Java/C++/C#: Minor refactor following review comment.

2025-12-21 19:26:31 +01:00 · 2019-10-28 16:31:22 +01:00
parent 379ef1d2f9
commit d0842fc35d
23 changed files with 200 additions and 188 deletions
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
@@ -772,6 +772,9 @@ private module ImplCommon {
  abstract class ReturnKindExt extends TReturnKindExt {
    /** Gets a textual representation of this return kind. */
    abstract string toString();
+
+    /** Gets a node corresponding to data flow out of `call`. */
+    abstract Node getAnOutNode(DataFlowCall call);
  }

  class ValueReturnKind extends ReturnKindExt, TValueReturn {
@@ -782,6 +785,8 @@ private module ImplCommon {
    ReturnKind getKind() { result = kind }

    override string toString() { result = kind.toString() }
+
+    override Node getAnOutNode(DataFlowCall call) { result = getAnOutNode(call, this.getKind()) }
  }

  class ParamUpdateReturnKind extends ReturnKindExt, TParamUpdate {
@@ -792,6 +797,13 @@ private module ImplCommon {
    int getPosition() { result = pos }

    override string toString() { result = "param update " + pos }
+
+    override Node getAnOutNode(DataFlowCall call) {
+      exists(ArgumentNode arg |
+        result.(PostUpdateNode).getPreUpdateNode() = arg and
+        arg.argumentOf(call, this.getPosition())
+      )
+    }
  }

  /** A callable tagged with a relevant return kind. */
@@ -823,15 +835,6 @@ private module ImplCommon {
    )
  }

-  Node getAnOutNodeExt(DataFlowCall call, ReturnKindExt kind) {
-    result = getAnOutNode(call, kind.(ValueReturnKind).getKind())
-    or
-    exists(ArgumentNode arg |
-      result.(PostUpdateNode).getPreUpdateNode() = arg and
-      arg.argumentOf(call, kind.(ParamUpdateReturnKind).getPosition())
-    )
-  }
-
  bindingset[cc, callable]
  predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
    cc instanceof CallContextAny and callable = viableCallable(call)
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
@@ -772,6 +772,9 @@ private module ImplCommon {
  abstract class ReturnKindExt extends TReturnKindExt {
    /** Gets a textual representation of this return kind. */
    abstract string toString();
+
+    /** Gets a node corresponding to data flow out of `call`. */
+    abstract Node getAnOutNode(DataFlowCall call);
  }

  class ValueReturnKind extends ReturnKindExt, TValueReturn {
@@ -782,6 +785,8 @@ private module ImplCommon {
    ReturnKind getKind() { result = kind }

    override string toString() { result = kind.toString() }
+
+    override Node getAnOutNode(DataFlowCall call) { result = getAnOutNode(call, this.getKind()) }
  }

  class ParamUpdateReturnKind extends ReturnKindExt, TParamUpdate {
@@ -792,6 +797,13 @@ private module ImplCommon {
    int getPosition() { result = pos }

    override string toString() { result = "param update " + pos }
+
+    override Node getAnOutNode(DataFlowCall call) {
+      exists(ArgumentNode arg |
+        result.(PostUpdateNode).getPreUpdateNode() = arg and
+        arg.argumentOf(call, this.getPosition())
+      )
+    }
  }

  /** A callable tagged with a relevant return kind. */
@@ -823,15 +835,6 @@ private module ImplCommon {
    )
  }

-  Node getAnOutNodeExt(DataFlowCall call, ReturnKindExt kind) {
-    result = getAnOutNode(call, kind.(ValueReturnKind).getKind())
-    or
-    exists(ArgumentNode arg |
-      result.(PostUpdateNode).getPreUpdateNode() = arg and
-      arg.argumentOf(call, kind.(ParamUpdateReturnKind).getPosition())
-    )
-  }
-
  bindingset[cc, callable]
  predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
    cc instanceof CallContextAny and callable = viableCallable(call)
--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll
+++ b/csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll
@@ -772,6 +772,9 @@ private module ImplCommon {
  abstract class ReturnKindExt extends TReturnKindExt {
    /** Gets a textual representation of this return kind. */
    abstract string toString();
+
+    /** Gets a node corresponding to data flow out of `call`. */
+    abstract Node getAnOutNode(DataFlowCall call);
  }

  class ValueReturnKind extends ReturnKindExt, TValueReturn {
@@ -782,6 +785,8 @@ private module ImplCommon {
    ReturnKind getKind() { result = kind }

    override string toString() { result = kind.toString() }
+
+    override Node getAnOutNode(DataFlowCall call) { result = getAnOutNode(call, this.getKind()) }
  }

  class ParamUpdateReturnKind extends ReturnKindExt, TParamUpdate {
@@ -792,6 +797,13 @@ private module ImplCommon {
    int getPosition() { result = pos }

    override string toString() { result = "param update " + pos }
+
+    override Node getAnOutNode(DataFlowCall call) {
+      exists(ArgumentNode arg |
+        result.(PostUpdateNode).getPreUpdateNode() = arg and
+        arg.argumentOf(call, this.getPosition())
+      )
+    }
  }

  /** A callable tagged with a relevant return kind. */
@@ -823,15 +835,6 @@ private module ImplCommon {
    )
  }

-  Node getAnOutNodeExt(DataFlowCall call, ReturnKindExt kind) {
-    result = getAnOutNode(call, kind.(ValueReturnKind).getKind())
-    or
-    exists(ArgumentNode arg |
-      result.(PostUpdateNode).getPreUpdateNode() = arg and
-      arg.argumentOf(call, kind.(ParamUpdateReturnKind).getPosition())
-    )
-  }
-
  bindingset[cc, callable]
  predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
    cc instanceof CallContextAny and callable = viableCallable(call)
--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
@@ -317,7 +317,7 @@ private predicate nodeCandFwd1(Node node, Configuration config) {
    exists(DataFlowCall call, ReturnNodeExt ret, ReturnKindExt kind |
      nodeCandFwd1(ret, config) and
      getReturnPosition(ret) = viableReturnPos(call, kind) and
-      node = getAnOutNodeExt(call, kind)
+      node = kind.getAnOutNode(call)
    )
  )
 }
@@ -409,7 +409,7 @@ private predicate nodeCand1ReturnPosition(ReturnPosition pos, Configuration conf
  exists(DataFlowCall call, ReturnKindExt kind, Node out |
    nodeCand1(out, config) and
    pos = viableReturnPos(call, kind) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -576,7 +576,7 @@ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config
  not inBarrier(node2, config) and
  exists(DataFlowCall call, ReturnKindExt kind |
    getReturnPosition1(node1, unbind(config)) = viableReturnPos(call, kind) and
-    node2 = getAnOutNodeExt(call, kind)
+    node2 = kind.getAnOutNode(call)
  )
 }

@@ -1806,7 +1806,7 @@ private predicate pathOutOfCallable1(
 pragma[noinline]
 private predicate pathOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
  exists(ReturnKindExt kind, DataFlowCall call | pathOutOfCallable1(mid, call, kind, cc) |
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1905,7 +1905,7 @@ pragma[noinline]
 private predicate pathThroughCallable(PathNodeMid mid, Node out, CallContext cc, AccessPathNil apnil) {
  exists(DataFlowCall call, ReturnKindExt kind |
    pathThroughCallable0(call, mid, kind, cc, apnil) and
-    out = getAnOutNodeExt(call, kind)
+    out = kind.getAnOutNode(call)
  )
 }

@@ -1965,7 +1965,7 @@ private module FlowExploration {
      // flow out of a callable
      exists(DataFlowCall call, ReturnKindExt kind |
        getReturnPosition(node1) = viableReturnPos(call, kind) and
-        node2 = getAnOutNodeExt(call, kind)
+        node2 = kind.getAnOutNode(call)
      )
    |
      c1 = node1.getEnclosingCallable() and
@@ -2287,7 +2287,7 @@ private module FlowExploration {
    exists(ReturnKindExt kind, DataFlowCall call |
      partialPathOutOfCallable1(mid, call, kind, cc, ap, config)
    |
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

@@ -2370,7 +2370,7 @@ private module FlowExploration {
  ) {
    exists(DataFlowCall call, ReturnKindExt kind |
      partialPathThroughCallable0(call, mid, kind, cc, apnil, config) and
-      out = getAnOutNodeExt(call, kind)
+      out = kind.getAnOutNode(call)
    )
  }

--- a/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll
+++ b/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll
@@ -772,6 +772,9 @@ private module ImplCommon {
  abstract class ReturnKindExt extends TReturnKindExt {
    /** Gets a textual representation of this return kind. */
    abstract string toString();
+
+    /** Gets a node corresponding to data flow out of `call`. */
+    abstract Node getAnOutNode(DataFlowCall call);
  }

  class ValueReturnKind extends ReturnKindExt, TValueReturn {
@@ -782,6 +785,8 @@ private module ImplCommon {
    ReturnKind getKind() { result = kind }

    override string toString() { result = kind.toString() }
+
+    override Node getAnOutNode(DataFlowCall call) { result = getAnOutNode(call, this.getKind()) }
  }

  class ParamUpdateReturnKind extends ReturnKindExt, TParamUpdate {
@@ -792,6 +797,13 @@ private module ImplCommon {
    int getPosition() { result = pos }

    override string toString() { result = "param update " + pos }
+
+    override Node getAnOutNode(DataFlowCall call) {
+      exists(ArgumentNode arg |
+        result.(PostUpdateNode).getPreUpdateNode() = arg and
+        arg.argumentOf(call, this.getPosition())
+      )
+    }
  }

  /** A callable tagged with a relevant return kind. */
@@ -823,15 +835,6 @@ private module ImplCommon {
    )
  }

-  Node getAnOutNodeExt(DataFlowCall call, ReturnKindExt kind) {
-    result = getAnOutNode(call, kind.(ValueReturnKind).getKind())
-    or
-    exists(ArgumentNode arg |
-      result.(PostUpdateNode).getPreUpdateNode() = arg and
-      arg.argumentOf(call, kind.(ParamUpdateReturnKind).getPosition())
-    )
-  }
-
  bindingset[cc, callable]
  predicate resolveReturn(CallContext cc, DataFlowCallable callable, DataFlowCall call) {
    cc instanceof CallContextAny and callable = viableCallable(call)