PostDominance.cs:12:13:12:21 | [true] ... is ... |
 | PostDominance.cs:14:9:14:28 | call to method WriteLine | PostDominance.cs:14:27:14:27 | access to parameter s |
+| PostDominance.cs:14:9:14:29 | ...; | PostDominance.cs:12:13:12:21 | [false] ... is ... |
 | PostDominance.cs:14:27:14:27 | access to parameter s | PostDominance.cs:14:9:14:29 | ...; |
 | PostDominance.cs:17:10:17:11 | exit M3 (abnormal) | PostDominance.cs:20:13:20:55 | throw ...; |
 | PostDominance.cs:17:10:17:11 | exit M3 (normal) | PostDominance.cs:21:9:21:28 | call to method WriteLine |
 | PostDominance.cs:18:5:22:5 | {...} | PostDominance.cs:17:10:17:11 | enter M3 |
 | PostDominance.cs:19:9:20:55 | if (...) ... | PostDominance.cs:18:5:22:5 | {...} |
 | PostDominance.cs:19:13:19:13 | access to parameter s | PostDominance.cs:19:9:20:55 | if (...) ... |
-| PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:19:18:19:21 | null |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:19:18:19:21 | null |
 | PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:13:19:13 | access to parameter s |
 | PostDominance.cs:20:13:20:55 | throw ...; | PostDominance.cs:20:19:20:54 | object creation of type ArgumentNullException |
 | PostDominance.cs:20:19:20:54 | object creation of type ArgumentNullException | PostDominance.cs:20:45:20:53 | nameof(...) |
 | PostDominance.cs:21:9:21:28 | call to method WriteLine | PostDominance.cs:21:27:21:27 | access to parameter s |
-| PostDominance.cs:21:9:21:29 | ...; | PostDominance.cs:19:13:19:21 | ... is ... |
+| PostDominance.cs:21:9:21:29 | ...; | PostDominance.cs:19:13:19:21 | [false] ... is ... |
 | PostDominance.cs:21:27:21:27 | access to parameter s | PostDominance.cs:21:9:21:29 | ...; |
 | Qualifiers.cs:7:16:7:21 | exit Method | Qualifiers.cs:7:16:7:21 | exit Method (normal) |
 | Qualifiers.cs:7:16:7:21 | exit Method (normal) | Qualifiers.cs:7:28:7:31 | null |
@@ -7486,9 +7500,9 @@ postDominance
 | TypeAccesses.cs:6:13:6:23 | ... as ... | TypeAccesses.cs:6:13:6:13 | access to parameter o |
 | TypeAccesses.cs:7:9:7:25 | if (...) ... | TypeAccesses.cs:6:9:6:23 | ... = ... |
 | TypeAccesses.cs:7:13:7:13 | access to parameter o | TypeAccesses.cs:7:9:7:25 | if (...) ... |
-| TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:7:18:7:22 | Int32 j |
 | TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:13:7:13 | access to parameter o |
-| TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:7:13:7:22 | ... is ... |
+| TypeAccesses.cs:7:25:7:25 | ; | TypeAccesses.cs:7:13:7:22 | [true] ... is ... |
+| TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:7:13:7:22 | [false] ... is ... |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:7:25:7:25 | ; |
 | TypeAccesses.cs:8:13:8:27 | Type t = ... | TypeAccesses.cs:8:17:8:27 | typeof(...) |
 | TypeAccesses.cs:8:17:8:27 | typeof(...) | TypeAccesses.cs:8:9:8:28 | ... ...; |
@@ -11511,10 +11525,16 @@ blockDominance
 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:5:10:5:11 | enter M1 |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:8:13:8:23 | [false] ... is ... |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:8:13:8:23 | [true] ... is ... |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:12:14:18:9 | if (...) ... |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:12:18:12:31 | [false] ... is ... |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:12:18:12:31 | [true] ... is ... |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:13:9:15:9 | {...} |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:16:18:16:28 | [true] ... is ... |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:17:9:18:9 | {...} |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:20:9:38:9 | switch (...) {...} |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:23:17:23:22 | break; |
@@ -11529,14 +11549,41 @@ blockDominance
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:34:17:34:22 | break; |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:35:13:35:20 | default: |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:40:9:42:9 | switch (...) {...} |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:8:13:8:23 | [false] ... is ... |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:12:14:18:9 | if (...) ... |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:12:18:12:31 | [false] ... is ... |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:12:18:12:31 | [true] ... is ... |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:13:9:15:9 | {...} |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:16:18:16:28 | [true] ... is ... |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:17:9:18:9 | {...} |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:8:13:8:23 | [true] ... is ... |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:14:18:9 | if (...) ... |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:18:12:31 | [false] ... is ... |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:18:12:31 | [true] ... is ... |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:13:9:15:9 | {...} |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:16:18:16:28 | [true] ... is ... |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:17:9:18:9 | {...} |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:12:18:12:31 | [false] ... is ... |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:16:18:16:28 | [true] ... is ... |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:17:9:18:9 | {...} |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:12:18:12:31 | [true] ... is ... |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:13:9:15:9 | {...} |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:13:9:15:9 | {...} |
 | Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:18:16:28 | [true] ... is ... |
 | Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:17:9:18:9 | {...} |
+| Patterns.cs:16:18:16:28 | [false] ... is ... | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:16:18:16:28 | [true] ... is ... |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:17:9:18:9 | {...} |
 | Patterns.cs:17:9:18:9 | {...} | Patterns.cs:17:9:18:9 | {...} |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:20:9:38:9 | switch (...) {...} |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:23:17:23:22 | break; |
@@ -11587,42 +11634,79 @@ blockDominance
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:40:9:42:9 | switch (...) {...} |
 | Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:47:24:47:25 | enter M2 |
 | Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:50:24:50:25 | enter M3 |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:21 | [false] ... is ... |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:21 | [true] ... is ... |
 | Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:39 | ... ? ... : ... |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:14:51:21 | [match] not ... |
+| Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:14:51:21 | [no-match] not ... |
 | Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:25:51:25 | access to parameter c |
 | Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:9:51:21 | [false] ... is ... |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:9:51:21 | [true] ... is ... |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:25:51:25 | access to parameter c |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:9:51:39 | ... ? ... : ... |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:51:9:51:21 | [true] ... is ... |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:51:14:51:21 | [match] not ... |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:51:9:51:21 | [false] ... is ... |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:51:14:51:21 | [no-match] not ... |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:51:34:51:34 | access to parameter c |
 | Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:25:51:25 | access to parameter c |
 | Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:34:51:34 | access to parameter c |
 | Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:53:24:53:25 | enter M4 |
 | Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:56:26:56:27 | enter M5 |
 | Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:58:16:62:9 | ... switch { ... } |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:13:60:17 | [match] not ... |
+| Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:13:60:17 | [no-match] not ... |
 | Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:60:22:60:28 | "not 1" |
 | Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:13:61:13 | _ |
 | Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:61:18:61:24 | "other" |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:16:62:9 | ... switch { ... } |
+| Patterns.cs:60:13:60:17 | [match] not ... | Patterns.cs:60:13:60:17 | [match] not ... |
+| Patterns.cs:60:13:60:17 | [match] not ... | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:60:13:60:17 | [no-match] not ... |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:61:18:61:24 | "other" |
 | Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:22:60:28 | "not 1" |
 | Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:13:61:13 | _ |
 | Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:18:61:24 | "other" |
 | Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:18:61:24 | "other" |
 | Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:69:13:69:17 | [no-match] not ... |
 | Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:13:70:13 | 2 |
 | Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:70:18:70:27 | "possible" |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:69:13:69:17 | [no-match] not ... |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:70:18:70:27 | "possible" |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | enter M1 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | enter M2 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | exit M2 (normal) |
+| PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:13:12:21 | [false] ... is ... |
+| PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:13:12:21 | [true] ... is ... |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:13:13:13:19 | return ...; |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:14:9:14:29 | ...; |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | exit M2 (normal) |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:12:13:12:21 | [false] ... is ... |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:14:9:14:29 | ...; |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:12:13:12:21 | [true] ... is ... |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:13:13:13:19 | return ...; |
 | PostDominance.cs:13:13:13:19 | return ...; | PostDominance.cs:13:13:13:19 | return ...; |
 | PostDominance.cs:14:9:14:29 | ...; | PostDominance.cs:14:9:14:29 | ...; |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:17:10:17:11 | enter M3 |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:17:10:17:11 | exit M3 |
+| PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:19:13:19:21 | [false] ... is ... |
+| PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:19:13:19:21 | [true] ... is ... |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:20:45:20:53 | nameof(...) |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:21:9:21:29 | ...; |
 | PostDominance.cs:17:10:17:11 | exit M3 | PostDominance.cs:17:10:17:11 | exit M3 |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:19:13:19:21 | [false] ... is ... |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:21:9:21:29 | ...; |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:19:13:19:21 | [true] ... is ... |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:20:45:20:53 | nameof(...) |
 | PostDominance.cs:20:45:20:53 | nameof(...) | PostDominance.cs:20:45:20:53 | nameof(...) |
 | PostDominance.cs:21:9:21:29 | ...; | PostDominance.cs:21:9:21:29 | ...; |
 | Qualifiers.cs:7:16:7:21 | enter Method | Qualifiers.cs:7:16:7:21 | enter Method |
@@ -11945,8 +12029,13 @@ blockDominance
 | Switch.cs:158:13:158:49 | ...; | Switch.cs:158:13:158:49 | ...; |
 | Switch.cs:160:13:160:49 | ...; | Switch.cs:160:13:160:49 | ...; |
 | TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:3:10:3:10 | enter M |
+| TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:7:13:7:22 | [false] ... is ... |
+| TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:7:13:7:22 | [true] ... is ... |
 | TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:7:25:7:25 | ; |
 | TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:8:9:8:28 | ... ...; |
+| TypeAccesses.cs:7:13:7:22 | [false] ... is ... | TypeAccesses.cs:7:13:7:22 | [false] ... is ... |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:7:13:7:22 | [true] ... is ... |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:7:25:7:25 | ; |
 | TypeAccesses.cs:7:25:7:25 | ; | TypeAccesses.cs:7:25:7:25 | ; |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:8:9:8:28 | ... ...; |
 | VarDecls.cs:5:18:5:19 | enter M1 | VarDecls.cs:5:18:5:19 | enter M1 |
@@ -14820,16 +14909,33 @@ postBlockDominance
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:16:17:16:25 | ... ?? ... |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:17:13:17:24 | ... ?? ... |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:5:10:5:11 | enter M1 |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:8:13:8:23 | [false] ... is ... |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:8:13:8:23 | [true] ... is ... |
+| Patterns.cs:9:9:11:9 | {...} | Patterns.cs:8:13:8:23 | [true] ... is ... |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:9:9:11:9 | {...} |
+| Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:8:13:8:23 | [false] ... is ... |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:14:18:9 | if (...) ... |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:12:18:12:31 | [false] ... is ... |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:12:18:12:31 | [true] ... is ... |
+| Patterns.cs:13:9:15:9 | {...} | Patterns.cs:12:18:12:31 | [true] ... is ... |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:13:9:15:9 | {...} |
+| Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:12:18:12:31 | [false] ... is ... |
 | Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:16:18:16:28 | [false] ... is ... | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:16:18:16:28 | [true] ... is ... |
+| Patterns.cs:17:9:18:9 | {...} | Patterns.cs:16:18:16:28 | [true] ... is ... |
 | Patterns.cs:17:9:18:9 | {...} | Patterns.cs:17:9:18:9 | {...} |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | enter M1 |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:8:13:8:23 | [false] ... is ... |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:8:13:8:23 | [true] ... is ... |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:12:14:18:9 | if (...) ... |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:12:18:12:31 | [false] ... is ... |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:12:18:12:31 | [true] ... is ... |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:13:9:15:9 | {...} |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:16:18:16:28 | [true] ... is ... |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:17:9:18:9 | {...} |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:20:9:38:9 | switch (...) {...} |
 | Patterns.cs:23:17:23:22 | break; | Patterns.cs:23:17:23:22 | break; |
@@ -14844,10 +14950,16 @@ postBlockDominance
 | Patterns.cs:34:17:34:22 | break; | Patterns.cs:34:17:34:22 | break; |
 | Patterns.cs:35:13:35:20 | default: | Patterns.cs:35:13:35:20 | default: |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | enter M1 |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:8:13:8:23 | [false] ... is ... |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:8:13:8:23 | [true] ... is ... |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:9:9:11:9 | {...} |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:12:14:18:9 | if (...) ... |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:12:18:12:31 | [false] ... is ... |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:12:18:12:31 | [true] ... is ... |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:13:9:15:9 | {...} |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:16:14:18:9 | if (...) ... |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:16:18:16:28 | [false] ... is ... |
+| Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:16:18:16:28 | [true] ... is ... |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:17:9:18:9 | {...} |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:20:9:38:9 | switch (...) {...} |
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:23:17:23:22 | break; |
@@ -14864,41 +14976,76 @@ postBlockDominance
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:40:9:42:9 | switch (...) {...} |
 | Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:47:24:47:25 | enter M2 |
 | Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:50:24:50:25 | enter M3 |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:9:51:21 | [false] ... is ... |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:14:51:21 | [no-match] not ... |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:9:51:21 | [true] ... is ... |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:14:51:21 | [match] not ... |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | enter M3 |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:9:51:21 | [false] ... is ... |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:9:51:21 | [true] ... is ... |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:9:51:39 | ... ? ... : ... |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:14:51:21 | [match] not ... |
+| Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:14:51:21 | [no-match] not ... |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:25:51:25 | access to parameter c |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:34:51:34 | access to parameter c |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:51:14:51:21 | [match] not ... |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:51:14:51:21 | [no-match] not ... |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:9:51:21 | [true] ... is ... |
+| Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:14:51:21 | [match] not ... |
 | Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:25:51:25 | access to parameter c |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:9:51:21 | [false] ... is ... |
+| Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:14:51:21 | [no-match] not ... |
 | Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:51:34:51:34 | access to parameter c |
 | Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:53:24:53:25 | enter M4 |
 | Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:56:26:56:27 | enter M5 |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:56:26:56:27 | enter M5 |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:16:62:9 | ... switch { ... } |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:60:13:60:17 | [match] not ... |
+| Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:60:13:60:17 | [no-match] not ... |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:60:22:60:28 | "not 1" |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:61:13:61:13 | _ |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:61:18:61:24 | "other" |
+| Patterns.cs:60:13:60:17 | [match] not ... | Patterns.cs:60:13:60:17 | [match] not ... |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:60:13:60:17 | [no-match] not ... |
+| Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:13:60:17 | [match] not ... |
 | Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:22:60:28 | "not 1" |
+| Patterns.cs:61:13:61:13 | _ | Patterns.cs:60:13:60:17 | [no-match] not ... |
 | Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:13:61:13 | _ |
+| Patterns.cs:61:18:61:24 | "other" | Patterns.cs:60:13:60:17 | [no-match] not ... |
 | Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:13:61:13 | _ |
 | Patterns.cs:61:18:61:24 | "other" | Patterns.cs:61:18:61:24 | "other" |
 | Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:69:13:69:17 | [no-match] not ... |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:70:13:70:13 | 2 | Patterns.cs:69:13:69:17 | [no-match] not ... |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | enter M6 |
+| Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:69:13:69:17 | [no-match] not ... |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:13 | 2 |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | enter M1 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | enter M2 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | enter M2 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | exit M2 (normal) |
+| PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:12:13:12:21 | [false] ... is ... |
+| PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:12:13:12:21 | [true] ... is ... |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:13:13:13:19 | return ...; |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:14:9:14:29 | ...; |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:12:13:12:21 | [false] ... is ... |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:12:13:12:21 | [true] ... is ... |
+| PostDominance.cs:13:13:13:19 | return ...; | PostDominance.cs:12:13:12:21 | [true] ... is ... |
 | PostDominance.cs:13:13:13:19 | return ...; | PostDominance.cs:13:13:13:19 | return ...; |
+| PostDominance.cs:14:9:14:29 | ...; | PostDominance.cs:12:13:12:21 | [false] ... is ... |
 | PostDominance.cs:14:9:14:29 | ...; | PostDominance.cs:14:9:14:29 | ...; |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:17:10:17:11 | enter M3 |
 | PostDominance.cs:17:10:17:11 | exit M3 | PostDominance.cs:17:10:17:11 | exit M3 |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:17:10:17:11 | enter M3 |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:19:13:19:21 | [false] ... is ... |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:19:13:19:21 | [true] ... is ... |
 | PostDominance.cs:20:45:20:53 | nameof(...) | PostDominance.cs:20:45:20:53 | nameof(...) |
 | PostDominance.cs:21:9:21:29 | ...; | PostDominance.cs:17:10:17:11 | enter M3 |
+| PostDominance.cs:21:9:21:29 | ...; | PostDominance.cs:19:13:19:21 | [false] ... is ... |
 | PostDominance.cs:21:9:21:29 | ...; | PostDominance.cs:21:9:21:29 | ...; |
 | Qualifiers.cs:7:16:7:21 | enter Method | Qualifiers.cs:7:16:7:21 | enter Method |
 | Qualifiers.cs:8:23:8:34 | enter StaticMethod | Qualifiers.cs:8:23:8:34 | enter StaticMethod |
@@ -15140,8 +15287,13 @@ postBlockDominance
 | Switch.cs:158:13:158:49 | ...; | Switch.cs:158:13:158:49 | ...; |
 | Switch.cs:160:13:160:49 | ...; | Switch.cs:160:13:160:49 | ...; |
 | TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:3:10:3:10 | enter M |
+| TypeAccesses.cs:7:13:7:22 | [false] ... is ... | TypeAccesses.cs:7:13:7:22 | [false] ... is ... |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:7:13:7:22 | [true] ... is ... |
+| TypeAccesses.cs:7:25:7:25 | ; | TypeAccesses.cs:7:13:7:22 | [true] ... is ... |
 | TypeAccesses.cs:7:25:7:25 | ; | TypeAccesses.cs:7:25:7:25 | ; |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:3:10:3:10 | enter M |
+| TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:7:13:7:22 | [false] ... is ... |
+| TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:7:13:7:22 | [true] ... is ... |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:7:25:7:25 | ; |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:8:9:8:28 | ... ...; |
 | VarDecls.cs:5:18:5:19 | enter M1 | VarDecls.cs:5:18:5:19 | enter M1 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
index ff77b166891..1b5088c216e 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
@@ -3493,7 +3493,8 @@ nodeEnclosing
 | Patterns.cs:7:20:7:23 | null | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:8:9:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:8:13:8:13 | access to local variable o | Patterns.cs:5:10:5:11 | M1 |
-| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:10:13:10:42 | call to method WriteLine | Patterns.cs:5:10:5:11 | M1 |
@@ -3503,7 +3504,8 @@ nodeEnclosing
 | Patterns.cs:10:38:10:39 | access to local variable i1 | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:12:18:12:18 | access to local variable o | Patterns.cs:5:10:5:11 | M1 |
-| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:14:13:14:45 | call to method WriteLine | Patterns.cs:5:10:5:11 | M1 |
@@ -3513,7 +3515,8 @@ nodeEnclosing
 | Patterns.cs:14:41:14:42 | access to local variable s1 | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:16:18:16:18 | access to local variable o | Patterns.cs:5:10:5:11 | M1 |
-| Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:16:18:16:28 | [false] ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:17:9:18:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | M1 |
@@ -3569,9 +3572,11 @@ nodeEnclosing
 | Patterns.cs:50:24:50:25 | exit M3 | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:50:24:50:25 | exit M3 (normal) | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:50:24:50:25 | M3 |
-| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | M3 |
-| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:51:18:51:21 | null | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:51:25:51:30 | ... is ... | Patterns.cs:50:24:50:25 | M3 |
@@ -3596,7 +3601,8 @@ nodeEnclosing
 | Patterns.cs:58:9:62:10 | return ...; | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:56:26:56:27 | M5 |
-| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:60:13:60:17 | [match] not ... | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:60:13:60:28 | ... => ... | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:60:17:60:17 | 1 | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:56:26:56:27 | M5 |
@@ -3610,7 +3616,7 @@ nodeEnclosing
 | Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:67:16:67:16 | 2 | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:65:26:65:27 | M6 |
-| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:69:17:69:17 | 2 | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:65:26:65:27 | M6 |
@@ -3628,7 +3634,8 @@ nodeEnclosing
 | PostDominance.cs:11:5:15:5 | {...} | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:12:9:13:19 | if (...) ... | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:12:13:12:13 | access to parameter s | PostDominance.cs:10:10:10:11 | M2 |
-| PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:10:10:10:11 | M2 |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:10:10:10:11 | M2 |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:12:18:12:21 | null | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:13:13:13:19 | return ...; | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:14:9:14:28 | call to method WriteLine | PostDominance.cs:10:10:10:11 | M2 |
@@ -3641,7 +3648,8 @@ nodeEnclosing
 | PostDominance.cs:18:5:22:5 | {...} | PostDominance.cs:17:10:17:11 | M3 |
 | PostDominance.cs:19:9:20:55 | if (...) ... | PostDominance.cs:17:10:17:11 | M3 |
 | PostDominance.cs:19:13:19:13 | access to parameter s | PostDominance.cs:17:10:17:11 | M3 |
-| PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:17:10:17:11 | M3 |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:17:10:17:11 | M3 |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:17:10:17:11 | M3 |
 | PostDominance.cs:19:18:19:21 | null | PostDominance.cs:17:10:17:11 | M3 |
 | PostDominance.cs:20:13:20:55 | throw ...; | PostDominance.cs:17:10:17:11 | M3 |
 | PostDominance.cs:20:19:20:54 | object creation of type ArgumentNullException | PostDominance.cs:17:10:17:11 | M3 |
@@ -4004,7 +4012,8 @@ nodeEnclosing
 | TypeAccesses.cs:6:13:6:23 | ... as ... | TypeAccesses.cs:3:10:3:10 | M |
 | TypeAccesses.cs:7:9:7:25 | if (...) ... | TypeAccesses.cs:3:10:3:10 | M |
 | TypeAccesses.cs:7:13:7:13 | access to parameter o | TypeAccesses.cs:3:10:3:10 | M |
-| TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:3:10:3:10 | M |
+| TypeAccesses.cs:7:13:7:22 | [false] ... is ... | TypeAccesses.cs:3:10:3:10 | M |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:3:10:3:10 | M |
 | TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:3:10:3:10 | M |
 | TypeAccesses.cs:7:25:7:25 | ; | TypeAccesses.cs:3:10:3:10 | M |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:3:10:3:10 | M |
@@ -5692,10 +5701,16 @@ blockEnclosing
 | NullCoalescing.cs:16:17:16:25 | ... ?? ... | NullCoalescing.cs:13:10:13:11 | M6 |
 | NullCoalescing.cs:17:13:17:24 | ... ?? ... | NullCoalescing.cs:13:10:13:11 | M6 |
 | Patterns.cs:5:10:5:11 | enter M1 | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:16:18:16:28 | [false] ... is ... | Patterns.cs:5:10:5:11 | M1 |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:17:9:18:9 | {...} | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:23:17:23:22 | break; | Patterns.cs:5:10:5:11 | M1 |
@@ -5712,25 +5727,36 @@ blockEnclosing
 | Patterns.cs:40:9:42:9 | switch (...) {...} | Patterns.cs:5:10:5:11 | M1 |
 | Patterns.cs:47:24:47:25 | enter M2 | Patterns.cs:47:24:47:25 | M2 |
 | Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:50:24:50:25 | M3 |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:51:34:51:34 | access to parameter c | Patterns.cs:50:24:50:25 | M3 |
 | Patterns.cs:53:24:53:25 | enter M4 | Patterns.cs:53:24:53:25 | M4 |
 | Patterns.cs:56:26:56:27 | enter M5 | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:60:13:60:17 | [match] not ... | Patterns.cs:56:26:56:27 | M5 |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:61:13:61:13 | _ | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:61:18:61:24 | "other" | Patterns.cs:56:26:56:27 | M5 |
 | Patterns.cs:65:26:65:27 | enter M6 | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | M6 |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | M1 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | M2 |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:10:10:10:11 | M2 |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:13:13:13:19 | return ...; | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:14:9:14:29 | ...; | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:17:10:17:11 | enter M3 | PostDominance.cs:17:10:17:11 | M3 |
 | PostDominance.cs:17:10:17:11 | exit M3 | PostDominance.cs:17:10:17:11 | M3 |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:17:10:17:11 | M3 |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:17:10:17:11 | M3 |
 | PostDominance.cs:20:45:20:53 | nameof(...) | PostDominance.cs:17:10:17:11 | M3 |
 | PostDominance.cs:21:9:21:29 | ...; | PostDominance.cs:17:10:17:11 | M3 |
 | Qualifiers.cs:7:16:7:21 | enter Method | Qualifiers.cs:7:16:7:21 | Method |
@@ -5847,6 +5873,8 @@ blockEnclosing
 | Switch.cs:158:13:158:49 | ...; | Switch.cs:154:10:154:12 | M15 |
 | Switch.cs:160:13:160:49 | ...; | Switch.cs:154:10:154:12 | M15 |
 | TypeAccesses.cs:3:10:3:10 | enter M | TypeAccesses.cs:3:10:3:10 | M |
+| TypeAccesses.cs:7:13:7:22 | [false] ... is ... | TypeAccesses.cs:3:10:3:10 | M |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:3:10:3:10 | M |
 | TypeAccesses.cs:7:25:7:25 | ; | TypeAccesses.cs:3:10:3:10 | M |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:3:10:3:10 | M |
 | VarDecls.cs:5:18:5:19 | enter M1 | VarDecls.cs:5:18:5:19 | M1 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
index c89d35533a5..384c01fc520 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
@@ -2820,7 +2820,8 @@
 | Patterns.cs:8:13:8:13 | access to local variable o | Patterns.cs:8:13:8:13 | access to local variable o | normal |
 | Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:8:13:8:23 | ... is ... | false |
 | Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:8:13:8:23 | ... is ... | true |
-| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:18:8:23 | Int32 i1 | normal |
+| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:18:8:23 | Int32 i1 | match |
+| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:18:8:23 | Int32 i1 | no-match |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:10:13:10:42 | call to method WriteLine | normal |
 | Patterns.cs:10:13:10:42 | call to method WriteLine | Patterns.cs:10:13:10:42 | call to method WriteLine | normal |
 | Patterns.cs:10:13:10:43 | ...; | Patterns.cs:10:13:10:42 | call to method WriteLine | normal |
@@ -2833,7 +2834,8 @@
 | Patterns.cs:12:18:12:18 | access to local variable o | Patterns.cs:12:18:12:18 | access to local variable o | normal |
 | Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:12:18:12:31 | ... is ... | false |
 | Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:12:18:12:31 | ... is ... | true |
-| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:23:12:31 | String s1 | normal |
+| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:23:12:31 | String s1 | match |
+| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:23:12:31 | String s1 | no-match |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:14:13:14:45 | call to method WriteLine | normal |
 | Patterns.cs:14:13:14:45 | call to method WriteLine | Patterns.cs:14:13:14:45 | call to method WriteLine | normal |
 | Patterns.cs:14:13:14:46 | ...; | Patterns.cs:14:13:14:45 | call to method WriteLine | normal |
@@ -2845,7 +2847,8 @@
 | Patterns.cs:16:18:16:18 | access to local variable o | Patterns.cs:16:18:16:18 | access to local variable o | normal |
 | Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:16:18:16:28 | ... is ... | false |
 | Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:16:18:16:28 | ... is ... | true |
-| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:23:16:28 | Object v1 | normal |
+| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:23:16:28 | Object v1 | match |
+| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:23:16:28 | Object v1 | no-match |
 | Patterns.cs:17:9:18:9 | {...} | Patterns.cs:17:9:18:9 | {...} | normal |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:23:17:23:22 | break; | normal [break] (0) |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:26:17:26:22 | break; | normal [break] (0) |
@@ -2914,8 +2917,10 @@
 | Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:9:51:21 | ... is ... | false |
 | Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:9:51:21 | ... is ... | true |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:51:9:51:39 | ... ? ... : ... | normal |
-| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:14:51:21 | not ... | normal |
-| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:18:51:21 | null | normal |
+| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:14:51:21 | not ... | match |
+| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:14:51:21 | not ... | no-match |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:18:51:21 | null | match |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:18:51:21 | null | no-match |
 | Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:25:51:25 | access to parameter c | normal |
 | Patterns.cs:51:25:51:30 | ... is ... | Patterns.cs:51:25:51:30 | ... is ... | normal |
 | Patterns.cs:51:30:51:30 | 1 | Patterns.cs:51:30:51:30 | 1 | normal |
@@ -2936,7 +2941,8 @@
 | Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:13:60:17 | not ... | match |
 | Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:13:60:17 | not ... | no-match |
 | Patterns.cs:60:13:60:28 | ... => ... | Patterns.cs:60:13:60:28 | ... => ... | normal |
-| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:17:60:17 | 1 | normal |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:17:60:17 | 1 | match |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:17:60:17 | 1 | no-match |
 | Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:22:60:28 | "not 1" | normal |
 | Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:13:61:13 | _ | match |
 | Patterns.cs:61:13:61:24 | ... => ... | Patterns.cs:61:13:61:24 | ... => ... | normal |
@@ -2945,9 +2951,10 @@
 | Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:67:9:71:10 | return ...; | return |
 | Patterns.cs:67:16:67:16 | 2 | Patterns.cs:67:16:67:16 | 2 | normal |
 | Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:67:16:71:9 | ... switch { ... } | normal |
+| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:69:13:69:17 | not ... | match |
 | Patterns.cs:69:13:69:17 | not ... | Patterns.cs:69:13:69:17 | not ... | no-match |
 | Patterns.cs:69:13:69:33 | ... => ... | Patterns.cs:69:13:69:33 | ... => ... | normal |
-| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:17:69:17 | 2 | normal |
+| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:17:69:17 | 2 | match |
 | Patterns.cs:69:22:69:33 | "impossible" | Patterns.cs:69:22:69:33 | "impossible" | normal |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 | match |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:70:13:70:27 | ... => ... | normal |
@@ -2963,7 +2970,8 @@
 | PostDominance.cs:12:13:12:13 | access to parameter s | PostDominance.cs:12:13:12:13 | access to parameter s | normal |
 | PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:12:13:12:21 | ... is ... | false |
 | PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:12:13:12:21 | ... is ... | true |
-| PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:18:12:21 | null | normal |
+| PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:18:12:21 | null | match |
+| PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:18:12:21 | null | no-match |
 | PostDominance.cs:13:13:13:19 | return ...; | PostDominance.cs:13:13:13:19 | return ...; | return |
 | PostDominance.cs:14:9:14:28 | call to method WriteLine | PostDominance.cs:14:9:14:28 | call to method WriteLine | normal |
 | PostDominance.cs:14:9:14:29 | ...; | PostDominance.cs:14:9:14:28 | call to method WriteLine | normal |
@@ -2975,7 +2983,8 @@
 | PostDominance.cs:19:13:19:13 | access to parameter s | PostDominance.cs:19:13:19:13 | access to parameter s | normal |
 | PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:19:13:19:21 | ... is ... | false |
 | PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:19:13:19:21 | ... is ... | true |
-| PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:18:19:21 | null | normal |
+| PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:18:19:21 | null | match |
+| PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:18:19:21 | null | no-match |
 | PostDominance.cs:20:13:20:55 | throw ...; | PostDominance.cs:20:13:20:55 | throw ...; | throw(ArgumentNullException) |
 | PostDominance.cs:20:19:20:54 | object creation of type ArgumentNullException | PostDominance.cs:20:19:20:54 | object creation of type ArgumentNullException | normal |
 | PostDominance.cs:20:45:20:53 | nameof(...) | PostDominance.cs:20:45:20:53 | nameof(...) | normal |
@@ -3412,7 +3421,8 @@
 | TypeAccesses.cs:7:13:7:13 | access to parameter o | TypeAccesses.cs:7:13:7:13 | access to parameter o | normal |
 | TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:7:13:7:22 | ... is ... | false |
 | TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:7:13:7:22 | ... is ... | true |
-| TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:18:7:22 | Int32 j | normal |
+| TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:18:7:22 | Int32 j | match |
+| TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:18:7:22 | Int32 j | no-match |
 | TypeAccesses.cs:7:25:7:25 | ; | TypeAccesses.cs:7:25:7:25 | ; | normal |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:8:13:8:27 | Type t = ... | normal |
 | TypeAccesses.cs:8:13:8:27 | Type t = ... | TypeAccesses.cs:8:13:8:27 | Type t = ... | normal |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
index af80244b25f..253885b6e1d 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
@@ -3518,9 +3518,10 @@
 | Patterns.cs:7:20:7:23 | null | Patterns.cs:7:16:7:23 | Object o = ... | semmle.label | successor |
 | Patterns.cs:8:9:18:9 | if (...) ... | Patterns.cs:8:13:8:13 | access to local variable o | semmle.label | successor |
 | Patterns.cs:8:13:8:13 | access to local variable o | Patterns.cs:8:18:8:23 | Int32 i1 | semmle.label | successor |
-| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:9:9:11:9 | {...} | semmle.label | true |
-| Patterns.cs:8:13:8:23 | ... is ... | Patterns.cs:12:14:18:9 | if (...) ... | semmle.label | false |
-| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:13:8:23 | ... is ... | semmle.label | successor |
+| Patterns.cs:8:13:8:23 | [false] ... is ... | Patterns.cs:12:14:18:9 | if (...) ... | semmle.label | false |
+| Patterns.cs:8:13:8:23 | [true] ... is ... | Patterns.cs:9:9:11:9 | {...} | semmle.label | true |
+| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:13:8:23 | [false] ... is ... | semmle.label | no-match |
+| Patterns.cs:8:18:8:23 | Int32 i1 | Patterns.cs:8:13:8:23 | [true] ... is ... | semmle.label | match |
 | Patterns.cs:9:9:11:9 | {...} | Patterns.cs:10:13:10:43 | ...; | semmle.label | successor |
 | Patterns.cs:10:13:10:42 | call to method WriteLine | Patterns.cs:20:9:38:9 | switch (...) {...} | semmle.label | successor |
 | Patterns.cs:10:13:10:43 | ...; | Patterns.cs:10:33:10:36 | "int " | semmle.label | successor |
@@ -3529,9 +3530,10 @@
 | Patterns.cs:10:38:10:39 | access to local variable i1 | Patterns.cs:10:31:10:41 | $"..." | semmle.label | successor |
 | Patterns.cs:12:14:18:9 | if (...) ... | Patterns.cs:12:18:12:18 | access to local variable o | semmle.label | successor |
 | Patterns.cs:12:18:12:18 | access to local variable o | Patterns.cs:12:23:12:31 | String s1 | semmle.label | successor |
-| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:13:9:15:9 | {...} | semmle.label | true |
-| Patterns.cs:12:18:12:31 | ... is ... | Patterns.cs:16:14:18:9 | if (...) ... | semmle.label | false |
-| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:18:12:31 | ... is ... | semmle.label | successor |
+| Patterns.cs:12:18:12:31 | [false] ... is ... | Patterns.cs:16:14:18:9 | if (...) ... | semmle.label | false |
+| Patterns.cs:12:18:12:31 | [true] ... is ... | Patterns.cs:13:9:15:9 | {...} | semmle.label | true |
+| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:18:12:31 | [false] ... is ... | semmle.label | no-match |
+| Patterns.cs:12:23:12:31 | String s1 | Patterns.cs:12:18:12:31 | [true] ... is ... | semmle.label | match |
 | Patterns.cs:13:9:15:9 | {...} | Patterns.cs:14:13:14:46 | ...; | semmle.label | successor |
 | Patterns.cs:14:13:14:45 | call to method WriteLine | Patterns.cs:20:9:38:9 | switch (...) {...} | semmle.label | successor |
 | Patterns.cs:14:13:14:46 | ...; | Patterns.cs:14:33:14:39 | "string " | semmle.label | successor |
@@ -3540,9 +3542,10 @@
 | Patterns.cs:14:41:14:42 | access to local variable s1 | Patterns.cs:14:31:14:44 | $"..." | semmle.label | successor |
 | Patterns.cs:16:14:18:9 | if (...) ... | Patterns.cs:16:18:16:18 | access to local variable o | semmle.label | successor |
 | Patterns.cs:16:18:16:18 | access to local variable o | Patterns.cs:16:23:16:28 | Object v1 | semmle.label | successor |
-| Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:17:9:18:9 | {...} | semmle.label | true |
-| Patterns.cs:16:18:16:28 | ... is ... | Patterns.cs:20:9:38:9 | switch (...) {...} | semmle.label | false |
-| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:18:16:28 | ... is ... | semmle.label | successor |
+| Patterns.cs:16:18:16:28 | [false] ... is ... | Patterns.cs:20:9:38:9 | switch (...) {...} | semmle.label | false |
+| Patterns.cs:16:18:16:28 | [true] ... is ... | Patterns.cs:17:9:18:9 | {...} | semmle.label | true |
+| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:18:16:28 | [false] ... is ... | semmle.label | no-match |
+| Patterns.cs:16:23:16:28 | Object v1 | Patterns.cs:16:18:16:28 | [true] ... is ... | semmle.label | match |
 | Patterns.cs:17:9:18:9 | {...} | Patterns.cs:20:9:38:9 | switch (...) {...} | semmle.label | successor |
 | Patterns.cs:20:9:38:9 | switch (...) {...} | Patterns.cs:20:17:20:17 | access to local variable o | semmle.label | successor |
 | Patterns.cs:20:17:20:17 | access to local variable o | Patterns.cs:22:13:22:23 | case ...: | semmle.label | successor |
@@ -3601,11 +3604,13 @@
 | Patterns.cs:50:24:50:25 | enter M3 | Patterns.cs:51:9:51:9 | access to parameter c | semmle.label | successor |
 | Patterns.cs:50:24:50:25 | exit M3 (normal) | Patterns.cs:50:24:50:25 | exit M3 | semmle.label | successor |
 | Patterns.cs:51:9:51:9 | access to parameter c | Patterns.cs:51:18:51:21 | null | semmle.label | successor |
-| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:25:51:25 | access to parameter c | semmle.label | true |
-| Patterns.cs:51:9:51:21 | ... is ... | Patterns.cs:51:34:51:34 | access to parameter c | semmle.label | false |
+| Patterns.cs:51:9:51:21 | [false] ... is ... | Patterns.cs:51:34:51:34 | access to parameter c | semmle.label | false |
+| Patterns.cs:51:9:51:21 | [true] ... is ... | Patterns.cs:51:25:51:25 | access to parameter c | semmle.label | true |
 | Patterns.cs:51:9:51:39 | ... ? ... : ... | Patterns.cs:50:24:50:25 | exit M3 (normal) | semmle.label | successor |
-| Patterns.cs:51:14:51:21 | not ... | Patterns.cs:51:9:51:21 | ... is ... | semmle.label | successor |
-| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:14:51:21 | not ... | semmle.label | successor |
+| Patterns.cs:51:14:51:21 | [match] not ... | Patterns.cs:51:9:51:21 | [true] ... is ... | semmle.label | match |
+| Patterns.cs:51:14:51:21 | [no-match] not ... | Patterns.cs:51:9:51:21 | [false] ... is ... | semmle.label | no-match |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:14:51:21 | [match] not ... | semmle.label | no-match |
+| Patterns.cs:51:18:51:21 | null | Patterns.cs:51:14:51:21 | [no-match] not ... | semmle.label | match |
 | Patterns.cs:51:25:51:25 | access to parameter c | Patterns.cs:51:30:51:30 | 1 | semmle.label | successor |
 | Patterns.cs:51:25:51:30 | ... is ... | Patterns.cs:51:9:51:39 | ... ? ... : ... | semmle.label | successor |
 | Patterns.cs:51:30:51:30 | 1 | Patterns.cs:51:25:51:30 | ... is ... | semmle.label | successor |
@@ -3627,10 +3632,11 @@
 | Patterns.cs:58:9:62:10 | return ...; | Patterns.cs:56:26:56:27 | exit M5 (normal) | semmle.label | return |
 | Patterns.cs:58:16:58:16 | access to parameter i | Patterns.cs:60:17:60:17 | 1 | semmle.label | successor |
 | Patterns.cs:58:16:62:9 | ... switch { ... } | Patterns.cs:58:9:62:10 | return ...; | semmle.label | successor |
-| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:60:22:60:28 | "not 1" | semmle.label | match |
-| Patterns.cs:60:13:60:17 | not ... | Patterns.cs:61:13:61:13 | _ | semmle.label | no-match |
+| Patterns.cs:60:13:60:17 | [match] not ... | Patterns.cs:60:22:60:28 | "not 1" | semmle.label | match |
+| Patterns.cs:60:13:60:17 | [no-match] not ... | Patterns.cs:61:13:61:13 | _ | semmle.label | no-match |
 | Patterns.cs:60:13:60:28 | ... => ... | Patterns.cs:58:16:62:9 | ... switch { ... } | semmle.label | successor |
-| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:13:60:17 | not ... | semmle.label | successor |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:13:60:17 | [match] not ... | semmle.label | no-match |
+| Patterns.cs:60:17:60:17 | 1 | Patterns.cs:60:13:60:17 | [no-match] not ... | semmle.label | match |
 | Patterns.cs:60:22:60:28 | "not 1" | Patterns.cs:60:13:60:28 | ... => ... | semmle.label | successor |
 | Patterns.cs:61:13:61:13 | _ | Patterns.cs:61:18:61:24 | "other" | semmle.label | match |
 | Patterns.cs:61:13:61:24 | ... => ... | Patterns.cs:58:16:62:9 | ... switch { ... } | semmle.label | successor |
@@ -3641,8 +3647,8 @@
 | Patterns.cs:67:9:71:10 | return ...; | Patterns.cs:65:26:65:27 | exit M6 (normal) | semmle.label | return |
 | Patterns.cs:67:16:67:16 | 2 | Patterns.cs:69:17:69:17 | 2 | semmle.label | successor |
 | Patterns.cs:67:16:71:9 | ... switch { ... } | Patterns.cs:67:9:71:10 | return ...; | semmle.label | successor |
-| Patterns.cs:69:13:69:17 | not ... | Patterns.cs:70:13:70:13 | 2 | semmle.label | no-match |
-| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:13:69:17 | not ... | semmle.label | successor |
+| Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:70:13:70:13 | 2 | semmle.label | no-match |
+| Patterns.cs:69:17:69:17 | 2 | Patterns.cs:69:13:69:17 | [no-match] not ... | semmle.label | match |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" | semmle.label | match |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:67:16:71:9 | ... switch { ... } | semmle.label | successor |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:27 | ... => ... | semmle.label | successor |
@@ -3657,9 +3663,10 @@
 | PostDominance.cs:11:5:15:5 | {...} | PostDominance.cs:12:9:13:19 | if (...) ... | semmle.label | successor |
 | PostDominance.cs:12:9:13:19 | if (...) ... | PostDominance.cs:12:13:12:13 | access to parameter s | semmle.label | successor |
 | PostDominance.cs:12:13:12:13 | access to parameter s | PostDominance.cs:12:18:12:21 | null | semmle.label | successor |
-| PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:13:13:13:19 | return ...; | semmle.label | true |
-| PostDominance.cs:12:13:12:21 | ... is ... | PostDominance.cs:14:9:14:29 | ...; | semmle.label | false |
-| PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:13:12:21 | ... is ... | semmle.label | successor |
+| PostDominance.cs:12:13:12:21 | [false] ... is ... | PostDominance.cs:14:9:14:29 | ...; | semmle.label | false |
+| PostDominance.cs:12:13:12:21 | [true] ... is ... | PostDominance.cs:13:13:13:19 | return ...; | semmle.label | true |
+| PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:13:12:21 | [false] ... is ... | semmle.label | no-match |
+| PostDominance.cs:12:18:12:21 | null | PostDominance.cs:12:13:12:21 | [true] ... is ... | semmle.label | match |
 | PostDominance.cs:13:13:13:19 | return ...; | PostDominance.cs:10:10:10:11 | exit M2 (normal) | semmle.label | return |
 | PostDominance.cs:14:9:14:28 | call to method WriteLine | PostDominance.cs:10:10:10:11 | exit M2 (normal) | semmle.label | successor |
 | PostDominance.cs:14:9:14:29 | ...; | PostDominance.cs:14:27:14:27 | access to parameter s | semmle.label | successor |
@@ -3670,9 +3677,10 @@
 | PostDominance.cs:18:5:22:5 | {...} | PostDominance.cs:19:9:20:55 | if (...) ... | semmle.label | successor |
 | PostDominance.cs:19:9:20:55 | if (...) ... | PostDominance.cs:19:13:19:13 | access to parameter s | semmle.label | successor |
 | PostDominance.cs:19:13:19:13 | access to parameter s | PostDominance.cs:19:18:19:21 | null | semmle.label | successor |
-| PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:20:45:20:53 | nameof(...) | semmle.label | true |
-| PostDominance.cs:19:13:19:21 | ... is ... | PostDominance.cs:21:9:21:29 | ...; | semmle.label | false |
-| PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:13:19:21 | ... is ... | semmle.label | successor |
+| PostDominance.cs:19:13:19:21 | [false] ... is ... | PostDominance.cs:21:9:21:29 | ...; | semmle.label | false |
+| PostDominance.cs:19:13:19:21 | [true] ... is ... | PostDominance.cs:20:45:20:53 | nameof(...) | semmle.label | true |
+| PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:13:19:21 | [false] ... is ... | semmle.label | no-match |
+| PostDominance.cs:19:18:19:21 | null | PostDominance.cs:19:13:19:21 | [true] ... is ... | semmle.label | match |
 | PostDominance.cs:20:13:20:55 | throw ...; | PostDominance.cs:17:10:17:11 | exit M3 (abnormal) | semmle.label | exception(ArgumentNullException) |
 | PostDominance.cs:20:19:20:54 | object creation of type ArgumentNullException | PostDominance.cs:20:13:20:55 | throw ...; | semmle.label | successor |
 | PostDominance.cs:20:45:20:53 | nameof(...) | PostDominance.cs:20:19:20:54 | object creation of type ArgumentNullException | semmle.label | successor |
@@ -4049,9 +4057,10 @@
 | TypeAccesses.cs:6:13:6:23 | ... as ... | TypeAccesses.cs:6:9:6:23 | ... = ... | semmle.label | successor |
 | TypeAccesses.cs:7:9:7:25 | if (...) ... | TypeAccesses.cs:7:13:7:13 | access to parameter o | semmle.label | successor |
 | TypeAccesses.cs:7:13:7:13 | access to parameter o | TypeAccesses.cs:7:18:7:22 | Int32 j | semmle.label | successor |
-| TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:7:25:7:25 | ; | semmle.label | true |
-| TypeAccesses.cs:7:13:7:22 | ... is ... | TypeAccesses.cs:8:9:8:28 | ... ...; | semmle.label | false |
-| TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:13:7:22 | ... is ... | semmle.label | successor |
+| TypeAccesses.cs:7:13:7:22 | [false] ... is ... | TypeAccesses.cs:8:9:8:28 | ... ...; | semmle.label | false |
+| TypeAccesses.cs:7:13:7:22 | [true] ... is ... | TypeAccesses.cs:7:25:7:25 | ; | semmle.label | true |
+| TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:13:7:22 | [false] ... is ... | semmle.label | no-match |
+| TypeAccesses.cs:7:18:7:22 | Int32 j | TypeAccesses.cs:7:13:7:22 | [true] ... is ... | semmle.label | match |
 | TypeAccesses.cs:7:25:7:25 | ; | TypeAccesses.cs:8:9:8:28 | ... ...; | semmle.label | successor |
 | TypeAccesses.cs:8:9:8:28 | ... ...; | TypeAccesses.cs:8:17:8:27 | typeof(...) | semmle.label | successor |
 | TypeAccesses.cs:8:13:8:27 | Type t = ... | TypeAccesses.cs:3:10:3:10 | exit M (normal) | semmle.label | successor |
diff --git a/csharp/ql/test/library-tests/csharp7/IsFlow.expected b/csharp/ql/test/library-tests/csharp7/IsFlow.expected
index f61853bd4de..18b1fa2615f 100644
--- a/csharp/ql/test/library-tests/csharp7/IsFlow.expected
+++ b/csharp/ql/test/library-tests/csharp7/IsFlow.expected
@@ -16,9 +16,10 @@
 | CSharp7.cs:256:18:256:20 | "x" | CSharp7.cs:256:27:256:27 | access to local variable o | semmle.label | match |
 | CSharp7.cs:256:18:256:20 | "x" | CSharp7.cs:259:13:259:36 | case ...: | semmle.label | no-match |
 | CSharp7.cs:256:27:256:27 | access to local variable o | CSharp7.cs:256:32:256:40 | String s4 | semmle.label | successor |
-| CSharp7.cs:256:27:256:40 | ... is ... | CSharp7.cs:257:17:257:45 | ...; | semmle.label | true |
-| CSharp7.cs:256:27:256:40 | ... is ... | CSharp7.cs:259:13:259:36 | case ...: | semmle.label | false |
-| CSharp7.cs:256:32:256:40 | String s4 | CSharp7.cs:256:27:256:40 | ... is ... | semmle.label | successor |
+| CSharp7.cs:256:27:256:40 | [false] ... is ... | CSharp7.cs:259:13:259:36 | case ...: | semmle.label | false |
+| CSharp7.cs:256:27:256:40 | [true] ... is ... | CSharp7.cs:257:17:257:45 | ...; | semmle.label | true |
+| CSharp7.cs:256:32:256:40 | String s4 | CSharp7.cs:256:27:256:40 | [false] ... is ... | semmle.label | no-match |
+| CSharp7.cs:256:32:256:40 | String s4 | CSharp7.cs:256:27:256:40 | [true] ... is ... | semmle.label | match |
 | CSharp7.cs:257:17:257:44 | call to method WriteLine | CSharp7.cs:258:17:258:22 | break; | semmle.label | successor |
 | CSharp7.cs:257:17:257:45 | ...; | CSharp7.cs:257:37:257:38 | "x " | semmle.label | successor |
 | CSharp7.cs:257:35:257:43 | $"..." | CSharp7.cs:257:17:257:44 | call to method WriteLine | semmle.label | successor |
diff --git a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
index fc00d4e05e9..ef6b14f1eee 100644
--- a/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
+++ b/csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
@@ -193,8 +193,9 @@
 | CSharp7.cs:235:13:235:13 | access to local variable o | CSharp7.cs:235:18:235:23 | SSA def(i1) |
 | CSharp7.cs:235:13:235:13 | access to local variable o | CSharp7.cs:239:18:239:18 | access to local variable o |
 | CSharp7.cs:235:13:235:13 | access to local variable o | CSharp7.cs:250:17:250:17 | access to local variable o |
-| CSharp7.cs:235:13:235:23 | ... is ... | CSharp7.cs:235:13:235:33 | [false] ... && ... |
-| CSharp7.cs:235:13:235:23 | ... is ... | CSharp7.cs:235:13:235:33 | [true] ... && ... |
+| CSharp7.cs:235:13:235:23 | [false] ... is ... | CSharp7.cs:235:13:235:33 | [false] ... && ... |
+| CSharp7.cs:235:13:235:23 | [true] ... is ... | CSharp7.cs:235:13:235:33 | [false] ... && ... |
+| CSharp7.cs:235:13:235:23 | [true] ... is ... | CSharp7.cs:235:13:235:33 | [true] ... && ... |
 | CSharp7.cs:235:18:235:23 | SSA def(i1) | CSharp7.cs:235:28:235:29 | access to local variable i1 |
 | CSharp7.cs:235:28:235:29 | access to local variable i1 | CSharp7.cs:235:28:235:33 | ... > ... |
 | CSharp7.cs:235:28:235:29 | access to local variable i1 | CSharp7.cs:237:38:237:39 | access to local variable i1 |
@@ -251,7 +252,7 @@
 | CSharp7.cs:299:25:299:30 | ... < ... | CSharp7.cs:299:25:299:44 | [true] ... && ... |
 | CSharp7.cs:299:35:299:35 | access to local variable x | CSharp7.cs:299:40:299:44 | SSA def(y) |
 | CSharp7.cs:299:35:299:35 | access to local variable x | CSharp7.cs:299:49:299:49 | access to local variable x |
-| CSharp7.cs:299:35:299:44 | ... is ... | CSharp7.cs:299:25:299:44 | [false] ... && ... |
-| CSharp7.cs:299:35:299:44 | ... is ... | CSharp7.cs:299:25:299:44 | [true] ... && ... |
+| CSharp7.cs:299:35:299:44 | [false] ... is ... | CSharp7.cs:299:25:299:44 | [false] ... && ... |
+| CSharp7.cs:299:35:299:44 | [true] ... is ... | CSharp7.cs:299:25:299:44 | [true] ... && ... |
 | CSharp7.cs:299:40:299:44 | SSA def(y) | CSharp7.cs:301:31:301:31 | access to local variable y |
 | CSharp7.cs:299:47:299:49 | SSA def(x) | CSharp7.cs:299:25:299:25 | SSA phi(x) |
diff --git a/csharp/ql/test/library-tests/csharp8/ispatternflow.expected b/csharp/ql/test/library-tests/csharp8/ispatternflow.expected
index 31e52472bde..4c172af48c4 100644
--- a/csharp/ql/test/library-tests/csharp8/ispatternflow.expected
+++ b/csharp/ql/test/library-tests/csharp8/ispatternflow.expected
@@ -10,20 +10,22 @@
 | patterns.cs:7:39:7:39 | 2 | patterns.cs:7:35:7:39 | ... = ... | semmle.label | successor |
 | patterns.cs:9:9:11:9 | if (...) ... | patterns.cs:9:13:9:13 | access to local variable o | semmle.label | successor |
 | patterns.cs:9:13:9:13 | access to local variable o | patterns.cs:9:18:9:29 | MyStruct ms1 | semmle.label | successor |
-| patterns.cs:9:13:9:29 | ... is ... | patterns.cs:10:9:11:9 | {...} | semmle.label | true |
-| patterns.cs:9:13:9:29 | ... is ... | patterns.cs:13:9:15:9 | if (...) ... | semmle.label | false |
-| patterns.cs:9:18:9:29 | MyStruct ms1 | patterns.cs:9:13:9:29 | ... is ... | semmle.label | successor |
+| patterns.cs:9:13:9:29 | [false] ... is ... | patterns.cs:13:9:15:9 | if (...) ... | semmle.label | false |
+| patterns.cs:9:13:9:29 | [true] ... is ... | patterns.cs:10:9:11:9 | {...} | semmle.label | true |
+| patterns.cs:9:18:9:29 | MyStruct ms1 | patterns.cs:9:13:9:29 | [false] ... is ... | semmle.label | no-match |
+| patterns.cs:9:18:9:29 | MyStruct ms1 | patterns.cs:9:13:9:29 | [true] ... is ... | semmle.label | match |
 | patterns.cs:10:9:11:9 | {...} | patterns.cs:13:9:15:9 | if (...) ... | semmle.label | successor |
 | patterns.cs:13:9:15:9 | if (...) ... | patterns.cs:13:13:13:13 | access to local variable o | semmle.label | successor |
 | patterns.cs:13:13:13:13 | access to local variable o | patterns.cs:13:18:13:40 | MyStruct s | semmle.label | successor |
-| patterns.cs:13:13:13:40 | ... is ... | patterns.cs:13:13:13:47 | [false] ... && ... | semmle.label | false |
-| patterns.cs:13:13:13:40 | ... is ... | patterns.cs:13:45:13:45 | access to local variable x | semmle.label | true |
+| patterns.cs:13:13:13:40 | [false] ... is ... | patterns.cs:13:13:13:47 | [false] ... && ... | semmle.label | false |
+| patterns.cs:13:13:13:40 | [true] ... is ... | patterns.cs:13:45:13:45 | access to local variable x | semmle.label | true |
 | patterns.cs:13:13:13:47 | [false] ... && ... | patterns.cs:13:13:13:56 | [false] ... && ... | semmle.label | false |
 | patterns.cs:13:13:13:47 | [true] ... && ... | patterns.cs:13:52:13:52 | access to local variable s | semmle.label | true |
 | patterns.cs:13:13:13:56 | [false] ... && ... | patterns.cs:17:9:19:9 | if (...) ... | semmle.label | false |
 | patterns.cs:13:13:13:56 | [true] ... && ... | patterns.cs:14:9:15:9 | {...} | semmle.label | true |
 | patterns.cs:13:18:13:40 | MyStruct s | patterns.cs:13:32:13:36 | Int32 x | semmle.label | successor |
-| patterns.cs:13:18:13:40 | { ... } | patterns.cs:13:13:13:40 | ... is ... | semmle.label | successor |
+| patterns.cs:13:18:13:40 | { ... } | patterns.cs:13:13:13:40 | [false] ... is ... | semmle.label | no-match |
+| patterns.cs:13:18:13:40 | { ... } | patterns.cs:13:13:13:40 | [true] ... is ... | semmle.label | match |
 | patterns.cs:13:27:13:38 | { ... } | patterns.cs:13:18:13:40 | { ... } | semmle.label | successor |
 | patterns.cs:13:32:13:36 | Int32 x | patterns.cs:13:27:13:38 | { ... } | semmle.label | successor |
 | patterns.cs:13:45:13:45 | access to local variable x | patterns.cs:13:47:13:47 | 4 | semmle.label | successor |
@@ -38,17 +40,19 @@
 | patterns.cs:14:9:15:9 | {...} | patterns.cs:17:9:19:9 | if (...) ... | semmle.label | successor |
 | patterns.cs:17:9:19:9 | if (...) ... | patterns.cs:17:13:17:13 | access to local variable o | semmle.label | successor |
 | patterns.cs:17:13:17:13 | access to local variable o | patterns.cs:17:18:17:21 | Object p | semmle.label | successor |
-| patterns.cs:17:13:17:21 | ... is ... | patterns.cs:18:9:19:9 | {...} | semmle.label | true |
-| patterns.cs:17:13:17:21 | ... is ... | patterns.cs:22:9:24:9 | if (...) ... | semmle.label | false |
+| patterns.cs:17:13:17:21 | [false] ... is ... | patterns.cs:22:9:24:9 | if (...) ... | semmle.label | false |
+| patterns.cs:17:13:17:21 | [true] ... is ... | patterns.cs:18:9:19:9 | {...} | semmle.label | true |
 | patterns.cs:17:18:17:19 | { ... } | patterns.cs:17:18:17:21 | { ... } | semmle.label | successor |
 | patterns.cs:17:18:17:21 | Object p | patterns.cs:17:18:17:19 | { ... } | semmle.label | successor |
-| patterns.cs:17:18:17:21 | { ... } | patterns.cs:17:13:17:21 | ... is ... | semmle.label | successor |
+| patterns.cs:17:18:17:21 | { ... } | patterns.cs:17:13:17:21 | [false] ... is ... | semmle.label | no-match |
+| patterns.cs:17:18:17:21 | { ... } | patterns.cs:17:13:17:21 | [true] ... is ... | semmle.label | match |
 | patterns.cs:18:9:19:9 | {...} | patterns.cs:22:9:24:9 | if (...) ... | semmle.label | successor |
 | patterns.cs:22:9:24:9 | if (...) ... | patterns.cs:22:13:22:13 | access to local variable o | semmle.label | successor |
 | patterns.cs:22:13:22:13 | access to local variable o | patterns.cs:22:31:22:32 | 12 | semmle.label | successor |
-| patterns.cs:22:13:22:53 | ... is ... | patterns.cs:23:9:24:9 | {...} | semmle.label | true |
-| patterns.cs:22:13:22:53 | ... is ... | patterns.cs:27:9:29:9 | if (...) ... | semmle.label | false |
-| patterns.cs:22:18:22:53 | { ... } | patterns.cs:22:13:22:53 | ... is ... | semmle.label | successor |
+| patterns.cs:22:13:22:53 | [false] ... is ... | patterns.cs:27:9:29:9 | if (...) ... | semmle.label | false |
+| patterns.cs:22:13:22:53 | [true] ... is ... | patterns.cs:23:9:24:9 | {...} | semmle.label | true |
+| patterns.cs:22:18:22:53 | { ... } | patterns.cs:22:13:22:53 | [false] ... is ... | semmle.label | no-match |
+| patterns.cs:22:18:22:53 | { ... } | patterns.cs:22:13:22:53 | [true] ... is ... | semmle.label | match |
 | patterns.cs:22:27:22:53 | { ... } | patterns.cs:22:18:22:53 | { ... } | semmle.label | successor |
 | patterns.cs:22:31:22:32 | 12 | patterns.cs:22:42:22:49 | Int32 subX | semmle.label | successor |
 | patterns.cs:22:38:22:51 | { ... } | patterns.cs:22:27:22:53 | { ... } | semmle.label | successor |
@@ -57,9 +61,10 @@
 | patterns.cs:23:9:24:9 | {...} | patterns.cs:27:9:29:9 | if (...) ... | semmle.label | successor |
 | patterns.cs:27:9:29:9 | if (...) ... | patterns.cs:27:13:27:13 | access to local variable o | semmle.label | successor |
 | patterns.cs:27:13:27:13 | access to local variable o | patterns.cs:27:31:27:32 | 12 | semmle.label | successor |
-| patterns.cs:27:13:27:58 | ... is ... | patterns.cs:5:10:5:19 | exit IsPatterns (normal) | semmle.label | false |
-| patterns.cs:27:13:27:58 | ... is ... | patterns.cs:28:9:29:9 | {...} | semmle.label | true |
-| patterns.cs:27:18:27:58 | { ... } | patterns.cs:27:13:27:58 | ... is ... | semmle.label | successor |
+| patterns.cs:27:13:27:58 | [false] ... is ... | patterns.cs:5:10:5:19 | exit IsPatterns (normal) | semmle.label | false |
+| patterns.cs:27:13:27:58 | [true] ... is ... | patterns.cs:28:9:29:9 | {...} | semmle.label | true |
+| patterns.cs:27:18:27:58 | { ... } | patterns.cs:27:13:27:58 | [false] ... is ... | semmle.label | no-match |
+| patterns.cs:27:18:27:58 | { ... } | patterns.cs:27:13:27:58 | [true] ... is ... | semmle.label | match |
 | patterns.cs:27:27:27:58 | { ... } | patterns.cs:27:18:27:58 | { ... } | semmle.label | successor |
 | patterns.cs:27:31:27:32 | 12 | patterns.cs:27:38:27:56 | MyStruct ms | semmle.label | successor |
 | patterns.cs:27:38:27:56 | MyStruct ms | patterns.cs:27:51:27:51 | _ | semmle.label | successor |
diff --git a/csharp/ql/test/library-tests/csharp8/switchexprcontrolflow.expected b/csharp/ql/test/library-tests/csharp8/switchexprcontrolflow.expected
index 53132fa80cf..d54bffc9f4c 100644
--- a/csharp/ql/test/library-tests/csharp8/switchexprcontrolflow.expected
+++ b/csharp/ql/test/library-tests/csharp8/switchexprcontrolflow.expected
@@ -146,9 +146,10 @@
 | patterns.cs:140:17:140:24 | Object y | patterns.cs:141:17:141:22 | access to type String | semmle.label | no-match |
 | patterns.cs:140:17:140:42 | ... => ... | patterns.cs:136:17:143:13 | ... switch { ... } | semmle.label | successor |
 | patterns.cs:140:31:140:31 | access to local variable y | patterns.cs:140:36:140:37 | { ... } | semmle.label | successor |
-| patterns.cs:140:31:140:37 | ... is ... | patterns.cs:140:42:140:42 | 4 | semmle.label | true |
-| patterns.cs:140:31:140:37 | ... is ... | patterns.cs:141:17:141:22 | access to type String | semmle.label | false |
-| patterns.cs:140:36:140:37 | { ... } | patterns.cs:140:31:140:37 | ... is ... | semmle.label | successor |
+| patterns.cs:140:31:140:37 | [false] ... is ... | patterns.cs:141:17:141:22 | access to type String | semmle.label | false |
+| patterns.cs:140:31:140:37 | [true] ... is ... | patterns.cs:140:42:140:42 | 4 | semmle.label | true |
+| patterns.cs:140:36:140:37 | { ... } | patterns.cs:140:31:140:37 | [false] ... is ... | semmle.label | no-match |
+| patterns.cs:140:36:140:37 | { ... } | patterns.cs:140:31:140:37 | [true] ... is ... | semmle.label | match |
 | patterns.cs:140:36:140:37 | { ... } | patterns.cs:140:36:140:37 | { ... } | semmle.label | successor |
 | patterns.cs:140:42:140:42 | 4 | patterns.cs:140:17:140:42 | ... => ... | semmle.label | successor |
 | patterns.cs:141:17:141:22 | access to type String | patterns.cs:141:29:141:29 | 5 | semmle.label | match |
diff --git a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
index a93069cf7e4..fc6cb442cb0 100644
--- a/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
+++ b/csharp/ql/test/query-tests/Nullness/NullMaybe.expected
@@ -191,6 +191,7 @@ nodes
 | D.cs:253:13:253:14 | access to local variable o2 |
 | D.cs:258:16:258:23 | SSA def(o) |
 | D.cs:266:9:267:25 | if (...) ... |
+| D.cs:266:13:266:27 | [true] ... is ... |
 | D.cs:267:13:267:13 | access to local variable o |
 | D.cs:269:9:269:16 | SSA def(o) |
 | D.cs:272:25:272:25 | access to local variable i |
@@ -345,6 +346,7 @@ nodes
 | E.cs:201:13:201:13 | access to local variable o |
 | E.cs:203:13:203:13 | access to local variable o |
 | E.cs:206:28:206:28 | SSA param(s) |
+| E.cs:208:13:208:23 | [false] ... is ... |
 | E.cs:210:16:210:16 | access to parameter s |
 | E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) |
 | E.cs:218:9:218:9 | access to local variable x |
@@ -364,6 +366,7 @@ nodes
 | E.cs:301:13:301:27 | SSA def(s) |
 | E.cs:302:9:302:9 | access to local variable s |
 | E.cs:319:29:319:30 | SSA param(s1) |
+| E.cs:321:13:321:30 | [true] ... is ... |
 | E.cs:321:14:321:21 | ... ?? ... |
 | E.cs:321:20:321:21 | access to parameter s2 |
 | E.cs:323:13:323:14 | access to parameter s1 |
@@ -597,7 +600,8 @@ edges
 | D.cs:244:9:247:25 | if (...) ... | D.cs:247:13:247:13 | access to local variable o |
 | D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 |
 | D.cs:258:16:258:23 | SSA def(o) | D.cs:266:9:267:25 | if (...) ... |
-| D.cs:266:9:267:25 | if (...) ... | D.cs:267:13:267:13 | access to local variable o |
+| D.cs:266:9:267:25 | if (...) ... | D.cs:266:13:266:27 | [true] ... is ... |
+| D.cs:266:13:266:27 | [true] ... is ... | D.cs:267:13:267:13 | access to local variable o |
 | D.cs:269:9:269:16 | SSA def(o) | D.cs:272:25:272:25 | access to local variable i |
 | D.cs:272:25:272:25 | access to local variable i | D.cs:273:9:288:9 | {...} |
 | D.cs:272:25:272:25 | access to local variable i | D.cs:290:9:291:25 | if (...) ... |
@@ -744,7 +748,8 @@ edges
 | E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o |
 | E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:13:203:13 | access to local variable o |
 | E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:13:201:13 | access to local variable o |
-| E.cs:206:28:206:28 | SSA param(s) | E.cs:210:16:210:16 | access to parameter s |
+| E.cs:206:28:206:28 | SSA param(s) | E.cs:208:13:208:23 | [false] ... is ... |
+| E.cs:208:13:208:23 | [false] ... is ... | E.cs:210:16:210:16 | access to parameter s |
 | E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x |
 | E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:220:13:220:13 | access to local variable x |
 | E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:13 | access to local variable x |
@@ -756,7 +761,8 @@ edges
 | E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
 | E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s |
 | E.cs:319:29:319:30 | SSA param(s1) | E.cs:321:20:321:21 | access to parameter s2 |
-| E.cs:321:14:321:21 | ... ?? ... | E.cs:323:13:323:14 | access to parameter s1 |
+| E.cs:321:13:321:30 | [true] ... is ... | E.cs:323:13:323:14 | access to parameter s1 |
+| E.cs:321:14:321:21 | ... ?? ... | E.cs:321:13:321:30 | [true] ... is ... |
 | E.cs:321:20:321:21 | access to parameter s2 | E.cs:321:14:321:21 | ... ?? ... |
 | E.cs:330:13:330:36 | SSA def(x) | E.cs:331:9:331:9 | access to local variable x |
 | E.cs:342:13:342:32 | SSA def(x) | E.cs:343:9:343:9 | access to local variable x |

From e0c7f3228208d0b8e8f9b40b81ec397dfa7a9f3b Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 19 Jan 2021 10:40:13 +0100
Subject: [PATCH 295/343] C#: Add relational pattern CFG test

---
 .../controlflow/graph/BasicBlock.expected     |  9 +++
 .../controlflow/graph/Condition.expected      | 16 ++++
 .../controlflow/graph/Dominance.expected      | 80 +++++++++++++++++++
 .../graph/EnclosingCallable.expected          | 30 +++++++
 .../controlflow/graph/EntryElement.expected   | 18 +++++
 .../controlflow/graph/ExitElement.expected    | 21 +++++
 .../controlflow/graph/NodeGraph.expected      | 23 ++++++
 .../controlflow/graph/Nodes.expected          |  1 +
 .../controlflow/graph/Patterns.cs             | 11 +++
 9 files changed, 209 insertions(+)

diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
index 557f5ea4df6..2cfbf8ef3da 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
@@ -970,6 +970,15 @@
 | Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:69:13:69:17 | [no-match] not ... | 1 |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 | 1 |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | exit M6 | 6 |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:78:13:78:15 | > ... | 5 |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:74:26:74:27 | exit M7 | 4 |
+| Patterns.cs:78:20:78:24 | "> 1" | Patterns.cs:78:13:78:24 | ... => ... | 2 |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:79:13:79:15 | < ... | 2 |
+| Patterns.cs:79:20:79:24 | "< 0" | Patterns.cs:79:13:79:24 | ... => ... | 2 |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:13:80:13 | 1 | 1 |
+| Patterns.cs:80:18:80:20 | "1" | Patterns.cs:80:13:80:20 | ... => ... | 2 |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:81:13:81:13 | _ | 1 |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:81:13:81:20 | ... => ... | 2 |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | exit M1 | 7 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:18:12:21 | null | 5 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | exit M2 | 2 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
index 3f8406344b7..341f8a50b29 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
@@ -1872,6 +1872,22 @@ conditionBlock
 | Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:70:13:70:13 | 2 | false |
 | Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:70:18:70:27 | "possible" | false |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" | true |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:78:20:78:24 | "> 1" | true |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:79:15:79:15 | 0 | false |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:79:20:79:24 | "< 0" | false |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:80:13:80:13 | 1 | false |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:80:18:80:20 | "1" | false |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:81:13:81:13 | _ | false |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:81:18:81:20 | "0" | false |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:79:20:79:24 | "< 0" | true |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:80:13:80:13 | 1 | false |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:80:18:80:20 | "1" | false |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:81:13:81:13 | _ | false |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:81:18:81:20 | "0" | false |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:18:80:20 | "1" | true |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:81:13:81:13 | _ | false |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:81:18:81:20 | "0" | false |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:81:18:81:20 | "0" | true |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:13:12:21 | [false] ... is ... | false |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:12:13:12:21 | [true] ... is ... | true |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:13:13:13:19 | return ...; | true |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
index e0f56f17f5c..0e031cadabe 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
@@ -3177,6 +3177,25 @@ dominance
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:67:16:71:9 | ... switch { ... } |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:27 | ... => ... |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:75:5:83:5 | {...} |
+| Patterns.cs:74:26:74:27 | exit M7 (normal) | Patterns.cs:74:26:74:27 | exit M7 |
+| Patterns.cs:75:5:83:5 | {...} | Patterns.cs:76:16:76:16 | access to parameter i |
+| Patterns.cs:76:9:82:10 | return ...; | Patterns.cs:74:26:74:27 | exit M7 (normal) |
+| Patterns.cs:76:16:76:16 | access to parameter i | Patterns.cs:78:15:78:15 | 1 |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:76:9:82:10 | return ...; |
+| Patterns.cs:78:13:78:15 | > ... | Patterns.cs:78:20:78:24 | "> 1" |
+| Patterns.cs:78:13:78:15 | > ... | Patterns.cs:79:15:79:15 | 0 |
+| Patterns.cs:78:15:78:15 | 1 | Patterns.cs:78:13:78:15 | > ... |
+| Patterns.cs:78:20:78:24 | "> 1" | Patterns.cs:78:13:78:24 | ... => ... |
+| Patterns.cs:79:13:79:15 | < ... | Patterns.cs:79:20:79:24 | "< 0" |
+| Patterns.cs:79:13:79:15 | < ... | Patterns.cs:80:13:80:13 | 1 |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:79:13:79:15 | < ... |
+| Patterns.cs:79:20:79:24 | "< 0" | Patterns.cs:79:13:79:24 | ... => ... |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:18:80:20 | "1" |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:80:18:80:20 | "1" | Patterns.cs:80:13:80:20 | ... => ... |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:81:18:81:20 | "0" |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:81:13:81:20 | ... => ... |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:6:5:8:5 | {...} |
 | PostDominance.cs:5:10:5:11 | exit M1 (normal) | PostDominance.cs:5:10:5:11 | exit M1 |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:7:9:7:29 | ...; |
@@ -7170,6 +7189,23 @@ postDominance
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:69:13:69:17 | [no-match] not ... |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:70:18:70:27 | "possible" |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:13 | 2 |
+| Patterns.cs:74:26:74:27 | exit M7 | Patterns.cs:74:26:74:27 | exit M7 (normal) |
+| Patterns.cs:74:26:74:27 | exit M7 (normal) | Patterns.cs:76:9:82:10 | return ...; |
+| Patterns.cs:75:5:83:5 | {...} | Patterns.cs:74:26:74:27 | enter M7 |
+| Patterns.cs:76:9:82:10 | return ...; | Patterns.cs:76:16:82:9 | ... switch { ... } |
+| Patterns.cs:76:16:76:16 | access to parameter i | Patterns.cs:75:5:83:5 | {...} |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:78:13:78:24 | ... => ... |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:79:13:79:24 | ... => ... |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:80:13:80:20 | ... => ... |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:81:13:81:20 | ... => ... |
+| Patterns.cs:78:13:78:15 | > ... | Patterns.cs:78:15:78:15 | 1 |
+| Patterns.cs:78:13:78:24 | ... => ... | Patterns.cs:78:20:78:24 | "> 1" |
+| Patterns.cs:78:15:78:15 | 1 | Patterns.cs:76:16:76:16 | access to parameter i |
+| Patterns.cs:79:13:79:15 | < ... | Patterns.cs:79:15:79:15 | 0 |
+| Patterns.cs:79:13:79:24 | ... => ... | Patterns.cs:79:20:79:24 | "< 0" |
+| Patterns.cs:80:13:80:20 | ... => ... | Patterns.cs:80:18:80:20 | "1" |
+| Patterns.cs:81:13:81:20 | ... => ... | Patterns.cs:81:18:81:20 | "0" |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:81:13:81:13 | _ |
 | PostDominance.cs:5:10:5:11 | exit M1 | PostDominance.cs:5:10:5:11 | exit M1 (normal) |
 | PostDominance.cs:5:10:5:11 | exit M1 (normal) | PostDominance.cs:7:9:7:28 | call to method WriteLine |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:5:10:5:11 | enter M1 |
@@ -11682,6 +11718,32 @@ blockDominance
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:74:26:74:27 | enter M7 |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:76:16:82:9 | ... switch { ... } |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:78:20:78:24 | "> 1" |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:79:15:79:15 | 0 |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:79:20:79:24 | "< 0" |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:80:13:80:13 | 1 |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:80:18:80:20 | "1" |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:81:18:81:20 | "0" |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:76:16:82:9 | ... switch { ... } |
+| Patterns.cs:78:20:78:24 | "> 1" | Patterns.cs:78:20:78:24 | "> 1" |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:79:15:79:15 | 0 |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:79:20:79:24 | "< 0" |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:80:13:80:13 | 1 |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:80:18:80:20 | "1" |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:81:18:81:20 | "0" |
+| Patterns.cs:79:20:79:24 | "< 0" | Patterns.cs:79:20:79:24 | "< 0" |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:13:80:13 | 1 |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:18:80:20 | "1" |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:81:18:81:20 | "0" |
+| Patterns.cs:80:18:80:20 | "1" | Patterns.cs:80:18:80:20 | "1" |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:81:18:81:20 | "0" |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:81:18:81:20 | "0" |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | enter M1 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | enter M2 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | exit M2 (normal) |
@@ -15024,6 +15086,24 @@ postBlockDominance
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:69:13:69:17 | [no-match] not ... |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:13 | 2 |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:74:26:74:27 | enter M7 |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:74:26:74:27 | enter M7 |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:76:16:82:9 | ... switch { ... } |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:78:20:78:24 | "> 1" |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:79:15:79:15 | 0 |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:79:20:79:24 | "< 0" |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:80:13:80:13 | 1 |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:80:18:80:20 | "1" |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:81:18:81:20 | "0" |
+| Patterns.cs:78:20:78:24 | "> 1" | Patterns.cs:78:20:78:24 | "> 1" |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:79:15:79:15 | 0 |
+| Patterns.cs:79:20:79:24 | "< 0" | Patterns.cs:79:20:79:24 | "< 0" |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:13:80:13 | 1 |
+| Patterns.cs:80:18:80:20 | "1" | Patterns.cs:80:18:80:20 | "1" |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:81:18:81:20 | "0" |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | enter M1 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | enter M2 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | enter M2 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
index 1b5088c216e..47ca910462c 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
@@ -3621,6 +3621,27 @@ nodeEnclosing
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:74:26:74:27 | exit M7 | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:74:26:74:27 | exit M7 (normal) | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:75:5:83:5 | {...} | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:76:9:82:10 | return ...; | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:76:16:76:16 | access to parameter i | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:78:13:78:15 | > ... | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:78:13:78:24 | ... => ... | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:78:15:78:15 | 1 | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:78:20:78:24 | "> 1" | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:79:13:79:15 | < ... | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:79:13:79:24 | ... => ... | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:79:20:79:24 | "< 0" | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:80:13:80:20 | ... => ... | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:80:18:80:20 | "1" | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:81:13:81:20 | ... => ... | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:74:26:74:27 | M7 |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | M1 |
 | PostDominance.cs:5:10:5:11 | exit M1 | PostDominance.cs:5:10:5:11 | M1 |
 | PostDominance.cs:5:10:5:11 | exit M1 (normal) | PostDominance.cs:5:10:5:11 | M1 |
@@ -5746,6 +5767,15 @@ blockEnclosing
 | Patterns.cs:69:13:69:17 | [no-match] not ... | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:65:26:65:27 | M6 |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:65:26:65:27 | M6 |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:78:20:78:24 | "> 1" | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:79:20:79:24 | "< 0" | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:80:18:80:20 | "1" | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:74:26:74:27 | M7 |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:74:26:74:27 | M7 |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:5:10:5:11 | M1 |
 | PostDominance.cs:10:10:10:11 | enter M2 | PostDominance.cs:10:10:10:11 | M2 |
 | PostDominance.cs:10:10:10:11 | exit M2 (normal) | PostDominance.cs:10:10:10:11 | M2 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected b/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
index 087bcc9b5d3..0d597fdd0f4 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
@@ -2260,6 +2260,24 @@
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:70:13:70:13 | 2 |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" |
+| Patterns.cs:75:5:83:5 | {...} | Patterns.cs:75:5:83:5 | {...} |
+| Patterns.cs:76:9:82:10 | return ...; | Patterns.cs:76:16:76:16 | access to parameter i |
+| Patterns.cs:76:16:76:16 | access to parameter i | Patterns.cs:76:16:76:16 | access to parameter i |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:76:16:76:16 | access to parameter i |
+| Patterns.cs:78:13:78:15 | > ... | Patterns.cs:78:15:78:15 | 1 |
+| Patterns.cs:78:13:78:24 | ... => ... | Patterns.cs:78:15:78:15 | 1 |
+| Patterns.cs:78:15:78:15 | 1 | Patterns.cs:78:15:78:15 | 1 |
+| Patterns.cs:78:20:78:24 | "> 1" | Patterns.cs:78:20:78:24 | "> 1" |
+| Patterns.cs:79:13:79:15 | < ... | Patterns.cs:79:15:79:15 | 0 |
+| Patterns.cs:79:13:79:24 | ... => ... | Patterns.cs:79:15:79:15 | 0 |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:79:15:79:15 | 0 |
+| Patterns.cs:79:20:79:24 | "< 0" | Patterns.cs:79:20:79:24 | "< 0" |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:13:80:13 | 1 |
+| Patterns.cs:80:13:80:20 | ... => ... | Patterns.cs:80:13:80:13 | 1 |
+| Patterns.cs:80:18:80:20 | "1" | Patterns.cs:80:18:80:20 | "1" |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:81:13:81:20 | ... => ... | Patterns.cs:81:13:81:13 | _ |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:81:18:81:20 | "0" |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:6:5:8:5 | {...} |
 | PostDominance.cs:7:9:7:28 | call to method WriteLine | PostDominance.cs:7:27:7:27 | access to parameter s |
 | PostDominance.cs:7:9:7:29 | ...; | PostDominance.cs:7:9:7:29 | ...; |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
index 384c01fc520..5a6b27b882a 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
@@ -2959,6 +2959,27 @@
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:13:70:13 | 2 | match |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:70:13:70:27 | ... => ... | normal |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:18:70:27 | "possible" | normal |
+| Patterns.cs:75:5:83:5 | {...} | Patterns.cs:76:9:82:10 | return ...; | return |
+| Patterns.cs:76:9:82:10 | return ...; | Patterns.cs:76:9:82:10 | return ...; | return |
+| Patterns.cs:76:16:76:16 | access to parameter i | Patterns.cs:76:16:76:16 | access to parameter i | normal |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:76:16:82:9 | ... switch { ... } | normal |
+| Patterns.cs:78:13:78:15 | > ... | Patterns.cs:78:13:78:15 | > ... | match |
+| Patterns.cs:78:13:78:15 | > ... | Patterns.cs:78:13:78:15 | > ... | no-match |
+| Patterns.cs:78:13:78:24 | ... => ... | Patterns.cs:78:13:78:24 | ... => ... | normal |
+| Patterns.cs:78:15:78:15 | 1 | Patterns.cs:78:15:78:15 | 1 | normal |
+| Patterns.cs:78:20:78:24 | "> 1" | Patterns.cs:78:20:78:24 | "> 1" | normal |
+| Patterns.cs:79:13:79:15 | < ... | Patterns.cs:79:13:79:15 | < ... | match |
+| Patterns.cs:79:13:79:15 | < ... | Patterns.cs:79:13:79:15 | < ... | no-match |
+| Patterns.cs:79:13:79:24 | ... => ... | Patterns.cs:79:13:79:24 | ... => ... | normal |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:79:15:79:15 | 0 | normal |
+| Patterns.cs:79:20:79:24 | "< 0" | Patterns.cs:79:20:79:24 | "< 0" | normal |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:13:80:13 | 1 | match |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:13:80:13 | 1 | no-match |
+| Patterns.cs:80:13:80:20 | ... => ... | Patterns.cs:80:13:80:20 | ... => ... | normal |
+| Patterns.cs:80:18:80:20 | "1" | Patterns.cs:80:18:80:20 | "1" | normal |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:81:13:81:13 | _ | match |
+| Patterns.cs:81:13:81:20 | ... => ... | Patterns.cs:81:13:81:20 | ... => ... | normal |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:81:18:81:20 | "0" | normal |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:7:9:7:28 | call to method WriteLine | normal |
 | PostDominance.cs:7:9:7:28 | call to method WriteLine | PostDominance.cs:7:9:7:28 | call to method WriteLine | normal |
 | PostDominance.cs:7:9:7:29 | ...; | PostDominance.cs:7:9:7:28 | call to method WriteLine | normal |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
index 253885b6e1d..730966a551d 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
@@ -3652,6 +3652,29 @@
 | Patterns.cs:70:13:70:13 | 2 | Patterns.cs:70:18:70:27 | "possible" | semmle.label | match |
 | Patterns.cs:70:13:70:27 | ... => ... | Patterns.cs:67:16:71:9 | ... switch { ... } | semmle.label | successor |
 | Patterns.cs:70:18:70:27 | "possible" | Patterns.cs:70:13:70:27 | ... => ... | semmle.label | successor |
+| Patterns.cs:74:26:74:27 | enter M7 | Patterns.cs:75:5:83:5 | {...} | semmle.label | successor |
+| Patterns.cs:74:26:74:27 | exit M7 (normal) | Patterns.cs:74:26:74:27 | exit M7 | semmle.label | successor |
+| Patterns.cs:75:5:83:5 | {...} | Patterns.cs:76:16:76:16 | access to parameter i | semmle.label | successor |
+| Patterns.cs:76:9:82:10 | return ...; | Patterns.cs:74:26:74:27 | exit M7 (normal) | semmle.label | return |
+| Patterns.cs:76:16:76:16 | access to parameter i | Patterns.cs:78:15:78:15 | 1 | semmle.label | successor |
+| Patterns.cs:76:16:82:9 | ... switch { ... } | Patterns.cs:76:9:82:10 | return ...; | semmle.label | successor |
+| Patterns.cs:78:13:78:15 | > ... | Patterns.cs:78:20:78:24 | "> 1" | semmle.label | match |
+| Patterns.cs:78:13:78:15 | > ... | Patterns.cs:79:15:79:15 | 0 | semmle.label | no-match |
+| Patterns.cs:78:13:78:24 | ... => ... | Patterns.cs:76:16:82:9 | ... switch { ... } | semmle.label | successor |
+| Patterns.cs:78:15:78:15 | 1 | Patterns.cs:78:13:78:15 | > ... | semmle.label | successor |
+| Patterns.cs:78:20:78:24 | "> 1" | Patterns.cs:78:13:78:24 | ... => ... | semmle.label | successor |
+| Patterns.cs:79:13:79:15 | < ... | Patterns.cs:79:20:79:24 | "< 0" | semmle.label | match |
+| Patterns.cs:79:13:79:15 | < ... | Patterns.cs:80:13:80:13 | 1 | semmle.label | no-match |
+| Patterns.cs:79:13:79:24 | ... => ... | Patterns.cs:76:16:82:9 | ... switch { ... } | semmle.label | successor |
+| Patterns.cs:79:15:79:15 | 0 | Patterns.cs:79:13:79:15 | < ... | semmle.label | successor |
+| Patterns.cs:79:20:79:24 | "< 0" | Patterns.cs:79:13:79:24 | ... => ... | semmle.label | successor |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:80:18:80:20 | "1" | semmle.label | match |
+| Patterns.cs:80:13:80:13 | 1 | Patterns.cs:81:13:81:13 | _ | semmle.label | no-match |
+| Patterns.cs:80:13:80:20 | ... => ... | Patterns.cs:76:16:82:9 | ... switch { ... } | semmle.label | successor |
+| Patterns.cs:80:18:80:20 | "1" | Patterns.cs:80:13:80:20 | ... => ... | semmle.label | successor |
+| Patterns.cs:81:13:81:13 | _ | Patterns.cs:81:18:81:20 | "0" | semmle.label | match |
+| Patterns.cs:81:13:81:20 | ... => ... | Patterns.cs:76:16:82:9 | ... switch { ... } | semmle.label | successor |
+| Patterns.cs:81:18:81:20 | "0" | Patterns.cs:81:13:81:20 | ... => ... | semmle.label | successor |
 | PostDominance.cs:5:10:5:11 | enter M1 | PostDominance.cs:6:5:8:5 | {...} | semmle.label | successor |
 | PostDominance.cs:5:10:5:11 | exit M1 (normal) | PostDominance.cs:5:10:5:11 | exit M1 | semmle.label | successor |
 | PostDominance.cs:6:5:8:5 | {...} | PostDominance.cs:7:9:7:29 | ...; | semmle.label | successor |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
index 9c66acba802..80b2ba16540 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
@@ -1224,6 +1224,7 @@ entryPoint
 | Patterns.cs:53:24:53:25 | M4 | Patterns.cs:54:9:54:9 | access to parameter c |
 | Patterns.cs:56:26:56:27 | M5 | Patterns.cs:57:5:63:5 | {...} |
 | Patterns.cs:65:26:65:27 | M6 | Patterns.cs:66:5:72:5 | {...} |
+| Patterns.cs:74:26:74:27 | M7 | Patterns.cs:75:5:83:5 | {...} |
 | PostDominance.cs:5:10:5:11 | M1 | PostDominance.cs:6:5:8:5 | {...} |
 | PostDominance.cs:10:10:10:11 | M2 | PostDominance.cs:11:5:15:5 | {...} |
 | PostDominance.cs:17:10:17:11 | M3 | PostDominance.cs:18:5:22:5 | {...} |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Patterns.cs b/csharp/ql/test/library-tests/controlflow/graph/Patterns.cs
index 86a6e34d708..1b6195174af 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Patterns.cs
+++ b/csharp/ql/test/library-tests/controlflow/graph/Patterns.cs
@@ -70,4 +70,15 @@ class Patterns
             2 => "possible"
         };
     }
+
+    public static string M7(int i)
+    {
+        return i switch
+        {
+            > 1 => "> 1",
+            < 0 => "< 0",
+            1 => "1",
+            _ => "0"
+        };
+    }
 }

From 0543e348127ad1a4e26fbee267794c54c26b9db6 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 21 Jan 2021 08:38:57 +0100
Subject: [PATCH 296/343] C#: Address review comment

---
 .../controlflow/internal/Completion.qll       | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
index dc6dfd91622..bdd8286818b 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/Completion.qll
@@ -269,19 +269,16 @@ private predicate typePatternCommonSubType(Type t, Type strippedType) {
  * constantly non-matches (`value = false`).
  */
 private predicate isMatchingConstant(PatternExpr pe, boolean value) {
-  exists(Expr e | mustHaveMatchingCompletion(e, pe) |
-    exists(Expr stripped | stripped = e.stripCasts() |
-      exists(string strippedValue, string patternValue |
-        strippedValue = stripped.getValue() and
-        patternValue = pe.getValue() and
-        if strippedValue = patternValue then value = true else value = false
-      )
-    )
-    or
-    pe instanceof DiscardPatternExpr and
-    value = true
+  exists(Expr e, string exprValue, string patternValue |
+    mustHaveMatchingCompletion(e, pe) and
+    exprValue = e.stripCasts().getValue() and
+    patternValue = pe.getValue() and
+    if exprValue = patternValue then value = true else value = false
   )
   or
+  pe instanceof DiscardPatternExpr and
+  value = true
+  or
   exists(Type t, Type strippedType |
     typePatternMustHaveMatchingCompletion(pe, t, strippedType) and
     not typePatternCommonSubType(t, strippedType) and

From 355edcb13699187cf611061c803848a2494ae083 Mon Sep 17 00:00:00 2001
From: alexet <alexet@semmle.com>
Date: Fri, 22 Jan 2021 12:27:40 +0000
Subject: [PATCH 297/343] Csharp: Reduce BDD usage.

---
 .../internal/ControlFlowGraphImpl.qll         | 200 +++++++-----------
 1 file changed, 77 insertions(+), 123 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
index cb22d51aee8..1d2405a7769 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
@@ -225,15 +225,11 @@ abstract private class PostOrderTree extends ControlFlowTree {
 }
 
 abstract private class SwitchTree extends ControlFlowTree, Switch {
-  Expr expr;
-
-  SwitchTree() { expr = this.getExpr() }
-
-  override predicate propagatesAbnormal(ControlFlowElement child) { child = expr }
+  override predicate propagatesAbnormal(ControlFlowElement child) { child = this.getExpr() }
 
   override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
     // Flow from last element of switch expression to first element of first case
-    last(expr, pred, c) and
+    last(this.getExpr(), pred, c) and
     c instanceof NormalCompletion and
     first(this.getCase(0), succ)
     or
@@ -254,17 +250,12 @@ abstract private class SwitchTree extends ControlFlowTree, Switch {
 }
 
 abstract private class CaseTree extends ControlFlowTree, Case {
-  PatternExpr pattern;
-  ControlFlowElement body;
-
-  CaseTree() { pattern = this.getPattern() and body = this.getBody() }
-
   final override predicate propagatesAbnormal(ControlFlowElement child) {
-    child in [pattern, this.getCondition().(ControlFlowElement), body]
+    child in [this.getPattern(), this.getCondition().(ControlFlowElement), this.getBody()]
   }
 
   override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
-    last(pattern, pred, c) and
+    last(this.getPattern(), pred, c) and
     c.(MatchingCompletion).isMatch() and
     (
       if exists(this.getCondition())
@@ -273,13 +264,13 @@ abstract private class CaseTree extends ControlFlowTree, Case {
         first(this.getCondition(), succ)
       else
         // Flow from last element of pattern to first element of body
-        first(body, succ)
+        first(this.getBody(), succ)
     )
     or
     // Flow from last element of condition to first element of body
     last(this.getCondition(), pred, c) and
     c instanceof TrueCompletion and
-    first(body, succ)
+    first(this.getBody(), succ)
   }
 }
 
@@ -427,13 +418,11 @@ module Expressions {
     }
   }
 
+  private class StatOrDynAccessorCall_ =
+    @dynamic_member_access_expr or @dynamic_element_access_expr or @call_access_expr;
+
   /** A normal or a (potential) dynamic call to an accessor. */
-  private class StatOrDynAccessorCall extends Expr {
-    StatOrDynAccessorCall() {
-      this instanceof AccessorCall or
-      this instanceof DynamicAccess
-    }
-  }
+  private class StatOrDynAccessorCall extends Expr, StatOrDynAccessorCall_ { }
 
   /**
    * An expression that writes via an accessor call, for example `x.Prop = 0`,
@@ -528,120 +517,101 @@ module Expressions {
   }
 
   private class LogicalAndExprTree extends PostOrderTree, LogicalAndExpr {
-    private Expr left;
-    private Expr right;
+    final override predicate propagatesAbnormal(ControlFlowElement child) {
+      child in [this.getLeftOperand(), this.getRightOperand()]
+    }
 
-    LogicalAndExprTree() { left = this.getLeftOperand() and right = this.getRightOperand() }
-
-    final override predicate propagatesAbnormal(ControlFlowElement child) { child in [left, right] }
-
-    final override predicate first(ControlFlowElement first) { first(left, first) }
+    final override predicate first(ControlFlowElement first) { first(this.getLeftOperand(), first) }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       // Flow from last element of left operand to first element of right operand
-      last(left, pred, c) and
+      last(this.getLeftOperand(), pred, c) and
       c instanceof TrueCompletion and
-      first(right, succ)
+      first(this.getRightOperand(), succ)
       or
       // Post-order: flow from last element of left operand to element itself
-      last(left, pred, c) and
+      last(this.getLeftOperand(), pred, c) and
       c instanceof FalseCompletion and
       succ = this
       or
       // Post-order: flow from last element of right operand to element itself
-      last(right, pred, c) and
+      last(this.getRightOperand(), pred, c) and
       c instanceof NormalCompletion and
       succ = this
     }
   }
 
   private class LogicalOrExprTree extends PostOrderTree, LogicalOrExpr {
-    private Expr left;
-    private Expr right;
+    final override predicate propagatesAbnormal(ControlFlowElement child) {
+      child in [this.getLeftOperand(), this.getRightOperand()]
+    }
 
-    LogicalOrExprTree() { left = this.getLeftOperand() and right = this.getRightOperand() }
-
-    final override predicate propagatesAbnormal(ControlFlowElement child) { child in [left, right] }
-
-    final override predicate first(ControlFlowElement first) { first(left, first) }
+    final override predicate first(ControlFlowElement first) { first(this.getLeftOperand(), first) }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       // Flow from last element of left operand to first element of right operand
-      last(left, pred, c) and
+      last(this.getLeftOperand(), pred, c) and
       c instanceof FalseCompletion and
-      first(right, succ)
+      first(this.getRightOperand(), succ)
       or
       // Post-order: flow from last element of left operand to element itself
-      last(left, pred, c) and
+      last(this.getLeftOperand(), pred, c) and
       c instanceof TrueCompletion and
       succ = this
       or
       // Post-order: flow from last element of right operand to element itself
-      last(right, pred, c) and
+      last(this.getRightOperand(), pred, c) and
       c instanceof NormalCompletion and
       succ = this
     }
   }
 
   private class NullCoalescingExprTree extends PostOrderTree, NullCoalescingExpr {
-    private Expr left;
-    private Expr right;
+    final override predicate propagatesAbnormal(ControlFlowElement child) {
+      child in [this.getLeftOperand(), this.getRightOperand()]
+    }
 
-    NullCoalescingExprTree() { left = this.getLeftOperand() and right = this.getRightOperand() }
-
-    final override predicate propagatesAbnormal(ControlFlowElement child) { child in [left, right] }
-
-    final override predicate first(ControlFlowElement first) { first(left, first) }
+    final override predicate first(ControlFlowElement first) { first(this.getLeftOperand(), first) }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       // Flow from last element of left operand to first element of right operand
-      last(left, pred, c) and
+      last(this.getLeftOperand(), pred, c) and
       c.(NullnessCompletion).isNull() and
-      first(right, succ)
+      first(getRightOperand(), succ)
       or
       // Post-order: flow from last element of left operand to element itself
-      last(left, pred, c) and
+      last(this.getLeftOperand(), pred, c) and
       succ = this and
       c instanceof NormalCompletion and
       not c.(NullnessCompletion).isNull()
       or
       // Post-order: flow from last element of right operand to element itself
-      last(right, pred, c) and
+      last(getRightOperand(), pred, c) and
       c instanceof NormalCompletion and
       succ = this
     }
   }
 
   private class ConditionalExprTree extends PostOrderTree, ConditionalExpr {
-    private Expr condition;
-    private Expr thenBranch;
-    private Expr elseBranch;
-
-    ConditionalExprTree() {
-      condition = this.getCondition() and
-      thenBranch = this.getThen() and
-      elseBranch = this.getElse()
-    }
-
     final override predicate propagatesAbnormal(ControlFlowElement child) {
-      child in [condition, thenBranch, elseBranch]
+      child in [this.getCondition(), this.getThen(), this.getElse()]
     }
 
-    final override predicate first(ControlFlowElement first) { first(condition, first) }
+    final override predicate first(ControlFlowElement first) { first(this.getCondition(), first) }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       // Flow from last element of condition to first element of then branch
-      last(condition, pred, c) and
+      last(this.getCondition(), pred, c) and
       c instanceof TrueCompletion and
-      first(thenBranch, succ)
+      first(this.getThen(), succ)
       or
       // Flow from last element of condition to first element of else branch
-      last(condition, pred, c) and
+      last(this.getCondition(), pred, c) and
       c instanceof FalseCompletion and
-      first(elseBranch, succ)
+      first(this.getElse(), succ)
       or
       // Post-order: flow from last element of a branch to element itself
-      last([thenBranch, elseBranch], pred, c) and
+      last([this.getThen(), this.getElse()], pred, c) and
       c instanceof NormalCompletion and
       succ = this
     }
@@ -653,15 +623,13 @@ module Expressions {
    * tracking.
    */
   private class AssignOperationWithExpandedAssignment extends AssignOperation, ControlFlowTree {
-    private Expr expanded;
-
-    AssignOperationWithExpandedAssignment() { expanded = this.getExpandedAssignment() }
-
-    final override predicate first(ControlFlowElement first) { first(expanded, first) }
+    final override predicate first(ControlFlowElement first) {
+      first(this.getExpandedAssignment(), first)
+    }
 
     final override predicate last(ControlFlowElement last, Completion c) {
-      last = expanded and
-      last(expanded, last, c)
+      last = this.getExpandedAssignment() and
+      last(this.getExpandedAssignment(), last, c)
     }
 
     final override predicate propagatesAbnormal(ControlFlowElement child) { none() }
@@ -711,16 +679,12 @@ module Expressions {
   }
 
   private class ThrowExprTree extends PostOrderTree, ThrowExpr {
-    private Expr expr;
+    final override predicate propagatesAbnormal(ControlFlowElement child) { child = this.getExpr() }
 
-    ThrowExprTree() { expr = this.getExpr() }
-
-    final override predicate propagatesAbnormal(ControlFlowElement child) { child = expr }
-
-    final override predicate first(ControlFlowElement first) { first(expr, first) }
+    final override predicate first(ControlFlowElement first) { first(this.getExpr(), first) }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
-      last(expr, pred, c) and
+      last(this.getExpr(), pred, c) and
       c instanceof NormalCompletion and
       succ = this
     }
@@ -827,7 +791,7 @@ module Expressions {
       child = this.getACase()
     }
 
-    final override predicate first(ControlFlowElement first) { first(expr, first) }
+    final override predicate first(ControlFlowElement first) { first(this.getExpr(), first) }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       SwitchTree.super.succ(pred, succ, c)
@@ -839,7 +803,7 @@ module Expressions {
   }
 
   private class SwitchCaseExprTree extends PostOrderTree, CaseTree, SwitchCaseExpr {
-    final override predicate first(ControlFlowElement first) { first(pattern, first) }
+    final override predicate first(ControlFlowElement first) { first(this.getPattern(), first) }
 
     final override predicate last(ControlFlowElement last, Completion c) {
       PostOrderTree.super.last(last, c)
@@ -849,7 +813,7 @@ module Expressions {
         this = se.getCase(i) and
         not this.matchesAll() and
         not exists(se.getCase(i + 1)) and
-        last([pattern, this.getCondition()], last, cc) and
+        last([this.getPattern(), this.getCondition()], last, cc) and
         (cc.(MatchingCompletion).isNonMatch() or cc instanceof FalseCompletion) and
         c =
           any(NestedCompletion nc |
@@ -866,7 +830,7 @@ module Expressions {
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       CaseTree.super.succ(pred, succ, c)
       or
-      last(body, pred, c) and
+      last(this.getBody(), pred, c) and
       succ = this and
       c instanceof NormalCompletion
     }
@@ -922,17 +886,15 @@ module Expressions {
   }
 
   private class NotPatternExprTree extends PostOrderTree, NotPatternExpr {
-    private PatternExpr operand;
+    final override predicate propagatesAbnormal(ControlFlowElement child) {
+      child = this.getPattern()
+    }
 
-    NotPatternExprTree() { operand = this.getPattern() }
-
-    final override predicate propagatesAbnormal(ControlFlowElement child) { child = operand }
-
-    final override predicate first(ControlFlowElement first) { first(operand, first) }
+    final override predicate first(ControlFlowElement first) { first(this.getPattern(), first) }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       succ = this and
-      last(operand, pred, c) and
+      last(this.getPattern(), pred, c) and
       c instanceof NormalCompletion
     }
   }
@@ -1003,15 +965,13 @@ module Statements {
   }
 
   private class IfStmtTree extends PreOrderTree, IfStmt {
-    private Expr condition;
-
-    IfStmtTree() { condition = this.getCondition() }
-
-    final override predicate propagatesAbnormal(ControlFlowElement child) { child = condition }
+    final override predicate propagatesAbnormal(ControlFlowElement child) {
+      child = this.getCondition()
+    }
 
     final override predicate last(ControlFlowElement last, Completion c) {
       // Condition exits with a false completion and there is no `else` branch
-      last(condition, last, c) and
+      last(this.getCondition(), last, c) and
       c instanceof FalseCompletion and
       not exists(this.getElse())
       or
@@ -1025,10 +985,10 @@ module Statements {
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       // Pre-order: flow from statement itself to first element of condition
       pred = this and
-      first(condition, succ) and
+      first(this.getCondition(), succ) and
       c instanceof SimpleCompletion
       or
-      last(condition, pred, c) and
+      last(this.getCondition(), pred, c) and
       (
         // Flow from last element of condition to first element of then branch
         c instanceof TrueCompletion and first(this.getThen(), succ)
@@ -1043,7 +1003,7 @@ module Statements {
     final override predicate last(ControlFlowElement last, Completion c) {
       // Switch expression exits normally and there are no cases
       not exists(this.getACase()) and
-      last(expr, last, c) and
+      last(this.getExpr(), last, c) and
       c instanceof NormalCompletion
       or
       // A statement exits with a `break` completion
@@ -1075,7 +1035,7 @@ module Statements {
       or
       // Pre-order: flow from statement itself to first switch expression
       pred = this and
-      first(expr, succ) and
+      first(this.getExpr(), succ) and
       c instanceof SimpleCompletion
       or
       // Flow from last element of non-`case` statement `i` to first element of statement `i+1`
@@ -1100,27 +1060,23 @@ module Statements {
       c instanceof FalseCompletion
       or
       // Case pattern exits with a non-match
-      last(pattern, last, c) and
+      last(this.getPattern(), last, c) and
       not c.(MatchingCompletion).isMatch()
       or
       // Case body exits with any completion
-      last(body, last, c)
+      last(this.getBody(), last, c)
     }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
       CaseTree.super.succ(pred, succ, c)
       or
       pred = this and
-      first(pattern, succ) and
+      first(this.getPattern(), succ) and
       c instanceof SimpleCompletion
     }
   }
 
   abstract private class LoopStmtTree extends PreOrderTree, LoopStmt {
-    Stmt body;
-
-    LoopStmtTree() { body = this.getBody() }
-
     final override predicate propagatesAbnormal(ControlFlowElement child) {
       child = this.getCondition()
     }
@@ -1131,10 +1087,10 @@ module Statements {
       c instanceof FalseCompletion
       or
       // Body exits with a break completion
-      last(body, last, c.(NestedBreakCompletion).getAnInnerCompatibleCompletion())
+      last(this.getBody(), last, c.(NestedBreakCompletion).getAnInnerCompatibleCompletion())
       or
       // Body exits with a completion that does not continue the loop
-      last(body, last, c) and
+      last(this.getBody(), last, c) and
       not c instanceof BreakCompletion and
       not c.continuesLoop()
     }
@@ -1143,11 +1099,11 @@ module Statements {
       // Flow from last element of condition to first element of loop body
       last(this.getCondition(), pred, c) and
       c instanceof TrueCompletion and
-      first(body, succ)
+      first(this.getBody(), succ)
       or
       // Flow from last element of loop body back to first element of condition
       not this instanceof ForStmt and
-      last(body, pred, c) and
+      last(this.getBody(), pred, c) and
       c.continuesLoop() and
       first(this.getCondition(), succ)
     }
@@ -1168,7 +1124,7 @@ module Statements {
       LoopStmtTree.super.succ(pred, succ, c)
       or
       pred = this and
-      first(body, succ) and
+      first(this.getBody(), succ) and
       c instanceof SimpleCompletion
     }
   }
@@ -1179,7 +1135,7 @@ module Statements {
       result = this.getCondition()
       or
       not exists(this.getCondition()) and
-      result = body
+      result = this.getBody()
     }
 
     final override predicate succ(ControlFlowElement pred, ControlFlowElement succ, Completion c) {
@@ -1214,11 +1170,11 @@ module Statements {
       // Flow from last element of condition into first element of loop body
       last(this.getCondition(), pred, c) and
       c instanceof TrueCompletion and
-      first(body, succ)
+      first(this.getBody(), succ)
       or
       // Flow from last element of loop body to first element of update/condition/self
       exists(ControlFlowElement next |
-        last(body, pred, c) and
+        last(this.getBody(), pred, c) and
         c.continuesLoop() and
         first(next, succ) and
         if exists(this.getUpdate(0))
@@ -1318,8 +1274,6 @@ module Statements {
   }
 
   class TryStmtTree extends PreOrderTree, TryStmt {
-    ControlFlowTree body;
-
     final override predicate propagatesAbnormal(ControlFlowElement child) {
       child = this.getFinally()
     }

From 221aebc833ea18d3ec8b8e710e31407e443a36fd Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 25 Jan 2021 13:53:01 +0100
Subject: [PATCH 298/343] C#: Fix bug in
 `AssignOperationWithExpandedAssignment::last`

---
 .../controlflow/internal/ControlFlowGraphImpl.qll   | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
index 1d2405a7769..ebe4654d70c 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
@@ -623,14 +623,13 @@ module Expressions {
    * tracking.
    */
   private class AssignOperationWithExpandedAssignment extends AssignOperation, ControlFlowTree {
-    final override predicate first(ControlFlowElement first) {
-      first(this.getExpandedAssignment(), first)
-    }
+    private Expr expanded;
 
-    final override predicate last(ControlFlowElement last, Completion c) {
-      last = this.getExpandedAssignment() and
-      last(this.getExpandedAssignment(), last, c)
-    }
+    AssignOperationWithExpandedAssignment() { expanded = this.getExpandedAssignment() }
+
+    final override predicate first(ControlFlowElement first) { first(expanded, first) }
+
+    final override predicate last(ControlFlowElement last, Completion c) { last(expanded, last, c) }
 
     final override predicate propagatesAbnormal(ControlFlowElement child) { none() }
 

From 38b0f743cb0a471c9d4435d632f9eb9da47c47ea Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 12 Jan 2021 10:06:12 +0100
Subject: [PATCH 299/343] C#: Add test that illustrates problem with flow
 through phi nodes

---
 .../dataflow/local/DataFlowStep.expected       |  8 ++++++++
 .../dataflow/local/LocalDataFlow.cs            | 18 ++++++++++++++++++
 .../dataflow/local/TaintTrackingStep.expected  |  8 ++++++++
 3 files changed, 34 insertions(+)

diff --git a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
index babc7501a22..bf87f4e4bad 100644
--- a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
@@ -414,6 +414,14 @@
 | LocalDataFlow.cs:361:41:361:44 | args | LocalDataFlow.cs:363:29:363:32 | access to parameter args |
 | LocalDataFlow.cs:363:29:363:32 | [post] access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
 | LocalDataFlow.cs:363:29:363:32 | access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
+| LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
+| LocalDataFlow.cs:367:32:367:33 | b2 | LocalDataFlow.cs:374:17:374:18 | access to parameter b2 |
+| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:376:35:376:35 | access to local variable x |
+| LocalDataFlow.cs:373:17:373:25 | "tainted" | LocalDataFlow.cs:373:13:373:25 | SSA def(x) |
+| LocalDataFlow.cs:376:35:376:35 | access to local variable x | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
+| LocalDataFlow.cs:381:13:381:29 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
+| LocalDataFlow.cs:381:17:381:29 | "not tainted" | LocalDataFlow.cs:381:13:381:29 | SSA def(x) |
+| LocalDataFlow.cs:382:9:382:17 | SSA phi(x) | LocalDataFlow.cs:382:15:382:15 | access to local variable x |
 | SSA.cs:5:17:5:17 | SSA entry def(this.S) | SSA.cs:67:9:67:14 | access to field S |
 | SSA.cs:5:17:5:17 | this | SSA.cs:67:9:67:12 | this access |
 | SSA.cs:5:26:5:32 | tainted | SSA.cs:8:24:8:30 | access to parameter tainted |
diff --git a/csharp/ql/test/library-tests/dataflow/local/LocalDataFlow.cs b/csharp/ql/test/library-tests/dataflow/local/LocalDataFlow.cs
index a5a1e34178f..900a2161715 100644
--- a/csharp/ql/test/library-tests/dataflow/local/LocalDataFlow.cs
+++ b/csharp/ql/test/library-tests/dataflow/local/LocalDataFlow.cs
@@ -363,4 +363,22 @@ public class LocalDataFlow
         Span<object> span = args; // flow (library operator)
         LocalDataFlow x = args; // no flow (source code operator)
     }
+
+    void PhiFlow(bool b1, bool b2)
+    {
+        var x = "";
+
+        if (b1)
+        {
+            x = "tainted";
+            if (b2)
+            {
+                Console.WriteLine(x);
+                return;
+            }
+        }
+        else
+            x = "not tainted";
+        Check(x);
+    }
 }
diff --git a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
index 2435c1a30f7..8c3e3a4d9c9 100644
--- a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
@@ -524,6 +524,14 @@
 | LocalDataFlow.cs:363:29:363:32 | [post] access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
 | LocalDataFlow.cs:363:29:363:32 | access to parameter args | LocalDataFlow.cs:363:29:363:32 | call to operator implicit conversion |
 | LocalDataFlow.cs:363:29:363:32 | access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
+| LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
+| LocalDataFlow.cs:367:32:367:33 | b2 | LocalDataFlow.cs:374:17:374:18 | access to parameter b2 |
+| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:376:35:376:35 | access to local variable x |
+| LocalDataFlow.cs:373:17:373:25 | "tainted" | LocalDataFlow.cs:373:13:373:25 | SSA def(x) |
+| LocalDataFlow.cs:376:35:376:35 | access to local variable x | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
+| LocalDataFlow.cs:381:13:381:29 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
+| LocalDataFlow.cs:381:17:381:29 | "not tainted" | LocalDataFlow.cs:381:13:381:29 | SSA def(x) |
+| LocalDataFlow.cs:382:9:382:17 | SSA phi(x) | LocalDataFlow.cs:382:15:382:15 | access to local variable x |
 | SSA.cs:5:17:5:17 | SSA entry def(this.S) | SSA.cs:67:9:67:14 | access to field S |
 | SSA.cs:5:17:5:17 | this | SSA.cs:67:9:67:12 | this access |
 | SSA.cs:5:26:5:32 | tainted | SSA.cs:8:24:8:30 | access to parameter tainted |

From 6ffeaf8c2a0ee0f462ae6ec65c5034232abb3136 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 12 Jan 2021 11:00:03 +0100
Subject: [PATCH 300/343] C#: Adjust flow into phi nodes

---
 .../dataflow/internal/DataFlowPrivate.qll     | 21 ++++----
 .../code/csharp/dataflow/internal/SsaImpl.qll | 34 +++++++++----
 .../dataflow/internal/SsaImplCommon.qll       | 48 ++++++++++++-------
 .../dataflow/local/DataFlowStep.expected      |  4 +-
 .../dataflow/local/TaintTrackingStep.expected |  4 +-
 5 files changed, 70 insertions(+), 41 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 6e30f8c50fa..fb5b2d86471 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -266,16 +266,15 @@ module LocalFlow {
   }
 
   /**
-   * Holds if `nodeFrom` is a last node referencing SSA definition `def`.
-   * Either an SSA definition node for `def` when there is no read of `def`,
-   * or a last read of `def`.
+   * Holds if `nodeFrom` is a last node referencing SSA definition `def`, which
+   * can reach `next`.
    */
-  private predicate localFlowSsaInput(Node nodeFrom, Ssa::Definition def) {
-    def = nodeFrom.(SsaDefinitionNode).getDefinition() and
-    not exists(def.getARead())
-    or
-    exists(AssignableRead read, ControlFlow::Node cfn | read = nodeFrom.asExprAtNode(cfn) |
-      def.getALastReadAtNode(cfn) = read
+  private predicate localFlowSsaInput(Node nodeFrom, Ssa::Definition def, Ssa::Definition next) {
+    exists(ControlFlow::BasicBlock bb, int i | SsaImpl::lastRefBeforeRedef(def, bb, i, next) |
+      def = nodeFrom.(SsaDefinitionNode).getDefinition() and
+      def.definesAt(_, bb, i)
+      or
+      nodeFrom.asExprAtNode(bb.getNode(i)) instanceof AssignableRead
     )
   }
 
@@ -302,14 +301,14 @@ module LocalFlow {
     or
     // Flow into phi node
     exists(Ssa::PhiNode phi |
-      localFlowSsaInput(nodeFrom, def) and
+      localFlowSsaInput(nodeFrom, def, phi) and
       phi = nodeTo.(SsaDefinitionNode).getDefinition() and
       def = phi.getAnInput()
     )
     or
     // Flow into uncertain SSA definition
     exists(LocalFlow::UncertainExplicitSsaDefinition uncertain |
-      localFlowSsaInput(nodeFrom, def) and
+      localFlowSsaInput(nodeFrom, def, uncertain) and
       uncertain = nodeTo.(SsaDefinitionNode).getDefinition() and
       def = uncertain.getPriorDefinition()
     )
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index 47a3c84263b..bb799d43c5b 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -6,7 +6,7 @@ import csharp
 import SsaImplCommon
 
 /** A classification of variable reads. */
-newtype TReadKind =
+private newtype TReadKind =
   /** An actual read. */
   ActualRead() or
   /**
@@ -49,7 +49,7 @@ newtype TReadKind =
   RefReadBeforeWrite()
 
 /** A classification of variable reads. */
-class ReadKind extends TReadKind {
+private class ReadKind extends TReadKind {
   string toString() {
     this = ActualRead() and
     result = "ActualRead"
@@ -199,7 +199,7 @@ private module SourceVariableImpl {
     rk = RefReadBeforeWrite()
   }
 
-  private predicate outRefExitRead(ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v) {
+  predicate outRefExitRead(ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v) {
     exists(ControlFlow::Nodes::AnnotatedExitNode exit |
       exit.isNormal() and
       exists(LocalScopeVariable lsv |
@@ -1130,7 +1130,6 @@ private module Cached {
   ) {
     exists(Ssa::Definition def0, ControlFlow::BasicBlock bb, int i |
       def = def0.getAnUltimateDefinition() and
-      lastRef(def0, bb, i) and
       capturedReadOut(bb, i, def0.getSourceVariable(), cdef.getSourceVariable(), cdef.getCall(),
         additionalCalls)
     )
@@ -1199,12 +1198,28 @@ private module Cached {
     variableRead(bb2, i2, _, any(ReadKind rk | rk.isPseudo()))
   }
 
+  private predicate reachesLastRefRedef(
+    Definition def, ControlFlow::BasicBlock bb, int i, Definition next
+  ) {
+    lastRefRedef(def, bb, i, next)
+    or
+    exists(ControlFlow::BasicBlock bb0, int i0 |
+      reachesLastRefRedef(def, bb0, i0, next) and
+      adjacentDefPseudoRead(def, bb, i, bb0, i0)
+    )
+  }
+
+  cached
+  predicate lastRefBeforeRedef(Definition def, ControlFlow::BasicBlock bb, int i, Definition next) {
+    reachesLastRefRedef(def, bb, i, next) and
+    not variableRead(bb, i, def.getSourceVariable(), any(ReadKind rk | rk.isPseudo()))
+  }
+
   private predicate reachesLastRef(Definition def, ControlFlow::BasicBlock bb, int i) {
     lastRef(def, bb, i)
     or
     exists(ControlFlow::BasicBlock bb0, int i0 |
       reachesLastRef(def, bb0, i0) and
-      variableRead(bb0, i0, _, any(ReadKind rk | rk.isPseudo())) and
       adjacentDefPseudoRead(def, bb, i, bb0, i0)
     )
   }
@@ -1221,11 +1236,12 @@ private module Cached {
   cached
   predicate isLiveOutRefParameterDefinition(Ssa::Definition def, Parameter p) {
     p.isOutOrRef() and
-    exists(Ssa::Definition def0, ControlFlow::BasicBlock bb, int i |
+    exists(Ssa::SourceVariable v, Ssa::Definition def0, ControlFlow::BasicBlock bb, int i |
+      v = def.getSourceVariable() and
+      p = v.getAssignable() and
       def = def0.getAnUltimateDefinition() and
-      reachesLastRef(def0, bb, i) and
-      variableRead(bb, i, def0.getSourceVariable(), OutRefExitRead()) and
-      p = def0.getSourceVariable().getAssignable()
+      ssaDefReachesRead(_, def0, bb, i) and
+      outRefExitRead(bb, i, v)
     )
   }
 }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
index a3c3417f0aa..8bfef0053ac 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll
@@ -440,6 +440,28 @@ private module Cached {
     defAdjacentRead(def, bb1, bb2, i2)
   }
 
+  /**
+   * Holds if the node at index `i` in `bb` is a last reference to SSA definition
+   * `def`. The reference is last because it can reach another write `next`,
+   * without passing through another read or write.
+   */
+  cached
+  predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
+    exists(int rnk, SourceVariable v, int j | rnk = ssaDefRank(def, v, bb, i, _) |
+      // Next reference to `v` inside `bb` is a write
+      next.definesAt(v, bb, j) and
+      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
+      or
+      // Can reach a write using one or more steps
+      rnk = maxSsaRefRank(bb, v) and
+      exists(BasicBlock bb2 |
+        varBlockReaches(def, bb, bb2) and
+        next.definesAt(v, bb2, j) and
+        1 = ssaRefRank(bb2, j, v, SsaDef())
+      )
+    )
+  }
+
   /**
    * Holds if the node at index `i` in `bb` is a last reference to SSA
    * definition `def`.
@@ -450,24 +472,16 @@ private module Cached {
    */
   cached
   predicate lastRef(Definition def, BasicBlock bb, int i) {
-    exists(int rnk, SourceVariable v | rnk = ssaDefRank(def, v, bb, i, _) |
-      // Next reference to `v` inside `bb` is a write
-      rnk + 1 = ssaRefRank(bb, _, v, SsaDef())
+    lastRefRedef(def, bb, i, _)
+    or
+    exists(SourceVariable v | ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v) |
+      // Can reach exit directly
+      bb instanceof ExitBasicBlock
       or
-      // No more references to `v` inside `bb`
-      rnk = maxSsaRefRank(bb, v) and
-      (
-        // Can reach exit directly
-        bb instanceof ExitBasicBlock
-        or
-        exists(BasicBlock bb2 | varBlockReaches(def, bb, bb2) |
-          // Can reach a write using one or more steps
-          1 = ssaRefRank(bb2, _, def.getSourceVariable(), SsaDef())
-          or
-          // Can reach a block using one or more steps, where `def` is no longer live
-          not defOccursInBlock(def, bb2, _) and
-          not ssaDefReachesEndOfBlock(bb2, def, _)
-        )
+      // Can reach a block using one or more steps, where `def` is no longer live
+      exists(BasicBlock bb2 | varBlockReaches(def, bb, bb2) |
+        not defOccursInBlock(def, bb2, _) and
+        not ssaDefReachesEndOfBlock(bb2, def, _)
       )
     )
   }
diff --git a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
index bf87f4e4bad..e6c0dd9beda 100644
--- a/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
@@ -417,8 +417,8 @@
 | LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
 | LocalDataFlow.cs:367:32:367:33 | b2 | LocalDataFlow.cs:374:17:374:18 | access to parameter b2 |
 | LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:376:35:376:35 | access to local variable x |
+| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
 | LocalDataFlow.cs:373:17:373:25 | "tainted" | LocalDataFlow.cs:373:13:373:25 | SSA def(x) |
-| LocalDataFlow.cs:376:35:376:35 | access to local variable x | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
 | LocalDataFlow.cs:381:13:381:29 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
 | LocalDataFlow.cs:381:17:381:29 | "not tainted" | LocalDataFlow.cs:381:13:381:29 | SSA def(x) |
 | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) | LocalDataFlow.cs:382:15:382:15 | access to local variable x |
@@ -702,7 +702,6 @@
 | SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:154:13:154:13 | (...) ... |
 | SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:155:25:155:25 | access to parameter t |
 | SSA.cs:155:25:155:25 | SSA def(t) | SSA.cs:152:17:152:28 | SSA phi(t) |
-| SSA.cs:155:25:155:25 | access to parameter t | SSA.cs:152:17:152:28 | SSA phi(t) |
 | SSA.cs:166:10:166:13 | this | SSA.cs:166:19:166:22 | this access |
 | SSA.cs:168:22:168:28 | tainted | SSA.cs:173:24:173:30 | access to parameter tainted |
 | SSA.cs:168:35:168:35 | i | SSA.cs:171:13:171:13 | access to parameter i |
@@ -710,6 +709,7 @@
 | SSA.cs:170:27:170:28 | "" | SSA.cs:170:16:170:28 | SSA def(ssaSink5) |
 | SSA.cs:171:13:171:15 | SSA def(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
 | SSA.cs:173:13:173:30 | SSA def(ssaSink5) | SSA.cs:176:21:176:28 | access to local variable ssaSink5 |
+| SSA.cs:173:13:173:30 | SSA def(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
 | SSA.cs:173:24:173:30 | access to parameter tainted | SSA.cs:173:13:173:30 | SSA def(ssaSink5) |
 | SSA.cs:174:20:174:20 | SSA phi(i) | SSA.cs:174:20:174:20 | access to parameter i |
 | SSA.cs:174:20:174:22 | SSA def(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
diff --git a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
index 8c3e3a4d9c9..37e5fee2dc9 100644
--- a/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
+++ b/csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
@@ -527,8 +527,8 @@
 | LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
 | LocalDataFlow.cs:367:32:367:33 | b2 | LocalDataFlow.cs:374:17:374:18 | access to parameter b2 |
 | LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:376:35:376:35 | access to local variable x |
+| LocalDataFlow.cs:373:13:373:25 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
 | LocalDataFlow.cs:373:17:373:25 | "tainted" | LocalDataFlow.cs:373:13:373:25 | SSA def(x) |
-| LocalDataFlow.cs:376:35:376:35 | access to local variable x | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
 | LocalDataFlow.cs:381:13:381:29 | SSA def(x) | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) |
 | LocalDataFlow.cs:381:17:381:29 | "not tainted" | LocalDataFlow.cs:381:13:381:29 | SSA def(x) |
 | LocalDataFlow.cs:382:9:382:17 | SSA phi(x) | LocalDataFlow.cs:382:15:382:15 | access to local variable x |
@@ -828,7 +828,6 @@
 | SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:154:13:154:13 | (...) ... |
 | SSA.cs:154:13:154:13 | access to parameter t | SSA.cs:155:25:155:25 | access to parameter t |
 | SSA.cs:155:25:155:25 | SSA def(t) | SSA.cs:152:17:152:28 | SSA phi(t) |
-| SSA.cs:155:25:155:25 | access to parameter t | SSA.cs:152:17:152:28 | SSA phi(t) |
 | SSA.cs:166:10:166:13 | this | SSA.cs:166:19:166:22 | this access |
 | SSA.cs:168:22:168:28 | tainted | SSA.cs:173:24:173:30 | access to parameter tainted |
 | SSA.cs:168:35:168:35 | i | SSA.cs:171:13:171:13 | access to parameter i |
@@ -837,6 +836,7 @@
 | SSA.cs:171:13:171:15 | ...-- | SSA.cs:171:13:171:19 | ... > ... |
 | SSA.cs:171:13:171:15 | SSA def(i) | SSA.cs:174:20:174:20 | SSA phi(i) |
 | SSA.cs:173:13:173:30 | SSA def(ssaSink5) | SSA.cs:176:21:176:28 | access to local variable ssaSink5 |
+| SSA.cs:173:13:173:30 | SSA def(ssaSink5) | SSA.cs:180:9:180:24 | SSA phi(ssaSink5) |
 | SSA.cs:173:24:173:30 | access to parameter tainted | SSA.cs:173:13:173:30 | SSA def(ssaSink5) |
 | SSA.cs:174:20:174:20 | SSA phi(i) | SSA.cs:174:20:174:20 | access to parameter i |
 | SSA.cs:174:20:174:22 | ...-- | SSA.cs:174:20:174:26 | ... > ... |

From 7c9a6064cff861bc0bf45e8b2316fb3551a250f6 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Mon, 25 Jan 2021 16:20:14 +0100
Subject: [PATCH 301/343] C#: Get rid of `ReadKind`

---
 .../src/semmle/code/csharp/dataflow/SSA.qll   |   4 +-
 .../code/csharp/dataflow/internal/SsaImpl.qll | 149 +++++++-----------
 .../dataflow/internal/SsaImplSpecific.qll     |   4 +-
 3 files changed, 57 insertions(+), 100 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
index 7fe19636f58..c3e645205de 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/SSA.qll
@@ -235,9 +235,9 @@ module Ssa {
     final AssignableRead getAReadAtNode(ControlFlow::Node cfn) {
       exists(SourceVariable v, ControlFlow::BasicBlock bb, int i |
         SsaImpl::ssaDefReachesRead(v, this, bb, i) and
+        SsaImpl::variableReadActual(bb, i, v) and
         cfn = bb.getNode(i) and
-        cfn = result.getAControlFlowNode() and
-        result = v.getAnAccess().(AssignableRead)
+        result.getAControlFlowNode() = cfn
       )
     }
 
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index bb799d43c5b..3014e33a63b 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -5,70 +5,11 @@
 import csharp
 import SsaImplCommon
 
-/** A classification of variable reads. */
-private newtype TReadKind =
-  /** An actual read. */
-  ActualRead() or
-  /**
-   * A pseudo read for a `ref` or `out` variable at the end of the variable's enclosing
-   * callable. A pseudo read is inserted to make assignments to `out`/`ref` variables
-   * live, for example line 1 in
-   *
-   * ```csharp
-   * void M(out int i) {
-   *   i = 0;
-   * }
-   * ```
-   */
-  OutRefExitRead() or
-  /**
-   * A pseudo read for a captured variable at the end of the capturing
-   * callable. A write to a captured variable needs to be live for the same reasons
-   * as a write to a `ref` or `out` variable (see above).
-   */
-  CapturedVarExitRead() or
-  /**
-   * A pseudo read for a captured variable via a call.
-   */
-  CapturedVarCallRead() or
-  /**
-   * A pseudo read for a `ref` variable, just prior to an update of the referenced value.
-   * A pseudo read is inserted to make assignments to the `ref` variable live, for example
-   * line 2 in
-   *
-   * ```csharp
-   * void M() {
-   *   ref int i = ref GetRef();
-   *   i = 0;
-   * }
-   * ```
-   *
-   * The pseudo read is inserted at the CFG node `i` on the left-hand side of the
-   * assignment on line 3.
-   */
-  RefReadBeforeWrite()
-
-/** A classification of variable reads. */
-private class ReadKind extends TReadKind {
-  string toString() {
-    this = ActualRead() and
-    result = "ActualRead"
-    or
-    this = OutRefExitRead() and
-    result = "OutRefExitRead"
-    or
-    this = CapturedVarExitRead() and
-    result = "CapturedVarExitRead"
-    or
-    this = CapturedVarCallRead() and
-    result = "CapturedVarCallRead"
-    or
-    this = RefReadBeforeWrite() and
-    result = "RefReadBeforeWrite"
-  }
-
-  /** Holds if this kind represents a pseudo read. */
-  predicate isPseudo() { this != ActualRead() }
+/**
+ * Holds if the `i`th node of basic block `bb` reads source variable `v`.
+ */
+predicate variableReadActual(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v) {
+  v.getAnAccess().(AssignableRead) = bb.getNode(i).getElement()
 }
 
 private module SourceVariableImpl {
@@ -183,22 +124,16 @@ private module SourceVariableImpl {
   }
 
   /**
-   * Holds if the `i`th node of basic block `bb` reads source variable `v`.
-   * The read is of kind `rk`.
+   * Holds if a pseudo read for `ref` or `out` variable `v` happens at index `i`
+   * in basic block `bb`. A pseudo read is inserted to make assignments to
+   * `out`/`ref` variables live, for example line 1 in
    *
-   * This excludes implicit reads via calls.
+   * ```csharp
+   * void M(out int i) {
+   *   i = 0;
+   * }
+   * ```
    */
-  predicate variableReadDirect(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, ReadKind rk) {
-    v.getAnAccess().(AssignableRead) = bb.getNode(i).getElement() and
-    rk = ActualRead()
-    or
-    outRefExitRead(bb, i, v) and
-    rk = OutRefExitRead()
-    or
-    refReadBeforeWrite(bb, i, v) and
-    rk = RefReadBeforeWrite()
-  }
-
   predicate outRefExitRead(ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v) {
     exists(ControlFlow::Nodes::AnnotatedExitNode exit |
       exit.isNormal() and
@@ -215,7 +150,23 @@ private module SourceVariableImpl {
     )
   }
 
-  private predicate refReadBeforeWrite(ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v) {
+  /**
+   * Holds if a pseudo read for `ref` variable `v` happens at index `i` in basic
+   * block `bb`, just prior to an update of the referenced value. A pseudo read
+   * is inserted to make assignments to the `ref` variable live, for example
+   * line 2 in
+   *
+   * ```csharp
+   * void M() {
+   *   ref int i = ref GetRef();
+   *   i = 0;
+   * }
+   * ```
+   *
+   * The pseudo read is inserted at the CFG node `i` on the left-hand side of the
+   * assignment on line 3.
+   */
+  predicate refReadBeforeWrite(ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v) {
     exists(AssignableDefinitions::AssignmentDefinition def, LocalVariable lv |
       def.getTarget() = lv and
       lv.isRef() and
@@ -812,10 +763,13 @@ private module CapturedVariableLivenessImpl {
    */
   private predicate capturerReads(Callable c, LocalScopeVariable v) {
     exists(LocalScopeSourceVariable sv |
-      variableReadDirect(_, _, sv, _) and
       c = sv.getEnclosingCallable() and
       v = sv.getAssignable() and
       v.getCallable() != c
+    |
+      variableReadActual(_, _, sv)
+      or
+      refReadBeforeWrite(_, _, sv)
     )
   }
 
@@ -985,20 +939,25 @@ private module CapturedVariableLivenessImpl {
 
 private import CapturedVariableLivenessImpl
 
+private predicate variableReadPseudo(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v) {
+  outRefExitRead(bb, i, v)
+  or
+  refReadBeforeWrite(bb, i, v)
+  or
+  capturedReadOut(bb, i, v, _, _, _)
+  or
+  capturedReadIn(bb, i, v, _, _, _)
+}
+
 /**
  * Holds if the `i`th of basic block `bb` reads source variable `v`.
- * The read is of kind `rk`.
  *
  * This includes implicit reads via calls.
  */
-predicate variableRead(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, ReadKind rk) {
-  variableReadDirect(bb, i, v, rk)
+predicate variableRead(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v) {
+  variableReadActual(bb, i, v)
   or
-  capturedReadOut(bb, i, v, _, _, _) and
-  rk = CapturedVarExitRead()
-  or
-  capturedReadIn(bb, i, v, _, _, _) and
-  rk = CapturedVarCallRead()
+  variableReadPseudo(bb, i, v)
 }
 
 cached
@@ -1119,7 +1078,7 @@ private module Cached {
       capturedReadIn(_, _, v, edef.getSourceVariable(), c, additionalCalls) and
       def = def0.getAnUltimateDefinition() and
       ssaDefReachesRead(_, def0, bb, i) and
-      variableRead(bb, i, v, CapturedVarCallRead()) and
+      capturedReadIn(bb, i, v, _, _, _) and
       c = bb.getNode(i)
     )
   }
@@ -1150,7 +1109,7 @@ private module Cached {
     or
     exists(ControlFlow::BasicBlock bb3, int i3 |
       adjacentDefReaches(def, bb1, i1, bb3, i3) and
-      variableRead(bb3, i3, _, any(ReadKind rk | rk.isPseudo())) and
+      variableReadPseudo(bb3, i3, _) and
       adjacentDefRead(def, bb3, i3, bb2, i2)
     )
   }
@@ -1160,7 +1119,7 @@ private module Cached {
     Definition def, ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2
   ) {
     adjacentDefReaches(def, bb1, i1, bb2, i2) and
-    variableRead(bb2, i2, _, ActualRead())
+    variableReadActual(bb2, i2, _)
   }
 
   /**
@@ -1185,7 +1144,7 @@ private module Cached {
   predicate adjacentReadPairSameVar(Definition def, ControlFlow::Node cfn1, ControlFlow::Node cfn2) {
     exists(ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2 |
       cfn1 = bb1.getNode(i1) and
-      variableRead(bb1, i1, _, ActualRead()) and
+      variableReadActual(bb1, i1, _) and
       adjacentDefActualRead(def, bb1, i1, bb2, i2) and
       cfn2 = bb2.getNode(i2)
     )
@@ -1195,7 +1154,7 @@ private module Cached {
     Definition def, ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2
   ) {
     adjacentDefReaches(def, bb1, i1, bb2, i2) and
-    variableRead(bb2, i2, _, any(ReadKind rk | rk.isPseudo()))
+    variableReadPseudo(bb2, i2, _)
   }
 
   private predicate reachesLastRefRedef(
@@ -1212,7 +1171,7 @@ private module Cached {
   cached
   predicate lastRefBeforeRedef(Definition def, ControlFlow::BasicBlock bb, int i, Definition next) {
     reachesLastRefRedef(def, bb, i, next) and
-    not variableRead(bb, i, def.getSourceVariable(), any(ReadKind rk | rk.isPseudo()))
+    not variableReadPseudo(bb, i, def.getSourceVariable())
   }
 
   private predicate reachesLastRef(Definition def, ControlFlow::BasicBlock bb, int i) {
@@ -1228,7 +1187,7 @@ private module Cached {
   predicate lastReadSameVar(Definition def, ControlFlow::Node cfn) {
     exists(ControlFlow::BasicBlock bb, int i |
       reachesLastRef(def, bb, i) and
-      variableRead(bb, i, _, ActualRead()) and
+      variableReadActual(bb, i, _) and
       cfn = bb.getNode(i)
     )
   }
diff --git a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
index 3c18ad905c7..c99ad7d8fb3 100644
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplSpecific.qll
@@ -16,6 +16,4 @@ class SourceVariable = SsaImpl::TSourceVariable;
 
 predicate variableWrite = SsaImpl::variableWrite/4;
 
-predicate variableRead(BasicBlock bb, int i, SourceVariable v) {
-  SsaImpl::variableRead(bb, i, v, _)
-}
+predicate variableRead = SsaImpl::variableRead/3;

From 361bee851a3d748bb3e34c11a2f64a47aac05726 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sun, 24 Jan 2021 23:04:35 +0100
Subject: [PATCH 302/343] Python: Tests inspired by reverse read check

---
 .../experimental/dataflow/coverage/test.py    | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/python/ql/test/experimental/dataflow/coverage/test.py b/python/ql/test/experimental/dataflow/coverage/test.py
index 9b55a7c02d7..2510cc93a4b 100644
--- a/python/ql/test/experimental/dataflow/coverage/test.py
+++ b/python/ql/test/experimental/dataflow/coverage/test.py
@@ -591,3 +591,35 @@ def return_from_inner_scope(x):
 
 def test_return_from_inner_scope():
     SINK(return_from_inner_scope([]))  #$ flow="SOURCE, l:-3 -> return_from_inner_scope(..)"
+
+
+# Inspired by reverse read inconsistency check
+def insertAtA(d):
+    d["a"] = SOURCE
+
+def test_reverse_read_subscript():
+    d = {"a": NONSOURCE}
+    l = [d]
+    insertAtA(l[0])
+    SINK(d["a"])  #$ MISSING:flow="SOURCE, l-6 -> d['a']""
+
+def test_reverse_read_dict_arg():
+    d = {"a": NONSOURCE}
+    dd = {"d": d}
+    insertAtA(**dd)
+    SINK(d["a"])  #$ MISSING:flow="SOURCE, l-12 -> d['a']""
+
+
+class WithA:
+    def setA(self, v):
+        self.a = v
+
+    def __init__(self):
+        self.a = ""
+
+
+def test_reverse_read_subscript_cls():
+    withA = WithA()
+    l = [withA]
+    l[0].setA(SOURCE)
+    SINK(withA.a) #$ MISSING:flow="SOURCE, l:-1 -> self.a"

From ad39bfb2ff5c9b4945527d9b26ceb370ac963cf6 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Sun, 24 Jan 2021 16:17:34 +0100
Subject: [PATCH 303/343] Python: Add postupdate nodes for subscripts. This
 drops reverse read inconsistencies on saltstack from 14909 to 1353.

---
 .../src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll | 2 ++
 .../ql/test/experimental/dataflow/coverage/localFlow.expected   | 1 +
 2 files changed, 3 insertions(+)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
index 570c0396037..b36b897d68f 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
@@ -76,6 +76,8 @@ class ReadPreUpdateNode extends NeedsSyntheticPostUpdateNode, CfgNode {
       node = a.getObject().getAFlowNode() and
       a.getCtx() instanceof Load
     )
+    or
+    exists(SubscriptNode s | node = s.getObject())
   }
 
   override string label() { result = "read" }
diff --git a/python/ql/test/experimental/dataflow/coverage/localFlow.expected b/python/ql/test/experimental/dataflow/coverage/localFlow.expected
index f604e3d7b18..30b25979df3 100644
--- a/python/ql/test/experimental/dataflow/coverage/localFlow.expected
+++ b/python/ql/test/experimental/dataflow/coverage/localFlow.expected
@@ -8,6 +8,7 @@
 | test.py:187:1:187:53 | GSSA Variable SINK | test.py:189:5:189:8 | ControlFlowNode for SINK |
 | test.py:187:1:187:53 | GSSA Variable SOURCE | test.py:188:25:188:30 | ControlFlowNode for SOURCE |
 | test.py:188:5:188:5 | SSA variable x | test.py:189:10:189:10 | ControlFlowNode for x |
+| test.py:188:9:188:68 | ControlFlowNode for .0 | test.py:188:9:188:68 | SSA variable .0 |
 | test.py:188:9:188:68 | ControlFlowNode for ListComp | test.py:188:5:188:5 | SSA variable x |
 | test.py:188:9:188:68 | SSA variable .0 | test.py:188:9:188:68 | ControlFlowNode for .0 |
 | test.py:188:16:188:16 | SSA variable v | test.py:188:45:188:45 | ControlFlowNode for v |

From a8186be2fa47b649e3b37c7a86bbc692612baa04 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Mon, 25 Jan 2021 17:19:08 +0100
Subject: [PATCH 304/343] Python: Add test of type-tracking self in methods

---
 .../dataflow/typetracking/test.py             | 32 +++++++++++++++++++
 .../dataflow/typetracking/tracked.ql          | 29 +++++++++++++++++
 2 files changed, 61 insertions(+)

diff --git a/python/ql/test/experimental/dataflow/typetracking/test.py b/python/ql/test/experimental/dataflow/typetracking/test.py
index 432518327f5..b03a2e6912d 100644
--- a/python/ql/test/experimental/dataflow/typetracking/test.py
+++ b/python/ql/test/experimental/dataflow/typetracking/test.py
@@ -69,3 +69,35 @@ def redefine_test():
     expects_int(x) # $int
     x = str("Hello") # $str
     expects_string(x) # $str
+
+# ------------------------------------------------------------------------------
+# Tracking of self in methods
+# ------------------------------------------------------------------------------
+
+class Foo(object):
+
+    def meth1(self):
+        do_stuff(self)
+
+    def meth2(self): # $ MISSING: tracked_self
+        do_stuff(self) # $ MISSING: tracked_self
+
+    def meth3(self): # $ MISSING: tracked_self
+        do_stuff(self) # $ MISSING: tracked_self
+
+
+class Bar(Foo):
+
+    def meth1(self): # $ tracked_self
+        do_stuff(self) # $ tracked_self
+
+    def meth2(self):
+        do_stuff(self)
+
+    def meth3(self):
+        do_stuff(self)
+
+    def track_self(self): # $ tracked_self
+        self.meth1() # $ tracked_self
+        super().meth2()
+        super(Bar, self).foo3() # $ tracked_self
diff --git a/python/ql/test/experimental/dataflow/typetracking/tracked.ql b/python/ql/test/experimental/dataflow/typetracking/tracked.ql
index b145dd8f73f..4ce35a2d265 100644
--- a/python/ql/test/experimental/dataflow/typetracking/tracked.ql
+++ b/python/ql/test/experimental/dataflow/typetracking/tracked.ql
@@ -73,3 +73,32 @@ class TrackedStringTest extends InlineExpectationsTest {
     )
   }
 }
+
+DataFlow::Node tracked_self(TypeTracker t) {
+  t.start() and
+  exists(Function f |
+    f.isMethod() and
+    f.getName() = "track_self" and
+    result.(DataFlow::ParameterNode).getParameter() = f.getArg(0)
+  )
+  or
+  exists(TypeTracker t2 | result = tracked_self(t2).track(t2, t))
+}
+
+class TrackedSelfTest extends InlineExpectationsTest {
+  TrackedSelfTest() { this = "TrackedSelfTest" }
+
+  override string getARelevantTag() { result = "tracked_self" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(DataFlow::Node e, TypeTracker t |
+      e = tracked_self(t) and
+      // Module variables have no sensible location, and hence can't be annotated.
+      not e instanceof DataFlow::ModuleVariableNode and
+      tag = "tracked_self" and
+      location = e.getLocation() and
+      value = t.getAttr() and
+      element = e.toString()
+    )
+  }
+}

From 96b7f7590587a6c04d474ef9750148cc3f36163f Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Mon, 25 Jan 2021 17:34:49 +0100
Subject: [PATCH 305/343] Python: add postupdate nodes for kwargs drops
 remaining reverse read failures on saltstack.

---
 .../semmle/python/dataflow/new/internal/DataFlowPrivate.qll   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
index b36b897d68f..3dd31f4b97a 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
@@ -77,7 +77,9 @@ class ReadPreUpdateNode extends NeedsSyntheticPostUpdateNode, CfgNode {
       a.getCtx() instanceof Load
     )
     or
-    exists(SubscriptNode s | node = s.getObject())
+    node = any(SubscriptNode s).getObject()
+    or
+    node.getNode() = any(Call call).getKwargs()
   }
 
   override string label() { result = "read" }

From d1427fcd939eca75254fc738caa19c7fbd46c531 Mon Sep 17 00:00:00 2001
From: Joe Farebrother <joefarebrother@github.com>
Date: Thu, 5 Nov 2020 16:53:38 +0000
Subject: [PATCH 306/343] Java: Add modelling for Guava's collection classes

---
 .../java/frameworks/guava/Collections.qll     | 259 ++++++++++++++++++
 .../code/java/frameworks/guava/Guava.qll      |   1 +
 2 files changed, 260 insertions(+)
 create mode 100644 java/ql/src/semmle/code/java/frameworks/guava/Collections.qll

diff --git a/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll b/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll
new file mode 100644
index 00000000000..981ba64822b
--- /dev/null
+++ b/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll
@@ -0,0 +1,259 @@
+/** Defenitions of flow steps through the collection types in the Guava framework */
+
+import java
+private import semmle.code.java.dataflow.FlowSteps
+private import semmle.code.java.Collections
+
+private string guavaCollectPackage() { result = "com.google.common.collect" }
+
+/** A reference types that extends a parameterization of one of the various immutable container types. */
+private class ImmutableContainerType extends RefType {
+  string kind;
+
+  ImmutableContainerType() {
+    this.getASourceSupertype().hasQualifiedName(guavaCollectPackage(), kind) and
+    kind = ["ImmutableCollection", "ImmutableMap", "ImmutableMultimap", "ImmutableTable"]
+  }
+
+  /**
+   * Gets the name of the most general superclass of this type
+   * from among `ImmutableCollection`, `ImmutableMap`, `ImmutableMultimap`, and `ImmutableTable`.
+   */
+  string getKind() { result = kind }
+}
+
+/** A nested `Builder` class of one of the various immutable container classes */
+private class CollectionBuilder extends NestedType {
+  CollectionBuilder() {
+    this.hasName("Builder") and
+    this.getEnclosingType() instanceof ImmutableContainerType
+  }
+}
+
+private class BuilderBuildMethod extends TaintPreservingCallable {
+  BuilderBuildMethod() {
+    this.getDeclaringType().getASourceSupertype*() instanceof CollectionBuilder and
+    // abstract ImmutableCollection<E> build()
+    // similar for other builder types
+    this.hasName("build")
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = -1 }
+}
+
+/** A method on a `Builder` class that adds elements to the container being built */
+private class BuilderAddMethod extends TaintPreservingCallable {
+  int argument;
+
+  BuilderAddMethod() {
+    this.getDeclaringType().getASourceSupertype*() instanceof CollectionBuilder and
+    // @CanIgnoreReturnValue abstract ImmutableCollection.Builder<E> add(E element)
+    // @CanIgnoreReturnValue ImmutableCollection.Builder<E> add(E... elements)
+    // @CanIgnoreReturnValue ImmutableCollection.Builder<E> addAll(Iterable<? extends E> elements)
+    // @CanIgnoreReturnValue ImmutableCollection.Builder<E> addAll(Iterator<? extends E> elements)
+    // @CanIgnoreReturnValue ImmutableMultiset.Builder<E> addCopies(E element, int occurrences)
+    // @CanIgnoreReturnValue ImmutableMultiset.Builder<E> setCount(E element, int count)
+    this.hasName(["add", "addAll", "addCopies", "setCount"]) and
+    argument = 0
+    or
+    // @CanIgnoreReturnValue ImmutableMap.Builder<K,V> put(K key, V value)
+    // @CanIgnoreReturnValue ImmutableMap.Builder<K,V> put(Map.Entry<? extends K,? extends V> entry)
+    // @CanIgnoreReturnValue ImmutableMap.Builder<K,V> putAll(Map<? extends K,? extends V> map)
+    // @CanIgnoreReturnValue ImmutableMap.Builder<K,V> putAll(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
+    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> put(K key, V value)
+    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> put(Map.Entry<? extends K,? extends V> entry)
+    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> putAll(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
+    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> putAll(K key, Iterable<? extends V> values)
+    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> putAll(K key, V... values)
+    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> putAll(Multimap<? extends K,? extends V> multimap)
+    // @CanIgnoreReturnValue ImmutableTable.Builder<R,C,V> put(R rowKey, C columnKey, V value)
+    // @CanIgnoreReturnValue ImmutableTable.Builder<R,C,V> put(Table.Cell<? extends R,? extends C,? extends V> cell)
+    // @CanIgnoreReturnValue ImmutableTable.Builder<R,C,V> putAll(Table<? extends R,? extends C,? extends V> table)
+    this.hasName(["put", "putAll"]) and
+    argument = getNumberOfParameters() - 1
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = [-1, argument] }
+
+  override predicate transfersTaint(int src, int sink) { src = argument and sink = -1 }
+}
+
+/**
+ * A reference type that extends a parameterization of `com.google.common.collect.Multimap`.
+ */
+class MultimapType extends RefType {
+  MultimapType() { this.getASourceSupertype*().hasQualifiedName(guavaCollectPackage(), "Multimap") }
+
+  /** Gets the type of keys stored in this map. */
+  RefType getKeyType() {
+    exists(GenericInterface map | map.hasQualifiedName(guavaCollectPackage(), "Multimap") |
+      indirectlyInstantiates(this, map, 0, result)
+    )
+  }
+
+  /** Gets the type of values stored in this map. */
+  RefType getValueType() {
+    exists(GenericInterface map | map.hasQualifiedName(guavaCollectPackage(), "Multimap") |
+      indirectlyInstantiates(this, map, 1, result)
+    )
+  }
+}
+
+private class MultimapWriteMethod extends TaintPreservingCallable {
+  MultimapWriteMethod() {
+    this.getDeclaringType() instanceof MultimapType and
+    // @CanIgnoreReturnValue boolean put(@Nullable K key, @Nullable V value)
+    // @CanIgnoreReturnValue boolean putAll(@Nullable K key, Iterable<? extends V> values)
+    // @CanIgnoreReturnValue boolean putAll(Multimap<? extends K,? extends V> multimap)
+    // @CanIgnoreReturnValue Collection<V> replaceValues(@Nullable K key, Iterable<? extends V> values)
+    this.hasName(["put", "putAll", "replaceValues"])
+  }
+
+  override predicate transfersTaint(int src, int sink) {
+    src = getNumberOfParameters() - 1 and
+    sink = -1
+  }
+}
+
+private class MultimapReadMethod extends TaintPreservingCallable {
+  MultimapReadMethod() {
+    this.getDeclaringType() instanceof MultimapType and
+    // @CanIgnoreReturnValue Collection<V> replaceValues(@Nullable K key, Iterable<? extends V> values)
+    // @CanIgnoreReturnValue Collection<V> removeAll(@CompatibleWith("K") @Nullable Object key)
+    // Collection<V> get(@Nullable K key)
+    // Collection<V> values()
+    // Collection<Map.Entry<K,V>> entries()
+    // Map<K,Collection<V>> asMap()
+    this.hasName(["replaceValues", "removeAll", "get", "values", "entries", "asMap"])
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = -1 }
+  // Not implemented: Some of these methods return "views", which when modified will modify the map itself.
+  // However, taint flow from these views to the map is not implemented.
+}
+
+/**
+ * A reference type that extends a parameterization of `com.google.common.collect.Table`.
+ */
+class TableType extends RefType {
+  TableType() { this.getASourceSupertype*().hasQualifiedName(guavaCollectPackage(), "Table") }
+
+  /** Gets the type of row keys stored in this table. */
+  RefType getRowType() {
+    exists(GenericInterface table | table.hasQualifiedName(guavaCollectPackage(), "Table") |
+      indirectlyInstantiates(this, table, 0, result)
+    )
+  }
+
+  /** Gets the type of row keys stored in this table. */
+  RefType getColumnType() {
+    exists(GenericInterface table | table.hasQualifiedName(guavaCollectPackage(), "Table") |
+      indirectlyInstantiates(this, table, 1, result)
+    )
+  }
+
+  /** Gets the type of values stored in this table. */
+  RefType getValueType() {
+    exists(GenericInterface table | table.hasQualifiedName(guavaCollectPackage(), "Table") |
+      indirectlyInstantiates(this, table, 2, result)
+    )
+  }
+}
+
+private class TableWriteMethod extends TaintPreservingCallable {
+  TableWriteMethod() {
+    this.getDeclaringType() instanceof TableType and
+    // @CanIgnoreReturnValue @Nullable V put(R rowKey, C columnKey, V value)
+    // void putAll(Table<? extends R,? extends C,? extends V> table)
+    this.hasName(["put", "putAll"])
+  }
+
+  override predicate transfersTaint(int src, int sink) {
+    src = getNumberOfParameters() - 1 and
+    sink = -1
+  }
+}
+
+private class TableReadMethod extends TaintPreservingCallable {
+  TableReadMethod() {
+    this.getDeclaringType() instanceof TableType and
+    // @CanIgnoreReturnValue @Nullable V put(R rowKey, C columnKey, V value)
+    // @CanIgnoreReturnValue @Nullable V remove(@CompatibleWith("R") @Nullable Object rowKey, @CompatibleWith("C") @Nullable Object columnKey)
+    // @Nullable V get(@CompatibleWith("R") @Nullable Object rowKey, @CompatibleWith("C") @Nullable Object columnKey)
+    // Map<C,V> row(R rowKey)
+    // Map<R,V> column(C columnKey)
+    // Set<Table.Cell<R,C,V>> cellSet()
+    // Collection<V> values()
+    // Map<R,Map<C,V>> rowMap()
+    // Map<C,Map<R,V>> columnMap()
+    this
+        .hasName(["put", "remove", "get", "row", "column", "cellSet", "values", "rowMap",
+              "columnMap"])
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = -1 }
+  // Not implemented: Some of these methods return "views", which when modified will modify the table itself.
+  // However, taint flow from these views to the table is not implemented.
+}
+
+private class TableCellReadMethod extends TaintPreservingCallable {
+  TableCellReadMethod() {
+    exists(NestedType cell |
+      cell.getEnclosingType() instanceof TableType and
+      cell.hasName("Cell") and
+      this.getDeclaringType().getASourceSupertype*() = cell and
+      // @Nullable V getValue()
+      this.hasName("getValue")
+    )
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = -1 }
+}
+
+/**
+ * An `of` static method on the various immutable collection types.
+ */
+private class OfMethod extends TaintPreservingCallable {
+  string kind;
+
+  OfMethod() {
+    this.getDeclaringType().(ImmutableContainerType).getKind() = kind and
+    // static <E> ImmutableList<E> of(E e1, E e2, E e3, E e4, E e5, E e6)
+    // static <K,V> ImmutableMap<K,V> of(K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4)
+    // static <K,V> ImmutableMultimap<K,V> of(K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4)
+    // static <R,C,V> ImmutableTable<R,C,V> of(R rowKey, C columnKey, V value)
+    // etc for other types and numbers of parameters
+    this.hasName("of") and
+    this.isStatic()
+  }
+
+  override predicate returnsTaintFrom(int arg) {
+    arg = [0 .. getNumberOfParameters()] and
+    (kind.matches("%Map") implies arg % 2 = 1) and
+    (kind = "ImmutableTable" implies arg % 3 = 2)
+  }
+}
+
+/**
+ * A `copyOf` or `sortedCopyOf` static method on the varios immutable collection types.
+ */
+private class CopyOfMethod extends TaintPreservingCallable {
+  CopyOfMethod() {
+    this.getDeclaringType() instanceof ImmutableContainerType and
+    // static <E> ImmutableList<E> copyOf(E[] elements)
+    // static <E> ImmutableList<E> copyOf(Iterable<? extends E> elements)
+    // static <E> ImmutableList<E> copyOf(Collection<? extends E> elements)
+    // static <E> ImmutableList<E> copyOf(Iterator<? extends E> elements)
+    // static <E extends Comparable<? super E>> ImmutableList<E> sortedCopyOf(Iterable<? extends E> elements)
+    // static <E> ImmutableList<E> sortedCopyOf(Comparator<? super E> comparator, Iterable<? extends E> elements)
+    // static <K,V> ImmutableMap<K,V> copyOf(Map<? extends K,? extends V> map)
+    // static <K,V> ImmutableMap<K,V> copyOf(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
+    // static <K,V> ImmutableMultimap<K,V> copyOf(Multimap<? extends K,? extends V> multimap)
+    // static <K,V> ImmutableMultimap<K,V> copyOf(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
+    // static <R,C,V> ImmutableTable<R,C,V> copyOf  (Table<? extends R,? extends C,? extends V> table)
+    this.hasName(["copyOf", "sortedCopyOf"]) and
+    this.isStatic()
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = getNumberOfParameters() - 1 }
+}
diff --git a/java/ql/src/semmle/code/java/frameworks/guava/Guava.qll b/java/ql/src/semmle/code/java/frameworks/guava/Guava.qll
index 7278ff0277d..547a920d749 100644
--- a/java/ql/src/semmle/code/java/frameworks/guava/Guava.qll
+++ b/java/ql/src/semmle/code/java/frameworks/guava/Guava.qll
@@ -4,3 +4,4 @@
 
 import java
 import StringUtils
+import Collections

From 7e11d8ed078db10e0c40737db04b36b315566f9e Mon Sep 17 00:00:00 2001
From: Joe Farebrother <joefarebrother@github.com>
Date: Thu, 3 Dec 2020 15:49:13 +0000
Subject: [PATCH 307/343] Java: Add modelling for guava `Sets`

---
 .../java/frameworks/guava/Collections.qll     | 51 ++++++++++++++++++-
 1 file changed, 49 insertions(+), 2 deletions(-)

diff --git a/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll b/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll
index 981ba64822b..7b4d1728b57 100644
--- a/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll
+++ b/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll
@@ -187,8 +187,9 @@ private class TableReadMethod extends TaintPreservingCallable {
     // Map<R,Map<C,V>> rowMap()
     // Map<C,Map<R,V>> columnMap()
     this
-        .hasName(["put", "remove", "get", "row", "column", "cellSet", "values", "rowMap",
-              "columnMap"])
+        .hasName([
+            "put", "remove", "get", "row", "column", "cellSet", "values", "rowMap", "columnMap"
+          ])
   }
 
   override predicate returnsTaintFrom(int arg) { arg = -1 }
@@ -257,3 +258,49 @@ private class CopyOfMethod extends TaintPreservingCallable {
 
   override predicate returnsTaintFrom(int arg) { arg = getNumberOfParameters() - 1 }
 }
+
+/**
+ * A taint-preserving static method of `com.google.common.collect.Sets`.
+ */
+private class SetsMethod extends TaintPreservingCallable {
+  int arg;
+
+  SetsMethod() {
+    this.getDeclaringType().hasQualifiedName(guavaCollectPackage(), "Sets") and
+    this.isStatic() and
+    (
+      // static <E> HashSet<E> newHashSet(E... elements)
+      // static <E> Set<E> newConcurrentHashSet(Iterable<? extends E> elements)
+      // static <E> CopyOnWriteArraySet<E> newCopyOnWriteArraySet(Iterable<? extends E> elements)
+      // static <E extends Enum<E>>EnumSet<E> newEnumSet(Iterable<E> iterable, Class<E> elementType)
+      // etc
+      this.getName().matches("new%Set") and
+      arg = 0
+      or
+      // static <B> Set<List<B>> cartesianProduct(List<? extends Set<? extends B>> sets)
+      // static <B> Set<List<B>> cartesianProduct(Set<? extends B>... sets)
+      // static <E> Set<Set<E>> combinations(Set<E> set, int size)
+      // static <E> Sets.SetView<E> difference(Set<E> set1, Set<?> set2)
+      // static <E> NavigableSet<E> filter(NavigableSet<E> unfiltered, Predicate<? super E> predicate)
+      // static <E> Set<E> filter(Set<E> unfiltered, Predicate<? super E> predicate)
+      // static <E> SortedSet<E> filter(SortedSet<E> unfiltered, Predicate<? super E> predicate)
+      // static <E> Set<Set<E>> powerSet(Set<E> set)
+      // static <K extends Comparable<? super K>> NavigableSet<K>
+      // static <E> NavigableSet<E> synchronizedNavigableSet(NavigableSet<E> navigableSet)
+      // static <E> NavigableSet<E> unmodifiableNavigableSet(NavigableSet<E> set)
+      this
+          .hasName([
+              "cartesianProduct", "combinations", "difference", "filter", "powerSet", "subSet",
+              "synchronizedNavigableSet", "unmodifyableNavigableSet"
+            ]) and
+      arg = 0
+      or
+      // static <E> Sets.SetView<E> symmetricDifference(Set<? extends E> set1, Set<? extends E> set2)
+      // static <E> Sets.SetView<E> union(Set<? extends E> set1, Set<? extends E> set2)
+      this.hasName(["symmetricDifference", "union"]) and
+      arg = [0, 1]
+    )
+  }
+
+  override predicate returnsTaintFrom(int arg_) { arg_ = arg }
+}

From d69ecde5c13c26e04d08d880616a4d13126e7c9b Mon Sep 17 00:00:00 2001
From: Joe Farebrother <joefarebrother@github.com>
Date: Tue, 8 Dec 2020 15:44:59 +0000
Subject: [PATCH 308/343] Java: Add additional flow steps for guava collection
 methods and more unit tests

---
 .../java/frameworks/guava/Collections.qll     | 182 ++++++++++++------
 .../frameworks/guava/TestCollect.java         | 122 ++++++++++++
 .../guava/{Test.java => TestStrings.java}     |   2 +-
 .../frameworks/guava/flow.expected            |  69 +++++--
 .../com/google/common/base/Splitter.java      |   2 +-
 .../common/collect/AbstractMultimap.java      |  90 +++++++++
 .../google/common/collect/AbstractTable.java  |  90 +++++++++
 .../common/collect/ImmutableCollection.java   |  50 +++++
 .../google/common/collect/ImmutableList.java  | 101 ++++++++++
 .../google/common/collect/ImmutableMap.java   | 149 ++++++++++++++
 .../common/collect/ImmutableMultimap.java     | 128 ++++++++++++
 .../common/collect/ImmutableMultiset.java     | 125 ++++++++++++
 .../google/common/collect/ImmutableSet.java   |  86 +++++++++
 .../common/collect/ImmutableSortedMap.java    | 105 ++++++++++
 .../common/collect/ImmutableSortedSet.java    | 111 +++++++++++
 .../google/common/collect/ImmutableTable.java | 124 ++++++++++++
 .../com/google/common/collect/Multimap.java   |  65 +++++++
 .../com/google/common/collect/Multiset.java   |  49 +++++
 .../com/google/common/collect/Sets.java       |  93 +++++++++
 .../com/google/common/collect/Table.java      |  69 +++++++
 20 files changed, 1729 insertions(+), 83 deletions(-)
 create mode 100644 java/ql/test/library-tests/frameworks/guava/TestCollect.java
 rename java/ql/test/library-tests/frameworks/guava/{Test.java => TestStrings.java} (98%)
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/AbstractMultimap.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/AbstractTable.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableCollection.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableList.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMap.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMultimap.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMultiset.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSet.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSortedMap.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSortedSet.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableTable.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/Multimap.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/Multiset.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/Sets.java
 create mode 100644 java/ql/test/stubs/guava-30.0/com/google/common/collect/Table.java

diff --git a/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll b/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll
index 7b4d1728b57..58558b2ffc0 100644
--- a/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll
+++ b/java/ql/src/semmle/code/java/frameworks/guava/Collections.qll
@@ -1,17 +1,18 @@
-/** Defenitions of flow steps through the collection types in the Guava framework */
+/** Definitions of flow steps through the collection types in the Guava framework */
 
 import java
+private import semmle.code.java.dataflow.DataFlow
 private import semmle.code.java.dataflow.FlowSteps
 private import semmle.code.java.Collections
 
 private string guavaCollectPackage() { result = "com.google.common.collect" }
 
-/** A reference types that extends a parameterization of one of the various immutable container types. */
+/** A reference type that extends a parameterization of one of the various immutable container types. */
 private class ImmutableContainerType extends RefType {
   string kind;
 
   ImmutableContainerType() {
-    this.getASourceSupertype().hasQualifiedName(guavaCollectPackage(), kind) and
+    this.getSourceDeclaration().getASourceSupertype*().hasQualifiedName(guavaCollectPackage(), kind) and
     kind = ["ImmutableCollection", "ImmutableMap", "ImmutableMultimap", "ImmutableTable"]
   }
 
@@ -23,8 +24,8 @@ private class ImmutableContainerType extends RefType {
 }
 
 /** A nested `Builder` class of one of the various immutable container classes */
-private class CollectionBuilder extends NestedType {
-  CollectionBuilder() {
+private class ContainerBuilder extends NestedType {
+  ContainerBuilder() {
     this.hasName("Builder") and
     this.getEnclosingType() instanceof ImmutableContainerType
   }
@@ -32,7 +33,7 @@ private class CollectionBuilder extends NestedType {
 
 private class BuilderBuildMethod extends TaintPreservingCallable {
   BuilderBuildMethod() {
-    this.getDeclaringType().getASourceSupertype*() instanceof CollectionBuilder and
+    this.getDeclaringType().getASourceSupertype*() instanceof ContainerBuilder and
     // abstract ImmutableCollection<E> build()
     // similar for other builder types
     this.hasName("build")
@@ -46,31 +47,33 @@ private class BuilderAddMethod extends TaintPreservingCallable {
   int argument;
 
   BuilderAddMethod() {
-    this.getDeclaringType().getASourceSupertype*() instanceof CollectionBuilder and
-    // @CanIgnoreReturnValue abstract ImmutableCollection.Builder<E> add(E element)
-    // @CanIgnoreReturnValue ImmutableCollection.Builder<E> add(E... elements)
-    // @CanIgnoreReturnValue ImmutableCollection.Builder<E> addAll(Iterable<? extends E> elements)
-    // @CanIgnoreReturnValue ImmutableCollection.Builder<E> addAll(Iterator<? extends E> elements)
-    // @CanIgnoreReturnValue ImmutableMultiset.Builder<E> addCopies(E element, int occurrences)
-    // @CanIgnoreReturnValue ImmutableMultiset.Builder<E> setCount(E element, int count)
-    this.hasName(["add", "addAll", "addCopies", "setCount"]) and
-    argument = 0
-    or
-    // @CanIgnoreReturnValue ImmutableMap.Builder<K,V> put(K key, V value)
-    // @CanIgnoreReturnValue ImmutableMap.Builder<K,V> put(Map.Entry<? extends K,? extends V> entry)
-    // @CanIgnoreReturnValue ImmutableMap.Builder<K,V> putAll(Map<? extends K,? extends V> map)
-    // @CanIgnoreReturnValue ImmutableMap.Builder<K,V> putAll(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
-    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> put(K key, V value)
-    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> put(Map.Entry<? extends K,? extends V> entry)
-    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> putAll(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
-    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> putAll(K key, Iterable<? extends V> values)
-    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> putAll(K key, V... values)
-    // @CanIgnoreReturnValue ImmutableMultimap.Builder<K,V> putAll(Multimap<? extends K,? extends V> multimap)
-    // @CanIgnoreReturnValue ImmutableTable.Builder<R,C,V> put(R rowKey, C columnKey, V value)
-    // @CanIgnoreReturnValue ImmutableTable.Builder<R,C,V> put(Table.Cell<? extends R,? extends C,? extends V> cell)
-    // @CanIgnoreReturnValue ImmutableTable.Builder<R,C,V> putAll(Table<? extends R,? extends C,? extends V> table)
-    this.hasName(["put", "putAll"]) and
-    argument = getNumberOfParameters() - 1
+    this.getDeclaringType().getASourceSupertype*() instanceof ContainerBuilder and
+    (
+      // abstract ImmutableCollection.Builder<E> add(E element)
+      // ImmutableCollection.Builder<E> add(E... elements)
+      // ImmutableCollection.Builder<E> addAll(Iterable<? extends E> elements)
+      // ImmutableCollection.Builder<E> addAll(Iterator<? extends E> elements)
+      // ImmutableMultiset.Builder<E> addCopies(E element, int occurrences)
+      // ImmutableMultiset.Builder<E> setCount(E element, int count)
+      this.hasName(["add", "addAll", "addCopies", "setCount"]) and
+      argument = 0
+      or
+      // ImmutableMap.Builder<K,V> put(K key, V value)
+      // ImmutableMap.Builder<K,V> put(Map.Entry<? extends K,? extends V> entry)
+      // ImmutableMap.Builder<K,V> putAll(Map<? extends K,? extends V> map)
+      // ImmutableMap.Builder<K,V> putAll(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
+      // ImmutableMultimap.Builder<K,V> put(K key, V value)
+      // ImmutableMultimap.Builder<K,V> put(Map.Entry<? extends K,? extends V> entry)
+      // ImmutableMultimap.Builder<K,V> putAll(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
+      // ImmutableMultimap.Builder<K,V> putAll(K key, Iterable<? extends V> values)
+      // ImmutableMultimap.Builder<K,V> putAll(K key, V... values)
+      // ImmutableMultimap.Builder<K,V> putAll(Multimap<? extends K,? extends V> multimap)
+      // ImmutableTable.Builder<R,C,V> put(R rowKey, C columnKey, V value)
+      // ImmutableTable.Builder<R,C,V> put(Table.Cell<? extends R,? extends C,? extends V> cell)
+      // ImmutableTable.Builder<R,C,V> putAll(Table<? extends R,? extends C,? extends V> table)
+      this.hasName(["put", "putAll"]) and
+      argument = getNumberOfParameters() - 1
+    )
   }
 
   override predicate returnsTaintFrom(int arg) { arg = [-1, argument] }
@@ -78,11 +81,35 @@ private class BuilderAddMethod extends TaintPreservingCallable {
   override predicate transfersTaint(int src, int sink) { src = argument and sink = -1 }
 }
 
+/**
+ * In a chained call `b.add(x).add(y).add(z)`, represents a flow step from the return value of
+ * this expression to the post update node of `b` (valid because the builder add methods return their qualifier).
+ * This is sufficient to express flow from `y` and `z` to `b`.
+ */
+private class ChainedBuilderAddStep extends AdditionalTaintStep {
+  override predicate step(DataFlow::Node src, DataFlow::Node sink) {
+    exists(MethodAccess ma |
+      ma.getMethod() instanceof BuilderAddMethod and
+      src.asExpr() = ma and
+      chainedBuilderMethod+(sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr()) = ma
+    )
+  }
+}
+
+private MethodAccess chainedBuilderMethod(Expr e) {
+  result.getQualifier() = e and
+  result.getMethod() instanceof BuilderAddMethod
+}
+
 /**
  * A reference type that extends a parameterization of `com.google.common.collect.Multimap`.
  */
 class MultimapType extends RefType {
-  MultimapType() { this.getASourceSupertype*().hasQualifiedName(guavaCollectPackage(), "Multimap") }
+  MultimapType() {
+    this.getSourceDeclaration()
+        .getASourceSupertype*()
+        .hasQualifiedName(guavaCollectPackage(), "Multimap")
+  }
 
   /** Gets the type of keys stored in this map. */
   RefType getKeyType() {
@@ -102,10 +129,10 @@ class MultimapType extends RefType {
 private class MultimapWriteMethod extends TaintPreservingCallable {
   MultimapWriteMethod() {
     this.getDeclaringType() instanceof MultimapType and
-    // @CanIgnoreReturnValue boolean put(@Nullable K key, @Nullable V value)
-    // @CanIgnoreReturnValue boolean putAll(@Nullable K key, Iterable<? extends V> values)
-    // @CanIgnoreReturnValue boolean putAll(Multimap<? extends K,? extends V> multimap)
-    // @CanIgnoreReturnValue Collection<V> replaceValues(@Nullable K key, Iterable<? extends V> values)
+    // boolean put(K key, V value)
+    // boolean putAll(K key, Iterable<? extends V> values)
+    // boolean putAll(Multimap<? extends K,? extends V> multimap)
+    // Collection<V> replaceValues(K key, Iterable<? extends V> values)
     this.hasName(["put", "putAll", "replaceValues"])
   }
 
@@ -118,9 +145,9 @@ private class MultimapWriteMethod extends TaintPreservingCallable {
 private class MultimapReadMethod extends TaintPreservingCallable {
   MultimapReadMethod() {
     this.getDeclaringType() instanceof MultimapType and
-    // @CanIgnoreReturnValue Collection<V> replaceValues(@Nullable K key, Iterable<? extends V> values)
-    // @CanIgnoreReturnValue Collection<V> removeAll(@CompatibleWith("K") @Nullable Object key)
-    // Collection<V> get(@Nullable K key)
+    // Collection<V> replaceValues(K key, Iterable<? extends V> values)
+    // Collection<V> removeAll(@CompatibleWith("K") Object key)
+    // Collection<V> get(K key)
     // Collection<V> values()
     // Collection<Map.Entry<K,V>> entries()
     // Map<K,Collection<V>> asMap()
@@ -136,7 +163,11 @@ private class MultimapReadMethod extends TaintPreservingCallable {
  * A reference type that extends a parameterization of `com.google.common.collect.Table`.
  */
 class TableType extends RefType {
-  TableType() { this.getASourceSupertype*().hasQualifiedName(guavaCollectPackage(), "Table") }
+  TableType() {
+    this.getSourceDeclaration()
+        .getASourceSupertype*()
+        .hasQualifiedName(guavaCollectPackage(), "Table")
+  }
 
   /** Gets the type of row keys stored in this table. */
   RefType getRowType() {
@@ -145,7 +176,7 @@ class TableType extends RefType {
     )
   }
 
-  /** Gets the type of row keys stored in this table. */
+  /** Gets the type of column keys stored in this table. */
   RefType getColumnType() {
     exists(GenericInterface table | table.hasQualifiedName(guavaCollectPackage(), "Table") |
       indirectlyInstantiates(this, table, 1, result)
@@ -163,7 +194,7 @@ class TableType extends RefType {
 private class TableWriteMethod extends TaintPreservingCallable {
   TableWriteMethod() {
     this.getDeclaringType() instanceof TableType and
-    // @CanIgnoreReturnValue @Nullable V put(R rowKey, C columnKey, V value)
+    // V put(R rowKey, C columnKey, V value)
     // void putAll(Table<? extends R,? extends C,? extends V> table)
     this.hasName(["put", "putAll"])
   }
@@ -177,19 +208,18 @@ private class TableWriteMethod extends TaintPreservingCallable {
 private class TableReadMethod extends TaintPreservingCallable {
   TableReadMethod() {
     this.getDeclaringType() instanceof TableType and
-    // @CanIgnoreReturnValue @Nullable V put(R rowKey, C columnKey, V value)
-    // @CanIgnoreReturnValue @Nullable V remove(@CompatibleWith("R") @Nullable Object rowKey, @CompatibleWith("C") @Nullable Object columnKey)
-    // @Nullable V get(@CompatibleWith("R") @Nullable Object rowKey, @CompatibleWith("C") @Nullable Object columnKey)
+    // V put(R rowKey, C columnKey, V value)
+    // V remove(@CompatibleWith("R") Object rowKey, @CompatibleWith("C") Object columnKey)
+    // V get(@CompatibleWith("R") Object rowKey, @CompatibleWith("C") Object columnKey)
     // Map<C,V> row(R rowKey)
     // Map<R,V> column(C columnKey)
     // Set<Table.Cell<R,C,V>> cellSet()
     // Collection<V> values()
     // Map<R,Map<C,V>> rowMap()
     // Map<C,Map<R,V>> columnMap()
-    this
-        .hasName([
-            "put", "remove", "get", "row", "column", "cellSet", "values", "rowMap", "columnMap"
-          ])
+    this.hasName([
+        "put", "remove", "get", "row", "column", "cellSet", "values", "rowMap", "columnMap"
+      ])
   }
 
   override predicate returnsTaintFrom(int arg) { arg = -1 }
@@ -202,8 +232,8 @@ private class TableCellReadMethod extends TaintPreservingCallable {
     exists(NestedType cell |
       cell.getEnclosingType() instanceof TableType and
       cell.hasName("Cell") and
-      this.getDeclaringType().getASourceSupertype*() = cell and
-      // @Nullable V getValue()
+      this.getDeclaringType().getSourceDeclaration().getASourceSupertype*() = cell and
+      // V getValue()
       this.hasName("getValue")
     )
   }
@@ -212,7 +242,7 @@ private class TableCellReadMethod extends TaintPreservingCallable {
 }
 
 /**
- * An `of` static method on the various immutable collection types.
+ * An `of` static method on the various immutable container types.
  */
 private class OfMethod extends TaintPreservingCallable {
   string kind;
@@ -230,13 +260,17 @@ private class OfMethod extends TaintPreservingCallable {
 
   override predicate returnsTaintFrom(int arg) {
     arg = [0 .. getNumberOfParameters()] and
-    (kind.matches("%Map") implies arg % 2 = 1) and
+    (kind.regexpMatch(".*[Mm]ap") implies arg % 2 = 1) and
     (kind = "ImmutableTable" implies arg % 3 = 2)
   }
 }
 
+private class ComparatorType extends RefType {
+  ComparatorType() { this.getASourceSupertype*().hasQualifiedName("java.util", "Comparator") }
+}
+
 /**
- * A `copyOf` or `sortedCopyOf` static method on the varios immutable collection types.
+ * A `copyOf`, `sortedCopyOf`, or `copyOfSorted` static method on the various immutable container types.
  */
 private class CopyOfMethod extends TaintPreservingCallable {
   CopyOfMethod() {
@@ -251,12 +285,34 @@ private class CopyOfMethod extends TaintPreservingCallable {
     // static <K,V> ImmutableMap<K,V> copyOf(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
     // static <K,V> ImmutableMultimap<K,V> copyOf(Multimap<? extends K,? extends V> multimap)
     // static <K,V> ImmutableMultimap<K,V> copyOf(Iterable<? extends Map.Entry<? extends K,? extends V>> entries)
-    // static <R,C,V> ImmutableTable<R,C,V> copyOf  (Table<? extends R,? extends C,? extends V> table)
-    this.hasName(["copyOf", "sortedCopyOf"]) and
+    // static <R,C,V> ImmutableTable<R,C,V> copyOf(Table<? extends R,? extends C,? extends V> table)
+    // static <K, V> ImmutableSortedMap<K, V> copyOf(Map<? extends K, ? extends V> map)
+    // static <K, V> ImmutableSortedMap<K, V> copyOf(Map<? extends K, ? extends V> map, Comparator<? super K> comparator)
+    // static <K, V> ImmutableSortedMap<K, V> copyOfSorted(SortedMap<K, ? extends V> map)
+    // static <E> ImmutableSortedSet<E> copyOf(Iterator<? extends E> elements)
+    // static <E> ImmutableSortedSet<E> copyOf(Comparator<? super E> comparator, Iterator<? extends E> elements)
+    // static <E> ImmutableSortedSet<E> copyOfSorted(SortedSet<E> sortedSet)
+    // etc
+    this.hasName(["copyOf", "sortedCopyOf", "copyOfSorted"]) and
     this.isStatic()
   }
 
-  override predicate returnsTaintFrom(int arg) { arg = getNumberOfParameters() - 1 }
+  override predicate returnsTaintFrom(int arg) {
+    arg = [0 .. getNumberOfParameters()] and
+    not getParameterType(arg) instanceof ComparatorType
+  }
+}
+
+private class CollectionAsListMethod extends TaintPreservingCallable {
+  CollectionAsListMethod() {
+    this.getDeclaringType()
+        .getASourceSupertype*()
+        .hasQualifiedName(guavaCollectPackage(), "ImmutableCollection") and
+    // public ImmutableList<E> asList()
+    this.hasName("asList")
+  }
+
+  override predicate returnsTaintFrom(int arg) { arg = -1 }
 }
 
 /**
@@ -272,7 +328,6 @@ private class SetsMethod extends TaintPreservingCallable {
       // static <E> HashSet<E> newHashSet(E... elements)
       // static <E> Set<E> newConcurrentHashSet(Iterable<? extends E> elements)
       // static <E> CopyOnWriteArraySet<E> newCopyOnWriteArraySet(Iterable<? extends E> elements)
-      // static <E extends Enum<E>>EnumSet<E> newEnumSet(Iterable<E> iterable, Class<E> elementType)
       // etc
       this.getName().matches("new%Set") and
       arg = 0
@@ -285,14 +340,13 @@ private class SetsMethod extends TaintPreservingCallable {
       // static <E> Set<E> filter(Set<E> unfiltered, Predicate<? super E> predicate)
       // static <E> SortedSet<E> filter(SortedSet<E> unfiltered, Predicate<? super E> predicate)
       // static <E> Set<Set<E>> powerSet(Set<E> set)
-      // static <K extends Comparable<? super K>> NavigableSet<K>
+      // static <K extends Comparable<? super K>> NavigableSet<K> subSet(NavigableSet<K> set, Range<K> range)
       // static <E> NavigableSet<E> synchronizedNavigableSet(NavigableSet<E> navigableSet)
       // static <E> NavigableSet<E> unmodifiableNavigableSet(NavigableSet<E> set)
-      this
-          .hasName([
-              "cartesianProduct", "combinations", "difference", "filter", "powerSet", "subSet",
-              "synchronizedNavigableSet", "unmodifyableNavigableSet"
-            ]) and
+      this.hasName([
+          "cartesianProduct", "combinations", "difference", "filter", "powerSet", "subSet",
+          "synchronizedNavigableSet", "unmodifyableNavigableSet"
+        ]) and
       arg = 0
       or
       // static <E> Sets.SetView<E> symmetricDifference(Set<? extends E> set1, Set<? extends E> set2)
diff --git a/java/ql/test/library-tests/frameworks/guava/TestCollect.java b/java/ql/test/library-tests/frameworks/guava/TestCollect.java
new file mode 100644
index 00000000000..c5f01f2d2d1
--- /dev/null
+++ b/java/ql/test/library-tests/frameworks/guava/TestCollect.java
@@ -0,0 +1,122 @@
+package com.google.common.collect;
+
+import java.util.Map;
+import java.util.SortedSet;
+import java.util.SortedMap;
+import java.util.Comparator;
+
+class TestCollect {
+    String taint() { return "tainted"; }
+
+    void sink(Object o) {}
+
+    void test1() {
+        String x = taint();
+
+        ImmutableSet<String> xs = ImmutableSet.of(x, "y", "z");
+        sink(xs.asList());
+
+        ImmutableSet<String> ys = ImmutableSet.of("a", "b", "c");
+
+        sink(Sets.filter(Sets.union(xs, ys), y -> true));
+
+        sink(Sets.newHashSet("a", "b", "c", "d", x));
+    }
+
+    void test2() {
+        sink(ImmutableList.of(taint(), taint(), taint(), taint())); // expect 4 alerts
+        sink(ImmutableMap.of(taint(), taint(), taint(), taint())); // expect 2 alerts
+        sink(ImmutableMultimap.of(taint(), taint(), taint(), taint())); // expect 2 alerts
+        sink(ImmutableTable.of(taint(),taint(), taint())); // expect 1 alert
+    }
+
+    void test3() {
+        String x = taint();
+
+        ImmutableList.Builder<String> b = ImmutableList.builder();
+
+        b.add("a");
+        sink(b);
+        b.add(x);
+        sink(b.build());
+
+        b = ImmutableList.builder();
+
+        b.add("a").add(x);
+        sink(b.build());
+
+        sink(ImmutableList.builder().add("a").add(x).build());
+
+        ImmutableMap.Builder<String, String> b2 = ImmutableMap.builder();
+        b2.put(x,"v");
+        sink(b2);
+        b2.put("k",x);
+        sink(b2.build());
+    }
+
+    void test4(Table<String, String, String> t1, Table<String, String, String> t2, Table<String, String, String> t3) {
+        String x = taint();
+        t1.put(x, "c", "v");
+        sink(t1);
+        t1.put("r", x, "v");
+        sink(t1);
+        t1.put("r", "c", x);
+        sink(t1);
+        sink(t1.row("r"));
+        
+        t2.putAll(t1);
+        for (Table.Cell<String,String,String> c : t2.cellSet()) {
+            sink(c.getValue());
+        }
+
+        sink(t1.remove("r", "c"));
+
+        t3.row("r").put("c", x);
+        sink(t3); // Not detected
+    }
+
+    void test4(Multimap<String, String> m1, Multimap<String, String> m2, Multimap<String, String> m3, 
+           Multimap<String, String> m4, Multimap<String, String> m5){
+        String x = taint();
+        m1.put("k", x);
+        sink(m1);
+        sink(m1.get("k"));
+
+        m2.putAll("k", ImmutableList.of("a", x, "b"));
+        sink(m2);
+
+        m3.putAll(m1);
+        sink(m3);
+
+        m4.replaceValues("k", m1.replaceValues("k", ImmutableList.of("a")));
+        for (Map.Entry<String, String> e : m4.entries()) {
+            sink(e.getValue());
+        }
+
+        m5.asMap().get("k").add(x);
+        sink(m5); // Not detected
+    }
+
+    void test5(Comparator<String> comp, SortedSet<String> sorS, SortedMap<String, String> sorM) {
+        ImmutableSortedSet<String> s = ImmutableSortedSet.of(taint());
+
+        sink(s);
+        sink(ImmutableSortedSet.copyOf(s));
+        sink(ImmutableSortedSet.copyOf(comp, s));
+
+        sorS.add(taint());
+        sink(ImmutableSortedSet.copyOfSorted(sorS));
+
+        sink(ImmutableList.sortedCopyOf(s));
+        sink(ImmutableList.sortedCopyOf(comp, s));
+
+        ImmutableSortedMap<String, String> m = ImmutableSortedMap.of("k", taint());
+
+        sink(m);
+        sink(ImmutableSortedMap.copyOf(m));
+        sink(ImmutableSortedMap.copyOf(m, comp));
+
+        sorM.put("k", taint());
+        sink(ImmutableSortedMap.copyOfSorted(sorM));
+    }
+}
\ No newline at end of file
diff --git a/java/ql/test/library-tests/frameworks/guava/Test.java b/java/ql/test/library-tests/frameworks/guava/TestStrings.java
similarity index 98%
rename from java/ql/test/library-tests/frameworks/guava/Test.java
rename to java/ql/test/library-tests/frameworks/guava/TestStrings.java
index da64ea30083..e85cb0bc965 100644
--- a/java/ql/test/library-tests/frameworks/guava/Test.java
+++ b/java/ql/test/library-tests/frameworks/guava/TestStrings.java
@@ -6,7 +6,7 @@ import com.google.common.base.Joiner;
 import java.util.Map;
 import java.util.HashMap;
 
-class Test {
+class TestStrings {
     String taint() { return "tainted"; }
 
     void sink(Object o) {}
diff --git a/java/ql/test/library-tests/frameworks/guava/flow.expected b/java/ql/test/library-tests/frameworks/guava/flow.expected
index 809dcfd6f84..52276485cf9 100644
--- a/java/ql/test/library-tests/frameworks/guava/flow.expected
+++ b/java/ql/test/library-tests/frameworks/guava/flow.expected
@@ -1,17 +1,52 @@
-| Test.java:15:20:15:26 | taint(...) | Test.java:17:14:17:41 | padStart(...) |
-| Test.java:15:20:15:26 | taint(...) | Test.java:18:14:18:39 | padEnd(...) |
-| Test.java:15:20:15:26 | taint(...) | Test.java:19:14:19:33 | repeat(...) |
-| Test.java:15:20:15:26 | taint(...) | Test.java:20:14:20:56 | emptyToNull(...) |
-| Test.java:15:20:15:26 | taint(...) | Test.java:21:14:21:40 | lenientFormat(...) |
-| Test.java:15:20:15:26 | taint(...) | Test.java:24:14:24:51 | lenientFormat(...) |
-| Test.java:28:20:28:26 | taint(...) | Test.java:32:14:32:23 | split(...) |
-| Test.java:28:20:28:26 | taint(...) | Test.java:33:14:33:29 | splitToList(...) |
-| Test.java:28:20:28:26 | taint(...) | Test.java:35:14:35:50 | split(...) |
-| Test.java:39:20:39:26 | taint(...) | Test.java:46:14:46:54 | appendTo(...) |
-| Test.java:39:20:39:26 | taint(...) | Test.java:47:14:47:26 | toString(...) |
-| Test.java:39:20:39:26 | taint(...) | Test.java:48:14:48:51 | appendTo(...) |
-| Test.java:39:20:39:26 | taint(...) | Test.java:49:14:49:26 | toString(...) |
-| Test.java:39:20:39:26 | taint(...) | Test.java:52:14:52:42 | appendTo(...) |
-| Test.java:39:20:39:26 | taint(...) | Test.java:57:14:57:56 | join(...) |
-| Test.java:39:20:39:26 | taint(...) | Test.java:58:14:58:82 | join(...) |
-| Test.java:39:20:39:26 | taint(...) | Test.java:60:14:60:58 | join(...) |
+| TestCollect.java:14:20:14:26 | taint(...) | TestCollect.java:17:14:17:24 | asList(...) |
+| TestCollect.java:14:20:14:26 | taint(...) | TestCollect.java:21:14:21:55 | filter(...) |
+| TestCollect.java:14:20:14:26 | taint(...) | TestCollect.java:23:14:23:51 | newHashSet(...) |
+| TestCollect.java:27:31:27:37 | taint(...) | TestCollect.java:27:14:27:65 | of(...) |
+| TestCollect.java:27:40:27:46 | taint(...) | TestCollect.java:27:14:27:65 | of(...) |
+| TestCollect.java:27:49:27:55 | taint(...) | TestCollect.java:27:14:27:65 | of(...) |
+| TestCollect.java:27:58:27:64 | taint(...) | TestCollect.java:27:14:27:65 | of(...) |
+| TestCollect.java:28:39:28:45 | taint(...) | TestCollect.java:28:14:28:64 | of(...) |
+| TestCollect.java:28:57:28:63 | taint(...) | TestCollect.java:28:14:28:64 | of(...) |
+| TestCollect.java:29:44:29:50 | taint(...) | TestCollect.java:29:14:29:69 | of(...) |
+| TestCollect.java:29:62:29:68 | taint(...) | TestCollect.java:29:14:29:69 | of(...) |
+| TestCollect.java:30:49:30:55 | taint(...) | TestCollect.java:30:14:30:56 | of(...) |
+| TestCollect.java:34:20:34:26 | taint(...) | TestCollect.java:41:14:41:22 | build(...) |
+| TestCollect.java:34:20:34:26 | taint(...) | TestCollect.java:46:14:46:22 | build(...) |
+| TestCollect.java:34:20:34:26 | taint(...) | TestCollect.java:48:14:48:60 | build(...) |
+| TestCollect.java:34:20:34:26 | taint(...) | TestCollect.java:54:14:54:23 | build(...) |
+| TestCollect.java:58:20:58:26 | taint(...) | TestCollect.java:64:14:64:15 | t1 |
+| TestCollect.java:58:20:58:26 | taint(...) | TestCollect.java:65:14:65:24 | row(...) |
+| TestCollect.java:58:20:58:26 | taint(...) | TestCollect.java:69:18:69:29 | getValue(...) |
+| TestCollect.java:58:20:58:26 | taint(...) | TestCollect.java:72:14:72:32 | remove(...) |
+| TestCollect.java:80:20:80:26 | taint(...) | TestCollect.java:82:14:82:15 | m1 |
+| TestCollect.java:80:20:80:26 | taint(...) | TestCollect.java:83:14:83:24 | get(...) |
+| TestCollect.java:80:20:80:26 | taint(...) | TestCollect.java:86:14:86:15 | m2 |
+| TestCollect.java:80:20:80:26 | taint(...) | TestCollect.java:89:14:89:15 | m3 |
+| TestCollect.java:80:20:80:26 | taint(...) | TestCollect.java:93:18:93:29 | getValue(...) |
+| TestCollect.java:101:62:101:68 | taint(...) | TestCollect.java:103:14:103:14 | s |
+| TestCollect.java:101:62:101:68 | taint(...) | TestCollect.java:104:14:104:41 | copyOf(...) |
+| TestCollect.java:101:62:101:68 | taint(...) | TestCollect.java:105:14:105:47 | copyOf(...) |
+| TestCollect.java:101:62:101:68 | taint(...) | TestCollect.java:110:14:110:42 | sortedCopyOf(...) |
+| TestCollect.java:101:62:101:68 | taint(...) | TestCollect.java:111:14:111:48 | sortedCopyOf(...) |
+| TestCollect.java:107:18:107:24 | taint(...) | TestCollect.java:108:14:108:50 | copyOfSorted(...) |
+| TestCollect.java:113:75:113:81 | taint(...) | TestCollect.java:115:14:115:14 | m |
+| TestCollect.java:113:75:113:81 | taint(...) | TestCollect.java:116:14:116:41 | copyOf(...) |
+| TestCollect.java:113:75:113:81 | taint(...) | TestCollect.java:117:14:117:47 | copyOf(...) |
+| TestCollect.java:119:23:119:29 | taint(...) | TestCollect.java:120:14:120:50 | copyOfSorted(...) |
+| TestStrings.java:15:20:15:26 | taint(...) | TestStrings.java:17:14:17:41 | padStart(...) |
+| TestStrings.java:15:20:15:26 | taint(...) | TestStrings.java:18:14:18:39 | padEnd(...) |
+| TestStrings.java:15:20:15:26 | taint(...) | TestStrings.java:19:14:19:33 | repeat(...) |
+| TestStrings.java:15:20:15:26 | taint(...) | TestStrings.java:20:14:20:56 | emptyToNull(...) |
+| TestStrings.java:15:20:15:26 | taint(...) | TestStrings.java:21:14:21:40 | lenientFormat(...) |
+| TestStrings.java:15:20:15:26 | taint(...) | TestStrings.java:24:14:24:51 | lenientFormat(...) |
+| TestStrings.java:28:20:28:26 | taint(...) | TestStrings.java:32:14:32:23 | split(...) |
+| TestStrings.java:28:20:28:26 | taint(...) | TestStrings.java:33:14:33:29 | splitToList(...) |
+| TestStrings.java:28:20:28:26 | taint(...) | TestStrings.java:35:14:35:50 | split(...) |
+| TestStrings.java:39:20:39:26 | taint(...) | TestStrings.java:46:14:46:54 | appendTo(...) |
+| TestStrings.java:39:20:39:26 | taint(...) | TestStrings.java:47:14:47:26 | toString(...) |
+| TestStrings.java:39:20:39:26 | taint(...) | TestStrings.java:48:14:48:51 | appendTo(...) |
+| TestStrings.java:39:20:39:26 | taint(...) | TestStrings.java:49:14:49:26 | toString(...) |
+| TestStrings.java:39:20:39:26 | taint(...) | TestStrings.java:52:14:52:42 | appendTo(...) |
+| TestStrings.java:39:20:39:26 | taint(...) | TestStrings.java:57:14:57:56 | join(...) |
+| TestStrings.java:39:20:39:26 | taint(...) | TestStrings.java:58:14:58:82 | join(...) |
+| TestStrings.java:39:20:39:26 | taint(...) | TestStrings.java:60:14:60:58 | join(...) |
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/base/Splitter.java b/java/ql/test/stubs/guava-30.0/com/google/common/base/Splitter.java
index 379ff766dbc..521b6a605a5 100644
--- a/java/ql/test/stubs/guava-30.0/com/google/common/base/Splitter.java
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/base/Splitter.java
@@ -25,7 +25,7 @@ public final class Splitter {
   }
 
   public Splitter omitEmptyStrings() {
-    return null;;
+    return null;
   }
 
   public Iterable<String> split(final CharSequence sequence) {
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/AbstractMultimap.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/AbstractMultimap.java
new file mode 100644
index 00000000000..0b9120bfd8b
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/AbstractMultimap.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2012 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Collection;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.Set;
+
+abstract class AbstractMultimap<K, V> implements Multimap<K, V> {
+  @Override
+  public boolean isEmpty() {
+    return false;
+  }
+
+  @Override
+  public boolean containsValue(Object value) {
+    return false;
+  }
+
+  @Override
+  public boolean containsEntry(Object key, Object value) {
+    return false;
+  }
+
+  @Override
+  public boolean remove(Object key, Object value) {
+    return false;
+  }
+
+  @Override
+  public boolean put(K key, V value) {
+    return false;
+  }
+
+  @Override
+  public boolean putAll(K key, Iterable<? extends V> values) {
+    return false;
+  }
+
+  @Override
+  public boolean putAll(Multimap<? extends K, ? extends V> multimap) {
+    return false;
+  }
+
+  @Override
+  public Collection<V> replaceValues(K key, Iterable<? extends V> values) {
+    return null;
+  }
+
+  @Override
+  public Collection<Entry<K, V>> entries() {
+    return null;
+  }
+
+  @Override
+  public Set<K> keySet() {
+    return null;
+  }
+
+  @Override
+  public Multiset<K> keys() {
+    return null;
+  }
+
+  @Override
+  public Collection<V> values() {
+    return null;
+  }
+
+  @Override
+  public Map<K, Collection<V>> asMap() {
+    return null;
+  }
+
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/AbstractTable.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/AbstractTable.java
new file mode 100644
index 00000000000..9003783bab9
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/AbstractTable.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2013 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Collection;
+import java.util.Map;
+import java.util.Set;
+
+abstract class AbstractTable<R, C, V> implements Table<R, C, V> {
+  @Override
+  public boolean containsRow(Object rowKey) {
+    return false;
+  }
+
+  @Override
+  public boolean containsColumn(Object columnKey) {
+    return false;
+  }
+
+  @Override
+  public Set<R> rowKeySet() {
+    return null;
+  }
+
+  @Override
+  public Set<C> columnKeySet() {
+    return null;
+  }
+
+  @Override
+  public boolean containsValue(Object value) {
+    return false;
+  }
+
+  @Override
+  public boolean contains(Object rowKey, Object columnKey) {
+    return false;
+  }
+
+  @Override
+  public V get(Object rowKey, Object columnKey) {
+    return null;
+  }
+
+  @Override
+  public boolean isEmpty() {
+    return false;
+  }
+
+  @Override
+  public void clear() {
+  }
+
+  @Override
+  public V remove(Object rowKey, Object columnKey) {
+    return null;
+  }
+
+  @Override
+  public V put(R rowKey, C columnKey, V value) {
+    return null;
+  }
+
+  @Override
+  public void putAll(Table<? extends R, ? extends C, ? extends V> table) {
+  }
+
+  @Override
+  public Set<Cell<R, C, V>> cellSet() {
+    return null;
+  }
+
+  @Override
+  public Collection<V> values() {
+    return null;
+  }
+
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableCollection.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableCollection.java
new file mode 100644
index 00000000000..670016cdab6
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableCollection.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2008 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.io.Serializable;
+import java.util.AbstractCollection;
+import java.util.Collection;
+import java.util.Iterator;
+
+public abstract class ImmutableCollection<E> extends AbstractCollection<E> implements Serializable {
+  ImmutableCollection() {}
+  
+  public ImmutableList<E> asList() {
+    return null;
+  }
+
+  public abstract static class Builder<E> {
+    Builder() {}
+
+    public abstract Builder<E> add(E element);
+
+    public Builder<E> add(E... elements) {
+      return null;
+    }
+
+    public Builder<E> addAll(Iterable<? extends E> elements) {
+      return null;
+    }
+
+    public Builder<E> addAll(Iterator<? extends E> elements) {
+      return null;
+    }
+
+    public abstract ImmutableCollection<E> build();
+  }
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableList.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableList.java
new file mode 100644
index 00000000000..3e4fcf39d0a
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableList.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2007 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.Iterator;
+import java.util.List;
+
+public abstract class ImmutableList<E> extends ImmutableCollection<E>
+    implements List<E>{
+
+  public static <E> ImmutableList<E> of() {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> of(E element) {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> of(E e1, E e2) {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> of(E e1, E e2, E e3) {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> of(E e1, E e2, E e3, E e4) {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> of(
+      E e1, E e2, E e3, E e4, E e5, E e6, E e7, E e8, E e9, E e10, E e11, E e12, E... others) {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> copyOf(Iterable<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> copyOf(Collection<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> copyOf(Iterator<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> copyOf(E[] elements) {
+    return null;
+  }
+
+  public static <E extends Comparable<? super E>> ImmutableList<E> sortedCopyOf(
+      Iterable<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableList<E> sortedCopyOf(
+      Comparator<? super E> comparator, Iterable<? extends E> elements) {
+    return null;
+  }
+
+  ImmutableList() {}
+
+  public ImmutableList<E> reverse() {
+    return null;
+  }
+
+  public static <E> Builder<E> builder() {
+    return null;
+  }
+
+  public static final class Builder<E> extends ImmutableCollection.Builder<E> {
+    @Override
+    public Builder<E> add(E element) {
+      return null;
+    }
+
+    @Override
+    public ImmutableList<E> build() {
+      return null;
+    }
+  }
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMap.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMap.java
new file mode 100644
index 00000000000..631d25768fb
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMap.java
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2008 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Collection;
+import java.util.Comparator;
+import java.util.Map;
+
+public abstract class ImmutableMap<K, V> implements Map<K, V> {
+  public static <K, V> ImmutableMap<K, V> of() {
+    return null;
+  }
+
+  public static <K, V> ImmutableMap<K, V> of(K k1, V v1) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMap<K, V> of(K k1, V v1, K k2, V v2) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMap<K, V> of(K k1, V v1, K k2, V v2, K k3, V v3) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMap<K, V> of(K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMap<K, V> of(
+      K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4, K k5, V v5) {
+    return null;
+  }
+
+  public static <K, V> Builder<K, V> builder() {
+    return null;
+  }
+
+  public static <K, V> Builder<K, V> builderWithExpectedSize(int expectedSize) {
+    return null;
+  }
+
+  public static class Builder<K, V> {
+    public Builder() {
+    }
+
+    public Builder<K, V> put(K key, V value) {
+      return null;
+    }
+
+    public Builder<K, V> put(Entry<? extends K, ? extends V> entry) {
+      return null;
+    }
+
+    public Builder<K, V> putAll(Map<? extends K, ? extends V> map) {
+      return null;
+    }
+
+    public Builder<K, V> putAll(Iterable<? extends Entry<? extends K, ? extends V>> entries) {
+      return null;
+    }
+
+    public Builder<K, V> orderEntriesByValue(Comparator<? super V> valueComparator) {
+      return null;
+    }
+
+    public ImmutableMap<K, V> build() {
+      return null;
+    }
+
+  }
+  public static <K, V> ImmutableMap<K, V> copyOf(Map<? extends K, ? extends V> map) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMap<K, V> copyOf(
+      Iterable<? extends Entry<? extends K, ? extends V>> entries) {
+    return null;
+  }
+
+  @Override
+  public final V put(K k, V v) {
+    return null;
+  }
+
+  @Override
+  public final void putAll(Map<? extends K, ? extends V> map) {
+  }
+
+  @Override
+  public final V remove(Object o) {
+    return null;
+  }
+
+  @Override
+  public final void clear() {
+  }
+
+  @Override
+  public boolean isEmpty() {
+    return false;
+  }
+
+  @Override
+  public boolean containsKey(Object key) {
+    return false;
+  }
+
+  @Override
+  public boolean containsValue(Object value) {
+    return false;
+  }
+
+  @Override
+  public abstract V get(Object key);
+
+  @Override
+  public ImmutableSet<Entry<K, V>> entrySet() {
+    return null;
+  }
+
+  @Override
+  public ImmutableSet<K> keySet() {
+    return null;
+  }
+
+  @Override
+  public ImmutableCollection<V> values() {
+    return null;
+  }
+
+  // public ImmutableSetMultimap<K, V> asMultimap() {
+  //   return null;
+  // }
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMultimap.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMultimap.java
new file mode 100644
index 00000000000..c1345f72f3f
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMultimap.java
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2008 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Collection;
+import java.util.Comparator;
+import java.util.Map;
+import java.util.Map.Entry;
+
+public abstract class ImmutableMultimap<K, V> extends AbstractMultimap<K, V> {
+  public static <K, V> ImmutableMultimap<K, V> of() {
+    return null;
+  }
+
+  public static <K, V> ImmutableMultimap<K, V> of(K k1, V v1) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMultimap<K, V> of(K k1, V v1, K k2, V v2) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMultimap<K, V> of(K k1, V v1, K k2, V v2, K k3, V v3) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMultimap<K, V> of(K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMultimap<K, V> of(
+      K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4, K k5, V v5) {
+    return null;
+  }
+
+  public static <K, V> Builder<K, V> builder() {
+    return null;
+  }
+
+  public static class Builder<K, V> {
+    public Builder() {
+    }
+
+    public Builder<K, V> put(K key, V value) {
+      return null;
+    }
+
+    public Builder<K, V> put(Entry<? extends K, ? extends V> entry) {
+      return null;
+    }
+
+    public Builder<K, V> putAll(Iterable<? extends Entry<? extends K, ? extends V>> entries) {
+      return null;
+    }
+
+    public Builder<K, V> putAll(K key, Iterable<? extends V> values) {
+      return null;
+    }
+
+    public Builder<K, V> putAll(K key, V... values) {
+      return null;
+    }
+
+    public Builder<K, V> putAll(Multimap<? extends K, ? extends V> multimap) {
+      return null;
+    }
+
+    public Builder<K, V> orderKeysBy(Comparator<? super K> keyComparator) {
+      return null;
+    }
+
+    public Builder<K, V> orderValuesBy(Comparator<? super V> valueComparator) {
+      return null;
+    }
+
+    public ImmutableMultimap<K, V> build() {
+      return null;
+    }
+
+  }
+  public static <K, V> ImmutableMultimap<K, V> copyOf(Multimap<? extends K, ? extends V> multimap) {
+    return null;
+  }
+
+  public static <K, V> ImmutableMultimap<K, V> copyOf(
+      Iterable<? extends Entry<? extends K, ? extends V>> entries) {
+    return null;
+  }
+
+  @Override
+  public ImmutableCollection<V> removeAll(Object key) {
+    return null;
+  }
+
+  @Override
+  public void clear() {
+  }
+
+  @Override
+  public abstract ImmutableCollection<V> get(K key);
+
+  public abstract ImmutableMultimap<V, K> inverse();
+
+  @Override
+  public boolean containsKey(Object key) {
+    return false;
+  }
+
+  @Override
+  public int size() {
+    return 0;
+  }
+
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMultiset.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMultiset.java
new file mode 100644
index 00000000000..0fb82a18c80
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableMultiset.java
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2008 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Collection;
+import java.util.Iterator;
+
+public abstract class ImmutableMultiset<E> extends ImmutableCollection<E>
+    implements Multiset<E> {
+
+  public static <E> ImmutableMultiset<E> of() {
+    return null;
+  }
+
+  public static <E> ImmutableMultiset<E> of(E element) {
+    return null;
+  }
+
+  public static <E> ImmutableMultiset<E> of(E e1, E e2) {
+    return null;
+  }
+
+  public static <E> ImmutableMultiset<E> of(E e1, E e2, E e3) {
+    return null;
+  }
+
+  public static <E> ImmutableMultiset<E> of(E e1, E e2, E e3, E e4) {
+    return null;
+  }
+
+  public static <E> ImmutableMultiset<E> of(E e1, E e2, E e3, E e4, E e5) {
+    return null;
+  }
+
+  public static <E> ImmutableMultiset<E> of(E e1, E e2, E e3, E e4, E e5, E e6, E... others) {
+    return null;
+  }
+
+  public static <E> ImmutableMultiset<E> copyOf(E[] elements) {
+    return null;
+  }
+
+  public static <E> ImmutableMultiset<E> copyOf(Iterable<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableMultiset<E> copyOf(Iterator<? extends E> elements) {
+    return null;
+  }
+
+  @Override
+  public boolean contains(Object object) {
+    return false;
+  }
+
+  @Override
+  public final int add(E element, int occurrences) {
+    return 0;
+  }
+
+  @Override
+  public final int remove(Object element, int occurrences) {
+    return 0;
+  }
+
+  @Override
+  public final int setCount(E element, int count) {
+    return 0;
+  }
+
+  @Override
+  public final boolean setCount(E element, int oldCount, int newCount) {
+    return false;
+  }
+
+  @Override
+  public abstract ImmutableSet<E> elementSet();
+
+  @Override
+  public ImmutableSet<Entry<E>> entrySet() {
+    return null;
+  }
+
+  public static <E> Builder<E> builder() {
+    return null;
+  }
+
+  public static class Builder<E> extends ImmutableCollection.Builder<E> {
+    public Builder() {
+    }
+
+    @Override
+    public Builder<E> add(E element) {
+      return null;
+    }
+
+    public Builder<E> addCopies(E element, int occurrences) {
+      return null;
+    }
+
+    public Builder<E> setCount(E element, int count) {
+      return null;
+    }
+
+    @Override
+    public ImmutableMultiset<E> build() {
+      return null;
+    }
+
+  }
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSet.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSet.java
new file mode 100644
index 00000000000..938b5aedf59
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSet.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2007 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.Set;
+
+public abstract class ImmutableSet<E> extends ImmutableCollection<E> implements Set<E> {
+  public static <E> ImmutableSet<E> of() {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> of(E element) {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> of(E e1, E e2) {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> of(E e1, E e2, E e3) {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> of(E e1, E e2, E e3, E e4) {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> of(E e1, E e2, E e3, E e4, E e5) {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> of(E e1, E e2, E e3, E e4, E e5, E e6, E... others) {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> copyOf(Collection<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> copyOf(Iterable<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> copyOf(Iterator<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSet<E> copyOf(E[] elements) {
+    return null;
+  }
+
+  ImmutableSet() {}
+
+  public static <E> Builder<E> builder() {
+    return null;
+  }
+
+  public static class Builder<E> extends ImmutableCollection.Builder<E> {
+    public Builder() {
+    }
+
+    public Builder<E> add(E element) {
+      return null;
+    }
+
+    public ImmutableSet<E> build() {
+      return null;
+    }
+  }
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSortedMap.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSortedMap.java
new file mode 100644
index 00000000000..dc3bfd49083
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSortedMap.java
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2009 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Comparator;
+import java.util.Map;
+import java.util.SortedMap;
+
+public final class ImmutableSortedMap<K, V> extends ImmutableMap<K, V>{
+
+  public static <K, V> ImmutableSortedMap<K, V> of() {
+    return null;
+  }
+
+  public static <K extends Comparable<? super K>, V> ImmutableSortedMap<K, V> of(K k1, V v1) {
+    return null;
+  }
+
+  public static <K extends Comparable<? super K>, V> ImmutableSortedMap<K, V> of(
+      K k1, V v1, K k2, V v2) {
+    return null;
+  }
+
+  public static <K extends Comparable<? super K>, V> ImmutableSortedMap<K, V> of(
+      K k1, V v1, K k2, V v2, K k3, V v3) {
+    return null;
+  }
+
+  public static <K extends Comparable<? super K>, V> ImmutableSortedMap<K, V> of(
+      K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4) {
+    return null;
+  }
+
+  public static <K extends Comparable<? super K>, V> ImmutableSortedMap<K, V> of(
+      K k1, V v1, K k2, V v2, K k3, V v3, K k4, V v4, K k5, V v5) {
+    return null;
+  }
+
+  public static <K, V> ImmutableSortedMap<K, V> copyOf(Map<? extends K, ? extends V> map) {
+    return null;
+  }
+
+  public static <K, V> ImmutableSortedMap<K, V> copyOf(
+      Map<? extends K, ? extends V> map, Comparator<? super K> comparator) {
+    return null;
+  }
+
+  public static <K, V> ImmutableSortedMap<K, V> copyOf(
+      Iterable<? extends Entry<? extends K, ? extends V>> entries) {
+    return null;
+  }
+
+  public static <K, V> ImmutableSortedMap<K, V> copyOf(
+      Iterable<? extends Entry<? extends K, ? extends V>> entries,
+      Comparator<? super K> comparator) {
+    return null;
+  }
+
+  public static <K, V> ImmutableSortedMap<K, V> copyOfSorted(SortedMap<K, ? extends V> map) {
+    return null;
+  }
+
+  @Override
+  public V get(Object key) {
+    return null;
+  }
+
+  @Override
+  public int size() {
+    return 0;
+  }
+
+  public static <K extends Comparable<?>, V> Builder<K, V> naturalOrder() {
+    return null;
+  }
+
+  public static <K, V> Builder<K, V> orderedBy(Comparator<K> comparator) {
+    return null;
+  }
+
+  public static <K extends Comparable<?>, V> Builder<K, V> reverseOrder() {
+    return null;
+  }
+
+  public static class Builder<K, V> extends ImmutableMap.Builder<K, V> {
+    public Builder(Comparator<? super K> comparator) {
+    }
+
+  }
+
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSortedSet.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSortedSet.java
new file mode 100644
index 00000000000..fb22c85b5ef
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableSortedSet.java
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2008 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Collection;
+import java.util.Comparator;
+import java.util.Iterator;
+import java.util.NavigableSet;
+import java.util.SortedSet;
+
+public abstract class ImmutableSortedSet<E> extends ImmutableSet<E>
+    implements NavigableSet<E> {
+  
+  public static <E> ImmutableSortedSet<E> of() {
+    return null;
+  }
+
+  public static <E extends Comparable<? super E>> ImmutableSortedSet<E> of(E element) {
+    return null;
+  }
+
+  public static <E extends Comparable<? super E>> ImmutableSortedSet<E> of(E e1, E e2) {
+    return null;
+  }
+
+  public static <E extends Comparable<? super E>> ImmutableSortedSet<E> of(E e1, E e2, E e3) {
+    return null;
+  }
+
+  public static <E extends Comparable<? super E>> ImmutableSortedSet<E> of(E e1, E e2, E e3, E e4) {
+    return null;
+  }
+
+  public static <E extends Comparable<? super E>> ImmutableSortedSet<E> of(
+      E e1, E e2, E e3, E e4, E e5) {
+    return null;
+  }
+
+  public static <E extends Comparable<? super E>> ImmutableSortedSet<E> of(
+      E e1, E e2, E e3, E e4, E e5, E e6, E... remaining) {
+    return null;
+  }
+
+  public static <E extends Comparable<? super E>> ImmutableSortedSet<E> copyOf(E[] elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSortedSet<E> copyOf(Iterable<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSortedSet<E> copyOf(Collection<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSortedSet<E> copyOf(Iterator<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSortedSet<E> copyOf(
+      Comparator<? super E> comparator, Iterator<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSortedSet<E> copyOf(
+      Comparator<? super E> comparator, Iterable<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSortedSet<E> copyOf(
+      Comparator<? super E> comparator, Collection<? extends E> elements) {
+    return null;
+  }
+
+  public static <E> ImmutableSortedSet<E> copyOfSorted(SortedSet<E> sortedSet) {
+    return null;
+  }
+
+  public static <E> Builder<E> orderedBy(Comparator<E> comparator) {
+    return null;
+  }
+
+  public static <E extends Comparable<?>> Builder<E> reverseOrder() {
+    return null;
+  }
+
+  public static <E extends Comparable<?>> Builder<E> naturalOrder() {
+    return null;
+  }
+
+  public static final class Builder<E> extends ImmutableSet.Builder<E> {
+    public Builder(Comparator<? super E> comparator) {
+    }
+
+  }
+
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableTable.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableTable.java
new file mode 100644
index 00000000000..73b3907b352
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/ImmutableTable.java
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2009 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Map;
+
+public abstract class ImmutableTable<R, C, V> extends AbstractTable<R, C, V> {
+
+  public static <R, C, V> ImmutableTable<R, C, V> of() {
+    return null;
+  }
+
+  public static <R, C, V> ImmutableTable<R, C, V> of(R rowKey, C columnKey, V value) {
+    return null;
+  }
+
+  public static <R, C, V> ImmutableTable<R, C, V> copyOf(
+      Table<? extends R, ? extends C, ? extends V> table) {
+    return null;
+  }
+
+  public static <R, C, V> Builder<R, C, V> builder() {
+    return null;
+  }
+
+  public static final class Builder<R, C, V> {
+    public Builder() {}
+
+    public Builder<R, C, V> put(R rowKey, C columnKey, V value) {
+      return null;
+    }
+
+    public Builder<R, C, V> put(Cell<? extends R, ? extends C, ? extends V> cell) {
+      return null;
+    }
+
+    public Builder<R, C, V> putAll(Table<? extends R, ? extends C, ? extends V> table) {
+      return null;
+    }
+
+    public ImmutableTable<R, C, V> build() {
+      return null;
+    }
+
+  }
+  @Override
+  public ImmutableSet<Cell<R, C, V>> cellSet() {
+    return null;
+  }
+
+  @Override
+  public ImmutableCollection<V> values() {
+    return null;
+  }
+
+  @Override
+  public ImmutableMap<R, V> column(C columnKey) {
+    return null;
+  }
+
+  @Override
+  public ImmutableSet<C> columnKeySet() {
+    return null;
+  }
+
+  @Override
+  public abstract ImmutableMap<C, Map<R, V>> columnMap();
+
+  @Override
+  public ImmutableMap<C, V> row(R rowKey) {
+    return null;
+  }
+
+  @Override
+  public ImmutableSet<R> rowKeySet() {
+    return null;
+  }
+
+  @Override
+  public abstract ImmutableMap<R, Map<C, V>> rowMap();
+
+  @Override
+  public boolean contains(Object rowKey, Object columnKey) {
+    return false;
+  }
+
+  @Override
+  public boolean containsValue(Object value) {
+    return false;
+  }
+
+  @Override
+  public final void clear() {
+  }
+
+  @Override
+  public final V put(R rowKey, C columnKey, V value) {
+    return null;
+  }
+
+  @Override
+  public final void putAll(Table<? extends R, ? extends C, ? extends V> table) {
+  }
+
+  @Override
+  public final V remove(Object rowKey, Object columnKey) {
+    return null;
+  }
+
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/Multimap.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/Multimap.java
new file mode 100644
index 00000000000..80223a450c9
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/Multimap.java
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2007 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+
+import java.util.Collection;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.Set;
+import java.util.function.BiConsumer;
+
+public interface Multimap<K, V> {
+  int size();
+
+  boolean isEmpty();
+
+  boolean containsKey(Object key);
+
+  boolean containsValue(Object value);
+
+  boolean containsEntry(Object key, Object value);
+
+  boolean put(K key, V value);
+
+  boolean remove(Object key, Object value);
+
+  boolean putAll(K key, Iterable<? extends V> values);
+
+  boolean putAll(Multimap<? extends K, ? extends V> multimap);
+
+  Collection<V> replaceValues(K key, Iterable<? extends V> values);
+
+  Collection<V> removeAll(Object key);
+
+  void clear();
+
+  Collection<V> get(K key);
+
+  Set<K> keySet();
+
+  Multiset<K> keys();
+
+  Collection<V> values();
+
+  Collection<Entry<K, V>> entries();
+
+  default void forEach(BiConsumer<? super K, ? super V> action) {
+  }
+
+  Map<K, Collection<V>> asMap();
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/Multiset.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/Multiset.java
new file mode 100644
index 00000000000..c67f63e79a0
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/Multiset.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2007 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+
+import java.util.Collection;
+import java.util.Set;
+import java.util.function.ObjIntConsumer;
+
+public interface Multiset<E> extends Collection<E> {
+  int count(Object element);
+
+  int add(E element, int occurrences);
+
+  int remove(Object element, int occurrences);
+
+  int setCount(E element, int count);
+
+  boolean setCount(E element, int oldCount, int newCount);
+
+  Set<E> elementSet();
+
+  Set<Entry<E>> entrySet();
+
+  default void forEachEntry(ObjIntConsumer<? super E> action) {
+  }
+
+  boolean equals(Object object);
+
+  interface Entry<E> {
+    E getElement();
+
+    int getCount();
+  }
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/Sets.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/Sets.java
new file mode 100644
index 00000000000..77d3812f082
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/Sets.java
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2007 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.AbstractSet;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.NavigableSet;
+import java.util.NoSuchElementException;
+import java.util.Set;
+import java.util.function.Predicate;
+
+public final class Sets {
+  private Sets() {}
+
+  public static <E> HashSet<E> newHashSet() {
+    return null;
+  }
+
+  public static <E> HashSet<E> newHashSet(E... elements) {
+    return null;
+  }
+
+  public static <E> HashSet<E> newHashSet(Iterable<? extends E> elements) {
+    return null;
+  }
+  public abstract static class SetView<E> extends AbstractSet<E> {
+    private SetView() {} 
+  }
+
+  public static <E> SetView<E> union(final Set<? extends E> set1, final Set<? extends E> set2) {
+    return null;
+  }
+
+  public static <E> SetView<E> intersection(final Set<E> set1, final Set<?> set2) {
+    return null;
+  }
+
+  public static <E> SetView<E> difference(final Set<E> set1, final Set<?> set2) {
+    return null;
+  }
+
+  public static <E> SetView<E> symmetricDifference(
+      final Set<? extends E> set1, final Set<? extends E> set2) {
+    return null;
+  }
+
+  public static <E> Set<E> filter(Set<E> unfiltered, Predicate<? super E> predicate) {
+    return null;
+  }
+
+  
+  public static <B> Set<List<B>> cartesianProduct(List<? extends Set<? extends B>> sets) {
+    return null;
+  }
+
+  public static <B> Set<List<B>> cartesianProduct(Set<? extends B>... sets) {
+    return null;
+  }
+
+  public static <E> Set<Set<E>> powerSet(Set<E> set) {
+    return null;
+  }
+
+  public static <E> Set<Set<E>> combinations(Set<E> set, final int size) {
+    return null;
+  }
+
+  public static <E> NavigableSet<E> synchronizedNavigableSet(NavigableSet<E> navigableSet) {
+    return null;
+  }
+
+  public static <K extends Comparable<? super K>> NavigableSet<K> subSet(
+      NavigableSet<K> set, Object range) {
+    return null;
+  }
+}
diff --git a/java/ql/test/stubs/guava-30.0/com/google/common/collect/Table.java b/java/ql/test/stubs/guava-30.0/com/google/common/collect/Table.java
new file mode 100644
index 00000000000..d310bd99182
--- /dev/null
+++ b/java/ql/test/stubs/guava-30.0/com/google/common/collect/Table.java
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2008 The Guava Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.common.collect;
+
+import java.util.Collection;
+import java.util.Map;
+import java.util.Set;
+
+public interface Table<R, C, V> {
+  boolean contains(Object rowKey, Object columnKey);
+
+  boolean containsRow(Object rowKey);
+
+  boolean containsColumn(Object columnKey);
+
+  boolean containsValue(Object value);
+
+  V get(Object rowKey, Object columnKey);
+
+  boolean isEmpty();
+
+  int size();
+
+  void clear();
+
+  V put(R rowKey, C columnKey, V value);
+
+  void putAll(Table<? extends R, ? extends C, ? extends V> table);
+
+  V remove(Object rowKey, Object columnKey);
+
+  Map<C, V> row(R rowKey);
+
+  Map<R, V> column(C columnKey);
+
+  Set<Cell<R, C, V>> cellSet();
+
+  Set<R> rowKeySet();
+
+  Set<C> columnKeySet();
+
+  Collection<V> values();
+
+  Map<R, Map<C, V>> rowMap();
+
+  Map<C, Map<R, V>> columnMap();
+
+  interface Cell<R, C, V> {
+    R getRowKey();
+
+    C getColumnKey();
+
+    V getValue();
+  }
+}

From 07a96c35962e51586b74dbcecd43962849fa07ad Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 26 Jan 2021 08:50:06 +0100
Subject: [PATCH 309/343] C#: Add CFG tests for `ExceptionDispatchInfo::Throw`

---
 .../controlflow/graph/BasicBlock.expected     |  92 +-
 .../controlflow/graph/Condition.expected      |  58 +-
 .../controlflow/graph/Dominance.expected      | 876 +++++++++---------
 .../graph/EnclosingCallable.expected          | 460 ++++-----
 .../controlflow/graph/EntryElement.expected   | 265 +++---
 .../controlflow/graph/ExitElement.expected    | 327 +++----
 .../controlflow/graph/ExitMethods.cs          |  10 +
 .../controlflow/graph/NodeGraph.expected      | 342 +++----
 .../controlflow/graph/Nodes.expected          |  43 +-
 9 files changed, 1299 insertions(+), 1174 deletions(-)

diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
index 6f3b0b5e956..00316b3c41d 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
@@ -370,50 +370,54 @@
 | Conditions.cs:145:27:145:29 | [b (line 143): false] "b" | Conditions.cs:146:13:146:13 | [b (line 143): false] access to parameter b | 5 |
 | Conditions.cs:147:13:147:49 | ...; | Conditions.cs:147:13:147:48 | call to method WriteLine | 5 |
 | Conditions.cs:149:13:149:49 | ...; | Conditions.cs:149:13:149:48 | call to method WriteLine | 5 |
-| ExitMethods.cs:7:10:7:11 | enter M1 | ExitMethods.cs:7:10:7:11 | exit M1 | 8 |
-| ExitMethods.cs:13:10:13:11 | enter M2 | ExitMethods.cs:13:10:13:11 | exit M2 | 8 |
-| ExitMethods.cs:19:10:19:11 | enter M3 | ExitMethods.cs:19:10:19:11 | exit M3 | 7 |
-| ExitMethods.cs:25:10:25:11 | enter M4 | ExitMethods.cs:25:10:25:11 | exit M4 | 7 |
-| ExitMethods.cs:31:10:31:11 | enter M5 | ExitMethods.cs:31:10:31:11 | exit M5 | 7 |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | 7 |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:37:10:37:11 | exit M6 | 2 |
-| ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} | 1 |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | 1 |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:45:13:45:19 | return ...; | 2 |
-| ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | 1 |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:49:13:49:19 | return ...; | 2 |
-| ExitMethods.cs:53:10:53:11 | enter M7 | ExitMethods.cs:53:10:53:11 | exit M7 | 6 |
-| ExitMethods.cs:59:10:59:11 | enter M8 | ExitMethods.cs:59:10:59:11 | exit M8 | 6 |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:67:13:67:13 | access to parameter b | 4 |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe | 1 |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | 1 |
-| ExitMethods.cs:68:19:68:33 | object creation of type Exception | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (abnormal) | 3 |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:73:13:73:13 | access to parameter b | 4 |
-| ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:71:17:71:27 | exit ErrorAlways | 2 |
-| ExitMethods.cs:74:19:74:33 | object creation of type Exception | ExitMethods.cs:74:13:74:34 | throw ...; | 2 |
-| ExitMethods.cs:76:41:76:43 | "b" | ExitMethods.cs:76:13:76:45 | throw ...; | 3 |
-| ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 | ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 | 6 |
-| ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 | ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 | 5 |
-| ExitMethods.cs:86:10:86:13 | enter Exit | ExitMethods.cs:86:10:86:13 | exit Exit | 7 |
-| ExitMethods.cs:91:10:91:18 | enter ExitInTry | ExitMethods.cs:91:10:91:18 | exit ExitInTry | 9 |
-| ExitMethods.cs:104:10:104:24 | enter ApplicationExit | ExitMethods.cs:104:10:104:24 | exit ApplicationExit | 6 |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:111:16:111:25 | ... != ... | 6 |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr | ExitMethods.cs:109:13:109:21 | exit ThrowExpr | 1 |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:109:13:109:21 | exit ThrowExpr (normal) | 7 |
-| ExitMethods.cs:111:69:111:75 | "input" | ExitMethods.cs:109:13:109:21 | exit ThrowExpr (abnormal) | 4 |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:116:16:116:30 | call to method Contains | 5 |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall | 4 |
-| ExitMethods.cs:116:34:116:34 | 0 | ExitMethods.cs:116:34:116:34 | 0 | 1 |
-| ExitMethods.cs:116:38:116:38 | 1 | ExitMethods.cs:116:38:116:38 | 1 | 1 |
-| ExitMethods.cs:119:17:119:32 | enter FailingAssertion | ExitMethods.cs:121:23:121:27 | false | 4 |
-| ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:119:17:119:32 | exit FailingAssertion | 3 |
-| ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 | ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 | 7 |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:48:131:48 | access to parameter b | 2 |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse | 1 |
-| ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse (abnormal) | 2 |
-| ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse (normal) | 2 |
-| ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 | ExitMethods.cs:135:21:135:24 | true | 5 |
-| ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 | 3 |
+| ExitMethods.cs:8:10:8:11 | enter M1 | ExitMethods.cs:8:10:8:11 | exit M1 | 8 |
+| ExitMethods.cs:14:10:14:11 | enter M2 | ExitMethods.cs:14:10:14:11 | exit M2 | 8 |
+| ExitMethods.cs:20:10:20:11 | enter M3 | ExitMethods.cs:20:10:20:11 | exit M3 | 7 |
+| ExitMethods.cs:26:10:26:11 | enter M4 | ExitMethods.cs:26:10:26:11 | exit M4 | 7 |
+| ExitMethods.cs:32:10:32:11 | enter M5 | ExitMethods.cs:32:10:32:11 | exit M5 | 7 |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | 7 |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:38:10:38:11 | exit M6 | 2 |
+| ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} | 1 |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | 1 |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:46:13:46:19 | return ...; | 2 |
+| ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | 1 |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:50:13:50:19 | return ...; | 2 |
+| ExitMethods.cs:54:10:54:11 | enter M7 | ExitMethods.cs:54:10:54:11 | exit M7 | 6 |
+| ExitMethods.cs:60:10:60:11 | enter M8 | ExitMethods.cs:60:10:60:11 | exit M8 | 6 |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:68:13:68:13 | access to parameter b | 4 |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | 1 |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | 1 |
+| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (abnormal) | 3 |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:74:13:74:13 | access to parameter b | 4 |
+| ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:72:17:72:27 | exit ErrorAlways | 2 |
+| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:75:13:75:34 | throw ...; | 2 |
+| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:77:13:77:45 | throw ...; | 3 |
+| ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 | ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 | 6 |
+| ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 | ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 | 5 |
+| ExitMethods.cs:87:10:87:13 | enter Exit | ExitMethods.cs:87:10:87:13 | exit Exit | 7 |
+| ExitMethods.cs:92:10:92:18 | enter ExitInTry | ExitMethods.cs:92:10:92:18 | exit ExitInTry | 9 |
+| ExitMethods.cs:105:10:105:24 | enter ApplicationExit | ExitMethods.cs:105:10:105:24 | exit ApplicationExit | 6 |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:112:16:112:25 | ... != ... | 6 |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr | ExitMethods.cs:110:13:110:21 | exit ThrowExpr | 1 |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:110:13:110:21 | exit ThrowExpr (normal) | 7 |
+| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:110:13:110:21 | exit ThrowExpr (abnormal) | 4 |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:117:16:117:30 | call to method Contains | 5 |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall | 4 |
+| ExitMethods.cs:117:34:117:34 | 0 | ExitMethods.cs:117:34:117:34 | 0 | 1 |
+| ExitMethods.cs:117:38:117:38 | 1 | ExitMethods.cs:117:38:117:38 | 1 | 1 |
+| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:122:23:122:27 | false | 4 |
+| ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:120:17:120:32 | exit FailingAssertion | 3 |
+| ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 | ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 | 7 |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:48:132:48 | access to parameter b | 2 |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse | 1 |
+| ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse (abnormal) | 2 |
+| ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse (normal) | 2 |
+| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:136:21:136:24 | true | 5 |
+| ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 | 3 |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:142:13:142:13 | access to parameter b | 4 |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:42 | call to method Throw | 3 |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:52 | call to method Throw | 4 |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | 5 |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | exit ToInt32 | 7 |
 | Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | exit ToBool | 8 |
 | Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | exit CallToInt32 | 5 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
index 3f1653363c8..47f4dcbdcb4 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Condition.expected
@@ -1305,21 +1305,23 @@ conditionBlock
 | Conditions.cs:143:10:143:12 | enter M11 | Conditions.cs:149:13:149:49 | ...; | false |
 | Conditions.cs:145:21:145:23 | [b (line 143): true] "a" | Conditions.cs:147:13:147:49 | ...; | true |
 | Conditions.cs:145:27:145:29 | [b (line 143): false] "b" | Conditions.cs:149:13:149:49 | ...; | false |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | false |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:50:9 | {...} | false |
-| ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:50:9 | {...} | true |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | false |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:68:19:68:33 | object creation of type Exception | true |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:74:19:74:33 | object creation of type Exception | true |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:76:41:76:43 | "b" | false |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:111:29:111:29 | 1 | true |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:111:69:111:75 | "input" | false |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:116:34:116:34 | 0 | true |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:116:38:116:38 | 1 | false |
-| ExitMethods.cs:119:17:119:32 | enter FailingAssertion | ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | false |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | true |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | false |
-| ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 | ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | true |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | false |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:49:9:51:9 | {...} | false |
+| ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:49:9:51:9 | {...} | true |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | false |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:69:19:69:33 | object creation of type Exception | true |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:75:19:75:33 | object creation of type Exception | true |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:77:41:77:43 | "b" | false |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:112:29:112:29 | 1 | true |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:112:69:112:75 | "input" | false |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:117:34:117:34 | 0 | true |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:117:38:117:38 | 1 | false |
+| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | false |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | true |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | false |
+| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | true |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:143:13:143:43 | ...; | true |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:145:13:145:53 | ...; | false |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:26:38:26:39 | [exception: Exception] IOException ex | true |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:27:9:29:9 | {...} | true |
 | Finally.cs:26:9:29:9 | [exception: Exception] catch (...) {...} | Finally.cs:30:9:40:9 | [exception: Exception] catch (...) {...} | false |
@@ -2551,18 +2553,20 @@ conditionFlow
 | Conditions.cs:145:17:145:17 | access to parameter b | Conditions.cs:145:27:145:29 | [b (line 143): false] "b" | false |
 | Conditions.cs:146:13:146:13 | [b (line 143): false] access to parameter b | Conditions.cs:149:13:149:49 | ...; | false |
 | Conditions.cs:146:13:146:13 | [b (line 143): true] access to parameter b | Conditions.cs:147:13:147:49 | ...; | true |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | false |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:68:19:68:33 | object creation of type Exception | true |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:74:19:74:33 | object creation of type Exception | true |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:76:41:76:43 | "b" | false |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:29:111:29 | 1 | true |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:69:111:75 | "input" | false |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:34:116:34 | 0 | true |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:38:116:38 | 1 | false |
-| ExitMethods.cs:121:23:121:27 | false | ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | false |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | true |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | false |
-| ExitMethods.cs:135:21:135:24 | true | ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | true |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | false |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:69:19:69:33 | object creation of type Exception | true |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:75:19:75:33 | object creation of type Exception | true |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:77:41:77:43 | "b" | false |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:29:112:29 | 1 | true |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:69:112:75 | "input" | false |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:34:117:34 | 0 | true |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:38:117:38 | 1 | false |
+| ExitMethods.cs:122:23:122:27 | false | ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | false |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | true |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | false |
+| ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | true |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:143:13:143:43 | ...; | true |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:145:13:145:53 | ...; | false |
 | Finally.cs:26:48:26:51 | [exception: Exception] true | Finally.cs:27:9:29:9 | {...} | true |
 | Finally.cs:34:21:34:24 | true | Finally.cs:34:27:34:32 | throw ...; | true |
 | Finally.cs:61:48:61:51 | [exception: Exception] true | Finally.cs:62:9:64:9 | {...} | true |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
index 8fe3dbbf796..c7c78455c64 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
@@ -1496,154 +1496,168 @@ dominance
 | Conditions.cs:149:38:149:47 | $"..." | Conditions.cs:149:13:149:48 | call to method WriteLine |
 | Conditions.cs:149:40:149:43 | "b = " | Conditions.cs:149:45:149:45 | access to local variable s |
 | Conditions.cs:149:45:149:45 | access to local variable s | Conditions.cs:149:38:149:47 | $"..." |
-| ExitMethods.cs:7:10:7:11 | enter M1 | ExitMethods.cs:8:5:11:5 | {...} |
-| ExitMethods.cs:7:10:7:11 | exit M1 (normal) | ExitMethods.cs:7:10:7:11 | exit M1 |
-| ExitMethods.cs:8:5:11:5 | {...} | ExitMethods.cs:9:9:9:25 | ...; |
-| ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe | ExitMethods.cs:10:9:10:15 | return ...; |
-| ExitMethods.cs:9:9:9:25 | ...; | ExitMethods.cs:9:20:9:23 | true |
-| ExitMethods.cs:9:20:9:23 | true | ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe |
-| ExitMethods.cs:10:9:10:15 | return ...; | ExitMethods.cs:7:10:7:11 | exit M1 (normal) |
-| ExitMethods.cs:13:10:13:11 | enter M2 | ExitMethods.cs:14:5:17:5 | {...} |
-| ExitMethods.cs:13:10:13:11 | exit M2 (normal) | ExitMethods.cs:13:10:13:11 | exit M2 |
-| ExitMethods.cs:14:5:17:5 | {...} | ExitMethods.cs:15:9:15:26 | ...; |
-| ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe | ExitMethods.cs:16:9:16:15 | return ...; |
-| ExitMethods.cs:15:9:15:26 | ...; | ExitMethods.cs:15:20:15:24 | false |
-| ExitMethods.cs:15:20:15:24 | false | ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe |
-| ExitMethods.cs:16:9:16:15 | return ...; | ExitMethods.cs:13:10:13:11 | exit M2 (normal) |
-| ExitMethods.cs:19:10:19:11 | enter M3 | ExitMethods.cs:20:5:23:5 | {...} |
-| ExitMethods.cs:19:10:19:11 | exit M3 (abnormal) | ExitMethods.cs:19:10:19:11 | exit M3 |
-| ExitMethods.cs:20:5:23:5 | {...} | ExitMethods.cs:21:9:21:26 | ...; |
-| ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | ExitMethods.cs:19:10:19:11 | exit M3 (abnormal) |
-| ExitMethods.cs:21:9:21:26 | ...; | ExitMethods.cs:21:21:21:24 | true |
-| ExitMethods.cs:21:21:21:24 | true | ExitMethods.cs:21:9:21:25 | call to method ErrorAlways |
-| ExitMethods.cs:25:10:25:11 | enter M4 | ExitMethods.cs:26:5:29:5 | {...} |
-| ExitMethods.cs:25:10:25:11 | exit M4 (abnormal) | ExitMethods.cs:25:10:25:11 | exit M4 |
-| ExitMethods.cs:26:5:29:5 | {...} | ExitMethods.cs:27:9:27:15 | ...; |
-| ExitMethods.cs:27:9:27:14 | call to method Exit | ExitMethods.cs:25:10:25:11 | exit M4 (abnormal) |
-| ExitMethods.cs:27:9:27:14 | this access | ExitMethods.cs:27:9:27:14 | call to method Exit |
-| ExitMethods.cs:27:9:27:15 | ...; | ExitMethods.cs:27:9:27:14 | this access |
-| ExitMethods.cs:31:10:31:11 | enter M5 | ExitMethods.cs:32:5:35:5 | {...} |
-| ExitMethods.cs:31:10:31:11 | exit M5 (abnormal) | ExitMethods.cs:31:10:31:11 | exit M5 |
-| ExitMethods.cs:32:5:35:5 | {...} | ExitMethods.cs:33:9:33:26 | ...; |
-| ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | ExitMethods.cs:31:10:31:11 | exit M5 (abnormal) |
-| ExitMethods.cs:33:9:33:25 | this access | ExitMethods.cs:33:9:33:25 | call to method ApplicationExit |
-| ExitMethods.cs:33:9:33:26 | ...; | ExitMethods.cs:33:9:33:25 | this access |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:38:5:51:5 | {...} |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:37:10:37:11 | exit M6 |
-| ExitMethods.cs:38:5:51:5 | {...} | ExitMethods.cs:39:9:50:9 | try {...} ... |
-| ExitMethods.cs:39:9:50:9 | try {...} ... | ExitMethods.cs:40:9:42:9 | {...} |
-| ExitMethods.cs:40:9:42:9 | {...} | ExitMethods.cs:41:13:41:31 | ...; |
-| ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} |
-| ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:41:13:41:31 | ...; | ExitMethods.cs:41:25:41:29 | false |
-| ExitMethods.cs:41:25:41:29 | false | ExitMethods.cs:41:13:41:30 | call to method ErrorAlways |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:45:13:45:19 | return ...; |
-| ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:50:9 | {...} |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:49:13:49:19 | return ...; |
-| ExitMethods.cs:53:10:53:11 | enter M7 | ExitMethods.cs:54:5:57:5 | {...} |
-| ExitMethods.cs:53:10:53:11 | exit M7 (abnormal) | ExitMethods.cs:53:10:53:11 | exit M7 |
-| ExitMethods.cs:54:5:57:5 | {...} | ExitMethods.cs:55:9:55:23 | ...; |
-| ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | ExitMethods.cs:53:10:53:11 | exit M7 (abnormal) |
-| ExitMethods.cs:55:9:55:23 | ...; | ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 |
-| ExitMethods.cs:59:10:59:11 | enter M8 | ExitMethods.cs:60:5:63:5 | {...} |
-| ExitMethods.cs:59:10:59:11 | exit M8 (abnormal) | ExitMethods.cs:59:10:59:11 | exit M8 |
-| ExitMethods.cs:60:5:63:5 | {...} | ExitMethods.cs:61:9:61:23 | ...; |
-| ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | ExitMethods.cs:59:10:59:11 | exit M8 (abnormal) |
-| ExitMethods.cs:61:9:61:23 | ...; | ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:66:5:69:5 | {...} |
-| ExitMethods.cs:66:5:69:5 | {...} | ExitMethods.cs:67:9:68:34 | if (...) ... |
-| ExitMethods.cs:67:9:68:34 | if (...) ... | ExitMethods.cs:67:13:67:13 | access to parameter b |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:68:19:68:33 | object creation of type Exception |
-| ExitMethods.cs:68:13:68:34 | throw ...; | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (abnormal) |
-| ExitMethods.cs:68:19:68:33 | object creation of type Exception | ExitMethods.cs:68:13:68:34 | throw ...; |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:72:5:77:5 | {...} |
-| ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:71:17:71:27 | exit ErrorAlways |
-| ExitMethods.cs:72:5:77:5 | {...} | ExitMethods.cs:73:9:76:45 | if (...) ... |
-| ExitMethods.cs:73:9:76:45 | if (...) ... | ExitMethods.cs:73:13:73:13 | access to parameter b |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:74:19:74:33 | object creation of type Exception |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:76:41:76:43 | "b" |
-| ExitMethods.cs:74:19:74:33 | object creation of type Exception | ExitMethods.cs:74:13:74:34 | throw ...; |
-| ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException | ExitMethods.cs:76:13:76:45 | throw ...; |
-| ExitMethods.cs:76:41:76:43 | "b" | ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException |
-| ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 | ExitMethods.cs:80:5:82:5 | {...} |
-| ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 (abnormal) | ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 |
-| ExitMethods.cs:80:5:82:5 | {...} | ExitMethods.cs:81:15:81:29 | object creation of type Exception |
-| ExitMethods.cs:81:9:81:30 | throw ...; | ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 (abnormal) |
-| ExitMethods.cs:81:15:81:29 | object creation of type Exception | ExitMethods.cs:81:9:81:30 | throw ...; |
-| ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 | ExitMethods.cs:84:41:84:55 | object creation of type Exception |
-| ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 (abnormal) | ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 |
-| ExitMethods.cs:84:35:84:55 | throw ... | ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 (abnormal) |
-| ExitMethods.cs:84:41:84:55 | object creation of type Exception | ExitMethods.cs:84:35:84:55 | throw ... |
-| ExitMethods.cs:86:10:86:13 | enter Exit | ExitMethods.cs:87:5:89:5 | {...} |
-| ExitMethods.cs:86:10:86:13 | exit Exit (abnormal) | ExitMethods.cs:86:10:86:13 | exit Exit |
-| ExitMethods.cs:87:5:89:5 | {...} | ExitMethods.cs:88:9:88:28 | ...; |
-| ExitMethods.cs:88:9:88:27 | call to method Exit | ExitMethods.cs:86:10:86:13 | exit Exit (abnormal) |
-| ExitMethods.cs:88:9:88:28 | ...; | ExitMethods.cs:88:26:88:26 | 0 |
-| ExitMethods.cs:88:26:88:26 | 0 | ExitMethods.cs:88:9:88:27 | call to method Exit |
-| ExitMethods.cs:91:10:91:18 | enter ExitInTry | ExitMethods.cs:92:5:102:5 | {...} |
-| ExitMethods.cs:91:10:91:18 | exit ExitInTry (abnormal) | ExitMethods.cs:91:10:91:18 | exit ExitInTry |
-| ExitMethods.cs:92:5:102:5 | {...} | ExitMethods.cs:93:9:101:9 | try {...} ... |
-| ExitMethods.cs:93:9:101:9 | try {...} ... | ExitMethods.cs:94:9:96:9 | {...} |
-| ExitMethods.cs:94:9:96:9 | {...} | ExitMethods.cs:95:13:95:19 | ...; |
-| ExitMethods.cs:95:13:95:18 | call to method Exit | ExitMethods.cs:91:10:91:18 | exit ExitInTry (abnormal) |
-| ExitMethods.cs:95:13:95:18 | this access | ExitMethods.cs:95:13:95:18 | call to method Exit |
-| ExitMethods.cs:95:13:95:19 | ...; | ExitMethods.cs:95:13:95:18 | this access |
-| ExitMethods.cs:104:10:104:24 | enter ApplicationExit | ExitMethods.cs:105:5:107:5 | {...} |
-| ExitMethods.cs:104:10:104:24 | exit ApplicationExit (abnormal) | ExitMethods.cs:104:10:104:24 | exit ApplicationExit |
-| ExitMethods.cs:105:5:107:5 | {...} | ExitMethods.cs:106:9:106:48 | ...; |
-| ExitMethods.cs:106:9:106:47 | call to method Exit | ExitMethods.cs:104:10:104:24 | exit ApplicationExit (abnormal) |
-| ExitMethods.cs:106:9:106:48 | ...; | ExitMethods.cs:106:9:106:47 | call to method Exit |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:110:5:112:5 | {...} |
-| ExitMethods.cs:110:5:112:5 | {...} | ExitMethods.cs:111:16:111:20 | access to parameter input |
-| ExitMethods.cs:111:9:111:77 | return ...; | ExitMethods.cs:109:13:109:21 | exit ThrowExpr (normal) |
-| ExitMethods.cs:111:16:111:20 | access to parameter input | ExitMethods.cs:111:25:111:25 | 0 |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:29:111:29 | 1 |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:69:111:75 | "input" |
-| ExitMethods.cs:111:16:111:76 | ... ? ... : ... | ExitMethods.cs:111:9:111:77 | return ...; |
-| ExitMethods.cs:111:25:111:25 | 0 | ExitMethods.cs:111:25:111:25 | (...) ... |
-| ExitMethods.cs:111:25:111:25 | (...) ... | ExitMethods.cs:111:16:111:25 | ... != ... |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:111:29:111:29 | (...) ... |
-| ExitMethods.cs:111:29:111:29 | (...) ... | ExitMethods.cs:111:33:111:37 | access to parameter input |
-| ExitMethods.cs:111:29:111:37 | ... / ... | ExitMethods.cs:111:16:111:76 | ... ? ... : ... |
-| ExitMethods.cs:111:33:111:37 | access to parameter input | ExitMethods.cs:111:29:111:37 | ... / ... |
-| ExitMethods.cs:111:41:111:76 | throw ... | ExitMethods.cs:109:13:109:21 | exit ThrowExpr (abnormal) |
-| ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException | ExitMethods.cs:111:41:111:76 | throw ... |
-| ExitMethods.cs:111:69:111:75 | "input" | ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:115:5:117:5 | {...} |
-| ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall (normal) | ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall |
-| ExitMethods.cs:115:5:117:5 | {...} | ExitMethods.cs:116:16:116:16 | access to parameter s |
-| ExitMethods.cs:116:9:116:39 | return ...; | ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall (normal) |
-| ExitMethods.cs:116:16:116:16 | access to parameter s | ExitMethods.cs:116:27:116:29 | - |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:34:116:34 | 0 |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:38:116:38 | 1 |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:9:116:39 | return ...; |
-| ExitMethods.cs:116:27:116:29 | - | ExitMethods.cs:116:16:116:30 | call to method Contains |
-| ExitMethods.cs:119:17:119:32 | enter FailingAssertion | ExitMethods.cs:120:5:123:5 | {...} |
-| ExitMethods.cs:119:17:119:32 | exit FailingAssertion (abnormal) | ExitMethods.cs:119:17:119:32 | exit FailingAssertion |
-| ExitMethods.cs:120:5:123:5 | {...} | ExitMethods.cs:121:9:121:29 | ...; |
-| ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:119:17:119:32 | exit FailingAssertion (abnormal) |
-| ExitMethods.cs:121:9:121:29 | ...; | ExitMethods.cs:121:23:121:27 | false |
-| ExitMethods.cs:121:23:121:27 | false | ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue |
-| ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 | ExitMethods.cs:126:5:129:5 | {...} |
-| ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 (abnormal) | ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 |
-| ExitMethods.cs:126:5:129:5 | {...} | ExitMethods.cs:127:9:127:27 | ...; |
-| ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 (abnormal) |
-| ExitMethods.cs:127:9:127:26 | this access | ExitMethods.cs:127:9:127:26 | call to method FailingAssertion |
-| ExitMethods.cs:127:9:127:27 | ...; | ExitMethods.cs:127:9:127:26 | this access |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:48:131:48 | access to parameter b |
-| ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse (abnormal) |
-| ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse (normal) |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse |
-| ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 | ExitMethods.cs:134:5:137:5 | {...} |
-| ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 (abnormal) | ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 |
-| ExitMethods.cs:134:5:137:5 | {...} | ExitMethods.cs:135:9:135:26 | ...; |
-| ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 (abnormal) |
-| ExitMethods.cs:135:9:135:25 | this access | ExitMethods.cs:135:21:135:24 | true |
-| ExitMethods.cs:135:9:135:26 | ...; | ExitMethods.cs:135:9:135:25 | this access |
-| ExitMethods.cs:135:21:135:24 | true | ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse |
+| ExitMethods.cs:8:10:8:11 | enter M1 | ExitMethods.cs:9:5:12:5 | {...} |
+| ExitMethods.cs:8:10:8:11 | exit M1 (normal) | ExitMethods.cs:8:10:8:11 | exit M1 |
+| ExitMethods.cs:9:5:12:5 | {...} | ExitMethods.cs:10:9:10:25 | ...; |
+| ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe | ExitMethods.cs:11:9:11:15 | return ...; |
+| ExitMethods.cs:10:9:10:25 | ...; | ExitMethods.cs:10:20:10:23 | true |
+| ExitMethods.cs:10:20:10:23 | true | ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe |
+| ExitMethods.cs:11:9:11:15 | return ...; | ExitMethods.cs:8:10:8:11 | exit M1 (normal) |
+| ExitMethods.cs:14:10:14:11 | enter M2 | ExitMethods.cs:15:5:18:5 | {...} |
+| ExitMethods.cs:14:10:14:11 | exit M2 (normal) | ExitMethods.cs:14:10:14:11 | exit M2 |
+| ExitMethods.cs:15:5:18:5 | {...} | ExitMethods.cs:16:9:16:26 | ...; |
+| ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe | ExitMethods.cs:17:9:17:15 | return ...; |
+| ExitMethods.cs:16:9:16:26 | ...; | ExitMethods.cs:16:20:16:24 | false |
+| ExitMethods.cs:16:20:16:24 | false | ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe |
+| ExitMethods.cs:17:9:17:15 | return ...; | ExitMethods.cs:14:10:14:11 | exit M2 (normal) |
+| ExitMethods.cs:20:10:20:11 | enter M3 | ExitMethods.cs:21:5:24:5 | {...} |
+| ExitMethods.cs:20:10:20:11 | exit M3 (abnormal) | ExitMethods.cs:20:10:20:11 | exit M3 |
+| ExitMethods.cs:21:5:24:5 | {...} | ExitMethods.cs:22:9:22:26 | ...; |
+| ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | ExitMethods.cs:20:10:20:11 | exit M3 (abnormal) |
+| ExitMethods.cs:22:9:22:26 | ...; | ExitMethods.cs:22:21:22:24 | true |
+| ExitMethods.cs:22:21:22:24 | true | ExitMethods.cs:22:9:22:25 | call to method ErrorAlways |
+| ExitMethods.cs:26:10:26:11 | enter M4 | ExitMethods.cs:27:5:30:5 | {...} |
+| ExitMethods.cs:26:10:26:11 | exit M4 (abnormal) | ExitMethods.cs:26:10:26:11 | exit M4 |
+| ExitMethods.cs:27:5:30:5 | {...} | ExitMethods.cs:28:9:28:15 | ...; |
+| ExitMethods.cs:28:9:28:14 | call to method Exit | ExitMethods.cs:26:10:26:11 | exit M4 (abnormal) |
+| ExitMethods.cs:28:9:28:14 | this access | ExitMethods.cs:28:9:28:14 | call to method Exit |
+| ExitMethods.cs:28:9:28:15 | ...; | ExitMethods.cs:28:9:28:14 | this access |
+| ExitMethods.cs:32:10:32:11 | enter M5 | ExitMethods.cs:33:5:36:5 | {...} |
+| ExitMethods.cs:32:10:32:11 | exit M5 (abnormal) | ExitMethods.cs:32:10:32:11 | exit M5 |
+| ExitMethods.cs:33:5:36:5 | {...} | ExitMethods.cs:34:9:34:26 | ...; |
+| ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | ExitMethods.cs:32:10:32:11 | exit M5 (abnormal) |
+| ExitMethods.cs:34:9:34:25 | this access | ExitMethods.cs:34:9:34:25 | call to method ApplicationExit |
+| ExitMethods.cs:34:9:34:26 | ...; | ExitMethods.cs:34:9:34:25 | this access |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:39:5:52:5 | {...} |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:38:10:38:11 | exit M6 |
+| ExitMethods.cs:39:5:52:5 | {...} | ExitMethods.cs:40:9:51:9 | try {...} ... |
+| ExitMethods.cs:40:9:51:9 | try {...} ... | ExitMethods.cs:41:9:43:9 | {...} |
+| ExitMethods.cs:41:9:43:9 | {...} | ExitMethods.cs:42:13:42:31 | ...; |
+| ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} |
+| ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:42:13:42:31 | ...; | ExitMethods.cs:42:25:42:29 | false |
+| ExitMethods.cs:42:25:42:29 | false | ExitMethods.cs:42:13:42:30 | call to method ErrorAlways |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:46:13:46:19 | return ...; |
+| ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:49:9:51:9 | {...} |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:50:13:50:19 | return ...; |
+| ExitMethods.cs:54:10:54:11 | enter M7 | ExitMethods.cs:55:5:58:5 | {...} |
+| ExitMethods.cs:54:10:54:11 | exit M7 (abnormal) | ExitMethods.cs:54:10:54:11 | exit M7 |
+| ExitMethods.cs:55:5:58:5 | {...} | ExitMethods.cs:56:9:56:23 | ...; |
+| ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | ExitMethods.cs:54:10:54:11 | exit M7 (abnormal) |
+| ExitMethods.cs:56:9:56:23 | ...; | ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 |
+| ExitMethods.cs:60:10:60:11 | enter M8 | ExitMethods.cs:61:5:64:5 | {...} |
+| ExitMethods.cs:60:10:60:11 | exit M8 (abnormal) | ExitMethods.cs:60:10:60:11 | exit M8 |
+| ExitMethods.cs:61:5:64:5 | {...} | ExitMethods.cs:62:9:62:23 | ...; |
+| ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | ExitMethods.cs:60:10:60:11 | exit M8 (abnormal) |
+| ExitMethods.cs:62:9:62:23 | ...; | ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:67:5:70:5 | {...} |
+| ExitMethods.cs:67:5:70:5 | {...} | ExitMethods.cs:68:9:69:34 | if (...) ... |
+| ExitMethods.cs:68:9:69:34 | if (...) ... | ExitMethods.cs:68:13:68:13 | access to parameter b |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:69:19:69:33 | object creation of type Exception |
+| ExitMethods.cs:69:13:69:34 | throw ...; | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (abnormal) |
+| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:69:13:69:34 | throw ...; |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:73:5:78:5 | {...} |
+| ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:72:17:72:27 | exit ErrorAlways |
+| ExitMethods.cs:73:5:78:5 | {...} | ExitMethods.cs:74:9:77:45 | if (...) ... |
+| ExitMethods.cs:74:9:77:45 | if (...) ... | ExitMethods.cs:74:13:74:13 | access to parameter b |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:75:19:75:33 | object creation of type Exception |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:77:41:77:43 | "b" |
+| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:75:13:75:34 | throw ...; |
+| ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException | ExitMethods.cs:77:13:77:45 | throw ...; |
+| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException |
+| ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 | ExitMethods.cs:81:5:83:5 | {...} |
+| ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 (abnormal) | ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 |
+| ExitMethods.cs:81:5:83:5 | {...} | ExitMethods.cs:82:15:82:29 | object creation of type Exception |
+| ExitMethods.cs:82:9:82:30 | throw ...; | ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 (abnormal) |
+| ExitMethods.cs:82:15:82:29 | object creation of type Exception | ExitMethods.cs:82:9:82:30 | throw ...; |
+| ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 | ExitMethods.cs:85:41:85:55 | object creation of type Exception |
+| ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 (abnormal) | ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 |
+| ExitMethods.cs:85:35:85:55 | throw ... | ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 (abnormal) |
+| ExitMethods.cs:85:41:85:55 | object creation of type Exception | ExitMethods.cs:85:35:85:55 | throw ... |
+| ExitMethods.cs:87:10:87:13 | enter Exit | ExitMethods.cs:88:5:90:5 | {...} |
+| ExitMethods.cs:87:10:87:13 | exit Exit (abnormal) | ExitMethods.cs:87:10:87:13 | exit Exit |
+| ExitMethods.cs:88:5:90:5 | {...} | ExitMethods.cs:89:9:89:28 | ...; |
+| ExitMethods.cs:89:9:89:27 | call to method Exit | ExitMethods.cs:87:10:87:13 | exit Exit (abnormal) |
+| ExitMethods.cs:89:9:89:28 | ...; | ExitMethods.cs:89:26:89:26 | 0 |
+| ExitMethods.cs:89:26:89:26 | 0 | ExitMethods.cs:89:9:89:27 | call to method Exit |
+| ExitMethods.cs:92:10:92:18 | enter ExitInTry | ExitMethods.cs:93:5:103:5 | {...} |
+| ExitMethods.cs:92:10:92:18 | exit ExitInTry (abnormal) | ExitMethods.cs:92:10:92:18 | exit ExitInTry |
+| ExitMethods.cs:93:5:103:5 | {...} | ExitMethods.cs:94:9:102:9 | try {...} ... |
+| ExitMethods.cs:94:9:102:9 | try {...} ... | ExitMethods.cs:95:9:97:9 | {...} |
+| ExitMethods.cs:95:9:97:9 | {...} | ExitMethods.cs:96:13:96:19 | ...; |
+| ExitMethods.cs:96:13:96:18 | call to method Exit | ExitMethods.cs:92:10:92:18 | exit ExitInTry (abnormal) |
+| ExitMethods.cs:96:13:96:18 | this access | ExitMethods.cs:96:13:96:18 | call to method Exit |
+| ExitMethods.cs:96:13:96:19 | ...; | ExitMethods.cs:96:13:96:18 | this access |
+| ExitMethods.cs:105:10:105:24 | enter ApplicationExit | ExitMethods.cs:106:5:108:5 | {...} |
+| ExitMethods.cs:105:10:105:24 | exit ApplicationExit (abnormal) | ExitMethods.cs:105:10:105:24 | exit ApplicationExit |
+| ExitMethods.cs:106:5:108:5 | {...} | ExitMethods.cs:107:9:107:48 | ...; |
+| ExitMethods.cs:107:9:107:47 | call to method Exit | ExitMethods.cs:105:10:105:24 | exit ApplicationExit (abnormal) |
+| ExitMethods.cs:107:9:107:48 | ...; | ExitMethods.cs:107:9:107:47 | call to method Exit |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:111:5:113:5 | {...} |
+| ExitMethods.cs:111:5:113:5 | {...} | ExitMethods.cs:112:16:112:20 | access to parameter input |
+| ExitMethods.cs:112:9:112:77 | return ...; | ExitMethods.cs:110:13:110:21 | exit ThrowExpr (normal) |
+| ExitMethods.cs:112:16:112:20 | access to parameter input | ExitMethods.cs:112:25:112:25 | 0 |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:29:112:29 | 1 |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:69:112:75 | "input" |
+| ExitMethods.cs:112:16:112:76 | ... ? ... : ... | ExitMethods.cs:112:9:112:77 | return ...; |
+| ExitMethods.cs:112:25:112:25 | 0 | ExitMethods.cs:112:25:112:25 | (...) ... |
+| ExitMethods.cs:112:25:112:25 | (...) ... | ExitMethods.cs:112:16:112:25 | ... != ... |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:112:29:112:29 | (...) ... |
+| ExitMethods.cs:112:29:112:29 | (...) ... | ExitMethods.cs:112:33:112:37 | access to parameter input |
+| ExitMethods.cs:112:29:112:37 | ... / ... | ExitMethods.cs:112:16:112:76 | ... ? ... : ... |
+| ExitMethods.cs:112:33:112:37 | access to parameter input | ExitMethods.cs:112:29:112:37 | ... / ... |
+| ExitMethods.cs:112:41:112:76 | throw ... | ExitMethods.cs:110:13:110:21 | exit ThrowExpr (abnormal) |
+| ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException | ExitMethods.cs:112:41:112:76 | throw ... |
+| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:116:5:118:5 | {...} |
+| ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall (normal) | ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall |
+| ExitMethods.cs:116:5:118:5 | {...} | ExitMethods.cs:117:16:117:16 | access to parameter s |
+| ExitMethods.cs:117:9:117:39 | return ...; | ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall (normal) |
+| ExitMethods.cs:117:16:117:16 | access to parameter s | ExitMethods.cs:117:27:117:29 | - |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:34:117:34 | 0 |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:38:117:38 | 1 |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:9:117:39 | return ...; |
+| ExitMethods.cs:117:27:117:29 | - | ExitMethods.cs:117:16:117:30 | call to method Contains |
+| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:121:5:124:5 | {...} |
+| ExitMethods.cs:120:17:120:32 | exit FailingAssertion (abnormal) | ExitMethods.cs:120:17:120:32 | exit FailingAssertion |
+| ExitMethods.cs:121:5:124:5 | {...} | ExitMethods.cs:122:9:122:29 | ...; |
+| ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:120:17:120:32 | exit FailingAssertion (abnormal) |
+| ExitMethods.cs:122:9:122:29 | ...; | ExitMethods.cs:122:23:122:27 | false |
+| ExitMethods.cs:122:23:122:27 | false | ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue |
+| ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 | ExitMethods.cs:127:5:130:5 | {...} |
+| ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 (abnormal) | ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 |
+| ExitMethods.cs:127:5:130:5 | {...} | ExitMethods.cs:128:9:128:27 | ...; |
+| ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 (abnormal) |
+| ExitMethods.cs:128:9:128:26 | this access | ExitMethods.cs:128:9:128:26 | call to method FailingAssertion |
+| ExitMethods.cs:128:9:128:27 | ...; | ExitMethods.cs:128:9:128:26 | this access |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:48:132:48 | access to parameter b |
+| ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse (abnormal) |
+| ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse (normal) |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse |
+| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:135:5:138:5 | {...} |
+| ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 (abnormal) | ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 |
+| ExitMethods.cs:135:5:138:5 | {...} | ExitMethods.cs:136:9:136:26 | ...; |
+| ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 (abnormal) |
+| ExitMethods.cs:136:9:136:25 | this access | ExitMethods.cs:136:21:136:24 | true |
+| ExitMethods.cs:136:9:136:26 | ...; | ExitMethods.cs:136:9:136:25 | this access |
+| ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:141:5:147:5 | {...} |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow |
+| ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:142:9:145:53 | if (...) ... |
+| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:142:13:142:13 | access to parameter b |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:143:13:143:43 | ...; |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:145:13:145:53 | ...; |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:41:143:41 | access to parameter e |
+| ExitMethods.cs:143:41:143:41 | access to parameter e | ExitMethods.cs:143:13:143:42 | call to method Throw |
+| ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:145:13:145:52 | call to method Throw |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:43:145:43 | access to parameter e |
+| ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:145:13:145:44 | call to method Capture |
+| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:27:146:32 | "dead" |
+| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:146:9:146:33 | call to method WriteLine |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:6:5:8:5 | {...} |
 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) | Extensions.cs:5:23:5:29 | exit ToInt32 |
 | Extensions.cs:6:5:8:5 | {...} | Extensions.cs:7:28:7:28 | access to parameter s |
@@ -5582,147 +5596,161 @@ postDominance
 | Conditions.cs:149:38:149:47 | $"..." | Conditions.cs:149:45:149:45 | access to local variable s |
 | Conditions.cs:149:40:149:43 | "b = " | Conditions.cs:149:13:149:49 | ...; |
 | Conditions.cs:149:45:149:45 | access to local variable s | Conditions.cs:149:40:149:43 | "b = " |
-| ExitMethods.cs:7:10:7:11 | exit M1 | ExitMethods.cs:7:10:7:11 | exit M1 (normal) |
-| ExitMethods.cs:7:10:7:11 | exit M1 (normal) | ExitMethods.cs:10:9:10:15 | return ...; |
-| ExitMethods.cs:8:5:11:5 | {...} | ExitMethods.cs:7:10:7:11 | enter M1 |
-| ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe | ExitMethods.cs:9:20:9:23 | true |
-| ExitMethods.cs:9:9:9:25 | ...; | ExitMethods.cs:8:5:11:5 | {...} |
-| ExitMethods.cs:9:20:9:23 | true | ExitMethods.cs:9:9:9:25 | ...; |
-| ExitMethods.cs:10:9:10:15 | return ...; | ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe |
-| ExitMethods.cs:13:10:13:11 | exit M2 | ExitMethods.cs:13:10:13:11 | exit M2 (normal) |
-| ExitMethods.cs:13:10:13:11 | exit M2 (normal) | ExitMethods.cs:16:9:16:15 | return ...; |
-| ExitMethods.cs:14:5:17:5 | {...} | ExitMethods.cs:13:10:13:11 | enter M2 |
-| ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe | ExitMethods.cs:15:20:15:24 | false |
-| ExitMethods.cs:15:9:15:26 | ...; | ExitMethods.cs:14:5:17:5 | {...} |
-| ExitMethods.cs:15:20:15:24 | false | ExitMethods.cs:15:9:15:26 | ...; |
-| ExitMethods.cs:16:9:16:15 | return ...; | ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe |
-| ExitMethods.cs:19:10:19:11 | exit M3 | ExitMethods.cs:19:10:19:11 | exit M3 (abnormal) |
-| ExitMethods.cs:19:10:19:11 | exit M3 (abnormal) | ExitMethods.cs:21:9:21:25 | call to method ErrorAlways |
-| ExitMethods.cs:20:5:23:5 | {...} | ExitMethods.cs:19:10:19:11 | enter M3 |
-| ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | ExitMethods.cs:21:21:21:24 | true |
-| ExitMethods.cs:21:9:21:26 | ...; | ExitMethods.cs:20:5:23:5 | {...} |
-| ExitMethods.cs:21:21:21:24 | true | ExitMethods.cs:21:9:21:26 | ...; |
-| ExitMethods.cs:25:10:25:11 | exit M4 | ExitMethods.cs:25:10:25:11 | exit M4 (abnormal) |
-| ExitMethods.cs:25:10:25:11 | exit M4 (abnormal) | ExitMethods.cs:27:9:27:14 | call to method Exit |
-| ExitMethods.cs:26:5:29:5 | {...} | ExitMethods.cs:25:10:25:11 | enter M4 |
-| ExitMethods.cs:27:9:27:14 | call to method Exit | ExitMethods.cs:27:9:27:14 | this access |
-| ExitMethods.cs:27:9:27:14 | this access | ExitMethods.cs:27:9:27:15 | ...; |
-| ExitMethods.cs:27:9:27:15 | ...; | ExitMethods.cs:26:5:29:5 | {...} |
-| ExitMethods.cs:31:10:31:11 | exit M5 | ExitMethods.cs:31:10:31:11 | exit M5 (abnormal) |
-| ExitMethods.cs:31:10:31:11 | exit M5 (abnormal) | ExitMethods.cs:33:9:33:25 | call to method ApplicationExit |
-| ExitMethods.cs:32:5:35:5 | {...} | ExitMethods.cs:31:10:31:11 | enter M5 |
-| ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | ExitMethods.cs:33:9:33:25 | this access |
-| ExitMethods.cs:33:9:33:25 | this access | ExitMethods.cs:33:9:33:26 | ...; |
-| ExitMethods.cs:33:9:33:26 | ...; | ExitMethods.cs:32:5:35:5 | {...} |
-| ExitMethods.cs:37:10:37:11 | exit M6 | ExitMethods.cs:37:10:37:11 | exit M6 (normal) |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:45:13:45:19 | return ...; |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:49:13:49:19 | return ...; |
-| ExitMethods.cs:38:5:51:5 | {...} | ExitMethods.cs:37:10:37:11 | enter M6 |
-| ExitMethods.cs:39:9:50:9 | try {...} ... | ExitMethods.cs:38:5:51:5 | {...} |
-| ExitMethods.cs:40:9:42:9 | {...} | ExitMethods.cs:39:9:50:9 | try {...} ... |
-| ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | ExitMethods.cs:41:25:41:29 | false |
-| ExitMethods.cs:41:13:41:31 | ...; | ExitMethods.cs:40:9:42:9 | {...} |
-| ExitMethods.cs:41:25:41:29 | false | ExitMethods.cs:41:13:41:31 | ...; |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} |
-| ExitMethods.cs:45:13:45:19 | return ...; | ExitMethods.cs:44:9:46:9 | {...} |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:49:13:49:19 | return ...; | ExitMethods.cs:48:9:50:9 | {...} |
-| ExitMethods.cs:53:10:53:11 | exit M7 | ExitMethods.cs:53:10:53:11 | exit M7 (abnormal) |
-| ExitMethods.cs:53:10:53:11 | exit M7 (abnormal) | ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 |
-| ExitMethods.cs:54:5:57:5 | {...} | ExitMethods.cs:53:10:53:11 | enter M7 |
-| ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | ExitMethods.cs:55:9:55:23 | ...; |
-| ExitMethods.cs:55:9:55:23 | ...; | ExitMethods.cs:54:5:57:5 | {...} |
-| ExitMethods.cs:59:10:59:11 | exit M8 | ExitMethods.cs:59:10:59:11 | exit M8 (abnormal) |
-| ExitMethods.cs:59:10:59:11 | exit M8 (abnormal) | ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 |
-| ExitMethods.cs:60:5:63:5 | {...} | ExitMethods.cs:59:10:59:11 | enter M8 |
-| ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | ExitMethods.cs:61:9:61:23 | ...; |
-| ExitMethods.cs:61:9:61:23 | ...; | ExitMethods.cs:60:5:63:5 | {...} |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (abnormal) | ExitMethods.cs:68:13:68:34 | throw ...; |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | ExitMethods.cs:67:13:67:13 | access to parameter b |
-| ExitMethods.cs:66:5:69:5 | {...} | ExitMethods.cs:65:17:65:26 | enter ErrorMaybe |
-| ExitMethods.cs:67:9:68:34 | if (...) ... | ExitMethods.cs:66:5:69:5 | {...} |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:67:9:68:34 | if (...) ... |
-| ExitMethods.cs:68:13:68:34 | throw ...; | ExitMethods.cs:68:19:68:33 | object creation of type Exception |
-| ExitMethods.cs:71:17:71:27 | exit ErrorAlways | ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) |
-| ExitMethods.cs:72:5:77:5 | {...} | ExitMethods.cs:71:17:71:27 | enter ErrorAlways |
-| ExitMethods.cs:73:9:76:45 | if (...) ... | ExitMethods.cs:72:5:77:5 | {...} |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:73:9:76:45 | if (...) ... |
-| ExitMethods.cs:74:13:74:34 | throw ...; | ExitMethods.cs:74:19:74:33 | object creation of type Exception |
-| ExitMethods.cs:76:13:76:45 | throw ...; | ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException |
-| ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException | ExitMethods.cs:76:41:76:43 | "b" |
-| ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 | ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 (abnormal) |
-| ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 (abnormal) | ExitMethods.cs:81:9:81:30 | throw ...; |
-| ExitMethods.cs:80:5:82:5 | {...} | ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 |
-| ExitMethods.cs:81:9:81:30 | throw ...; | ExitMethods.cs:81:15:81:29 | object creation of type Exception |
-| ExitMethods.cs:81:15:81:29 | object creation of type Exception | ExitMethods.cs:80:5:82:5 | {...} |
-| ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 | ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 (abnormal) |
-| ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 (abnormal) | ExitMethods.cs:84:35:84:55 | throw ... |
-| ExitMethods.cs:84:35:84:55 | throw ... | ExitMethods.cs:84:41:84:55 | object creation of type Exception |
-| ExitMethods.cs:84:41:84:55 | object creation of type Exception | ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 |
-| ExitMethods.cs:86:10:86:13 | exit Exit | ExitMethods.cs:86:10:86:13 | exit Exit (abnormal) |
-| ExitMethods.cs:86:10:86:13 | exit Exit (abnormal) | ExitMethods.cs:88:9:88:27 | call to method Exit |
-| ExitMethods.cs:87:5:89:5 | {...} | ExitMethods.cs:86:10:86:13 | enter Exit |
-| ExitMethods.cs:88:9:88:27 | call to method Exit | ExitMethods.cs:88:26:88:26 | 0 |
-| ExitMethods.cs:88:9:88:28 | ...; | ExitMethods.cs:87:5:89:5 | {...} |
-| ExitMethods.cs:88:26:88:26 | 0 | ExitMethods.cs:88:9:88:28 | ...; |
-| ExitMethods.cs:91:10:91:18 | exit ExitInTry | ExitMethods.cs:91:10:91:18 | exit ExitInTry (abnormal) |
-| ExitMethods.cs:91:10:91:18 | exit ExitInTry (abnormal) | ExitMethods.cs:95:13:95:18 | call to method Exit |
-| ExitMethods.cs:92:5:102:5 | {...} | ExitMethods.cs:91:10:91:18 | enter ExitInTry |
-| ExitMethods.cs:93:9:101:9 | try {...} ... | ExitMethods.cs:92:5:102:5 | {...} |
-| ExitMethods.cs:94:9:96:9 | {...} | ExitMethods.cs:93:9:101:9 | try {...} ... |
-| ExitMethods.cs:95:13:95:18 | call to method Exit | ExitMethods.cs:95:13:95:18 | this access |
-| ExitMethods.cs:95:13:95:18 | this access | ExitMethods.cs:95:13:95:19 | ...; |
-| ExitMethods.cs:95:13:95:19 | ...; | ExitMethods.cs:94:9:96:9 | {...} |
-| ExitMethods.cs:104:10:104:24 | exit ApplicationExit | ExitMethods.cs:104:10:104:24 | exit ApplicationExit (abnormal) |
-| ExitMethods.cs:104:10:104:24 | exit ApplicationExit (abnormal) | ExitMethods.cs:106:9:106:47 | call to method Exit |
-| ExitMethods.cs:105:5:107:5 | {...} | ExitMethods.cs:104:10:104:24 | enter ApplicationExit |
-| ExitMethods.cs:106:9:106:47 | call to method Exit | ExitMethods.cs:106:9:106:48 | ...; |
-| ExitMethods.cs:106:9:106:48 | ...; | ExitMethods.cs:105:5:107:5 | {...} |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr (abnormal) | ExitMethods.cs:111:41:111:76 | throw ... |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr (normal) | ExitMethods.cs:111:9:111:77 | return ...; |
-| ExitMethods.cs:110:5:112:5 | {...} | ExitMethods.cs:109:13:109:21 | enter ThrowExpr |
-| ExitMethods.cs:111:9:111:77 | return ...; | ExitMethods.cs:111:16:111:76 | ... ? ... : ... |
-| ExitMethods.cs:111:16:111:20 | access to parameter input | ExitMethods.cs:110:5:112:5 | {...} |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:25:111:25 | (...) ... |
-| ExitMethods.cs:111:16:111:76 | ... ? ... : ... | ExitMethods.cs:111:29:111:37 | ... / ... |
-| ExitMethods.cs:111:25:111:25 | 0 | ExitMethods.cs:111:16:111:20 | access to parameter input |
-| ExitMethods.cs:111:25:111:25 | (...) ... | ExitMethods.cs:111:25:111:25 | 0 |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:111:16:111:25 | ... != ... |
-| ExitMethods.cs:111:29:111:29 | (...) ... | ExitMethods.cs:111:29:111:29 | 1 |
-| ExitMethods.cs:111:29:111:37 | ... / ... | ExitMethods.cs:111:33:111:37 | access to parameter input |
-| ExitMethods.cs:111:33:111:37 | access to parameter input | ExitMethods.cs:111:29:111:29 | (...) ... |
-| ExitMethods.cs:111:41:111:76 | throw ... | ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException |
-| ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException | ExitMethods.cs:111:69:111:75 | "input" |
-| ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall | ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall (normal) |
-| ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall (normal) | ExitMethods.cs:116:9:116:39 | return ...; |
-| ExitMethods.cs:115:5:117:5 | {...} | ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall |
-| ExitMethods.cs:116:9:116:39 | return ...; | ExitMethods.cs:116:16:116:38 | ... ? ... : ... |
-| ExitMethods.cs:116:16:116:16 | access to parameter s | ExitMethods.cs:115:5:117:5 | {...} |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:27:116:29 | - |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:34:116:34 | 0 |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:38:116:38 | 1 |
-| ExitMethods.cs:116:27:116:29 | - | ExitMethods.cs:116:16:116:16 | access to parameter s |
-| ExitMethods.cs:119:17:119:32 | exit FailingAssertion | ExitMethods.cs:119:17:119:32 | exit FailingAssertion (abnormal) |
-| ExitMethods.cs:119:17:119:32 | exit FailingAssertion (abnormal) | ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue |
-| ExitMethods.cs:120:5:123:5 | {...} | ExitMethods.cs:119:17:119:32 | enter FailingAssertion |
-| ExitMethods.cs:121:9:121:29 | ...; | ExitMethods.cs:120:5:123:5 | {...} |
-| ExitMethods.cs:121:23:121:27 | false | ExitMethods.cs:121:9:121:29 | ...; |
-| ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 | ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 (abnormal) |
-| ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 (abnormal) | ExitMethods.cs:127:9:127:26 | call to method FailingAssertion |
-| ExitMethods.cs:126:5:129:5 | {...} | ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 |
-| ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | ExitMethods.cs:127:9:127:26 | this access |
-| ExitMethods.cs:127:9:127:26 | this access | ExitMethods.cs:127:9:127:27 | ...; |
-| ExitMethods.cs:127:9:127:27 | ...; | ExitMethods.cs:126:5:129:5 | {...} |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse (abnormal) | ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse (normal) | ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | ExitMethods.cs:131:48:131:48 | access to parameter b |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:10:131:20 | enter AssertFalse |
-| ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 | ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 (abnormal) |
-| ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 (abnormal) | ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse |
-| ExitMethods.cs:134:5:137:5 | {...} | ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 |
-| ExitMethods.cs:135:9:135:25 | this access | ExitMethods.cs:135:9:135:26 | ...; |
-| ExitMethods.cs:135:9:135:26 | ...; | ExitMethods.cs:134:5:137:5 | {...} |
-| ExitMethods.cs:135:21:135:24 | true | ExitMethods.cs:135:9:135:25 | this access |
+| ExitMethods.cs:8:10:8:11 | exit M1 | ExitMethods.cs:8:10:8:11 | exit M1 (normal) |
+| ExitMethods.cs:8:10:8:11 | exit M1 (normal) | ExitMethods.cs:11:9:11:15 | return ...; |
+| ExitMethods.cs:9:5:12:5 | {...} | ExitMethods.cs:8:10:8:11 | enter M1 |
+| ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe | ExitMethods.cs:10:20:10:23 | true |
+| ExitMethods.cs:10:9:10:25 | ...; | ExitMethods.cs:9:5:12:5 | {...} |
+| ExitMethods.cs:10:20:10:23 | true | ExitMethods.cs:10:9:10:25 | ...; |
+| ExitMethods.cs:11:9:11:15 | return ...; | ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe |
+| ExitMethods.cs:14:10:14:11 | exit M2 | ExitMethods.cs:14:10:14:11 | exit M2 (normal) |
+| ExitMethods.cs:14:10:14:11 | exit M2 (normal) | ExitMethods.cs:17:9:17:15 | return ...; |
+| ExitMethods.cs:15:5:18:5 | {...} | ExitMethods.cs:14:10:14:11 | enter M2 |
+| ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe | ExitMethods.cs:16:20:16:24 | false |
+| ExitMethods.cs:16:9:16:26 | ...; | ExitMethods.cs:15:5:18:5 | {...} |
+| ExitMethods.cs:16:20:16:24 | false | ExitMethods.cs:16:9:16:26 | ...; |
+| ExitMethods.cs:17:9:17:15 | return ...; | ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe |
+| ExitMethods.cs:20:10:20:11 | exit M3 | ExitMethods.cs:20:10:20:11 | exit M3 (abnormal) |
+| ExitMethods.cs:20:10:20:11 | exit M3 (abnormal) | ExitMethods.cs:22:9:22:25 | call to method ErrorAlways |
+| ExitMethods.cs:21:5:24:5 | {...} | ExitMethods.cs:20:10:20:11 | enter M3 |
+| ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | ExitMethods.cs:22:21:22:24 | true |
+| ExitMethods.cs:22:9:22:26 | ...; | ExitMethods.cs:21:5:24:5 | {...} |
+| ExitMethods.cs:22:21:22:24 | true | ExitMethods.cs:22:9:22:26 | ...; |
+| ExitMethods.cs:26:10:26:11 | exit M4 | ExitMethods.cs:26:10:26:11 | exit M4 (abnormal) |
+| ExitMethods.cs:26:10:26:11 | exit M4 (abnormal) | ExitMethods.cs:28:9:28:14 | call to method Exit |
+| ExitMethods.cs:27:5:30:5 | {...} | ExitMethods.cs:26:10:26:11 | enter M4 |
+| ExitMethods.cs:28:9:28:14 | call to method Exit | ExitMethods.cs:28:9:28:14 | this access |
+| ExitMethods.cs:28:9:28:14 | this access | ExitMethods.cs:28:9:28:15 | ...; |
+| ExitMethods.cs:28:9:28:15 | ...; | ExitMethods.cs:27:5:30:5 | {...} |
+| ExitMethods.cs:32:10:32:11 | exit M5 | ExitMethods.cs:32:10:32:11 | exit M5 (abnormal) |
+| ExitMethods.cs:32:10:32:11 | exit M5 (abnormal) | ExitMethods.cs:34:9:34:25 | call to method ApplicationExit |
+| ExitMethods.cs:33:5:36:5 | {...} | ExitMethods.cs:32:10:32:11 | enter M5 |
+| ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | ExitMethods.cs:34:9:34:25 | this access |
+| ExitMethods.cs:34:9:34:25 | this access | ExitMethods.cs:34:9:34:26 | ...; |
+| ExitMethods.cs:34:9:34:26 | ...; | ExitMethods.cs:33:5:36:5 | {...} |
+| ExitMethods.cs:38:10:38:11 | exit M6 | ExitMethods.cs:38:10:38:11 | exit M6 (normal) |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:46:13:46:19 | return ...; |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:50:13:50:19 | return ...; |
+| ExitMethods.cs:39:5:52:5 | {...} | ExitMethods.cs:38:10:38:11 | enter M6 |
+| ExitMethods.cs:40:9:51:9 | try {...} ... | ExitMethods.cs:39:5:52:5 | {...} |
+| ExitMethods.cs:41:9:43:9 | {...} | ExitMethods.cs:40:9:51:9 | try {...} ... |
+| ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | ExitMethods.cs:42:25:42:29 | false |
+| ExitMethods.cs:42:13:42:31 | ...; | ExitMethods.cs:41:9:43:9 | {...} |
+| ExitMethods.cs:42:25:42:29 | false | ExitMethods.cs:42:13:42:31 | ...; |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} |
+| ExitMethods.cs:46:13:46:19 | return ...; | ExitMethods.cs:45:9:47:9 | {...} |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:50:13:50:19 | return ...; | ExitMethods.cs:49:9:51:9 | {...} |
+| ExitMethods.cs:54:10:54:11 | exit M7 | ExitMethods.cs:54:10:54:11 | exit M7 (abnormal) |
+| ExitMethods.cs:54:10:54:11 | exit M7 (abnormal) | ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 |
+| ExitMethods.cs:55:5:58:5 | {...} | ExitMethods.cs:54:10:54:11 | enter M7 |
+| ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | ExitMethods.cs:56:9:56:23 | ...; |
+| ExitMethods.cs:56:9:56:23 | ...; | ExitMethods.cs:55:5:58:5 | {...} |
+| ExitMethods.cs:60:10:60:11 | exit M8 | ExitMethods.cs:60:10:60:11 | exit M8 (abnormal) |
+| ExitMethods.cs:60:10:60:11 | exit M8 (abnormal) | ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 |
+| ExitMethods.cs:61:5:64:5 | {...} | ExitMethods.cs:60:10:60:11 | enter M8 |
+| ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | ExitMethods.cs:62:9:62:23 | ...; |
+| ExitMethods.cs:62:9:62:23 | ...; | ExitMethods.cs:61:5:64:5 | {...} |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (abnormal) | ExitMethods.cs:69:13:69:34 | throw ...; |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | ExitMethods.cs:68:13:68:13 | access to parameter b |
+| ExitMethods.cs:67:5:70:5 | {...} | ExitMethods.cs:66:17:66:26 | enter ErrorMaybe |
+| ExitMethods.cs:68:9:69:34 | if (...) ... | ExitMethods.cs:67:5:70:5 | {...} |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:68:9:69:34 | if (...) ... |
+| ExitMethods.cs:69:13:69:34 | throw ...; | ExitMethods.cs:69:19:69:33 | object creation of type Exception |
+| ExitMethods.cs:72:17:72:27 | exit ErrorAlways | ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) |
+| ExitMethods.cs:73:5:78:5 | {...} | ExitMethods.cs:72:17:72:27 | enter ErrorAlways |
+| ExitMethods.cs:74:9:77:45 | if (...) ... | ExitMethods.cs:73:5:78:5 | {...} |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:74:9:77:45 | if (...) ... |
+| ExitMethods.cs:75:13:75:34 | throw ...; | ExitMethods.cs:75:19:75:33 | object creation of type Exception |
+| ExitMethods.cs:77:13:77:45 | throw ...; | ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException |
+| ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException | ExitMethods.cs:77:41:77:43 | "b" |
+| ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 | ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 (abnormal) |
+| ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 (abnormal) | ExitMethods.cs:82:9:82:30 | throw ...; |
+| ExitMethods.cs:81:5:83:5 | {...} | ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 |
+| ExitMethods.cs:82:9:82:30 | throw ...; | ExitMethods.cs:82:15:82:29 | object creation of type Exception |
+| ExitMethods.cs:82:15:82:29 | object creation of type Exception | ExitMethods.cs:81:5:83:5 | {...} |
+| ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 | ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 (abnormal) |
+| ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 (abnormal) | ExitMethods.cs:85:35:85:55 | throw ... |
+| ExitMethods.cs:85:35:85:55 | throw ... | ExitMethods.cs:85:41:85:55 | object creation of type Exception |
+| ExitMethods.cs:85:41:85:55 | object creation of type Exception | ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 |
+| ExitMethods.cs:87:10:87:13 | exit Exit | ExitMethods.cs:87:10:87:13 | exit Exit (abnormal) |
+| ExitMethods.cs:87:10:87:13 | exit Exit (abnormal) | ExitMethods.cs:89:9:89:27 | call to method Exit |
+| ExitMethods.cs:88:5:90:5 | {...} | ExitMethods.cs:87:10:87:13 | enter Exit |
+| ExitMethods.cs:89:9:89:27 | call to method Exit | ExitMethods.cs:89:26:89:26 | 0 |
+| ExitMethods.cs:89:9:89:28 | ...; | ExitMethods.cs:88:5:90:5 | {...} |
+| ExitMethods.cs:89:26:89:26 | 0 | ExitMethods.cs:89:9:89:28 | ...; |
+| ExitMethods.cs:92:10:92:18 | exit ExitInTry | ExitMethods.cs:92:10:92:18 | exit ExitInTry (abnormal) |
+| ExitMethods.cs:92:10:92:18 | exit ExitInTry (abnormal) | ExitMethods.cs:96:13:96:18 | call to method Exit |
+| ExitMethods.cs:93:5:103:5 | {...} | ExitMethods.cs:92:10:92:18 | enter ExitInTry |
+| ExitMethods.cs:94:9:102:9 | try {...} ... | ExitMethods.cs:93:5:103:5 | {...} |
+| ExitMethods.cs:95:9:97:9 | {...} | ExitMethods.cs:94:9:102:9 | try {...} ... |
+| ExitMethods.cs:96:13:96:18 | call to method Exit | ExitMethods.cs:96:13:96:18 | this access |
+| ExitMethods.cs:96:13:96:18 | this access | ExitMethods.cs:96:13:96:19 | ...; |
+| ExitMethods.cs:96:13:96:19 | ...; | ExitMethods.cs:95:9:97:9 | {...} |
+| ExitMethods.cs:105:10:105:24 | exit ApplicationExit | ExitMethods.cs:105:10:105:24 | exit ApplicationExit (abnormal) |
+| ExitMethods.cs:105:10:105:24 | exit ApplicationExit (abnormal) | ExitMethods.cs:107:9:107:47 | call to method Exit |
+| ExitMethods.cs:106:5:108:5 | {...} | ExitMethods.cs:105:10:105:24 | enter ApplicationExit |
+| ExitMethods.cs:107:9:107:47 | call to method Exit | ExitMethods.cs:107:9:107:48 | ...; |
+| ExitMethods.cs:107:9:107:48 | ...; | ExitMethods.cs:106:5:108:5 | {...} |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr (abnormal) | ExitMethods.cs:112:41:112:76 | throw ... |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr (normal) | ExitMethods.cs:112:9:112:77 | return ...; |
+| ExitMethods.cs:111:5:113:5 | {...} | ExitMethods.cs:110:13:110:21 | enter ThrowExpr |
+| ExitMethods.cs:112:9:112:77 | return ...; | ExitMethods.cs:112:16:112:76 | ... ? ... : ... |
+| ExitMethods.cs:112:16:112:20 | access to parameter input | ExitMethods.cs:111:5:113:5 | {...} |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:25:112:25 | (...) ... |
+| ExitMethods.cs:112:16:112:76 | ... ? ... : ... | ExitMethods.cs:112:29:112:37 | ... / ... |
+| ExitMethods.cs:112:25:112:25 | 0 | ExitMethods.cs:112:16:112:20 | access to parameter input |
+| ExitMethods.cs:112:25:112:25 | (...) ... | ExitMethods.cs:112:25:112:25 | 0 |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:112:16:112:25 | ... != ... |
+| ExitMethods.cs:112:29:112:29 | (...) ... | ExitMethods.cs:112:29:112:29 | 1 |
+| ExitMethods.cs:112:29:112:37 | ... / ... | ExitMethods.cs:112:33:112:37 | access to parameter input |
+| ExitMethods.cs:112:33:112:37 | access to parameter input | ExitMethods.cs:112:29:112:29 | (...) ... |
+| ExitMethods.cs:112:41:112:76 | throw ... | ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException |
+| ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException | ExitMethods.cs:112:69:112:75 | "input" |
+| ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall | ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall (normal) |
+| ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall (normal) | ExitMethods.cs:117:9:117:39 | return ...; |
+| ExitMethods.cs:116:5:118:5 | {...} | ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall |
+| ExitMethods.cs:117:9:117:39 | return ...; | ExitMethods.cs:117:16:117:38 | ... ? ... : ... |
+| ExitMethods.cs:117:16:117:16 | access to parameter s | ExitMethods.cs:116:5:118:5 | {...} |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:27:117:29 | - |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:34:117:34 | 0 |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:38:117:38 | 1 |
+| ExitMethods.cs:117:27:117:29 | - | ExitMethods.cs:117:16:117:16 | access to parameter s |
+| ExitMethods.cs:120:17:120:32 | exit FailingAssertion | ExitMethods.cs:120:17:120:32 | exit FailingAssertion (abnormal) |
+| ExitMethods.cs:120:17:120:32 | exit FailingAssertion (abnormal) | ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue |
+| ExitMethods.cs:121:5:124:5 | {...} | ExitMethods.cs:120:17:120:32 | enter FailingAssertion |
+| ExitMethods.cs:122:9:122:29 | ...; | ExitMethods.cs:121:5:124:5 | {...} |
+| ExitMethods.cs:122:23:122:27 | false | ExitMethods.cs:122:9:122:29 | ...; |
+| ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 | ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 (abnormal) |
+| ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 (abnormal) | ExitMethods.cs:128:9:128:26 | call to method FailingAssertion |
+| ExitMethods.cs:127:5:130:5 | {...} | ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 |
+| ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | ExitMethods.cs:128:9:128:26 | this access |
+| ExitMethods.cs:128:9:128:26 | this access | ExitMethods.cs:128:9:128:27 | ...; |
+| ExitMethods.cs:128:9:128:27 | ...; | ExitMethods.cs:127:5:130:5 | {...} |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse (abnormal) | ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse (normal) | ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | ExitMethods.cs:132:48:132:48 | access to parameter b |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:10:132:20 | enter AssertFalse |
+| ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 | ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 (abnormal) |
+| ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 (abnormal) | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse |
+| ExitMethods.cs:135:5:138:5 | {...} | ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 |
+| ExitMethods.cs:136:9:136:25 | this access | ExitMethods.cs:136:9:136:26 | ...; |
+| ExitMethods.cs:136:9:136:26 | ...; | ExitMethods.cs:135:5:138:5 | {...} |
+| ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:136:9:136:25 | this access |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | ExitMethods.cs:146:9:146:33 | call to method WriteLine |
+| ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow |
+| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:141:5:147:5 | {...} |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:142:9:145:53 | if (...) ... |
+| ExitMethods.cs:143:13:143:42 | call to method Throw | ExitMethods.cs:143:41:143:41 | access to parameter e |
+| ExitMethods.cs:143:41:143:41 | access to parameter e | ExitMethods.cs:143:13:143:43 | ...; |
+| ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:145:43:145:43 | access to parameter e |
+| ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:145:13:145:44 | call to method Capture |
+| ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:145:13:145:53 | ...; |
+| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:146:27:146:32 | "dead" |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:143:13:143:42 | call to method Throw |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:145:13:145:52 | call to method Throw |
+| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:146:9:146:34 | ...; |
 | Extensions.cs:5:23:5:29 | exit ToInt32 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) |
 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) | Extensions.cs:7:9:7:30 | return ...; |
 | Extensions.cs:6:5:8:5 | {...} | Extensions.cs:5:23:5:29 | enter ToInt32 |
@@ -9891,76 +9919,83 @@ blockDominance
 | Conditions.cs:145:27:145:29 | [b (line 143): false] "b" | Conditions.cs:149:13:149:49 | ...; |
 | Conditions.cs:147:13:147:49 | ...; | Conditions.cs:147:13:147:49 | ...; |
 | Conditions.cs:149:13:149:49 | ...; | Conditions.cs:149:13:149:49 | ...; |
-| ExitMethods.cs:7:10:7:11 | enter M1 | ExitMethods.cs:7:10:7:11 | enter M1 |
-| ExitMethods.cs:13:10:13:11 | enter M2 | ExitMethods.cs:13:10:13:11 | enter M2 |
-| ExitMethods.cs:19:10:19:11 | enter M3 | ExitMethods.cs:19:10:19:11 | enter M3 |
-| ExitMethods.cs:25:10:25:11 | enter M4 | ExitMethods.cs:25:10:25:11 | enter M4 |
-| ExitMethods.cs:31:10:31:11 | enter M5 | ExitMethods.cs:31:10:31:11 | enter M5 |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:37:10:37:11 | enter M6 |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:37:10:37:11 | exit M6 (normal) |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:44:9:46:9 | {...} |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:48:9:50:9 | {...} |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:37:10:37:11 | exit M6 (normal) |
-| ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:50:9 | {...} |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:44:9:46:9 | {...} |
-| ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:50:9 | {...} |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:48:9:50:9 | {...} |
-| ExitMethods.cs:53:10:53:11 | enter M7 | ExitMethods.cs:53:10:53:11 | enter M7 |
-| ExitMethods.cs:59:10:59:11 | enter M8 | ExitMethods.cs:59:10:59:11 | enter M8 |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:65:17:65:26 | enter ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:68:19:68:33 | object creation of type Exception |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) |
-| ExitMethods.cs:68:19:68:33 | object creation of type Exception | ExitMethods.cs:68:19:68:33 | object creation of type Exception |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:71:17:71:27 | enter ErrorAlways |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:74:19:74:33 | object creation of type Exception |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:76:41:76:43 | "b" |
-| ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) |
-| ExitMethods.cs:74:19:74:33 | object creation of type Exception | ExitMethods.cs:74:19:74:33 | object creation of type Exception |
-| ExitMethods.cs:76:41:76:43 | "b" | ExitMethods.cs:76:41:76:43 | "b" |
-| ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 | ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 |
-| ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 | ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 |
-| ExitMethods.cs:86:10:86:13 | enter Exit | ExitMethods.cs:86:10:86:13 | enter Exit |
-| ExitMethods.cs:91:10:91:18 | enter ExitInTry | ExitMethods.cs:91:10:91:18 | enter ExitInTry |
-| ExitMethods.cs:104:10:104:24 | enter ApplicationExit | ExitMethods.cs:104:10:104:24 | enter ApplicationExit |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:109:13:109:21 | enter ThrowExpr |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:109:13:109:21 | exit ThrowExpr |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:111:29:111:29 | 1 |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:111:69:111:75 | "input" |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr | ExitMethods.cs:109:13:109:21 | exit ThrowExpr |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:111:29:111:29 | 1 |
-| ExitMethods.cs:111:69:111:75 | "input" | ExitMethods.cs:111:69:111:75 | "input" |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:116:16:116:38 | ... ? ... : ... |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:116:34:116:34 | 0 |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:116:38:116:38 | 1 |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:16:116:38 | ... ? ... : ... |
-| ExitMethods.cs:116:34:116:34 | 0 | ExitMethods.cs:116:34:116:34 | 0 |
-| ExitMethods.cs:116:38:116:38 | 1 | ExitMethods.cs:116:38:116:38 | 1 |
-| ExitMethods.cs:119:17:119:32 | enter FailingAssertion | ExitMethods.cs:119:17:119:32 | enter FailingAssertion |
-| ExitMethods.cs:119:17:119:32 | enter FailingAssertion | ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue |
-| ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue |
-| ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 | ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:10:131:20 | enter AssertFalse |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse |
-| ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 | ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 |
-| ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 | ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse |
-| ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse |
+| ExitMethods.cs:8:10:8:11 | enter M1 | ExitMethods.cs:8:10:8:11 | enter M1 |
+| ExitMethods.cs:14:10:14:11 | enter M2 | ExitMethods.cs:14:10:14:11 | enter M2 |
+| ExitMethods.cs:20:10:20:11 | enter M3 | ExitMethods.cs:20:10:20:11 | enter M3 |
+| ExitMethods.cs:26:10:26:11 | enter M4 | ExitMethods.cs:26:10:26:11 | enter M4 |
+| ExitMethods.cs:32:10:32:11 | enter M5 | ExitMethods.cs:32:10:32:11 | enter M5 |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:38:10:38:11 | enter M6 |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:38:10:38:11 | exit M6 (normal) |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:45:9:47:9 | {...} |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:49:9:51:9 | {...} |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:38:10:38:11 | exit M6 (normal) |
+| ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:49:9:51:9 | {...} |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:45:9:47:9 | {...} |
+| ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:49:9:51:9 | {...} |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:49:9:51:9 | {...} |
+| ExitMethods.cs:54:10:54:11 | enter M7 | ExitMethods.cs:54:10:54:11 | enter M7 |
+| ExitMethods.cs:60:10:60:11 | enter M8 | ExitMethods.cs:60:10:60:11 | enter M8 |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:66:17:66:26 | enter ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:69:19:69:33 | object creation of type Exception |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) |
+| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:69:19:69:33 | object creation of type Exception |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:72:17:72:27 | enter ErrorAlways |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:75:19:75:33 | object creation of type Exception |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:77:41:77:43 | "b" |
+| ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) |
+| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:75:19:75:33 | object creation of type Exception |
+| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:77:41:77:43 | "b" |
+| ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 | ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 |
+| ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 | ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 |
+| ExitMethods.cs:87:10:87:13 | enter Exit | ExitMethods.cs:87:10:87:13 | enter Exit |
+| ExitMethods.cs:92:10:92:18 | enter ExitInTry | ExitMethods.cs:92:10:92:18 | enter ExitInTry |
+| ExitMethods.cs:105:10:105:24 | enter ApplicationExit | ExitMethods.cs:105:10:105:24 | enter ApplicationExit |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:110:13:110:21 | enter ThrowExpr |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:110:13:110:21 | exit ThrowExpr |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:112:29:112:29 | 1 |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:112:69:112:75 | "input" |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr | ExitMethods.cs:110:13:110:21 | exit ThrowExpr |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:112:29:112:29 | 1 |
+| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:112:69:112:75 | "input" |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:117:16:117:38 | ... ? ... : ... |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:117:34:117:34 | 0 |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:117:38:117:38 | 1 |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:16:117:38 | ... ? ... : ... |
+| ExitMethods.cs:117:34:117:34 | 0 | ExitMethods.cs:117:34:117:34 | 0 |
+| ExitMethods.cs:117:38:117:38 | 1 | ExitMethods.cs:117:38:117:38 | 1 |
+| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:120:17:120:32 | enter FailingAssertion |
+| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue |
+| ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue |
+| ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 | ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:10:132:20 | enter AssertFalse |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse |
+| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 |
+| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse |
+| ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:143:13:143:43 | ...; |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:145:13:145:53 | ...; |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:146:9:146:34 | ...; |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:43 | ...; |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:53 | ...; |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:9:146:34 | ...; |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | enter ToInt32 |
 | Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | enter ToBool |
 | Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | enter CallToInt32 |
@@ -13816,64 +13851,71 @@ postBlockDominance
 | Conditions.cs:147:13:147:49 | ...; | Conditions.cs:147:13:147:49 | ...; |
 | Conditions.cs:149:13:149:49 | ...; | Conditions.cs:145:27:145:29 | [b (line 143): false] "b" |
 | Conditions.cs:149:13:149:49 | ...; | Conditions.cs:149:13:149:49 | ...; |
-| ExitMethods.cs:7:10:7:11 | enter M1 | ExitMethods.cs:7:10:7:11 | enter M1 |
-| ExitMethods.cs:13:10:13:11 | enter M2 | ExitMethods.cs:13:10:13:11 | enter M2 |
-| ExitMethods.cs:19:10:19:11 | enter M3 | ExitMethods.cs:19:10:19:11 | enter M3 |
-| ExitMethods.cs:25:10:25:11 | enter M4 | ExitMethods.cs:25:10:25:11 | enter M4 |
-| ExitMethods.cs:31:10:31:11 | enter M5 | ExitMethods.cs:31:10:31:11 | enter M5 |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:37:10:37:11 | enter M6 |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:37:10:37:11 | enter M6 |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:37:10:37:11 | exit M6 (normal) |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:44:9:46:9 | {...} |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:48:9:50:9 | {...} |
-| ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:44:9:46:9 | {...} |
-| ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:48:9:50:9 | {...} |
-| ExitMethods.cs:53:10:53:11 | enter M7 | ExitMethods.cs:53:10:53:11 | enter M7 |
-| ExitMethods.cs:59:10:59:11 | enter M8 | ExitMethods.cs:59:10:59:11 | enter M8 |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:65:17:65:26 | enter ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | ExitMethods.cs:65:17:65:26 | enter ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) |
-| ExitMethods.cs:68:19:68:33 | object creation of type Exception | ExitMethods.cs:68:19:68:33 | object creation of type Exception |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:71:17:71:27 | enter ErrorAlways |
-| ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) |
-| ExitMethods.cs:74:19:74:33 | object creation of type Exception | ExitMethods.cs:74:19:74:33 | object creation of type Exception |
-| ExitMethods.cs:76:41:76:43 | "b" | ExitMethods.cs:76:41:76:43 | "b" |
-| ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 | ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 |
-| ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 | ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 |
-| ExitMethods.cs:86:10:86:13 | enter Exit | ExitMethods.cs:86:10:86:13 | enter Exit |
-| ExitMethods.cs:91:10:91:18 | enter ExitInTry | ExitMethods.cs:91:10:91:18 | enter ExitInTry |
-| ExitMethods.cs:104:10:104:24 | enter ApplicationExit | ExitMethods.cs:104:10:104:24 | enter ApplicationExit |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:109:13:109:21 | enter ThrowExpr |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr | ExitMethods.cs:109:13:109:21 | exit ThrowExpr |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:109:13:109:21 | enter ThrowExpr |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:111:29:111:29 | 1 |
-| ExitMethods.cs:111:69:111:75 | "input" | ExitMethods.cs:111:69:111:75 | "input" |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:16:116:38 | ... ? ... : ... |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:34:116:34 | 0 |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:38:116:38 | 1 |
-| ExitMethods.cs:116:34:116:34 | 0 | ExitMethods.cs:116:34:116:34 | 0 |
-| ExitMethods.cs:116:38:116:38 | 1 | ExitMethods.cs:116:38:116:38 | 1 |
-| ExitMethods.cs:119:17:119:32 | enter FailingAssertion | ExitMethods.cs:119:17:119:32 | enter FailingAssertion |
-| ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue |
-| ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 | ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:10:131:20 | enter AssertFalse |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | ExitMethods.cs:131:10:131:20 | enter AssertFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse |
-| ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 | ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 |
-| ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse |
+| ExitMethods.cs:8:10:8:11 | enter M1 | ExitMethods.cs:8:10:8:11 | enter M1 |
+| ExitMethods.cs:14:10:14:11 | enter M2 | ExitMethods.cs:14:10:14:11 | enter M2 |
+| ExitMethods.cs:20:10:20:11 | enter M3 | ExitMethods.cs:20:10:20:11 | enter M3 |
+| ExitMethods.cs:26:10:26:11 | enter M4 | ExitMethods.cs:26:10:26:11 | enter M4 |
+| ExitMethods.cs:32:10:32:11 | enter M5 | ExitMethods.cs:32:10:32:11 | enter M5 |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:38:10:38:11 | enter M6 |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:38:10:38:11 | enter M6 |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:38:10:38:11 | exit M6 (normal) |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:45:9:47:9 | {...} |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:49:9:51:9 | {...} |
+| ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:45:9:47:9 | {...} |
+| ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:49:9:51:9 | {...} |
+| ExitMethods.cs:54:10:54:11 | enter M7 | ExitMethods.cs:54:10:54:11 | enter M7 |
+| ExitMethods.cs:60:10:60:11 | enter M8 | ExitMethods.cs:60:10:60:11 | enter M8 |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:66:17:66:26 | enter ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | ExitMethods.cs:66:17:66:26 | enter ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) |
+| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:69:19:69:33 | object creation of type Exception |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:72:17:72:27 | enter ErrorAlways |
+| ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) |
+| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:75:19:75:33 | object creation of type Exception |
+| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:77:41:77:43 | "b" |
+| ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 | ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 |
+| ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 | ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 |
+| ExitMethods.cs:87:10:87:13 | enter Exit | ExitMethods.cs:87:10:87:13 | enter Exit |
+| ExitMethods.cs:92:10:92:18 | enter ExitInTry | ExitMethods.cs:92:10:92:18 | enter ExitInTry |
+| ExitMethods.cs:105:10:105:24 | enter ApplicationExit | ExitMethods.cs:105:10:105:24 | enter ApplicationExit |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:110:13:110:21 | enter ThrowExpr |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr | ExitMethods.cs:110:13:110:21 | exit ThrowExpr |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:110:13:110:21 | enter ThrowExpr |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:112:29:112:29 | 1 |
+| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:112:69:112:75 | "input" |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:16:117:38 | ... ? ... : ... |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:34:117:34 | 0 |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:38:117:38 | 1 |
+| ExitMethods.cs:117:34:117:34 | 0 | ExitMethods.cs:117:34:117:34 | 0 |
+| ExitMethods.cs:117:38:117:38 | 1 | ExitMethods.cs:117:38:117:38 | 1 |
+| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:120:17:120:32 | enter FailingAssertion |
+| ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue |
+| ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 | ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:10:132:20 | enter AssertFalse |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | ExitMethods.cs:132:10:132:20 | enter AssertFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse |
+| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 |
+| ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:43 | ...; |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:53 | ...; |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:143:13:143:43 | ...; |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:145:13:145:53 | ...; |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:9:146:34 | ...; |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | enter ToInt32 |
 | Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | enter ToBool |
 | Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | enter CallToInt32 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
index 3ab6261019f..8050b8ced38 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
@@ -1603,182 +1603,198 @@ nodeEnclosing
 | Conditions.cs:149:38:149:47 | $"..." | Conditions.cs:143:10:143:12 | M11 |
 | Conditions.cs:149:40:149:43 | "b = " | Conditions.cs:143:10:143:12 | M11 |
 | Conditions.cs:149:45:149:45 | access to local variable s | Conditions.cs:143:10:143:12 | M11 |
-| ExitMethods.cs:7:10:7:11 | enter M1 | ExitMethods.cs:7:10:7:11 | M1 |
-| ExitMethods.cs:7:10:7:11 | exit M1 | ExitMethods.cs:7:10:7:11 | M1 |
-| ExitMethods.cs:7:10:7:11 | exit M1 (normal) | ExitMethods.cs:7:10:7:11 | M1 |
-| ExitMethods.cs:8:5:11:5 | {...} | ExitMethods.cs:7:10:7:11 | M1 |
-| ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe | ExitMethods.cs:7:10:7:11 | M1 |
-| ExitMethods.cs:9:9:9:25 | ...; | ExitMethods.cs:7:10:7:11 | M1 |
-| ExitMethods.cs:9:20:9:23 | true | ExitMethods.cs:7:10:7:11 | M1 |
-| ExitMethods.cs:10:9:10:15 | return ...; | ExitMethods.cs:7:10:7:11 | M1 |
-| ExitMethods.cs:13:10:13:11 | enter M2 | ExitMethods.cs:13:10:13:11 | M2 |
-| ExitMethods.cs:13:10:13:11 | exit M2 | ExitMethods.cs:13:10:13:11 | M2 |
-| ExitMethods.cs:13:10:13:11 | exit M2 (normal) | ExitMethods.cs:13:10:13:11 | M2 |
-| ExitMethods.cs:14:5:17:5 | {...} | ExitMethods.cs:13:10:13:11 | M2 |
-| ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe | ExitMethods.cs:13:10:13:11 | M2 |
-| ExitMethods.cs:15:9:15:26 | ...; | ExitMethods.cs:13:10:13:11 | M2 |
-| ExitMethods.cs:15:20:15:24 | false | ExitMethods.cs:13:10:13:11 | M2 |
-| ExitMethods.cs:16:9:16:15 | return ...; | ExitMethods.cs:13:10:13:11 | M2 |
-| ExitMethods.cs:19:10:19:11 | enter M3 | ExitMethods.cs:19:10:19:11 | M3 |
-| ExitMethods.cs:19:10:19:11 | exit M3 | ExitMethods.cs:19:10:19:11 | M3 |
-| ExitMethods.cs:19:10:19:11 | exit M3 (abnormal) | ExitMethods.cs:19:10:19:11 | M3 |
-| ExitMethods.cs:20:5:23:5 | {...} | ExitMethods.cs:19:10:19:11 | M3 |
-| ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | ExitMethods.cs:19:10:19:11 | M3 |
-| ExitMethods.cs:21:9:21:26 | ...; | ExitMethods.cs:19:10:19:11 | M3 |
-| ExitMethods.cs:21:21:21:24 | true | ExitMethods.cs:19:10:19:11 | M3 |
-| ExitMethods.cs:25:10:25:11 | enter M4 | ExitMethods.cs:25:10:25:11 | M4 |
-| ExitMethods.cs:25:10:25:11 | exit M4 | ExitMethods.cs:25:10:25:11 | M4 |
-| ExitMethods.cs:25:10:25:11 | exit M4 (abnormal) | ExitMethods.cs:25:10:25:11 | M4 |
-| ExitMethods.cs:26:5:29:5 | {...} | ExitMethods.cs:25:10:25:11 | M4 |
-| ExitMethods.cs:27:9:27:14 | call to method Exit | ExitMethods.cs:25:10:25:11 | M4 |
-| ExitMethods.cs:27:9:27:14 | this access | ExitMethods.cs:25:10:25:11 | M4 |
-| ExitMethods.cs:27:9:27:15 | ...; | ExitMethods.cs:25:10:25:11 | M4 |
-| ExitMethods.cs:31:10:31:11 | enter M5 | ExitMethods.cs:31:10:31:11 | M5 |
-| ExitMethods.cs:31:10:31:11 | exit M5 | ExitMethods.cs:31:10:31:11 | M5 |
-| ExitMethods.cs:31:10:31:11 | exit M5 (abnormal) | ExitMethods.cs:31:10:31:11 | M5 |
-| ExitMethods.cs:32:5:35:5 | {...} | ExitMethods.cs:31:10:31:11 | M5 |
-| ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | ExitMethods.cs:31:10:31:11 | M5 |
-| ExitMethods.cs:33:9:33:25 | this access | ExitMethods.cs:31:10:31:11 | M5 |
-| ExitMethods.cs:33:9:33:26 | ...; | ExitMethods.cs:31:10:31:11 | M5 |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:37:10:37:11 | exit M6 | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:38:5:51:5 | {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:39:9:50:9 | try {...} ... | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:40:9:42:9 | {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:41:13:41:31 | ...; | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:41:25:41:29 | false | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:45:13:45:19 | return ...; | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:49:13:49:19 | return ...; | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:53:10:53:11 | enter M7 | ExitMethods.cs:53:10:53:11 | M7 |
-| ExitMethods.cs:53:10:53:11 | exit M7 | ExitMethods.cs:53:10:53:11 | M7 |
-| ExitMethods.cs:53:10:53:11 | exit M7 (abnormal) | ExitMethods.cs:53:10:53:11 | M7 |
-| ExitMethods.cs:54:5:57:5 | {...} | ExitMethods.cs:53:10:53:11 | M7 |
-| ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | ExitMethods.cs:53:10:53:11 | M7 |
-| ExitMethods.cs:55:9:55:23 | ...; | ExitMethods.cs:53:10:53:11 | M7 |
-| ExitMethods.cs:59:10:59:11 | enter M8 | ExitMethods.cs:59:10:59:11 | M8 |
-| ExitMethods.cs:59:10:59:11 | exit M8 | ExitMethods.cs:59:10:59:11 | M8 |
-| ExitMethods.cs:59:10:59:11 | exit M8 (abnormal) | ExitMethods.cs:59:10:59:11 | M8 |
-| ExitMethods.cs:60:5:63:5 | {...} | ExitMethods.cs:59:10:59:11 | M8 |
-| ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | ExitMethods.cs:59:10:59:11 | M8 |
-| ExitMethods.cs:61:9:61:23 | ...; | ExitMethods.cs:59:10:59:11 | M8 |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (abnormal) | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:66:5:69:5 | {...} | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:67:9:68:34 | if (...) ... | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:68:13:68:34 | throw ...; | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:68:19:68:33 | object creation of type Exception | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:71:17:71:27 | exit ErrorAlways | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:72:5:77:5 | {...} | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:73:9:76:45 | if (...) ... | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:74:13:74:34 | throw ...; | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:74:19:74:33 | object creation of type Exception | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:76:13:76:45 | throw ...; | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:76:41:76:43 | "b" | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 | ExitMethods.cs:79:17:79:28 | ErrorAlways2 |
-| ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 | ExitMethods.cs:79:17:79:28 | ErrorAlways2 |
-| ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 (abnormal) | ExitMethods.cs:79:17:79:28 | ErrorAlways2 |
-| ExitMethods.cs:80:5:82:5 | {...} | ExitMethods.cs:79:17:79:28 | ErrorAlways2 |
-| ExitMethods.cs:81:9:81:30 | throw ...; | ExitMethods.cs:79:17:79:28 | ErrorAlways2 |
-| ExitMethods.cs:81:15:81:29 | object creation of type Exception | ExitMethods.cs:79:17:79:28 | ErrorAlways2 |
-| ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 | ExitMethods.cs:84:17:84:28 | ErrorAlways3 |
-| ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 | ExitMethods.cs:84:17:84:28 | ErrorAlways3 |
-| ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 (abnormal) | ExitMethods.cs:84:17:84:28 | ErrorAlways3 |
-| ExitMethods.cs:84:35:84:55 | throw ... | ExitMethods.cs:84:17:84:28 | ErrorAlways3 |
-| ExitMethods.cs:84:41:84:55 | object creation of type Exception | ExitMethods.cs:84:17:84:28 | ErrorAlways3 |
-| ExitMethods.cs:86:10:86:13 | enter Exit | ExitMethods.cs:86:10:86:13 | Exit |
-| ExitMethods.cs:86:10:86:13 | exit Exit | ExitMethods.cs:86:10:86:13 | Exit |
-| ExitMethods.cs:86:10:86:13 | exit Exit (abnormal) | ExitMethods.cs:86:10:86:13 | Exit |
-| ExitMethods.cs:87:5:89:5 | {...} | ExitMethods.cs:86:10:86:13 | Exit |
-| ExitMethods.cs:88:9:88:27 | call to method Exit | ExitMethods.cs:86:10:86:13 | Exit |
-| ExitMethods.cs:88:9:88:28 | ...; | ExitMethods.cs:86:10:86:13 | Exit |
-| ExitMethods.cs:88:26:88:26 | 0 | ExitMethods.cs:86:10:86:13 | Exit |
-| ExitMethods.cs:91:10:91:18 | enter ExitInTry | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:91:10:91:18 | exit ExitInTry | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:91:10:91:18 | exit ExitInTry (abnormal) | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:92:5:102:5 | {...} | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:93:9:101:9 | try {...} ... | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:94:9:96:9 | {...} | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:95:13:95:18 | call to method Exit | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:95:13:95:18 | this access | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:95:13:95:19 | ...; | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:104:10:104:24 | enter ApplicationExit | ExitMethods.cs:104:10:104:24 | ApplicationExit |
-| ExitMethods.cs:104:10:104:24 | exit ApplicationExit | ExitMethods.cs:104:10:104:24 | ApplicationExit |
-| ExitMethods.cs:104:10:104:24 | exit ApplicationExit (abnormal) | ExitMethods.cs:104:10:104:24 | ApplicationExit |
-| ExitMethods.cs:105:5:107:5 | {...} | ExitMethods.cs:104:10:104:24 | ApplicationExit |
-| ExitMethods.cs:106:9:106:47 | call to method Exit | ExitMethods.cs:104:10:104:24 | ApplicationExit |
-| ExitMethods.cs:106:9:106:48 | ...; | ExitMethods.cs:104:10:104:24 | ApplicationExit |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr (abnormal) | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr (normal) | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:110:5:112:5 | {...} | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:9:111:77 | return ...; | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:16:111:20 | access to parameter input | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:16:111:76 | ... ? ... : ... | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:25:111:25 | 0 | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:25:111:25 | (...) ... | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:29:111:29 | (...) ... | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:29:111:37 | ... / ... | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:33:111:37 | access to parameter input | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:41:111:76 | throw ... | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:69:111:75 | "input" | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall (normal) | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:115:5:117:5 | {...} | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:9:116:39 | return ...; | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:16:116:16 | access to parameter s | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:27:116:29 | - | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:34:116:34 | 0 | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:38:116:38 | 1 | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:119:17:119:32 | enter FailingAssertion | ExitMethods.cs:119:17:119:32 | FailingAssertion |
-| ExitMethods.cs:119:17:119:32 | exit FailingAssertion | ExitMethods.cs:119:17:119:32 | FailingAssertion |
-| ExitMethods.cs:119:17:119:32 | exit FailingAssertion (abnormal) | ExitMethods.cs:119:17:119:32 | FailingAssertion |
-| ExitMethods.cs:120:5:123:5 | {...} | ExitMethods.cs:119:17:119:32 | FailingAssertion |
-| ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:119:17:119:32 | FailingAssertion |
-| ExitMethods.cs:121:9:121:29 | ...; | ExitMethods.cs:119:17:119:32 | FailingAssertion |
-| ExitMethods.cs:121:23:121:27 | false | ExitMethods.cs:119:17:119:32 | FailingAssertion |
-| ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 | ExitMethods.cs:125:17:125:33 | FailingAssertion2 |
-| ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 | ExitMethods.cs:125:17:125:33 | FailingAssertion2 |
-| ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 (abnormal) | ExitMethods.cs:125:17:125:33 | FailingAssertion2 |
-| ExitMethods.cs:126:5:129:5 | {...} | ExitMethods.cs:125:17:125:33 | FailingAssertion2 |
-| ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | ExitMethods.cs:125:17:125:33 | FailingAssertion2 |
-| ExitMethods.cs:127:9:127:26 | this access | ExitMethods.cs:125:17:125:33 | FailingAssertion2 |
-| ExitMethods.cs:127:9:127:27 | ...; | ExitMethods.cs:125:17:125:33 | FailingAssertion2 |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse (abnormal) | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse (normal) | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
-| ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
-| ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 (abnormal) | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
-| ExitMethods.cs:134:5:137:5 | {...} | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
-| ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
-| ExitMethods.cs:135:9:135:25 | this access | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
-| ExitMethods.cs:135:9:135:26 | ...; | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
-| ExitMethods.cs:135:21:135:24 | true | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
+| ExitMethods.cs:8:10:8:11 | enter M1 | ExitMethods.cs:8:10:8:11 | M1 |
+| ExitMethods.cs:8:10:8:11 | exit M1 | ExitMethods.cs:8:10:8:11 | M1 |
+| ExitMethods.cs:8:10:8:11 | exit M1 (normal) | ExitMethods.cs:8:10:8:11 | M1 |
+| ExitMethods.cs:9:5:12:5 | {...} | ExitMethods.cs:8:10:8:11 | M1 |
+| ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe | ExitMethods.cs:8:10:8:11 | M1 |
+| ExitMethods.cs:10:9:10:25 | ...; | ExitMethods.cs:8:10:8:11 | M1 |
+| ExitMethods.cs:10:20:10:23 | true | ExitMethods.cs:8:10:8:11 | M1 |
+| ExitMethods.cs:11:9:11:15 | return ...; | ExitMethods.cs:8:10:8:11 | M1 |
+| ExitMethods.cs:14:10:14:11 | enter M2 | ExitMethods.cs:14:10:14:11 | M2 |
+| ExitMethods.cs:14:10:14:11 | exit M2 | ExitMethods.cs:14:10:14:11 | M2 |
+| ExitMethods.cs:14:10:14:11 | exit M2 (normal) | ExitMethods.cs:14:10:14:11 | M2 |
+| ExitMethods.cs:15:5:18:5 | {...} | ExitMethods.cs:14:10:14:11 | M2 |
+| ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe | ExitMethods.cs:14:10:14:11 | M2 |
+| ExitMethods.cs:16:9:16:26 | ...; | ExitMethods.cs:14:10:14:11 | M2 |
+| ExitMethods.cs:16:20:16:24 | false | ExitMethods.cs:14:10:14:11 | M2 |
+| ExitMethods.cs:17:9:17:15 | return ...; | ExitMethods.cs:14:10:14:11 | M2 |
+| ExitMethods.cs:20:10:20:11 | enter M3 | ExitMethods.cs:20:10:20:11 | M3 |
+| ExitMethods.cs:20:10:20:11 | exit M3 | ExitMethods.cs:20:10:20:11 | M3 |
+| ExitMethods.cs:20:10:20:11 | exit M3 (abnormal) | ExitMethods.cs:20:10:20:11 | M3 |
+| ExitMethods.cs:21:5:24:5 | {...} | ExitMethods.cs:20:10:20:11 | M3 |
+| ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | ExitMethods.cs:20:10:20:11 | M3 |
+| ExitMethods.cs:22:9:22:26 | ...; | ExitMethods.cs:20:10:20:11 | M3 |
+| ExitMethods.cs:22:21:22:24 | true | ExitMethods.cs:20:10:20:11 | M3 |
+| ExitMethods.cs:26:10:26:11 | enter M4 | ExitMethods.cs:26:10:26:11 | M4 |
+| ExitMethods.cs:26:10:26:11 | exit M4 | ExitMethods.cs:26:10:26:11 | M4 |
+| ExitMethods.cs:26:10:26:11 | exit M4 (abnormal) | ExitMethods.cs:26:10:26:11 | M4 |
+| ExitMethods.cs:27:5:30:5 | {...} | ExitMethods.cs:26:10:26:11 | M4 |
+| ExitMethods.cs:28:9:28:14 | call to method Exit | ExitMethods.cs:26:10:26:11 | M4 |
+| ExitMethods.cs:28:9:28:14 | this access | ExitMethods.cs:26:10:26:11 | M4 |
+| ExitMethods.cs:28:9:28:15 | ...; | ExitMethods.cs:26:10:26:11 | M4 |
+| ExitMethods.cs:32:10:32:11 | enter M5 | ExitMethods.cs:32:10:32:11 | M5 |
+| ExitMethods.cs:32:10:32:11 | exit M5 | ExitMethods.cs:32:10:32:11 | M5 |
+| ExitMethods.cs:32:10:32:11 | exit M5 (abnormal) | ExitMethods.cs:32:10:32:11 | M5 |
+| ExitMethods.cs:33:5:36:5 | {...} | ExitMethods.cs:32:10:32:11 | M5 |
+| ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | ExitMethods.cs:32:10:32:11 | M5 |
+| ExitMethods.cs:34:9:34:25 | this access | ExitMethods.cs:32:10:32:11 | M5 |
+| ExitMethods.cs:34:9:34:26 | ...; | ExitMethods.cs:32:10:32:11 | M5 |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:38:10:38:11 | exit M6 | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:39:5:52:5 | {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:40:9:51:9 | try {...} ... | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:41:9:43:9 | {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:42:13:42:31 | ...; | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:42:25:42:29 | false | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:46:13:46:19 | return ...; | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:50:13:50:19 | return ...; | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:54:10:54:11 | enter M7 | ExitMethods.cs:54:10:54:11 | M7 |
+| ExitMethods.cs:54:10:54:11 | exit M7 | ExitMethods.cs:54:10:54:11 | M7 |
+| ExitMethods.cs:54:10:54:11 | exit M7 (abnormal) | ExitMethods.cs:54:10:54:11 | M7 |
+| ExitMethods.cs:55:5:58:5 | {...} | ExitMethods.cs:54:10:54:11 | M7 |
+| ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | ExitMethods.cs:54:10:54:11 | M7 |
+| ExitMethods.cs:56:9:56:23 | ...; | ExitMethods.cs:54:10:54:11 | M7 |
+| ExitMethods.cs:60:10:60:11 | enter M8 | ExitMethods.cs:60:10:60:11 | M8 |
+| ExitMethods.cs:60:10:60:11 | exit M8 | ExitMethods.cs:60:10:60:11 | M8 |
+| ExitMethods.cs:60:10:60:11 | exit M8 (abnormal) | ExitMethods.cs:60:10:60:11 | M8 |
+| ExitMethods.cs:61:5:64:5 | {...} | ExitMethods.cs:60:10:60:11 | M8 |
+| ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | ExitMethods.cs:60:10:60:11 | M8 |
+| ExitMethods.cs:62:9:62:23 | ...; | ExitMethods.cs:60:10:60:11 | M8 |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (abnormal) | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:67:5:70:5 | {...} | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:68:9:69:34 | if (...) ... | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:69:13:69:34 | throw ...; | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:72:17:72:27 | exit ErrorAlways | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:73:5:78:5 | {...} | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:74:9:77:45 | if (...) ... | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:75:13:75:34 | throw ...; | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:77:13:77:45 | throw ...; | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 | ExitMethods.cs:80:17:80:28 | ErrorAlways2 |
+| ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 | ExitMethods.cs:80:17:80:28 | ErrorAlways2 |
+| ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 (abnormal) | ExitMethods.cs:80:17:80:28 | ErrorAlways2 |
+| ExitMethods.cs:81:5:83:5 | {...} | ExitMethods.cs:80:17:80:28 | ErrorAlways2 |
+| ExitMethods.cs:82:9:82:30 | throw ...; | ExitMethods.cs:80:17:80:28 | ErrorAlways2 |
+| ExitMethods.cs:82:15:82:29 | object creation of type Exception | ExitMethods.cs:80:17:80:28 | ErrorAlways2 |
+| ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 | ExitMethods.cs:85:17:85:28 | ErrorAlways3 |
+| ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 | ExitMethods.cs:85:17:85:28 | ErrorAlways3 |
+| ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 (abnormal) | ExitMethods.cs:85:17:85:28 | ErrorAlways3 |
+| ExitMethods.cs:85:35:85:55 | throw ... | ExitMethods.cs:85:17:85:28 | ErrorAlways3 |
+| ExitMethods.cs:85:41:85:55 | object creation of type Exception | ExitMethods.cs:85:17:85:28 | ErrorAlways3 |
+| ExitMethods.cs:87:10:87:13 | enter Exit | ExitMethods.cs:87:10:87:13 | Exit |
+| ExitMethods.cs:87:10:87:13 | exit Exit | ExitMethods.cs:87:10:87:13 | Exit |
+| ExitMethods.cs:87:10:87:13 | exit Exit (abnormal) | ExitMethods.cs:87:10:87:13 | Exit |
+| ExitMethods.cs:88:5:90:5 | {...} | ExitMethods.cs:87:10:87:13 | Exit |
+| ExitMethods.cs:89:9:89:27 | call to method Exit | ExitMethods.cs:87:10:87:13 | Exit |
+| ExitMethods.cs:89:9:89:28 | ...; | ExitMethods.cs:87:10:87:13 | Exit |
+| ExitMethods.cs:89:26:89:26 | 0 | ExitMethods.cs:87:10:87:13 | Exit |
+| ExitMethods.cs:92:10:92:18 | enter ExitInTry | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:92:10:92:18 | exit ExitInTry | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:92:10:92:18 | exit ExitInTry (abnormal) | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:93:5:103:5 | {...} | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:94:9:102:9 | try {...} ... | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:95:9:97:9 | {...} | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:96:13:96:18 | call to method Exit | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:96:13:96:18 | this access | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:96:13:96:19 | ...; | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:105:10:105:24 | enter ApplicationExit | ExitMethods.cs:105:10:105:24 | ApplicationExit |
+| ExitMethods.cs:105:10:105:24 | exit ApplicationExit | ExitMethods.cs:105:10:105:24 | ApplicationExit |
+| ExitMethods.cs:105:10:105:24 | exit ApplicationExit (abnormal) | ExitMethods.cs:105:10:105:24 | ApplicationExit |
+| ExitMethods.cs:106:5:108:5 | {...} | ExitMethods.cs:105:10:105:24 | ApplicationExit |
+| ExitMethods.cs:107:9:107:47 | call to method Exit | ExitMethods.cs:105:10:105:24 | ApplicationExit |
+| ExitMethods.cs:107:9:107:48 | ...; | ExitMethods.cs:105:10:105:24 | ApplicationExit |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr (abnormal) | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr (normal) | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:111:5:113:5 | {...} | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:9:112:77 | return ...; | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:16:112:20 | access to parameter input | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:16:112:76 | ... ? ... : ... | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:25:112:25 | 0 | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:25:112:25 | (...) ... | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:29:112:29 | (...) ... | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:29:112:37 | ... / ... | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:33:112:37 | access to parameter input | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:41:112:76 | throw ... | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall (normal) | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:116:5:118:5 | {...} | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:9:117:39 | return ...; | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:16:117:16 | access to parameter s | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:27:117:29 | - | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:34:117:34 | 0 | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:38:117:38 | 1 | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:120:17:120:32 | FailingAssertion |
+| ExitMethods.cs:120:17:120:32 | exit FailingAssertion | ExitMethods.cs:120:17:120:32 | FailingAssertion |
+| ExitMethods.cs:120:17:120:32 | exit FailingAssertion (abnormal) | ExitMethods.cs:120:17:120:32 | FailingAssertion |
+| ExitMethods.cs:121:5:124:5 | {...} | ExitMethods.cs:120:17:120:32 | FailingAssertion |
+| ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:120:17:120:32 | FailingAssertion |
+| ExitMethods.cs:122:9:122:29 | ...; | ExitMethods.cs:120:17:120:32 | FailingAssertion |
+| ExitMethods.cs:122:23:122:27 | false | ExitMethods.cs:120:17:120:32 | FailingAssertion |
+| ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 | ExitMethods.cs:126:17:126:33 | FailingAssertion2 |
+| ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 | ExitMethods.cs:126:17:126:33 | FailingAssertion2 |
+| ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 (abnormal) | ExitMethods.cs:126:17:126:33 | FailingAssertion2 |
+| ExitMethods.cs:127:5:130:5 | {...} | ExitMethods.cs:126:17:126:33 | FailingAssertion2 |
+| ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | ExitMethods.cs:126:17:126:33 | FailingAssertion2 |
+| ExitMethods.cs:128:9:128:26 | this access | ExitMethods.cs:126:17:126:33 | FailingAssertion2 |
+| ExitMethods.cs:128:9:128:27 | ...; | ExitMethods.cs:126:17:126:33 | FailingAssertion2 |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse (abnormal) | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse (normal) | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 (abnormal) | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:135:5:138:5 | {...} | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:136:9:136:25 | this access | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:136:9:136:26 | ...; | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:143:13:143:42 | call to method Throw | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:143:41:143:41 | access to parameter e | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | ToInt32 |
 | Extensions.cs:5:23:5:29 | exit ToInt32 | Extensions.cs:5:23:5:29 | ToInt32 |
 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) | Extensions.cs:5:23:5:29 | ToInt32 |
@@ -5069,50 +5085,54 @@ blockEnclosing
 | Conditions.cs:145:27:145:29 | [b (line 143): false] "b" | Conditions.cs:143:10:143:12 | M11 |
 | Conditions.cs:147:13:147:49 | ...; | Conditions.cs:143:10:143:12 | M11 |
 | Conditions.cs:149:13:149:49 | ...; | Conditions.cs:143:10:143:12 | M11 |
-| ExitMethods.cs:7:10:7:11 | enter M1 | ExitMethods.cs:7:10:7:11 | M1 |
-| ExitMethods.cs:13:10:13:11 | enter M2 | ExitMethods.cs:13:10:13:11 | M2 |
-| ExitMethods.cs:19:10:19:11 | enter M3 | ExitMethods.cs:19:10:19:11 | M3 |
-| ExitMethods.cs:25:10:25:11 | enter M4 | ExitMethods.cs:25:10:25:11 | M4 |
-| ExitMethods.cs:31:10:31:11 | enter M5 | ExitMethods.cs:31:10:31:11 | M5 |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:37:10:37:11 | M6 |
-| ExitMethods.cs:53:10:53:11 | enter M7 | ExitMethods.cs:53:10:53:11 | M7 |
-| ExitMethods.cs:59:10:59:11 | enter M8 | ExitMethods.cs:59:10:59:11 | M8 |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:68:19:68:33 | object creation of type Exception | ExitMethods.cs:65:17:65:26 | ErrorMaybe |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:74:19:74:33 | object creation of type Exception | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:76:41:76:43 | "b" | ExitMethods.cs:71:17:71:27 | ErrorAlways |
-| ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 | ExitMethods.cs:79:17:79:28 | ErrorAlways2 |
-| ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 | ExitMethods.cs:84:17:84:28 | ErrorAlways3 |
-| ExitMethods.cs:86:10:86:13 | enter Exit | ExitMethods.cs:86:10:86:13 | Exit |
-| ExitMethods.cs:91:10:91:18 | enter ExitInTry | ExitMethods.cs:91:10:91:18 | ExitInTry |
-| ExitMethods.cs:104:10:104:24 | enter ApplicationExit | ExitMethods.cs:104:10:104:24 | ApplicationExit |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:111:69:111:75 | "input" | ExitMethods.cs:109:13:109:21 | ThrowExpr |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:34:116:34 | 0 | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:116:38:116:38 | 1 | ExitMethods.cs:114:16:114:34 | ExtensionMethodCall |
-| ExitMethods.cs:119:17:119:32 | enter FailingAssertion | ExitMethods.cs:119:17:119:32 | FailingAssertion |
-| ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:119:17:119:32 | FailingAssertion |
-| ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 | ExitMethods.cs:125:17:125:33 | FailingAssertion2 |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | ExitMethods.cs:131:10:131:20 | AssertFalse |
-| ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
-| ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:133:17:133:33 | FailingAssertion3 |
+| ExitMethods.cs:8:10:8:11 | enter M1 | ExitMethods.cs:8:10:8:11 | M1 |
+| ExitMethods.cs:14:10:14:11 | enter M2 | ExitMethods.cs:14:10:14:11 | M2 |
+| ExitMethods.cs:20:10:20:11 | enter M3 | ExitMethods.cs:20:10:20:11 | M3 |
+| ExitMethods.cs:26:10:26:11 | enter M4 | ExitMethods.cs:26:10:26:11 | M4 |
+| ExitMethods.cs:32:10:32:11 | enter M5 | ExitMethods.cs:32:10:32:11 | M5 |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:38:10:38:11 | M6 |
+| ExitMethods.cs:54:10:54:11 | enter M7 | ExitMethods.cs:54:10:54:11 | M7 |
+| ExitMethods.cs:60:10:60:11 | enter M8 | ExitMethods.cs:60:10:60:11 | M8 |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:66:17:66:26 | ErrorMaybe |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:72:17:72:27 | ErrorAlways |
+| ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 | ExitMethods.cs:80:17:80:28 | ErrorAlways2 |
+| ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 | ExitMethods.cs:85:17:85:28 | ErrorAlways3 |
+| ExitMethods.cs:87:10:87:13 | enter Exit | ExitMethods.cs:87:10:87:13 | Exit |
+| ExitMethods.cs:92:10:92:18 | enter ExitInTry | ExitMethods.cs:92:10:92:18 | ExitInTry |
+| ExitMethods.cs:105:10:105:24 | enter ApplicationExit | ExitMethods.cs:105:10:105:24 | ApplicationExit |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:110:13:110:21 | ThrowExpr |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:34:117:34 | 0 | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:117:38:117:38 | 1 | ExitMethods.cs:115:16:115:34 | ExtensionMethodCall |
+| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:120:17:120:32 | FailingAssertion |
+| ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:120:17:120:32 | FailingAssertion |
+| ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 | ExitMethods.cs:126:17:126:33 | FailingAssertion2 |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | ExitMethods.cs:132:10:132:20 | AssertFalse |
+| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | ToInt32 |
 | Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | ToBool |
 | Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | CallToInt32 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected b/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
index 610c8d7f8eb..86819e6601b 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EntryElement.expected
@@ -1149,132 +1149,145 @@
 | Conditions.cs:149:38:149:47 | $"..." | Conditions.cs:149:40:149:43 | "b = " |
 | Conditions.cs:149:40:149:43 | "b = " | Conditions.cs:149:40:149:43 | "b = " |
 | Conditions.cs:149:45:149:45 | access to local variable s | Conditions.cs:149:45:149:45 | access to local variable s |
-| ExitMethods.cs:8:5:11:5 | {...} | ExitMethods.cs:8:5:11:5 | {...} |
-| ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe | ExitMethods.cs:9:20:9:23 | true |
-| ExitMethods.cs:9:9:9:25 | ...; | ExitMethods.cs:9:9:9:25 | ...; |
-| ExitMethods.cs:9:20:9:23 | true | ExitMethods.cs:9:20:9:23 | true |
-| ExitMethods.cs:10:9:10:15 | return ...; | ExitMethods.cs:10:9:10:15 | return ...; |
-| ExitMethods.cs:14:5:17:5 | {...} | ExitMethods.cs:14:5:17:5 | {...} |
-| ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe | ExitMethods.cs:15:20:15:24 | false |
-| ExitMethods.cs:15:9:15:26 | ...; | ExitMethods.cs:15:9:15:26 | ...; |
-| ExitMethods.cs:15:20:15:24 | false | ExitMethods.cs:15:20:15:24 | false |
-| ExitMethods.cs:16:9:16:15 | return ...; | ExitMethods.cs:16:9:16:15 | return ...; |
-| ExitMethods.cs:20:5:23:5 | {...} | ExitMethods.cs:20:5:23:5 | {...} |
-| ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | ExitMethods.cs:21:21:21:24 | true |
-| ExitMethods.cs:21:9:21:26 | ...; | ExitMethods.cs:21:9:21:26 | ...; |
-| ExitMethods.cs:21:21:21:24 | true | ExitMethods.cs:21:21:21:24 | true |
-| ExitMethods.cs:22:9:22:15 | return ...; | ExitMethods.cs:22:9:22:15 | return ...; |
-| ExitMethods.cs:26:5:29:5 | {...} | ExitMethods.cs:26:5:29:5 | {...} |
-| ExitMethods.cs:27:9:27:14 | call to method Exit | ExitMethods.cs:27:9:27:14 | this access |
-| ExitMethods.cs:27:9:27:14 | this access | ExitMethods.cs:27:9:27:14 | this access |
-| ExitMethods.cs:27:9:27:15 | ...; | ExitMethods.cs:27:9:27:15 | ...; |
-| ExitMethods.cs:28:9:28:15 | return ...; | ExitMethods.cs:28:9:28:15 | return ...; |
-| ExitMethods.cs:32:5:35:5 | {...} | ExitMethods.cs:32:5:35:5 | {...} |
-| ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | ExitMethods.cs:33:9:33:25 | this access |
-| ExitMethods.cs:33:9:33:25 | this access | ExitMethods.cs:33:9:33:25 | this access |
-| ExitMethods.cs:33:9:33:26 | ...; | ExitMethods.cs:33:9:33:26 | ...; |
-| ExitMethods.cs:34:9:34:15 | return ...; | ExitMethods.cs:34:9:34:15 | return ...; |
-| ExitMethods.cs:38:5:51:5 | {...} | ExitMethods.cs:38:5:51:5 | {...} |
-| ExitMethods.cs:39:9:50:9 | try {...} ... | ExitMethods.cs:39:9:50:9 | try {...} ... |
-| ExitMethods.cs:40:9:42:9 | {...} | ExitMethods.cs:40:9:42:9 | {...} |
-| ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | ExitMethods.cs:41:25:41:29 | false |
-| ExitMethods.cs:41:13:41:31 | ...; | ExitMethods.cs:41:13:41:31 | ...; |
-| ExitMethods.cs:41:25:41:29 | false | ExitMethods.cs:41:25:41:29 | false |
-| ExitMethods.cs:43:9:46:9 | catch (...) {...} | ExitMethods.cs:43:9:46:9 | catch (...) {...} |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:44:9:46:9 | {...} |
-| ExitMethods.cs:45:13:45:19 | return ...; | ExitMethods.cs:45:13:45:19 | return ...; |
-| ExitMethods.cs:47:9:50:9 | catch (...) {...} | ExitMethods.cs:47:9:50:9 | catch (...) {...} |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:48:9:50:9 | {...} |
-| ExitMethods.cs:49:13:49:19 | return ...; | ExitMethods.cs:49:13:49:19 | return ...; |
-| ExitMethods.cs:54:5:57:5 | {...} | ExitMethods.cs:54:5:57:5 | {...} |
-| ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 |
-| ExitMethods.cs:55:9:55:23 | ...; | ExitMethods.cs:55:9:55:23 | ...; |
-| ExitMethods.cs:56:9:56:15 | return ...; | ExitMethods.cs:56:9:56:15 | return ...; |
-| ExitMethods.cs:60:5:63:5 | {...} | ExitMethods.cs:60:5:63:5 | {...} |
-| ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 |
-| ExitMethods.cs:61:9:61:23 | ...; | ExitMethods.cs:61:9:61:23 | ...; |
-| ExitMethods.cs:62:9:62:15 | return ...; | ExitMethods.cs:62:9:62:15 | return ...; |
-| ExitMethods.cs:66:5:69:5 | {...} | ExitMethods.cs:66:5:69:5 | {...} |
-| ExitMethods.cs:67:9:68:34 | if (...) ... | ExitMethods.cs:67:9:68:34 | if (...) ... |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:67:13:67:13 | access to parameter b |
-| ExitMethods.cs:68:13:68:34 | throw ...; | ExitMethods.cs:68:19:68:33 | object creation of type Exception |
-| ExitMethods.cs:68:19:68:33 | object creation of type Exception | ExitMethods.cs:68:19:68:33 | object creation of type Exception |
-| ExitMethods.cs:72:5:77:5 | {...} | ExitMethods.cs:72:5:77:5 | {...} |
-| ExitMethods.cs:73:9:76:45 | if (...) ... | ExitMethods.cs:73:9:76:45 | if (...) ... |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:73:13:73:13 | access to parameter b |
-| ExitMethods.cs:74:13:74:34 | throw ...; | ExitMethods.cs:74:19:74:33 | object creation of type Exception |
-| ExitMethods.cs:74:19:74:33 | object creation of type Exception | ExitMethods.cs:74:19:74:33 | object creation of type Exception |
-| ExitMethods.cs:76:13:76:45 | throw ...; | ExitMethods.cs:76:41:76:43 | "b" |
-| ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException | ExitMethods.cs:76:41:76:43 | "b" |
-| ExitMethods.cs:76:41:76:43 | "b" | ExitMethods.cs:76:41:76:43 | "b" |
-| ExitMethods.cs:80:5:82:5 | {...} | ExitMethods.cs:80:5:82:5 | {...} |
-| ExitMethods.cs:81:9:81:30 | throw ...; | ExitMethods.cs:81:15:81:29 | object creation of type Exception |
-| ExitMethods.cs:81:15:81:29 | object creation of type Exception | ExitMethods.cs:81:15:81:29 | object creation of type Exception |
-| ExitMethods.cs:84:35:84:55 | throw ... | ExitMethods.cs:84:41:84:55 | object creation of type Exception |
-| ExitMethods.cs:84:41:84:55 | object creation of type Exception | ExitMethods.cs:84:41:84:55 | object creation of type Exception |
-| ExitMethods.cs:87:5:89:5 | {...} | ExitMethods.cs:87:5:89:5 | {...} |
-| ExitMethods.cs:88:9:88:27 | call to method Exit | ExitMethods.cs:88:26:88:26 | 0 |
-| ExitMethods.cs:88:9:88:28 | ...; | ExitMethods.cs:88:9:88:28 | ...; |
-| ExitMethods.cs:88:26:88:26 | 0 | ExitMethods.cs:88:26:88:26 | 0 |
-| ExitMethods.cs:92:5:102:5 | {...} | ExitMethods.cs:92:5:102:5 | {...} |
-| ExitMethods.cs:93:9:101:9 | try {...} ... | ExitMethods.cs:93:9:101:9 | try {...} ... |
-| ExitMethods.cs:94:9:96:9 | {...} | ExitMethods.cs:94:9:96:9 | {...} |
-| ExitMethods.cs:95:13:95:18 | call to method Exit | ExitMethods.cs:95:13:95:18 | this access |
-| ExitMethods.cs:95:13:95:18 | this access | ExitMethods.cs:95:13:95:18 | this access |
-| ExitMethods.cs:95:13:95:19 | ...; | ExitMethods.cs:95:13:95:19 | ...; |
-| ExitMethods.cs:98:9:101:9 | {...} | ExitMethods.cs:98:9:101:9 | {...} |
-| ExitMethods.cs:100:13:100:40 | call to method WriteLine | ExitMethods.cs:100:38:100:39 | "" |
-| ExitMethods.cs:100:13:100:41 | ...; | ExitMethods.cs:100:13:100:41 | ...; |
-| ExitMethods.cs:100:38:100:39 | "" | ExitMethods.cs:100:38:100:39 | "" |
-| ExitMethods.cs:105:5:107:5 | {...} | ExitMethods.cs:105:5:107:5 | {...} |
-| ExitMethods.cs:106:9:106:47 | call to method Exit | ExitMethods.cs:106:9:106:47 | call to method Exit |
-| ExitMethods.cs:106:9:106:48 | ...; | ExitMethods.cs:106:9:106:48 | ...; |
-| ExitMethods.cs:110:5:112:5 | {...} | ExitMethods.cs:110:5:112:5 | {...} |
-| ExitMethods.cs:111:9:111:77 | return ...; | ExitMethods.cs:111:16:111:20 | access to parameter input |
-| ExitMethods.cs:111:16:111:20 | access to parameter input | ExitMethods.cs:111:16:111:20 | access to parameter input |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:16:111:20 | access to parameter input |
-| ExitMethods.cs:111:16:111:76 | ... ? ... : ... | ExitMethods.cs:111:16:111:20 | access to parameter input |
-| ExitMethods.cs:111:25:111:25 | 0 | ExitMethods.cs:111:25:111:25 | 0 |
-| ExitMethods.cs:111:25:111:25 | (...) ... | ExitMethods.cs:111:25:111:25 | 0 |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:111:29:111:29 | 1 |
-| ExitMethods.cs:111:29:111:29 | (...) ... | ExitMethods.cs:111:29:111:29 | 1 |
-| ExitMethods.cs:111:29:111:37 | ... / ... | ExitMethods.cs:111:29:111:29 | 1 |
-| ExitMethods.cs:111:33:111:37 | access to parameter input | ExitMethods.cs:111:33:111:37 | access to parameter input |
-| ExitMethods.cs:111:41:111:76 | throw ... | ExitMethods.cs:111:69:111:75 | "input" |
-| ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException | ExitMethods.cs:111:69:111:75 | "input" |
-| ExitMethods.cs:111:69:111:75 | "input" | ExitMethods.cs:111:69:111:75 | "input" |
-| ExitMethods.cs:115:5:117:5 | {...} | ExitMethods.cs:115:5:117:5 | {...} |
-| ExitMethods.cs:116:9:116:39 | return ...; | ExitMethods.cs:116:16:116:16 | access to parameter s |
-| ExitMethods.cs:116:16:116:16 | access to parameter s | ExitMethods.cs:116:16:116:16 | access to parameter s |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:16:116:16 | access to parameter s |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:16:116:16 | access to parameter s |
-| ExitMethods.cs:116:27:116:29 | - | ExitMethods.cs:116:27:116:29 | - |
-| ExitMethods.cs:116:34:116:34 | 0 | ExitMethods.cs:116:34:116:34 | 0 |
-| ExitMethods.cs:116:38:116:38 | 1 | ExitMethods.cs:116:38:116:38 | 1 |
-| ExitMethods.cs:120:5:123:5 | {...} | ExitMethods.cs:120:5:123:5 | {...} |
-| ExitMethods.cs:121:9:121:28 | call to method IsTrue | ExitMethods.cs:121:23:121:27 | false |
-| ExitMethods.cs:121:9:121:29 | ...; | ExitMethods.cs:121:9:121:29 | ...; |
-| ExitMethods.cs:121:23:121:27 | false | ExitMethods.cs:121:23:121:27 | false |
-| ExitMethods.cs:122:9:122:18 | ... ...; | ExitMethods.cs:122:9:122:18 | ... ...; |
-| ExitMethods.cs:122:13:122:17 | Int32 x = ... | ExitMethods.cs:122:17:122:17 | 0 |
-| ExitMethods.cs:122:17:122:17 | 0 | ExitMethods.cs:122:17:122:17 | 0 |
-| ExitMethods.cs:126:5:129:5 | {...} | ExitMethods.cs:126:5:129:5 | {...} |
-| ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | ExitMethods.cs:127:9:127:26 | this access |
-| ExitMethods.cs:127:9:127:26 | this access | ExitMethods.cs:127:9:127:26 | this access |
-| ExitMethods.cs:127:9:127:27 | ...; | ExitMethods.cs:127:9:127:27 | ...; |
-| ExitMethods.cs:128:9:128:18 | ... ...; | ExitMethods.cs:128:9:128:18 | ... ...; |
-| ExitMethods.cs:128:13:128:17 | Int32 x = ... | ExitMethods.cs:128:17:128:17 | 0 |
-| ExitMethods.cs:128:17:128:17 | 0 | ExitMethods.cs:128:17:128:17 | 0 |
-| ExitMethods.cs:131:33:131:49 | call to method IsFalse | ExitMethods.cs:131:48:131:48 | access to parameter b |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:48:131:48 | access to parameter b |
-| ExitMethods.cs:134:5:137:5 | {...} | ExitMethods.cs:134:5:137:5 | {...} |
-| ExitMethods.cs:135:9:135:25 | call to method AssertFalse | ExitMethods.cs:135:9:135:25 | this access |
-| ExitMethods.cs:135:9:135:25 | this access | ExitMethods.cs:135:9:135:25 | this access |
-| ExitMethods.cs:135:9:135:26 | ...; | ExitMethods.cs:135:9:135:26 | ...; |
-| ExitMethods.cs:135:21:135:24 | true | ExitMethods.cs:135:21:135:24 | true |
-| ExitMethods.cs:136:9:136:18 | ... ...; | ExitMethods.cs:136:9:136:18 | ... ...; |
-| ExitMethods.cs:136:13:136:17 | Int32 x = ... | ExitMethods.cs:136:17:136:17 | 0 |
-| ExitMethods.cs:136:17:136:17 | 0 | ExitMethods.cs:136:17:136:17 | 0 |
+| ExitMethods.cs:9:5:12:5 | {...} | ExitMethods.cs:9:5:12:5 | {...} |
+| ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe | ExitMethods.cs:10:20:10:23 | true |
+| ExitMethods.cs:10:9:10:25 | ...; | ExitMethods.cs:10:9:10:25 | ...; |
+| ExitMethods.cs:10:20:10:23 | true | ExitMethods.cs:10:20:10:23 | true |
+| ExitMethods.cs:11:9:11:15 | return ...; | ExitMethods.cs:11:9:11:15 | return ...; |
+| ExitMethods.cs:15:5:18:5 | {...} | ExitMethods.cs:15:5:18:5 | {...} |
+| ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe | ExitMethods.cs:16:20:16:24 | false |
+| ExitMethods.cs:16:9:16:26 | ...; | ExitMethods.cs:16:9:16:26 | ...; |
+| ExitMethods.cs:16:20:16:24 | false | ExitMethods.cs:16:20:16:24 | false |
+| ExitMethods.cs:17:9:17:15 | return ...; | ExitMethods.cs:17:9:17:15 | return ...; |
+| ExitMethods.cs:21:5:24:5 | {...} | ExitMethods.cs:21:5:24:5 | {...} |
+| ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | ExitMethods.cs:22:21:22:24 | true |
+| ExitMethods.cs:22:9:22:26 | ...; | ExitMethods.cs:22:9:22:26 | ...; |
+| ExitMethods.cs:22:21:22:24 | true | ExitMethods.cs:22:21:22:24 | true |
+| ExitMethods.cs:23:9:23:15 | return ...; | ExitMethods.cs:23:9:23:15 | return ...; |
+| ExitMethods.cs:27:5:30:5 | {...} | ExitMethods.cs:27:5:30:5 | {...} |
+| ExitMethods.cs:28:9:28:14 | call to method Exit | ExitMethods.cs:28:9:28:14 | this access |
+| ExitMethods.cs:28:9:28:14 | this access | ExitMethods.cs:28:9:28:14 | this access |
+| ExitMethods.cs:28:9:28:15 | ...; | ExitMethods.cs:28:9:28:15 | ...; |
+| ExitMethods.cs:29:9:29:15 | return ...; | ExitMethods.cs:29:9:29:15 | return ...; |
+| ExitMethods.cs:33:5:36:5 | {...} | ExitMethods.cs:33:5:36:5 | {...} |
+| ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | ExitMethods.cs:34:9:34:25 | this access |
+| ExitMethods.cs:34:9:34:25 | this access | ExitMethods.cs:34:9:34:25 | this access |
+| ExitMethods.cs:34:9:34:26 | ...; | ExitMethods.cs:34:9:34:26 | ...; |
+| ExitMethods.cs:35:9:35:15 | return ...; | ExitMethods.cs:35:9:35:15 | return ...; |
+| ExitMethods.cs:39:5:52:5 | {...} | ExitMethods.cs:39:5:52:5 | {...} |
+| ExitMethods.cs:40:9:51:9 | try {...} ... | ExitMethods.cs:40:9:51:9 | try {...} ... |
+| ExitMethods.cs:41:9:43:9 | {...} | ExitMethods.cs:41:9:43:9 | {...} |
+| ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | ExitMethods.cs:42:25:42:29 | false |
+| ExitMethods.cs:42:13:42:31 | ...; | ExitMethods.cs:42:13:42:31 | ...; |
+| ExitMethods.cs:42:25:42:29 | false | ExitMethods.cs:42:25:42:29 | false |
+| ExitMethods.cs:44:9:47:9 | catch (...) {...} | ExitMethods.cs:44:9:47:9 | catch (...) {...} |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:45:9:47:9 | {...} |
+| ExitMethods.cs:46:13:46:19 | return ...; | ExitMethods.cs:46:13:46:19 | return ...; |
+| ExitMethods.cs:48:9:51:9 | catch (...) {...} | ExitMethods.cs:48:9:51:9 | catch (...) {...} |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:49:9:51:9 | {...} |
+| ExitMethods.cs:50:13:50:19 | return ...; | ExitMethods.cs:50:13:50:19 | return ...; |
+| ExitMethods.cs:55:5:58:5 | {...} | ExitMethods.cs:55:5:58:5 | {...} |
+| ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 |
+| ExitMethods.cs:56:9:56:23 | ...; | ExitMethods.cs:56:9:56:23 | ...; |
+| ExitMethods.cs:57:9:57:15 | return ...; | ExitMethods.cs:57:9:57:15 | return ...; |
+| ExitMethods.cs:61:5:64:5 | {...} | ExitMethods.cs:61:5:64:5 | {...} |
+| ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 |
+| ExitMethods.cs:62:9:62:23 | ...; | ExitMethods.cs:62:9:62:23 | ...; |
+| ExitMethods.cs:63:9:63:15 | return ...; | ExitMethods.cs:63:9:63:15 | return ...; |
+| ExitMethods.cs:67:5:70:5 | {...} | ExitMethods.cs:67:5:70:5 | {...} |
+| ExitMethods.cs:68:9:69:34 | if (...) ... | ExitMethods.cs:68:9:69:34 | if (...) ... |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:68:13:68:13 | access to parameter b |
+| ExitMethods.cs:69:13:69:34 | throw ...; | ExitMethods.cs:69:19:69:33 | object creation of type Exception |
+| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:69:19:69:33 | object creation of type Exception |
+| ExitMethods.cs:73:5:78:5 | {...} | ExitMethods.cs:73:5:78:5 | {...} |
+| ExitMethods.cs:74:9:77:45 | if (...) ... | ExitMethods.cs:74:9:77:45 | if (...) ... |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:74:13:74:13 | access to parameter b |
+| ExitMethods.cs:75:13:75:34 | throw ...; | ExitMethods.cs:75:19:75:33 | object creation of type Exception |
+| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:75:19:75:33 | object creation of type Exception |
+| ExitMethods.cs:77:13:77:45 | throw ...; | ExitMethods.cs:77:41:77:43 | "b" |
+| ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException | ExitMethods.cs:77:41:77:43 | "b" |
+| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:77:41:77:43 | "b" |
+| ExitMethods.cs:81:5:83:5 | {...} | ExitMethods.cs:81:5:83:5 | {...} |
+| ExitMethods.cs:82:9:82:30 | throw ...; | ExitMethods.cs:82:15:82:29 | object creation of type Exception |
+| ExitMethods.cs:82:15:82:29 | object creation of type Exception | ExitMethods.cs:82:15:82:29 | object creation of type Exception |
+| ExitMethods.cs:85:35:85:55 | throw ... | ExitMethods.cs:85:41:85:55 | object creation of type Exception |
+| ExitMethods.cs:85:41:85:55 | object creation of type Exception | ExitMethods.cs:85:41:85:55 | object creation of type Exception |
+| ExitMethods.cs:88:5:90:5 | {...} | ExitMethods.cs:88:5:90:5 | {...} |
+| ExitMethods.cs:89:9:89:27 | call to method Exit | ExitMethods.cs:89:26:89:26 | 0 |
+| ExitMethods.cs:89:9:89:28 | ...; | ExitMethods.cs:89:9:89:28 | ...; |
+| ExitMethods.cs:89:26:89:26 | 0 | ExitMethods.cs:89:26:89:26 | 0 |
+| ExitMethods.cs:93:5:103:5 | {...} | ExitMethods.cs:93:5:103:5 | {...} |
+| ExitMethods.cs:94:9:102:9 | try {...} ... | ExitMethods.cs:94:9:102:9 | try {...} ... |
+| ExitMethods.cs:95:9:97:9 | {...} | ExitMethods.cs:95:9:97:9 | {...} |
+| ExitMethods.cs:96:13:96:18 | call to method Exit | ExitMethods.cs:96:13:96:18 | this access |
+| ExitMethods.cs:96:13:96:18 | this access | ExitMethods.cs:96:13:96:18 | this access |
+| ExitMethods.cs:96:13:96:19 | ...; | ExitMethods.cs:96:13:96:19 | ...; |
+| ExitMethods.cs:99:9:102:9 | {...} | ExitMethods.cs:99:9:102:9 | {...} |
+| ExitMethods.cs:101:13:101:40 | call to method WriteLine | ExitMethods.cs:101:38:101:39 | "" |
+| ExitMethods.cs:101:13:101:41 | ...; | ExitMethods.cs:101:13:101:41 | ...; |
+| ExitMethods.cs:101:38:101:39 | "" | ExitMethods.cs:101:38:101:39 | "" |
+| ExitMethods.cs:106:5:108:5 | {...} | ExitMethods.cs:106:5:108:5 | {...} |
+| ExitMethods.cs:107:9:107:47 | call to method Exit | ExitMethods.cs:107:9:107:47 | call to method Exit |
+| ExitMethods.cs:107:9:107:48 | ...; | ExitMethods.cs:107:9:107:48 | ...; |
+| ExitMethods.cs:111:5:113:5 | {...} | ExitMethods.cs:111:5:113:5 | {...} |
+| ExitMethods.cs:112:9:112:77 | return ...; | ExitMethods.cs:112:16:112:20 | access to parameter input |
+| ExitMethods.cs:112:16:112:20 | access to parameter input | ExitMethods.cs:112:16:112:20 | access to parameter input |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:16:112:20 | access to parameter input |
+| ExitMethods.cs:112:16:112:76 | ... ? ... : ... | ExitMethods.cs:112:16:112:20 | access to parameter input |
+| ExitMethods.cs:112:25:112:25 | 0 | ExitMethods.cs:112:25:112:25 | 0 |
+| ExitMethods.cs:112:25:112:25 | (...) ... | ExitMethods.cs:112:25:112:25 | 0 |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:112:29:112:29 | 1 |
+| ExitMethods.cs:112:29:112:29 | (...) ... | ExitMethods.cs:112:29:112:29 | 1 |
+| ExitMethods.cs:112:29:112:37 | ... / ... | ExitMethods.cs:112:29:112:29 | 1 |
+| ExitMethods.cs:112:33:112:37 | access to parameter input | ExitMethods.cs:112:33:112:37 | access to parameter input |
+| ExitMethods.cs:112:41:112:76 | throw ... | ExitMethods.cs:112:69:112:75 | "input" |
+| ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException | ExitMethods.cs:112:69:112:75 | "input" |
+| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:112:69:112:75 | "input" |
+| ExitMethods.cs:116:5:118:5 | {...} | ExitMethods.cs:116:5:118:5 | {...} |
+| ExitMethods.cs:117:9:117:39 | return ...; | ExitMethods.cs:117:16:117:16 | access to parameter s |
+| ExitMethods.cs:117:16:117:16 | access to parameter s | ExitMethods.cs:117:16:117:16 | access to parameter s |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:16:117:16 | access to parameter s |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:16:117:16 | access to parameter s |
+| ExitMethods.cs:117:27:117:29 | - | ExitMethods.cs:117:27:117:29 | - |
+| ExitMethods.cs:117:34:117:34 | 0 | ExitMethods.cs:117:34:117:34 | 0 |
+| ExitMethods.cs:117:38:117:38 | 1 | ExitMethods.cs:117:38:117:38 | 1 |
+| ExitMethods.cs:121:5:124:5 | {...} | ExitMethods.cs:121:5:124:5 | {...} |
+| ExitMethods.cs:122:9:122:28 | call to method IsTrue | ExitMethods.cs:122:23:122:27 | false |
+| ExitMethods.cs:122:9:122:29 | ...; | ExitMethods.cs:122:9:122:29 | ...; |
+| ExitMethods.cs:122:23:122:27 | false | ExitMethods.cs:122:23:122:27 | false |
+| ExitMethods.cs:123:9:123:18 | ... ...; | ExitMethods.cs:123:9:123:18 | ... ...; |
+| ExitMethods.cs:123:13:123:17 | Int32 x = ... | ExitMethods.cs:123:17:123:17 | 0 |
+| ExitMethods.cs:123:17:123:17 | 0 | ExitMethods.cs:123:17:123:17 | 0 |
+| ExitMethods.cs:127:5:130:5 | {...} | ExitMethods.cs:127:5:130:5 | {...} |
+| ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | ExitMethods.cs:128:9:128:26 | this access |
+| ExitMethods.cs:128:9:128:26 | this access | ExitMethods.cs:128:9:128:26 | this access |
+| ExitMethods.cs:128:9:128:27 | ...; | ExitMethods.cs:128:9:128:27 | ...; |
+| ExitMethods.cs:129:9:129:18 | ... ...; | ExitMethods.cs:129:9:129:18 | ... ...; |
+| ExitMethods.cs:129:13:129:17 | Int32 x = ... | ExitMethods.cs:129:17:129:17 | 0 |
+| ExitMethods.cs:129:17:129:17 | 0 | ExitMethods.cs:129:17:129:17 | 0 |
+| ExitMethods.cs:132:33:132:49 | call to method IsFalse | ExitMethods.cs:132:48:132:48 | access to parameter b |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:48:132:48 | access to parameter b |
+| ExitMethods.cs:135:5:138:5 | {...} | ExitMethods.cs:135:5:138:5 | {...} |
+| ExitMethods.cs:136:9:136:25 | call to method AssertFalse | ExitMethods.cs:136:9:136:25 | this access |
+| ExitMethods.cs:136:9:136:25 | this access | ExitMethods.cs:136:9:136:25 | this access |
+| ExitMethods.cs:136:9:136:26 | ...; | ExitMethods.cs:136:9:136:26 | ...; |
+| ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:136:21:136:24 | true |
+| ExitMethods.cs:137:9:137:18 | ... ...; | ExitMethods.cs:137:9:137:18 | ... ...; |
+| ExitMethods.cs:137:13:137:17 | Int32 x = ... | ExitMethods.cs:137:17:137:17 | 0 |
+| ExitMethods.cs:137:17:137:17 | 0 | ExitMethods.cs:137:17:137:17 | 0 |
+| ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:141:5:147:5 | {...} |
+| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:142:9:145:53 | if (...) ... |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:142:13:142:13 | access to parameter b |
+| ExitMethods.cs:143:13:143:42 | call to method Throw | ExitMethods.cs:143:41:143:41 | access to parameter e |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:43 | ...; |
+| ExitMethods.cs:143:41:143:41 | access to parameter e | ExitMethods.cs:143:41:143:41 | access to parameter e |
+| ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:145:43:145:43 | access to parameter e |
+| ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:145:43:145:43 | access to parameter e |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:53 | ...; |
+| ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:145:43:145:43 | access to parameter e |
+| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:146:27:146:32 | "dead" |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:9:146:34 | ...; |
+| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:146:27:146:32 | "dead" |
 | Extensions.cs:6:5:8:5 | {...} | Extensions.cs:6:5:8:5 | {...} |
 | Extensions.cs:7:9:7:30 | return ...; | Extensions.cs:7:28:7:28 | access to parameter s |
 | Extensions.cs:7:16:7:29 | call to method Parse | Extensions.cs:7:28:7:28 | access to parameter s |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
index 07a0a9cffc7..6e19712c22b 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
@@ -1443,162 +1443,177 @@
 | Conditions.cs:149:38:149:47 | $"..." | Conditions.cs:149:38:149:47 | $"..." | normal |
 | Conditions.cs:149:40:149:43 | "b = " | Conditions.cs:149:40:149:43 | "b = " | normal |
 | Conditions.cs:149:45:149:45 | access to local variable s | Conditions.cs:149:45:149:45 | access to local variable s | normal |
-| ExitMethods.cs:8:5:11:5 | {...} | ExitMethods.cs:10:9:10:15 | return ...; | return |
-| ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe | ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe | normal |
-| ExitMethods.cs:9:9:9:25 | ...; | ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe | normal |
-| ExitMethods.cs:9:20:9:23 | true | ExitMethods.cs:9:20:9:23 | true | normal |
-| ExitMethods.cs:10:9:10:15 | return ...; | ExitMethods.cs:10:9:10:15 | return ...; | return |
-| ExitMethods.cs:14:5:17:5 | {...} | ExitMethods.cs:16:9:16:15 | return ...; | return |
-| ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe | ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe | normal |
-| ExitMethods.cs:15:9:15:26 | ...; | ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe | normal |
-| ExitMethods.cs:15:20:15:24 | false | ExitMethods.cs:15:20:15:24 | false | normal |
-| ExitMethods.cs:16:9:16:15 | return ...; | ExitMethods.cs:16:9:16:15 | return ...; | return |
-| ExitMethods.cs:20:5:23:5 | {...} | ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | throw(ArgumentException) |
-| ExitMethods.cs:20:5:23:5 | {...} | ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | throw(Exception) |
-| ExitMethods.cs:20:5:23:5 | {...} | ExitMethods.cs:22:9:22:15 | return ...; | return |
-| ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | throw(ArgumentException) |
-| ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | throw(Exception) |
-| ExitMethods.cs:21:9:21:26 | ...; | ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | throw(ArgumentException) |
-| ExitMethods.cs:21:9:21:26 | ...; | ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | throw(Exception) |
-| ExitMethods.cs:21:21:21:24 | true | ExitMethods.cs:21:21:21:24 | true | normal |
-| ExitMethods.cs:22:9:22:15 | return ...; | ExitMethods.cs:22:9:22:15 | return ...; | return |
-| ExitMethods.cs:26:5:29:5 | {...} | ExitMethods.cs:27:9:27:14 | call to method Exit | exit |
-| ExitMethods.cs:26:5:29:5 | {...} | ExitMethods.cs:28:9:28:15 | return ...; | return |
-| ExitMethods.cs:27:9:27:14 | call to method Exit | ExitMethods.cs:27:9:27:14 | call to method Exit | exit |
-| ExitMethods.cs:27:9:27:14 | this access | ExitMethods.cs:27:9:27:14 | this access | normal |
-| ExitMethods.cs:27:9:27:15 | ...; | ExitMethods.cs:27:9:27:14 | call to method Exit | exit |
-| ExitMethods.cs:28:9:28:15 | return ...; | ExitMethods.cs:28:9:28:15 | return ...; | return |
-| ExitMethods.cs:32:5:35:5 | {...} | ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | exit |
-| ExitMethods.cs:32:5:35:5 | {...} | ExitMethods.cs:34:9:34:15 | return ...; | return |
-| ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | exit |
-| ExitMethods.cs:33:9:33:25 | this access | ExitMethods.cs:33:9:33:25 | this access | normal |
-| ExitMethods.cs:33:9:33:26 | ...; | ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | exit |
-| ExitMethods.cs:34:9:34:15 | return ...; | ExitMethods.cs:34:9:34:15 | return ...; | return |
-| ExitMethods.cs:38:5:51:5 | {...} | ExitMethods.cs:45:13:45:19 | return ...; | return |
-| ExitMethods.cs:38:5:51:5 | {...} | ExitMethods.cs:49:13:49:19 | return ...; | return |
-| ExitMethods.cs:39:9:50:9 | try {...} ... | ExitMethods.cs:45:13:45:19 | return ...; | return |
-| ExitMethods.cs:39:9:50:9 | try {...} ... | ExitMethods.cs:49:13:49:19 | return ...; | return |
-| ExitMethods.cs:40:9:42:9 | {...} | ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | throw(ArgumentException) |
-| ExitMethods.cs:40:9:42:9 | {...} | ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | throw(Exception) |
-| ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | throw(ArgumentException) |
-| ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | throw(Exception) |
-| ExitMethods.cs:41:13:41:31 | ...; | ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | throw(ArgumentException) |
-| ExitMethods.cs:41:13:41:31 | ...; | ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | throw(Exception) |
-| ExitMethods.cs:41:25:41:29 | false | ExitMethods.cs:41:25:41:29 | false | normal |
-| ExitMethods.cs:43:9:46:9 | catch (...) {...} | ExitMethods.cs:43:9:46:9 | catch (...) {...} | no-match |
-| ExitMethods.cs:43:9:46:9 | catch (...) {...} | ExitMethods.cs:45:13:45:19 | return ...; | return |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:45:13:45:19 | return ...; | return |
-| ExitMethods.cs:45:13:45:19 | return ...; | ExitMethods.cs:45:13:45:19 | return ...; | return |
-| ExitMethods.cs:47:9:50:9 | catch (...) {...} | ExitMethods.cs:49:13:49:19 | return ...; | return |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:49:13:49:19 | return ...; | return |
-| ExitMethods.cs:49:13:49:19 | return ...; | ExitMethods.cs:49:13:49:19 | return ...; | return |
-| ExitMethods.cs:54:5:57:5 | {...} | ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | throw(Exception) |
-| ExitMethods.cs:54:5:57:5 | {...} | ExitMethods.cs:56:9:56:15 | return ...; | return |
-| ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | throw(Exception) |
-| ExitMethods.cs:55:9:55:23 | ...; | ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | throw(Exception) |
-| ExitMethods.cs:56:9:56:15 | return ...; | ExitMethods.cs:56:9:56:15 | return ...; | return |
-| ExitMethods.cs:60:5:63:5 | {...} | ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | throw(Exception) |
-| ExitMethods.cs:60:5:63:5 | {...} | ExitMethods.cs:62:9:62:15 | return ...; | return |
-| ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | throw(Exception) |
-| ExitMethods.cs:61:9:61:23 | ...; | ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | throw(Exception) |
-| ExitMethods.cs:62:9:62:15 | return ...; | ExitMethods.cs:62:9:62:15 | return ...; | return |
-| ExitMethods.cs:66:5:69:5 | {...} | ExitMethods.cs:67:13:67:13 | access to parameter b | false |
-| ExitMethods.cs:66:5:69:5 | {...} | ExitMethods.cs:68:13:68:34 | throw ...; | throw(Exception) |
-| ExitMethods.cs:67:9:68:34 | if (...) ... | ExitMethods.cs:67:13:67:13 | access to parameter b | false |
-| ExitMethods.cs:67:9:68:34 | if (...) ... | ExitMethods.cs:68:13:68:34 | throw ...; | throw(Exception) |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:67:13:67:13 | access to parameter b | false |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:67:13:67:13 | access to parameter b | true |
-| ExitMethods.cs:68:13:68:34 | throw ...; | ExitMethods.cs:68:13:68:34 | throw ...; | throw(Exception) |
-| ExitMethods.cs:68:19:68:33 | object creation of type Exception | ExitMethods.cs:68:19:68:33 | object creation of type Exception | normal |
-| ExitMethods.cs:72:5:77:5 | {...} | ExitMethods.cs:74:13:74:34 | throw ...; | throw(Exception) |
-| ExitMethods.cs:72:5:77:5 | {...} | ExitMethods.cs:76:13:76:45 | throw ...; | throw(ArgumentException) |
-| ExitMethods.cs:73:9:76:45 | if (...) ... | ExitMethods.cs:74:13:74:34 | throw ...; | throw(Exception) |
-| ExitMethods.cs:73:9:76:45 | if (...) ... | ExitMethods.cs:76:13:76:45 | throw ...; | throw(ArgumentException) |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:73:13:73:13 | access to parameter b | false |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:73:13:73:13 | access to parameter b | true |
-| ExitMethods.cs:74:13:74:34 | throw ...; | ExitMethods.cs:74:13:74:34 | throw ...; | throw(Exception) |
-| ExitMethods.cs:74:19:74:33 | object creation of type Exception | ExitMethods.cs:74:19:74:33 | object creation of type Exception | normal |
-| ExitMethods.cs:76:13:76:45 | throw ...; | ExitMethods.cs:76:13:76:45 | throw ...; | throw(ArgumentException) |
-| ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException | ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException | normal |
-| ExitMethods.cs:76:41:76:43 | "b" | ExitMethods.cs:76:41:76:43 | "b" | normal |
-| ExitMethods.cs:80:5:82:5 | {...} | ExitMethods.cs:81:9:81:30 | throw ...; | throw(Exception) |
-| ExitMethods.cs:81:9:81:30 | throw ...; | ExitMethods.cs:81:9:81:30 | throw ...; | throw(Exception) |
-| ExitMethods.cs:81:15:81:29 | object creation of type Exception | ExitMethods.cs:81:15:81:29 | object creation of type Exception | normal |
-| ExitMethods.cs:84:35:84:55 | throw ... | ExitMethods.cs:84:35:84:55 | throw ... | throw(Exception) |
-| ExitMethods.cs:84:41:84:55 | object creation of type Exception | ExitMethods.cs:84:41:84:55 | object creation of type Exception | normal |
-| ExitMethods.cs:87:5:89:5 | {...} | ExitMethods.cs:88:9:88:27 | call to method Exit | exit |
-| ExitMethods.cs:88:9:88:27 | call to method Exit | ExitMethods.cs:88:9:88:27 | call to method Exit | exit |
-| ExitMethods.cs:88:9:88:28 | ...; | ExitMethods.cs:88:9:88:27 | call to method Exit | exit |
-| ExitMethods.cs:88:26:88:26 | 0 | ExitMethods.cs:88:26:88:26 | 0 | normal |
-| ExitMethods.cs:92:5:102:5 | {...} | ExitMethods.cs:95:13:95:18 | call to method Exit | exit |
-| ExitMethods.cs:93:9:101:9 | try {...} ... | ExitMethods.cs:95:13:95:18 | call to method Exit | exit |
-| ExitMethods.cs:94:9:96:9 | {...} | ExitMethods.cs:95:13:95:18 | call to method Exit | exit |
-| ExitMethods.cs:95:13:95:18 | call to method Exit | ExitMethods.cs:95:13:95:18 | call to method Exit | exit |
-| ExitMethods.cs:95:13:95:18 | this access | ExitMethods.cs:95:13:95:18 | this access | normal |
-| ExitMethods.cs:95:13:95:19 | ...; | ExitMethods.cs:95:13:95:18 | call to method Exit | exit |
-| ExitMethods.cs:98:9:101:9 | {...} | ExitMethods.cs:100:13:100:40 | call to method WriteLine | normal |
-| ExitMethods.cs:100:13:100:40 | call to method WriteLine | ExitMethods.cs:100:13:100:40 | call to method WriteLine | normal |
-| ExitMethods.cs:100:13:100:41 | ...; | ExitMethods.cs:100:13:100:40 | call to method WriteLine | normal |
-| ExitMethods.cs:100:38:100:39 | "" | ExitMethods.cs:100:38:100:39 | "" | normal |
-| ExitMethods.cs:105:5:107:5 | {...} | ExitMethods.cs:106:9:106:47 | call to method Exit | exit |
-| ExitMethods.cs:106:9:106:47 | call to method Exit | ExitMethods.cs:106:9:106:47 | call to method Exit | exit |
-| ExitMethods.cs:106:9:106:48 | ...; | ExitMethods.cs:106:9:106:47 | call to method Exit | exit |
-| ExitMethods.cs:110:5:112:5 | {...} | ExitMethods.cs:111:9:111:77 | return ...; | return |
-| ExitMethods.cs:110:5:112:5 | {...} | ExitMethods.cs:111:41:111:76 | throw ... | throw(ArgumentException) |
-| ExitMethods.cs:111:9:111:77 | return ...; | ExitMethods.cs:111:9:111:77 | return ...; | return |
-| ExitMethods.cs:111:9:111:77 | return ...; | ExitMethods.cs:111:41:111:76 | throw ... | throw(ArgumentException) |
-| ExitMethods.cs:111:16:111:20 | access to parameter input | ExitMethods.cs:111:16:111:20 | access to parameter input | normal |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:16:111:25 | ... != ... | false |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:16:111:25 | ... != ... | true |
-| ExitMethods.cs:111:16:111:76 | ... ? ... : ... | ExitMethods.cs:111:16:111:76 | ... ? ... : ... | normal |
-| ExitMethods.cs:111:16:111:76 | ... ? ... : ... | ExitMethods.cs:111:41:111:76 | throw ... | throw(ArgumentException) |
-| ExitMethods.cs:111:25:111:25 | 0 | ExitMethods.cs:111:25:111:25 | 0 | normal |
-| ExitMethods.cs:111:25:111:25 | (...) ... | ExitMethods.cs:111:25:111:25 | (...) ... | normal |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:111:29:111:29 | 1 | normal |
-| ExitMethods.cs:111:29:111:29 | (...) ... | ExitMethods.cs:111:29:111:29 | (...) ... | normal |
-| ExitMethods.cs:111:29:111:37 | ... / ... | ExitMethods.cs:111:29:111:37 | ... / ... | normal |
-| ExitMethods.cs:111:33:111:37 | access to parameter input | ExitMethods.cs:111:33:111:37 | access to parameter input | normal |
-| ExitMethods.cs:111:41:111:76 | throw ... | ExitMethods.cs:111:41:111:76 | throw ... | throw(ArgumentException) |
-| ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException | ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException | normal |
-| ExitMethods.cs:111:69:111:75 | "input" | ExitMethods.cs:111:69:111:75 | "input" | normal |
-| ExitMethods.cs:115:5:117:5 | {...} | ExitMethods.cs:116:9:116:39 | return ...; | return |
-| ExitMethods.cs:116:9:116:39 | return ...; | ExitMethods.cs:116:9:116:39 | return ...; | return |
-| ExitMethods.cs:116:16:116:16 | access to parameter s | ExitMethods.cs:116:16:116:16 | access to parameter s | normal |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:16:116:30 | call to method Contains | false |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:16:116:30 | call to method Contains | true |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:16:116:38 | ... ? ... : ... | normal |
-| ExitMethods.cs:116:27:116:29 | - | ExitMethods.cs:116:27:116:29 | - | normal |
-| ExitMethods.cs:116:34:116:34 | 0 | ExitMethods.cs:116:34:116:34 | 0 | normal |
-| ExitMethods.cs:116:38:116:38 | 1 | ExitMethods.cs:116:38:116:38 | 1 | normal |
-| ExitMethods.cs:120:5:123:5 | {...} | ExitMethods.cs:121:9:121:28 | call to method IsTrue | throw(AssertFailedException) |
-| ExitMethods.cs:120:5:123:5 | {...} | ExitMethods.cs:122:13:122:17 | Int32 x = ... | normal |
-| ExitMethods.cs:121:9:121:28 | call to method IsTrue | ExitMethods.cs:121:9:121:28 | call to method IsTrue | throw(AssertFailedException) |
-| ExitMethods.cs:121:9:121:29 | ...; | ExitMethods.cs:121:9:121:28 | call to method IsTrue | throw(AssertFailedException) |
-| ExitMethods.cs:121:23:121:27 | false | ExitMethods.cs:121:23:121:27 | false | false |
-| ExitMethods.cs:122:9:122:18 | ... ...; | ExitMethods.cs:122:13:122:17 | Int32 x = ... | normal |
-| ExitMethods.cs:122:13:122:17 | Int32 x = ... | ExitMethods.cs:122:13:122:17 | Int32 x = ... | normal |
-| ExitMethods.cs:122:17:122:17 | 0 | ExitMethods.cs:122:17:122:17 | 0 | normal |
-| ExitMethods.cs:126:5:129:5 | {...} | ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | throw(AssertFailedException) |
-| ExitMethods.cs:126:5:129:5 | {...} | ExitMethods.cs:128:13:128:17 | Int32 x = ... | normal |
-| ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | throw(AssertFailedException) |
-| ExitMethods.cs:127:9:127:26 | this access | ExitMethods.cs:127:9:127:26 | this access | normal |
-| ExitMethods.cs:127:9:127:27 | ...; | ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | throw(AssertFailedException) |
-| ExitMethods.cs:128:9:128:18 | ... ...; | ExitMethods.cs:128:13:128:17 | Int32 x = ... | normal |
-| ExitMethods.cs:128:13:128:17 | Int32 x = ... | ExitMethods.cs:128:13:128:17 | Int32 x = ... | normal |
-| ExitMethods.cs:128:17:128:17 | 0 | ExitMethods.cs:128:17:128:17 | 0 | normal |
-| ExitMethods.cs:131:33:131:49 | call to method IsFalse | ExitMethods.cs:131:33:131:49 | call to method IsFalse | normal |
-| ExitMethods.cs:131:33:131:49 | call to method IsFalse | ExitMethods.cs:131:33:131:49 | call to method IsFalse | throw(AssertFailedException) |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:48:131:48 | access to parameter b | false |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:48:131:48 | access to parameter b | true |
-| ExitMethods.cs:134:5:137:5 | {...} | ExitMethods.cs:135:9:135:25 | call to method AssertFalse | throw(AssertFailedException) |
-| ExitMethods.cs:134:5:137:5 | {...} | ExitMethods.cs:136:13:136:17 | Int32 x = ... | normal |
-| ExitMethods.cs:135:9:135:25 | call to method AssertFalse | ExitMethods.cs:135:9:135:25 | call to method AssertFalse | throw(AssertFailedException) |
-| ExitMethods.cs:135:9:135:25 | this access | ExitMethods.cs:135:9:135:25 | this access | normal |
-| ExitMethods.cs:135:9:135:26 | ...; | ExitMethods.cs:135:9:135:25 | call to method AssertFalse | throw(AssertFailedException) |
-| ExitMethods.cs:135:21:135:24 | true | ExitMethods.cs:135:21:135:24 | true | true |
-| ExitMethods.cs:136:9:136:18 | ... ...; | ExitMethods.cs:136:13:136:17 | Int32 x = ... | normal |
-| ExitMethods.cs:136:13:136:17 | Int32 x = ... | ExitMethods.cs:136:13:136:17 | Int32 x = ... | normal |
-| ExitMethods.cs:136:17:136:17 | 0 | ExitMethods.cs:136:17:136:17 | 0 | normal |
+| ExitMethods.cs:9:5:12:5 | {...} | ExitMethods.cs:11:9:11:15 | return ...; | return |
+| ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe | ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe | normal |
+| ExitMethods.cs:10:9:10:25 | ...; | ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe | normal |
+| ExitMethods.cs:10:20:10:23 | true | ExitMethods.cs:10:20:10:23 | true | normal |
+| ExitMethods.cs:11:9:11:15 | return ...; | ExitMethods.cs:11:9:11:15 | return ...; | return |
+| ExitMethods.cs:15:5:18:5 | {...} | ExitMethods.cs:17:9:17:15 | return ...; | return |
+| ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe | ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe | normal |
+| ExitMethods.cs:16:9:16:26 | ...; | ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe | normal |
+| ExitMethods.cs:16:20:16:24 | false | ExitMethods.cs:16:20:16:24 | false | normal |
+| ExitMethods.cs:17:9:17:15 | return ...; | ExitMethods.cs:17:9:17:15 | return ...; | return |
+| ExitMethods.cs:21:5:24:5 | {...} | ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | throw(ArgumentException) |
+| ExitMethods.cs:21:5:24:5 | {...} | ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | throw(Exception) |
+| ExitMethods.cs:21:5:24:5 | {...} | ExitMethods.cs:23:9:23:15 | return ...; | return |
+| ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | throw(ArgumentException) |
+| ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | throw(Exception) |
+| ExitMethods.cs:22:9:22:26 | ...; | ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | throw(ArgumentException) |
+| ExitMethods.cs:22:9:22:26 | ...; | ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | throw(Exception) |
+| ExitMethods.cs:22:21:22:24 | true | ExitMethods.cs:22:21:22:24 | true | normal |
+| ExitMethods.cs:23:9:23:15 | return ...; | ExitMethods.cs:23:9:23:15 | return ...; | return |
+| ExitMethods.cs:27:5:30:5 | {...} | ExitMethods.cs:28:9:28:14 | call to method Exit | exit |
+| ExitMethods.cs:27:5:30:5 | {...} | ExitMethods.cs:29:9:29:15 | return ...; | return |
+| ExitMethods.cs:28:9:28:14 | call to method Exit | ExitMethods.cs:28:9:28:14 | call to method Exit | exit |
+| ExitMethods.cs:28:9:28:14 | this access | ExitMethods.cs:28:9:28:14 | this access | normal |
+| ExitMethods.cs:28:9:28:15 | ...; | ExitMethods.cs:28:9:28:14 | call to method Exit | exit |
+| ExitMethods.cs:29:9:29:15 | return ...; | ExitMethods.cs:29:9:29:15 | return ...; | return |
+| ExitMethods.cs:33:5:36:5 | {...} | ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | exit |
+| ExitMethods.cs:33:5:36:5 | {...} | ExitMethods.cs:35:9:35:15 | return ...; | return |
+| ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | exit |
+| ExitMethods.cs:34:9:34:25 | this access | ExitMethods.cs:34:9:34:25 | this access | normal |
+| ExitMethods.cs:34:9:34:26 | ...; | ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | exit |
+| ExitMethods.cs:35:9:35:15 | return ...; | ExitMethods.cs:35:9:35:15 | return ...; | return |
+| ExitMethods.cs:39:5:52:5 | {...} | ExitMethods.cs:46:13:46:19 | return ...; | return |
+| ExitMethods.cs:39:5:52:5 | {...} | ExitMethods.cs:50:13:50:19 | return ...; | return |
+| ExitMethods.cs:40:9:51:9 | try {...} ... | ExitMethods.cs:46:13:46:19 | return ...; | return |
+| ExitMethods.cs:40:9:51:9 | try {...} ... | ExitMethods.cs:50:13:50:19 | return ...; | return |
+| ExitMethods.cs:41:9:43:9 | {...} | ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | throw(ArgumentException) |
+| ExitMethods.cs:41:9:43:9 | {...} | ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | throw(Exception) |
+| ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | throw(ArgumentException) |
+| ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | throw(Exception) |
+| ExitMethods.cs:42:13:42:31 | ...; | ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | throw(ArgumentException) |
+| ExitMethods.cs:42:13:42:31 | ...; | ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | throw(Exception) |
+| ExitMethods.cs:42:25:42:29 | false | ExitMethods.cs:42:25:42:29 | false | normal |
+| ExitMethods.cs:44:9:47:9 | catch (...) {...} | ExitMethods.cs:44:9:47:9 | catch (...) {...} | no-match |
+| ExitMethods.cs:44:9:47:9 | catch (...) {...} | ExitMethods.cs:46:13:46:19 | return ...; | return |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:46:13:46:19 | return ...; | return |
+| ExitMethods.cs:46:13:46:19 | return ...; | ExitMethods.cs:46:13:46:19 | return ...; | return |
+| ExitMethods.cs:48:9:51:9 | catch (...) {...} | ExitMethods.cs:50:13:50:19 | return ...; | return |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:50:13:50:19 | return ...; | return |
+| ExitMethods.cs:50:13:50:19 | return ...; | ExitMethods.cs:50:13:50:19 | return ...; | return |
+| ExitMethods.cs:55:5:58:5 | {...} | ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | throw(Exception) |
+| ExitMethods.cs:55:5:58:5 | {...} | ExitMethods.cs:57:9:57:15 | return ...; | return |
+| ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | throw(Exception) |
+| ExitMethods.cs:56:9:56:23 | ...; | ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | throw(Exception) |
+| ExitMethods.cs:57:9:57:15 | return ...; | ExitMethods.cs:57:9:57:15 | return ...; | return |
+| ExitMethods.cs:61:5:64:5 | {...} | ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | throw(Exception) |
+| ExitMethods.cs:61:5:64:5 | {...} | ExitMethods.cs:63:9:63:15 | return ...; | return |
+| ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | throw(Exception) |
+| ExitMethods.cs:62:9:62:23 | ...; | ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | throw(Exception) |
+| ExitMethods.cs:63:9:63:15 | return ...; | ExitMethods.cs:63:9:63:15 | return ...; | return |
+| ExitMethods.cs:67:5:70:5 | {...} | ExitMethods.cs:68:13:68:13 | access to parameter b | false |
+| ExitMethods.cs:67:5:70:5 | {...} | ExitMethods.cs:69:13:69:34 | throw ...; | throw(Exception) |
+| ExitMethods.cs:68:9:69:34 | if (...) ... | ExitMethods.cs:68:13:68:13 | access to parameter b | false |
+| ExitMethods.cs:68:9:69:34 | if (...) ... | ExitMethods.cs:69:13:69:34 | throw ...; | throw(Exception) |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:68:13:68:13 | access to parameter b | false |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:68:13:68:13 | access to parameter b | true |
+| ExitMethods.cs:69:13:69:34 | throw ...; | ExitMethods.cs:69:13:69:34 | throw ...; | throw(Exception) |
+| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:69:19:69:33 | object creation of type Exception | normal |
+| ExitMethods.cs:73:5:78:5 | {...} | ExitMethods.cs:75:13:75:34 | throw ...; | throw(Exception) |
+| ExitMethods.cs:73:5:78:5 | {...} | ExitMethods.cs:77:13:77:45 | throw ...; | throw(ArgumentException) |
+| ExitMethods.cs:74:9:77:45 | if (...) ... | ExitMethods.cs:75:13:75:34 | throw ...; | throw(Exception) |
+| ExitMethods.cs:74:9:77:45 | if (...) ... | ExitMethods.cs:77:13:77:45 | throw ...; | throw(ArgumentException) |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:74:13:74:13 | access to parameter b | false |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:74:13:74:13 | access to parameter b | true |
+| ExitMethods.cs:75:13:75:34 | throw ...; | ExitMethods.cs:75:13:75:34 | throw ...; | throw(Exception) |
+| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:75:19:75:33 | object creation of type Exception | normal |
+| ExitMethods.cs:77:13:77:45 | throw ...; | ExitMethods.cs:77:13:77:45 | throw ...; | throw(ArgumentException) |
+| ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException | ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException | normal |
+| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:77:41:77:43 | "b" | normal |
+| ExitMethods.cs:81:5:83:5 | {...} | ExitMethods.cs:82:9:82:30 | throw ...; | throw(Exception) |
+| ExitMethods.cs:82:9:82:30 | throw ...; | ExitMethods.cs:82:9:82:30 | throw ...; | throw(Exception) |
+| ExitMethods.cs:82:15:82:29 | object creation of type Exception | ExitMethods.cs:82:15:82:29 | object creation of type Exception | normal |
+| ExitMethods.cs:85:35:85:55 | throw ... | ExitMethods.cs:85:35:85:55 | throw ... | throw(Exception) |
+| ExitMethods.cs:85:41:85:55 | object creation of type Exception | ExitMethods.cs:85:41:85:55 | object creation of type Exception | normal |
+| ExitMethods.cs:88:5:90:5 | {...} | ExitMethods.cs:89:9:89:27 | call to method Exit | exit |
+| ExitMethods.cs:89:9:89:27 | call to method Exit | ExitMethods.cs:89:9:89:27 | call to method Exit | exit |
+| ExitMethods.cs:89:9:89:28 | ...; | ExitMethods.cs:89:9:89:27 | call to method Exit | exit |
+| ExitMethods.cs:89:26:89:26 | 0 | ExitMethods.cs:89:26:89:26 | 0 | normal |
+| ExitMethods.cs:93:5:103:5 | {...} | ExitMethods.cs:96:13:96:18 | call to method Exit | exit |
+| ExitMethods.cs:94:9:102:9 | try {...} ... | ExitMethods.cs:96:13:96:18 | call to method Exit | exit |
+| ExitMethods.cs:95:9:97:9 | {...} | ExitMethods.cs:96:13:96:18 | call to method Exit | exit |
+| ExitMethods.cs:96:13:96:18 | call to method Exit | ExitMethods.cs:96:13:96:18 | call to method Exit | exit |
+| ExitMethods.cs:96:13:96:18 | this access | ExitMethods.cs:96:13:96:18 | this access | normal |
+| ExitMethods.cs:96:13:96:19 | ...; | ExitMethods.cs:96:13:96:18 | call to method Exit | exit |
+| ExitMethods.cs:99:9:102:9 | {...} | ExitMethods.cs:101:13:101:40 | call to method WriteLine | normal |
+| ExitMethods.cs:101:13:101:40 | call to method WriteLine | ExitMethods.cs:101:13:101:40 | call to method WriteLine | normal |
+| ExitMethods.cs:101:13:101:41 | ...; | ExitMethods.cs:101:13:101:40 | call to method WriteLine | normal |
+| ExitMethods.cs:101:38:101:39 | "" | ExitMethods.cs:101:38:101:39 | "" | normal |
+| ExitMethods.cs:106:5:108:5 | {...} | ExitMethods.cs:107:9:107:47 | call to method Exit | exit |
+| ExitMethods.cs:107:9:107:47 | call to method Exit | ExitMethods.cs:107:9:107:47 | call to method Exit | exit |
+| ExitMethods.cs:107:9:107:48 | ...; | ExitMethods.cs:107:9:107:47 | call to method Exit | exit |
+| ExitMethods.cs:111:5:113:5 | {...} | ExitMethods.cs:112:9:112:77 | return ...; | return |
+| ExitMethods.cs:111:5:113:5 | {...} | ExitMethods.cs:112:41:112:76 | throw ... | throw(ArgumentException) |
+| ExitMethods.cs:112:9:112:77 | return ...; | ExitMethods.cs:112:9:112:77 | return ...; | return |
+| ExitMethods.cs:112:9:112:77 | return ...; | ExitMethods.cs:112:41:112:76 | throw ... | throw(ArgumentException) |
+| ExitMethods.cs:112:16:112:20 | access to parameter input | ExitMethods.cs:112:16:112:20 | access to parameter input | normal |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:16:112:25 | ... != ... | false |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:16:112:25 | ... != ... | true |
+| ExitMethods.cs:112:16:112:76 | ... ? ... : ... | ExitMethods.cs:112:16:112:76 | ... ? ... : ... | normal |
+| ExitMethods.cs:112:16:112:76 | ... ? ... : ... | ExitMethods.cs:112:41:112:76 | throw ... | throw(ArgumentException) |
+| ExitMethods.cs:112:25:112:25 | 0 | ExitMethods.cs:112:25:112:25 | 0 | normal |
+| ExitMethods.cs:112:25:112:25 | (...) ... | ExitMethods.cs:112:25:112:25 | (...) ... | normal |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:112:29:112:29 | 1 | normal |
+| ExitMethods.cs:112:29:112:29 | (...) ... | ExitMethods.cs:112:29:112:29 | (...) ... | normal |
+| ExitMethods.cs:112:29:112:37 | ... / ... | ExitMethods.cs:112:29:112:37 | ... / ... | normal |
+| ExitMethods.cs:112:33:112:37 | access to parameter input | ExitMethods.cs:112:33:112:37 | access to parameter input | normal |
+| ExitMethods.cs:112:41:112:76 | throw ... | ExitMethods.cs:112:41:112:76 | throw ... | throw(ArgumentException) |
+| ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException | ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException | normal |
+| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:112:69:112:75 | "input" | normal |
+| ExitMethods.cs:116:5:118:5 | {...} | ExitMethods.cs:117:9:117:39 | return ...; | return |
+| ExitMethods.cs:117:9:117:39 | return ...; | ExitMethods.cs:117:9:117:39 | return ...; | return |
+| ExitMethods.cs:117:16:117:16 | access to parameter s | ExitMethods.cs:117:16:117:16 | access to parameter s | normal |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:16:117:30 | call to method Contains | false |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:16:117:30 | call to method Contains | true |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:16:117:38 | ... ? ... : ... | normal |
+| ExitMethods.cs:117:27:117:29 | - | ExitMethods.cs:117:27:117:29 | - | normal |
+| ExitMethods.cs:117:34:117:34 | 0 | ExitMethods.cs:117:34:117:34 | 0 | normal |
+| ExitMethods.cs:117:38:117:38 | 1 | ExitMethods.cs:117:38:117:38 | 1 | normal |
+| ExitMethods.cs:121:5:124:5 | {...} | ExitMethods.cs:122:9:122:28 | call to method IsTrue | throw(AssertFailedException) |
+| ExitMethods.cs:121:5:124:5 | {...} | ExitMethods.cs:123:13:123:17 | Int32 x = ... | normal |
+| ExitMethods.cs:122:9:122:28 | call to method IsTrue | ExitMethods.cs:122:9:122:28 | call to method IsTrue | throw(AssertFailedException) |
+| ExitMethods.cs:122:9:122:29 | ...; | ExitMethods.cs:122:9:122:28 | call to method IsTrue | throw(AssertFailedException) |
+| ExitMethods.cs:122:23:122:27 | false | ExitMethods.cs:122:23:122:27 | false | false |
+| ExitMethods.cs:123:9:123:18 | ... ...; | ExitMethods.cs:123:13:123:17 | Int32 x = ... | normal |
+| ExitMethods.cs:123:13:123:17 | Int32 x = ... | ExitMethods.cs:123:13:123:17 | Int32 x = ... | normal |
+| ExitMethods.cs:123:17:123:17 | 0 | ExitMethods.cs:123:17:123:17 | 0 | normal |
+| ExitMethods.cs:127:5:130:5 | {...} | ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | throw(AssertFailedException) |
+| ExitMethods.cs:127:5:130:5 | {...} | ExitMethods.cs:129:13:129:17 | Int32 x = ... | normal |
+| ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | throw(AssertFailedException) |
+| ExitMethods.cs:128:9:128:26 | this access | ExitMethods.cs:128:9:128:26 | this access | normal |
+| ExitMethods.cs:128:9:128:27 | ...; | ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | throw(AssertFailedException) |
+| ExitMethods.cs:129:9:129:18 | ... ...; | ExitMethods.cs:129:13:129:17 | Int32 x = ... | normal |
+| ExitMethods.cs:129:13:129:17 | Int32 x = ... | ExitMethods.cs:129:13:129:17 | Int32 x = ... | normal |
+| ExitMethods.cs:129:17:129:17 | 0 | ExitMethods.cs:129:17:129:17 | 0 | normal |
+| ExitMethods.cs:132:33:132:49 | call to method IsFalse | ExitMethods.cs:132:33:132:49 | call to method IsFalse | normal |
+| ExitMethods.cs:132:33:132:49 | call to method IsFalse | ExitMethods.cs:132:33:132:49 | call to method IsFalse | throw(AssertFailedException) |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:48:132:48 | access to parameter b | false |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:48:132:48 | access to parameter b | true |
+| ExitMethods.cs:135:5:138:5 | {...} | ExitMethods.cs:136:9:136:25 | call to method AssertFalse | throw(AssertFailedException) |
+| ExitMethods.cs:135:5:138:5 | {...} | ExitMethods.cs:137:13:137:17 | Int32 x = ... | normal |
+| ExitMethods.cs:136:9:136:25 | call to method AssertFalse | ExitMethods.cs:136:9:136:25 | call to method AssertFalse | throw(AssertFailedException) |
+| ExitMethods.cs:136:9:136:25 | this access | ExitMethods.cs:136:9:136:25 | this access | normal |
+| ExitMethods.cs:136:9:136:26 | ...; | ExitMethods.cs:136:9:136:25 | call to method AssertFalse | throw(AssertFailedException) |
+| ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:136:21:136:24 | true | true |
+| ExitMethods.cs:137:9:137:18 | ... ...; | ExitMethods.cs:137:13:137:17 | Int32 x = ... | normal |
+| ExitMethods.cs:137:13:137:17 | Int32 x = ... | ExitMethods.cs:137:13:137:17 | Int32 x = ... | normal |
+| ExitMethods.cs:137:17:137:17 | 0 | ExitMethods.cs:137:17:137:17 | 0 | normal |
+| ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:146:9:146:33 | call to method WriteLine | normal |
+| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:143:13:143:42 | call to method Throw | normal |
+| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:145:13:145:52 | call to method Throw | normal |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:142:13:142:13 | access to parameter b | false |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:142:13:142:13 | access to parameter b | true |
+| ExitMethods.cs:143:13:143:42 | call to method Throw | ExitMethods.cs:143:13:143:42 | call to method Throw | normal |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:42 | call to method Throw | normal |
+| ExitMethods.cs:143:41:143:41 | access to parameter e | ExitMethods.cs:143:41:143:41 | access to parameter e | normal |
+| ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:145:13:145:44 | call to method Capture | normal |
+| ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:145:13:145:52 | call to method Throw | normal |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:52 | call to method Throw | normal |
+| ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:145:43:145:43 | access to parameter e | normal |
+| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:146:9:146:33 | call to method WriteLine | normal |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:9:146:33 | call to method WriteLine | normal |
+| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:146:27:146:32 | "dead" | normal |
 | Extensions.cs:6:5:8:5 | {...} | Extensions.cs:7:9:7:30 | return ...; | return |
 | Extensions.cs:7:9:7:30 | return ...; | Extensions.cs:7:9:7:30 | return ...; | return |
 | Extensions.cs:7:16:7:29 | call to method Parse | Extensions.cs:7:16:7:29 | call to method Parse | normal |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ExitMethods.cs b/csharp/ql/test/library-tests/controlflow/graph/ExitMethods.cs
index 9a34ecd32f8..3d821a1d335 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ExitMethods.cs
+++ b/csharp/ql/test/library-tests/controlflow/graph/ExitMethods.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Linq;
 using Microsoft.VisualStudio.TestTools.UnitTesting;
+using System.Runtime.ExceptionServices;
 
 class ExitMethods
 {
@@ -135,6 +136,15 @@ class ExitMethods
         AssertFalse(true);
         var x = 0; // dead
     }
+
+    public void ExceptionDispatchInfoThrow(bool b, ArgumentException e)
+    {
+        if (b)
+            ExceptionDispatchInfo.Throw(e);
+        else
+            ExceptionDispatchInfo.Capture(e).Throw();
+        Console.WriteLine("dead");
+    }
 }
 
 // semmle-extractor-options: ${testdir}/../../../resources/stubs/System.Windows.cs  ${testdir}/../../../resources/stubs/Microsoft.VisualStudio.TestTools.UnitTesting.cs
diff --git a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
index 6218a3a3b46..15149f7a20e 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
@@ -1650,169 +1650,185 @@
 | Conditions.cs:149:38:149:47 | $"..." | Conditions.cs:149:13:149:48 | call to method WriteLine | semmle.label | successor |
 | Conditions.cs:149:40:149:43 | "b = " | Conditions.cs:149:45:149:45 | access to local variable s | semmle.label | successor |
 | Conditions.cs:149:45:149:45 | access to local variable s | Conditions.cs:149:38:149:47 | $"..." | semmle.label | successor |
-| ExitMethods.cs:7:10:7:11 | enter M1 | ExitMethods.cs:8:5:11:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:7:10:7:11 | exit M1 (normal) | ExitMethods.cs:7:10:7:11 | exit M1 | semmle.label | successor |
-| ExitMethods.cs:8:5:11:5 | {...} | ExitMethods.cs:9:9:9:25 | ...; | semmle.label | successor |
-| ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe | ExitMethods.cs:10:9:10:15 | return ...; | semmle.label | successor |
-| ExitMethods.cs:9:9:9:25 | ...; | ExitMethods.cs:9:20:9:23 | true | semmle.label | successor |
-| ExitMethods.cs:9:20:9:23 | true | ExitMethods.cs:9:9:9:24 | call to method ErrorMaybe | semmle.label | successor |
-| ExitMethods.cs:10:9:10:15 | return ...; | ExitMethods.cs:7:10:7:11 | exit M1 (normal) | semmle.label | return |
-| ExitMethods.cs:13:10:13:11 | enter M2 | ExitMethods.cs:14:5:17:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:13:10:13:11 | exit M2 (normal) | ExitMethods.cs:13:10:13:11 | exit M2 | semmle.label | successor |
-| ExitMethods.cs:14:5:17:5 | {...} | ExitMethods.cs:15:9:15:26 | ...; | semmle.label | successor |
-| ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe | ExitMethods.cs:16:9:16:15 | return ...; | semmle.label | successor |
-| ExitMethods.cs:15:9:15:26 | ...; | ExitMethods.cs:15:20:15:24 | false | semmle.label | successor |
-| ExitMethods.cs:15:20:15:24 | false | ExitMethods.cs:15:9:15:25 | call to method ErrorMaybe | semmle.label | successor |
-| ExitMethods.cs:16:9:16:15 | return ...; | ExitMethods.cs:13:10:13:11 | exit M2 (normal) | semmle.label | return |
-| ExitMethods.cs:19:10:19:11 | enter M3 | ExitMethods.cs:20:5:23:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:19:10:19:11 | exit M3 (abnormal) | ExitMethods.cs:19:10:19:11 | exit M3 | semmle.label | successor |
-| ExitMethods.cs:20:5:23:5 | {...} | ExitMethods.cs:21:9:21:26 | ...; | semmle.label | successor |
-| ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | ExitMethods.cs:19:10:19:11 | exit M3 (abnormal) | semmle.label | exception(ArgumentException) |
-| ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | ExitMethods.cs:19:10:19:11 | exit M3 (abnormal) | semmle.label | exception(Exception) |
-| ExitMethods.cs:21:9:21:26 | ...; | ExitMethods.cs:21:21:21:24 | true | semmle.label | successor |
-| ExitMethods.cs:21:21:21:24 | true | ExitMethods.cs:21:9:21:25 | call to method ErrorAlways | semmle.label | successor |
-| ExitMethods.cs:25:10:25:11 | enter M4 | ExitMethods.cs:26:5:29:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:25:10:25:11 | exit M4 (abnormal) | ExitMethods.cs:25:10:25:11 | exit M4 | semmle.label | successor |
-| ExitMethods.cs:26:5:29:5 | {...} | ExitMethods.cs:27:9:27:15 | ...; | semmle.label | successor |
-| ExitMethods.cs:27:9:27:14 | call to method Exit | ExitMethods.cs:25:10:25:11 | exit M4 (abnormal) | semmle.label | exit |
-| ExitMethods.cs:27:9:27:14 | this access | ExitMethods.cs:27:9:27:14 | call to method Exit | semmle.label | successor |
-| ExitMethods.cs:27:9:27:15 | ...; | ExitMethods.cs:27:9:27:14 | this access | semmle.label | successor |
-| ExitMethods.cs:31:10:31:11 | enter M5 | ExitMethods.cs:32:5:35:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:31:10:31:11 | exit M5 (abnormal) | ExitMethods.cs:31:10:31:11 | exit M5 | semmle.label | successor |
-| ExitMethods.cs:32:5:35:5 | {...} | ExitMethods.cs:33:9:33:26 | ...; | semmle.label | successor |
-| ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | ExitMethods.cs:31:10:31:11 | exit M5 (abnormal) | semmle.label | exit |
-| ExitMethods.cs:33:9:33:25 | this access | ExitMethods.cs:33:9:33:25 | call to method ApplicationExit | semmle.label | successor |
-| ExitMethods.cs:33:9:33:26 | ...; | ExitMethods.cs:33:9:33:25 | this access | semmle.label | successor |
-| ExitMethods.cs:37:10:37:11 | enter M6 | ExitMethods.cs:38:5:51:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:37:10:37:11 | exit M6 (normal) | ExitMethods.cs:37:10:37:11 | exit M6 | semmle.label | successor |
-| ExitMethods.cs:38:5:51:5 | {...} | ExitMethods.cs:39:9:50:9 | try {...} ... | semmle.label | successor |
-| ExitMethods.cs:39:9:50:9 | try {...} ... | ExitMethods.cs:40:9:42:9 | {...} | semmle.label | successor |
-| ExitMethods.cs:40:9:42:9 | {...} | ExitMethods.cs:41:13:41:31 | ...; | semmle.label | successor |
-| ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} | semmle.label | exception(ArgumentException) |
-| ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | semmle.label | exception(Exception) |
-| ExitMethods.cs:41:13:41:31 | ...; | ExitMethods.cs:41:25:41:29 | false | semmle.label | successor |
-| ExitMethods.cs:41:25:41:29 | false | ExitMethods.cs:41:13:41:30 | call to method ErrorAlways | semmle.label | successor |
-| ExitMethods.cs:43:9:46:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:44:9:46:9 | {...} | semmle.label | match |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:44:9:46:9 | {...} | semmle.label | match |
-| ExitMethods.cs:43:9:46:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | semmle.label | no-match |
-| ExitMethods.cs:44:9:46:9 | {...} | ExitMethods.cs:45:13:45:19 | return ...; | semmle.label | successor |
-| ExitMethods.cs:45:13:45:19 | return ...; | ExitMethods.cs:37:10:37:11 | exit M6 (normal) | semmle.label | return |
-| ExitMethods.cs:47:9:50:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:50:9 | {...} | semmle.label | match |
-| ExitMethods.cs:48:9:50:9 | {...} | ExitMethods.cs:49:13:49:19 | return ...; | semmle.label | successor |
-| ExitMethods.cs:49:13:49:19 | return ...; | ExitMethods.cs:37:10:37:11 | exit M6 (normal) | semmle.label | return |
-| ExitMethods.cs:53:10:53:11 | enter M7 | ExitMethods.cs:54:5:57:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:53:10:53:11 | exit M7 (abnormal) | ExitMethods.cs:53:10:53:11 | exit M7 | semmle.label | successor |
-| ExitMethods.cs:54:5:57:5 | {...} | ExitMethods.cs:55:9:55:23 | ...; | semmle.label | successor |
-| ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | ExitMethods.cs:53:10:53:11 | exit M7 (abnormal) | semmle.label | exception(Exception) |
-| ExitMethods.cs:55:9:55:23 | ...; | ExitMethods.cs:55:9:55:22 | call to method ErrorAlways2 | semmle.label | successor |
-| ExitMethods.cs:59:10:59:11 | enter M8 | ExitMethods.cs:60:5:63:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:59:10:59:11 | exit M8 (abnormal) | ExitMethods.cs:59:10:59:11 | exit M8 | semmle.label | successor |
-| ExitMethods.cs:60:5:63:5 | {...} | ExitMethods.cs:61:9:61:23 | ...; | semmle.label | successor |
-| ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | ExitMethods.cs:59:10:59:11 | exit M8 (abnormal) | semmle.label | exception(Exception) |
-| ExitMethods.cs:61:9:61:23 | ...; | ExitMethods.cs:61:9:61:22 | call to method ErrorAlways3 | semmle.label | successor |
-| ExitMethods.cs:65:17:65:26 | enter ErrorMaybe | ExitMethods.cs:66:5:69:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (abnormal) | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe | semmle.label | successor |
-| ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe | semmle.label | successor |
-| ExitMethods.cs:66:5:69:5 | {...} | ExitMethods.cs:67:9:68:34 | if (...) ... | semmle.label | successor |
-| ExitMethods.cs:67:9:68:34 | if (...) ... | ExitMethods.cs:67:13:67:13 | access to parameter b | semmle.label | successor |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (normal) | semmle.label | false |
-| ExitMethods.cs:67:13:67:13 | access to parameter b | ExitMethods.cs:68:19:68:33 | object creation of type Exception | semmle.label | true |
-| ExitMethods.cs:68:13:68:34 | throw ...; | ExitMethods.cs:65:17:65:26 | exit ErrorMaybe (abnormal) | semmle.label | exception(Exception) |
-| ExitMethods.cs:68:19:68:33 | object creation of type Exception | ExitMethods.cs:68:13:68:34 | throw ...; | semmle.label | successor |
-| ExitMethods.cs:71:17:71:27 | enter ErrorAlways | ExitMethods.cs:72:5:77:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:71:17:71:27 | exit ErrorAlways | semmle.label | successor |
-| ExitMethods.cs:72:5:77:5 | {...} | ExitMethods.cs:73:9:76:45 | if (...) ... | semmle.label | successor |
-| ExitMethods.cs:73:9:76:45 | if (...) ... | ExitMethods.cs:73:13:73:13 | access to parameter b | semmle.label | successor |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:74:19:74:33 | object creation of type Exception | semmle.label | true |
-| ExitMethods.cs:73:13:73:13 | access to parameter b | ExitMethods.cs:76:41:76:43 | "b" | semmle.label | false |
-| ExitMethods.cs:74:13:74:34 | throw ...; | ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) | semmle.label | exception(Exception) |
-| ExitMethods.cs:74:19:74:33 | object creation of type Exception | ExitMethods.cs:74:13:74:34 | throw ...; | semmle.label | successor |
-| ExitMethods.cs:76:13:76:45 | throw ...; | ExitMethods.cs:71:17:71:27 | exit ErrorAlways (abnormal) | semmle.label | exception(ArgumentException) |
-| ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException | ExitMethods.cs:76:13:76:45 | throw ...; | semmle.label | successor |
-| ExitMethods.cs:76:41:76:43 | "b" | ExitMethods.cs:76:19:76:44 | object creation of type ArgumentException | semmle.label | successor |
-| ExitMethods.cs:79:17:79:28 | enter ErrorAlways2 | ExitMethods.cs:80:5:82:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 (abnormal) | ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 | semmle.label | successor |
-| ExitMethods.cs:80:5:82:5 | {...} | ExitMethods.cs:81:15:81:29 | object creation of type Exception | semmle.label | successor |
-| ExitMethods.cs:81:9:81:30 | throw ...; | ExitMethods.cs:79:17:79:28 | exit ErrorAlways2 (abnormal) | semmle.label | exception(Exception) |
-| ExitMethods.cs:81:15:81:29 | object creation of type Exception | ExitMethods.cs:81:9:81:30 | throw ...; | semmle.label | successor |
-| ExitMethods.cs:84:17:84:28 | enter ErrorAlways3 | ExitMethods.cs:84:41:84:55 | object creation of type Exception | semmle.label | successor |
-| ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 (abnormal) | ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 | semmle.label | successor |
-| ExitMethods.cs:84:35:84:55 | throw ... | ExitMethods.cs:84:17:84:28 | exit ErrorAlways3 (abnormal) | semmle.label | exception(Exception) |
-| ExitMethods.cs:84:41:84:55 | object creation of type Exception | ExitMethods.cs:84:35:84:55 | throw ... | semmle.label | successor |
-| ExitMethods.cs:86:10:86:13 | enter Exit | ExitMethods.cs:87:5:89:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:86:10:86:13 | exit Exit (abnormal) | ExitMethods.cs:86:10:86:13 | exit Exit | semmle.label | successor |
-| ExitMethods.cs:87:5:89:5 | {...} | ExitMethods.cs:88:9:88:28 | ...; | semmle.label | successor |
-| ExitMethods.cs:88:9:88:27 | call to method Exit | ExitMethods.cs:86:10:86:13 | exit Exit (abnormal) | semmle.label | exit |
-| ExitMethods.cs:88:9:88:28 | ...; | ExitMethods.cs:88:26:88:26 | 0 | semmle.label | successor |
-| ExitMethods.cs:88:26:88:26 | 0 | ExitMethods.cs:88:9:88:27 | call to method Exit | semmle.label | successor |
-| ExitMethods.cs:91:10:91:18 | enter ExitInTry | ExitMethods.cs:92:5:102:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:91:10:91:18 | exit ExitInTry (abnormal) | ExitMethods.cs:91:10:91:18 | exit ExitInTry | semmle.label | successor |
-| ExitMethods.cs:92:5:102:5 | {...} | ExitMethods.cs:93:9:101:9 | try {...} ... | semmle.label | successor |
-| ExitMethods.cs:93:9:101:9 | try {...} ... | ExitMethods.cs:94:9:96:9 | {...} | semmle.label | successor |
-| ExitMethods.cs:94:9:96:9 | {...} | ExitMethods.cs:95:13:95:19 | ...; | semmle.label | successor |
-| ExitMethods.cs:95:13:95:18 | call to method Exit | ExitMethods.cs:91:10:91:18 | exit ExitInTry (abnormal) | semmle.label | exit |
-| ExitMethods.cs:95:13:95:18 | this access | ExitMethods.cs:95:13:95:18 | call to method Exit | semmle.label | successor |
-| ExitMethods.cs:95:13:95:19 | ...; | ExitMethods.cs:95:13:95:18 | this access | semmle.label | successor |
-| ExitMethods.cs:104:10:104:24 | enter ApplicationExit | ExitMethods.cs:105:5:107:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:104:10:104:24 | exit ApplicationExit (abnormal) | ExitMethods.cs:104:10:104:24 | exit ApplicationExit | semmle.label | successor |
-| ExitMethods.cs:105:5:107:5 | {...} | ExitMethods.cs:106:9:106:48 | ...; | semmle.label | successor |
-| ExitMethods.cs:106:9:106:47 | call to method Exit | ExitMethods.cs:104:10:104:24 | exit ApplicationExit (abnormal) | semmle.label | exit |
-| ExitMethods.cs:106:9:106:48 | ...; | ExitMethods.cs:106:9:106:47 | call to method Exit | semmle.label | successor |
-| ExitMethods.cs:109:13:109:21 | enter ThrowExpr | ExitMethods.cs:110:5:112:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr (abnormal) | ExitMethods.cs:109:13:109:21 | exit ThrowExpr | semmle.label | successor |
-| ExitMethods.cs:109:13:109:21 | exit ThrowExpr (normal) | ExitMethods.cs:109:13:109:21 | exit ThrowExpr | semmle.label | successor |
-| ExitMethods.cs:110:5:112:5 | {...} | ExitMethods.cs:111:16:111:20 | access to parameter input | semmle.label | successor |
-| ExitMethods.cs:111:9:111:77 | return ...; | ExitMethods.cs:109:13:109:21 | exit ThrowExpr (normal) | semmle.label | return |
-| ExitMethods.cs:111:16:111:20 | access to parameter input | ExitMethods.cs:111:25:111:25 | 0 | semmle.label | successor |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:29:111:29 | 1 | semmle.label | true |
-| ExitMethods.cs:111:16:111:25 | ... != ... | ExitMethods.cs:111:69:111:75 | "input" | semmle.label | false |
-| ExitMethods.cs:111:16:111:76 | ... ? ... : ... | ExitMethods.cs:111:9:111:77 | return ...; | semmle.label | successor |
-| ExitMethods.cs:111:25:111:25 | 0 | ExitMethods.cs:111:25:111:25 | (...) ... | semmle.label | successor |
-| ExitMethods.cs:111:25:111:25 | (...) ... | ExitMethods.cs:111:16:111:25 | ... != ... | semmle.label | successor |
-| ExitMethods.cs:111:29:111:29 | 1 | ExitMethods.cs:111:29:111:29 | (...) ... | semmle.label | successor |
-| ExitMethods.cs:111:29:111:29 | (...) ... | ExitMethods.cs:111:33:111:37 | access to parameter input | semmle.label | successor |
-| ExitMethods.cs:111:29:111:37 | ... / ... | ExitMethods.cs:111:16:111:76 | ... ? ... : ... | semmle.label | successor |
-| ExitMethods.cs:111:33:111:37 | access to parameter input | ExitMethods.cs:111:29:111:37 | ... / ... | semmle.label | successor |
-| ExitMethods.cs:111:41:111:76 | throw ... | ExitMethods.cs:109:13:109:21 | exit ThrowExpr (abnormal) | semmle.label | exception(ArgumentException) |
-| ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException | ExitMethods.cs:111:41:111:76 | throw ... | semmle.label | successor |
-| ExitMethods.cs:111:69:111:75 | "input" | ExitMethods.cs:111:47:111:76 | object creation of type ArgumentException | semmle.label | successor |
-| ExitMethods.cs:114:16:114:34 | enter ExtensionMethodCall | ExitMethods.cs:115:5:117:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall (normal) | ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall | semmle.label | successor |
-| ExitMethods.cs:115:5:117:5 | {...} | ExitMethods.cs:116:16:116:16 | access to parameter s | semmle.label | successor |
-| ExitMethods.cs:116:9:116:39 | return ...; | ExitMethods.cs:114:16:114:34 | exit ExtensionMethodCall (normal) | semmle.label | return |
-| ExitMethods.cs:116:16:116:16 | access to parameter s | ExitMethods.cs:116:27:116:29 | - | semmle.label | successor |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:34:116:34 | 0 | semmle.label | true |
-| ExitMethods.cs:116:16:116:30 | call to method Contains | ExitMethods.cs:116:38:116:38 | 1 | semmle.label | false |
-| ExitMethods.cs:116:16:116:38 | ... ? ... : ... | ExitMethods.cs:116:9:116:39 | return ...; | semmle.label | successor |
-| ExitMethods.cs:116:27:116:29 | - | ExitMethods.cs:116:16:116:30 | call to method Contains | semmle.label | successor |
-| ExitMethods.cs:116:34:116:34 | 0 | ExitMethods.cs:116:16:116:38 | ... ? ... : ... | semmle.label | successor |
-| ExitMethods.cs:116:38:116:38 | 1 | ExitMethods.cs:116:16:116:38 | ... ? ... : ... | semmle.label | successor |
-| ExitMethods.cs:119:17:119:32 | enter FailingAssertion | ExitMethods.cs:120:5:123:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:119:17:119:32 | exit FailingAssertion (abnormal) | ExitMethods.cs:119:17:119:32 | exit FailingAssertion | semmle.label | successor |
-| ExitMethods.cs:120:5:123:5 | {...} | ExitMethods.cs:121:9:121:29 | ...; | semmle.label | successor |
-| ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:119:17:119:32 | exit FailingAssertion (abnormal) | semmle.label | exception(AssertFailedException) |
-| ExitMethods.cs:121:9:121:29 | ...; | ExitMethods.cs:121:23:121:27 | false | semmle.label | successor |
-| ExitMethods.cs:121:23:121:27 | false | ExitMethods.cs:121:9:121:28 | [assertion failure] call to method IsTrue | semmle.label | false |
-| ExitMethods.cs:125:17:125:33 | enter FailingAssertion2 | ExitMethods.cs:126:5:129:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 (abnormal) | ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 | semmle.label | successor |
-| ExitMethods.cs:126:5:129:5 | {...} | ExitMethods.cs:127:9:127:27 | ...; | semmle.label | successor |
-| ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | ExitMethods.cs:125:17:125:33 | exit FailingAssertion2 (abnormal) | semmle.label | exception(AssertFailedException) |
-| ExitMethods.cs:127:9:127:26 | this access | ExitMethods.cs:127:9:127:26 | call to method FailingAssertion | semmle.label | successor |
-| ExitMethods.cs:127:9:127:27 | ...; | ExitMethods.cs:127:9:127:26 | this access | semmle.label | successor |
-| ExitMethods.cs:131:10:131:20 | enter AssertFalse | ExitMethods.cs:131:48:131:48 | access to parameter b | semmle.label | successor |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse (abnormal) | ExitMethods.cs:131:10:131:20 | exit AssertFalse | semmle.label | successor |
-| ExitMethods.cs:131:10:131:20 | exit AssertFalse (normal) | ExitMethods.cs:131:10:131:20 | exit AssertFalse | semmle.label | successor |
-| ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse (abnormal) | semmle.label | exception(AssertFailedException) |
-| ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | ExitMethods.cs:131:10:131:20 | exit AssertFalse (normal) | semmle.label | successor |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:33:131:49 | [assertion failure] call to method IsFalse | semmle.label | true |
-| ExitMethods.cs:131:48:131:48 | access to parameter b | ExitMethods.cs:131:33:131:49 | [assertion success] call to method IsFalse | semmle.label | false |
-| ExitMethods.cs:133:17:133:33 | enter FailingAssertion3 | ExitMethods.cs:134:5:137:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 (abnormal) | ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 | semmle.label | successor |
-| ExitMethods.cs:134:5:137:5 | {...} | ExitMethods.cs:135:9:135:26 | ...; | semmle.label | successor |
-| ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:133:17:133:33 | exit FailingAssertion3 (abnormal) | semmle.label | exception(AssertFailedException) |
-| ExitMethods.cs:135:9:135:25 | this access | ExitMethods.cs:135:21:135:24 | true | semmle.label | successor |
-| ExitMethods.cs:135:9:135:26 | ...; | ExitMethods.cs:135:9:135:25 | this access | semmle.label | successor |
-| ExitMethods.cs:135:21:135:24 | true | ExitMethods.cs:135:9:135:25 | [assertion failure] call to method AssertFalse | semmle.label | true |
+| ExitMethods.cs:8:10:8:11 | enter M1 | ExitMethods.cs:9:5:12:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:8:10:8:11 | exit M1 (normal) | ExitMethods.cs:8:10:8:11 | exit M1 | semmle.label | successor |
+| ExitMethods.cs:9:5:12:5 | {...} | ExitMethods.cs:10:9:10:25 | ...; | semmle.label | successor |
+| ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe | ExitMethods.cs:11:9:11:15 | return ...; | semmle.label | successor |
+| ExitMethods.cs:10:9:10:25 | ...; | ExitMethods.cs:10:20:10:23 | true | semmle.label | successor |
+| ExitMethods.cs:10:20:10:23 | true | ExitMethods.cs:10:9:10:24 | call to method ErrorMaybe | semmle.label | successor |
+| ExitMethods.cs:11:9:11:15 | return ...; | ExitMethods.cs:8:10:8:11 | exit M1 (normal) | semmle.label | return |
+| ExitMethods.cs:14:10:14:11 | enter M2 | ExitMethods.cs:15:5:18:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:14:10:14:11 | exit M2 (normal) | ExitMethods.cs:14:10:14:11 | exit M2 | semmle.label | successor |
+| ExitMethods.cs:15:5:18:5 | {...} | ExitMethods.cs:16:9:16:26 | ...; | semmle.label | successor |
+| ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe | ExitMethods.cs:17:9:17:15 | return ...; | semmle.label | successor |
+| ExitMethods.cs:16:9:16:26 | ...; | ExitMethods.cs:16:20:16:24 | false | semmle.label | successor |
+| ExitMethods.cs:16:20:16:24 | false | ExitMethods.cs:16:9:16:25 | call to method ErrorMaybe | semmle.label | successor |
+| ExitMethods.cs:17:9:17:15 | return ...; | ExitMethods.cs:14:10:14:11 | exit M2 (normal) | semmle.label | return |
+| ExitMethods.cs:20:10:20:11 | enter M3 | ExitMethods.cs:21:5:24:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:20:10:20:11 | exit M3 (abnormal) | ExitMethods.cs:20:10:20:11 | exit M3 | semmle.label | successor |
+| ExitMethods.cs:21:5:24:5 | {...} | ExitMethods.cs:22:9:22:26 | ...; | semmle.label | successor |
+| ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | ExitMethods.cs:20:10:20:11 | exit M3 (abnormal) | semmle.label | exception(ArgumentException) |
+| ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | ExitMethods.cs:20:10:20:11 | exit M3 (abnormal) | semmle.label | exception(Exception) |
+| ExitMethods.cs:22:9:22:26 | ...; | ExitMethods.cs:22:21:22:24 | true | semmle.label | successor |
+| ExitMethods.cs:22:21:22:24 | true | ExitMethods.cs:22:9:22:25 | call to method ErrorAlways | semmle.label | successor |
+| ExitMethods.cs:26:10:26:11 | enter M4 | ExitMethods.cs:27:5:30:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:26:10:26:11 | exit M4 (abnormal) | ExitMethods.cs:26:10:26:11 | exit M4 | semmle.label | successor |
+| ExitMethods.cs:27:5:30:5 | {...} | ExitMethods.cs:28:9:28:15 | ...; | semmle.label | successor |
+| ExitMethods.cs:28:9:28:14 | call to method Exit | ExitMethods.cs:26:10:26:11 | exit M4 (abnormal) | semmle.label | exit |
+| ExitMethods.cs:28:9:28:14 | this access | ExitMethods.cs:28:9:28:14 | call to method Exit | semmle.label | successor |
+| ExitMethods.cs:28:9:28:15 | ...; | ExitMethods.cs:28:9:28:14 | this access | semmle.label | successor |
+| ExitMethods.cs:32:10:32:11 | enter M5 | ExitMethods.cs:33:5:36:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:32:10:32:11 | exit M5 (abnormal) | ExitMethods.cs:32:10:32:11 | exit M5 | semmle.label | successor |
+| ExitMethods.cs:33:5:36:5 | {...} | ExitMethods.cs:34:9:34:26 | ...; | semmle.label | successor |
+| ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | ExitMethods.cs:32:10:32:11 | exit M5 (abnormal) | semmle.label | exit |
+| ExitMethods.cs:34:9:34:25 | this access | ExitMethods.cs:34:9:34:25 | call to method ApplicationExit | semmle.label | successor |
+| ExitMethods.cs:34:9:34:26 | ...; | ExitMethods.cs:34:9:34:25 | this access | semmle.label | successor |
+| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:39:5:52:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:38:10:38:11 | exit M6 | semmle.label | successor |
+| ExitMethods.cs:39:5:52:5 | {...} | ExitMethods.cs:40:9:51:9 | try {...} ... | semmle.label | successor |
+| ExitMethods.cs:40:9:51:9 | try {...} ... | ExitMethods.cs:41:9:43:9 | {...} | semmle.label | successor |
+| ExitMethods.cs:41:9:43:9 | {...} | ExitMethods.cs:42:13:42:31 | ...; | semmle.label | successor |
+| ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} | semmle.label | exception(ArgumentException) |
+| ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | semmle.label | exception(Exception) |
+| ExitMethods.cs:42:13:42:31 | ...; | ExitMethods.cs:42:25:42:29 | false | semmle.label | successor |
+| ExitMethods.cs:42:25:42:29 | false | ExitMethods.cs:42:13:42:30 | call to method ErrorAlways | semmle.label | successor |
+| ExitMethods.cs:44:9:47:9 | [exception: ArgumentException] catch (...) {...} | ExitMethods.cs:45:9:47:9 | {...} | semmle.label | match |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:45:9:47:9 | {...} | semmle.label | match |
+| ExitMethods.cs:44:9:47:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | semmle.label | no-match |
+| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:46:13:46:19 | return ...; | semmle.label | successor |
+| ExitMethods.cs:46:13:46:19 | return ...; | ExitMethods.cs:38:10:38:11 | exit M6 (normal) | semmle.label | return |
+| ExitMethods.cs:48:9:51:9 | [exception: Exception] catch (...) {...} | ExitMethods.cs:49:9:51:9 | {...} | semmle.label | match |
+| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:50:13:50:19 | return ...; | semmle.label | successor |
+| ExitMethods.cs:50:13:50:19 | return ...; | ExitMethods.cs:38:10:38:11 | exit M6 (normal) | semmle.label | return |
+| ExitMethods.cs:54:10:54:11 | enter M7 | ExitMethods.cs:55:5:58:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:54:10:54:11 | exit M7 (abnormal) | ExitMethods.cs:54:10:54:11 | exit M7 | semmle.label | successor |
+| ExitMethods.cs:55:5:58:5 | {...} | ExitMethods.cs:56:9:56:23 | ...; | semmle.label | successor |
+| ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | ExitMethods.cs:54:10:54:11 | exit M7 (abnormal) | semmle.label | exception(Exception) |
+| ExitMethods.cs:56:9:56:23 | ...; | ExitMethods.cs:56:9:56:22 | call to method ErrorAlways2 | semmle.label | successor |
+| ExitMethods.cs:60:10:60:11 | enter M8 | ExitMethods.cs:61:5:64:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:60:10:60:11 | exit M8 (abnormal) | ExitMethods.cs:60:10:60:11 | exit M8 | semmle.label | successor |
+| ExitMethods.cs:61:5:64:5 | {...} | ExitMethods.cs:62:9:62:23 | ...; | semmle.label | successor |
+| ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | ExitMethods.cs:60:10:60:11 | exit M8 (abnormal) | semmle.label | exception(Exception) |
+| ExitMethods.cs:62:9:62:23 | ...; | ExitMethods.cs:62:9:62:22 | call to method ErrorAlways3 | semmle.label | successor |
+| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:67:5:70:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (abnormal) | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | semmle.label | successor |
+| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | semmle.label | successor |
+| ExitMethods.cs:67:5:70:5 | {...} | ExitMethods.cs:68:9:69:34 | if (...) ... | semmle.label | successor |
+| ExitMethods.cs:68:9:69:34 | if (...) ... | ExitMethods.cs:68:13:68:13 | access to parameter b | semmle.label | successor |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | semmle.label | false |
+| ExitMethods.cs:68:13:68:13 | access to parameter b | ExitMethods.cs:69:19:69:33 | object creation of type Exception | semmle.label | true |
+| ExitMethods.cs:69:13:69:34 | throw ...; | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (abnormal) | semmle.label | exception(Exception) |
+| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:69:13:69:34 | throw ...; | semmle.label | successor |
+| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:73:5:78:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:72:17:72:27 | exit ErrorAlways | semmle.label | successor |
+| ExitMethods.cs:73:5:78:5 | {...} | ExitMethods.cs:74:9:77:45 | if (...) ... | semmle.label | successor |
+| ExitMethods.cs:74:9:77:45 | if (...) ... | ExitMethods.cs:74:13:74:13 | access to parameter b | semmle.label | successor |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:75:19:75:33 | object creation of type Exception | semmle.label | true |
+| ExitMethods.cs:74:13:74:13 | access to parameter b | ExitMethods.cs:77:41:77:43 | "b" | semmle.label | false |
+| ExitMethods.cs:75:13:75:34 | throw ...; | ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | semmle.label | exception(Exception) |
+| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:75:13:75:34 | throw ...; | semmle.label | successor |
+| ExitMethods.cs:77:13:77:45 | throw ...; | ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | semmle.label | exception(ArgumentException) |
+| ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException | ExitMethods.cs:77:13:77:45 | throw ...; | semmle.label | successor |
+| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:77:19:77:44 | object creation of type ArgumentException | semmle.label | successor |
+| ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 | ExitMethods.cs:81:5:83:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 (abnormal) | ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 | semmle.label | successor |
+| ExitMethods.cs:81:5:83:5 | {...} | ExitMethods.cs:82:15:82:29 | object creation of type Exception | semmle.label | successor |
+| ExitMethods.cs:82:9:82:30 | throw ...; | ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 (abnormal) | semmle.label | exception(Exception) |
+| ExitMethods.cs:82:15:82:29 | object creation of type Exception | ExitMethods.cs:82:9:82:30 | throw ...; | semmle.label | successor |
+| ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 | ExitMethods.cs:85:41:85:55 | object creation of type Exception | semmle.label | successor |
+| ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 (abnormal) | ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 | semmle.label | successor |
+| ExitMethods.cs:85:35:85:55 | throw ... | ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 (abnormal) | semmle.label | exception(Exception) |
+| ExitMethods.cs:85:41:85:55 | object creation of type Exception | ExitMethods.cs:85:35:85:55 | throw ... | semmle.label | successor |
+| ExitMethods.cs:87:10:87:13 | enter Exit | ExitMethods.cs:88:5:90:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:87:10:87:13 | exit Exit (abnormal) | ExitMethods.cs:87:10:87:13 | exit Exit | semmle.label | successor |
+| ExitMethods.cs:88:5:90:5 | {...} | ExitMethods.cs:89:9:89:28 | ...; | semmle.label | successor |
+| ExitMethods.cs:89:9:89:27 | call to method Exit | ExitMethods.cs:87:10:87:13 | exit Exit (abnormal) | semmle.label | exit |
+| ExitMethods.cs:89:9:89:28 | ...; | ExitMethods.cs:89:26:89:26 | 0 | semmle.label | successor |
+| ExitMethods.cs:89:26:89:26 | 0 | ExitMethods.cs:89:9:89:27 | call to method Exit | semmle.label | successor |
+| ExitMethods.cs:92:10:92:18 | enter ExitInTry | ExitMethods.cs:93:5:103:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:92:10:92:18 | exit ExitInTry (abnormal) | ExitMethods.cs:92:10:92:18 | exit ExitInTry | semmle.label | successor |
+| ExitMethods.cs:93:5:103:5 | {...} | ExitMethods.cs:94:9:102:9 | try {...} ... | semmle.label | successor |
+| ExitMethods.cs:94:9:102:9 | try {...} ... | ExitMethods.cs:95:9:97:9 | {...} | semmle.label | successor |
+| ExitMethods.cs:95:9:97:9 | {...} | ExitMethods.cs:96:13:96:19 | ...; | semmle.label | successor |
+| ExitMethods.cs:96:13:96:18 | call to method Exit | ExitMethods.cs:92:10:92:18 | exit ExitInTry (abnormal) | semmle.label | exit |
+| ExitMethods.cs:96:13:96:18 | this access | ExitMethods.cs:96:13:96:18 | call to method Exit | semmle.label | successor |
+| ExitMethods.cs:96:13:96:19 | ...; | ExitMethods.cs:96:13:96:18 | this access | semmle.label | successor |
+| ExitMethods.cs:105:10:105:24 | enter ApplicationExit | ExitMethods.cs:106:5:108:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:105:10:105:24 | exit ApplicationExit (abnormal) | ExitMethods.cs:105:10:105:24 | exit ApplicationExit | semmle.label | successor |
+| ExitMethods.cs:106:5:108:5 | {...} | ExitMethods.cs:107:9:107:48 | ...; | semmle.label | successor |
+| ExitMethods.cs:107:9:107:47 | call to method Exit | ExitMethods.cs:105:10:105:24 | exit ApplicationExit (abnormal) | semmle.label | exit |
+| ExitMethods.cs:107:9:107:48 | ...; | ExitMethods.cs:107:9:107:47 | call to method Exit | semmle.label | successor |
+| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:111:5:113:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr (abnormal) | ExitMethods.cs:110:13:110:21 | exit ThrowExpr | semmle.label | successor |
+| ExitMethods.cs:110:13:110:21 | exit ThrowExpr (normal) | ExitMethods.cs:110:13:110:21 | exit ThrowExpr | semmle.label | successor |
+| ExitMethods.cs:111:5:113:5 | {...} | ExitMethods.cs:112:16:112:20 | access to parameter input | semmle.label | successor |
+| ExitMethods.cs:112:9:112:77 | return ...; | ExitMethods.cs:110:13:110:21 | exit ThrowExpr (normal) | semmle.label | return |
+| ExitMethods.cs:112:16:112:20 | access to parameter input | ExitMethods.cs:112:25:112:25 | 0 | semmle.label | successor |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:29:112:29 | 1 | semmle.label | true |
+| ExitMethods.cs:112:16:112:25 | ... != ... | ExitMethods.cs:112:69:112:75 | "input" | semmle.label | false |
+| ExitMethods.cs:112:16:112:76 | ... ? ... : ... | ExitMethods.cs:112:9:112:77 | return ...; | semmle.label | successor |
+| ExitMethods.cs:112:25:112:25 | 0 | ExitMethods.cs:112:25:112:25 | (...) ... | semmle.label | successor |
+| ExitMethods.cs:112:25:112:25 | (...) ... | ExitMethods.cs:112:16:112:25 | ... != ... | semmle.label | successor |
+| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:112:29:112:29 | (...) ... | semmle.label | successor |
+| ExitMethods.cs:112:29:112:29 | (...) ... | ExitMethods.cs:112:33:112:37 | access to parameter input | semmle.label | successor |
+| ExitMethods.cs:112:29:112:37 | ... / ... | ExitMethods.cs:112:16:112:76 | ... ? ... : ... | semmle.label | successor |
+| ExitMethods.cs:112:33:112:37 | access to parameter input | ExitMethods.cs:112:29:112:37 | ... / ... | semmle.label | successor |
+| ExitMethods.cs:112:41:112:76 | throw ... | ExitMethods.cs:110:13:110:21 | exit ThrowExpr (abnormal) | semmle.label | exception(ArgumentException) |
+| ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException | ExitMethods.cs:112:41:112:76 | throw ... | semmle.label | successor |
+| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:112:47:112:76 | object creation of type ArgumentException | semmle.label | successor |
+| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:116:5:118:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall (normal) | ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall | semmle.label | successor |
+| ExitMethods.cs:116:5:118:5 | {...} | ExitMethods.cs:117:16:117:16 | access to parameter s | semmle.label | successor |
+| ExitMethods.cs:117:9:117:39 | return ...; | ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall (normal) | semmle.label | return |
+| ExitMethods.cs:117:16:117:16 | access to parameter s | ExitMethods.cs:117:27:117:29 | - | semmle.label | successor |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:34:117:34 | 0 | semmle.label | true |
+| ExitMethods.cs:117:16:117:30 | call to method Contains | ExitMethods.cs:117:38:117:38 | 1 | semmle.label | false |
+| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:117:9:117:39 | return ...; | semmle.label | successor |
+| ExitMethods.cs:117:27:117:29 | - | ExitMethods.cs:117:16:117:30 | call to method Contains | semmle.label | successor |
+| ExitMethods.cs:117:34:117:34 | 0 | ExitMethods.cs:117:16:117:38 | ... ? ... : ... | semmle.label | successor |
+| ExitMethods.cs:117:38:117:38 | 1 | ExitMethods.cs:117:16:117:38 | ... ? ... : ... | semmle.label | successor |
+| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:121:5:124:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:120:17:120:32 | exit FailingAssertion (abnormal) | ExitMethods.cs:120:17:120:32 | exit FailingAssertion | semmle.label | successor |
+| ExitMethods.cs:121:5:124:5 | {...} | ExitMethods.cs:122:9:122:29 | ...; | semmle.label | successor |
+| ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | ExitMethods.cs:120:17:120:32 | exit FailingAssertion (abnormal) | semmle.label | exception(AssertFailedException) |
+| ExitMethods.cs:122:9:122:29 | ...; | ExitMethods.cs:122:23:122:27 | false | semmle.label | successor |
+| ExitMethods.cs:122:23:122:27 | false | ExitMethods.cs:122:9:122:28 | [assertion failure] call to method IsTrue | semmle.label | false |
+| ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 | ExitMethods.cs:127:5:130:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 (abnormal) | ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 | semmle.label | successor |
+| ExitMethods.cs:127:5:130:5 | {...} | ExitMethods.cs:128:9:128:27 | ...; | semmle.label | successor |
+| ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 (abnormal) | semmle.label | exception(AssertFailedException) |
+| ExitMethods.cs:128:9:128:26 | this access | ExitMethods.cs:128:9:128:26 | call to method FailingAssertion | semmle.label | successor |
+| ExitMethods.cs:128:9:128:27 | ...; | ExitMethods.cs:128:9:128:26 | this access | semmle.label | successor |
+| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:48:132:48 | access to parameter b | semmle.label | successor |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse (abnormal) | ExitMethods.cs:132:10:132:20 | exit AssertFalse | semmle.label | successor |
+| ExitMethods.cs:132:10:132:20 | exit AssertFalse (normal) | ExitMethods.cs:132:10:132:20 | exit AssertFalse | semmle.label | successor |
+| ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse (abnormal) | semmle.label | exception(AssertFailedException) |
+| ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse (normal) | semmle.label | successor |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:33:132:49 | [assertion failure] call to method IsFalse | semmle.label | true |
+| ExitMethods.cs:132:48:132:48 | access to parameter b | ExitMethods.cs:132:33:132:49 | [assertion success] call to method IsFalse | semmle.label | false |
+| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:135:5:138:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 (abnormal) | ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 | semmle.label | successor |
+| ExitMethods.cs:135:5:138:5 | {...} | ExitMethods.cs:136:9:136:26 | ...; | semmle.label | successor |
+| ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 (abnormal) | semmle.label | exception(AssertFailedException) |
+| ExitMethods.cs:136:9:136:25 | this access | ExitMethods.cs:136:21:136:24 | true | semmle.label | successor |
+| ExitMethods.cs:136:9:136:26 | ...; | ExitMethods.cs:136:9:136:25 | this access | semmle.label | successor |
+| ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | semmle.label | true |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:141:5:147:5 | {...} | semmle.label | successor |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | semmle.label | successor |
+| ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:142:9:145:53 | if (...) ... | semmle.label | successor |
+| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:142:13:142:13 | access to parameter b | semmle.label | successor |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:143:13:143:43 | ...; | semmle.label | true |
+| ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:145:13:145:53 | ...; | semmle.label | false |
+| ExitMethods.cs:143:13:143:42 | call to method Throw | ExitMethods.cs:146:9:146:34 | ...; | semmle.label | successor |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:41:143:41 | access to parameter e | semmle.label | successor |
+| ExitMethods.cs:143:41:143:41 | access to parameter e | ExitMethods.cs:143:13:143:42 | call to method Throw | semmle.label | successor |
+| ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:145:13:145:52 | call to method Throw | semmle.label | successor |
+| ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:146:9:146:34 | ...; | semmle.label | successor |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:43:145:43 | access to parameter e | semmle.label | successor |
+| ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:145:13:145:44 | call to method Capture | semmle.label | successor |
+| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | semmle.label | successor |
+| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:27:146:32 | "dead" | semmle.label | successor |
+| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:146:9:146:33 | call to method WriteLine | semmle.label | successor |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:6:5:8:5 | {...} | semmle.label | successor |
 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) | Extensions.cs:5:23:5:29 | exit ToInt32 | semmle.label | successor |
 | Extensions.cs:6:5:8:5 | {...} | Extensions.cs:7:28:7:28 | access to parameter s | semmle.label | successor |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
index fd138aea838..eb42287f5ed 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Nodes.expected
@@ -1092,27 +1092,28 @@ entryPoint
 | Conditions.cs:113:10:113:11 | M9 | Conditions.cs:114:5:124:5 | {...} |
 | Conditions.cs:129:10:129:12 | M10 | Conditions.cs:130:5:141:5 | {...} |
 | Conditions.cs:143:10:143:12 | M11 | Conditions.cs:144:5:150:5 | {...} |
-| ExitMethods.cs:7:10:7:11 | M1 | ExitMethods.cs:8:5:11:5 | {...} |
-| ExitMethods.cs:13:10:13:11 | M2 | ExitMethods.cs:14:5:17:5 | {...} |
-| ExitMethods.cs:19:10:19:11 | M3 | ExitMethods.cs:20:5:23:5 | {...} |
-| ExitMethods.cs:25:10:25:11 | M4 | ExitMethods.cs:26:5:29:5 | {...} |
-| ExitMethods.cs:31:10:31:11 | M5 | ExitMethods.cs:32:5:35:5 | {...} |
-| ExitMethods.cs:37:10:37:11 | M6 | ExitMethods.cs:38:5:51:5 | {...} |
-| ExitMethods.cs:53:10:53:11 | M7 | ExitMethods.cs:54:5:57:5 | {...} |
-| ExitMethods.cs:59:10:59:11 | M8 | ExitMethods.cs:60:5:63:5 | {...} |
-| ExitMethods.cs:65:17:65:26 | ErrorMaybe | ExitMethods.cs:66:5:69:5 | {...} |
-| ExitMethods.cs:71:17:71:27 | ErrorAlways | ExitMethods.cs:72:5:77:5 | {...} |
-| ExitMethods.cs:79:17:79:28 | ErrorAlways2 | ExitMethods.cs:80:5:82:5 | {...} |
-| ExitMethods.cs:84:17:84:28 | ErrorAlways3 | ExitMethods.cs:84:41:84:55 | object creation of type Exception |
-| ExitMethods.cs:86:10:86:13 | Exit | ExitMethods.cs:87:5:89:5 | {...} |
-| ExitMethods.cs:91:10:91:18 | ExitInTry | ExitMethods.cs:92:5:102:5 | {...} |
-| ExitMethods.cs:104:10:104:24 | ApplicationExit | ExitMethods.cs:105:5:107:5 | {...} |
-| ExitMethods.cs:109:13:109:21 | ThrowExpr | ExitMethods.cs:110:5:112:5 | {...} |
-| ExitMethods.cs:114:16:114:34 | ExtensionMethodCall | ExitMethods.cs:115:5:117:5 | {...} |
-| ExitMethods.cs:119:17:119:32 | FailingAssertion | ExitMethods.cs:120:5:123:5 | {...} |
-| ExitMethods.cs:125:17:125:33 | FailingAssertion2 | ExitMethods.cs:126:5:129:5 | {...} |
-| ExitMethods.cs:131:10:131:20 | AssertFalse | ExitMethods.cs:131:48:131:48 | access to parameter b |
-| ExitMethods.cs:133:17:133:33 | FailingAssertion3 | ExitMethods.cs:134:5:137:5 | {...} |
+| ExitMethods.cs:8:10:8:11 | M1 | ExitMethods.cs:9:5:12:5 | {...} |
+| ExitMethods.cs:14:10:14:11 | M2 | ExitMethods.cs:15:5:18:5 | {...} |
+| ExitMethods.cs:20:10:20:11 | M3 | ExitMethods.cs:21:5:24:5 | {...} |
+| ExitMethods.cs:26:10:26:11 | M4 | ExitMethods.cs:27:5:30:5 | {...} |
+| ExitMethods.cs:32:10:32:11 | M5 | ExitMethods.cs:33:5:36:5 | {...} |
+| ExitMethods.cs:38:10:38:11 | M6 | ExitMethods.cs:39:5:52:5 | {...} |
+| ExitMethods.cs:54:10:54:11 | M7 | ExitMethods.cs:55:5:58:5 | {...} |
+| ExitMethods.cs:60:10:60:11 | M8 | ExitMethods.cs:61:5:64:5 | {...} |
+| ExitMethods.cs:66:17:66:26 | ErrorMaybe | ExitMethods.cs:67:5:70:5 | {...} |
+| ExitMethods.cs:72:17:72:27 | ErrorAlways | ExitMethods.cs:73:5:78:5 | {...} |
+| ExitMethods.cs:80:17:80:28 | ErrorAlways2 | ExitMethods.cs:81:5:83:5 | {...} |
+| ExitMethods.cs:85:17:85:28 | ErrorAlways3 | ExitMethods.cs:85:41:85:55 | object creation of type Exception |
+| ExitMethods.cs:87:10:87:13 | Exit | ExitMethods.cs:88:5:90:5 | {...} |
+| ExitMethods.cs:92:10:92:18 | ExitInTry | ExitMethods.cs:93:5:103:5 | {...} |
+| ExitMethods.cs:105:10:105:24 | ApplicationExit | ExitMethods.cs:106:5:108:5 | {...} |
+| ExitMethods.cs:110:13:110:21 | ThrowExpr | ExitMethods.cs:111:5:113:5 | {...} |
+| ExitMethods.cs:115:16:115:34 | ExtensionMethodCall | ExitMethods.cs:116:5:118:5 | {...} |
+| ExitMethods.cs:120:17:120:32 | FailingAssertion | ExitMethods.cs:121:5:124:5 | {...} |
+| ExitMethods.cs:126:17:126:33 | FailingAssertion2 | ExitMethods.cs:127:5:130:5 | {...} |
+| ExitMethods.cs:132:10:132:20 | AssertFalse | ExitMethods.cs:132:48:132:48 | access to parameter b |
+| ExitMethods.cs:134:17:134:33 | FailingAssertion3 | ExitMethods.cs:135:5:138:5 | {...} |
+| ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow | ExitMethods.cs:141:5:147:5 | {...} |
 | Extensions.cs:5:23:5:29 | ToInt32 | Extensions.cs:6:5:8:5 | {...} |
 | Extensions.cs:10:24:10:29 | ToBool | Extensions.cs:11:5:13:5 | {...} |
 | Extensions.cs:15:23:15:33 | CallToInt32 | Extensions.cs:15:48:15:50 | "0" |

From cd8155c20154255494b7a74985bdfcb71ad07fce Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 26 Jan 2021 08:59:03 +0100
Subject: [PATCH 310/343] C#: Teach CFG about `ExceptionDispatchInfo::Throw`

---
 .../controlflow/internal/NonReturning.qll     | 12 +++++++++++
 .../controlflow/graph/BasicBlock.expected     |  2 +-
 .../controlflow/graph/Dominance.expected      | 21 +++++--------------
 .../graph/EnclosingCallable.expected          |  7 ++-----
 .../controlflow/graph/ExitElement.expected    | 14 +++++++------
 .../controlflow/graph/NodeGraph.expected      |  9 +++-----
 6 files changed, 31 insertions(+), 34 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/NonReturning.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/NonReturning.qll
index a3f80938ad8..6d075d031f5 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/NonReturning.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/NonReturning.qll
@@ -45,6 +45,18 @@ private class ThrowingCall extends NonReturningCall {
         c.getExceptionClass().matchesHandle(ex) and
         not m.isVirtual()
       )
+      or
+      this =
+        any(MethodCall mc |
+          mc.getTarget()
+              .hasQualifiedName("System.Runtime.ExceptionServices.ExceptionDispatchInfo", "Throw") and
+          (
+            mc.hasNoArguments() and
+            c.getExceptionClass() instanceof SystemExceptionClass
+            or
+            c.getExceptionClass() = mc.getArgument(0).getType()
+          )
+        )
     )
   }
 
diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
index 00316b3c41d..3db57be80ab 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
@@ -415,9 +415,9 @@
 | ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:136:21:136:24 | true | 5 |
 | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 | 3 |
 | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:142:13:142:13 | access to parameter b | 4 |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | 2 |
 | ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:42 | call to method Throw | 3 |
 | ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:52 | call to method Throw | 4 |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | 5 |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | exit ToInt32 | 7 |
 | Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | exit ToBool | 8 |
 | Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | exit CallToInt32 | 5 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
index c7c78455c64..acb32204be7 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/Dominance.expected
@@ -1645,7 +1645,7 @@ dominance
 | ExitMethods.cs:136:9:136:26 | ...; | ExitMethods.cs:136:9:136:25 | this access |
 | ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse |
 | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:141:5:147:5 | {...} |
-| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow |
 | ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:142:9:145:53 | if (...) ... |
 | ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:142:13:142:13 | access to parameter b |
 | ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:143:13:143:43 | ...; |
@@ -1655,9 +1655,6 @@ dominance
 | ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:145:13:145:52 | call to method Throw |
 | ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:43:145:43 | access to parameter e |
 | ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:145:13:145:44 | call to method Capture |
-| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:27:146:32 | "dead" |
-| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:146:9:146:33 | call to method WriteLine |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:6:5:8:5 | {...} |
 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) | Extensions.cs:5:23:5:29 | exit ToInt32 |
 | Extensions.cs:6:5:8:5 | {...} | Extensions.cs:7:28:7:28 | access to parameter s |
@@ -5737,8 +5734,7 @@ postDominance
 | ExitMethods.cs:136:9:136:25 | this access | ExitMethods.cs:136:9:136:26 | ...; |
 | ExitMethods.cs:136:9:136:26 | ...; | ExitMethods.cs:135:5:138:5 | {...} |
 | ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:136:9:136:25 | this access |
-| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) |
-| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | ExitMethods.cs:146:9:146:33 | call to method WriteLine |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) |
 | ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow |
 | ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:141:5:147:5 | {...} |
 | ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:142:9:145:53 | if (...) ... |
@@ -5747,10 +5743,6 @@ postDominance
 | ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:145:43:145:43 | access to parameter e |
 | ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:145:13:145:44 | call to method Capture |
 | ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:145:13:145:53 | ...; |
-| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:146:27:146:32 | "dead" |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:143:13:143:42 | call to method Throw |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:145:13:145:52 | call to method Throw |
-| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:146:9:146:34 | ...; |
 | Extensions.cs:5:23:5:29 | exit ToInt32 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) |
 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) | Extensions.cs:7:9:7:30 | return ...; |
 | Extensions.cs:6:5:8:5 | {...} | Extensions.cs:5:23:5:29 | enter ToInt32 |
@@ -9990,12 +9982,12 @@ blockDominance
 | ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse |
 | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse |
 | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow |
+| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) |
 | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:143:13:143:43 | ...; |
 | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:145:13:145:53 | ...; |
-| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:146:9:146:34 | ...; |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) |
 | ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:43 | ...; |
 | ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:53 | ...; |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:9:146:34 | ...; |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | enter ToInt32 |
 | Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | enter ToBool |
 | Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | enter CallToInt32 |
@@ -13910,12 +13902,9 @@ postBlockDominance
 | ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 |
 | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse |
 | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) |
 | ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:43 | ...; |
 | ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:53 | ...; |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:143:13:143:43 | ...; |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:145:13:145:53 | ...; |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:9:146:34 | ...; |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | enter ToInt32 |
 | Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | enter ToBool |
 | Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | enter CallToInt32 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
index 8050b8ced38..37447be7a6b 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/EnclosingCallable.expected
@@ -1781,7 +1781,7 @@ nodeEnclosing
 | ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
 | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
-| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
@@ -1792,9 +1792,6 @@ nodeEnclosing
 | ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
-| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
-| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | ToInt32 |
 | Extensions.cs:5:23:5:29 | exit ToInt32 | Extensions.cs:5:23:5:29 | ToInt32 |
 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) | Extensions.cs:5:23:5:29 | ToInt32 |
@@ -5130,9 +5127,9 @@ blockEnclosing
 | ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
 | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | ExitMethods.cs:134:17:134:33 | FailingAssertion3 |
 | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:140:17:140:42 | ExceptionDispatchInfoThrow |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | ToInt32 |
 | Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | ToBool |
 | Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | CallToInt32 |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
index 6e19712c22b..8cd996801d7 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/ExitElement.expected
@@ -1599,17 +1599,19 @@
 | ExitMethods.cs:137:9:137:18 | ... ...; | ExitMethods.cs:137:13:137:17 | Int32 x = ... | normal |
 | ExitMethods.cs:137:13:137:17 | Int32 x = ... | ExitMethods.cs:137:13:137:17 | Int32 x = ... | normal |
 | ExitMethods.cs:137:17:137:17 | 0 | ExitMethods.cs:137:17:137:17 | 0 | normal |
+| ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:143:13:143:42 | call to method Throw | throw(ArgumentException) |
+| ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:145:13:145:52 | call to method Throw | throw(Exception) |
 | ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:146:9:146:33 | call to method WriteLine | normal |
-| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:143:13:143:42 | call to method Throw | normal |
-| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:145:13:145:52 | call to method Throw | normal |
+| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:143:13:143:42 | call to method Throw | throw(ArgumentException) |
+| ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:145:13:145:52 | call to method Throw | throw(Exception) |
 | ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:142:13:142:13 | access to parameter b | false |
 | ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:142:13:142:13 | access to parameter b | true |
-| ExitMethods.cs:143:13:143:42 | call to method Throw | ExitMethods.cs:143:13:143:42 | call to method Throw | normal |
-| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:42 | call to method Throw | normal |
+| ExitMethods.cs:143:13:143:42 | call to method Throw | ExitMethods.cs:143:13:143:42 | call to method Throw | throw(ArgumentException) |
+| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:42 | call to method Throw | throw(ArgumentException) |
 | ExitMethods.cs:143:41:143:41 | access to parameter e | ExitMethods.cs:143:41:143:41 | access to parameter e | normal |
 | ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:145:13:145:44 | call to method Capture | normal |
-| ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:145:13:145:52 | call to method Throw | normal |
-| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:52 | call to method Throw | normal |
+| ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:145:13:145:52 | call to method Throw | throw(Exception) |
+| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:52 | call to method Throw | throw(Exception) |
 | ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:145:43:145:43 | access to parameter e | normal |
 | ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:146:9:146:33 | call to method WriteLine | normal |
 | ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:9:146:33 | call to method WriteLine | normal |
diff --git a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
index 15149f7a20e..bc95c468f4c 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected
@@ -1814,21 +1814,18 @@
 | ExitMethods.cs:136:9:136:26 | ...; | ExitMethods.cs:136:9:136:25 | this access | semmle.label | successor |
 | ExitMethods.cs:136:21:136:24 | true | ExitMethods.cs:136:9:136:25 | [assertion failure] call to method AssertFalse | semmle.label | true |
 | ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:141:5:147:5 | {...} | semmle.label | successor |
-| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | semmle.label | successor |
+| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | semmle.label | successor |
 | ExitMethods.cs:141:5:147:5 | {...} | ExitMethods.cs:142:9:145:53 | if (...) ... | semmle.label | successor |
 | ExitMethods.cs:142:9:145:53 | if (...) ... | ExitMethods.cs:142:13:142:13 | access to parameter b | semmle.label | successor |
 | ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:143:13:143:43 | ...; | semmle.label | true |
 | ExitMethods.cs:142:13:142:13 | access to parameter b | ExitMethods.cs:145:13:145:53 | ...; | semmle.label | false |
-| ExitMethods.cs:143:13:143:42 | call to method Throw | ExitMethods.cs:146:9:146:34 | ...; | semmle.label | successor |
+| ExitMethods.cs:143:13:143:42 | call to method Throw | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | semmle.label | exception(ArgumentException) |
 | ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:41:143:41 | access to parameter e | semmle.label | successor |
 | ExitMethods.cs:143:41:143:41 | access to parameter e | ExitMethods.cs:143:13:143:42 | call to method Throw | semmle.label | successor |
 | ExitMethods.cs:145:13:145:44 | call to method Capture | ExitMethods.cs:145:13:145:52 | call to method Throw | semmle.label | successor |
-| ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:146:9:146:34 | ...; | semmle.label | successor |
+| ExitMethods.cs:145:13:145:52 | call to method Throw | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | semmle.label | exception(Exception) |
 | ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:43:145:43 | access to parameter e | semmle.label | successor |
 | ExitMethods.cs:145:43:145:43 | access to parameter e | ExitMethods.cs:145:13:145:44 | call to method Capture | semmle.label | successor |
-| ExitMethods.cs:146:9:146:33 | call to method WriteLine | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (normal) | semmle.label | successor |
-| ExitMethods.cs:146:9:146:34 | ...; | ExitMethods.cs:146:27:146:32 | "dead" | semmle.label | successor |
-| ExitMethods.cs:146:27:146:32 | "dead" | ExitMethods.cs:146:9:146:33 | call to method WriteLine | semmle.label | successor |
 | Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:6:5:8:5 | {...} | semmle.label | successor |
 | Extensions.cs:5:23:5:29 | exit ToInt32 (normal) | Extensions.cs:5:23:5:29 | exit ToInt32 | semmle.label | successor |
 | Extensions.cs:6:5:8:5 | {...} | Extensions.cs:7:28:7:28 | access to parameter s | semmle.label | successor |

From dacc21d0b52e9337e4522e278226b411cab61035 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 26 Jan 2021 09:45:41 +0100
Subject: [PATCH 311/343] Python: update test expectation

---
 python/ql/test/experimental/dataflow/coverage/localFlow.expected | 1 -
 1 file changed, 1 deletion(-)

diff --git a/python/ql/test/experimental/dataflow/coverage/localFlow.expected b/python/ql/test/experimental/dataflow/coverage/localFlow.expected
index 30b25979df3..f604e3d7b18 100644
--- a/python/ql/test/experimental/dataflow/coverage/localFlow.expected
+++ b/python/ql/test/experimental/dataflow/coverage/localFlow.expected
@@ -8,7 +8,6 @@
 | test.py:187:1:187:53 | GSSA Variable SINK | test.py:189:5:189:8 | ControlFlowNode for SINK |
 | test.py:187:1:187:53 | GSSA Variable SOURCE | test.py:188:25:188:30 | ControlFlowNode for SOURCE |
 | test.py:188:5:188:5 | SSA variable x | test.py:189:10:189:10 | ControlFlowNode for x |
-| test.py:188:9:188:68 | ControlFlowNode for .0 | test.py:188:9:188:68 | SSA variable .0 |
 | test.py:188:9:188:68 | ControlFlowNode for ListComp | test.py:188:5:188:5 | SSA variable x |
 | test.py:188:9:188:68 | SSA variable .0 | test.py:188:9:188:68 | ControlFlowNode for .0 |
 | test.py:188:16:188:16 | SSA variable v | test.py:188:45:188:45 | ControlFlowNode for v |

From 7b9ca7171a82b39a58be2a00269297cf61787f14 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 26 Jan 2021 09:47:48 +0100
Subject: [PATCH 312/343] Python: update test expectations

---
 python/ql/test/experimental/dataflow/coverage/localFlow.expected | 1 +
 1 file changed, 1 insertion(+)

diff --git a/python/ql/test/experimental/dataflow/coverage/localFlow.expected b/python/ql/test/experimental/dataflow/coverage/localFlow.expected
index f604e3d7b18..30b25979df3 100644
--- a/python/ql/test/experimental/dataflow/coverage/localFlow.expected
+++ b/python/ql/test/experimental/dataflow/coverage/localFlow.expected
@@ -8,6 +8,7 @@
 | test.py:187:1:187:53 | GSSA Variable SINK | test.py:189:5:189:8 | ControlFlowNode for SINK |
 | test.py:187:1:187:53 | GSSA Variable SOURCE | test.py:188:25:188:30 | ControlFlowNode for SOURCE |
 | test.py:188:5:188:5 | SSA variable x | test.py:189:10:189:10 | ControlFlowNode for x |
+| test.py:188:9:188:68 | ControlFlowNode for .0 | test.py:188:9:188:68 | SSA variable .0 |
 | test.py:188:9:188:68 | ControlFlowNode for ListComp | test.py:188:5:188:5 | SSA variable x |
 | test.py:188:9:188:68 | SSA variable .0 | test.py:188:9:188:68 | ControlFlowNode for .0 |
 | test.py:188:16:188:16 | SSA variable v | test.py:188:45:188:45 | ControlFlowNode for v |

From 71d25c1f8b0b41bae6fcb0581751645690e23d81 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 26 Jan 2021 09:58:01 +0100
Subject: [PATCH 313/343] C#: Fix join-orders in `ControlFlowTree::last()`

---
 .../internal/ControlFlowGraphImpl.qll         | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
index ebe4654d70c..fe898cb509b 100644
--- a/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
@@ -804,6 +804,12 @@ module Expressions {
   private class SwitchCaseExprTree extends PostOrderTree, CaseTree, SwitchCaseExpr {
     final override predicate first(ControlFlowElement first) { first(this.getPattern(), first) }
 
+    pragma[noinline]
+    private predicate lastNoMatch(ControlFlowElement last, ConditionalCompletion cc) {
+      last([this.getPattern(), this.getCondition()], last, cc) and
+      (cc.(MatchingCompletion).isNonMatch() or cc instanceof FalseCompletion)
+    }
+
     final override predicate last(ControlFlowElement last, Completion c) {
       PostOrderTree.super.last(last, c)
       or
@@ -812,8 +818,7 @@ module Expressions {
         this = se.getCase(i) and
         not this.matchesAll() and
         not exists(se.getCase(i + 1)) and
-        last([this.getPattern(), this.getCondition()], last, cc) and
-        (cc.(MatchingCompletion).isNonMatch() or cc instanceof FalseCompletion) and
+        this.lastNoMatch(last, cc) and
         c =
           any(NestedCompletion nc |
             nc.getNestLevel() = 0 and
@@ -1372,11 +1377,16 @@ module Statements {
       or
       // If the `finally` block completes normally, it inherits any non-normal
       // completion that was current before the `finally` block was entered
-      c =
-        any(NestedCompletion nc |
-          this.lastFinally(last, nc.getAnInnerCompatibleCompletion(), nc.getOuterCompletion(),
-            nc.getNestLevel())
-        )
+      exists(int nestLevel |
+        c =
+          any(NestedCompletion nc |
+            this.lastFinally(last, nc.getAnInnerCompatibleCompletion(), nc.getOuterCompletion(),
+              nestLevel) and
+            // unbind
+            nc.getNestLevel() >= nestLevel and
+            nc.getNestLevel() <= nestLevel
+          )
+      )
     }
 
     /**

From 89225e222ce9e374be9232498c55f1e9ca0dabdc Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Tue, 26 Jan 2021 09:25:12 +0000
Subject: [PATCH 314/343] JS: Remove confusing comment

---
 javascript/ql/src/semmle/javascript/frameworks/Angular2.qll | 1 -
 1 file changed, 1 deletion(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 976a2e7a472..1905bf1795b 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -516,7 +516,6 @@ module Angular2 {
         i = 1 and name = "date" // date format string
       )
       or
-      // Arguments to translate are assumed to be included in the result somewhere
       name = "translate" and
       succ = this and
       pred = [getArgument(1), getOptionArgument(1, _)]

From d59ccb7687cb74d634f3ce884da287f02cffcdbe Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Tue, 26 Jan 2021 09:27:48 +0000
Subject: [PATCH 315/343] JS: Remove unhelpful mat-table load step

---
 .../ql/src/semmle/javascript/frameworks/Angular2.qll  | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
index 1905bf1795b..1aaf5a7af77 100644
--- a/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
+++ b/javascript/ql/src/semmle/javascript/frameworks/Angular2.qll
@@ -578,17 +578,6 @@ module Angular2 {
     }
   }
 
-  /** Like `MatTableTaintStep` but as a value-preserving load step. */
-  private class MatTableLoadStep extends PreCallGraphStep {
-    override predicate loadStep(DataFlow::Node pred, DataFlow::Node succ, string prop) {
-      exists(MatTableElement table |
-        pred = table.getDataSourceNode() and
-        succ = table.getARowRef() and
-        prop = DataFlow::PseudoProperties::arrayElement()
-      )
-    }
-  }
-
   /** A taint step into the data array of a `MatTableDataSource` instance. */
   private class MatTableDataSourceStep extends TaintTracking::AdditionalTaintStep, DataFlow::NewNode {
     MatTableDataSourceStep() {

From e6d9cd19059accd0baf3e1f64f2cf84b6b21ece1 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Tue, 26 Jan 2021 10:14:12 +0000
Subject: [PATCH 316/343] JS: Add clause to getReturn/getInstance

---
 javascript/ql/src/semmle/javascript/ApiGraphs.qll | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/javascript/ql/src/semmle/javascript/ApiGraphs.qll b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
index 6c9faff38e8..e33e8e2fe5e 100644
--- a/javascript/ql/src/semmle/javascript/ApiGraphs.qll
+++ b/javascript/ql/src/semmle/javascript/ApiGraphs.qll
@@ -840,10 +840,16 @@ module API {
     Node getLastParameter() { result = getParameter(getNumArgument() - 1) }
 
     /** Gets the API node for the return value of this call. */
-    Node getReturn() { result.getAnImmediateUse() = this }
+    Node getReturn() {
+      result = callee.getReturn() and
+      result.getAnImmediateUse() = this
+    }
 
     /** Gets the API node for the object constructed by this invocation. */
-    Node getInstance() { result.getAnImmediateUse() = this }
+    Node getInstance() {
+      result = callee.getInstance() and
+      result.getAnImmediateUse() = this
+    }
   }
 
   /** A call connected to the API graph. */

From 2c58643fd1786d2af8a145acb4b57ac24b8e3304 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 26 Jan 2021 11:28:31 +0100
Subject: [PATCH 317/343] Python: Test for parameters without nodes.

---
 .../dataflow/consistency/modeling-consistency.expected     | 1 +
 .../dataflow/consistency/modeling-consistency.ql           | 7 +++++++
 2 files changed, 8 insertions(+)
 create mode 100644 python/ql/test/experimental/dataflow/consistency/modeling-consistency.expected
 create mode 100644 python/ql/test/experimental/dataflow/consistency/modeling-consistency.ql

diff --git a/python/ql/test/experimental/dataflow/consistency/modeling-consistency.expected b/python/ql/test/experimental/dataflow/consistency/modeling-consistency.expected
new file mode 100644
index 00000000000..2cbecf5ba66
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/consistency/modeling-consistency.expected
@@ -0,0 +1 @@
+| test.py:239:27:239:27 | Parameter | There is no `ParameterNode` associated with this parameter. |
diff --git a/python/ql/test/experimental/dataflow/consistency/modeling-consistency.ql b/python/ql/test/experimental/dataflow/consistency/modeling-consistency.ql
new file mode 100644
index 00000000000..a0dde59bedb
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/consistency/modeling-consistency.ql
@@ -0,0 +1,7 @@
+import python
+import semmle.python.dataflow.new.DataFlow
+
+query predicate parameterWithoutNode(Parameter p, string msg) {
+  not exists(DataFlow::ParameterNode node | p = node.getParameter()) and
+  msg = "There is no `ParameterNode` associated with this parameter."
+}

From e44f1813fab7c1d196f7504c33b5d59f5837cd07 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 26 Jan 2021 11:29:14 +0100
Subject: [PATCH 318/343] Python: Add TODO comment

---
 .../src/semmle/python/dataflow/new/internal/DataFlowPublic.qll   | 1 +
 1 file changed, 1 insertion(+)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
index d28eb856e19..4a3c7722c3e 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -182,6 +182,7 @@ class ParameterNode extends CfgNode {
   ParameterNode() {
     node = def.getDefiningNode() and
     // Disregard parameters that we cannot resolve
+    // TODO: Make this unnecessary
     exists(DataFlowCallable c | node = c.getParameter(_))
   }
 

From e25385599911450e920f2097d34a34d77be72e18 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen <yoff@github.com>
Date: Tue, 26 Jan 2021 12:11:21 +0100
Subject: [PATCH 319/343] Python: Add comment about reverse reads.

---
 .../python/dataflow/new/internal/DataFlowPrivate.qll | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
index 3dd31f4b97a..16e42e4d871 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
@@ -69,7 +69,17 @@ class StorePreUpdateNode extends NeedsSyntheticPostUpdateNode, CfgNode {
   override string label() { result = "store" }
 }
 
-/** A node marking the state change of an object after a read. */
+/**
+ * A node marking the state change of an object after a read.
+ *
+ * A reverse read happens when the result of a read is modified, e.g. in
+ * ```python
+ * l = [ mutable ]
+ * l[0].mutate()
+ * ```
+ * we may now have changed the content of `l`. To track this, there must be
+ * a postupdate node for `l`.
+ */
 class ReadPreUpdateNode extends NeedsSyntheticPostUpdateNode, CfgNode {
   ReadPreUpdateNode() {
     exists(Attribute a |

From 932ee968e0dd30472c5cafb109daafe543303120 Mon Sep 17 00:00:00 2001
From: Remco Vermeulen <rvermeulen@users.noreply.github.com>
Date: Tue, 26 Jan 2021 13:08:28 +0100
Subject: [PATCH 320/343] Correct pointer to data member example

The class `PointerToMemberType` is preceded by an example that doesn't define the variable `c` used to access a data member.
---
 cpp/ql/src/semmle/code/cpp/Type.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Type.qll b/cpp/ql/src/semmle/code/cpp/Type.qll
index 81b28cca4c9..1426f41ded5 100644
--- a/cpp/ql/src/semmle/code/cpp/Type.qll
+++ b/cpp/ql/src/semmle/code/cpp/Type.qll
@@ -1546,7 +1546,7 @@ class FunctionPointerIshType extends DerivedType {
  * ```
  * class C { int m; };
  * int C::* p = &C::m;          // pointer to data member m of class C
- * class C *;
+ * class C c;
  * int val = c.*p;              // access data member
  * ```
  */

From 8c09032d1dcc45a3c0693ee82e4ff124925c79d8 Mon Sep 17 00:00:00 2001
From: Remco Vermeulen <rvermeulen@users.noreply.github.com>
Date: Tue, 26 Jan 2021 13:23:43 +0100
Subject: [PATCH 321/343] Correct access specifier

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 cpp/ql/src/semmle/code/cpp/Type.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Type.qll b/cpp/ql/src/semmle/code/cpp/Type.qll
index 1426f41ded5..f19bd6c7746 100644
--- a/cpp/ql/src/semmle/code/cpp/Type.qll
+++ b/cpp/ql/src/semmle/code/cpp/Type.qll
@@ -1544,7 +1544,7 @@ class FunctionPointerIshType extends DerivedType {
 /**
  * A C++ pointer to data member. See 15.5.
  * ```
- * class C { int m; };
+ * class C { public: int m; };
  * int C::* p = &C::m;          // pointer to data member m of class C
  * class C c;
  * int val = c.*p;              // access data member

From 1834403148a7fb23fe5cd8386f950cdcfb190d57 Mon Sep 17 00:00:00 2001
From: Remco Vermeulen <rvermeulen@users.noreply.github.com>
Date: Tue, 26 Jan 2021 14:14:42 +0100
Subject: [PATCH 322/343] Replace HTTP entity

The code formatting operator correctly translate to HTTP entities.
---
 cpp/ql/src/semmle/code/cpp/Type.qll | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Type.qll b/cpp/ql/src/semmle/code/cpp/Type.qll
index f19bd6c7746..a0d8c42df32 100644
--- a/cpp/ql/src/semmle/code/cpp/Type.qll
+++ b/cpp/ql/src/semmle/code/cpp/Type.qll
@@ -274,7 +274,7 @@ class Type extends Locatable, @type {
 
   /**
    * Gets this type with any typedefs resolved. For example, given
-   * `typedef C T`, this would resolve `const T&amp;` to `const C&amp;`.
+   * `typedef C T`, this would resolve `const T&` to `const C&`.
    * Note that this will only work if the resolved type actually appears
    * on its own elsewhere in the program.
    */

From c69a051292173effecc510d5f5b8dcc2d5943948 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Tue, 26 Jan 2021 15:16:27 +0000
Subject: [PATCH 323/343] JS: Add test that depends on getAQlClass

---
 javascript/ql/test/library-tests/DataFlow/tests.expected | 2 ++
 javascript/ql/test/library-tests/DataFlow/tests.ql       | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/javascript/ql/test/library-tests/DataFlow/tests.expected b/javascript/ql/test/library-tests/DataFlow/tests.expected
index b65daf255c0..7655a1fb761 100644
--- a/javascript/ql/test/library-tests/DataFlow/tests.expected
+++ b/javascript/ql/test/library-tests/DataFlow/tests.expected
@@ -1573,3 +1573,5 @@ sources
 | tst.js:117:10:117:20 | Object.seal |
 | tst.js:117:10:117:24 | Object.seal(x1) |
 | tst.js:117:22:117:23 | x1 |
+stress_getAQlClass
+| OK |
diff --git a/javascript/ql/test/library-tests/DataFlow/tests.ql b/javascript/ql/test/library-tests/DataFlow/tests.ql
index 459fdcb1503..f943806d46c 100644
--- a/javascript/ql/test/library-tests/DataFlow/tests.ql
+++ b/javascript/ql/test/library-tests/DataFlow/tests.ql
@@ -28,3 +28,10 @@ query predicate noBasicBlock(DataFlow::Node node) { not exists(node.getBasicBloc
 query predicate parameters(DataFlow::ParameterNode param) { any() }
 
 query predicate sources(DataFlow::SourceNode src) { any() }
+
+query predicate stress_getAQlClass(string msg) {
+  // Compile and evaluate `getAQlClass` so we get notified of potential problems with BDD size.
+  // Avoid outputting its result, however, as the output would constantly need to be updated.
+  count(DataFlow::Node node, string cls | cls = node.getAQlClass()) >= 42 and
+  msg = "OK"
+}

From 416aa49d99c55bf141509d9ff275a10f70dffb87 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Tue, 26 Jan 2021 17:24:03 +0100
Subject: [PATCH 324/343] C++: Capitalize alert message.

---
 .../CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql       | 2 +-
 .../tests/CompilerRemovalOfCodeToClearBuffers.expected      | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
index 435d2f8f96a..db09de9430d 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -124,4 +124,4 @@ where
   not fc.isVariableUseBoundWithArgumentFunction() and
   not fc.isVariableUseBoundWithGlobalVariable() and
   not fc.isExistsCompilationFlagsBlockingRemoval()
-select fc.getArgument(0), "this variable will not be cleared"
+select fc.getArgument(0), "This variable will not be cleared."
diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.expected
index fbb5a3f1552..8d98d94ff46 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-14/semmle/tests/CompilerRemovalOfCodeToClearBuffers.expected
@@ -1,3 +1,3 @@
-| test.c:13:9:13:13 | buff1 | this variable will not be cleared |
-| test.c:35:9:35:13 | buff1 | this variable will not be cleared |
-| test.c:43:9:43:13 | buff1 | this variable will not be cleared |
+| test.c:13:9:13:13 | buff1 | This variable will not be cleared. |
+| test.c:35:9:35:13 | buff1 | This variable will not be cleared. |
+| test.c:43:9:43:13 | buff1 | This variable will not be cleared. |

From 54f00de3e0e980e8e9fca11290ad2d67e422ccae Mon Sep 17 00:00:00 2001
From: Henning Makholm <hmakholm@github.com>
Date: Tue, 26 Jan 2021 18:15:22 +0100
Subject: [PATCH 325/343] Add "tests" fields to test qlpacks

This will allow `codeql resolve tests --ignore-dubious-cases`
(and thus the VSCode extension) to recognize all `.ql` files in those
packs as test cases, even if they don't have accompanying `.expected`
files.

CLI versions prior to 2.1.0 will choke on this, but it's almost 10
months since that came out.
---
 cpp/ql/test/qlpack.yml        | 1 +
 csharp/ql/test/qlpack.yml     | 1 +
 java/ql/test/qlpack.yml       | 1 +
 javascript/ql/test/qlpack.yml | 1 +
 python/ql/test/qlpack.yml     | 1 +
 5 files changed, 5 insertions(+)

diff --git a/cpp/ql/test/qlpack.yml b/cpp/ql/test/qlpack.yml
index 008af57baef..89f684e9e3e 100644
--- a/cpp/ql/test/qlpack.yml
+++ b/cpp/ql/test/qlpack.yml
@@ -2,3 +2,4 @@ name: codeql-cpp-tests
 version: 0.0.0
 libraryPathDependencies: codeql-cpp
 extractor: cpp
+tests: .
diff --git a/csharp/ql/test/qlpack.yml b/csharp/ql/test/qlpack.yml
index 2b8cce91f07..9882ae18d14 100644
--- a/csharp/ql/test/qlpack.yml
+++ b/csharp/ql/test/qlpack.yml
@@ -2,3 +2,4 @@ name: codeql-csharp-tests
 version: 0.0.0
 libraryPathDependencies: codeql-csharp
 extractor: csharp
+tests: .
diff --git a/java/ql/test/qlpack.yml b/java/ql/test/qlpack.yml
index 75a27d69080..1db4e776c00 100644
--- a/java/ql/test/qlpack.yml
+++ b/java/ql/test/qlpack.yml
@@ -2,3 +2,4 @@ name: codeql-java-tests
 version: 0.0.0
 libraryPathDependencies: codeql-java
 extractor: java
+tests: .
diff --git a/javascript/ql/test/qlpack.yml b/javascript/ql/test/qlpack.yml
index 76f050e0b81..b60f895f131 100644
--- a/javascript/ql/test/qlpack.yml
+++ b/javascript/ql/test/qlpack.yml
@@ -2,3 +2,4 @@ name: codeql-javascript-tests
 version: 0.0.0
 libraryPathDependencies: codeql-javascript
 extractor: javascript
+tests: .
diff --git a/python/ql/test/qlpack.yml b/python/ql/test/qlpack.yml
index afae7523793..aca2524d023 100644
--- a/python/ql/test/qlpack.yml
+++ b/python/ql/test/qlpack.yml
@@ -2,3 +2,4 @@ name: codeql-python-tests
 version: 0.0.0
 libraryPathDependencies: codeql-python
 extractor: python
+tests: .

From f074564dc1583be01fc8b5d48963240cfd197223 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Wed, 27 Jan 2021 00:00:18 +0300
Subject: [PATCH 326/343] Apply suggestions from code review

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
---
 .../AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c   | 4 ++--
 ...ccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp | 7 +++----
 .../AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql  | 4 +---
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c
index 9b08034dec5..060a22b5c18 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c
@@ -1,4 +1,4 @@
  
-strncat(dest, src, sizeof(dest) - strlen(dest)); //bad:
+strncat(dest, source, sizeof(dest) - strlen(dest)); // BAD: writes a zero byte past the `dest` buffer.
 
-strncat(dest, src, sizeof(dest) - strlen(dest) -1); //good:
+strncat(dest, source, sizeof(dest) - strlen(dest) -1); // GOOD: Reserves space for the zero byte.
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp
index 182279f6b6b..5c2154097ec 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.qhelp
@@ -3,18 +3,17 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
-<p>The standard library function <code> strncat </code> appends the source string to the target string. The third argument specifies the maximum number of characters to add and must be less than the remaining space in the target buffer. Calls of the form <code> strncat (dest, src, sizeof (dest) - strlen (dest)) </code> set the third argument to one more than possible. So when the buffer is full, the expression <code> sizeof (dest) - strlen (dest) </code> will be equal to one, and not zero as the programmer might think. Making a call of this type may result in a zero byte being written just outside the buffer.</p>
+<p>The standard library function <code>strncat(dest, source, count)</code> appends the <code>source</code> string to the <code>dest</code> string. <code>count</code> specifies the maximum number of characters to append and must be less than the remaining space in the target buffer. Calls of the form <code> strncat (dest, source, sizeof (dest) - strlen (dest)) </code> set the third argument to one more than possible. So when the <code>dest</code> is full, the expression <code> sizeof (dest) - strlen (dest) </code> will be equal to one, and not zero as the programmer might think. Making a call of this type may result in a zero byte being written just outside the <code>dest</code> buffer.</p>
 
-<p>Loss of detection includes cases of use of situations when memory allocation for a buffer occurs with a strong nesting or outside the limits of the function. It is also worth paying attention to the exclusion from the detection of situations when the second argument of the function is a constant string, since this situation creates a large number of false detection.</p>
 
 </overview>
 <recommendation>
 
-<p>We recommend using an extra byte call. for example <code> strncat(dest, src, sizeof(dest)-strlen(dest)-1) </code>.</p>
+<p>We recommend subtracting one from the third argument. For example, replace <code>strncat(dest, source, sizeof(dest)-strlen(dest))</code> with <code>strncat(dest, source, sizeof(dest)-strlen(dest)-1)</code>.</p>
 
 </recommendation>
 <example>
-<p>The following example demonstrates an erroneous and corrected use of the strncat function.</p>
+<p>The following example demonstrates an erroneous and corrected use of the <code>strncat</code> function.</p>
 <sample src="AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.c" />
 
 </example>
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
index fd82fc86fc3..4bc3d0e1fc4 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
@@ -1,8 +1,6 @@
 /**
  * @name Access Of Memory Location After The End Of A Buffer Using Strncat
- * @description --Calls of the form strncat(dest, src, sizeof (dest) - strlen (dest)) set the third argument to one more than possible.
- *              --So when the buffer is full, the expression sizeof(dest) - strlen (dest) will be equal to one, and not zero as the programmer might think.
- *              --Making a call of this type may result in a zero byte being written just outside the buffer.
+ * @description Calls of the form `strncat(dest, source, sizeof (dest) - strlen (dest))` set the third argument to one more than possible. So when `dest` is full, the expression `sizeof(dest) - strlen (dest)` will be equal to one, and not zero as the programmer might think. Making a call of this type may result in a zero byte being written just outside the `dest` buffer.
  * @kind problem
  * @id cpp/access-memory-location-after-end-buffer
  * @problem.severity warning

From 5d5cd4fde57b9794476e1cd7d5fb4ff4249a7f6d Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Wed, 27 Jan 2021 00:10:04 +0300
Subject: [PATCH 327/343] Update
 AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql

---
 .../AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
index 4bc3d0e1fc4..169280cbd87 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
@@ -12,6 +12,7 @@
 
 import cpp
 import semmle.code.cpp.valuenumbering.HashCons
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 /**
  * A call to `strncat` of the form `strncat(buff, str, someExpr - strlen(buf))`, for some expression `someExpr` equal to `sizeof(buff)`.
@@ -22,8 +23,8 @@ class WrongCallStrncat extends FunctionCall {
   WrongCallStrncat() {
     this.getTarget().hasGlobalOrStdName("strncat") and
     // the expression of the first argument in `strncat` and `strnlen` is identical
-    hashCons(this.getArgument(0)) =
-      hashCons(this.getArgument(2).(SubExpr).getRightOperand().(StrlenCall).getStringExpr()) and
+    globalValueNumber(this.getArgument(0)) =
+      globalValueNumber(this.getArgument(2).(SubExpr).getRightOperand().(StrlenCall).getStringExpr()) and
     // using a string constant often speaks of manually calculating the length of the required buffer.
     (
       not this.getArgument(1) instanceof StringLiteral and

From 5a89fa3f67af11b49362c08dd534dbb462d15492 Mon Sep 17 00:00:00 2001
From: Asger Feldthaus <asgerf@github.com>
Date: Wed, 27 Jan 2021 10:10:08 +0000
Subject: [PATCH 328/343] JS: Fix performance issue in upgrade script

---
 .../toplevel_parent_xml_node.ql               | 29 +++++++++++++++----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql
index d8de8b32916..daf6b007086 100644
--- a/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql
+++ b/javascript/upgrades/c8859f3725d4b070a877f8792214582d517c8a9b/toplevel_parent_xml_node.ql
@@ -1,18 +1,37 @@
+class Location extends @location {
+  string toString() { none() }
+
+  predicate startsAtLine(@file file, int line) { locations_default(this, file, line, _, _, _) }
+}
+
 class TopLevel extends @toplevel {
   string toString() { none() }
+
+  Location getLocation() { hasLocation(this, result) }
+
+  pragma[nomagic]
+  predicate startsAtLine(@file file, int line) { getLocation().startsAtLine(file, line) }
 }
 
 class XmlNode extends @xmllocatable {
   string toString() { none() }
+
+  Location getLocation() { xmllocations(this, result) }
+
+  pragma[nomagic]
+  predicate startsAtLine(@file file, int line) { getLocation().startsAtLine(file, line) }
 }
 
-// Based on previous implementation on HTMLNode.getCodeInAttribute and getInlineScript
+// Based on previous implementation on HTMLNode.getCodeInAttribute and getInlineScript,
+// with `startsAtLine` added for performance reasons.
 from
-  TopLevel top, XmlNode xml, @file f, @location l1, int sl1, int sc1, int el1, int ec1,
-  @location l2, int sl2, int sc2, int el2, int ec2
+  TopLevel top, XmlNode xml, @file f, Location l1, int sl1, int sc1, int el1, int ec1, Location l2,
+  int sl2, int sc2, int el2, int ec2
 where
-  xmllocations(xml, l1) and
-  hasLocation(top, l2) and
+  l1 = xml.getLocation() and
+  l2 = top.getLocation() and
+  xml.startsAtLine(f, sl1) and
+  top.startsAtLine(f, [sl1, sl1 + 1]) and
   locations_default(l1, f, sl1, sc1, el1, ec1) and
   locations_default(l2, f, sl2, sc2, el2, ec2) and
   (

From aebf7bdff412b6a49441a223eb1535af162fb721 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Wed, 27 Jan 2021 13:12:48 +0300
Subject: [PATCH 329/343] Update test.c

---
 .../query-tests/Security/CWE/CWE-788/semmle/tests/test.c   | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
index 212baf83497..0e6fc01f882 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
@@ -2,14 +2,14 @@ void workFunction_0(char *s) {
   char buf[80];
   strncat(buf, s, sizeof(buf)-strlen(buf)-1); // GOOD
   strncat(buf, s, sizeof(buf)-strlen(buf));  // BAD
-  strncat(buf, "fix", sizeof(buf)-strlen(buf)); // BAD but usually the size of the buffer is calculated manually. 
+  strncat(buf, "fix", sizeof(buf)-strlen(buf)); // BAD [NOT DETECTED] 
 }
 void workFunction_1(char *s) {
 #define MAX_SIZE 80
   char buf[MAX_SIZE];
   strncat(buf, s, MAX_SIZE-strlen(buf)-1); // GOOD
   strncat(buf, s, MAX_SIZE-strlen(buf));  // BAD
-  strncat(buf, "fix", MAX_SIZE-strlen(buf)); // BAD but usually the size of the buffer is calculated manually. 
+  strncat(buf, "fix", MAX_SIZE-strlen(buf)); // BAD [NOT DETECTED]
 }
 void workFunction_2_0(char *s) {
   char * buf;
@@ -17,8 +17,7 @@ void workFunction_2_0(char *s) {
   buf = (char *) malloc(len);
   strncat(buf, s, len-strlen(buf)-1); // GOOD
   strncat(buf, s, len-strlen(buf));  // BAD
-  strncat(buf, "fix", len-strlen(buf)); // BAD but usually the size of the buffer is calculated manually. 
-}
+  strncat(buf, "fix", len-strlen(buf)); // BAD [NOT DETECTED]
 void workFunction_2_1(char *s) {
   char * buf;
   int len=80;

From 68eba11dbfc856b89122fd14352f38a9de141a5a Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Wed, 27 Jan 2021 13:16:56 +0300
Subject: [PATCH 330/343] Update
 AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql

---
 .../AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql      | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
index 169280cbd87..b40b9c74ebe 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
@@ -11,7 +11,6 @@
  */
 
 import cpp
-import semmle.code.cpp.valuenumbering.HashCons
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 /**
@@ -39,7 +38,7 @@ class WrongCallStrncat extends FunctionCall {
    */
   predicate isExpressionEqualSizeof() {
     // the left side of the expression `someExpr` is `sizeof(buf)`.
-    hashCons(this.getArgument(0)) = hashCons(leftsomeExpr.(SizeofExprOperator).getExprOperand())
+    globalValueNumber(this.getArgument(0)) = globalValueNumber(leftsomeExpr.(SizeofExprOperator).getExprOperand())
     or
     // value of the left side of the expression `someExpr` equal  `sizeof(buf)` value, and `buf` is array.
     leftsomeExpr.getValue().toInt() = this.getArgument(0).getType().getSize()

From 3604557e62005d6f58a8743bcbe7d763e9e9a34f Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 27 Jan 2021 11:47:45 +0100
Subject: [PATCH 331/343] C++: Remove linear scan in isSVariant.

---
 cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll
index 061209d65b7..c4332c3ef5c 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll
@@ -40,9 +40,7 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid
   /**
    * Holds if this is one of the `strcpy_s` variants.
    */
-  private predicate isSVariant() {
-    exists(string name | name = getName() | name.suffix(name.length() - 2) = "_s")
-  }
+  private predicate isSVariant() { getName().matches("%\\_s") }
 
   /**
    * Gets the index of the parameter that is the maximum size of the copy (in characters).

From 19b7d46099cec320754e44146164af7e08abb0ee Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Wed, 27 Jan 2021 14:06:53 +0300
Subject: [PATCH 332/343] Update test.c

---
 .../query-tests/Security/CWE/CWE-788/semmle/tests/test.c         | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
index 0e6fc01f882..c3347e1fd65 100644
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c
@@ -18,6 +18,7 @@ void workFunction_2_0(char *s) {
   strncat(buf, s, len-strlen(buf)-1); // GOOD
   strncat(buf, s, len-strlen(buf));  // BAD
   strncat(buf, "fix", len-strlen(buf)); // BAD [NOT DETECTED]
+}
 void workFunction_2_1(char *s) {
   char * buf;
   int len=80;

From c61dec1dffad839b817c3841579cd0c3f0abe80a Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 27 Jan 2021 13:17:47 +0100
Subject: [PATCH 333/343] C++: Remove more linear scans.

---
 cpp/ql/src/semmle/code/cpp/Comments.qll                | 2 +-
 cpp/ql/src/semmle/code/cpp/commons/Synchronization.qll | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/Comments.qll b/cpp/ql/src/semmle/code/cpp/Comments.qll
index 65e2af5fd22..7574f0ff32c 100644
--- a/cpp/ql/src/semmle/code/cpp/Comments.qll
+++ b/cpp/ql/src/semmle/code/cpp/Comments.qll
@@ -50,5 +50,5 @@ class CStyleComment extends Comment {
  * ```
  */
 class CppStyleComment extends Comment {
-  CppStyleComment() { this.getContents().prefix(2) = "//" }
+  CppStyleComment() { this.getContents().matches("//%") }
 }
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Synchronization.qll b/cpp/ql/src/semmle/code/cpp/commons/Synchronization.qll
index c7641385393..92955ae3580 100644
--- a/cpp/ql/src/semmle/code/cpp/commons/Synchronization.qll
+++ b/cpp/ql/src/semmle/code/cpp/commons/Synchronization.qll
@@ -87,7 +87,7 @@ abstract class MutexType extends Type {
 private Function mustlockCandidate() {
   exists(string name | name = result.getName() |
     name = "lock" or
-    name.suffix(name.length() - 10) = "mutex_lock"
+    name.matches("%mutex\\_lock")
   )
 }
 
@@ -97,7 +97,7 @@ private Function mustlockCandidate() {
 private Function trylockCandidate() {
   exists(string name | name = result.getName() |
     name = "try_lock" or
-    name.suffix(name.length() - 13) = "mutex_trylock"
+    name.matches("%mutex\\_trylock")
   )
 }
 
@@ -107,7 +107,7 @@ private Function trylockCandidate() {
 private Function unlockCandidate() {
   exists(string name | name = result.getName() |
     name = "unlock" or
-    name.suffix(name.length() - 12) = "mutex_unlock"
+    name.matches("%mutex\\_unlock")
   )
 }
 

From 32b5c7fe06a69774b55fb1cd0c1f039fe4a33bcd Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 27 Jan 2021 16:41:19 +0100
Subject: [PATCH 334/343] C++: Model implied dataflow

---
 .../cpp/ir/dataflow/internal/DataFlowUtil.qll | 21 +++++++++++++++++++
 .../interfaces/FunctionInputsAndOutputs.qll   | 12 ++++++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index 3608c2c68fe..7580bfc9012 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -920,6 +920,27 @@ private predicate modelFlow(Operand opFrom, Instruction iTo) {
       )
     )
   )
+  or
+  impliedModelFlow(opFrom, iTo)
+}
+
+/**
+ * When a `DataFlowFunction` specifies dataflow from a parameter `p` to the return value there should
+ * also be dataflow from the parameter dereference (i.e., `*p`) to the return value dereference.
+ */
+private predicate impliedModelFlow(Operand opFrom, Instruction iTo) {
+  exists(
+    CallInstruction call, DataFlowFunction func, FunctionInput modelIn, FunctionOutput modelOut,
+    int index
+  |
+    call.getStaticCallTarget() = func and
+    func.hasDataFlow(modelIn, modelOut)
+  |
+    modelIn.isParameterOrQualifierAddress(index) and
+    modelOut.isReturnValue() and
+    opFrom = getSideEffectFor(call, index).(ReadSideEffectInstruction).getSideEffectOperand() and
+    iTo = call // TODO: Add write side effects for return values
+  )
 }
 
 /**
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
index 195cbcb63b5..4ab55ee5b3f 100644
--- a/cpp/ql/src/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
@@ -108,6 +108,16 @@ class FunctionInput extends TFunctionInput {
    */
   predicate isQualifierAddress() { none() }
 
+  /**
+   * Holds if `i >= 0` and `isParameter(i)` holds for this value, or
+   * if `i = -1` and `isQualifierAddress()` holds for this value.
+   */
+  final predicate isParameterOrQualifierAddress(ParameterIndex i) {
+    i >= 0 and this.isParameter(i)
+    or
+    i = -1 and this.isQualifierAddress()
+  }
+
   /**
    * Holds if this is the input value pointed to by the return value of a
    * function, if the function returns a pointer, or the input value referred
@@ -134,7 +144,7 @@ class FunctionInput extends TFunctionInput {
   predicate isReturnValueDeref() { none() }
 
   /**
-   * Holds if `i >= 0` and `isParameterDeref(i)` holds for this is value, or
+   * Holds if `i >= 0` and `isParameterDeref(i)` holds for this value, or
    * if `i = -1` and `isQualifierObject()` holds for this value.
    */
   final predicate isParameterDerefOrQualifierObject(ParameterIndex i) {

From 52e2a69db9645dba346e1c75641f6a26f464507c Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 27 Jan 2021 16:41:38 +0100
Subject: [PATCH 335/343] C++: Accept test changes.

---
 .../taint-tests/standalone_iterators.cpp      |  4 +-
 .../dataflow/taint-tests/string.cpp           |  4 +-
 .../dataflow/taint-tests/stringstream.cpp     | 44 +++++++++----------
 3 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp
index 709ba8e7af4..3fb8c738305 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp
@@ -38,13 +38,13 @@ public:
 
 void test_typedefs(int_iterator_by_typedefs source1) {
     sink(*source1); // $ ast,ir
-    sink(*(source1++)); // $ ast MISSING: ir
+    sink(*(source1++)); // $ ast,ir
     sink(*(++source1)); // $ ast MISSING: ir
 }
 
 void test_trait(int_iterator_by_trait source1) {
     sink(*source1); // $ ast,ir
-    sink(*(source1++)); // $ ast MISSING: ir
+    sink(*(source1++)); // $ ast,ir
     sink(*(++source1)); // $ ast MISSING: ir
 }
 
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp
index 3741c54285b..9169113c1d9 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp
@@ -415,10 +415,10 @@ void test_string_iterators() {
 		sink(*i9); // $ ast,ir
 
 		i10 = i2;
-		sink(*(i10++)); // $ ast MISSING: ir
+		sink(*(i10++)); // $ ast,ir
 		sink(i10); // $ ast,ir
 		i11 = i2;
-		sink(*(i11--)); // $ ast MISSING: ir
+		sink(*(i11--)); // $ ast,ir
 		sink(i11); // $ ast,ir
 	}
 }
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp
index 794df6704da..7b7712f0c01 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp
@@ -75,7 +75,7 @@ void test_stringstream_int(int source)
 	sink(ss1 << 1234);
 	sink(ss2 << source); // $ ast MISSING: ir
 	sink(ss1 >> v1);
-	sink(ss2 >> v2); // $ ast MISSING: ir
+	sink(ss2 >> v2); // $ ast,ir
 
 	sink(ss1);
 	sink(ss2); // $ ast,ir
@@ -143,27 +143,27 @@ void test_stringstream_in()
 	sink(ss2 << source()); // $ ast,ir
 
 	sink(ss1 >> s1);
-	sink(ss2 >> s2); // $ ast MISSING: ir
-	sink(ss2 >> s3 >> s4); // $ ast MISSING: ir
+	sink(ss2 >> s2); // $ ast,ir
+	sink(ss2 >> s3 >> s4); // $ ast,ir
 	sink(s1);
 	sink(s2); // $ ast,ir
 	sink(s3); // $ ast,ir
-	sink(s4); // $ ast MISSING: ir
+	sink(s4); // $ ast,ir
 
 	sink(ss1 >> b1);
-	sink(ss2 >> b2); // $ ast MISSING: ir
-	sink(ss2 >> b3 >> b4); // $ ast MISSING: ir
+	sink(ss2 >> b2); // $ ast,ir
+	sink(ss2 >> b3 >> b4); // $ ast,ir
 	sink(b1);
 	sink(b2); // $ ast,ir
 	sink(b3); // $ ast,ir
-	sink(b4); // $ ast MISSING: ir
+	sink(b4); // $ ast,ir
 
 	sink(ss1.read(b5, 100));
-	sink(ss2.read(b6, 100)); // $ ast MISSING: ir
+	sink(ss2.read(b6, 100)); // $ ast,ir
 	sink(ss1.readsome(b7, 100));
 	sink(ss2.readsome(b8, 100)); // (returns a length, not significantly tainted)
 	sink(ss1.get(b9, 100));
-	sink(ss2.get(b10, 100)); // $ ast MISSING: ir
+	sink(ss2.get(b10, 100)); // $ ast,ir
 	sink(b5);
 	sink(b6); // $ ast,ir
 	sink(b7);
@@ -176,7 +176,7 @@ void test_stringstream_in()
 	sink(c3 = ss1.peek());
 	sink(c4 = ss2.peek()); // $ ast,ir
 	sink(ss1.get(c5));
-	sink(ss2.get(c6)); // $ ast MISSING: ir
+	sink(ss2.get(c6)); // $ ast,ir
 	sink(c1);
 	sink(c2); // $ ast,ir
 	sink(c3);
@@ -212,44 +212,44 @@ void test_getline()
 	std::string s1, s2, s3, s4, s5, s6, s7, s8;
 
 	sink(ss1.getline(b1, 1000));
-	sink(ss2.getline(b2, 1000)); // $ ast MISSING: ir
-	sink(ss2.getline(b3, 1000)); // $ ast MISSING: ir
+	sink(ss2.getline(b2, 1000)); // $ ast,ir
+	sink(ss2.getline(b3, 1000)); // $ ast,ir
 	sink(ss1.getline(b3, 1000));
 	sink(b1);
 	sink(b2); // $ ast,ir
 	sink(b3); // $ SPURIOUS: ast,ir
 
 	sink(ss1.getline(b4, 1000, ' '));
-	sink(ss2.getline(b5, 1000, ' ')); // $ ast MISSING: ir
-	sink(ss2.getline(b6, 1000, ' ')); // $ ast MISSING: ir
+	sink(ss2.getline(b5, 1000, ' ')); // $ ast,ir
+	sink(ss2.getline(b6, 1000, ' ')); // $ ast,ir
 	sink(ss1.getline(b6, 1000, ' '));
 	sink(b4);
 	sink(b5); // $ ast,ir
 	sink(b6); // $ SPURIOUS: ast,ir
 
-	sink(ss2.getline(b7, 1000).getline(b8, 1000)); // $ ast MISSING: ir
+	sink(ss2.getline(b7, 1000).getline(b8, 1000)); // $ ast,ir
 	sink(b7); // $ ast,ir
 	sink(b8); // $ ast MISSING: ir
 
 	sink(getline(ss1, s1));
-	sink(getline(ss2, s2)); // $ ast MISSING: ir
-	sink(getline(ss2, s3)); // $ ast MISSING: ir
+	sink(getline(ss2, s2)); // $ ast,ir
+	sink(getline(ss2, s3)); // $ ast,ir
 	sink(getline(ss1, s3));
 	sink(s1);
 	sink(s2); // $ ast,ir
 	sink(s3); // $ SPURIOUS: ast,ir
 
 	sink(getline(ss1, s4, ' '));
-	sink(getline(ss2, s5, ' ')); // $ ast MISSING: ir
-	sink(getline(ss2, s6, ' ')); // $ ast MISSING: ir
+	sink(getline(ss2, s5, ' ')); // $ ast,ir
+	sink(getline(ss2, s6, ' ')); // $ ast,ir
 	sink(getline(ss1, s6, ' '));
 	sink(s4);
 	sink(s5); // $ ast,ir
 	sink(s6); // $ SPURIOUS: ast,ir
 
-	sink(getline(getline(ss2, s7), s8)); // $ ast MISSING: ir
+	sink(getline(getline(ss2, s7), s8)); // $ ast,ir
 	sink(s7); // $ ast,ir
-	sink(s8); // $ ast MISSING: ir
+	sink(s8); // $ ast,ir
 }
 
 void test_chaining()
@@ -259,7 +259,7 @@ void test_chaining()
 	char b1[1000] = {0};
 	char b2[1000] = {0};
 
-	sink(ss1.get(b1, 100).unget().get(b2, 100)); // $ ast MISSING: ir
+	sink(ss1.get(b1, 100).unget().get(b2, 100)); // $ ast,ir
 	sink(b1); // $ ast,ir
 	sink(b2); // $ ast MISSING: ir
 

From 066f83630d6020ccffe2e796a3ea4461be7fe845 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 27 Jan 2021 18:07:14 +0100
Subject: [PATCH 336/343] C++: bcopy can never be in the std namespace.

---
 .../src/semmle/code/cpp/models/implementations/Memcpy.qll | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
index 813c2834586..4ba7f40dd92 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
@@ -18,22 +18,22 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
     // memcpy(dest, src, num)
     // memmove(dest, src, num)
     // memmove(dest, src, num, remaining)
-    this.hasName(["memcpy", "memmove", "__builtin___memcpy_chk"])
+    this.hasGlobalOrStdName(["memcpy", "memmove"])
     or
     // bcopy(src, dest, num)
-    this.hasGlobalOrStdName("bcopy")
+    this.hasGlobalName(["bcopy", "__builtin___memcpy_chk"])
   }
 
   /**
    * Gets the index of the parameter that is the source buffer for the copy.
    */
-  int getParamSrc() { if this.hasGlobalOrStdName("bcopy") then result = 0 else result = 1 }
+  int getParamSrc() { if this.hasGlobalName("bcopy") then result = 0 else result = 1 }
 
   /**
    * Gets the index of the parameter that is the destination buffer for the
    * copy.
    */
-  int getParamDest() { if this.hasGlobalOrStdName("bcopy") then result = 1 else result = 0 }
+  int getParamDest() { if this.hasGlobalName("bcopy") then result = 1 else result = 0 }
 
   /**
    * Gets the index of the parameter that is the size of the copy (in bytes).

From 5aff5c32542ea7167061255793bde4c7207e880a Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 27 Jan 2021 18:12:02 +0100
Subject: [PATCH 337/343] C++: Add AliasFunction model to MemcpyFunction.

---
 .../cpp/models/implementations/Memcpy.qll     | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
index 4ba7f40dd92..9ceff32d128 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
@@ -6,6 +6,7 @@
 import semmle.code.cpp.Function
 import semmle.code.cpp.models.interfaces.ArrayFunction
 import semmle.code.cpp.models.interfaces.DataFlow
+import semmle.code.cpp.models.interfaces.Alias
 import semmle.code.cpp.models.interfaces.SideEffect
 import semmle.code.cpp.models.interfaces.Taint
 
@@ -13,7 +14,8 @@ import semmle.code.cpp.models.interfaces.Taint
  * The standard functions `memcpy`, `memmove` and `bcopy`; and the gcc variant
  * `__builtin___memcpy_chk`.
  */
-private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction {
+private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction,
+  AliasFunction {
   MemcpyFunction() {
     // memcpy(dest, src, num)
     // memmove(dest, src, num)
@@ -82,4 +84,19 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
       i = getParamSrc()
     )
   }
+
+  override predicate parameterNeverEscapes(int index) {
+    index = getParamSrc()
+    or
+    this.hasGlobalName("bcopy") and index = getParamDest()
+  }
+
+  override predicate parameterEscapesOnlyViaReturn(int index) {
+    not this.hasGlobalName("bcopy") and index = getParamDest()
+  }
+
+  override predicate parameterIsAlwaysReturned(int index) {
+    not this.hasGlobalName("bcopy") and
+    index = getParamDest()
+  }
 }

From aec18e71230ccd34390003b6f9e5386d1b0d8305 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 27 Jan 2021 18:12:32 +0100
Subject: [PATCH 338/343] C++: Add mempcpy to MemcpyFunction model class.

---
 .../src/semmle/code/cpp/models/implementations/Memcpy.qll  | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
index 9ceff32d128..df6c27b2187 100644
--- a/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
@@ -23,7 +23,8 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
     this.hasGlobalOrStdName(["memcpy", "memmove"])
     or
     // bcopy(src, dest, num)
-    this.hasGlobalName(["bcopy", "__builtin___memcpy_chk"])
+    // mempcpy(dest, src, num)
+    this.hasGlobalName(["bcopy", mempcpy(), "__builtin___memcpy_chk"])
   }
 
   /**
@@ -96,7 +97,9 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
   }
 
   override predicate parameterIsAlwaysReturned(int index) {
-    not this.hasGlobalName("bcopy") and
+    not this.hasGlobalName(["bcopy", mempcpy()]) and
     index = getParamDest()
   }
 }
+
+private string mempcpy() { result = ["mempcpy", "wmempcpy"] }

From c90dc62cc49e20fdd71d5e7befe707ef19cc6247 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 27 Jan 2021 18:57:09 +0100
Subject: [PATCH 339/343] C++: Autoformat.

---
 .../AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql      | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
index b40b9c74ebe..5311ffe2708 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
@@ -38,7 +38,8 @@ class WrongCallStrncat extends FunctionCall {
    */
   predicate isExpressionEqualSizeof() {
     // the left side of the expression `someExpr` is `sizeof(buf)`.
-    globalValueNumber(this.getArgument(0)) = globalValueNumber(leftsomeExpr.(SizeofExprOperator).getExprOperand())
+    globalValueNumber(this.getArgument(0)) =
+      globalValueNumber(leftsomeExpr.(SizeofExprOperator).getExprOperand())
     or
     // value of the left side of the expression `someExpr` equal  `sizeof(buf)` value, and `buf` is array.
     leftsomeExpr.getValue().toInt() = this.getArgument(0).getType().getSize()

From 44bb41e84b9393da0fd681697f8fa1ce8c2aa9c3 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Wed, 27 Jan 2021 19:06:51 +0100
Subject: [PATCH 340/343] Python: Add extra type-tracking test for "long"
 import chain

While trying to debug an other problem related to full import of django view, I
stumbled upon this oddity. (yikes)
---
 .../dataflow/typetracking/test.py             | 19 +++++
 .../dataflow/typetracking/tracked.ql          | 70 +++++++++++++++++++
 2 files changed, 89 insertions(+)

diff --git a/python/ql/test/experimental/dataflow/typetracking/test.py b/python/ql/test/experimental/dataflow/typetracking/test.py
index b03a2e6912d..a797c302023 100644
--- a/python/ql/test/experimental/dataflow/typetracking/test.py
+++ b/python/ql/test/experimental/dataflow/typetracking/test.py
@@ -101,3 +101,22 @@ class Bar(Foo):
         self.meth1() # $ tracked_self
         super().meth2()
         super(Bar, self).foo3() # $ tracked_self
+
+# ------------------------------------------------------------------------------
+# Tracking of attribute lookup after "long" import chain
+# ------------------------------------------------------------------------------
+
+def test_long_import_chain():
+    import foo.bar
+    foo.baz # $ SPURIOUS: tracked_foo_bar_baz
+    x = foo.bar.baz # $ tracked_foo_bar_baz
+    do_stuff(x) # $ tracked_foo_bar_baz
+
+    class Example(foo.bar.baz): # $ tracked_foo_bar_baz
+        pass
+
+
+def test_long_import_chain_full_path():
+    from foo.bar import baz # $ tracked_foo_bar_baz
+    x = baz # $ tracked_foo_bar_baz
+    do_stuff(x) # $ tracked_foo_bar_baz
diff --git a/python/ql/test/experimental/dataflow/typetracking/tracked.ql b/python/ql/test/experimental/dataflow/typetracking/tracked.ql
index 4ce35a2d265..0797e484c97 100644
--- a/python/ql/test/experimental/dataflow/typetracking/tracked.ql
+++ b/python/ql/test/experimental/dataflow/typetracking/tracked.ql
@@ -3,6 +3,9 @@ import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TypeTracker
 import TestUtilities.InlineExpectationsTest
 
+// -----------------------------------------------------------------------------
+// tracked
+// -----------------------------------------------------------------------------
 DataFlow::Node tracked(TypeTracker t) {
   t.start() and
   result.asCfgNode() = any(NameNode n | n.getId() = "tracked")
@@ -28,6 +31,9 @@ class TrackedTest extends InlineExpectationsTest {
   }
 }
 
+// -----------------------------------------------------------------------------
+// int + str
+// -----------------------------------------------------------------------------
 DataFlow::Node int_type(TypeTracker t) {
   t.start() and
   result.asCfgNode() = any(CallNode c | c.getFunction().(NameNode).getId() = "int")
@@ -74,6 +80,9 @@ class TrackedStringTest extends InlineExpectationsTest {
   }
 }
 
+// -----------------------------------------------------------------------------
+// tracked_self
+// -----------------------------------------------------------------------------
 DataFlow::Node tracked_self(TypeTracker t) {
   t.start() and
   exists(Function f |
@@ -102,3 +111,64 @@ class TrackedSelfTest extends InlineExpectationsTest {
     )
   }
 }
+
+// -----------------------------------------------------------------------------
+// tracked_foo_bar_baz
+// -----------------------------------------------------------------------------
+// This modeling follows the same pattern that we currently use in our real library modeling.
+/** Gets a reference to `foo` (fictive module). */
+private DataFlow::Node foo(DataFlow::TypeTracker t) {
+  t.start() and
+  result = DataFlow::importNode("foo")
+  or
+  exists(DataFlow::TypeTracker t2 | result = foo(t2).track(t2, t))
+}
+
+/** Gets a reference to `foo` (fictive module). */
+DataFlow::Node foo() { result = foo(DataFlow::TypeTracker::end()) }
+
+/** Gets a reference to `foo.bar` (fictive module). */
+private DataFlow::Node foo_bar(DataFlow::TypeTracker t) {
+  t.start() and
+  result = DataFlow::importNode("foo.bar")
+  or
+  t.startInAttr("bar") and
+  result = foo()
+  or
+  exists(DataFlow::TypeTracker t2 | result = foo_bar(t2).track(t2, t))
+}
+
+/** Gets a reference to `foo.bar` (fictive module). */
+DataFlow::Node foo_bar() { result = foo_bar(DataFlow::TypeTracker::end()) }
+
+/** Gets a reference to `foo.bar.baz` (fictive attribute on `foo.bar` module). */
+private DataFlow::Node foo_bar_baz(DataFlow::TypeTracker t) {
+  t.start() and
+  result = DataFlow::importNode("foo.bar.baz")
+  or
+  t.startInAttr("baz") and
+  result = foo_bar()
+  or
+  exists(DataFlow::TypeTracker t2 | result = foo_bar_baz(t2).track(t2, t))
+}
+
+/** Gets a reference to `foo.bar.baz` (fictive attribute on `foo.bar` module). */
+DataFlow::Node foo_bar_baz() { result = foo_bar_baz(DataFlow::TypeTracker::end()) }
+
+class TrackedFooBarBaz extends InlineExpectationsTest {
+  TrackedFooBarBaz() { this = "TrackedFooBarBaz" }
+
+  override string getARelevantTag() { result = "tracked_foo_bar_baz" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(DataFlow::Node e |
+      e = foo_bar_baz() and
+      // Module variables have no sensible location, and hence can't be annotated.
+      not e instanceof DataFlow::ModuleVariableNode and
+      tag = "tracked_foo_bar_baz" and
+      location = e.getLocation() and
+      value = "" and
+      element = e.toString()
+    )
+  }
+}

From 0d42e546a07f180ce5a9e3e4852cd06b10fab107 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Wed, 27 Jan 2021 19:08:50 +0100
Subject: [PATCH 341/343] Python: Add deep import chain to import-helper tests

---
 .../experimental/dataflow/import-helper/ImportHelper.expected | 4 ++++
 .../ql/test/experimental/dataflow/import-helper/test_deep.py  | 3 +++
 2 files changed, 7 insertions(+)
 create mode 100644 python/ql/test/experimental/dataflow/import-helper/test_deep.py

diff --git a/python/ql/test/experimental/dataflow/import-helper/ImportHelper.expected b/python/ql/test/experimental/dataflow/import-helper/ImportHelper.expected
index 9d263331f6a..a30908932da 100644
--- a/python/ql/test/experimental/dataflow/import-helper/ImportHelper.expected
+++ b/python/ql/test/experimental/dataflow/import-helper/ImportHelper.expected
@@ -21,3 +21,7 @@
 | test7.py:5:8:5:16 | ControlFlowNode for ImportExpr | mypkg.foo |
 | test7.py:9:6:9:10 | ControlFlowNode for ImportExpr | mypkg |
 | test7.py:9:19:9:21 | ControlFlowNode for ImportMember | mypkg.foo |
+| test_deep.py:1:6:1:21 | ControlFlowNode for ImportExpr | start.middle.end |
+| test_deep.py:1:6:1:21 | ControlFlowNode for ImportExpr | start.middle.end |
+| test_deep.py:1:30:1:32 | ControlFlowNode for ImportMember | start.middle.end.foo |
+| test_deep.py:1:35:1:37 | ControlFlowNode for ImportMember | start.middle.end.bar |
diff --git a/python/ql/test/experimental/dataflow/import-helper/test_deep.py b/python/ql/test/experimental/dataflow/import-helper/test_deep.py
new file mode 100644
index 00000000000..49c4bc6c184
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/import-helper/test_deep.py
@@ -0,0 +1,3 @@
+from start.middle.end import foo, bar
+print(foo)
+print(bar)

From 5646af56dd5a9bc3c11f02ccd9151c6243b17e04 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen <rasmuswl@github.com>
Date: Wed, 27 Jan 2021 19:11:55 +0100
Subject: [PATCH 342/343] Python: Fix too many results from
 DataFlow::importNode

---
 .../semmle/python/dataflow/new/internal/DataFlowUtil.qll  | 8 +++++++-
 .../dataflow/import-helper/ImportHelper.expected          | 4 ----
 python/ql/test/experimental/dataflow/typetracking/test.py | 2 +-
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowUtil.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowUtil.qll
index 8c9daf0c8d8..174564db96b 100644
--- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowUtil.qll
+++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowUtil.qll
@@ -68,5 +68,11 @@ Node importNode(string name) {
   // Because named imports are modelled as `AttrRead`s, the statement `from foo import bar as baz`
   // is interpreted as if it was an assignment `baz = foo.bar`, which means `baz` gets tracked as a
   // reference to `foo.bar`, as desired.
-  result.asCfgNode().getNode() = any(ImportExpr i | i.getName() = name)
+  exists(ImportExpr imp_expr |
+    imp_expr.getName() = name and
+    result.asCfgNode().getNode() = imp_expr and
+    // in `import foo.bar` we DON'T want to give a result for `importNode("foo.bar")`,
+    // only for `importNode("foo")`. We exclude those cases with the following clause.
+    not exists(Import imp | imp.getAName().getValue() = imp_expr)
+  )
 }
diff --git a/python/ql/test/experimental/dataflow/import-helper/ImportHelper.expected b/python/ql/test/experimental/dataflow/import-helper/ImportHelper.expected
index a30908932da..11608b04ab8 100644
--- a/python/ql/test/experimental/dataflow/import-helper/ImportHelper.expected
+++ b/python/ql/test/experimental/dataflow/import-helper/ImportHelper.expected
@@ -4,9 +4,7 @@
 | test2.py:1:19:1:21 | ControlFlowNode for ImportMember | mypkg.foo |
 | test2.py:1:24:1:26 | ControlFlowNode for ImportMember | mypkg.bar |
 | test3.py:1:8:1:16 | ControlFlowNode for ImportExpr | mypkg |
-| test3.py:1:8:1:16 | ControlFlowNode for ImportExpr | mypkg.foo |
 | test3.py:2:8:2:16 | ControlFlowNode for ImportExpr | mypkg |
-| test3.py:2:8:2:16 | ControlFlowNode for ImportExpr | mypkg.bar |
 | test4.py:1:8:1:16 | ControlFlowNode for ImportExpr | mypkg.foo |
 | test4.py:2:8:2:16 | ControlFlowNode for ImportExpr | mypkg.bar |
 | test5.py:1:8:1:12 | ControlFlowNode for ImportExpr | mypkg |
@@ -14,11 +12,9 @@
 | test5.py:9:19:9:29 | ControlFlowNode for ImportMember | mypkg.bar |
 | test6.py:1:8:1:12 | ControlFlowNode for ImportExpr | mypkg |
 | test6.py:5:8:5:16 | ControlFlowNode for ImportExpr | mypkg |
-| test6.py:5:8:5:16 | ControlFlowNode for ImportExpr | mypkg.foo |
 | test7.py:1:6:1:10 | ControlFlowNode for ImportExpr | mypkg |
 | test7.py:1:19:1:21 | ControlFlowNode for ImportMember | mypkg.foo |
 | test7.py:5:8:5:16 | ControlFlowNode for ImportExpr | mypkg |
-| test7.py:5:8:5:16 | ControlFlowNode for ImportExpr | mypkg.foo |
 | test7.py:9:6:9:10 | ControlFlowNode for ImportExpr | mypkg |
 | test7.py:9:19:9:21 | ControlFlowNode for ImportMember | mypkg.foo |
 | test_deep.py:1:6:1:21 | ControlFlowNode for ImportExpr | start.middle.end |
diff --git a/python/ql/test/experimental/dataflow/typetracking/test.py b/python/ql/test/experimental/dataflow/typetracking/test.py
index a797c302023..a4dd1baeac1 100644
--- a/python/ql/test/experimental/dataflow/typetracking/test.py
+++ b/python/ql/test/experimental/dataflow/typetracking/test.py
@@ -108,7 +108,7 @@ class Bar(Foo):
 
 def test_long_import_chain():
     import foo.bar
-    foo.baz # $ SPURIOUS: tracked_foo_bar_baz
+    foo.baz
     x = foo.bar.baz # $ tracked_foo_bar_baz
     do_stuff(x) # $ tracked_foo_bar_baz
 

From 24f76f9a17559adb048ebeb29fc8c1a9b3e0566d Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Wed, 27 Jan 2021 21:57:12 +0100
Subject: [PATCH 343/343] C++: Accept test changes.

---
 .../ir/ssa/aliased_ssa_ir.expected            | 84 +++++++++----------
 1 file changed, 39 insertions(+), 45 deletions(-)

diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index f241c851109..c4019a38251 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -889,10 +889,8 @@ ssa.cpp:
 #  207|     m207_4(unknown)        = Chi                                : total:m207_2, partial:m207_3
 #  207|     r207_5(glval<int>)     = VariableAddress[x]                 : 
 #  207|     m207_6(int)            = InitializeParameter[x]             : &:r207_5
-#  207|     m207_7(unknown)        = Chi                                : total:m207_4, partial:m207_6
 #  208|     r208_1(glval<int>)     = VariableAddress[y]                 : 
 #  208|     m208_2(int)            = Uninitialized[y]                   : &:r208_1
-#  208|     m208_3(unknown)        = Chi                                : total:m207_7, partial:m208_2
 #  209|     r209_1(glval<unknown>) = FunctionAddress[memcpy]            : 
 #  209|     r209_2(glval<int>)     = VariableAddress[y]                 : 
 #  209|     r209_3(int *)          = CopyValue                          : r209_2
@@ -904,15 +902,15 @@ ssa.cpp:
 #  209|     r209_9(void *)         = Call[memcpy]                       : func:r209_1, 0:r209_4, 1:r209_7, 2:r209_8
 #  209|     v209_10(void)          = ^SizedBufferReadSideEffect[1]      : &:r209_7, r209_8, ~m207_6
 #  209|     m209_11(unknown)       = ^SizedBufferMustWriteSideEffect[0] : &:r209_4, r209_8
-#  209|     m209_12(unknown)       = Chi                                : total:m208_3, partial:m209_11
+#  209|     m209_12(int)           = Chi                                : total:m208_2, partial:m209_11
 #  210|     r210_1(glval<int>)     = VariableAddress[#return]           : 
 #  210|     r210_2(glval<int>)     = VariableAddress[y]                 : 
-#  210|     r210_3(int)            = Load[y]                            : &:r210_2, ~m209_12
+#  210|     r210_3(int)            = Load[y]                            : &:r210_2, m209_12
 #  210|     m210_4(int)            = Store[#return]                     : &:r210_1, r210_3
-#  207|     r207_8(glval<int>)     = VariableAddress[#return]           : 
-#  207|     v207_9(void)           = ReturnValue                        : &:r207_8, m210_4
-#  207|     v207_10(void)          = AliasedUse                         : m207_3
-#  207|     v207_11(void)          = ExitFunction                       : 
+#  207|     r207_7(glval<int>)     = VariableAddress[#return]           : 
+#  207|     v207_8(void)           = ReturnValue                        : &:r207_7, m210_4
+#  207|     v207_9(void)           = AliasedUse                         : m207_3
+#  207|     v207_10(void)          = ExitFunction                       : 
 
 #  213| void InitArray()
 #  213|   Block 0
@@ -1104,51 +1102,49 @@ ssa.cpp:
 #  247|     m247_6(char *)         = InitializeParameter[src]           : &:r247_5
 #  247|     r247_7(char *)         = Load[src]                          : &:r247_5, m247_6
 #  247|     m247_8(unknown)        = InitializeIndirection[src]         : &:r247_7
-#  247|     m247_9(unknown)        = Chi                                : total:m247_4, partial:m247_8
-#  247|     r247_10(glval<int>)    = VariableAddress[size]              : 
-#  247|     m247_11(int)           = InitializeParameter[size]          : &:r247_10
+#  247|     r247_9(glval<int>)     = VariableAddress[size]              : 
+#  247|     m247_10(int)           = InitializeParameter[size]          : &:r247_9
 #  248|     r248_1(glval<char *>)  = VariableAddress[dst]               : 
 #  248|     r248_2(glval<unknown>) = FunctionAddress[operator new[]]    : 
 #  248|     r248_3(glval<int>)     = VariableAddress[size]              : 
-#  248|     r248_4(int)            = Load[size]                         : &:r248_3, m247_11
+#  248|     r248_4(int)            = Load[size]                         : &:r248_3, m247_10
 #  248|     r248_5(unsigned long)  = Convert                            : r248_4
 #  248|     r248_6(unsigned long)  = Constant[1]                        : 
 #  248|     r248_7(unsigned long)  = Mul                                : r248_5, r248_6
 #  248|     r248_8(void *)         = Call[operator new[]]               : func:r248_2, 0:r248_7
-#  248|     m248_9(unknown)        = ^CallSideEffect                    : ~m247_9
-#  248|     m248_10(unknown)       = Chi                                : total:m247_9, partial:m248_9
+#  248|     m248_9(unknown)        = ^CallSideEffect                    : ~m247_4
+#  248|     m248_10(unknown)       = Chi                                : total:m247_4, partial:m248_9
 #  248|     m248_11(unknown)       = ^InitializeDynamicAllocation       : &:r248_8
-#  248|     m248_12(unknown)       = Chi                                : total:m248_10, partial:m248_11
-#  248|     r248_13(char *)        = Convert                            : r248_8
-#  248|     m248_14(char *)        = Store[dst]                         : &:r248_1, r248_13
+#  248|     r248_12(char *)        = Convert                            : r248_8
+#  248|     m248_13(char *)        = Store[dst]                         : &:r248_1, r248_12
 #  249|     r249_1(char)           = Constant[97]                       : 
 #  249|     r249_2(glval<char *>)  = VariableAddress[src]               : 
 #  249|     r249_3(char *)         = Load[src]                          : &:r249_2, m247_6
 #  249|     r249_4(glval<char>)    = CopyValue                          : r249_3
 #  249|     m249_5(char)           = Store[?]                           : &:r249_4, r249_1
-#  249|     m249_6(unknown)        = Chi                                : total:m248_12, partial:m249_5
+#  249|     m249_6(unknown)        = Chi                                : total:m247_8, partial:m249_5
 #  250|     r250_1(glval<unknown>) = FunctionAddress[memcpy]            : 
 #  250|     r250_2(glval<char *>)  = VariableAddress[dst]               : 
-#  250|     r250_3(char *)         = Load[dst]                          : &:r250_2, m248_14
+#  250|     r250_3(char *)         = Load[dst]                          : &:r250_2, m248_13
 #  250|     r250_4(void *)         = Convert                            : r250_3
 #  250|     r250_5(glval<char *>)  = VariableAddress[src]               : 
 #  250|     r250_6(char *)         = Load[src]                          : &:r250_5, m247_6
 #  250|     r250_7(void *)         = Convert                            : r250_6
 #  250|     r250_8(glval<int>)     = VariableAddress[size]              : 
-#  250|     r250_9(int)            = Load[size]                         : &:r250_8, m247_11
+#  250|     r250_9(int)            = Load[size]                         : &:r250_8, m247_10
 #  250|     r250_10(void *)        = Call[memcpy]                       : func:r250_1, 0:r250_4, 1:r250_7, 2:r250_9
 #  250|     v250_11(void)          = ^SizedBufferReadSideEffect[1]      : &:r250_7, r250_9, ~m249_6
 #  250|     m250_12(unknown)       = ^SizedBufferMustWriteSideEffect[0] : &:r250_4, r250_9
-#  250|     m250_13(unknown)       = Chi                                : total:m249_6, partial:m250_12
+#  250|     m250_13(unknown)       = Chi                                : total:m248_11, partial:m250_12
 #  251|     r251_1(glval<char *>)  = VariableAddress[#return]           : 
 #  251|     r251_2(glval<char *>)  = VariableAddress[dst]               : 
-#  251|     r251_3(char *)         = Load[dst]                          : &:r251_2, m248_14
+#  251|     r251_3(char *)         = Load[dst]                          : &:r251_2, m248_13
 #  251|     m251_4(char *)         = Store[#return]                     : &:r251_1, r251_3
-#  247|     v247_12(void)          = ReturnIndirection[src]             : &:r247_7, ~m250_13
-#  247|     r247_13(glval<char *>) = VariableAddress[#return]           : 
-#  247|     v247_14(void)          = ReturnValue                        : &:r247_13, m251_4
-#  247|     v247_15(void)          = AliasedUse                         : ~m250_13
-#  247|     v247_16(void)          = ExitFunction                       : 
+#  247|     v247_11(void)          = ReturnIndirection[src]             : &:r247_7, m249_6
+#  247|     r247_12(glval<char *>) = VariableAddress[#return]           : 
+#  247|     v247_13(void)          = ReturnValue                        : &:r247_12, m251_4
+#  247|     v247_14(void)          = AliasedUse                         : ~m248_10
+#  247|     v247_15(void)          = ExitFunction                       : 
 
 #  254| char StringLiteralAliasing2(bool)
 #  254|   Block 0
@@ -1206,39 +1202,37 @@ ssa.cpp:
 #  268|     m268_6(void *)         = InitializeParameter[s]             : &:r268_5
 #  268|     r268_7(void *)         = Load[s]                            : &:r268_5, m268_6
 #  268|     m268_8(unknown)        = InitializeIndirection[s]           : &:r268_7
-#  268|     m268_9(unknown)        = Chi                                : total:m268_4, partial:m268_8
-#  268|     r268_10(glval<int>)    = VariableAddress[size]              : 
-#  268|     m268_11(int)           = InitializeParameter[size]          : &:r268_10
+#  268|     r268_9(glval<int>)     = VariableAddress[size]              : 
+#  268|     m268_10(int)           = InitializeParameter[size]          : &:r268_9
 #  269|     r269_1(glval<void *>)  = VariableAddress[buf]               : 
 #  269|     r269_2(glval<unknown>) = FunctionAddress[malloc]            : 
 #  269|     r269_3(glval<int>)     = VariableAddress[size]              : 
-#  269|     r269_4(int)            = Load[size]                         : &:r269_3, m268_11
+#  269|     r269_4(int)            = Load[size]                         : &:r269_3, m268_10
 #  269|     r269_5(void *)         = Call[malloc]                       : func:r269_2, 0:r269_4
-#  269|     m269_6(unknown)        = ^CallSideEffect                    : ~m268_9
-#  269|     m269_7(unknown)        = Chi                                : total:m268_9, partial:m269_6
+#  269|     m269_6(unknown)        = ^CallSideEffect                    : ~m268_4
+#  269|     m269_7(unknown)        = Chi                                : total:m268_4, partial:m269_6
 #  269|     m269_8(unknown)        = ^InitializeDynamicAllocation       : &:r269_5
-#  269|     m269_9(unknown)        = Chi                                : total:m269_7, partial:m269_8
-#  269|     m269_10(void *)        = Store[buf]                         : &:r269_1, r269_5
+#  269|     m269_9(void *)         = Store[buf]                         : &:r269_1, r269_5
 #  270|     r270_1(glval<unknown>) = FunctionAddress[memcpy]            : 
 #  270|     r270_2(glval<void *>)  = VariableAddress[buf]               : 
-#  270|     r270_3(void *)         = Load[buf]                          : &:r270_2, m269_10
+#  270|     r270_3(void *)         = Load[buf]                          : &:r270_2, m269_9
 #  270|     r270_4(glval<void *>)  = VariableAddress[s]                 : 
 #  270|     r270_5(void *)         = Load[s]                            : &:r270_4, m268_6
 #  270|     r270_6(glval<int>)     = VariableAddress[size]              : 
-#  270|     r270_7(int)            = Load[size]                         : &:r270_6, m268_11
+#  270|     r270_7(int)            = Load[size]                         : &:r270_6, m268_10
 #  270|     r270_8(void *)         = Call[memcpy]                       : func:r270_1, 0:r270_3, 1:r270_5, 2:r270_7
-#  270|     v270_9(void)           = ^SizedBufferReadSideEffect[1]      : &:r270_5, r270_7, ~m269_7
+#  270|     v270_9(void)           = ^SizedBufferReadSideEffect[1]      : &:r270_5, r270_7, ~m268_8
 #  270|     m270_10(unknown)       = ^SizedBufferMustWriteSideEffect[0] : &:r270_3, r270_7
-#  270|     m270_11(unknown)       = Chi                                : total:m269_9, partial:m270_10
+#  270|     m270_11(unknown)       = Chi                                : total:m269_8, partial:m270_10
 #  271|     r271_1(glval<void *>)  = VariableAddress[#return]           : 
 #  271|     r271_2(glval<void *>)  = VariableAddress[buf]               : 
-#  271|     r271_3(void *)         = Load[buf]                          : &:r271_2, m269_10
+#  271|     r271_3(void *)         = Load[buf]                          : &:r271_2, m269_9
 #  271|     m271_4(void *)         = Store[#return]                     : &:r271_1, r271_3
-#  268|     v268_12(void)          = ReturnIndirection[s]               : &:r268_7, ~m270_11
-#  268|     r268_13(glval<void *>) = VariableAddress[#return]           : 
-#  268|     v268_14(void)          = ReturnValue                        : &:r268_13, m271_4
-#  268|     v268_15(void)          = AliasedUse                         : ~m270_11
-#  268|     v268_16(void)          = ExitFunction                       : 
+#  268|     v268_11(void)          = ReturnIndirection[s]               : &:r268_7, m268_8
+#  268|     r268_12(glval<void *>) = VariableAddress[#return]           : 
+#  268|     v268_13(void)          = ReturnValue                        : &:r268_12, m271_4
+#  268|     v268_14(void)          = AliasedUse                         : ~m269_7
+#  268|     v268_15(void)          = ExitFunction                       : 
 
 #  275| void EscapedButNotConflated(bool, Point, int)
 #  275|   Block 0